AI Agent Skill Bypass Exploits Security Scanners, Reaches 26,000 Agents

Security firm AIR demonstrated that a malicious AI agent skill could evade every major security scanner and be installed on roughly 26,000 corporate agents. The fabricated skill, dubbed "brand‑landingpage," was promoted through an Instagram ad and submitted to a popular skill marketplace, where it benefited from high GitHub star counts and clean scanner verdicts. All tested scanners, including those from Cisco and NVIDIA, marked the skill safe because they only examined the static package submitted for review.

The skill contained no harmful code itself; instead it instructed the agent to fetch and run instructions from an external URL controlled by AIR. After the skill passed review and widespread installation, the external page was swapped to deliver a payload that could collect email addresses and, in a real attack, potentially read files or move data. Anthropic’s documentation warns that skills fetching external URLs are inherently risky, a weakness AIR’s experiment exposed. The finding highlights a structural flaw in the AI agent ecosystem: scanners assess a snapshot, while external links can be altered post‑approval, rendering traditional trust signals such as GitHub stars unreliable.