Fake Landing-Page Skill Reached 26,000 Agents After Passing Scanners

AIR researchers created a fake AI skill for building landing pages, promoted it through Instagram and watched it spread. AIR says 26,000 agents were affected even though the skill passed every scanner the company tested.

The skill itself did not contain the later instructions. It sent agents to setup documentation on a domain controlled by AIR. That domain initially redirected to the legitimate Google Stitch service. After the skill had been reviewed and distributed, AIR changed the remote page so it told agents to download and run a script.

The public payload collected an email address so the researchers could count and notify participants. AIR says no agents were harmed. Its 26,000 figure is vendor-reported and has not been independently verified, but the experiment demonstrated a practical gap between scanning a skill and controlling what the skill later asks an agent to retrieve.

The scanner never saw the final instructions

AIR named the skill brand-landingpage and presented it as a way for non-technical users to create a website with Google’s Stitch design tool. The package pointed to stitch-design.ai for installation instructions. Google’s real Stitch service used a different domain.

During review, the researcher-controlled domain redirected to the legitimate site. AIR says Cisco’s and Nvidia’s scanners, along with the scanners used by skills.sh, marked the skill safe. Those products examined the package and its bundled resources. The later content behind the external link remained under AIR’s control.

When AIR changed the page, agents following the skill received instructions to fetch and run a script. The skill files did not need another release, so an install-time hash or scanner result would still describe the earlier package.

Distribution supplied the credibility

AIR placed the skill in a GitHub-hosted marketplace repository with about 36,000 stars. The listing inherited the repository’s visible reputation even though the stars were not endorsements of this particular contribution. The Instagram promotion then targeted marketers, sales staff and designers rather than security-conscious developers.

That path is useful to an attacker because each stage looks ordinary. The marketplace appears popular, the scanner badge is green and the advertised task is familiar. None of those signals establishes who controls an external domain or what it will serve next week.

The experiment also reached users outside engineering. A person who has never reviewed a package manifest can still add a skill to an agent that holds business data. Security controls built only around developer tooling will miss that adoption route.

Remote documentation belongs in the dependency inventory

Skill review needs to record more than the files committed to a repository. External documentation, download URLs and API setup pages can all alter an agent’s behavior. Reviewers should capture the final redirect destination, domain owner and content seen at approval time.

That evidence creates a baseline for later checks. A changed response body, new redirect or domain registration event can trigger another review. Organizations can also restrict agent web access to approved domains and block newly registered look-alikes such as the one used in AIR’s test.

Transitive references need the same treatment. If the documentation tells an agent to install a package or fetch another script, the dependency inventory must continue to that object. Stopping at the first URL recreates the scanner blind spot one hop later.

Limit what a changed instruction can reach

The same skill produces a different risk on a research agent than on an assistant with a shell and access to company systems. Keep business agents on separate, scoped identities and avoid handing every skill the same filesystem, SaaS and network permissions.

Tool policy should sit outside the skill. An instruction fetched from the web should not be able to approve its own shell command or choose an unrestricted outbound destination. High-impact actions need an independent rule or human decision that exposes the command and the data it can send.

Runtime logs complete the picture. Record when the agent loaded the skill, which remote content it fetched, the resolved URL and hash, and every command launched as a result. Without that chain, a changed web page can disappear before responders learn what it instructed.

Find the skills already in use

Start with an inventory of skills installed in managed agents and the personal accounts used for company work. Record the skill owner, source repository, installed version and external domains. Flag skills that instruct an agent to execute downloads or follow setup material outside the reviewed package.

For a suspicious skill, preserve the package and remote content before disabling it. Then review agent traces, endpoint process activity and outbound connections. Rotate any credential that reached a downloaded script, even if the original skill package still scans clean.

The brand-landingpage package passed the scanners AIR tested because its harmful potential sat behind a link that changed later. A useful review must follow that link, preserve what it sees and keep checking who controls it.

Verify that every retained skill maps to a current owner, reviewed source and approved external domain. Close a suspicious-skill investigation only after remote content and agent traces are preserved, unexplained commands and connections are scoped, and credentials available to downloaded code are rotated.