Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsYes. AI agents can be used to deliver malware, and security researchers and threat-intelligence teams now document this as a real attack route. It is an emerging channel rather than a dominant one. The evidence confirms specific attack paths and incidents, but no source measures how widely agents are being used this way across organizations.
The mechanism is simple to describe. An agent reads content it did not write and, depending on how it is configured, can run commands, change files, send messages or install packages. A web page, email, file, package description or installed skill can contain instructions that the agent follows as though its operator had written them. When that happens, a manipulated agent becomes a path for getting code onto a machine, not just a source of wrong answers.
As an Amazon Associate I earn from qualifying purchases.
How outside content turns into an agent action
The core technique has a name. The Center for AI Standards and Innovation (CAISI) at NIST calls it agent hijacking, and in a technical blog published January 17, 2025 it describes the problem this way:
“Currently, many AI agents are vulnerable to agent hijacking, a type of indirect prompt injection in which an attacker inserts malicious instructions into data that may be ingested by an AI agent, causing it to take unintended, harmful actions.”
#1 Best Overall
Yubico - Security Key C NFC - Basic Compatibility - Multi-Factor authentication (MFA) Security Key and passkey, Connect via USB-C or NFC, FIDO Certified
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
The difficulty is architectural. NIST notes that current LLM-agent designs make it hard to separate trusted instructions from untrusted data, because both arrive as text the model must interpret. Any content the agent consumes is therefore a possible instruction channel.
How much damage a manipulated agent can do depends on three things:
- Entry point: where the attacker’s content enters, such as an external page, a message, a file, a package, a skill or an active session.
- Agent authority: which data and tools the agent can reach, and which of its actions run without a person approving them.
- Persistence: whether the effect ends with one task or carries into the agent’s memory, its extensions or connected systems.
Three documented routes
The table compares the three documented routes on the axes that matter to a defender. The sections below explain each one.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →| Route | Entry point | Agent authority that matters | Documented outcome | Strength of evidence |
|---|---|---|---|---|
| Malicious agent skills or extensions | A third-party skill the agent or user installs | Whatever permissions the skill inherits from the agent | Backdoors, droppers, infostealers and remote-access tools distributed as OpenClaw skills | Threat-intelligence observation (Google Cloud, Mandiant and GTIG, September 2026) |
| Poisoned package recommendation | Attacker content that hijacks an active coding-assistant session | The assistant’s trusted position in the developer environment | Assistant recommended an attacker-poisoned external package | One documented case study (same Google Cloud report) |
| Indirect prompt injection in ingested content | Web pages, emails, files or data the agent reads | The tools and data the agent can use | Controlled-test scenarios for remote code execution, database exfiltration and automated phishing | Controlled benchmark (NIST CAISI, January 17, 2025) |
Malicious agent skills and extensions
Skills and extensions are add-on capabilities that an agent loads to perform new tasks. Google Cloud’s Mandiant and GTIG report, published in September 2026, states that attackers distributed backdoors, droppers, infostealers and remote-access tools disguised as OpenClaw agent skills. OpenClaw is the autonomous agent system examined in Google Research’s 2026 security analysis, and the reporting identifies its skill ecosystem as the delivery vehicle.
A skill runs with the permissions the agent already holds. Installing a malicious one therefore gives its code the same reach as the agent, and the user may see only a useful automation.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
On the credential question: infostealers are malware built to harvest stored credentials and session data, and the report says they were among the payloads distributed through these skills. The sources do not give a count of credentials taken, so the answer is established by mechanism and reported distribution, not by measured theft volume.
Poisoned packages recommended in a hijacked session
The second route needs no installed skill. In a case study in the same Google Cloud report, an attacker hijacked an active coding-assistant session, and the assistant recommended an external package the attacker had poisoned. The report’s point is that the assistant’s trusted position in the developer environment made the workflow consequential: a suggestion from a tool the developer already relies on carries more weight than an unknown link.
This is a single documented case. It shows the mechanism works in a real workflow, but it does not establish how often package recommendations are being manipulated.
Indirect prompt injection in content an agent reads
The third route is the broadest, because any content the agent reads can carry instructions. NIST CAISI tested this in a controlled setting. It added scenarios for remote code execution, database exfiltration and automated phishing, and ran an AgentDojo-based evaluation on held-out Workspace tasks against an upgraded agent built on Claude 3.5 Sonnet. Its strongest newly developed attack succeeded 81% of the time, compared with 11% for the strongest baseline attack.
