{"id":1421,"date":"2026-06-23T17:14:53","date_gmt":"2026-06-23T17:14:53","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=1421"},"modified":"2026-06-23T17:14:53","modified_gmt":"2026-06-23T17:14:53","slug":"fake-ai-agent-skill-passed-security-scans-and-reportedly-reached-26000-agents","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=1421","title":{"rendered":"Fake AI Agent Skill Passed Security Scans and Reportedly Reached 26,000 Agents"},"content":{"rendered":"
\n
<\/a><\/div>\n

Security firm\u00a0AIR\u00a0built a fake AI agent skill, pushed it through a popular skill marketplace and an Instagram ad, and says it reached roughly 26,000 agents, including some on corporate accounts.<\/p>\n

Every skill security scanner the firm tested it against marked it safe. The payload was harmless by design: it collected the user’s email address and did nothing else.<\/p>\n

The point was to show that none of the signals people lean on to trust a skill caught it: not the scanners, not the GitHub stars, not the open-source reputation.<\/p>\n

A skill is a bundle of instructions an agent loads into its own context and follows with roughly the authority of a user prompt. That trust is the whole problem, and it is the reason skill-scanning tools exist in the first place.<\/p>\n

The skill, named\u00a0brand-landingpage<\/b>, claimed to build a landing page using Google’s Stitch design tool, aimed squarely at non-technical users.<\/p>\n

To make it look credible, AIR went after two trust signals: GitHub stars and a clean scanner verdict. For the stars, it opened a pull request to a skill marketplace repository with around 36,000 stars and 156 skills.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The pull request was merged after a few days, so the skill inherited the repo’s count. Then it ran an Instagram ad aimed at marketers, salespeople, and designers, who installed it and put it to work.<\/p>\n

Why the scanners missed it<\/h2>\n

<\/p>\n

The scanners AIR tested analyze the package you hand them: the SKILL.md and the files shipped with it. That’s\u00a0Cisco’s<\/a>,\u00a0NVIDIA’s<\/a>, and the ones wired into skills.sh.<\/p>\n

AIR’s skill<\/a> carried no setup instructions of its own. It told the agent to install the \u00abStitch SDK\u00bb by following the documentation at an external link,\u00a0stitch-design.ai, a domain AIR controls, not Google (the real Stitch lives at\u00a0stitch.withgoogle.com).<\/p>\n

At first, the link led to the genuine Stitch docs, so the scanners, seeing a clean package that pointed at a plausible setup page, cleared it. The page the agent would actually fetch and follow sat outside the scan.<\/p>\n

\"\"<\/a><\/div>\n

Once the skill was installed widely, AIR swapped the page behind that link. The new version told the agent to download and run a script.<\/p>\n

In the demo, it only mailed the user’s address back to AIR, which is how the firm counted the agents it reached. A real operator could have used that foothold to read files, move data, or hit internal systems, bounded only by what the agent could reach.<\/p>\n

AIR is not the first to show this. Three weeks earlier,\u00a0Trail of Bits<\/a>\u00a0bypassed ClawHub’s malicious-skill detector, Cisco’s scanner, and all three scanners wired into skills.sh. Its conclusion was blunt: a scanner checks a fixed package, while an attacker can keep tweaking the payload until it passes.<\/p>\n

Real campaigns have used the same\u00a0trick\u00a0for months, keeping the submitted skill clean and hosting the payload on a site the agent only fetches at install.<\/p>\n

\"\"<\/a><\/div>\n

The problem is structural: the scan happens once, but the page a skill points the agent to can be rewritten at any time after. Anthropic’s own\u00a0docs<\/a>\u00a0already warn that skills fetching external URLs are risky for exactly this reason, since the content can change after the skill is vetted.<\/p>\n

Separate\u00a0research this year<\/a>\u00a0found scanners often disagree, because each one judges a skill in isolation, blind to its external links and to what changes after review.<\/p>\n

What to do<\/h2>\n

The read for defenders is the same one researchers keep landing on, now with a sharper example behind it. Treat skills as software, not text. Vet what a skill points to, not just what ships inside it.<\/p>\n

Most of these add-ons got installed with no review, so the first job is finding what is already running. Route new skills through a single source you control, and re-check them when anything changes, because a clean result at install does not stay clean if the skill phones out to a link someone else can edit.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Pin versions. Hold agents to the least privilege. Assume any external instruction an agent fetches runs with the agent’s access.<\/p>\n

The scale figures come from AIR alone, and they deserve a skeptical read. The firm is launching a managed skill marketplace and closes the write-up, pitching it, so the 26,000 number, the corporate-account detail, and the claim that it could have seized full control of every agent are the company’s own and are not independently confirmed.<\/p>\n

What holds up is the method. The named scanners really do judge only the submitted package, the external-link blind spot is real and has been independently demonstrated, and the trust signals AIR borrowed, stars, and a clean scan are exactly the ones the ecosystem still treats as proof.<\/p>\n

The experiment does not expose a new bug so much as it lines up every weak trust signal around agent skills into one run: stars that can be borrowed, a scan that reads a snapshot, and a link that can be rewritten after the check clears.<\/p>\n

Whether the real figure is 26,000 or a fraction of it, the gap it walks through is one that defenders still have not closed.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

Security firm\u00a0AIR\u00a0built a fake AI agent skill, pushed it through a popular skill marketplace and an Instagram ad, and says it reached roughly 26,000 agents, including some on corporate accounts.…<\/p>\n","protected":false},"author":1,"featured_media":1422,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[683,335,150,2160,2163,2162,2161,47,2159],"class_list":["post-1421","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-agent","tag-agents","tag-fake","tag-passed","tag-reached","tag-reportedly","tag-scans","tag-security","tag-skill"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/1421","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1421"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/1421\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/1422"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1421"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1421"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1421"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}