A Wake Forest University study has uncovered that over 1,700 security issues in third-party AI agent skills can leak sensitive user credentials, with nearly 90% of those leaks immediately exploitable. The findings, set for presentation at a major software engineering conference in October, reveal how both malicious design and negligent coding in AI extensions expose private data to unauthorized access.
Ying Zhang, an assistant professor in Wake Forest's Department of Computer Science, led the research examining how large language model (LLM) agents become vectors for data theft. LLM agents are autonomous systems that plan and execute multi-step actions. Developers install reusable software extensions called skills-available through open-source marketplaces-to give these agents new capabilities like database access or financial document analysis.
"When the agent skill is flawed or developed with malicious intent, it will steal your data and maybe pass it back to a remote server to be used in some malicious way," Zhang said.
Two paths to credential exposure
The research identifies two distinct leakage mechanisms. In malicious cases, a skill's developer deliberately embeds instructions to extract credentials and access private data. Unintentional leaks occur when developers neglect secure coding practices, unknowingly creating vulnerabilities that attackers can exploit.
The credentials at risk are secret identifiers that allow two systems to communicate securely without exposing sensitive data. The tasks these skills perform range widely-from generating presentations from personal notes to scanning financial documents for compliance problems.
Scale of the problem
The research team analyzed 17,022 randomly selected skills from SkillsMP, the largest open-source AI agent skill marketplace with more than 1.6 million available skills. They generated 170,226 outputs to map the threat landscape.
The analysis found 520 affected skills containing 1,708 security issues across 10 distinct leakage patterns. Critically, 89.6% of leaked credentials were immediately exploitable. After the researchers reported their findings to SkillsMP, the platform removed all malicious skills and fixed most vulnerabilities caused by negligent coding.
Security as an afterthought
Zhang points to two systemic failures in software development. Many developers lack the knowledge to integrate security into their work. They also tend to release products before giving security adequate consideration. She argues security must be part of planning from the start, a principle she reinforces with her students.
"When I train my students, I teach them that security is a critical component in their software design," she said. "Every feature they develop, they have to keep security in mind."
The rapid evolution of AI and the rise of AI-assisted software development-sometimes called vibe coding-intensifies the problem. Amateur developers often do not understand software security, and inexperienced programmers cannot rely on AI tools to address security gaps for them. Those interested in the broader implications for Generative AI and LLM systems will find the study's methodology relevant to understanding model vulnerabilities.
What can stop the leaks
Zhang wants security intuitively integrated from the initial software design stage, not patched after a breach. She calls for researchers to devise a standard for data safety that AI developers must meet. Developers need tools that analyze AI agent skills for safety issues before deployment. Users could benefit from assurances-through regulation or contract-that the applications they download meet security benchmarks.
The study will be presented at the International Conference on Automated Software Engineering, held October 12-16 in Munich.
Why this matters for researchers
For scientists and researchers who increasingly rely on AI agents to process datasets, draft analyses, or automate literature reviews, third-party skills represent a direct threat to research data integrity. A single compromised skill installed in an LLM agent could expose not just login credentials but also unpublished findings, grant proposals, or sensitive participant data. The study's finding that nearly 90% of leaks are immediately exploitable means the window between installation and breach can be near-instantaneous. Vetting the provenance of any AI agent skill-and pushing institutional IT teams to adopt the analysis tools Zhang's work calls for-is an immediate operational priority. Researchers exploring AI for Science & Research applications should factor these security risks into their tool evaluation criteria.
Your membership also unlocks:
