Massive Attack on AI Agents: Hackers Infect Popular Skills and Steal Data from 1.7 Million Users

In August 2026, cybersecurity faced a fundamentally new challenge: malicious actors began to massively use artificial intelligence skills (skills) to attack supply chains. Experts from Zenity Labs discovered a large-scale campaign on the skills.sh platform — a service functioning like an app store for AI agents. Malicious packages, disguised as useful tools, were downloaded more than 1.7 million times, putting the confidentiality and security of a huge number of developers and companies at risk.

Attack Mechanics: from Harmless Copies to Malicious Code

Investigators found that cybercriminals acted according to a proven scheme, characteristic of software supply chain attacks. Initially, the attackers cloned legitimate skills, creating copies with intentional typos in the names. At this stage, the packages did not pose a direct threat, which allowed them to gain popularity and user trust unnoticed. As soon as the number of downloads reached a critical mass, malicious instructions were embedded in the skills code.

Activated malicious modules began collecting critically important data: SSH keys, cloud service credentials, access tokens for Git and package managers, Kubernetes and Docker configurations, as well as database passwords. The obtained information was packaged together with host metadata and secretly sent to the attackers' servers.

Scale of the Incident and Tools Used

Zenity Labs found it difficult to name the exact number of affected organizations, but confirmed that only one family of malicious skills gathered 1.7 million downloads. During the investigation, "dozens" of additional skills demonstrating malicious or potentially dangerous behavior were discovered. Almost a third (30%) of them used Anthropic Claude Code and OpenClaw tools to distribute malware.

In addition, researchers identified several hundred reserved and empty package names, which were likely intended for future attacks. This indicates that cybercriminals are planning long-term activity in this area and continue to expand their capabilities.

Platform Response and Recommendations for Users

After receiving a warning from researchers, Vercel and Microsoft, managing the respective platforms, promptly removed malicious components from their repositories. However, experts emphasize that removing packages from the store does not guarantee the safety of users who have already downloaded them previously. Everyone who used suspicious skills must manually check their systems and remove infected components to prevent data leaks.

Contradictory Data

Currently, there are discrepancies in the assessment of the completeness of the threat elimination. On the one hand, Vercel and Microsoft platforms confirmed the removal of malicious packages from public access. On the other hand, Zenity Labs researchers note that the exact number of attack victims remains unknown, as the malicious code may have already been embedded in local development environments and continued to work even after the source packages were blocked.

The Future of Cyber Threats in the AI Era

This incident demonstrates how quickly cybercriminals adapt to new technologies. The use of AI agents to attack supply chains opens up new threat vectors that require the development of specialized protection methods. Experts urge developers and companies to be more careful when choosing skills for AI agents and to regularly check their systems for suspicious activity.