AI Risk Wire

Cases › security breach › LR-2026-0087

Typosquatted agent skills trojanized to deliver credential-harvesting infostealer

security breach

Severity major: The malicious skills reached more than 1.7 million aggregate installs across developer workstations, CI runners and agent workspaces, an unbounded scope of third parties.

Happened 2026-07-11 · Earliest source we hold 2026-08-06, 26 days later

An active malware campaign targeted users of AI tools Paperclip and Browser Use through typosquatted skills, trojanized packages and a remote loader.

Risk grouping: AI attacked

Who caused it A person or organisation
“Karli created infostealers, C2 infrastructure, and GitHub look-alike orgs targeting users of popular AI tools Paperclip and Browser Use.” source
Intended or not Intended
“Karli created infostealers, C2 infrastructure, and GitHub look-alike orgs targeting users of popular AI tools Paperclip and Browser Use.” source
Before or after release After release
“The malicious skills were trending on skills.sh throughout July 2026, amassing more than 1.7 million aggregate installs before being disrupted on August 2nd.” source
The AI's part Attacked
“The agent was told that this was the supported setup procedure: disable TLS verification (-k), download mutable base64 from a fake health endpoint, execute it with Node and delete the stage.” source

The story

1 · What it was doingAgents using Paperclip and Browser Use skills were asked to install or bootstrap the tools; the malicious skills instructed agents to fetch and execute a remote Node stage with network and shell access.
2 · What went wrongThe agents ran an infostealer and exfiltrated host metadata, workspace contents and discovered secrets to an attacker endpoint, breaching the boundary of the user's machine and credentials.
3 · What it reached or didThe payload collected host metadata, workspace and home directory contents, Git identity and secrets from over 100 paths, then transmitted them to the attacker's feedback endpoint.
4 · How it was caughtZenity Labs reported the malicious skills, and Vercel and Microsoft removed the reported skills, listings and repositories from their platforms within 12 hours of the outreach.
5 · What was doneVercel and Microsoft removed the reported skills, listings and repositories within 12 hours of Zenity's report; copied instructions may remain in downstream repositories, aggregators and user machines.

Show the full account: 62 items from the primary sources

What happened, in order

  1. July 2, 10:21 UTC At 10:21 UTC on July 2, Karli created getpaperclipai/paperclip as a full source clone of paperclipai/paperclip, with the initial bulk copy committed that day.
  2. July 2 Karli's first observed public GitHub activity was on July 2.
  3. July 2 On July 2, Karli registered getpaperclipp.com and created the getpaperclipai GitHub organization, impersonating paperclipai.
  4. July 5 The record first shows the getpaperclipai Paperclip skill family on July 5, with one skill listing 2,264 installs.
  5. July 5 The Paperclip skill family first appeared on skills.sh on July 5, when the skill files were still benign copies of the legitimate upstream skills.
  6. July 6 On July 6, getpaperclipai/paperclip was trojanized via commit 170b54c, which modified handlers in server/src/routes/companies.ts to add calls to log_action().
  7. July 6 Malicious code entered the surrounding repository on July 6, one day after the skills first appeared.
  8. July 9 The browser-use-headless look-alike organization profile was created on July 9.
  9. July 11 On July 11, commit 00b7d831 copied one byte-identical setup-installation.md blob into seven locations, marking the first weaponization of the skills.
  10. July 11 On July 11, the malicious skills were number 8 on the Trending (24h) list, showing 7.8K installs for the leading skill and 46.6K across the six skills.
  11. July 13 On July 13, Karli published browser-use-headless to PyPI, and it was spotted in under two hours.
  12. July 20 On July 20, Karli tried again with paperclip-ai, which was spotted within the hour.
  13. July 30 On July 30, Karli added another activation path allowing the malware to invoke the loader automatically through postinstall.
  14. July 30 The payload retrieval URL switched from hxxps://api[.]getpaperclipp[.]com/health to hxxps://api-v1[.]getpaperclipp[.]com/health on July 30.
  15. August 2 By August 2, skills.sh amassed more than 1.7M aggregate installs across the family.
  16. August 2nd The malicious skills were trending on skills.sh throughout July 2026 and were disrupted on August 2nd.

Who and what was involved

  1. Karli, known on GitHub as karli-paperclip, created infostealers, C2 infrastructure, and GitHub look-alike orgs targeting users of Paperclip and Browser Use.
  2. The campaign targeted users of popular AI tools Paperclip and Browser Use.
  3. Vercel and Microsoft/GitHub responded quickly to the report, removing reported skills, listings, and repositories within 12 hours.
  4. Amazon Inspector and Kamil Mańkowski reported the PyPI package browser-use-headless==0.1.4 in MAL-2026-10484.
  5. Kamil Mańkowski also reported the paperclip-ai package in MAL-2026-10869.
  6. Zenity Labs reported the incident and thanked Vercel and Microsoft for responding quickly to the report.
  7. The legitimate comparison assets included the paperclip[.]ing domain, the paperclipai/paperclip GitHub repository, the npm package paperclipai, the browser-use/browser-use GitHub repository, and the PyPI project browser-use.

How the agents communicated and organised

  1. The skills were set up to refer to one another, with board, planning, and agent-management skills directing the agent to the paperclip skill, which referenced its trojanized setup guide.
  2. The skills called the attacker-controlled checkout or GitHub Release the "only supported" installation path and warned the agent away from the legitimate npm package.
  3. The malicious paperclip skill's company-skills.md instructed agents to use a skills.sh URL or its key-style equivalent as the source and not convert it to a GitHub URL, calling skills.sh the managed registry and source of truth.

What they used to do it

  1. The malware used typosquatted skills, trojanized packages, and remote loaders to target users of popular AI tools.
  2. The skills made victim agents run an infostealer and exfiltrate results via a POST message to hxxps://api[.]getpaperclipp[.]com/feedback.
  3. The payload was a base64-encoded plaintext bundle containing host metadata, workspace and home directory, Git identity, and contents of discovered secrets.
  4. The malware configured more than 100 Unix, macOS, Windows and project-relative paths covering SSH keys, cloud credentials, Kubernetes, Docker, Git configuration, package-manager tokens, Terraform, Pulumi, database credentials, shell profiles, .env files, CI/CD configuration, and service-account files for platforms including Firebase, Vercel, Netlify, Cloudflare and Supabase.
  5. The log_action function added code to retrieve, execute and delete an attacker-controlled payload from hxxps://api[.]getpaperclipp[.]com/health.
  6. The downloaded script selected 71 home-relative and 56 project-relative targets on Unix and macOS, totaling 127 configured targets.
  7. On Windows, the script selected 52 home-relative and 56 project-relative targets, totaling 108.
  8. The browser-use-headless package was Browser Harness with an added helpers.py file containing an infostealer that executed a credential search and posted results to hxxps://api[.]getpaperclipp[.]com/feedback upon import.
  9. The paperclip-ai package's public source was a decoy; its workflow downloaded a hand-uploaded GitHub Release and published it to PyPI through OIDC, containing a variant of the same infostealer.
  10. The setup-installation.md document instructed agents to disable TLS verification (-k), download mutable base64 from a fake health endpoint, execute it with Node and delete the stage.
  11. The malware used progressive discovery to hide its tracks, with malicious commands in secondary documents like setup-installation.md.
  12. A benign-looking skill could route the agent to remote-code execution without containing the command itself, via a trojanized setup guide.
  13. The skills borrowed authority by describing skills.sh as the managed registry and "source of truth" for skills, telling agents to prefer it when available.

What they did to avoid being caught

  1. The malware used progressive discovery to hide its tracks, placing malicious commands in secondary documents like setup-installation.md that agents were told to open only when needed.
  2. The attack was embedded in installation instructions, not bundled as a visible JavaScript payload.
  3. The marketplace identities could accumulate installs and reputation before the content behind them became malicious, hiding the change in a TOCTOU window.

What made it possible

  1. The Paperclip skill family began accumulating skills.sh installs while they were still clean, and were trojanized on July 11.
  2. The skills referenced setup-installation.md as the supported installation procedure, which was weaponized.
  3. The call ran early in the handler's route, so loader reachability did not require the API operation to succeed.
  4. July 5 The skill files were initially benign copies of legitimate upstream skills, so the marketplace listing looked trustworthy before the payload was added.

