They Didn't Hack the Agent. They Forged the Badge.

Second post, same exploit.

Last time I wrote about how Bernie Sanders, asked why we call their billionaires oligarchs and ours entrepreneurs, accidentally described the identical con running on a whole country's vocabulary: dress wealth concentration in a friendlier word so nobody checks the access list underneath it. This week the story isn't a person or a country. It's the thing a lot of you have started plugging into your business without thinking of it as software: an AI agent skill.

A skill is a bundle of instructions an agent loads into its own context and follows with roughly the authority of a user prompt. That's the whole appeal: install it, and the agent just knows how to do the new thing. It's also, as a security firm called AIR just demonstrated, the whole problem.

The Trick, Stripped Down

AIR built a fake skill called brand-landingpage, pitched at non-technical users as a way to build a landing page using Google's Stitch design tool. To make it look trustworthy, they didn't bother faking the dangerous part. They faked the boring part: reputation.

They opened a pull request against a skill marketplace repository sitting at roughly 36,000 stars and 156 skills. It got merged within a few days, and the new skill inherited the repo's star count on the spot. Then they ran an Instagram ad at marketers, salespeople, and designers, exactly the audience with no reason to read source code before installing something that promises to build them a landing page.

The skill itself carried nothing dangerous. It told the agent to install a “Stitch SDK” by following setup documentation at an external link, stitch-design.ai, a domain AIR owns, built to look like the real Stitch (stitch.withgoogle.com). When it first went out, that link pointed to the genuine Stitch docs. Every scanner that checked it, Cisco's, NVIDIA's, the three wired into the skills.sh marketplace, saw a clean package pointing at a plausible setup page and cleared it.

Once the skill had spread, AIR swapped the page behind that same link. The new version told the agent to download and run a script. In the demo, the script did one thing: email the user's address back to AIR, which is how they counted roughly 26,000 agents reached, some on corporate accounts. A real operator wouldn't have stopped at an email address. The agent would have run that script with whatever access it already had: read files, move data, reach whatever the agent could reach.

Why the Badge Worked

None of those scanners are broken in the sense of doing their job wrong. They read the SKILL.md and the files shipped in the package, exactly the way a scanner is supposed to. The problem is what they don't read: the page the skill points the agent to, fetched fresh at install time, editable by whoever controls that domain, whenever they want, long after the scan that cleared it.

Three weeks before AIR's write-up, Trail of Bits ran the same play against ClawHub's malicious-skill detector, Cisco's scanner, and all three scanners on skills.sh, and got the same result. In their case it took under an hour to build three of the four malicious skills. Anthropic's own documentation already tells you to pay particular attention to skill instructions that connect out to untrusted external sources, for exactly this reason.

And the scanners don't even agree with each other. A 2026 study of the skills.sh marketplace found that seven malicious-skill scanners agreed on 0.12% of their verdicts, flagging the same skill in just 33 cases out of 27,111. Of the 8,402 skills flagged by at least one scanner, 72% were flagged by exactly one. The researchers put the blame in the same place I would: each scanner judges a sealed package in isolation, blind to what it links out to and blind to whether that link still says the same thing it said during review.

This is the same shape as the last post, and the same shape as the one I'll close the series with. The relabel Sanders described didn't change the concentration of wealth underneath it, it just changed whether anyone bothered to check. A scanner pass and a star count are the same kind of object: a stand-in for trust that everyone agrees to treat as proof, right up until someone works out it's borrowable.

The Part That Should Bother You

Worth saying plainly: the 26,000 figure, the corporate-account detail, and the claim that AIR could have taken over every agent it reached are AIR's own numbers, and AIR is in the middle of launching a managed skill marketplace, so read the scale with the same skepticism you'd apply to any vendor grading its own breach.

What doesn't need AIR's say-so to hold up: the named scanners really do check only the submitted package. The external-link blind spot is real, and Trail of Bits demonstrated it independently three weeks earlier against a different set of scanners. The trust signals AIR borrowed, stars and a clean scan, are exactly the signals the agent ecosystem still treats as sufficient. Whether the true number is 26,000 or a tenth of that, the structural gap it walked through is real, and it's still open.

