China's National CERT Warns of Skill Poisoning Attacks Turning AI Agents Into Malware Droppers

China's National Computer Virus Emergency Response Center (CVERC) has issued an advisory warning that attackers are publishing fake plug-ins for AI agent systems, hiding malicious instructions inside what look like ordinary skills. When an agent installs one of these poisoned skills, the hidden instructions tell it to download malware, steal files, and open a back door. The user never clicks a suspicious link. The agent does the work.

The advisory, first published in April 2026 and updated in early September, identifies eight counterfeit skill packs found in repositories used by an agent system called Lobster, also referred to in technical notes as OpenClaw. The findings were incorporated into the national cyberspace threat report and used as talking points during National Cybersecurity Awareness Week, which ran September 14 through 20, 2026. Cyberspace Administration of China officials listed skill poisoning among five AI security risks identified ahead of the awareness week.

How the Attack Works

A skill in this context is a plug-in that an AI agent loads so it can perform a specific task, booking travel, writing code, running tools, querying data. The agent ecosystem works like browser extensions or npm packages: skills are shared through repositories and marketplaces, and users install them to extend what the agent can do.

Analysts using the National Computer Virus Collaborative Analysis Platform examined eight fake skill packs. On the surface, they looked like normal add-ons. Inside, they carried malicious prompt text, instructions the agent would follow when the skill was loaded or used. When those skills ran, the agent silently fetched a trojan. CVERC said the malware could steal files and other data from the local computer, let an attacker take remote control, and use the machine as a jump box into a company network or other devices.

Du Zhenhua, a senior engineer at CVERC, said ordinary users cannot easily tell a safe skill from a poisoned one. There is no familiar "this file looks like a virus" moment. The danger is wrapped in natural-language instructions and a helpful-looking plug-in name.

Why This Is Different From Classic Malware

Traditional malware requires someone to open an attachment or run an installer. An AI agent is built to do things: fetch URLs, run scripts, call tools, touch files. A poisoned skill abuses that design.

The analogy is a bad recipe card. You ask the agent to summarize a folder. The recipe also says to download an extra program and run it. The agent follows both lines because that is what agents do. Three features make the risk worse.

Skills are easy to share. Repositories and marketplaces spread them the way browser extensions or npm packages once did. Prompts are hard to audit. Malicious text can sit next to legitimate instructions in the same file. Agents often hold high privileges. Some terminal agents can run system commands. If the skill is hostile, those rights become the attacker's rights.

CVERC officials described a six-month escalation: first poisoned skills, then agents that help write malware, then agents that can start attacks with little human steering. That last step matches other 2026 reporting on AI-driven attack loops against internet-facing servers.

The Eight Counterfeit Skills

The eight identified packs follow a consistent pattern. Each impersonates a legitimate tool and targets a use case that naturally requires tokens, file access, or network connectivity. That combination is what makes them valuable to steal.

The list includes skills impersonating LinkedIn management tools, Polymarket prediction market interfaces, a deep-research agent, a social-media command-line tool, Excel data analysis, a Solana wallet CLI, and a headless browser automation tool. The file names and hashes are published in the advisory for detection purposes.

The pattern across all eight is the same. The lure is an everyday agent job, social accounts, research, spreadsheets, prediction markets, a crypto wallet, a headless browser. Each skill needs access to data or systems that an attacker wants. The malicious payload is hidden in the prompt instructions, not in compiled code, which makes traditional antivirus scanning less effective.

Detection Is the Hard Part

The core difficulty with skill poisoning is that the malicious instructions are written in natural language. A prompt that tells the agent to download and run a file looks like any other instruction. There is no binary signature to match, no suspicious API call pattern to flag, no compiled code to decompile and analyze.

Du Zhenhua's observation that users cannot tell a safe skill from a poisoned one reflects a fundamental problem with the current agent ecosystem. Skills are distributed as text files containing prompts, URLs, and scripts. The agent interprets and executes them. The user sees the skill's name and description, not the full set of instructions the agent will follow.

This is different from traditional software supply chain attacks, where malicious code is hidden in compiled binaries or build scripts. In skill poisoning, the malicious instruction is the product. It is delivered in the same format as legitimate instructions, and the agent cannot distinguish between them without external verification.

What Security Teams Should Do

The advisory includes specific recommendations for organizations using AI agents. Before installing a skill package, perform a security audit of the prompts, external network links, scripted code, and tool calls. Ensure the skill matches its function description and does not contain code with unknown features.

Use only official project or vendor channels. Read the entire skill, prompts, URLs, scripts, and tools. Delete any skill that fetches a file you did not ask for. Prefer skills that cannot run a shell or communicate with a wallet.

While an agent is running, do not give it access to the entire disk, password store, or production network. Sandbox the agent. Treat "read this folder" as different from "install software." Allow-list outbound downloads. Log every tool call. A sudden connection to an unknown domain is the alert.

The Larger Problem

Skill poisoning is a symptom of a broader issue in the AI agent ecosystem. Agents are designed to take actions on behalf of users. That capability is the value proposition. It is also the attack surface. Every skill, tool, and plug-in that an agent can load extends what it can do, and every extension is a potential vector for misuse.

The CVERC advisory treats agent plug-ins as a live attack path, not a lab curiosity. The eight identified skills are not exotic or targeted. They are everyday tools that any agent user might install. The attack works because the agent model does not distinguish between a instruction that serves the user and one that serves an attacker. The model follows whatever prompt it receives.

For developers building agent systems, the implication is clear. The trust model for skills needs to be as rigorous as the trust model for installed software. Code signing, prompt auditing, sandboxing, and permission limits are not optional features. They are requirements for any system where agents can load and execute third-party instructions.