Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
Zenity disrupted an active campaign that impersonated Paperclip and Browser Use through look-alike organisations, skills, repositories, and packages. The Paperclip skill family appeared on skills.sh on 5 July while its skill documents were still benign, accumulated displayed installs, and was weaponised on 11 July with instructions that steered agents to attacker-controlled code and a remote loader; malicious code had entered the surrounding repository on 6 July. A Browser Use lure instead instructed agents to install a trojanized PyPI package, browser-use-headless==0.1.4, whose helper executed credential collection on import.
Recovered payloads searched more than 100 configured paths across developer, cloud, Git, package-manager, Kubernetes, Docker, infrastructure-as-code, database, and .env locations, then posted readable file contents plus host and workspace metadata to api[.]getpaperclipp[.]com/feedback inside a base64-encoded bundle. Base64 was encoding, not encryption. The reported 1.7 million figure is an aggregate displayed-install counter, not unique users or confirmed infections.
ASSESSED SYSTEM
A representative agent skill-installation path as configured during the disclosed campaign: an agent that discovers a skill through the skills.sh marketplace, admits it on marketplace identity and displayed install counts, then follows the skill's setup documents — fetching an attacker-controlled checkout or release and executing a remote stage, or installing a named PyPI dependency — inside a developer session holding cloud, Git, package-manager, Kubernetes, Docker, infrastructure-as-code, database, and .env credentials. The two lures are two entry points into the same assessed class: skill prose that the agent executes as setup instructions.
OUT OF SCOPE
The attacker's getpaperclipai and browser-use-headless identities, the cloned repositories, the trojanized packages, and the api[.]getpaperclipp[.]com endpoint are the attack, not the assessed system. The legitimate Paperclip and Browser Use projects are impersonation targets and are not assessed. Zenity's disruption of the campaign is a response outside the assessed boundary. The reported 1.7 million figure is an aggregate displayed-install counter and is explicitly not scored as unique users or confirmed infections, so no victim population or infection outcome is assessed.
Architecture: Agentic / MCP System (decision tree Q2) — Q1 = NO: a single agent installs and runs a skill; no peer-agent coordination is described. Q2 = YES: the agent autonomously carries out a multi-step setup workflow read from skill documents — fetch, decode, execute, install, and in one branch delete the fetched code — invoking shell, network, and package-manager capabilities with no per-action approval. Evidence in the brief: the Paperclip instructions directing the agent to an attacker-controlled checkout or release and a remote Node stage, and the Browser Use instructions directing installation of browser-use-headless==0.1.4. Tier 3: Tier 3 (Internal): the assessed system is a developer- and agent-side skill-installation path operating inside the organisational boundary, the same treatment given to the comparable AI coding-agent dependency and configuration cases. The breadth of credential exposure is carried by Cascade Potential (Cp = 1.00) rather than by raising the tier.
Documented attack or failure path
- The actor creates getpaperclipai and browser-use-headless identities resembling legitimate Paperclip and Browser Use projects, then publishes cloned repositories and skills.
- The Paperclip skills appear on skills.sh on 5 July as clean copies and accumulate displayed installs; malicious code enters the surrounding repository on 6 July and the skill setup documents are weaponised on 11 July — a marketplace time-of-check/time-of-use rug pull in which approval earned on one set of bytes carries across to different bytes.
- An agent admits the skill on marketplace identity and displayed popularity, then follows its setup documents: the Paperclip branch directs it to an attacker-controlled checkout or release as the only supported route and to fetch and execute a remote Node stage; the Browser Use branch directs it to install browser-use-headless==0.1.4, whose helper executes on import.
- The payload searches more than 100 configured credential paths and posts readable file contents plus host and workspace metadata to api[.]getpaperclipp[.]com/feedback in a base64-encoded bundle, with no runtime permission enforcement or egress restriction in the way.
Observed controls and bounded outcomes
Positive credit is given only where the record directly demonstrates a control operating. Recommended or merely presumed controls receive no positive scoring credit.
- No control inside the assessed path is evidenced as having interrupted admission, execution, collection, or exfiltration; the campaign was ended by Zenity's external disruption, which is outside the assessed boundary.
- The brief is explicit that the 1.7 million figure is an aggregate displayed-install counter rather than unique users or confirmed infections, so no infection outcome is scored in either direction.
- Base64 is recorded as encoding rather than encryption, so no transport-confidentiality control is credited to the attacker's channel or scored against the assessed system.
