Fake AI Agent Skill Bypasses Security Scans, Reaches 26,000 Agents

Security firm AIR created a fake AI agent skill that passed all tested security scanners and reached roughly 26,000 agents, including corporate accounts, via a popular skill marketplace and Instagram ad. The skill collected user emails but was otherwise harmless, designed to expose vulnerabilities in AI agent supply chains. The firm warns that a malicious payload could have caused significant damage.