RESEARCH
February 2026: malicious agent skills, silent leaks, deanonymisation with LLMs
February 2026 puts the AI agent supply chain centre stage: third-party skills, bundles of instructions and scripts, carry malicious code and injections that agents follow up to 80% of the time. Agents can exfiltrate data while their answer looks harmless, and LLMs make online deanonymisation a mass operation. Android updates and passkeys round out the month.
Archive: reconstruction written in November 2026
1. "Do Not Mention This to the User": Detecting and Understanding Malicious Agent Skills in the Wild
arXiv · Yi Liu, Zhihao Chen, Yanjun Zhang, Gelei Deng et al. · AI & LLM Security
In short: Of 98,380 skills for coding agents, 157 are malicious, half from a single actor impersonating known brands.
Coding agents use third-party skills, bundles of instructions and scripts that run with the user's privileges. The authors analyse 98,380 skills from two registries: 157 are malicious, with 632 vulnerabilities and 13 attack techniques. Credential theft through code execution and hostile instructions in documentation dominate. Over half the cases come from one actor. All were removed.
Why it matters. Skills are a new software supply-chain channel: they should be vetted like any dependency before installation.
2. Skill-Inject: Measuring Agent Vulnerability to Skill File Attacks
arXiv · David Schmotz, Luca Beurer-Kellner, Sahar Abdelnabi, Maksym Andriushchenko · AI & LLM Security
In short: Injections hidden in skill files succeed up to 80% of the time against frontier agents.
Skills extend agents with third-party code, knowledge and instructions, becoming a new surface for prompt injection. SkillInject gathers 202 attack-task pairs, from blatant injections to subtle instructions hidden in legitimate text. Frontier agents fall for them up to 80% of the time, carrying out exfiltration, destructive actions and ransomware-like behaviour.
Why it matters. Bigger models or simple filters are not enough: context-aware authorisation is needed before agents get access to systems.
3. Silent Egress: When Implicit Prompt Injection Makes LLM Agents Leak Without a Trace
arXiv · Qianlong Lan, Anuj Kaul, Shaun Jones, Stephanie Westrum · AI & LLM Security
In short: A poisoned link preview makes an agent exfiltrate data while its answer to the user looks harmless.
Agents that open URLs also read auto-generated titles, metadata and previews. A malicious page can hide instructions there that push the agent to send sensitive data outward, while the final answer stays clean. In 480 runs the attack succeeds 89% of the time and 95% of successes evade output checks. Network-level defences such as domain allowlists work better.
Why it matters. Agents' outbound traffic must be controlled as a data-leak risk: checks on answers alone do not see it.
4. AgentDyn: Are Your Agent Security Defenses Deployable in Real-World Dynamic Environments?
arXiv · Hao Li, Ruoyao Wen, Shanghao Shi, Ning Zhang et al. · AI & LLM Security
In short: AgentDyn shows almost every defence against indirect injection is either too weak or blocks useful work.
Agent defences against indirect prompt injection are tested on static, simple benchmarks. AgentDyn offers 60 open-ended tasks and 560 injection cases across shopping, GitHub and daily life, with dynamic planning and helpful third-party instructions to follow. Of ten recent defences, almost all prove insecure or so restrictive that they also block legitimate work.
Why it matters. Lab results for agent defences do not carry over to real use: vendor claims need checking.
Read the paper · PDF · Code
5. Large-scale online deanonymization with LLMs
arXiv · Simon Lermen, Daniel Paleka, Joshua Swanson, Michael Aerni et al. · Privacy
In short: An LLM agent links pseudonymous profiles to real people with 68% recall at 90% precision.
With internet access, an LLM agent re-identifies Hacker News users and interview participants from pseudonymous profiles and conversations alone, much like a human investigator working for hours. On unstructured data across platforms, the pipeline extracts identity cues, searches candidates and verifies matches: it reaches 68% recall at 90% precision, against near zero for classical methods.
Why it matters. Pseudonyms no longer protect: pseudonymised company data and staff profiles should be treated as potentially identifiable.
6. The Trigger in the Haystack: Extracting and Reconstructing LLM Backdoor Triggers
arXiv · Blake Bullwinkel, Giorgio Severi, Keegan Hines, Amanda Minnich et al. · AI & LLM Security
In short: A scanner recovers hidden backdoor triggers in LLMs using inference alone.
Telling whether a language model carries a sleeper backdoor is an open problem. The authors note that such models tend to memorise poisoning data, which can be made to surface, and show telltale signals in outputs and attention heads when the trigger appears. The resulting scanner needs no prior knowledge of the trigger and reconstructs working triggers across many models.
Why it matters. Vetting third-party models before adoption becomes practical: a useful control for anyone building LLMs into products.
7. Clouding the Mirror: Stealthy Prompt Injection Attacks Targeting LLM-based Phishing Detection
arXiv · Takashi Koide, Hiroki Nakano, Daiki Chiba · AI & LLM Security
In short: Phishing sites can hide instructions that fool LLM-based detectors.
