Loading story…
Security researchers reported that the emerging AI agent ecosystem is being abused to distribute malicious tools at scale, with one campaign involving trojanized AI skills reaching 1.7 million installs in an attack aimed at AI agents. The activity highlights how agents that can autonomously discover and install new capabilities are becoming a new software supply-chain target, particularly where marketplaces, repositories, and MCP servers lack mature vetting and integrity controls.
Island said its research found thousands of malicious repositories and widespread security flaws across MCP servers, alongside a technique dubbed "AgentBaiting" that tricks AI agents into locating and recommending malware to users. The findings underscore a growing enterprise risk in which attackers can poison the AI toolchain itself, forcing organizations to strengthen governance over which agent skills, tools, and external services can be discovered, trusted, and deployed.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
A campaign involving trojanized AI skills reportedly achieved 1.7 million installs and targeted AI agents. The available content supports this as a large-scale malicious distribution or supply-chain style attack, but provides limited additional detail.
The referenced content identified a new attack technique called AgentBaiting, in which attackers manipulate AI agents into finding and recommending malware to users. The technique was presented as a risk specific to autonomous tool discovery and installation by AI agents.
Island research found thousands of malicious repositories and widespread security flaws across MCP servers in the emerging AI agent ecosystem. The findings highlighted missing trust and security controls around AI Skills and MCP servers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A researcher demonstrated that a fake AI agent skill called **`brand-landingpage`** could pass marketplace security checks and spread widely by exploiting a blind spot in how agent skills are reviewed. The skill offered legitimate landing-page functionality, was promoted through open marketplaces, GitHub repositories, and social media, and was reportedly installed by about **26,000 AI agents**, including some linked to enterprise accounts. According to the reports, the package itself appeared benign and cleared tested scanners because the harmful behavior was not embedded in the submitted code. Instead, the skill pointed agents to externally hosted documentation that was modified after approval to instruct them to download and execute a script, demonstrating a supply-chain style attack against AI agent ecosystems. In the controlled test, the script only exfiltrated user email addresses, but the researcher said the same technique could enable arbitrary code execution, broader data theft, and persistent access depending on agent privileges. The findings align with prior warnings from other researchers that static scanning misses mutable external links, and they prompted recommendations to inventory installed skills, restrict approved sources, continuously revalidate linked content, pin versions, and enforce least privilege.
Jun 29, 2026
Multiple reports describe threat actors abusing *AI-adjacent* and open-source distribution channels to deliver malware or manipulate automated agents. Straiker STAR Labs reported a **SmartLoader** campaign that trojanized a legitimate-looking **Model Context Protocol (MCP)** server tied to *Oura* by cloning the project, fabricating GitHub credibility (fake forks/contributors), and getting the poisoned server listed in MCP registries; the payload ultimately deployed **StealC** to steal credentials and crypto-wallet data. Separately, researchers observed attackers using trusted platforms and SaaS reputations for delivery and monetization: a fake Android “antivirus” (*TrustBastion*) was hosted via **Hugging Face** repositories to distribute banking/credential-stealing malware, and Trend Micro documented spam/phishing that abused **Atlassian Jira Cloud** email reputation and **Keitaro TDS** redirects to funnel targets (including government/corporate users across multiple language groups) into investment scams and online casinos. In parallel, research highlights emerging risks where **AI agents and AI-enabled workflows become the target or the transport layer**. Check Point demonstrated “**AI as a proxy**,” where web-enabled assistants (e.g., *Grok*, *Microsoft Copilot*) can be coerced into acting as covert **C2 relays**, blending attacker traffic into commonly allowed enterprise destinations, and outlined a trajectory toward prompt-driven, adaptive malware behavior. OpenClaw featured in two distinct security developments: an OpenClaw advisory described a **log-poisoning / indirect prompt-injection** weakness (unsanitized WebSocket headers written to logs that may later be ingested as trusted context), while Hudson Rock reported an infostealer incident that exfiltrated sensitive **OpenClaw configuration artifacts** (e.g., `openclaw.json` tokens, `device.json` keys, and “memory/soul” files), signaling that infostealer operators are beginning to harvest AI-agent identities and automation secrets in addition to browser credentials.
Jun 29, 2026
Researchers disclosed **SymJack AI**, an attack technique that abuses symbolic links in repositories to trick AI coding assistants and automated development tools into writing to attacker-chosen destinations. A user may approve what appears to be a harmless file change, while the operating system follows a malicious symlink to alter configuration files and enable later command execution with the victim’s privileges. The technique raises concerns for local developer workstations and for CI/CD systems that automatically process untrusted pull requests, where compromised jobs could expose cloud credentials, deploy keys, and other sensitive secrets. Separate research found that public **AI skill marketplaces** remain vulnerable to simple malicious submissions that evade automated scanning. Trail of Bits reported bypassing multiple skill scanners with proof-of-concept packages that used oversized files, hidden content in `.docx` archives, poisoned `.pyc` bytecode, and prompt-injection-style social engineering to disguise malicious behavior. The findings indicate that both repository-based coding agents and downloadable agent skills can become supply-chain entry points, prompting calls for stricter validation of resolved file paths, tighter controls on configuration writes, monitoring of runtime behavior, review of pull requests that modify agent setup, and the use of curated internal skill sources instead of public marketplaces for sensitive environments.
Jun 29, 2026