JFrog Research Shows AI Coding Skills Evade Standard Security Scanners
New findings reveal that conventional application security tools fail to detect malicious instructions hidden in AI agent assets, creating a significant blind spot.
Key points
- JFrog research demonstrates that standard SCA and SAST tools miss threats in AI agent skills and plugins.
- A July 2026 study found evasion techniques bypassed eight scanners over 90% of the time.
- Malicious skills can steal credentials or exfiltrate code while appearing as valid Markdown files.
JFrog published research on July 2026 showing that standard application security tools fail to detect malicious instructions embedded in AI coding agent assets. The findings indicate that conventional scanners designed for software pipelines leave a significant blind spot when developers install skills, plugins, or agent package manager manifests.
The company’s analysis reveals that traditional methods like static application security testing (SAST) and software composition analysis (SCA) cannot analyze the intent behind these AI assets. Because these files contain instructions rather than compiled code, they lack the dependency trees and code paths that standard security scanners are built to trace and evaluate for vulnerabilities.
The Scope of the Blind Spot
In July 2026, a research team constructed an evasion framework to test how well existing tools handle malicious AI skills. They rewrote suspicious tokens and commands to hide the real payload until the agent executed the task. The team tested this approach against 1,613 real malicious skills found in the wild using eight different scanners.
According to the JFrog report, the strongest evasion technique bypassed each of the tested scanners more than 90% of the time. Despite being flagged as safe by static scanners, the cloaked skills executed correctly inside production agents such as Claude Code and Codex. This execution occurred with no measurable drop in task success, allowing the malicious code to operate effectively.
Threat Classes and Real-World Risks
The researchers identified four primary threat classes within these AI assets, including prompt injection, hidden instructions, obfuscated payloads, and credential exfiltration. Hidden instructions are positioned so human reviewers skim past them, but the AI model processes them. Obfuscated payloads appear as harmless noise but decode into executable commands for the agent.
A specific example involves a single line of text hidden in a normal-looking skill file that instructs the agent to read AWS credentials and include them in a summary. Because the instructions are classified as valid Markdown, there is no CVE assigned to this type of flaw. The agent already holds the relevant credentials borrowed from the developer, facilitating immediate theft.
What should you do?
Organizations using AI coding assistants should treat agent skills and plugins as high-risk inputs that require specialized scanning. Since standard SCA and SAST tools do not cover these assets, teams must implement solutions that analyze the intent and instructions within Markdown files and manifests. Developers should also manually review skill files before installation to check for suspicious credential access commands.
Background: Prompt injection attacks
Look for sudden shifts in tone, refusal to follow system constraints, or output that repeats hidden instructions. These signs indicate the model is processing injected commands rather than your intended query.
Read the full guide: Prompt Injection Warning Signs: How to Spot AI Manipulation
What to do and how to stay safe: JFrog
- Implement specialized scanning tools that analyze the intent and instructions within AI agent skills and plugins, rather than relying solely on standard code scanners.
- Manually review the contents of SKILL.md files and agent manifests before installing them in development environments to check for hidden or obfuscated commands.
- Monitor agent activity for unexpected credential access or data exfiltration attempts, as malicious skills may execute correctly while bypassing static detection.
- Establish a policy requiring verification of agent plugin sources, ensuring that only trusted marketplace items are used in production coding workflows.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Do standard security scanners detect malicious AI coding skills?
No, JFrog research shows that conventional SCA and SAST tools often miss threats in AI assets because they cannot analyze the instructions or intent behind the files.
What is the success rate of evasion techniques against scanners?
In a July 2026 study, the strongest evasion technique bypassed eight different scanners more than 90% of the time while still executing tasks successfully.
Is there a CVE for these Markdown-based threats?
No, the source material states there is no CVE because the malicious instructions are classified as valid Markdown files rather than traditional software vulnerabilities.
