A controlled experiment conducted by AI security firm AIR has exposed a deeply uncomfortable truth about the emerging ecosystem of AI agent skills: the tools organizations rely on to vet third-party capabilities are not yet fit for purpose. By designing a fake — but functionally malicious — skill and distributing it through legitimate channels, the firm demonstrated that sophisticated threats can reach tens of thousands of AI agents without raising a single alarm.
The Anatomy of a Silent Intrusion
The AIR team engineered a skill that, by design, was intentionally benign in its payload — it collected only the deploying user's email address and stopped there. But that restraint was the entire point. The research wasn't about stealing data; it was about proving that a bad actor could steal data, install persistent access, or exfiltrate credentials at scale using the exact same delivery mechanism — and nobody would catch it.
The skill was submitted to a widely used AI agent skill marketplace and promoted through an Instagram advertisement. From those two commonplace vectors, it propagated to approximately 26,000 agents, including accounts tied to corporate environments. No human reviewer flagged it. No automated scanner raised a concern. Every security tool the researchers tested against it returned a clean verdict.
"The payload was harmless by design. The vulnerability was not."
Why Scanners Are Failing in the AI Skill Layer
Traditional application security scanning was built for a different era — one defined by static binaries, known malware signatures, and predictable code execution paths. AI agent skills introduce a fundamentally different threat surface. They operate within conversational and agentic contexts, they interact with other tools and data sources dynamically, and their behavior can vary dramatically depending on the prompts and inputs they receive at runtime.
Current scanners are largely checking for what they already know. They look for recognized malicious code patterns, suspicious network calls, or known exploit signatures. An attacker who builds a skill from scratch — with clean, purpose-written code designed to blend in — can evade these checks almost trivially. The AIR experiment didn't require any particularly sophisticated evasion technique. The skill simply didn't look like malware to tools that weren't designed to understand what AI agent malware looks like.
The Marketplace Model Compounds the Risk
Skill marketplaces operate on a model borrowed from mobile app stores — a philosophy of frictionless distribution with security as an afterthought. That model created serious problems for mobile ecosystems a decade ago, and the AI industry appears to be reprising the same mistakes. The difference now is that AI agents are being deployed in enterprise environments with access to sensitive systems, communication channels, and internal data. The blast radius of a compromised skill is potentially far greater than a rogue mobile app.
The use of social media advertising as a distribution vector is also telling. Threat actors don't need to compromise a marketplace's infrastructure to reach victims — they can simply advertise. And because AI tools are attracting enormous interest from both developers and non-technical business users, those ads find an audience that is simultaneously enthusiastic and not always security-savvy.
What a Real Attack Would Look Like
Replace the email harvester with a credential exfiltrator. Replace it with a tool that quietly reads documents passed through the agent and forwards summaries to an external server. Replace it with something that maps internal tool integrations and waits for a command. Any of these scenarios follow the exact same distribution and installation path that AIR demonstrated — with the same likelihood of detection, which is to say, none.
Enterprise environments that have begun integrating AI agents into workflows — customer service pipelines, internal knowledge bases, developer tooling — are particularly exposed. In those contexts, a compromised skill isn't just a privacy incident. It's a potential beachhead into systems that matter.
What You Should Do
A Familiar Problem, a New Arena
The security industry has seen this pattern before — a powerful new technology platform attracts rapid adoption, security infrastructure lags behind, and researchers demonstrate the gap before attackers exploit it at scale. The difference is the speed at which AI agent deployment is accelerating, and the degree of trust organizations are placing in these systems from day one.
The AIR experiment is a controlled, responsible disclosure of a structural weakness. The question is whether the industry — marketplace operators, enterprise security teams, and AI platform vendors — will respond with urgency, or wait for a real-world incident to set the terms of the conversation.
