Fake Agent Skill Slips Past Every Scanner, Lands on 26,000 AI Agents

Key points

• AIR built a fake AI agent skill and distributed it through a skill marketplace and a paid Instagram ad.
• The skill passed every security scanner tested and reached roughly 26,000 agents, some on corporate accounts.
• The payload collected only the user's email address and retained nothing beyond the test.
• Scanning tools look for known-bad patterns and can't reason about what a skill is empowered to do once an agent grants it access.
• AIR has not publicly named the marketplace or the affected vendors.

Security firm AIR built a malicious AI agent skill, submitted it to a popular skill marketplace, and watched it land in roughly 26,000 agents. Some of those agents belonged to corporate accounts. Every security scanner the firm tested it against called it safe.

The payload was benign by design. It collected the user's email address and stopped there. That restraint was the whole point: show that a skill doing almost nothing is indistinguishable, to a scanner, from one that's waiting.

How did one Instagram ad reach 26,000 agents?

AIR submitted the skill and it passed marketplace review. The firm then ran a low-budget Instagram ad pointing at the listing. Installations followed. Twenty-six thousand agents from a single paid promotion, no exploit, no phishing infrastructure, no credential theft, no technical sophistication beyond writing a skill and buying an ad.

Ransomware affiliates would take that distribution number without complaint.

Why didn't the scanners catch it?

The scanning tools that marketplaces and enterprises use to vet agent skills are built for pattern-matching against known-bad behaviour. They're not reasoning about what a skill is authorised to do once an agent hands it inbox access, SaaS connectors or calendar permissions. A skill that does almost nothing looks identical to a skill that is waiting.

The browser-extension parallel is close. Extension stores spent years fighting attacks where benign code passed review and a later update, or a dormant capability, did the damage. Agent skill marketplaces are building the same architecture with the same review limits, only the reach into a user's accounts is wider than any extension managed. We first covered the agent-skills distribution risk on 23 June 2026; this experiment confirms it's no longer theoretical.

Should you worry about corporate exposure?

AIR says a portion of the 26,000 agents ran on organisational accounts. A hypothetical malicious version would have inherited whatever permissions employees granted their agents, which often includes inbox access and connections to SaaS platforms. Static and behavioural analysis built for traditional app stores doesn't translate cleanly to agent skills, where capability flows from prompts and granted scopes rather than compiled code.

Neither the marketplace AIR used nor the affected vendors have been named in the firm's disclosure. AIR says the email addresses collected were not retained.

The technique will be repeated. The next researcher to try it may not have benign intentions, and the scanners won't know the difference.