Posts

OWASP Agentic Skills Top 10: Security Risks and Mitigations for Agentic Skill Ecosystems

The OWASP Agentic Skills Top 10 (August 2026 publication) provides the first comprehensive framework for securing agent skill ecosystems—modular bundles of instructions and code that extend AI agent capabilities.  The document identifies ten critical risk categories: Malicious Skills (AST01), Supply Chain Compromise (AST02), Over-Privileged Skills (AST03), Insecure Metadata (AST04), Untrusted External Instructions (AST05), Weak Isolation (AST06), Update Drift (AST07), Poor Scanning (AST08), No Governance (AST09), and Cross-Platform Reuse (AST10). Each risk is documented with real-world evidence including the ClawHavoc campaign (1,184 malicious skills), Snyk's ToxicSkills research (280+ leaky skills), and CVE incidents like ClawJacked and Claude Code vulnerabilities.  The framework provides attack scenarios, preventive mitigations, code examples, and mappings to OWASP AISVS controls, CSA MAESTRO layers, and other industry standards. It emphasizes that skills combine natural-lan...
Post a Comment
Read more

Agent Skills in the Wild: An Empirical Study of Security Vulnerabilities at Scale

This academic study presents the first large-scale empirical security analysis of AI agent skills—modular packages that extend agent capabilities through instructions and executable code. Analyzing 31,132 unique skills from two major marketplaces (skills.rest and skillsmp.com) using SKILLSCAN, a multi-stage detection framework combining static analysis with LLM-based classification, the researchers found that 26.1% of skills contain at least one vulnerability across 14 distinct patterns in four categories: prompt injection, data exfiltration, privilege escalation, and supply chain risks.  Data exfiltration (13.3%) and privilege escalation (11.8%) were most prevalent, while 5.2% exhibited high-severity patterns suggesting malicious intent. Skills bundling executable scripts were 2.12× more likely to contain vulnerabilities than instruction-only skills (OR=2.12, p<0.001).  The framework achieved 86.7% precision and 82.5% recall against manually annotated ground truth. The stu...
Post a Comment
Read more

The Evolving Software Supply Chain Attack Surface: 2026 Open Source Malware Report

Sonatype's 2026 report reveals a dramatic escalation in open source malware, with over 454,600 new malicious packages identified in 2025—bringing the cumulative total to more than 1.233 million across npm, PyPI, Maven Central, NuGet, and Hugging Face.  The year marked a turning point where isolated incidents became industrialized campaigns, with over 99% of malware occurring on npm. Key developments include state-linked Lazarus Group operations (800+ packages, 97% on npm) using multi-stage payload chains with droppers (98%), secrets exfiltration (64%), and backdoors (29%); the first self-replicating npm worms (Shai-Hulud and Sha1-Hulud) that compromised over 500 packages and propagated autonomously; and massive spam campaigns like IndonesianFoods creating 150,000+ packages in days.  Attackers increasingly exploit developer behavior through typosquatting, namespace confusion, and toolchain masquerading—targeting high-velocity ecosystems like Tailwind, Vite, and React. Emerging ...
Post a Comment
Read more

2026 Open Source Security and Risk Analysis Report: Software Governance in the AI Era

Black Duck's 2026 OSSRA report reveals a pivotal shift in software development driven by AI-assisted coding.  Analyzing 947 commercial codebases, it finds open source is now universal (98% of codebases), with mean vulnerabilities per codebase more than doubling to 581, license conflicts surging to a record 68% of codebases, and over 90% containing significant maintenance debt.  Key drivers include a 74% year-over-year increase in files per codebase, a 30% rise in components per application (averaging 1,180), and the mainstream adoption of AI coding assistants (used by 67% of organizations, with 71% using them against policy).  The report documents major 2025 supply chain attacks (PhantomRaven, Shai-Hulud worm, React2Shell), the emerging risk of AI models (49% of organizations ship them directly), and the regulatory pressure from the EU Cyber Resilience Act (CRA) requiring 24-hour vulnerability reporting and comprehensive SBOMs.  It concludes that organizations need d...
Post a Comment
Read more

Staying Ahead of Adversarial AI Through Agentic Source Code Review

Google's Mandiant team introduces the Agentic Vulnerability Discovery Harness (AVDH), a multi-agent AI framework that augments human expertise to rapidly discover and validate vulnerabilities in source code.  Over 10 months, AVDH has identified over 100 true-positive critical vulnerabilities in two days during incident response, analyzed tens of millions of lines of code, and resulted in 12 assigned CVEs.  The pipeline chains specialized agents through threat modeling, entry point discovery, context enrichment, hypothesis generation, and validation—with human experts verifying findings and injecting distilled domain knowledge.  This approach enables defenders to scale code analysis against adversarial AI, complementing continuous monitoring tools like CodeMender and Google AI Threat Defense. The framework demonstrates that AI is most effective as a force multiplier for human expertise, not a replacement.  https://cloud.google.com/blog/topics/threat-intelligence/stayi...
Post a Comment
Read more

LiteLLM Supply Chain Attack: 2,500+ Companies Exposed in the Largest AI Supply Chain Breach of 2026

In March 2026, the threat actor group TeamPCP executed what is believed to be the largest supply chain attack targeting AI infrastructure by compromising LiteLLM through a chain that began with a compromised Trivy build.  The attack cascaded through PyPI into automated CI/CD pipelines, exposing over 2,500 companies and 434,000 pipelines worldwide. The malicious package versions 1.82.7 and 1.82.8 were live for approximately 40 minutes, yet automated systems rapidly distributed the compromise.  The stealer (SANDCLOCK) harvested SSH keys, cloud credentials (AWS, GCP, Azure), Kubernetes tokens, environment variables, CI/CD secrets, and LLM API keys.  Notable exposed organizations include Amazon, Cisco, Samsung, Salesforce, Siemens, Airbus, FedEx, Deloitte, Twitter/X, Zscaler, and many others.  The FBI's July 2026 FLASH advisory warns that affiliated actors are likely to weaponize the harvested credentials long after the original intrusion. The breach demonstrates how com...
Post a Comment
Read more

Putting Models to the Secure Coding Test: Plan vs Default Mode (an alert)

Datadog Security Labs tested whether running AI coding agents in "plan mode" (generating and approving a design before implementation) produces more secure code than default mode.  Across three models (Sonnet 5, Composer 2.5, GPT 5.5) building a document portal application, the experiment found **no meaningful security improvement** from plan mode—the prompt had far more impact than the mode.  Critically, **every iteration introduced the same Insecure Direct Object Reference (IDOR) vulnerability**, allowing any authenticated user to access any document, because the prompt never explicitly specified ownership restrictions.  The models consistently failed to infer necessary authorization logic without explicit requirements. Other findings: all iterations used parameterized queries (some via Prisma ORM), but plan mode sometimes introduced severe regressions (e.g., Composer 2.5 hardcoded a JWT secret in plan mode, enabling full authentication forgery).  Supply Chain Fire...
Post a Comment
Read more