Researchers have uncovered a large scale supply chain attack targeting AI agents through trojanized skills uploaded to the open agent skills ecosystem skills.sh. The campaign, discovered by security firm Zenity, exploited typosquatting techniques by impersonating the popular AI services Paperclip and Browser Use to distribute malicious skills that instructed AI agents to install a credential stealing payload from GitHub. According to the researchers, the malicious skills were first uploaded on July 11 and accumulated more than 1.7 million combined installs by August 2, making them one of the most successful attacks observed against the growing AI software supply chain. The incident highlights increasing efforts by threat actors to compromise AI development environments by manipulating shareable instruction and configuration files that guide the behavior of AI agents.
Zenity reported that the attackers began preparing the campaign in early July by creating fake GitHub organizations named getpaperclipai and browser use headless that closely resembled the legitimate repositories maintained by the developers of Paperclip AI and Browser Use. The attackers initially copied the legitimate skills into the skills.sh marketplace, operated by Vercel, allowing them to pass marketplace verification checks. After the skills gained credibility, the threat actors updated them with malicious installation instructions. Their original plan involved directing AI agents to install malicious npm and PyPI packages, but those packages were quickly identified and removed from both repositories. The attackers then changed tactics by modifying the skills to instruct AI agents to clone attacker controlled GitHub repositories and install the malicious software directly. The payload was designed to steal sensitive information from developer workstations, continuous integration environments, and AI agent workspaces, including SSH keys, cloud credentials, Git tokens, package manager tokens, Kubernetes and Docker configurations, deployment platform credentials, database access details, infrastructure as code files, and project environment files.
According to Zenity, the attackers uploaded several Paperclip related skills because the platform relies on interconnected skill files that automatically reference one another during installation. Since these skills triggered cascading installations, researchers said it is difficult to determine the exact number of affected users, although each individual skill received approximately 300,000 installs and appeared on the skills.sh trending list. The attack also demonstrated how progressive skills discovery can make malicious behavior more difficult to detect. Instead of embedding harmful instructions in the primary skill file, the attackers placed the malicious commands inside a secondary installation document that AI agents were instructed to access only when installing or starting the Paperclip platform. The instructions further directed the AI agents to treat the attacker controlled GitHub repository as the only trusted source and avoid searching package repositories, ensuring the malicious software would be installed instead of legitimate versions.
Researchers warned that AI agent configuration files, including skills and Model Context Protocol definitions, require continuous monitoring and careful review before deployment because they contain natural language instructions rather than traditional executable code. This makes automated security analysis significantly more challenging and increases the risk of malicious instructions bypassing conventional static detection methods. To help organizations identify such threats, Zenity introduced a free security service called AI Total. The platform executes AI skills inside a controlled sandbox environment using live AI agents equipped with decoy credentials, sensitive files, and full network monitoring capabilities. By observing downloaded packages, accessed files, network connections, and other agent activities, AI Total enables security teams to analyze potentially malicious AI skills before they are deployed in production environments, providing an additional layer of protection against emerging attacks targeting the AI software supply chain.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