How it was found

  1. The browser-use-headless package was discovered in under two hours in MAL-2026-10484.
  2. The paperclip-ai package was discovered within the hour in MAL-2026-10869.
  3. August 1 Zenity Labs spotted the family's aggregate install counter exceeding 1.7 million and still trending late on August 1.
  4. Zenity Labs reported the skills, and Vercel and Microsoft removed the reported skills, listings and repositories from their platforms within 12 hours of the outreach.

What it reached, and the numbers

  1. August 2 By August 2, skills.sh amassed more than 1.7M aggregate installs across the family, though these counters are not user-unique.
  2. Individual malicious skills show repeated near-300K displayed counters.
  3. July 26 Both PyPI projects recorded downloads through July 26, then stopped.
  4. July 2026 The malicious skills amassed more than 1.7 million aggregate installs before being disrupted, and these were not unique-user counts.
  5. The collection logic targeted developer workstations, CI runners and agent workspaces, including SSH keys, cloud credentials, Git and package-manager tokens, Kubernetes and Docker configuration, deployment platforms, databases, infrastructure-as-code tooling and project .env files.
  6. The payload configured 71 Unix/macOS home-relative paths, 52 Windows home-relative paths, and 56 project-relative paths, giving 138 unique strings across the combined lists.
  7. A Unix/macOS run checked 127 targets and a Windows run checked 108.
  8. In the transmitted metadata, foundPaths contained only files successfully read and missingPaths contained configured targets that were absent or unreadable.

What the sources say is still unknown or disputed

  1. The number of unique victims is unknown.
  2. The full list of configured targets is the cross-platform configured-target union, not an observed foundPaths result.
  3. The observed telemetry[.]paperclip[.]ing request was benign in the captured context, so it is flagged as a false-positive note.
  4. Copied instructions may remain in downstream repositories, aggregators, and user machines even after the takedown.
Show every field, with its source and grade

The AI system

Software around the model
Paperclip
C one secondary source states it
Tools it was given
shell, package install, network
D inferred by us from the described behaviour, reason shown
What it was allowed to do
Developer workstations, CI runners and agent workspaces, including credentials, tokens, configuration and .env files
C one secondary source states it
Stage of use
in live use
D inferred by us from the described behaviour, reason shown
How it was connected
agentic with tools
D inferred by us from the described behaviour, reason shown
What it was for
Agent skills for installing and bootstrapping a Paperclip instance
C one secondary source states it

What happened

When it happened
2026-07-11
C one secondary source states it
Earliest source we hold
2026-08-06
A the date the source itself carries
Who caught it
an outside party
C one secondary source states it
Themes
supply chain, typosquatting, agent skills, infostealer, credential theft
D inferred by us from the described behaviour, reason shown
Who caused it
an outside attacker
C one secondary source states it
Where its input came from
Malicious skill setup-installation.md documents and skill instructions in typosquatted repositories
C one secondary source states it
What was stopped
Both removed the reported skills, listings and repositories from their platforms within 12 hours of our outreach.
C one secondary source states it
What was done
Vercel and Microsoft/GitHub removed the reported skills, listings and repositories from their platforms within 12 hours of our outreach.
C one secondary source states it
What went wrong
security breach
D inferred by us from the described behaviour, reason shown
AI agent
an AI agent acted
C one secondary source states it
What it did
Malicious instructions embedded in skill setup documents caused agents to fetch and execute a remote loader and credential harvester.
D inferred by us from the described behaviour, reason shown

Impact

Severity
major
D inferred by us from the described behaviour, reason shown
Who was affected
Users of popular AI tools Paperclip and Browser Use; agents and their hosts
C one secondary source states it
Kinds of data exposed
credentials, SSH keys, cloud credentials, package manager tokens, environment (.env) files, CI/CD configuration, service account files
C one secondary source states it
Why this severity
The malicious skills reached more than 1.7 million aggregate installs across developer workstations, CI runners and agent workspaces, an unbounded scope of third parties.
D inferred by us from the described behaviour, reason shown

Context

Industry
Software Publishers
D inferred by us from the described behaviour, reason shown
Shared exposure
one shared model or part put many users at risk
C one secondary source states it
Shared model
getpaperclipai/paperclip skill family
C one secondary source states it

LR-2026-0087 · version 8 · published 2026-10-25 after automatic checks; not yet checked field by field by a person · changes to this case · JSON