TL;DR: Poisoned AI skills can deliver credential-stealing malware onto corporate endpoints by disguising a required add-on as part of a normal workflow, according to Cyera's research. Marketplace grades and productivity cues do not replace scrutiny of what the skill is asking the user or agent to install.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Cyera's research: Poisoned AI skills were used to distribute credential-stealing malware, showing that trusted productivity workflows can become infection routes on corporate endpoints.
Why it matters: This matters because endpoint access, cloud credentials, and internal systems can be exposed when employees treat AI extensions as routine productivity tools rather than executable software with changeable behavior.
Context
AI skills are reusable instructions that can extend what an agent or user can do, but they also expand the trust boundary around the endpoint. When a skill asks for a prerequisite install or a setup step, the user is no longer dealing with a passive helper but with code-like behaviour that can change the device's security profile.
Corporate endpoints often sit at the junction of code, cloud accounts, and internal systems, so a malicious skill can turn a convenience feature into a route for credential theft and lateral exposure. That risk is not unusual for endpoint extensions and add-ons, but AI skills make it easier to hide harmful instructions inside a productivity workflow.
Key questions
Q: How do poisoned AI skills infect corporate endpoints?
A: Poisoned AI skills infect corporate endpoints by packaging a skill with a payload, such as a script, macro, installer or malicious configuration, then getting a user or automation to run it with local trust. Infection usually depends on execution, persistence or abuse of endpoint management channels, not the skill label itself.
Q: Why do marketplace security scores fail to stop malicious skills?
A: Marketplace security scores fail because they rate the listed package, not the hidden behaviour that appears after installation or during runtime. A malicious skill can still use bundled files, deferred execution, obfuscated logic or external callbacks to deliver unwanted actions on the endpoint, even when the published score looks reassuring.
Q: How should teams govern AI skills that can change endpoint behaviour?
A: Teams should govern AI skills that can change endpoint behaviour as privileged software with explicit ownership, code review, allowlisting and revocation paths. If the skill ships bundled files, those artefacts need inspection for scripts, binaries, installers and persistence mechanisms before deployment, and endpoint controls should restrict what the skill can execute or modify.
Q: What signs suggest a malicious AI skill has been installed?
A: Signs include unexpected process launches, new startup entries, altered browser or system settings, unusual network callbacks, file drops, and changes to security tools or access controls. A malicious AI skill may also request excessive permissions, install persistence, or behave differently after approval than it did during review.
Technical breakdown
How a poisoned AI skill becomes an infection path
An AI skill is a reusable instruction set that tells an agent how to perform a task, often by chaining prompts, files, scripts, or external resources. The danger begins when the skill introduces a prerequisite package or setup step that the user believes is necessary for the requested function. That step can deliver malware, add hidden dependencies, or steer execution toward an attacker-controlled service. Because the installation happens in the context of a legitimate task, the malicious action is easier to normalise and much harder for a user to question. See the Agent Skills Security Guide.
Practical implication: Treat prerequisite installs in skills as a control point and block any package that is not explicitly approved for the workflow.
Why endpoint context increases the blast radius
A corporate endpoint is not just a laptop. It is a bridge to saved browser sessions, cloud consoles, code repositories, and internal systems, which means an infostealer can harvest more than local files. Once credentials or session tokens are stolen, the attacker can reuse authenticated access without needing to break in again. That is why malware delivered through an AI extension can create business-wide exposure even when the original action looked like a routine productivity boost. Read Top 10 Endpoint Security Risks.
Practical implication: Limit the authority of endpoints that can install or run skills, especially where browser sessions and cloud access are already present.
Why security grades can create false confidence
Marketplace security grades often compress risk into a simple label, but a label rarely covers the full package. In this case, the rating reflected visible metadata and not necessarily every bundled script, support file, or concealed instruction path. That means a skill can appear low-risk while still carrying dangerous behaviour. Security scoring is useful only when it is paired with package inspection, behavioural review, and an approval model that accounts for what the extension can do after installation.
Practical implication: Do not let repository scores override package-level review of scripts, dependencies, and installation instructions.
Threat narrative
Attacker objective: The attacker wants to convert a normal productivity installation into durable access to corporate accounts, data, and internal systems.
- Entry occurred when a malicious AI skill was presented as a required add-on for a productivity or developer workflow.
- Credential harvesting followed when the AMOS payload collected saved passwords, browser sessions, and sensitive files from the endpoint.
- Impact came from the reuse of stolen sessions and credentials to reach company accounts and internal resources beyond the infected device.
Breaches seen in the wild
- CircleCI breach 2023: Malware stole a CircleCI engineer's SSO session; attackers exfiltrated customers' CI/CD secrets and keys, forcing a platform-wide rotation.
- Shai Hulud npm malware campaign: Shai Hulud campaign: npm malware exposed secrets on GitHub.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Poisoned AI skills create a new control problem at installation time: the meaningful decision is no longer whether the base AI tool is acceptable, but whether a skill is allowed to alter the device and its trust chain. Once a prerequisite install is normalised, a productivity workflow can become an execution path for malware. Practitioners should treat skill installation as a governed software change, not a user convenience.
