"Like the Wild West": Israeli researchers found hundreds of malicious skills
A study by the Israeli cybersecurity startup Zenity has revealed that hundreds of popular AI agent skills are actually malware. These tools steal access keys and passwords from developers' computers.
Want to add new skills to your AI agents in Claude Code or Cursor? Wait a moment. A new study by the Israeli cybersecurity startup Zenity has revealed that hundreds of popular skills have turned into malware that steals keys and access to systems.
Feel like magic, but can hide a surprise
"Skills feel like magic with agents, which is why they are so popular," explains Michael Berguri, CTO and co-founder of Zenity, in a conversation with Geektime. This comes after the company revealed at the Black Hat conference in Las Vegas a severe vulnerability in Vercel's Skills platform. The platform allows downloading extensions and connections for a range of agents from leading companies such as Claude Code, Codex, Cursor, and others.
"We found hundreds of skills that caused agents to install malware, and in some cases even behave as malware themselves. The malware we found are called info-stealers, and they steal all the keys that are on your computer and send them to the attacker," says Berguri. To deal with this phenomenon, Zenity developed a new testing tool: "In the world of malware scanning, there is an idea called a detonation chamber — a concept from the world of bomb disposal. We built the world's first detonation chamber for agents. Instead of looking at a skill and trying to understand with code or AI whether it is malware, we literally connect it to an agent inside a controlled vault, make the agent use it, and see what happens."
The Wild West of AI
The accepted way today to look for security issues in skills is to pass them through a language model. At Zenity, they discovered that some of the malicious skills evaded this method with a simple trick: "They wrote in the skill a message for vulnerability scanners that the skill is perfectly fine and approved by the security department — and it worked."
Another technique hidden inside frequently used skills was hiding the true instructions within hidden logic, for example, within code examples. "The scanners get confused because they think it's just an example, and when the skill is used, it rewrites itself and the malicious logic is written as instructions," explains Berguri.
According to him, the research proves that the field of skills is currently functioning "like the Wild West." According to Vercel's download statistics, the malicious skills that were exposed were downloaded more than 1.7 million times. The attackers aimed to reach developers, especially those working in AI environments, and apparently managed to reach quite a few of them.
Blast radius
What do you estimate the blast radius of this type of vulnerability to be?
Berguri: "Once you install the malicious skill, the attacker has gained the ability to run code on your computer. What we saw the attacker doing is searching for every key and password on your computer and stealing them. This is full identity theft, and for developers, it can easily lead to theft of access to production systems."
Zenity performed a disclosure process with Vercel after discovering the malicious skills, and the company handled the entire incident within 12 hours of the report. In addition, the attacker's account was blocked on Vercel and GitHub. "But this is not the last word, attackers will continue and try. Information security is a cat-and-mouse game," concludes Berguri.
