The mechanism is thinner than dependency confusion and does not need a typo. A vendor publishes an llms.txt or llms-full.txt file for machine readers. An agent fetches it, finds a package name or a domain, and installs or resolves it. If nobody ever registered that name, the first person who does becomes the vendor of record for every agent that reads the file [3]. Classic dependency confusion requires guessing an internal package name. Typosquatting requires the victim to mistype. Here the target publishes the exact string and, per researcher Alon Hertz, nothing in the chain checks it: "Agents treat vendor docs as ground truth and don't question them, and neither do the humans supervising them" [9].
The density is worth the arithmetic. 120 affected sites across 6,214 scanned domains is one in 52, or 1.9 percent [12]. The file count runs ahead of the domain count because many sites publish both variants, 8,265 files over 6,214 domains, about 1.33 per domain [13][2].
Response time is the part that matters operationally. The first phone-home landed inside an hour [5], and a few dozen followed from a handful of registered names [4][6]. The source does not say how many names the researchers claimed, so the yield per name cannot be computed. It also carries no calendar dates for the scan or the beacon window, only "within an hour" and "over time" [14].
What the beacon data proves is narrower than the framing around it. The parent-process chain identifies which agent spawned each install, Claude, OpenAI's Codex, and Nous Research's Hermes [7], without recording whether a human clicked approve on any of them [15]. Anthropic, OpenAI and Nous Research had not responded to comment requests at publication [8], so the question of whether these agents fetch and execute doc-sourced names without confirmation is open.
Whether a hostile actor got to those names first remains unconfirmed. Bruce Schneier's read is an unverified forecast: he expects this to be exploited and points at SolarWinds-style supply chain attacks [11]. Hertz makes the growth argument, that agents are multiplying across SaaS, cloud and endpoint faster than the guards that would cover them [10].
The cheap control sits with whoever owns the doc, because the outside scan and the inside audit are the same scan. Any reference in your own llms.txt that resolves to nothing is a name someone else can register, and the code lands on your readers' machines under your documentation's authority.
