HiddenLayer Q2 2026 Report Highlights AI Agent and Supply Chain Threats
Report discovered via Awesome Annual Security Reports.
Summary
HiddenLayer’s April–June 2026 threat update examines malicious agent skills, prompt injection, AI-assisted cybercrime, and software supply chain compromises, recommending tighter controls on agent permissions and dependencies.
Key points
- The report describes malicious agent skills distributing Atomic macOS Stealer, enrolling agents in unauthorized cryptocurrency activity, and concealing instructions in skill metadata.
- HiddenLayer researchers demonstrated OpenClaw prompt-injection persistence through editable workspace files and recurring heartbeat tasks, turning the assistant into an LLM-powered command-and-control server.
- Tokenizer tampering research showed that a vocabulary-string substitution could manipulate decoded output without changing model weights, including silently injecting tool calls.
- Reported LiteLLM and Hugging Face supply chain compromises used trusted dependencies and model repositories to distribute credential-stealing payloads.
- The report says ChromaToast remained unpatched in ChromaDB 1.5.9 at writing; it recommends the unaffected Rust-based deployment or restricting network access to trusted clients.
- Examples of AI-enabled malware include a Sliver dropper using GPT-4 to assess victim environments, while other samples contained experimental AI features with little or no operational effect.
- Recommendations include auditing and versioning skills, checking dependency integrity, restricting untrusted third-party skills, reviewing agent authentication, and monitoring shadow AI.
Article Details
- Publisher
- HiddenLayer
- Report Period
- 2026-04-01 to 2026-06-30
- Scope
- AI security developments, including AI-assisted cybercrime, prompt attacks, agent skills, software supply chain compromises, vulnerabilities, and defensive frameworks; includes selected incidents outside the reporting quarter.
- Key Statistics
- Amazon reported that a Russian-speaking threat actor used generative AI to breach more than 600 FortiGate firewalls across 55 countries in five weeks.
- The report attributes 9,000 fake websites, more than one million fraudulent URLs, and 2.5 million scam texts to Outsider Enterprise; the texts targeted Android users during a two-week period in May 2026.
- Approximately 4,000 publicly reachable OpenClaw servers remained vulnerable to a malicious-webpage-triggered arbitrary command execution flaw at the time the referenced blog was published.
- The principal malicious LiteLLM release was downloaded approximately 100,000 times following the March 24 supply chain compromise.
- The report states that vulnerable versions of transformers received approximately 232 million downloads during the six-month window in which the described remote code execution vulnerability was exploitable.
- Recommendations
- Audit internally developed skills and thoroughly vet third-party skills for malicious or suspicious instructions before permitting agent use.
- Version skills, verify their integrity, track changes, and map agent-and-skill dependencies as a software supply chain.
- Keep skills narrow, single-purpose, explicit, and semantically consistent.
- Include agents in threat models and AI acceptable-use policies, and monitor corporate devices for shadow AI deployments.
- Audit agent configuration and authentication before exposure; restrict untrusted third-party skills and connections to agent-only social platforms.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationMalicious OpenClawCLI packages contained a base64-encoded blob concealing a command to download and execute malware.T1078 · Valid AccountsAmazon described attacks on exposed FortiGate management interfaces using weak credentials rather than unknown vulnerabilities.T1105 · Ingress Tool TransferMalicious skills and a typosquatted Hugging Face repository caused victim systems to download additional infostealer payloads.T1140 · Deobfuscate/Decode Files or InformationThe malicious OpenClawCLI dependency decoded a base64 blob into a malware download-and-execution command.T1190 · Exploit Public-Facing ApplicationJADEPUFFER reportedly used an LLM to exploit a Langflow vulnerability; MCPwn was also reported as actively exploited against nginx-ui MCP integrations.T1195.001 · Compromise Software Dependencies and Development ToolsAttackers distributed malicious agent skills, poisoned software dependencies, and a typosquatted model repository to compromise downstream users.T1496 · Resource HijackingAn AI-generated malware sample deployed an XMRig cryptominer, while malicious crypto-swarm skills enrolled agents into unauthorized compute work.T1497 · Virtualization/Sandbox EvasionAn AI-enabled dropper sent victim-environment reconnaissance to GPT-4 to decide whether to execute a Sliver payload and avoid sandbox environments.T1528 · Steal Application Access TokenThe fake Privacy Filter repository delivered an infostealer that harvested Discord tokens.T1539 · Steal Web Session CookieThe Rust-based infostealer delivered through the fake Privacy Filter repository harvested browser cookies.T1552.001 · Credentials In FilesThe malicious LiteLLM releases harvested SSH keys, cloud credentials, and Kubernetes secrets.T1555.001 · KeychainAtomic macOS Stealer distributed through malicious skills harvested credentials from keychains.T1555.003 · Credentials from Web BrowsersInfostealers distributed through malicious skills and the fake Privacy Filter repository harvested browser credentials.T1562.001 · Disable or Modify ToolsThe Rust-based infostealer delivered through the typosquatted model repository disabled Windows defenses.
