There’s a curious paradox in the AI world. The same developers who boast about “aligning models with human intent” seem entirely misaligned with basic security practices.
We keep hearing about responsible AI, safe AI, trustworthy AI… yet each breakthrough arrives wrapped in the same old problem. It’s built without security in mind.
And then some other researchers publish another paper pointing out the obvious, that it’s trivially easy to exploit.
The latest example comes from a group at the ELLIS Institute in Tübingen, who dissected Anthropic’s new “Agent Skills” feature.
Don’t get me wrong, I like the idea behind Agent Skills. I like it a lot. Developers can give AI agents modular abilities through small markdown files, called skills. These skill files contain task-specific instructions, like how to edit a PowerPoint or access a local project.
It’s like that “I know kung fu” part in Matrix, where Neo instantly learns new skills from several diskettes.
The problem is that every line in those files is typically interpreted as an instruction. Meaning anyone can hide malicious commands among the legitimate ones.
The researchers demonstrated that with a simple modification to an example skill, the AI could be coaxed into uploading private files to an external server – all without further user approval, once the familiar “Don’t ask again” box was ticked.
It’s depressingly easy. There’s no intricate jailbreak or adversarial tuning here. Just a line of YAML, a markdown file, and a user who trusts the system too much. The paper shows how a single benign approval can quietly extend to harmful actions, exposing how brittle those so-called system-level guardrails really are. The authors warn that unverified third-party “skills” shared online could become the next malware marketplace. The kind of marketplace the AI industry will pretend to be shocked by once it’s too late.
What’s galling isn’t that vulnerabilities exist – every technology has them. It’s the consistent failure of AI firms to design for security in the first place. These systems are deployed at scale, interacting with personal data, APIs, and business logic, yet their threat models remain an afterthought.
Researchers have been shouting about prompt injection for over two years. The response from AI companies has mostly been to publish new models rather than new mitigations.
Security-by-design means thinking about abuse before deployment, not after a demo goes viral. It means building controls that assume the worst, rather than hoping users will be careful.
But the AI field rewards speed, novelty, and “capability gains” far more than security maturity. This is why I believe that ultimately, it’s going to be cybersecurity’s job to rein in the chaos that the AI community keeps creating in its rush to innovate.
Security professionals will once again be left cleaning up the mess, building controls and safeguards long after the damage has already been done. If the last few decades of computing have taught us anything, it’s that when developers chase features without forethought, defenders are the ones who inherit the nightmare. AI won’t be any different. Except this time, the stakes are exponentially higher and the systems learn faster than the people trying to protect them.
Agent Skills may be a convenient developer feature. It’s also a reminder that until AI development adopts the same rigor as cybersecurity engineering, every “advancement” will come bundled with another open door.
The AI industry needs fewer clever new frameworks and more people asking the dull but vital question: what could go wrong here?
I’m dismayed that after all these years, the smartest people in tech still treat security as someone else’s problem.