Fake Agent Skill Slips Past Every Scanner, Lands on 26,000 AI Agents

A security firm spent a few dollars on Instagram and walked a malicious AI agent skill into roughly 26,000 agents, some of them on corporate accounts.

The firm, AIR, designed the experiment as a supply-chain test for the fast-growing market in third-party skills for AI assistants. The payload was deliberately benign. It harvested the user's email address. Nothing else.

That was the point.

AIR submitted the skill to a popular skill marketplace, where it passed review. The firm then ran an Instagram ad pointing at the listing. Installations followed. By the firm's count, the skill ended up wired into around 26,000 agents, a portion of them tied to business accounts rather than consumer hobbyists.

Every security scanner AIR tested the skill against rated it safe.

The firm's argument is straightforward: the scanning tools that marketplaces and enterprises rely on to vet agent skills are pattern-matching for known-bad behaviour, not reasoning about what a skill is empowered to do once an agent grants it access to email, calendars, files or browser sessions. A skill that does almost nothing looks identical, to a scanner, to a skill that is waiting.

The parallel to the browser-extension economy is hard to miss. Extension stores have spent a decade fighting low-effort distribution attacks where benign code passes review and a later update — or a dormant capability — does the damage. Agent skill marketplaces are now standing up the same architecture, with the same review limitations, against tooling that has far broader reach into a user's accounts than a browser extension ever did.

Neither the marketplace AIR used nor the affected vendors have been publicly named in the firm's disclosure so far. AIR has framed the work as a proof of concept rather than an attack, and says the email addresses collected were not retained beyond the test.

A few things worth flagging for defenders.

First, the install count. 26,000 agents from a single low-budget ad campaign is a distribution number that ransomware affiliates would be happy with, and it was achieved without any exploit, credential theft or phishing infrastructure. Just a listing and a paid promo.

Second, the corporate footprint. AIR says some of the agents running its skill belonged to organisational accounts, which means a hypothetical malicious version would have inherited whatever permissions employees handed their agents. In practice, that often includes inbox access and SaaS connectors.

Third, the scanner gap. Static and behavioural analysis built for traditional app stores does not translate cleanly to agent skills, where capability flows from prompts and granted scopes rather than compiled code.

Expect to see this technique repeated by people whose payloads are not benign.