Agent Skill Malware Targets Claude Code and OpenAI Codex With Scanner

Cybersecuritynews •Tushar Subhra Dutta • July 6, 2026

A new class of malicious software is quietly slipping past the security tools meant to protect popular AI coding assistants. Researchers have found that malware hidden inside “agent skills,” small add-on packages used by tools like Claude Code and OpenAI Codex, can be reshaped to sail through automated scanners while keeping its harmful functions fully […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New SkillCloak Technique Enables Malicious AI Skills to Evade Detection A new technique called SkillCloak allows malicious AI agent skills to bypass existing static skill scanners over 90% of the time. These skills can steal credentials, exfiltrate source code, and install backdoors, posing a significant risk to AI coding assistants like Claude Code and OpenAI Codex. Current defenses, primarily relying on static pattern matching, are ineffective against adaptive evasions. Researchers emphasize that runtime behavior auditing offers better resilience against these threats. The scope of impact includes a wide range of AI tools that utilize third-party agent skills, creating a substantial software supply-chain attack surface. As of now, the threat remains active, with no confirmed mitigation strategies reported. 6 sources 66

Extracted Entities

Agent Skill Malware Targets Claude Code and OpenAI Codex With Scanner

The full story

Extracted Entities

Attack Types (1)

Malware (1)

Tools (2)