Key Takeaways

  • Researchers found more than 3,000 malicious AI skills and 25,000 suspicious skills in repositories analyzed during H1 2026.
  • Agent add-ons can create new routes for credential theft, malware execution, data exfiltration, and potentially ransomware deployment.
  • Enterprises can reduce exposure through tighter agent permissions, identity controls, repository screening, segmentation, and tested recovery plans.

Ransomware prevention strategies developed in 2025 remain relevant, but the attack surface is changing. AI agents, coding assistants, and downloadable skills now give employees and automated systems new ways to interact with corporate data, local devices, cloud services, and software repositories. Those connections can improve productivity. They can also extend an attacker's reach.

ESET found more than 3,000 malicious AI skills among nearly 900,000 analyzed from popular repositories in its H1 2026 Threat Report. Another 25,000 were classified as suspicious. Detections associated with malicious AI skills more than doubled from H2 2025 to H1 2026, indicating that compromised or hostile add-ons are becoming a more prominent security concern.

The potential behavior is broad. Malicious skills can steal credentials, exfiltrate information, execute malware, download additional tools, inject code, or change their behavior after installation. None of those actions automatically results in ransomware. Still, each can support a stage of a ransomware intrusion, from initial access and credential harvesting to lateral movement, data theft, and payload execution.

An AI skill does not need to look like conventional ransomware to increase network vulnerability. A seemingly useful coding, productivity, or administrative extension could provide the access required to retrieve a second-stage tool later. That makes repository trust, software provenance, and runtime behavior part of the ransomware defense program.

The autonomy involved raises the stakes. ITWeb, citing the threat report data, noted that 84% of analyzed skills could execute commands without user initiation, while 31% downloaded third-party tools. When an add-on can act independently, a compromised workflow may progress before an employee notices anything unusual.

What happens when an agent has access to source code, production credentials, customer records, and a command shell at the same time? The answer depends heavily on identity design. Enterprises should treat each agent as a distinct workload identity, assign narrowly scoped privileges, limit credential duration, and separate development, testing, and production access. Shared service accounts and persistent tokens can turn one malicious skill into a wider incident.

This issue is not confined to technical extensions. ENISA analyzed 4,875 incidents from July 2024 to June 2025 and reported that AI-supported activity accounted for more than 80% of observed social-engineering activity by early 2025. Attackers can combine convincing phishing messages with stolen credentials and agent-enabled automation, compressing several intrusion steps into a shorter window.

Meanwhile, Gartner forecasts that 50% of service requests will be initiated by AI systems by 2030. That shift could make it harder for security teams to distinguish legitimate automated activity from abuse. Gartner also reported that fewer than 10% of enterprises secured the AI lifecycle through dedicated AI-security platforms in 2025, compared with more than 60% forecast for 2030 (source).

Practical controls start before installation. Security teams can maintain approved skill catalogs, verify publishers and dependencies, scan packages with options such as ESET AI Skills Checker, and review add-ons used with environments including GitHub Copilot and Cursor. High-risk capabilities, including shell execution, credential access, external downloads, and code modification, warrant additional review or isolation.

Runtime controls matter too. Organizations can restrict outbound connections, monitor child processes, log agent actions, and require human approval for sensitive operations. Endpoint detection, network segmentation, multifactor authentication, immutable backups, and rehearsed restoration procedures remain central ransomware safeguards. The difference is that telemetry should now identify which agent acted, which skill it invoked, what permissions it used, and whether the action matched an approved business purpose.

That said, blocking every AI add-on would sacrifice useful automation without eliminating the underlying threat. A more workable approach is controlled adoption: inventory agents, evaluate their skills as software supply-chain components, reduce excessive agency, and prepare for compromise. Ransomware defense is still about limiting access and recovering quickly. AI agents simply make those disciplines more urgent, and more granular.