river.io/the dark factory
Order 01113 July 20267 minSecurity

Every skill you do not install is an attack you do not have to detect

New research shows that malicious behavior can hide inside agent skills themselves. The attack evades scanners and keeps 96.6% of benign utility. The attack surface has moved from the agent's inputs to its toolbox.

In mid-July 2026, the research frontier in agentic-coding security shifted. The headline vulnerabilities of early July, GitLost and GuardFall, were about hostile content. Issues, pull requests, and web pages carry hidden instructions to an agent that reads them. The new wave is about hostile capabilities.

A paper titled PhantomSkill introduces an attack technique the authors call VulMask (arXiv 2606.19191). It shows that malicious behavior can hide inside an agent skill's auxiliary scripts. The attacker rewrites that behavior as ordinary-looking "vulnerability-shaped" code. The code fires only on the attacker's trigger. The results are a 58.8% attack success rate and 96.6% of the skill's benign utility preserved. The attack largely evades skill scanners and automated reviewers across major coding agents.

A class, not a one-off

PhantomSkill did not arrive alone. A companion wave of research confirms that this is a systemic class of attack. Cloak and Detonate covers scanner evasion and dynamic detection. SKILL-INJECT measures agent vulnerability to skill-file attacks. A survey covers supply-chain poisoning across LLM coding-agent skill ecosystems. The class even has its own curated tracker, the awesome-agent-skills-security list.

The core insight is uncomfortable for anyone who relies on marketplace review. Scanners look for malicious intent in a skill's description. The attack hides as ordinary insecure-looking code in auxiliary files, and activates later. Static scanning of skill text is not a control. Cloak and Detonate argues for dynamic detection instead.

The defensible posture available today is simpler: a minimal skill surface, first-party only. Agent skills and plugins are executable supply chain, not configuration.

Also this week: do not trust the screen

Security researcher Johann Rehberger demonstrated a time-of-check to time-of-use (TOCTOU) attack on computer-use and coding agents. TOCTOU means the state changes between the check and the action. Mutate the UI between the agent's visual check and its click, and the agent approves something it never saw. Any approval flow where an agent verifies visually and then acts is racy by construction. Verify approvals that matter at the API or data layer, atomically. Never verify them from screenshots.

Measuring autonomy before granting it

On the constructive side, Anthropic published field research on measuring AI agent autonomy in practice. The research draws on how agents are actually deployed on its public API. Software engineering accounts for roughly half of all agentic activity. That makes it the closest thing available to ground truth on how far real deployments run unattended. The practical guidance follows directly. Instrument what agents do without supervision, then set autonomy gates from data rather than optimism.

A new academic framework goes further and formalizes the gating itself. A paper on autonomous CI/CD quality assurance runs a complete quality gate from pull request to defect filing with 14 specialist agents. It is built on LangGraph multi-agent orchestration, from K11tech. It also computes a per-change risk score. It suspends execution to a human whenever that score reaches 0.85 or above.

We would not adopt the stack, which is LangGraph plus seven MCP servers. The pattern is the right abstraction: autonomy as a continuous function of measured risk, not a repository-level on-off switch. It matches the bounded-autonomy framing of the "From Assistance to Agency" work on CI/CD pipelines.

Two smaller signals round out the picture. First, "harness engineering" is now a named discipline with its own curated list, awesome-harness-engineering. It covers evals, memory, permissions, observability, and orchestration. The center of gravity is not the model. It is the harness.

Second, the field now draws a distinction. Personal agents run on markdown files. Production agents need databases, access control, and memory at scale. The gap between a hobby loop and a factory is infrastructure.

Spec-driven tooling also continued to mature. ASSERT turns specs into repeatable evals. Google published its account of automating the eval-optimize loop with independent AutoRaters that grade agent output against custom rubrics. The market for purpose-built eval-gate products is consolidating.

The proof point that matters

The reference case for production-scale agentic coding remains Spotify's background coding agent, Honk. It merges roughly 650 agent-generated pull requests to production per month, and more than 1,500 in total. Spotify reports 60 to 90 percent time savings on migrations, with a small team running the work. Spotify credits years of prior investment in fleet management, standardized builds, and comprehensive test suites.

The agent is the cheap part. The deterministic test and build substrate is the factory.

The counterweights deserve equal billing. Google's widely cited figure of about 75% AI-generated code, from Sundar Pichai, counts suggested-and-accepted code. That is a much weaker definition than autonomously merged. A survey of software engineering's third era finds that agent pull requests complete fast, half of them within about 13 minutes. Teams accept them at lower rates than human pull requests.

Older randomized controlled trials show the full spread. One found a 26% increase in pull requests per week. Another found no productivity lift and a 41% increase in bug density. Throughput is not merged quality.

How we apply this at River.io

This research wave lands as vindication of a posture we already hold. It converts that posture from engineering taste into security architecture.

Sources

Vendor and blog figures cited here show direction, not audited benchmarks.

← The Dark Factory Subscribe by RSS Reply by email