People
Conor McCauleyListed report author or contributor; Adversarial ML Researcher.David LuListed report author or contributor; Senior ML Threat Operations Specialist.Divyanshu DivyanshuListed report author or contributor; Security Researcher.Eoin WickensListed report author or contributor; Technical Research Director.Kenneth YeungListed report author or contributor; Associate Threat Researcher.Kieran EvansListed report author or contributor; Principal Security Researcher.Marta JanusListed report author or contributor; Principal Security Researcher.Peter SteinbergerIdentified as the developer who built OpenClaw, released in November 2025.Ryan TraceyListed report author or contributor; Principal Security Researcher.Tom BonnerListed report author or contributor; SVP of Research.
Threat Actors
Hive0163Financially motivated group that deployed Slopoly during a ransomware attack, according to IBM X-Force.JADEPUFFEROperator documented by Sysdig in early July as running an automated campaign thought to be the first known fully agentic ransomware operation.Outsider EnterpriseChina-based phishing-as-a-service operation run through Telegram that sold AI-generated phishing kits; Google filed a civil lawsuit against it in June.UNC1069North Korea-nexus actor to which Google attributed the March compromise of the axios npm library.
Malware
Atomic macOS Stealer (AMOS)Disguised as helpful automation tools, these skills were propagating malware - in most cases, a variant of Atomic macOS Stealer (AMOS).LAMEHUGBuilding on the trend started by PromptLock and LameHug, adversaries are increasingly embedding AI capabilities into their malware.PromptLockBuilding on the trend started by PromptLock and LameHug, adversaries are increasingly embedding AI capabilities into their malware.Shai-HuludThe long-running Shai-Hulud worm kept evolving too, expanding from npm into PyPI and, by June, embedding prompt injection inside packages to mislead LLM-based security scanners into classifying malware as clean.SlopolyIn March, IBM X-Force uncovered a likely AI-generated malware strain, dubbed Slopoly, deployed during a ransomware attack by a financially motivated group called Hive0163.SURXRATSimilarly, a new variant of the Android remote access trojan SURXRAT contains a subroutine that, under certain conditions, downloads a large LLM from an external repository, but doesn’t yet make any actual use of the
Vendors
AnthropicAt the top end, Anthropic introduced its Mythos tier, which sits above Opus, but access to this newest model was limited to a handful of trusted partners.OpenAIAnthropic as an open standard in December 2025, has been swiftly adopted by all major players, including OpenAI, Cursor, GitHub Copilot, and, most notably in the consumer market, OpenClaw.
Products
ChromaDBIn May 2026, HiddenLayer disclosed six vulnerabilities in ChromaDB, a popular open-source vector database used to enable semantic matching in AI applications.Claude CodeThe starkest case in this space was Anthropic: besides the already-mentioned Mythos leak, the company also accidentally exposed the source code of Claude Code, making it the second high-profile spill in just over a year.Claude Fable 5Claude Mythos 5, an upgrade to the cyber-defense model still locked to vetted Glasswing partners, and Claude Fable 5, which the company described as a Mythos-class model made safe for general use.Claude Mythos 5It released two models built on the same underlying system: Claude Mythos 5, an upgrade to the cyber-defense model still locked to vetted Glasswing partners, and Claude Fable 5, which the company described as aFortinet FortiGatesecurity division revealed that a Russian-speaking threat actor used generative AI to breach over 600 FortiGate firewalls across 55 countries in just five weeks.LangflowIn this campaign, an LLM autonomously exploited a Langflow vulnerability, harvested credentials, moved laterally to a production database, and executed a complete database-extortion playbook with no human drivingLiteLLMOne such attack to hit the headlines in recent months is the compromise of a widely used LLM proxy library called LiteLLM.Nginx UIA critical flaw, dubbed MCPwn, was found in nginx-ui MCP integration.OpenClaw- [OpenClaw as a New Attack Vector](#openclaw-as-a-new-attack-vector)TransformersAnother critical vulnerability was recently found by Pluto Security in HuggingFace’s transformers library, affecting all versions prior to 5.3.0.
Tools
ClawSwarmBuilt on an open-source “agentic skill economy” project called ClawSwarm, the scheme is hard to detect because there are no traditional malicious indicators, just routine traffic to a benign domain and wallet code usingJBFuzzMeanwhile, automated jailbreaking has matured into a fuzzing problem: tools like JBFuzz can now mutate and test attack prompts against a target model with no insider knowledge, hitting near-100% success rates in about aSliverOne recent example is a dropper distributing the infamous Sliver payload (an open-source alternative to Cobalt Strike).XMRigattacker using an AI-generated malware sample exploiting the React2Shell vulnerability to deploy an XMRig cryptominer, with the payload’s heavy commenting and a telling “Educational/Research Purpose Only”
Countries
ChinaBased in China and run through Telegram, the network sold AI-generated phishing kits that let low-skilled operators blast out fake text campaigns impersonating Google and other trusted brands, then spin up matchingNorth Koreadownloads, briefly poisoned with a dependency that dropped a cross-platform backdoor, to UNC1069, a North Korea-nexus actor, warning that hundreds of thousands of stolen secrets could now be circulating from these