Notifications
Clear all
Topic starter
18/08/2026 2:41 pm
TL;DR: AI skills now turn LLMs into systems that can query data, invoke tools, and interact with services, but ActiveFence’s analysis shows those same capabilities expand the attack surface through prompt injection, confused-deputy abuse, and multi-agent trust gaps. The practical lesson is that agent security depends on deterministic controls around the model, not prompt engineering alone.
NHIMG editorial — based on content published by ActiveFence: AI Skills Security, a practitioner’s guide to emerging threats
By the numbers:
- 82.4% of state-of-the-art LLMs execute malicious commands from peer agents that they would refuse from direct user input.
- A 2024 analysis of 1,038 ChatGPT plugins found 173 plugins with broken access control vulnerabilities.
- A 2024 analysis of 1,038 ChatGPT plugins found 368 plugins that leaked developer credentials, including API keys and OAuth tokens.
Questions worth separating out
Q: How should security teams govern AI models that can call tools and access data?
A: Security teams should govern AI models as non-human identities with named owners, limited scope, short-lived credentials, and continuous authorization.
Q: Why do AI agents create more risk than traditional automation?
A: AI agents create more risk because they can interpret context, choose actions, and invoke tools autonomously.
Q: What breaks when an AI agent trusts peer agents too readily?
A: A single compromised agent can influence others through shared instructions, delegated tools, or broadcast context, creating lateral movement across the agent mesh.
Practitioner guidance
- Classify AI skills as governed identities Assign each skill, tool, or agent an owner, explicit purpose, approved data scope, and expiry or review date so authority is not left implicit.
- Enforce least-privilege tool boundaries Separate read, write, and external communication permissions, and require read-only tokens wherever an agent does not truly need mutation rights.
- Block untrusted content from direct action paths Quarantine retrieved web pages, emails, documents, and peer-agent messages before the model can turn them into tool calls or state changes.
What's in the full article
ActiveFence's full analysis covers the operational detail this post intentionally leaves for the source:
- Step-by-step examples of how AI skills, plugins, and MCP-style integrations become exploitable through indirect prompt injection.
- Proof-of-concept material showing how malicious instructions flow from retrieved content into tool invocation and data exfiltration.
- Mitigation patterns for sandboxing, guardrails, and monitoring that are grounded in the article's examples.
- The article's timeline of MCP ecosystem vulnerabilities and why each one matters for deployment decisions.
👉 Read ActiveFence's analysis of AI skills security threats and agentic trust gaps →
AI skills security: what the hidden trust gaps mean for teams?
Explore further
18/08/2026 3:25 pm
AI skills are becoming non-human identities in practice, even when organisations do not label them that way. Once a model can use tools, access data, and act across services, it needs identity, privilege, and lifecycle governance like any other high-value machine actor. The governance gap is not theoretical: these systems inherit authority without always inheriting controls. Practitioners should classify agent skills as governed identities, not informal automations.
A question worth separating out:
Q: Who is accountable when an AI agent accesses sensitive data it was not meant to use?
A: Accountability sits with the team that approved the agent, its connectors, and its policy boundaries, not with the runtime behaviour alone. Organisations need ownership for intent, permissions, monitoring, and validation so they can prove whether the agent stayed inside its approved purpose. Without that, audit and regulatory response become retrospective guesswork.
👉 Read our full editorial: AI skills security exposes trust gaps in agentic AI architectures
