Security1 publisher2 min readPublished
Researchers confirmed 157 malicious skills in a sweep of 98,380 across two agent marketplaces
A securityaffairs.com analysis maps a single month of AI security papers onto MITRE ATLAS. The techniques land on agent skills, the Model Context Protocol and injection strings found by reinforcement learning.
The Watch · Security desk
What happened
- A securityaffairs.com analysis maps AI security research published in February 2026 onto MITRE ATLAS and reports a complete attack lifecycle aimed at agents that can take action, not at model behaviour in isolation.
- A fourth study targets the Model Context Protocol, the layer agents use to reach external tools and data, and proposes a replacement architecture because the current one is not secure enough.
- A deanonymisation study involving Nicholas Carlini and Florian Tramer used an LLM agent to pull identity signals out of text, retrieve candidate matches and verify them at scale.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- constraint Prompt filtering sits in front of the model, while a skill the operator installed runs beside the agent with its access to files, email and systems, so a control at the chat boundary never sees the poisoned dependency.
- capability An attacker who pays once for a search that produces transferable injection strings can reuse them against other agents and other tasks, so per-target engineering stops being the cost of the attack.
- decision Anyone letting agents pull skills from a marketplace now has to review them like third-party code, and the sweep shows what finding the 0.16 percent costs: static analysis, sandbox execution and human review.
- exposure The deanonymisation pipeline puts people in scope for reconnaissance at machine speed. The exposed party can be a customer or an employee who never went near the agent.
Of the 98,380 skills the sweep examined across two marketplaces, 157 were confirmed malicious after static analysis, sandbox execution and manual review [7]. That comes to 0.16 percent, about one in 630 listings [18]. The 157 fell into two types, data stealers and agent hijackers, and the study recorded multi-stage chains along with hiding techniques, one of which was putting the malicious behaviour in the skill's own documentation [8].
Installation is all it takes. A benchmark in the same month showed widely used agents performing harmful actions once a compromised skill is present [9], and a separate framework automated stealthy skill-based injection through a feedback loop that improved its own effectiveness [10]. The securityaffairs.com analysis compares this to the first major cases of malicious packages in software repositories [17], and states the difference in reach: "It's a skill you give to an agent with access to your files, email, and systems" [16].
A fourth study went at the connector instead. It targets the Model Context Protocol, which agents use to reach external tools and data, and proposes a secure architecture on the grounds that the current one is not secure enough [11]. The claim is about design at the protocol layer, and no amount of guardrail tuning on the model answers it.
Prompt injection stays high volume in the February set, mapped to AML.T0051 with direct and indirect sub-techniques [12]. The hand-crafting is going away. One study used reinforcement learning to discover injection strings that reliably manipulate an agent's behaviour while preserving the appearance of a legitimate task, and those strings transferred to other agents and other tasks [13]. Another built an adaptive red-teaming framework for web agents that identifies injection surfaces from execution traces, then discovers multi-step attacks automatically [14].
Reconnaissance, mapped to AML.T0014, has become an agent task too [4]. A deanonymisation study involving Nicholas Carlini and Florian Tramer chained extraction of identity-related signals from text with retrieval of candidate matches and verification of them [5]. The analysis calls that a challenge to practical anonymity, the assumption that a person is effectively anonymous among billions [5].
The mapping names persistent memory as one of the agent's four attack surfaces, alongside the skill and tool supply chain, the connection protocols, and the ability to act on systems [3]. The studies it places on the ATLAS stages cover reconnaissance, skill poisoning and injection [4][6][12]. All of it is research output: a marketplace sweep, a benchmark, two automation frameworks and a protocol proposal [7][9][10][11]. It is one analyst's reading over one month [1].
What to watch
- Whether the two marketplaces in the sweep publish removal counts for the 157 confirmed skills.
- Whether Model Context Protocol maintainers adopt anything resembling the secure architecture the fourth study proposes.
- Whether reinforcement-learned injection strings turn up in incident reports against production agents, not only benchmarks.