Story thread · 2 reports / 2 sources

Malicious AI ‘skills’ turned agents into credential thieves, at scale

thenextweb.com · 4dShare

Security researchers at Zenity Labs uncovered a credential-stealing campaign on skills.sh, a public registry of add-ons for AI agents run by Vercel. They unveiled the research at the Black Hat conference. Attackers had cloned real skills into typosquatted look-alikes. One tainted family racked up over 1.7 million installs, though Zenity stresses that is aggregate downloads, […] This story continues at The Next Web

First report: Experts warn malicious AI skills are hitting more victims than ever — with one family amassing 1.7 million downloads — techradar.com, 4d