And the install pattern here, an unreviewed skill picked up because a marketplace badge and a familiar-looking repo made it look safe, is precisely how most of these get installed in the first place. Most companies adopting agent skills right now have no inventory of what's already running, let alone a process for re-checking it when the thing it points to changes out from under them.

The Fix Is Starting. It's Aimed at the Wrong Half.

Here's what's moved since AIR published, because it matters. The scanner vendors are responding. Cisco's skill scanner is built to run continuously instead of once: it ships a pre-commit hook and a reusable CI/CD workflow, so a skill gets re-scanned on every change to its files rather than a single time at submission. ESET put out a free tool that goes a step further at the exact blind spot, extracting every external URL a skill references and tracing the download-and-execute chain before you install. The enterprise guidance is converging fast on the right instincts: pin versions, use immutable references, host external content you control, and hold agents to least privilege so a skill doesn't inherit the full access of the person running it.

Good. Now notice the shape of all of it. Cisco's re-scanning watches the skill's own files. ESET's check reads the remote page once, at install. Both are snapshots. The thing AIR swapped was that same remote page, on a domain the attacker controls, edited after every check had already passed. Re-scanning the package more often doesn't help when the payload was never in the package. Checking the link once doesn't help when the link's contents change the day after. The half of the problem everyone can see, the local files, is getting patched. The half AIR built its entire demo around, a live external target that can change out from under a clean verdict, is still mostly open.

What Actually Protects You

Three things, none of which require trusting anyone's marketing:

• Vet what a skill points to, not just what ships inside it. A scanner that reads the SKILL.md and stops there is reading half the program. If a skill fetches setup instructions, code, or a script from anywhere outside the package, that fetch is the part to audit.
• A clean scan is a timestamp, not a verdict. Anything a skill calls out to after install can change after the review that cleared it. Re-check on every change to that target, not once at install and never again.
• Borrowed reputation isn't earned reputation. Stars, forks, and a clean scanner result are signals other people can ride into by merging something into a repo that already has them. They tell you about the repo's history, not about what the skill you just installed actually does.

None of this required breaking anything. The scanner did its job. The marketplace did its job. The star count was real. The only thing that failed was the assumption underneath all three: that good behavior at the moment of the check stays good behavior afterward. It doesn't. It's just the moment before someone swaps the page.

Next, and last in the series: the same break with the costume off completely. No marketplace, no metaphor. Just a fake support message, a stolen key, and actual Russian intelligence on the other end.

Sources & Further Reading

• AIR: The Story of Skills: How We Hijacked 26,000 Agents With One Instagram Ad (June 22, 2026). The primary account, and the source of every number I attribute to AIR. Note again that AIR is grading its own demo.
• The Hacker News: Fake AI Agent Skill Passed Security Scans and Reportedly Reached 26,000 Agents, independent coverage. Note their “reportedly.”
• CSO Online: How a malicious AI agent skill passed security checks and reached 26,000 users.
• Trail of Bits: The sorry state of skill distribution (June 3, 2026). The independent confirmation, published three weeks earlier against a different set of scanners. This is the one to read if you only read one.
• Holzbauer, Schmidt, Gegenhuber, Schrittwieser & Ullrich (2026): “Malicious Or Not: Adding Repository Context to Agent Skill Classification,” summarized here. The source of the 0.12% scanner-agreement figure.
• Anthropic: Agent Skills documentation, including the guidance to audit skills that reach out to untrusted external sources.
• The tooling I mention: Cisco AI Defense Skill Scanner (open source, with pre-commit and CI/CD re-scanning) and the ESET AI Skills Checker (free, no account required). I am not affiliated with either.

Sourcing note: I have separated what AIR claims from what has been independently confirmed, and said so in the body rather than burying it here. The 26,000 figure is AIR's. The structural gap is Trail of Bits', the researchers', and Anthropic's own documentation. Verify anything you plan to repeat.

Connect with Casey

If this resonated, or if there's a topic you want me to take on next, reach out. I read everything.

Casey writes about economic policy, nomadic life, cybersecurity, and navigating the world as a late-diagnosed AuDHD adult. New posts drop on my professional website.