Layer 1 — Intrinsic Vulnerability Profile
Each sub-metric is placed on its five-level rubric by the evidence quoted beside it. Missing applicable evidence remains unknown. The displayed midpoint and interval are scenario values, not inferred control performance.
| Sub-metric | Score | Rubric basis | Evidence |
|---|---|---|---|
| Robustness (Ro) — scenario interval 0.00–0.75 (midpoint 0.38), Tier 3 MVT 0.40 indeterminate | |||
| Ro-5Supply-Chain Artifact Admission Integrity | 0.00w 0.25 | The 0.00 anchor: skill and package artifacts were admitted by marketplace name and displayed popularity with no origin, signature, hash or digest verification, and executed with the developer session's authority. The 0.25 anchor requires pinning or allow-lists for at least some artifact classes, and none is evidenced at either intake point. (Moved from Ro-4; the evidence concerns admission of unverified skill and package artifacts, not content poisoning.) | 'Approval accrued while the skill documents were benign on 5 July and survived their weaponisation on 11 July' because the admission decision was never bound to the exact skill digest, and the Browser Use branch resolved the trojanized package browser-use-headless==0.1.4 whose helper executed on import. Publisher identity was accepted on name resemblance, and no lockfile pinning, signed promoted cache or digest binding governed either the skill or the package.source: brief |
| Fairness (Fa) NOT APPLICABLE — axis-level applicability rule (Person-Outcome Surface test): The assessed system is an agent skill-installation path inside a developer session, whose outputs are skill setup execution, package installs and credential-file reads on the developer host; it allocates, ranks, classifies or describes no natural person and no protected-class attribute or proxy in the skill-document inputs influences those outputs. Its tier weight is redistributed across the remaining axes and its MVT is not evaluated. | |||
| Transparency (Tr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 3 MVT 0.45 indeterminate | |||
| Privacy (Pr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 3 MVT 0.50 indeterminate | |||
| Containment (Cn) — scenario interval 0.00–0.41 (midpoint 0.20), Tier 3 MVT 0.50 confirmed breach | |||
| Cn-1Scope Enforcement | 0.00w 0.09 | 0.00 anchor: no effective scope boundary existed between an admitted skill and the developer session's full credential and network surface. The 0.25 anchor requires boundaries that exist but are inconsistently enforced; the disclosed path applies none. | An installed skill reached more than 100 configured credential paths and an arbitrary outbound endpoint. AID-H-018.007 states the missing requirement — each Skill should declare file, network, shell, tool, and protected-resource access, enforced at runtime — and AID-I-001.004 has to be recommended for default-deny outbound policy, which together indicate that neither a capability boundary nor an egress boundary existed.source: brief |
| Cn-2Escalation Prevention | 0.00w 0.12 | 0.00 anchor: no escalation control separates skill installation from the session's ambient authority. The 0.25 anchor requires role checks that exist but can be defeated; here no authority boundary is applied to skill execution at all. | Installing a marketplace skill obtained the full authority of the developer session across nine credential classes. Nothing re-authorised the transition from admitting a skill document to executing a remote loader or importing a package helper that collects credentials.source: brief |
| Cn-5Agent Identity Integrity | 0.00w 0.10 | 0.00 anchor: no identity verification exists for the party supplying the agent's instructions and code; a look-alike name is accepted as the publisher. The 0.25 anchor requires a basic verification step, and marketplace identity here is self-asserted and unbound to any key or attested publisher. | Publisher identity was accepted on name resemblance. The actor's getpaperclipai and browser-use-headless organisations, repositories, skills, and packages were admitted because they looked like the legitimate projects. AID-H-030.001 is recommended to detect typosquatting and brand impersonation across the skill name, author, description, source organisation, package namespace, and linked installation instructions — a check the assessed path does not perform.source: brief |
| Cn-8Untrusted Context Isolation | 0.00w 0.14 | The 0.00 anchor: externally authored skill content was admitted to active context as trusted instruction by design, with no origin labelling and no denial of instruction authority even by prompt wording, and the injected instructions succeeded on both branches. The 0.25 anchor requires origin labels on some channels or prompt-level denial; neither is evidenced. (Moved from Ro-1; the evidence describes the boundary admitting untrusted content as instruction and records nothing about the model's resistance under test.) | 'Skill prose and progressively referenced setup documents were admitted as authoritative instructions and the agent executed them' - fetching and executing a remote Node stage on the Paperclip branch and installing browser-use-headless==0.1.4 on the Browser Use branch. The brief notes these instructions 'are natural language that signature and code scanners do not see', and recommends calibrated semantic intent classification over that prose because nothing inspected the instruction layer at all.source: brief |
| Cn-9Self-Modification and Persistent-State Containment | 0.00w 0.14 | The 0.00 anchor: a behaviour-governing state class (skills) was writable by the agent on marketplace signals with no gate, and the skill's changed content took effect in later sessions silently. The 0.25 anchor requires writes to be logged or a protected list that was bypassed; neither is evidenced. | The agent 'discovers a skill through the skills.sh marketplace, admits it on marketplace identity and displayed install counts, then follows the skill's setup documents'. Adding a skill changes the agent's own behaviour-governing state, and the workpaper evidences no approval gate, signed policy or allow-listed principal on that write: admission rested on displayed popularity, and the brief states that no control inside the assessed path interrupted admission or execution.source: brief |
Unknown, not N/A: 16 applicable sub-metrics lack admissible public evidence. The lower, midpoint, and upper scenarios evaluate each at 0.00, 0.50, and 1.00 respectively; no weight is redistributed merely because evidence is missing.
