A Trojanized PDF Skill Reveals a Broader AI Supply Chain Risk

An employee asks an AI agent to fill out a PDF. The agent loads a skill carrying Anthropic's name and Anthropic's working scripts, and follows the instructions inside. It all looks routine, and the user has no reason to question it.

But in one copy of a PDF skill we analyzed, those instructions had been swapped out to divert the agent from its intended task and steer it toward harmful actions. Suddenly, a basic office task could expose the organization’s systems, credentials, and sensitive data.

Across a wider study by Cyera Research of more than one million skills, the package presented as Anthropic's PDF skill illustrates the new attack vectors AI presents. Eleven files matched the official skill exactly, including its legitimate PDF-processing scripts. The package retained the familiar name and description, but replaced the main instructions and added a Linux executable containing a backdoor. We identified the original ZIP and five related archives observed between May 23 and July 14, 2026. 

The finding raises a practical question for companies adopting agents: how do they establish trust in the complete component an agent is about to use?

A Familiar Package with Consequential Changes

AI skills combine instructions with supporting material, such as scripts and reference documents. An agent follows those instructions using the tools and permissions available to it. This makes the package relevant to both software security and operational decision-making. Reviewing one means checking the files you’d check for any software, and also checking whether the instructions ask the agent to do things you’d sign off on.

In the PDF skill package we examined, the SKILL.md file was cut from 315 lines to 19. The title and description were unchanged, encouraging an agent or user to select it for this type of task. The instructions instructed the agent to make a network call to a Chinese domain and the package included a 5 MB system_linux binary whose only job is to hand a remote operator a shell. 

That ZIP file was forged to contain familiar markdown files and scripts which contain exactly the expected code. The package could still potentially perform legitimate PDF operations, but the instructions on SKILL.md were removed and completely changed the skill’s capabilities.

What the Investigation Establishes

If run, this malicious skill may allow a remote operator to issue commands on the machine with the permissions of the account that launched it. A narrowly scoped document-processing task could therefore carry a much broader risk if the unexpected program were executed.

Cyera researchers found that there were no indications of direct code or instructions to execute the binary. However, the SKILL.md was set to call an external URL, and at the time of the research the domains resolved to a private IP. We have two hypotheses. First, the URL was actually a subdomain targeting the specific organization that owns this domain and someone set an internal address that served the instructions. Second, the attacker has a DNS-like kill switch and changed the IP address on the fly. 

The Broader Risk Is Inherited Trust

For leadership, the most useful lesson is how easily trust in a recognizable component can lead to serious problems. Employees seek tools that make their work faster or easier, and agents use a skill's name and description to understand its purpose. A package retaining those familiar features may appear benign even when the instructions that control its behavior have changed. The trust decision must therefore be based on a deeper look at the version actually obtained and every file included in it.

This is particularly relevant when teams obtain skills through copied archives, repositories or other intermediaries. A component's claimed origin is only the starting point for verification. Practitioners need to understand that working with AI agents requires more than the traditional static and dynamic package scanning they normally do. For skills, MCP servers, plugins, or similar components, they should also scan the intention, instructions, and linguistic patterns hidden inside files. That scrutiny should continue when a previously reviewed component is updated.

The same reasoning applies wherever agents accept third-party instructions alongside executable resources. Product approval alone cannot account for every component later linked to that product. Skills may be used on developer workstations, Linux servers, or environments holding company documents and credentials. Their access will vary, but the underlying governance question remains consistent: what guardrails apply when the agent follows these instructions or runs these files?

What Companies Should Do

Companies should assign ownership for the skills used in sensitive workflows and verify complete packages against their claimed sources. Unexpected files, changed instructions, and unfamiliar network destinations should trigger review. In the case of this PDF skill, a comparison covering every file would have exposed the rewritten instruction file and added executable, even though the 11 legitimate files matched exactly. A review limited to names, descriptions, or known scripts would not reveal anything in this example case.

Scanning tools should assess both instructions and bundled code to avoid these oversights. They should identify concealed behavior, examine unexpected executables, and report content they could not inspect. Agent permissions should remain proportionate to the task, with scrutiny around network access and software execution. If a suspicious package is discovered internally, responders should establish whether it was present, whether its instructions were followed, and whether any program it added ran.

The PDF case shows why the complete skill package is the appropriate unit of trust. Familiar branding and unchanged scripts can coexist with altered instructions and a backdoor. Companies can address that risk through source verification, inspection of the full package, and limits on the authority available during use.