{"id":743426,"date":"2026-08-09T08:50:24","date_gmt":"2026-08-09T05:50:24","guid":{"rendered":"https:\/\/buradabiliyorum.com\/en\/malicious-ai-skills-turned-agents-into-credential-thieves-at-scale\/"},"modified":"2026-08-09T08:50:24","modified_gmt":"2026-08-09T05:50:24","slug":"malicious-ai-skills-turned-agents-into-credential-thieves-at-scale","status":"publish","type":"post","link":"https:\/\/buradabiliyorum.com\/en\/malicious-ai-skills-turned-agents-into-credential-thieves-at-scale\/","title":{"rendered":"Malicious AI \u2018skills\u2019 turned agents into credential thieves, at scale"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_89 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<label for=\"ez-toc-cssicon-toggle-item-6aeddab811441\" class=\"ez-toc-cssicon-toggle-label\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #dd3333;color:#dd3333\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #dd3333;color:#dd3333\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input type=\"checkbox\"  id=\"ez-toc-cssicon-toggle-item-6aeddab811441\" checked aria-label=\"Toggle\" \/><nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/buradabiliyorum.com\/en\/malicious-ai-skills-turned-agents-into-credential-thieves-at-scale\/#The_agent_becomes_the_weapon\" >The agent becomes the weapon<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/buradabiliyorum.com\/en\/malicious-ai-skills-turned-agents-into-credential-thieves-at-scale\/#Cleaned_up_but_not_gone\" >Cleaned up, but not gone<\/a><\/li><\/ul><\/nav><\/div>\n<p><img decoding=\"async\" src=\"https:\/\/media.thenextweb.com\/2026\/08\/zenity-ai.avif\" \/><\/p>\n<div id=\"article-main-content\">\n<p>Security researchers at Zenity Labs uncovered a credential-stealing campaign on skills.sh, a public registry of add-ons for AI agents run by Vercel. They unveiled the <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/www.businesswire.com\/news\/home\/20260806707467\/en\/Zenity-Labs-Uncovers-1.7-Million-Install-Malicious-Skills-Campaign-and-Dozens-of-Malicious-AI-Agent-Skills\" target=\"_blank\" rel=\"nofollow noopener\">research<\/a> at the Black Hat conference. Attackers had cloned real skills into typosquatted look-alikes.<\/p>\n<p>One tainted family racked up over 1.7 million installs, though Zenity stresses that is aggregate <a href=\"https:\/\/buradabiliyorum.com\/en\/category\/download-scripts-themes-apps\/\" data-internallinksmanager029f6b8e52c=\"9\" title=\"Download Scripts &amp; Themes &amp; Apps\" target=\"_blank\" rel=\"noopener\">download<\/a>s, not unique victims.<\/p>\n<p>The trick was patience. The fake skills sat clean while they built trust and install counts. Only later did the attackers slip in malicious instructions. Those told the AI agents to hunt down SSH keys, cloud credentials, database logins and access tokens, bundle them with the machine\u2019s details, and <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/www.techradar.com\/pro\/security\/experts-warn-malicious-ai-skills-are-hitting-more-victims-than-ever-with-one-family-amassing-1-7-million-downloads\" target=\"_blank\" rel=\"nofollow noopener\">ship them<\/a> to attacker servers.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"The_agent_becomes_the_weapon\"><\/span>The agent becomes the weapon<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>That is what sets this apart from an ordinary supply-chain attack. A skill is just instructions, and an agent\u2019s whole job is to follow instructions from the content it is handed. So the same obedience that makes agents useful becomes the attack surface.<\/p>\n<p>More than 30% of the dangerous skills abused Claude Code and OpenClaw to drop malware.<\/p>\n<p>Some went further, into self-preservation.<\/p>\n<p>One skill told the agent to rewrite its own system prompt so it would reinstall itself if deleted. Another quietly uninstalled Claude\u2019s built-in skill-creator and swapped in a copycat, without telling the user. Zenity also found hundreds of empty, reserved package names, staged for future attacks.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Cleaned_up_but_not_gone\"><\/span>Cleaned up, but not gone<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>After Zenity\u2019s disclosure, Vercel and Microsoft\u2019s GitHub pulled the offending skills, listings and repositories within 12 hours. That is the good <a href=\"https:\/\/buradabiliyorum.com\/en\/category\/news\/\" data-internallinksmanager029f6b8e52c=\"2\" title=\"News\" target=\"_blank\" rel=\"noopener\">news<\/a>. The bad news is that copied instructions can linger in downstream repos and on machines. Anyone who already installed one has to remove it by hand.<\/p>\n<p>The episode widens what \u201csupply chain\u201d means. For an AI agent it is no longer just code libraries, but skills, tools, MCP servers and any web page it reads. Each is a place to hide an instruction that makes the agent act against its user. The industry keeps relearning this as agents take unauthorised actions.<\/p>\n<p>There is a commercial edge to note. Zenity sells agent security, and its fix doubles as a pitch: a free tool, AI Total, that \u201cdetonates\u201d a skill in a sandbox to watch what it really does. Even so, the core point is hard to argue with. As CTO Michael Bargury put it, the most dangerous skills \u201cappear benign\u201d until they run.<\/p>\n<\/p><\/div>\n<blockquote><p><strong><span style=\"color: #ff6600;\">If you liked the article, do not forget to share it with your friends. Follow us on\u00a0<span style=\"color: #ff0000;\"><a style=\"color: #ff0000;\" href=\"https:\/\/news.google.com\/publications\/CAAqBwgKMN63nwsw68G3Aw\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Google News<\/a><\/span>\u00a0too, click on the star and choose us from your favorites.<\/span><\/strong><\/p><\/blockquote>\n<blockquote>\n<p style=\"text-align: center;\"><strong>If you want to read more like this article, you can visit our <span style=\"color: #ff9900;\"><a style=\"color: #ff9900;\" href=\"https:\/\/buradabiliyorum.com\/en\/category\/technology\/\" target=\"_blank\" >Technology category.<\/a><\/span><\/strong><\/p>\n<\/blockquote>\n<p><span style=\"color: black;\"><a style=\"color: #ff9900;\" href=\"https:\/\/thenextweb.com\/news\/zenity-malicious-ai-skills-1-7m-installs-supply-chain-credential-theft\" target=\"_blank\" >Source<\/a><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Security researchers at Zenity Labs uncovered a credential-stealing campaign on skills.sh, a public registry of add-ons for AI agents run by Vercel. They unveiled the research at the Black Hat conference. Attackers had cloned real skills into typosquatted look-alikes. One tainted family racked up over 1.7 million installs, though Zenity stresses that is aggregate downloads,&#8230;<\/p>\n","protected":false},"author":1,"featured_media":743427,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/media.thenextweb.com\/2026\/08\/zenity-ai.jpg","fifu_image_alt":"","footnotes":""},"categories":[18],"tags":[],"class_list":["post-743426","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology"],"_links":{"self":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/743426","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/comments?post=743426"}],"version-history":[{"count":0,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/743426\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media\/743427"}],"wp:attachment":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media?parent=743426"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/categories?post=743426"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/tags?post=743426"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}