In H1 2026, #ESETresearch analyzed 900,000 agentic AI skills – add-ons providing instructions that teach agents how to perform specific tasks – and found 25,000 suspicious ones and more than 3,000 outright malicious. Many of the malicious AI skills were designed to perform red-teaming actions, such as attacking Active Directory, enumerating data, exfiltrating credentials, or gaining highly privileged, persistent access. Their instructions referenced external offensive security tools and platforms such as Impacket, Mimikatz, or BloodHound. In other words, some AI skills do not just “help” an agent – they can steer it toward offensive behavior. One skill, labeled by ESET as suspicious, was instructed to create a persistence mechanism via a JSON file and a tool for self-modification in Python. While this can improve the skill, it can also lead to unpredictable agent behavior or abuse by an attacker. Even some benign skills are problematic, such as those marked as security scanners, many of which implement basic techniques, resembling AV tools from the 1990s: catching obvious threats, but offering little protection against complex, emerging, or obfuscated attacks. Read more about the growing attack surface of agentic AI in H1 2026 ESET Threat Report https://web-assets.esetstatic.com/wls/en/papers/threat-reports/eset-threat-report-h12026.pdf