AIR Says Fake AI Agent Skill Reached 26,000 Agents After Evading Scanners
Summary
AIR says its harmless fake AI skill reached about 26,000 agents after scanners cleared a package whose mutable external link later served a script. The figure is the firm’s claim and is not independently confirmed.
Key points
- AIR says its brand-landingpage skill reached about 26,000 agents, including some on corporate accounts; those figures are not independently confirmed.
- The skill passed scanners from Cisco, NVIDIA, and skills.sh because the scanners examined the submitted package, not the content later fetched from its external link.
- AIR initially linked to genuine Stitch documentation, then changed the linked page to tell agents to download and run a script.
- In the demonstration, the script only sent users’ email addresses to AIR; more harmful access was described as a potential risk, not an observed outcome.
- AIR used a merged marketplace submission that inherited a popular repository’s GitHub stars, plus an Instagram ad, to make the skill appear trustworthy.
- The article recommends vetting linked resources, rechecking skills when they change, pinning versions, using least privilege, and controlling where new skills are installed.
Article Details
- Event Type
- Security research demonstration of an AI-agent skill evading security scans through a mutable external link.
- Impact
- AIR says its demonstration skill reached roughly 26,000 agents, including some on corporate accounts; those figures are the company’s claims and are not independently confirmed. The demonstration payload was designed to collect users’ email addresses and do nothing else. It showed that scanners could approve a skill whose external instructions were changed after review, creating a potential path to broader access limited by the agent’s permissions.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | stitch-design[.]ai | AIR-controlled domain used in the demonstration for an external link that was changed after the skill passed scans to direct agents to download and run a script. |
Vendors
AIRAIR created a fake AI agent skill called brand-landingpage and used GitHub stars, a marketplace merge, and an Instagram ad to make it look trustworthy, eventually reaching about 26,000 agents.Anthropic#AIR #brand-landingpage #Cisco #NVIDIA #skills.shCiscoThe experiment showed that scanners from Cisco, NVIDIA, and skills.sh missed the threat because the malicious logic lived behind an external link that could be changed after review.NvidiaThe experiment showed that scanners from Cisco, NVIDIA, and skills.sh missed the threat because the malicious logic lived behind an external link that could be changed after review.
Products
ClawHubThree weeks earlier, Trail of Bits bypassed ClawHub’s malicious-skill detector, Cisco’s scanner, and all three scanners wired into skills.sh.skills.shThe experiment showed that scanners from Cisco, NVIDIA, and skills.sh missed the threat because the malicious logic lived behind an external link that could be changed after review.StitchThe skill, named brand-landingpage, claimed to build a landing page using Google’s Stitch design tool, aimed squarely at non-technical users.