UserGate Factor Experts Warn That AI Agent Skills Can Pose a Threat

Experts from the UserGate Factor cyber threat monitoring and response center warn about the potential danger of AI agents. The study highlights that over 26% of AI agent skills are potentially vulnerable, with the most common risks being data leakage and privilege escalation. Four main risk groups are identified: malware distribution, data transfer to external systems, gaining excessive privileges, and manipulating AI agent behavior. An example scenario is provided where an employee installs a seemingly useful skill that contains malicious instructions, leading to unauthorized data collection and exfiltration. To mitigate risks, experts recommend verifying skills through tools like Agent Threat Rule, checking security audits on platforms like skills.sh, and running even trusted skills with strict restrictions such as separate accounts, limited file system and network access, and user confirmation for sensitive operations. Svetlana Gazizova, UserGate's AI Security Product Owner, emphasizes the need for end-to-end control of the entire agentic system chain, monitoring data access, tool calls, and action authorization.