Two Ways to Capture an Agent

The confirmed skills in the study do not point to one uniform attacker. This chapter compares the two main strategies that emerge when the same supply-chain entry point is used for different ends: Data Thieves use execution and collection paths to move information out of the environment, while Agent Hijackers target the agent’s decisions and its relationship with the user. The comparison matters because the evidence for their separation is statistical and behavioral, and because a detector built for one strategy can miss the other.

Data Thieves: scale, credentials, and infrastructure

Start with the relationship between credential harvesting and external transmission. In the confirmed set, the two behaviors appeared together in 58 of 157 skills, or 36.9%. The reported odds ratio was 2.24, with Fisher’s exact test yielding p = 0.020 and a 95% confidence interval from 1.09 to 4.66. In practical terms, a skill that harvested credentials was about 2.2 times as likely to also transmit data externally as the independence model would predict.

That result is not a magic marker for maliciousness. A legitimate tool can collect information and send it to a service the user selected. The association becomes meaningful when combined with the study’s other evidence: the behavior must be observed, compared with the public function, and judged in context. Statistics can show that two patterns travel together more often than expected; they cannot, by themselves, reveal a publisher’s intent or prove that every instance has the same purpose.

The larger archetype is centered on remote script execution without instruction override. The study places 110 skills, or 70.1% of the confirmed set, in this Data Thief profile. Within it, credential harvesting is strongly enriched, with an odds ratio of 23.8, and external transmission has an odds ratio of 9.7. Code obfuscation also appears in this group and not in the Agent Hijacker group described by the paper. The combination suggests a supply-chain exfiltration strategy: get a useful-looking package installed, use the local execution path to reach sensitive material, and rely on external infrastructure to receive it.

The sequence is attractive to an attacker because it separates the public story from the operational machinery. The visible part of a skill can be customized to a popular brand or a high-demand workflow. The hidden behavior can be reused across many packages. A registry then supplies the distribution multiplier: the attacker does not need to persuade one organization to run one unusual program; they can place many plausible search results where users are already looking for capabilities.

The study found a particularly strong fingerprint in one publisher cluster. Of 85 brand-impersonating skills associated with that cluster, 83 showed the credential-harvesting-plus-remote-execution combination. Outside the cluster, only 5 of 72 skills showed the same pair. The resulting odds ratio was 556.1, with p < 0.001. That is not a general probability for all campaigns. It is evidence that this cluster’s packages were related by a repeated construction pattern rather than representing a collection of unrelated accidents.