Malicious AI Skills Amass 1.7 Million Installs as Attackers Target AI Agent Supply Chain

Malicious AI skills hit 1.7 million installs

The classic supply-chain hack just got an AI twist. Attackers uploaded harmless-looking "skills" for AI agents, waited for the downloads to pile up, then turned the agents into thieves. Security researchers at Zenity Labs uncovered a credential-stealing campaign on skills.sh, a public registry of add-ons for AI agents run by Vercel. They unveiled the research at the Black Hat conference. Attackers had cloned real skills into typosquatted look-alikes. One tainted family racked up over 1.7 million installs, though Zenity stresses that is aggregate downloads, not unique victims. The trick was patience. The fake skills sat clean while they built trust and install counts. Only later did the attackers slip in malicious instructions. Those told the AI agents to hunt down SSH keys, cloud credentials, database logins and access tokens, bundle them with the machine's details, and ship them to attacker servers. The agent becomes the weapon That is what sets this apart from an ordinary supply-chain attack. A skill is just instructions, and an agent's whole job is to follow instructions from the content it is handed. So the same obedience that makes agents useful becomes the attack surface. More than 30% of the dangerous skills abused Claude Code and OpenClaw to drop malware. Some went further, into self-preservation. One skill told the agent to rewrite its own system prompt so it would reinstall itself if deleted. Another quietly uninstalled Claude's built-in skill-creator and swapped in a copycat, without telling the user. Zenity also found hundreds of empty, reserved package names, staged for future attacks. Cleaned up, but not gone After Zenity's disclosure, Vercel and Microsoft's GitHub pulled the offending skills, listings and repositories within 12 hours. That is the good news. The bad news is that copied instructions can linger in downstream repos and on machines. Anyone who already installed one has to remove it by hand. The episode widens what "supply chain" means. For an AI agent it is no longer just code libraries, but skills, tools, MCP servers and any web page it reads. Each is a place to hide an instruction that makes the agent act against its user. The industry keeps relearning this as agents take unauthorised actions. There is a commercial edge to note. Zenity sells agent security, and its fix doubles as a pitch: a free tool, AI Total, that "detonates" a skill in a sandbox to watch what it really does. Even so, the core point is hard to argue with. As CTO Michael Bargury put it, the most dangerous skills "appear benign" until they run.

Experts warn malicious AI skills are hitting more victims than ever -- with one family amassing 1.7 million downloads

* Attackers cloned AI skills, later adding malicious code to steal credentials * Zenity Labs found millions of installs and dozens of dangerous skill variants * Vercel and Microsoft removed malicious skills, but manual removal is still required AI skills, instructions that teach AI agents how to do certain tasks and thus extend their capabilities, are increasingly being used in supply chain attacks, researchers have found. Security experts at Zenity Labs uncovered a credential-stealing campaign on skills.sh, a public registry (essentially an app store) for AI agent skills. In the registry, belonging to Vercel (a cloud platform for web applications), threat actors were cloning existing skills, creating typosquatted lookalikes which, at first, did nothing malicious. However, after a little time had past, and the skills amassed a solid download count, the attackers introduced malicious code instructing the AI agents to, among other things, exfiltrate SSH keys, cloud credentials, Git and package manager tokens, Kubernetes and Docker configurations, database credentials, infrastructure-as-code credentials, environment files and service account files. The agents were then told to package the stolen information with host metadata and send it to the attackers. Dozens of malicious skills While Zenity Labs could not say exactly how many people fell victim to this attack, they did stress that a single skill family amassed more than 1.7 million aggregate installs (not unique users). And that is just one skill family, in a sea of malicious skills. The researchers also said they found "dozens" of additional skills exhibiting either malicious or dangerous behavior. Almost a third (30%) of identified dangerous skills abused Claude Code and OpenClaw to drop malware to their targets, as well. Also, Zenity found "hundreds" of reserved and empty package names that were being kept for future attacks. These findings show how quickly cybercriminals adapt, and how creative they can get when it comes to abusing new tech. In essence, this campaign is an AI spin on a software supply-chain attack, being similar in spirit to incidents where attackers compromise an existing trusted package or repository, and later push a malicious update. Following responsible disclosure, Vercel and Microsoft removed the identified skills, but Zenity warns that those who installed them before won't be safe until they remove them from their systems manually. Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.