--- title: "Massive Attack on AI Agents: Hackers Infect Popular Skills and Steal Data from 1.7 Million Users" description: "🚨 Hackers turned AI agent skills into weapons: malicious packages downloaded 1.7 million times. Cybercriminals used the skills.sh platform to steal SSH keys, tokens, and credentials. Vercel and Microsoft platforms removed the packages, but users will have to clean systems manually. #cybersecurity #AI #hackers" date: 2026-08-09T13:33:21.000Z lang: de url: https://xab.info/de/posts/massive-attack-ai-agents-hackers-infect-skills-steal-data tags: [cybersecurity, artificial-intelligence, hacking, supply-chain-attack, skills-sh] publisher: "XAB.info" --- # Massive Attack on AI Agents: Hackers Infect Popular Skills and Steal Data from 1.7 Million Users ![Smartphone mit einer geöffneten KI-Agenten-App, auf dem Bildschirm wird ein digitales Modell eines menschlichen Gehirns angezeigt, das Datenlecks von Nutzern symbolisiert](https://xab.info/media/2026/08/09/hakers-ai-agents-skills-attack/hakers-ai-agents-skills-attack-1.webp) ## 🎯 Key Points - Hackers infected AI agent skills on the skills.sh platform, which were downloaded 1.7 million times. - Malicious code steals SSH keys, Git tokens, and cloud service credentials. - Vercel and Microsoft platforms removed the packages, but users need to clean systems manually. - Cybercriminals reserved hundreds of package names for future attacks. In August 2026, cybersecurity faced a fundamentally new challenge: malicious actors began to massively use artificial intelligence skills (skills) to attack supply chains. Experts from Zenity Labs discovered a large-scale campaign on the skills.sh platform — a service functioning like an app store for AI agents. Malicious packages, disguised as useful tools, were downloaded more than 1.7 million times, putting the confidentiality and security of a huge number of developers and companies at risk. ### Attack Mechanics: from Harmless Copies to Malicious Code Investigators found that cybercriminals acted according to a proven scheme, characteristic of software supply chain attacks. Initially, the attackers cloned legitimate skills, creating copies with intentional typos in the names. At this stage, the packages did not pose a direct threat, which allowed them to gain popularity and user trust unnoticed. As soon as the number of downloads reached a critical mass, malicious instructions were embedded in the skills code. Activated malicious modules began collecting critically important data: SSH keys, cloud service credentials, access tokens for Git and package managers, Kubernetes and Docker configurations, as well as database passwords. The obtained information was packaged together with host metadata and secretly sent to the attackers' servers. ### Scale of the Incident and Tools Used Zenity Labs found it difficult to name the exact number of affected organizations, but confirmed that only one family of malicious skills gathered 1.7 million downloads. During the investigation, "dozens" of additional skills demonstrating malicious or potentially dangerous behavior were discovered. Almost a third (30%) of them used Anthropic Claude Code and OpenClaw tools to distribute malware. In addition, researchers identified several hundred reserved and empty package names, which were likely intended for future attacks. This indicates that cybercriminals are planning long-term activity in this area and continue to expand their capabilities. ### Platform Response and Recommendations for Users After receiving a warning from researchers, Vercel and Microsoft, managing the respective platforms, promptly removed malicious components from their repositories. However, experts emphasize that removing packages from the store does not guarantee the safety of users who have already downloaded them previously. Everyone who used suspicious skills must manually check their systems and remove infected components to prevent data leaks. ### Contradictory Data Currently, there are discrepancies in the assessment of the completeness of the threat elimination. On the one hand, Vercel and Microsoft platforms confirmed the removal of malicious packages from public access. On the other hand, Zenity Labs researchers note that the exact number of attack victims remains unknown, as the malicious code may have already been embedded in local development environments and continued to work even after the source packages were blocked. ### The Future of Cyber Threats in the AI Era This incident demonstrates how quickly cybercriminals adapt to new technologies. The use of AI agents to attack supply chains opens up new threat vectors that require the development of specialized protection methods. Experts urge developers and companies to be more careful when choosing skills for AI agents and to regularly check their systems for suspicious activity. ## ❓ FAQ ### Q: What are AI agent skills? **A:** AI agent skills are sets of instructions for performing specific tasks, expanding the capabilities of artificial intelligence. ### Q: How did hackers use AI skills? **A:** Attackers cloned legitimate skills and then embedded malicious code into them to steal data. ### Q: What should users who downloaded malicious packages do? **A:** It is necessary to manually check systems and remove suspicious skills, as automatic removal does not guarantee safety.