llms.txt audit finds no isolated effect on AI search security
Original title: Manifest-Assisted Retrieval in Artificial Intelligence Search: Evidence Gaps and a Security Evaluation
A 120-response pilot found attacker-target adoption in 21 of 24 raw adversarial replies when evidence was supplied.
A non-systematic audit found no isolated security or utility effect from consuming /llms.txt while ordinary retrieval stayed fixed. The initial review covered 39 sources through August 16, 2026, with targeted updates through October 14. A 15-tool study saw no automatic requests in 45 trials, and 97% of domains with detected files had no recorded requests in May 2026. A pilot of 24 tasks, five conditions and 120 model responses measured output changes without live retrieval; the adversarial URLs-only condition had no known adoptions.
Unconfirmed: The audit is non-systematic, so it does not establish how often live agents fetch manifests.
- Frozen scoring left one further raw adversarial response unresolved.
- The URLs-only condition also had one unresolved response.
- Authors define five operational threat paths and paired estimands.
- Pre-model controls were exercised with 30 author-defined parser fixtures.
- Full retrieval and agent evaluation are left open.
From the original article
1 min read at arxiv.orgThe external sources retained in our non-systematic audit did not isolate the incremental security or utility effect of consuming /llms. txt while ordinary retrieval remained fixed. The initial audit covered 39 sources through August 16, 2026, with later targeted updates through October 14.
By Gangzhen Qian · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.