Loading story…
OWASP has published a final Top 10 list of security risks for agentic AI skills and introduced the Universal Agentic Skill Format v1.0, warning that malicious skills and supply-chain compromise are the most urgent threats facing enterprise AI agents. The guidance highlights how untrusted external instructions, overprivileged skills, and weak visibility into deployed agents can let attackers abuse legitimate automation paths rather than relying on classic prompt injection alone.
The release follows public demonstrations showing how a single weaponized skill or plugin can compromise agents at scale. Researchers described a campaign in which a malicious skill distributed through an Instagram ad reportedly led to the hijacking of 26,000 agents, while another proof of concept showed an unofficial Claude Code marketplace plugin coercing an AI coding assistant to install a trojanized httpx package from an attacker-controlled source. OWASP and industry practitioners said such attacks can steal credentials, persist through dependency manipulation, and evade detection unless organizations inventory agent usage and can rapidly disable malicious skills across their environments.
Track how attackers are adapting to this technology.
6 events from the most recent confirmed update back to the earliest known activity.
Research published on August 6 reported that Trojanized skills tied to the Paperclip-themed campaign had accumulated more than 300,000 installs each.
In August 2026, OWASP released the final Agentic Skills Top 10 list and the Universal Agentic Skill Format v1.0, identifying Malicious Skills as the top risk and Supply Chain Compromise as the second-highest risk.
During the July 2026 Paperclip-themed attack, automated scanners detected the Trojanized Python packages within hours, while the malicious skills reportedly evaded detection.
In early July 2026, an attacker registered a look-alike domain impersonating the Paperclip agentic AI work platform as part of an attack using Trojanized Python packages and weaponized AI skills to steal credentials and other sensitive information.
Air reported that it manipulated a repository system to give an experimental repository a high star count, and said this affected 26,000 agents within hours.
Prompt Security described a supply-chain attack scenario in which a malicious "Python Dependency Helper" plugin from an unofficial marketplace causes an AI coding assistant to install a trojanized version of the Python library httpx from an attacker-controlled source and persist it in dependency manifests.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
3 references tracked. Mallory keeps watching after this page renders.
darkreading.com
Open sourceair.security
Open sourceprompt.security
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported that the emerging AI agent ecosystem is being abused to distribute malicious tools at scale, with one campaign involving trojanized AI skills reaching **1.7 million installs** in an attack aimed at AI agents. The activity highlights how agents that can autonomously discover and install new capabilities are becoming a new software supply-chain target, particularly where marketplaces, repositories, and MCP servers lack mature vetting and integrity controls. Island said its research found **thousands of malicious repositories** and widespread security flaws across MCP servers, alongside a technique dubbed **"AgentBaiting"** that tricks AI agents into locating and recommending malware to users. The findings underscore a growing enterprise risk in which attackers can poison the AI toolchain itself, forcing organizations to strengthen governance over which agent skills, tools, and external services can be discovered, trusted, and deployed.
Aug 7, 2026
Security researchers are warning that *AI agent “Skills”* (markdown/YAML instruction packages that extend agent capabilities) are becoming a **supply-chain risk** due to hidden prompt-injection content that can survive human review. A demonstrated technique uses **invisible Unicode Tag codepoints** embedded in skill files to smuggle instructions that some models interpret as executable guidance, enabling outcomes such as **data exfiltration**, prompt injection, and other malicious behavior when the skill is invoked; a basic scanner was also built to help detect these hidden-instruction patterns. Separate reporting highlighted broader evidence of the same threat pattern across agent ecosystems: Simula Research Laboratory identified **hidden prompt-injection attacks** in a measurable portion of sampled content on a platform referenced as Moltbook, and Cisco researchers documented a malicious agent skill (“**What Would Elon Do?**”) that **exfiltrated data to external servers** while being artificially boosted to appear as a top-ranked skill. Researchers also anticipate the emergence of **self-replicating adversarial prompts** (“prompt worms/viruses”) that could propagate through networks of communicating AI agents, amplifying the impact of compromised skills and poisoned instruction content.
Jun 29, 2026
A researcher demonstrated that a fake AI agent skill called **`brand-landingpage`** could pass marketplace security checks and spread widely by exploiting a blind spot in how agent skills are reviewed. The skill offered legitimate landing-page functionality, was promoted through open marketplaces, GitHub repositories, and social media, and was reportedly installed by about **26,000 AI agents**, including some linked to enterprise accounts. According to the reports, the package itself appeared benign and cleared tested scanners because the harmful behavior was not embedded in the submitted code. Instead, the skill pointed agents to externally hosted documentation that was modified after approval to instruct them to download and execute a script, demonstrating a supply-chain style attack against AI agent ecosystems. In the controlled test, the script only exfiltrated user email addresses, but the researcher said the same technique could enable arbitrary code execution, broader data theft, and persistent access depending on agent privileges. The findings align with prior warnings from other researchers that static scanning misses mutable external links, and they prompted recommendations to inventory installed skills, restrict approved sources, continuously revalidate linked content, pin versions, and enforce least privilege.
Jun 29, 2026