SKILL POISONING TURNS AI AGENTS INTO MALWARE DROPPERS

Summary from the TLDR InfoSec newsletter

China's National Computer Virus Emergency Response Center is warning of "skill poisoning" attacks, where counterfeit plugins compromise AI agents to secretly download malware. Analysts have already identified eight malicious skill packs in popular agent repositories that impersonate legitimate tools, granting attackers unauthorized file access and remote-control capabilities. These poisoned plugins exploit an AI agent's natural task-execution design, bypassing the need for a user to actually click a suspicious link.