AI Summary

Researchers from Zenity discovered a campaign that used trojanized AI agent skills to deploy a credential stealer. The malicious skills were first uploaded to the open skills ecosystem skills.sh on July 11, with names that typosquatted popular AI services Paperclip and Browser Use. By August 2, the compromised skills had been downloaded more than 1.7 million times. The attack illustrates a growing trend of poisoning AI software supply chains by targeting sharable instruction and configuration files for agentic tools.

AI summaries can be wrong sometimes—always verify important details using the source article.