Multimodal LLMs are used to spot phishing sites by analysing URLs, HTML and the rendered page. But the site's creator controls almost all of these and can embed instructions invisible to users yet read by the model. The first systematic evaluation shows even top models are fooled, in the lab and on real sites. The InjectDefuser defence lowers attack success.
Why it matters. AI-based anti-phishing filters can be manipulated by the attackers themselves: they should not be treated as infallible.
8. Identifying Adversary Tactics and Techniques in Malware Binaries with an LLM Agent
arXiv · Zhou Xuan, Xiangzhe Xu, Mingwei Zheng, Louis Zheng-Hua Tan et al. · Malware & Threat Intelligence
In short: TTPDetect, an LLM agent, recognises attacker tactics and techniques in malware code with 87% precision.
Spotting malware techniques is hard when the binary is stripped and behaviour is scattered. TTPDetect narrows analysis entry points with semantic retrieval and uses an agent that explores context function by function. On decompiled code it reaches 93% precision and recall; on real malware it recovers 85.7% of documented techniques and finds 10.5 more on average.
Why it matters. Faster sample analysis speeds up incident response and the reconstruction of what the attacker did.
9. Unveiling the Global Landscape of Android Security Updates
IEEE Transactions on Dependable and Secure Computing · Haiyun Deng, Güliz Seray Tuncay, Abbas Acar, Esteban Luques et al. · Web & Mobile Security
In short: Ten years of Android updates across 904 devices: long delays and flaws mostly exploitable without user interaction.
The authors analyse 567,000 Android security update records from 2014 to 2024, covering 904 devices from six manufacturers in 98 countries. Release timing varies widely across manufacturers, device types and regions, partly due to fragmentation. On unpatched devices about 89.7% of vulnerabilities can be exploited without user interaction and with low complexity.
Why it matters. Unpatched company phones are an easy way in: device replacement and update policy weighs on risk.
10. State of Passkey Authentication in the Wild: A Census of the Top 100K sites
arXiv · Prince Bhardwaj, Nishanth Sastry · Identity & Authentication
In short: The first passkey census of the top 100,000 sites ties adoption to popularity and external identity providers.
Passkeys, FIDO2 credentials synced across devices, promise passwordless, phishing-resistant sign-in, but real-world uptake was unknown. The authors build Fidentikit, a crawler with 43 heuristics spanning UI, DOM, WebAuthn calls, traffic and libraries, and run it on the 100,000 most popular domains. Adoption rises with site popularity and often relies on external identity providers.
Why it matters. Passkeys cut credential-theft risk, but adoption remains concentrated on large sites.
Trends of the month
Software Supply Chain
8 papers this month on this topic
AI agent skills are becoming a new supply chain. Public registries hold dozens of malicious skills, many from one actor impersonating known brands, and even subtle injections in skill files are followed by frontier agents up to 80% of the time. The same rules as for software dependencies apply: vetting, provenance and least privilege.
Papers cited:
- "Do Not Mention This to the User": Detecting and Understanding Malicious Agent Skills in the Wild
- Skill-Inject: Measuring Agent Vulnerability to Skill File Attacks
AI & LLM Security
401 papers this month on this topic
With 401 of 1,619 papers, AI security remains the top topic. Agents can exfiltrate data while their answer looks harmless, and almost all defences against indirect injection fail in realistic settings. On the defensive side, scanners now recover backdoors in models, while LLM-driven deanonymisation makes profiles once protected by pseudonyms identifiable.
Papers cited:
- Silent Egress: When Implicit Prompt Injection Makes LLM Agents Leak Without a Trace
- AgentDyn: Are Your Agent Security Defenses Deployable in Real-World Dynamic Environments?
- The Trigger in the Haystack: Extracting and Reconstructing LLM Backdoor Triggers
- Large-scale online deanonymization with LLMs
Malware & Threat Intelligence
33 papers this month on this topic
On traditional threats, LLMs work on both sides. An agent recognises attacker techniques in malware code and finds new ones, but phishing sites can hide instructions that fool LLM-based detectors. Meanwhile ten years of Android data show that unpatched devices remain easy to attack.
Papers cited:
- Identifying Adversary Tactics and Techniques in Malware Binaries with an LLM Agent
- Clouding the Mirror: Stealthy Prompt Injection Attacks Targeting LLM-based Phishing Detection
- Unveiling the Global Landscape of Android Security Updates
How this digest is made
This issue belongs to the digest archive, reconstructed after the fact. The month's papers were collected from arXiv, the IACR ePrint archive and the main security conferences and journals; the selection also weighs the citations received since publication. An AI model assessed the candidates and wrote the summaries, which are based on the abstracts: the original paper is the reference for details.
Papers of the month assessed: 1619.