The real failure mode is trust transfer from marketplace metadata to code execution: a high security grade can reassure users while leaving scripts, bundled resources, and hidden instructions outside the review boundary. That creates a verification gap in which the label is seen as the control instead of the input to a control. The lesson is that approval needs to cover the full package and the behaviour it can trigger.
Corporate endpoints remain the most fragile place to absorb AI extension risk: they already hold session tokens, cloud access, and developer credentials, so a single malicious skill can create disproportionate blast radius. The governance answer is not to treat endpoint AI as a separate class of risk, but to extend software review, access restriction, and monitoring discipline to every agent add-on that can change execution.
Malicious skill delivery is a practical example of extension trust drift: the organisation approves one capability and gradually inherits additional behaviour, dependencies, and access paths that were never reviewed as a whole. That drift matters because the security decision is made once, while the operational change can persist and evolve afterwards. Security teams should assume every AI extension can become a changeable software supply chain on the endpoint.
The identity angle is direct because the endpoint becomes a proxy for human and machine authority: when a skill runs in a developer context, it can inherit access to cloud accounts, code repositories, and internal services already available on that device. That makes the endpoint part of the identity control plane, not just a compute asset. Agent Skills Security Guide is the relevant governance lens here because the issue is who can introduce skill-based authority and how it is reviewed.
From our research library:
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
- Read next: Agent Skills Security Guide
What this signals
Extension trust drift: organisations tend to approve the base AI tool and then inherit unreviewed behaviour through skills, connectors, and supporting packages. That drift turns a one-time approval into a moving trust boundary, so governance has to cover post-approval change as much as initial selection.
The practical programme shift is toward endpoint-centred AI control, where software review, session protection, and access limitation are applied to AI add-ons in the same way they are applied to any other executable change. Skills that can touch credentials or cloud sessions need the same scrutiny as any code path that can modify identity-bearing resources.
For practitioners
- Establish skill installation approvals Require review before any AI skill can add a prerequisite, external package, or setup component to a managed endpoint.
- Inspect the full skill package Scan supporting scripts, referenced resources, and hidden instructions, not just the main instruction file or marketplace description.
- Restrict endpoint authority for sensitive workflows Separate developer endpoints from privileged cloud sessions and limit where browser tokens, code access, and internal credentials can be used.
- Train users to challenge prerequisite prompts Make staff treat urgent setup messages, mandatory add-ons, and any claim that a skill cannot work without extra software as a review trigger.
- Monitor agent behaviour continuously Track what skills actually do after installation, especially when they request access to secrets, sessions, or external services.
Key takeaways
- A malicious AI skill can turn a routine productivity action into a malware delivery path on a managed endpoint.
- Marketplace ratings do not establish safety when bundled files or hidden instructions can still execute.
- The limiting control is governed review of the full skill package, plus tighter endpoint authority and continuous behaviour monitoring.
Related NHI Mgmt Group resources: Agent Skills Security Guide · Top 10 Endpoint Security Risks · CircleCI breach 2023 · Shai Hulud npm malware campaign
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | AMOS steals passwords, sessions, and files from endpoints exposed through malicious skills. |
| NHI-10 — Human Use of NHI | Employees are induced to run harmful skill components from a human workflow on a managed endpoint. | |
| Recommendation — Scan skills and endpoints for secret exposure and revoke any credential that may have been harvested. Review where human approval enables machine-executed actions that can change endpoint trust. | ||
| CIS Controls v8 | CIS-5 — Account Management | Endpoint compromise threatens account use through stolen sessions and reused credentials. |
| Recommendation — Tighten account lifecycle controls for endpoints that can access cloud and code systems. | ||
| MITRE ATT&CK | TA0006;TA0010 — Credential Access; Exfiltration | The campaign steals credentials and files from infected corporate endpoints. |
| Recommendation — Map skill-delivered infostealer activity to credential access and exfiltration detections. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The campaign abuses the permissions already present on a corporate endpoint. |
| Recommendation — Limit endpoint entitlements so AI add-ons cannot inherit broad access by default. | ||
Key terms
- Atomic MacOS Stealer: Atomic MacOS Stealer, often shortened to AMOS, is an infostealer malware family focused on macOS systems. It is used to harvest stored credentials, browser sessions, and local files that can be reused for account access or follow-on intrusion.
- AI Skill: A reusable bundle of prompts, scripts, references, and assets that an AI client can load when needed. In enterprise use, a skill becomes part of the workflow control surface because it can shape how the system responds, escalates, or handles policy-sensitive tasks.
- Infostealer: An infostealer is malware built to collect credentials, session material, tokens, and other authentication data from infected systems. In NHI programmes, the risk is not only theft but reuse, because harvested workload secrets can unlock cloud access long after the initial infection.
- Browser session: A browser session is the live, authenticated interaction between a user and an application after login. In identity governance, it is where access is actually exercised, which makes it a security boundary when attackers can manipulate the user interface, tokens, or workflow without changing infrastructure configuration.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It is a practical fit for practitioners who need to connect identity controls to broader endpoint and access risk.
Published by the NHIMG editorial team on November 6, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org