Those figures are experimental. They describe one agent configuration, an older model, and a fixed set of test tasks. They are not an estimate of how often deployed agents are compromised, and results for current agents may differ.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
The question of how prompt injection leads to malware installation has a precise answer. The NIST scenarios test remote code execution, but the sources do not describe a case in which injection alone installed a specific malware family. The documented installation examples come through the skill and package routes above.
Recommended Free Tools
Why the risk extends beyond one prompt
A single injected instruction is usually only the first step of a longer campaign. A 2026 Google Research paper maps agent risk across channel access, session and state, tool execution, external content and extension supply chains. Its abstract states:
“Our results show that threats such as indirect prompt injection, memory poisoning, unsafe tool invocation, data exfiltration, and malicious skill abuse are not isolated anomalies; they are stage-specific manifestations of a common systems problem in which untrusted influence progressively crosses into higher-privilege contexts.”
The paper is by Wanlun Ma, Qing-Long Han, Xiaogang Zhu, Wei Zhou, Junwu Xiong, Peter Ren, Sheng Wen and Yang Xiang. It was published in the IEEE/CAA Journal of Automatica Sinica, volume 13 (2026), pages 1257–1273.
A January 14, 2026 arXiv preprint by Ben Nassi, Bruce Schneier and Oleg Brodt gives this multi-stage view a name. The authors propose “promptware” for prompt-initiated, malware-like behavior against LLM applications. Promptware is a proposed analytical framework, not an established industry term. The preprint lists seven possible stages, which the authors present as a kill chain:
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Initial access
- Privilege escalation
- Reconnaissance
- Persistence
- Command and control
- Lateral movement
- Actions on objectives
In the authors’ analysis of prominent incidents, 15 of 36 traversed four or more of these stages. That is a count within a selected set of incidents, not an estimate of how common multi-stage campaigns are. The preprint itself is the primary reference for the framework and the incident set.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What detection data shows
Check Point Research’s July 14, 2026 report offers a trend rather than a prevalence figure. Between March and May 2026 it recorded roughly a fivefold increase in detections of longer malicious payloads, which approached 1% of the prompts it observed in May. Check Point says longer payloads are more typical of content-borne and agentic attack paths, and presents the trend as suggestive of growing operational relevance.
The 1% figure is a share of observed prompts. It is not a count of malware delivered by agents, and the report does not make that claim.
Controls that reduce exposure
The sources converge on layered controls. None claims a single control eliminates the risk, and NIST’s testing explains why: defenses that hold against previously known attacks may not withstand novel attacks built for a particular system.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
- Keep untrusted content from gaining instruction authority. Treat web pages, emails, files, package descriptions and tool outputs as data, not as instructions. Because current architectures blur that boundary, this is a mitigation to design for rather than a solved problem.
- Isolate execution and scope tools. Google Research recommends boundary-aware isolation and capability-scoped mediation, so an agent receives only the tools a task requires and cannot reach beyond that boundary.
- Put consequential actions behind a human check. Package installs, outbound messages, credential access and writes outside a working area are where a manipulated agent does the most harm. The sources’ focus on agent authority points to these actions, and Google’s call for evidence-oriented oversight supports requiring approval and a record for each one.
- Protect memory integrity. Memory poisoning is among the threats Google Research lists. Keeping agent memory reviewable and flagging unexpected changes limits how long an injected instruction can persist.
- Govern and scan extensions and packages. Maintain an approved list, review what each skill requests, and scan skills before the agent runs them. Google’s recommendation for extension governance addresses the skill route directly.
- Monitor tool calls and test adaptively. Log which tools the agent calls and with what arguments, and red-team the agent with attacks tailored to its own configuration rather than only generic test suites.
A review checklist for skills, packages and permissions
- Confirm who published the skill and where it came from. Treat a skill with no identifiable publisher as unverified.
- Read what it requests: file access, shell execution, network calls and messaging. Remove any permission its stated purpose does not need.
- Check every package an agent recommends against the official registry and the maintainer before installing it, because the coding-assistant case shows a recommendation can point to a poisoned package.
- Scan the skill or package before the agent runs it, and keep the result with the approval record.
- Require a manual approval step for installs, outbound messages and credential access.
- Review the agent’s tool-call log after each task, and remove any skill whose logged activity goes beyond its stated purpose.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
