Incident Published: Aug 24, 2026

Typosquatted Agent Skills Built Reputation Before a Credential-Stealing Rug Pull

Zenity disrupted an active campaign that impersonated Paperclip and Browser Use through look-alike organizations, skills, repositories, and packages. The Paperclip skill family appeared on skills.sh while its skill documents were still benign, accumulated displayed installs, and was weaponized on July 11 with instructions that steered agents to attacker-controlled code and a remote loader. A Browser Use lure instead instructed agents to install a trojanized PyPI package. Recovered payloads searched more than 100 configured paths and posted a base64-encoded plaintext bundle to api[.]getpaperclipp[.]com/feedback. The reported 1.7 million figure is an aggregate displayed-install counter, not unique users or confirmed infections.

Supply Chain CompromiseCredential TheftRuntime IsolationSupply Chain DefenseAI Supply Chain
9 applicable AIDEFEND defenses
Source: Attackers Target Agents via The Skill Supply Chain 
Authors: Michael Bargury, Zenity Labs; malicious PyPI package findings credited to Amazon Inspector and Kamil Mańkowski
Original article: Aug 6, 2026

Threat Analysis

  • Masquerading established the initial trust surface. The actor created getpaperclipai and browser-use-headless identities that resembled legitimate Paperclip and Browser Use projects, then published cloned repositories and skills.
  • Reputation accumulated before the skill documents changed. The Paperclip skills appeared on July 5 as clean copies. Malicious code entered the surrounding repository on July 6, and the skill setup documents were weaponized on July 11. This is a marketplace time-of-check/time-of-use failure and an AI supply-chain rug pull.
  • The activation paths branched by lure. Paperclip instructions called an attacker-controlled checkout or release the only supported route and also directed the agent to fetch and execute a remote Node stage. The Browser Use skill told the agent to install browser-use-headless==0.1.4, whose helper executed credential collection on import.
  • The payload's collection and exfiltration are documented precisely. Across Node and Python variants, the malware checked developer, cloud, Git, package-manager, Kubernetes, Docker, infrastructure-as-code, database, and .env paths, then sent readable file contents plus host and workspace metadata inside a base64-encoded bundle. Base64 was encoding, not encryption.

Applicable AIDEFEND Defenses (9)

AID-H-030.001
Skill Metadata & Manifest Honesty Validation
Very High
At skill intake, detect typosquatting and brand impersonation across the skill name, author, description, source organization, package namespace, and linked installation instructions.
AID-H-030.003
Manifest-vs-Observed Behavioral Consistency Testing
Very High
Consume the attested detonation reports and compare complete downloads, process execution, file reads, and network destinations with the Skill's permission manifest and stated function. Mark undeclared credential collection and attacker egress as noncompliant for the admission decision.
AID-H-030.005
Admission Decision Orchestration & Triggered Revalidation
Very High
Bind the final block, review, or allow decision to the exact Skill digest, invalidate it whenever instructions, repositories, releases, packages, scanners, policy, or freshness change, and let an install broker accept only the approved bytes.
AID-H-022.001
Sandboxed Dependency Installation
Very High
For the Browser Use branch, install only lockfile-pinned dependencies from a signed promoted cache inside an ephemeral no-network build container. Fail if resolution selects browser-use-headless==0.1.4 or any bytes outside the reviewed cache manifest.
AID-I-001.003
Ephemeral Single-Use Sandboxes for Tools
Very High
Run each admitted Skill invocation once in a fresh sandbox with no developer home-directory credentials or persistent Agent state, then destroy it. This limits the loader if admission misses the malicious behavior.
AID-H-018.007
Skill-Level Permission Manifest Validation & Runtime Enforcement
Very High
Require each Skill to declare file, network, shell, tool, and protected-resource access, then enforce that manifest at runtime. Block the undeclared credential paths and feedback endpoint before collection or exfiltration succeeds.
AID-H-030.002
Instruction-Layer Semantic Security Analysis
High
Use calibrated semantic intent classification over Skill prose and progressively referenced setup documents. This directly targets the Paperclip instructions to fetch, decode, execute, and delete attacker code even when signatures or code scanners see only natural language.
AID-I-001.005
Safe Ephemeral Detonation & Attested Raw Observation Reporting
High
Detonate the complete Paperclip and Browser Use installation paths in credential-free, deny-by-default microVMs and produce attested raw observations bound to the exact artifacts. This supplies the execution evidence; it does not itself decide whether installation is allowed.
AID-I-001.004
Sandbox Network Egress Restrictions
High
Execute admitted skills with default-deny outbound policy and permit only named destinations outside the sandboxed process, blocking the disclosed loader and feedback endpoints even if other gates miss the payload.

What Defenders Should Do Now

  • Check whether any agent or developer system used skills from getpaperclipai/paperclip or browser-use-headless/browser-use-headless-skill, or installed browser-use-headless==0.1.4 or paperclip-ai==0.1.0/0.1.1.
  • Search egress logs for the disclosed /health loader hosts and especially POST requests to api[.]getpaperclipp[.]com/feedback.
  • Invalidate approval and re-run semantic, dependency, and behavioral checks whenever any referenced instruction, repository commit, release artifact, package digest, scanner, policy, or freshness requirement changes; displayed popularity must not carry approval across changed bytes.
  • Detonate Skill installation and progressively referenced documents with no host secrets, compare the attested observations with a required Skill permission manifest, and let an install broker accept only the approved digest.
  • Run admitted Skills in fresh single-use sandboxes with runtime manifest enforcement and externally enforced default-deny egress.
  • If a malicious loader or stealer executed, treat the Agent and host as compromised and rotate accessible credentials. If only installation is known, triage exposure without claiming confirmed theft.

Conclusion

This campaign weaponized the gap between marketplace identity, mutable Skill content, and what an Agent ultimately executes. Skill-specific metadata and semantic checks must feed exact-artifact detonation, manifest comparison, and a digest-bound admission decision that is invalidated on change. Runtime permission enforcement, single-use isolation, and default-deny egress then limit any payload that passes admission. Popularity can help discovery, but cannot authorize content that changed after the counter was earned.