Fake AI Agent Skill Slipped Past Every Scanner and Reached 26,000 Agents

Fake AI Agent Skill Passed Security Scans and Reportedly Reached 26,000 Agents

AIR's fake skill reached 26,000 agents by bypassing security scanners, then modifying external content after approval—proving scanners only vet the submitted package. Managers must vet skill sources, assume external URLs change post-deployment, and enforce least privilege.