Topic starter
06/11/2026 6:40 pm
TL;DR: Poisoned AI skills can smuggle credential-stealing malware onto corporate endpoints by framing installation as a workflow prerequisite, according to Cyera's analysis. That means security teams have to govern what add-ons can alter on managed devices, not just what the base AI product was approved to do.
Editorial analysis by NHI Mgmt Group, based on content published by Cyera: “How AMOS-Poisoned AI Skills Put Corporate Endpoints at Risk”.
Key questions
Q: Why do marketplace security scores fail to stop malicious skills?
A: Marketplace security scores fail because they rate the listed package, not the hidden behaviour that appears after installation or during runtime.
Q: How should teams govern AI skills that can change endpoint behaviour?
A: Teams should govern AI skills that can change endpoint behaviour as privileged software with explicit ownership, code review, allowlisting and revocation paths.
Q: How do poisoned AI skills infect corporate endpoints?
A: Poisoned AI skills infect corporate endpoints by packaging a skill with a payload, such as a script, macro, installer or malicious configuration, then getting a user or automation to run it with local trust.
Practitioner guidance
- Establish skill installation approvals Require review before any AI skill can add a prerequisite, external package, or setup component to a managed endpoint.
- Inspect the full skill package Scan supporting scripts, referenced resources, and hidden instructions, not just the main instruction file or marketplace description.
- Restrict endpoint authority for sensitive workflows Separate developer endpoints from privileged cloud sessions and limit where browser tokens, code access, and internal credentials can be used.
Bottom line: A malicious AI skill can turn a routine productivity action into a malware delivery path on a managed endpoint.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:41 pm
Poisoned AI skills create a new control problem at installation time: the meaningful decision is no longer whether the base AI tool is acceptable, but whether a skill is allowed to alter the device and its trust chain. Once a prerequisite install is normalised, a productivity workflow can become an execution path for malware. Practitioners should treat skill installation as a governed software change, not a user convenience.
A few things that frame the scale:
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
A question worth separating out:
Q: What signs suggest a malicious AI skill has been installed?
A: Signs include unexpected process launches, new startup entries, altered browser or system settings, unusual network callbacks, file drops, and changes to security tools or access controls. A malicious AI skill may also request excessive permissions, install persistence, or behave differently after approval than it did during review.
👉 Read our full editorial: Poisoned AI skills turn endpoint access into a malware path