Your Agent Trusts Things You Never Approved

Cisco is partnering with OpenAI to integrate Daybreak, a cybersecurity-tuned AI reasoning system, into its AI security portfolio to detect malicious agent skills and MCP servers that execute code with an agent's credentials. The tiered architecture includes Daybreak Blue for primary scanning and Daybreak Red for heavily obfuscated payloads, addressing the blind spot where executable code disguised as markdown documentation bypasses traditional scans. Cisco AI Defense's skill-scanner and mcp-scanner run at marketplace ingestion, pre-install, and pre-commit points to close the gap in AI supply chain security.

Several notable breach retrospectives of the last decade have the same shape. The attacker didn’t break down the front door, they compromised something the target had already decided to trust — a package, a build tool, a base image — and walked in behind it. Agents have reopened that door and widened it. A compromised library used to mean bad data or a crashed process. A malicious Agent Skill means code executing with your agent’s credentials, file access, and network reach. It’s inside your environment and acting on someone else’s behalf, with no human in the loop to notice. The problem is the artifacts doing this don’t look dangerous, they just look like documentation. Frontier Threats Need Frontier Reasoning Catching this class of attack requires judgment instead of pattern matching. Is this obfuscated string a real exfiltration chain or a minified helper? Does this tool actually do what its manifest claims? Is this flagged pattern an attack technique or a benign look-alike? Those are reasoning tasks, which means detection quality is capped by the model doing the reasoning. And here the industry has a problem it rarely names: a model cautious enough to hedge or refuse on legitimately dual-use security content doesn’t produce a safer scan. It produces a blinder one. The finding it declined to analyze is the finding that mattered. This is why Cisco is partnering with OpenAI to bring Daybreak into our AI security portfolio https://www.cisco.com/site/us/en/products/security/ai-defense/index.html , starting with the scanners at the center of AI supply chain security. We’re validating a tiered architecture now: Daybreak Blue on the primary pass — cybersecurity-tuned reasoning applied to submitted skills and MCP server, without the refusal behavior that causes general-purpose models to under-analyze legitimate defensive work. Daybreak Red on the hard residue — the heavily obfuscated payloads and working exploit chains that Blue flags as incomplete, where more fully characterizing the threat requires going deeper than a first pass can go. Same pipeline. Same customer-facing report. A substantially higher detection ceiling on exactly the threats engineered to survive a first look. This is active research rather than a shipping commitment — but the agentic supply chain is an urgent proving ground, and the early signal is compelling. The Blind Spot: Executable Code Wearing a Markdown Costume Most teams assume a “skill” is a markdown file of instructions. It usually isn’t. Skills routinely bundle Python, Bash, JavaScript, even compiled binaries — running with the agent’s full permissions. MCP servers have the same property: a clean tool description in a manifest tells you virtually nothing about what the implementation does. Skill and MCP marketplaces are the AI-era npm and PyPI, and they’ve inherited the attack patterns without inheriting the decade of abuse-detection hardening: typosquatted skill names, upstream repos quietly compromised in a later update, unreviewed community submissions slipping into a listing. Often the entire supply chain is a folder pulled from GitHub. And because a skills directory doesn’t look like a codebase, it doesn’t get scanned like one — even though it can do everything a script can do. What Cisco AI Defense Scans skill-scanner covers the skill side — SKILL.md plus every bundled script and resource — with YARA and static pattern matching, Python bytecode integrity checks, shell pipeline taint analysis, behavioral dataflow analysis, and semantic review before a skill is trusted. mcp-scanner covers the server side — tools, prompts, resources, instructions, and the PyPI and npm packages underneath — hunting specifically for the gap between what a tool claims and what its code does. Both run at the points where trust is actually granted: marketplace ingestion, pre-install and pre-commit, and continuously afterward. A skill that was clean yesterday can ship malicious code tomorrow. That’s not a hypothetical; it’s how package compromise has always worked. The Real Shift Traditional security assumed the thing running in your environment was something you wrote, reviewed, or explicitly approved. Agentic AI breaks that assumption at runtime. Your agent makes trust decisions at machine speed, against artifacts sourced from registries with no vetting standard. The starting point is unglamorous: inventory what your agents can load and call. You cannot scan an asset class you haven’t admitted you have. Leave a Comment Cancel reply /ai/your-agent-trusts-things-you-never-approved respond You must be logged in https://blogs.cisco.com/wp-author/?redirect to=https%3A%2F%2Fblogs.cisco.com%2Fai%2Fyour-agent-trusts-things-you-never-approved to post a comment.