What happened
Zenity Labs (published August 6, 2026) disclosed an active supply-chain campaign targeting the emerging 'AI agent skills' ecosystem: threat actors typosquatted the popular Paperclip and Browser Use AI tools, seeded clean skill packages to build trust and trending status on skills.sh, then trojanized them on July 11, 2026 to instruct the AI agent runtime itself to fetch and execute a credential-stealing payload from GitHub. The campaign amassed over 1.7 million aggregate installs before disruption on August 2, 2026.
Why it matters
This is a new attack surface distinct from traditional npm/PyPI package supply-chain attacks: the 'skill' is code intentionally designed to be interpreted and acted upon by an autonomous AI agent, meaning the agent itself becomes the execution vector for the attacker's instructions, harvesting SSH keys, cloud credentials, and CI/CD tokens directly from developer and agent workspaces at massive scale.
Attack vector
Attackers published clean-looking 'Paperclip' and 'browser-use-headless' family skills on skills.sh (and separately as npm/PyPI packages) that accumulated organic installs while clean, then were trojanized on July 11, 2026 to instruct AI coding/browser agents to download and install a credential stealer directly from GitHub — bypassing prior detection that had thwarted an npm/PyPI-based approach.
Affected systems
skills.sh AI-agent 'skills' ecosystem — typosquatted packages impersonating popular AI tools Paperclip and Browser Use
Mitigation
Zenity Labs disclosed and disrupted the campaign on August 2, 2026; audit any installed skills.sh packages named paperclip-ai/browser-use-headless or similar, rotate SSH/cloud/Git credentials on affected workstations and CI runners.