AI Summary

Researchers at Zenity identified a campaign that trojanized AI agent skills to install a credential‑stealing payload. The malicious skills were uploaded on July 11 to the open skills ecosystem at skills.sh, using names that typo‑squatted popular AI services such as Paperclip and Browser Use. By August 2 the compromised skills had been downloaded more than 1.7 million times, illustrating a growing trend of attacks on the AI software supply chain.

AI summaries can be wrong sometimes—always verify important details using the source article.