The skill promised to summarise YouTube videos. Before it would run, it asked for one extra step: paste a short command into the terminal to install a helper tool. That command installed a keylogger, a program that records every keystroke and sends it to someone else. Passwords included.

The case is real. In early 2026, Koi Security audited all 2,857 skills then listed on ClawHub, the marketplace for the open-source agent OpenClaw. It found 341 malicious ones, 335 of them from a single campaign that Koi named ClawHavoc. Windows users got the keylogger. Mac users got Atomic Stealer, malware built to harvest stored passwords and credentials.

Most risky skills are less obvious. A study of 31,132 skills from two public marketplaces found at least one dangerous pattern in 26.1% of them. The most common was data exfiltration, meaning data leaves the machine without the user knowing. It showed up in 13.3% of all skills. A second audit by the security firm Snyk used a different method on 3,984 skills and found at least one flaw in 36.8%. The two numbers differ. They point the same way.

Set that against how people approve these tools. In March 2026, Anthropic reported that users accept 93% of the permission prompts in its coding agent Claude Code. By August the figure had risen to 97%. Both are the vendor's own numbers and have not been independently verified. The pattern is still hard to miss. One skill in four carries a risk pattern, and almost every request for access gets a yes.

That gap is what this article is about. It does not open in the model. It opens when an extension is installed, and it opens again with every update. Both moments are under the user's control.

An extension sees more than its user

Three terms are enough.

  • A skill is a folder of instructions for the model, often with scripts that run on the user's machine.
  • A connector, or MCP server, links the model to services like Google Drive, Gmail or a database. MCP stands for Model Context Protocol, a standard for plugging models into outside tools.
  • An agent is a model that calls these tools on its own.

The model reads an extension's full text, including the parts no user ever sees. That makes prompt injection possible: instructions hidden in a text, which the model follows as if they came from the user. In 2025, Invariant Labs showed that a malicious connector can use this to steal data. It can even override instructions from other, trusted connectors. The agent takes every tool description at face value, so an injected command looks like a normal step.

The security community has started to treat this as a category of its own. OWASP, the non-profit whose top-ten lists are the reference point for web security, published its first Top 10 for Agentic Applications in December 2025. Compromised tools, plugins and connectors appear there as a separate risk: supply chain vulnerabilities in agentic systems. The term fits. An extension is a supplier, and the agent trusts it the way a company trusts a contractor with a master key.

Three routes lead in

The documented incidents so far fall into three groups. They call for different defences, so it pays to keep them apart.

Malicious from the start. ClawHavoc is the textbook case. The skills looked useful, carried plausible names and hid their payload in a harmless-looking setup step. Checking the extension itself catches this route.

Vulnerable by accident. mcp-remote is a small helper that lets AI apps such as Claude Desktop reach connectors on the internet. In July 2025, the security firm JFrog found a flaw in it, catalogued as CVE-2025-6514 and rated 9.6 out of 10 for severity. A malicious server could use it to run any command on the user's computer. The package had been downloaded more than 437,000 times. Nobody had planned an attack. Updates close this route, and only updates.

Legitimate, but steered from outside. In May 2025, Invariant Labs showed an attack on GitHub's official MCP server. A single issue in a public repository contained hidden instructions. When a developer asked the agent to look at open issues, it read private repositories and published their contents in a public pull request. Invariant stressed that the server's code had no bug. The weakness lay in what the agent was allowed to combine. The same mechanism works without any third-party extension at all. EchoLeak, disclosed in June 2025, needed nothing but one email to make Microsoft 365 Copilot leak internal data. It was rated 9.3 out of 10, patched on Microsoft's side, and no attacks in the wild are known.

Only the first route is stopped by asking whether an extension is malicious. The second needs updates. The third can only be contained by limiting what an agent may do at the same time.

Three capabilities make an agent exploitable

Simon Willison is the developer who coined the term prompt injection in 2022. His rule of thumb explains why some extensions are harmless and others are not. An agent becomes easy to exploit when it has three things at once:

  • access to private data,
  • exposure to untrusted content,
  • a way to send data out.

Untrusted content is anything a third party controls, such as web pages, incoming email or outside documents. Each capability alone is ordinary. Together they give an attacker everything needed: something worth stealing, a way to plant instructions and a way to get the data out. The GitHub case fits exactly. The public issue was the untrusted content, the private repositories were the data, and the pull request was the way out.

Scripts add a fourth factor. The marketplace study found that skills bundling executable scripts are 2.12 times more likely to be vulnerable than skills made only of instructions. The reason is simple. Instructions can only steer the model, and the model can still refuse. Scripts act on the machine directly, usually with the full rights of the user who installed them.

Updates reopen the question

An extension that is clean today may not be clean tomorrow. The first malicious connector documented in the wild shows how that works. In September 2025, Koi Security found a package called postmark-mcp on npm, the main registry for JavaScript software. It copied the code of the email service Postmark, which had nothing to do with it. Fifteen versions worked exactly as advertised. Version 1.0.16 added a single change: every email the agent sent went out with a blind copy to an address controlled by the publisher. At that point the package counted about 1,500 downloads a week.

Researchers describe this as a pattern, not a one-off:

  1. Attackers publish a useful, well-documented service.
  2. They wait until people rely on it.
  3. Then they push a backdoor through an update.

Nothing in most marketplaces requires signed versions or change audits, so users rarely notice. A check at installation is therefore necessary but not enough. Every update is a new installation in disguise.

Approval has become a reflex

Users rarely catch any of this, because few read what they approve. The habit is older than AI. A 2012 study of Android apps found that only 17% of users paid attention to permissions during installation. Only 3% of respondents answered all three comprehension questions correctly. App permissions and AI extensions differ in detail. The habit of clicking through is the same.

