An expanded VirusTotal review found that more than half of 35,878 AI agent skills carried security or abuse risks, with many malicious payloads concealed in plain-language instructions rather than code.
VirusTotal has widened its study of AI agent skills and found that the security problem is larger, and more organised, than a small sample suggested. In an expanded review of 35,878 skills drawn from VirusTotal submissions, the company said 52.9% carried some form of security or abuse risk, while 18.5% were malicious and 14.8% were unsafe to run. The picture is being sharpened by a wider industry response: Bitdefender recently launched AI Guardian as a macOS tool to monitor autonomous agents, while other scanners, including ClawGuard, SkillRisk and AgentVerus, have begun marketing purpose-built checks for prompt injection, exfiltration and other agent-specific threats.
The most striking finding from VirusTotal’s analysis is that malicious skills often do not contain obvious malware at all. The company said 62% of the harmful samples placed the attack inside plain-language instructions that an agent could follow on its own, rather than in code. That matters because it blurs the line between documentation and abuse. Salt Labs has separately shown how an AI agent can be tricked by a disguised email prompt, including a case in which Manus still attempted to act on malicious content before warning the user, underscoring how easily instructions can be smuggled through trusted channels.
To make sense of these threats, VirusTotal has introduced CARO-A, a naming scheme that extends the older antivirus CARO convention to AI agent skills. The format identifies what the threat does, which platform it targets, which campaign family it belongs to and where the malicious logic lives. In practical terms, that allows defenders to distinguish a stealers campaign for OpenClaw from a loader aimed at Claude Code or Cursor, and to see whether the harmful part sits in the natural-language instructions, in bundled scripts or in external infrastructure. VirusTotal said this is important because many skills are now being reused across campaigns rather than appearing as isolated one-offs.
The broader breakdown of the sample suggests an ecosystem with a sizeable malicious and dual-use tail. VirusTotal classified 40.5% of malicious skills as stealers and 37.9% as loaders, with hijackers, backdoors and implants making up most of the rest. It also said 78.2% of malicious skills belonged to one of 1,016 families with multiple variants, which points to repeated, structured activity rather than sporadic experimentation. The company added that attack styles vary by platform: on OpenClaw, loaders were common, while on Claude Code, Cursor and Windsurf, stealers were more prevalent. That aligns with a growing market of defensive tools, such as ClawGuard and SkillRisk, that are now aimed specifically at scanning agent skills before they are installed.
VirusTotal also compared its own pipeline with several open-source scanners. It said a single-pass Jev-like model achieved 81.3% detection with 97.7% precision in about 130 milliseconds per skill, while Tencent AI-Infra-Guard, NVIDIA SkillSpector and Cisco Skill Scanner all missed substantial numbers of malicious samples at their default settings and produced many false positives among clean skills. The company argued that rules alone struggle to separate legitimate uses of terms such as curl, ssh and API keys from malicious instruction sets, and that multi-turn review systems, while more cautious, can be far slower. In response, VirusTotal is making a dedicated agentic analysis endpoint available to technology partners and AV and EDR vendors so they can extend the detection without building their own large language model stack.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
