Malicious AI capabilities transformed agents into large-scale credential theft perpetrators.

      Security researchers from Zenity Labs discovered a credential-stealing operation on skills.sh, a public registry for AI agent add-ons managed by Vercel. They presented their findings at the Black Hat conference. The attackers had created clones of legitimate skills with look-alikes that contained typographical errors.

      One compromised group amassed more than 1.7 million installs, although Zenity notes this figure reflects total downloads rather than unique victims. The key to their strategy was patience; these fake skills remained clean while they garnered trust and accumulated installations. It wasn't until later that the attackers inserted harmful instructions. These directions prompted the AI agents to seek out SSH keys, cloud credentials, database logins, and access tokens, then package them along with the machine’s information and send them to the attackers' servers.

      Transforming the agent into a weapon

      This aspect distinguishes it from a typical supply-chain attack. A skill consists of instructions, and the primary role of an agent is to execute the commands it receives. Consequently, the same compliance that makes agents beneficial also creates a potential vulnerability for attacks.

      Over 30% of the malicious skills exploited Claude Code and OpenClaw to deploy malware. Some even took measures for self-preservation. One skill instructed the agent to modify its own system prompt to ensure it would reinstall itself if deleted. Another skill discreetly removed Claude’s built-in skill creator and replaced it with a counterfeit, without notifying the user. Zenity also identified numerous empty, reserved package names, prepared for potential future attacks.

      Addressed but not eradicated

      Following Zenity’s report, Vercel and Microsoft’s GitHub removed the problematic skills, listings, and repositories within 12 hours. This is the positive aspect. The negative side is that the copied instructions may persist in downstream repositories and on users' devices. Anyone who has already installed one must manually remove it.

      This incident expands the definition of “supply chain.” For AI agents, it now encompasses more than just code libraries; it includes skills, tools, MCP servers, and any webpage they access. Each of these can serve as a hiding spot for an instruction prompting the agent to act against its user. The industry continues to encounter this issue as agents perform unauthorized actions.

      There is also a commercial aspect to consider. Zenity offers agent security, with its solution doubling as a promotion for a free tool, AI Total, which "detonates" a skill in a sandbox to observe its true behavior. Nonetheless, the main point remains difficult to dispute. As CTO Michael Bargury stated, the most dangerous skills "seem harmless" until they are activated.