Anthropic's own data adds a telling detail. When Claude Code presents a plan, users reject 39% of them. When it asks for a single permission, they reject 3%. People do judge what an AI proposes, as long as it reads like a decision. A permission prompt reads like a formality.

The vendor has drawn its own conclusion. In a study with 1,053 paid testers, Anthropic's automated classifier caught 89% of deliberately dangerous commands, while human reviewers caught 13.6%. Since 14 August 2026, this "auto mode" has been the default for new sessions on the Pro, Max and Team plans. Anthropic's documentation states plainly that it reduces prompts but does not guarantee safety. The classifier judges actions while the agent runs. Which extensions the agent carries in the first place is still decided at installation.

What the evidence does not show

  • Nobody has solved the problem. Willison's own assessment is that nobody yet knows how to prevent these attacks with full reliability.
  • The one-in-four figure is an estimate. It comes from automated detection with 86.7% precision and 82.5% recall. Snyk's 36.8% rests on a different method and a smaller sample. Neither covers every extension in existence.
  • Several key figures come from a single vendor. The approval rates and the classifier comparison are Anthropic's own data. Independent research on app permissions points the same way, but it is fourteen years old and concerns Android, not AI.
  • Documented incidents are only the visible part. How many attacks go unnoticed is unknown. For EchoLeak, no exploitation in the wild has been reported.

The decision is made at installation, and again with every update

The debate about AI security is mostly about models. Do they hallucinate? Can they be manipulated? The everyday gap is plainer. Someone installs an extension nobody has read and approves a prompt nobody has understood. Later an update arrives, and nobody looks again.

Vendors respond by automating approvals. That helps within a session, but it only moves the decision elsewhere. What an agent may carry is decided at installation, and decided again with every update. Whoever skips that decision leaves it to the publisher.

The second part, Checking an AI extension before installation, turns this into six concrete steps.

Sources

Opening

  • Koi Security (2026), "ClawHavoc: 341 Malicious Clawed Skills Found by the Bot They Were Targeting", koi.ai, with update of 16 February 2026; the original URL now redirects. Documented independently by Palo Alto Networks Unit 42 (2026), "OpenClaw's Skill Marketplace and the Emerging AI Supply Chain Threat", unit42.paloaltonetworks.com, 24 June 2026.
  • Liu, Y. et al. (2026), "Agent Skills in the Wild: An Empirical Study of Security Vulnerabilities at Scale", arXiv:2601.10338.
  • Snyk (2026), "ToxicSkills", snyk.io, 5 February 2026. Security vendor; method differs from Liu et al.
  • Anthropic (2026), "Claude Code auto mode: a safer way to skip permissions", anthropic.com/engineering, March 2026; "Auto mode is now the default in Claude Code for Pro, Max, and Team plans", claude.com/blog, 7 August 2026. Vendor data; not independently verified.

An extension sees more than its user

  • Invariant Labs (2025), "MCP Security Notification: Tool Poisoning Attacks", invariantlabs.ai, 1 April 2025.
  • Wang, Z. et al. (2025), "MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers", arXiv:2508.14925.
  • OWASP GenAI Security Project (2025), "OWASP Top 10 for Agentic Applications for 2026", genai.owasp.org, December 2025.

Three routes lead in

  • JFrog Security Research (2025), "CVE-2025-6514: Critical mcp-remote RCE Vulnerability", jfrog.com, 9 July 2025; download figure as reported by The Hacker News, 10 July 2025.
  • Invariant Labs (2025), "GitHub MCP Exploited: Accessing private repositories via MCP", invariantlabs.ai, 26 May 2025.
  • Reddy, P., Gujral, A. S. (2025), "EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System", arXiv:2509.10540; Microsoft Security Response Center, CVE-2025-32711.

Three capabilities make an agent exploitable

  • Willison, S. (2025), "The lethal trifecta for AI agents: private data, untrusted content, and external communication", simonwillison.net, 16 June 2025.
  • Willison, S. (2022), "Prompt injection attacks against GPT-3", simonwillison.net, 12 September 2022.
  • Liu, Y. et al. (2026), see above (factor 2.12 for skills with executable scripts).

Updates reopen the question

  • Koi Security (2025), postmark-mcp advisory, reported by The Hacker News, 29 September 2025, and Dark Reading, 29 September 2025; Postmark (2025), "Security Alert: Malicious 'postmark-mcp' npm Package Impersonating Postmark", postmarkapp.com.
  • "MCPGuard: Automatically Detecting Vulnerabilities in MCP Servers" (2025), arXiv:2510.23673.

Approval has become a reflex

  • Felt, A. P., Ha, E., Egelman, S., Haney, A., Chin, E., Wagner, D. (2012), "Android Permissions: User Attention, Comprehension, and Behavior", Proceedings of SOUPS '12, doi:10.1145/2335356.2335360.
  • Anthropic (2026), see above (39% and 3% rejection rates, auto mode default); study with 1,053 testers as reported by TechCrunch, 9 August 2026.
  • Anthropic (2026), "Choose a permission mode", Claude Code documentation, code.claude.com. As of September 2026.

What the evidence does not show

  • Willison, S. (2025), see above.
  • Liu, Y. et al. (2026), see above (detection precision and recall).
  • Reddy, P., Gujral, A. S. (2025), see above.

Transparency note: Research, structure and first draft were produced with Claude (Anthropic). All figures were checked against the sources listed. Several sources come from Anthropic itself and are marked as vendor data. As of September 2026.

The link has been copied!