Zenity researchers discovered an attack campaign up malicious AI agent skills to the open ecosystem skills.sh beginning July 11, with names typosquatting on Paperclip and Browser Use services, accumulating over 1.7 million combined downloads by August 2. The trojanized skills instructed AI agents to download and install credential stealer payloads from GitHub. The incident reflects a growing trend of attackers poisoning sharable instruction and configuration files targeting the AI software supply chain.
Topics #
Sources #
- Press
Go deeper #
This intelligence is sourced automatically from public sources across the web and synthesised by the Prefactor AI pipeline. Stories are reviewed before publication.
source & further reading
getreadyforagents.com — original article
Engineering teams report compound alignment problems when scaling multi-agent deployments without coordination
Salestrics releases Model Context Protocol server for safe AI agent access to business systems
New Orleans tests Carbyne AI triage in live 911 emergency dispatch operations