An add-on that pulls its instructions from somewhere else carries a pointer through review, not its payload. The fetch happens at runtime, the retrieved text lands in the agent's context, and the agent treats it the way it treats a user's prompt. Nothing inside the installed package has to change for its behaviour to change, which is why a one-time install check does not cover it.
AIR Security puts the number of public AI add-ons doing this at more than 17,800, across 6.7 million installations [2]. Divide one by the other and the average affected add-on sits on roughly 376 installs [11]. The distribution is not published, so the mean is the only shape available, but it is not the shape of abandoned junk with two users each.
The impersonation finding is the part that generalises. AIR says it found Skills in the wild posing as Anthropic and OpenAI, written to get past security review and then execute arbitrary code [3]. Its own screening list includes typo-squatted packages masquerading as official developer tools [6], and it is the same failure one register up, trust assigned by name string in ecosystems with no publisher verification worth the name.
All of it is the vendor's own research, and the launch account gives no method, no scan window and no list of the registries enumerated [14]. So treat the counts as an order of magnitude asserted by the company selling the fix. The fix, as described, discovers and evaluates every skill, plugin, MCP server and add-on before and after deployment [5], propagates revocation to every dependent agent and workflow [7], and offers a marketplace of pre-vetted add-ons [8]. That is a product description, with no deployment data attached to it yet.
What holds regardless is the inventory gap that CEO Yair Saban names in the launch: agents are autonomously installing tools and connecting to internal systems, and in most organisations nobody knows what is running, what is trusted, or how to shut it off [4]. AIR points at coding agents specifically, naming Claude Code, Cursor and Codex as where the volume is coming from [10]. Those tools install their extensions on developer machines, at developer pace, which is where the enumeration work sits.
An agent that reads files and email, holds credentials to internal systems and acts on behalf of an employee [13] is a privileged process, and third-party instructions reaching its context are an input path with no gate. A team that can list its installed Skills and MCP servers per host, and mark which of them fetch text from a URL at runtime, has priced this problem without a purchase order; a team that cannot has an unbounded number of extensions holding production credentials, whatever the size of the round.
