Massive Attack on AI Agents: Hackers Infect Popular Skills and Steal Data from 1.7 Million Users

In August 2026, cybersecurity faced a fundamentally new challenge: malicious actors began mass-using artificial intelligence skills to conduct attacks on supply chains. Experts from Zenity Labs discovered a large-scale campaign on the skills.sh platform — a service functioning like an app store for AI agents. Malicious packages, disguised as useful tools, were downloaded more than 1.7 million times, putting the confidentiality and security of a huge number of developers and companies at risk.

Attack Mechanics: From Harmless Copies to Malicious Code

Researchers found that cybercriminals acted according to a proven scheme characteristic of software supply chain attacks. Initially, attackers cloned legitimate skills, creating copies with intentional typos in the names. At this stage, the packages did not pose a direct threat, allowing them to gain popularity and user trust unnoticed. Once the number of downloads reached a critical mass, malicious instructions were injected into the skills' code.

Activated malicious modules began collecting critical data: SSH keys, cloud service credentials, access tokens for Git and package managers, Kubernetes and Docker configurations, as well as database passwords. The obtained information was packaged together with host metadata and secretly sent to the attackers' servers.

Scale of the Incident and Tools Used

Zenity Labs found it difficult to name the exact number of affected organizations, but confirmed that just one family of malicious skills gathered 1.7 million downloads. During the investigation, "dozens" of additional skills demonstrating malicious or potentially dangerous behavior were discovered. Almost a third (30%) of them used Anthropic Claude Code and OpenClaw tools to distribute malware.

Furthermore, researchers identified several hundred reserved and empty package names, which were likely intended for future attacks. This indicates that cybercriminals are planning long-term activity in this area and continue to expand their capabilities.

Platform Response and Recommendations for Users

After receiving a warning from researchers, Vercel and Microsoft, which manage the respective platforms, promptly removed malicious components from their repositories. However, experts emphasize that removing packages from the store does not guarantee the safety of users who downloaded them earlier. Everyone who used suspicious skills must manually check their systems and remove infected components to prevent data leaks.

Contradictory Data

Currently, there are discrepancies in assessing the completeness of the threat elimination. On the one hand, Vercel and Microsoft platforms have confirmed the removal of malicious packages from public access. On the other hand, Zenity Labs researchers note that the exact number of attack victims remains unknown, as the malicious code may have already been embedded in local development environments and continued to operate even after the source packages were blocked.

The Future of Cyber Threats in the AI Era

This incident demonstrates how quickly cybercriminals adapt to new technologies. The use of AI agents for supply chain attacks opens up new threat vectors that require the development of specialized protection methods. Experts urge developers and companies to be more careful when choosing skills for AI agents and to regularly check their systems for suspicious activity.