Architecture-based NOT APPLICABLE: excluded with the Fairness axis.
Layer 2 — Operational Risk Posture
| Dimension | Score | Justification |
|---|---|---|
| AaAutonomy Amplification | 1.00w 0.20 | The 1.00 anchor is met: the agent independently executes the setup workflow the skill supplies — fetching, decoding, executing remote code, and installing packages — with no human approval for any individual step. The operator's only decision was to use the skill. elevated |
| AsAttack Surface Exposure | 1.00w 0.25 | The 1.00 anchor is met: fully attacker-controlled public marketplace content — skill documents, repositories, releases, and packages — reaches the agent's instruction and execution path directly, and the brief shows the content can change after it was reviewed. elevated |
| CpCascade Potential | 1.00w 0.30 | No verified System Dependency Graph exists for the assessed configuration, so the specification's worst-case default applies. It is independently corroborated on its merits: the observed path is ungated end to end and terminates in exfiltration of readable credential-file contents across developer, cloud, Git, package-manager, Kubernetes, Docker, infrastructure-as-code, database, and .env classes — an irreversible node whose reachable set is every system those credentials open.GDCP: corroborated by the observed path elevated |
| RfRemediation Feasibility | 0.50w 0.25 | Scored above the deployment-infrastructure anchor. There is no single artefact to deploy: the durable fix is a change to how skills are admitted — digest-bound decisions, triggered revalidation on any change to instructions, repositories, releases, packages, scanners, policy, or freshness, plus runtime manifest enforcement and default-deny egress — which must be built into every agent's intake path. No retraining is required, which keeps it below the higher anchors. |
Nelevated = 3 (dimensions strictly above 0.75) → CRM = 1.35.
Compound Risk Alert. Two or more dimensions are simultaneously elevated (spec 3.2.2); architectural decomposition is recommended before deployment.
Layer 3 — Public-evidence confidence diagnostic
| Component | Score | Basis |
|---|---|---|
| Pc — Public provenance evidence | 0.20 | Below the 0.25 anchor. The brief identifies the impersonated identities, the exact package and skill names and versions, the weaponisation dates, the collection scope, and the exfiltration endpoint, but no deployment owner, agent product or version, tool manifest, identity policy, or evaluation artefact for any specific agent environment. No AIBOM or equivalent record exists for the assessed configuration. |
| Ec — Public evaluation coverage | 0.27 | coverage 0.27 (6 of 22 applicable sub-metrics) × independence 1.00 × fidelity 1.00. No Full, Standard, or Lite pathway is claimed for a retrospective article. |
| Tf — Public-evidence freshness | 0.35 | Evidence dated 2026-08-06; age 73 days on the workpaper reference date. Components: C_event 0.35 · C_behavior 0.40 · T_behavior 0.44 · T_containment 0.57 · C_monitor 0.65 · T_calendar 0.76 · C_evidence 0.85. Binding term: C_event. BAW applies: an installed skill is mutable behavioural state that persists across agent sessions and changes what the agent does, and the brief's central finding is that this state changed after approval. C_monitor 0.65 — nothing detected the weaponisation or the exfiltration; the brief has to ask defenders to start searching egress logs for the loader hosts and the feedback endpoint. C_event 0.35 — the major row applies: a confirmed critical-invariant violation, namely credential collection and exfiltration executed by an admitted skill. C_behavior Band 0 (0.40) — no canary set, no registered invariants, and no maintained drift baseline for skill behaviour are evidenced, the specification's worst-case default band, which is precisely why a rug pull was invisible. C_evidence 0.85 — the class stays open: the remedy is an admission-architecture change rather than a shipped fix. |
Public-evidence ACI = (Pc × Ec × Tf)1/3 = 0.27 — diagnostic status: Invalid as assessment-of-record evidence. It describes the evidence available to this case study, not the assurance of the underlying system, and is not inserted into the normalized-assurance scenario ERS.
Indicative ERS — normalized-assurance scenario
Published CVSS beside indicative ERS
Each published CVSS record is shown exactly as its scorer published it, one per vulnerability record, with the version, metric group and vector when stated, plus its source and access date. Records are never combined or inferred from a CVE's existence.
