Fake AI Skill Skirts Scanners, Reaches 26K Agents
Security firm AIR created a bogus AI agent skill, got it approved by a major marketplace and promoted via Instagram, and it installed on roughly 26,000 agents, including corporate accounts. All scanners flagged it safe because the malicious payload was hosted off‑platform and swapped after approval. The demo proves current skill‑scanning tools can be bypassed, exposing a systemic trust flaw.