A landing-page skill passed every scanner, then swapped its payload to hijack 26,000 agents: why it is not safe to use

What happened

In June 2026, a security firm called AIR ran an experiment. It built a fake AI agent skill named 'brand-landingpage' that claimed to build a landing page using a Google design tool, and advertised it on Instagram to marketers, salespeople, and designers.

At first the skill's install link pointed to real, harmless documentation. Because of that, every major skill scanner (automated tools that check a skill for danger before you install it) marked it safe. AIR also got a change accepted into a popular skills marketplace, which added to the appearance of trust.

After about 26,000 agents had installed it, including some on company accounts, AIR swapped the page behind the link for one telling the agent to download and run a script. Scanning happens once at submission, but the outside page can be rewritten anytime. AIR says its test payload was harmless, only emailing your address back to them. These install numbers are self-reported and not independently confirmed.

What it means for you

A "passed the scanner" badge is a snapshot, not a promise. A skill that links to an outside page can turn harmful later, without warning.

What to do instead

• Be cautious with skills promoted through ads or social media.
• Prefer skills that do not fetch and run outside scripts.
• Watch for a skill suddenly asking to download or execute something new.
• Stick to sources that review skills over time, not just once. AgentPod, for example, lists only skills we have reviewed and tested.

Sources:

• https://www.air.security/blog-posts/the-story-of-skills
• https://thenextweb.com/news/fake-ai-agent-skill-security-scanners-bypassed-26000-agents
• https://cybernews.com/ai-news/fake-ai-skill-hijacks-26000-agents-instagram/