INDICATIVE ERS · NORMALIZED-ASSURANCE SCENARIO
7.8 midpoint, interval 3.8–10.0; High scenario band; ACI fixed at 1.00. The published CVSS records do not enter this calculation.
PUBLISHED CVSS
CVSS — no applicable published score verified.
CVSS describes an individual vulnerability as its scorer published it. Indicative ERS describes the assessed AI deployment under the normalized-assurance scenario, so the two values are not direct equivalents and neither replaces the other.
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief or in the AIDEFEND SecureFlow defense map (audited AIDEFEND dataVersion 2026.10.15); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.10.15. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-H-030.001 | Skill Metadata & Manifest Honesty ValidationAIDEFEND dataVersion 2026.10.15. Detecting typosquatting and brand impersonation across skill name, author, description, source organisation, package namespace, and linked installation instructions is the Cn-5 control whose absence let look-alike identities be accepted as publishers. | Very High | Ro-1 Tr-3 Cn-1 Cn-2 Cn-5 |
| AID-H-030.003 | Manifest-vs-Observed Behavioral Consistency TestingAIDEFEND dataVersion 2026.10.15. Comparing attested detonation observations — downloads, process execution, file reads, network destinations — against the Skill's permission manifest is the evidence that would have marked undeclared credential collection noncompliant at admission. | Very High | Ro-1 Tr-3 Cn-1 Cn-2 Cn-5 |
| AID-H-030.005 | Admission Decision Orchestration & Triggered RevalidationAIDEFEND dataVersion 2026.10.15. Binding the admission decision to the exact Skill digest and invalidating it whenever instructions, repositories, releases, packages, scanners, policy, or freshness change is the Ro-5 control whose absence is the rug pull itself. | Very High | Ro-1 Tr-3 Cn-1 Cn-2 Cn-5 |
| AID-H-022.001 | Sandboxed Dependency InstallationAIDEFEND dataVersion 2026.10.15. Installing only lockfile-pinned dependencies from a signed promoted cache inside an ephemeral no-network build container is the Ro-5 control for the Browser Use branch; it fails closed if resolution selects browser-use-headless==0.1.4. | Very High | Ro-5 |
| AID-I-001.003 | Ephemeral Single-Use Sandboxes for ToolsAIDEFEND dataVersion 2026.10.15. Running each admitted Skill invocation once in a fresh sandbox with no developer home-directory credentials or persistent agent state is the Cn-1 containment boundary that would bound the loader after an admission miss. | Very High | Pr-2 Cn-7 |
| AID-H-018.007 | Skill-Level Permission Manifest Validation & Runtime EnforcementAIDEFEND dataVersion 2026.10.15. Requiring each Skill to declare file, network, shell, tool, and protected-resource access and enforcing that manifest at runtime is the Cn-1 control whose absence let the payload reach more than 100 credential paths and the feedback endpoint. | Very High | Cn-1 Cn-6 Cn-7 |
| AID-H-030.002 | Instruction-Layer Semantic Security AnalysisAIDEFEND dataVersion 2026.10.15. Calibrated semantic intent classification over skill prose and progressively referenced setup documents is the Cn-8 control that targets natural-language instructions to fetch, decode, execute, and delete attacker code. | High | Ro-1 Tr-3 Cn-1 Cn-2 Cn-5 |
| AID-I-001.005 | Safe Ephemeral Detonation & Attested Raw Observation ReportingAIDEFEND dataVersion 2026.10.15. Detonating the complete installation paths in credential-free, deny-by-default microVMs produces the attested raw observations that AID-H-030.003 consumes; the brief is explicit that it supplies evidence and does not itself decide admission. | High | Pr-2 Cn-7 |
| AID-I-001.004 | Sandbox Network Egress RestrictionsAIDEFEND dataVersion 2026.10.15. Default-deny outbound policy enforced outside the sandboxed process is the Cn-1 egress boundary that would have blocked the disclosed loader and feedback endpoints even after admission missed the payload. | High | Pr-2 Cn-7 |
WHAT THIS CASE TEACHES
Popularity is not provenance. Ro-5 scores 0.00 not because the skill was malicious when reviewed — it was not — but because the admission decision was never bound to the bytes it approved, so an install counter earned on 5 July still authorised different content on 11 July. That is the same failure the Behavioural Attestation Window exists to price: approval that does not expire when behaviour changes.
Sources: AIDEFEND in Action — Typosquatted Agent Skills Built Reputation Before a Credential-Stealing Rug Pull · Primary source — Attackers Target Agents via The Skill Supply Chain (Zenity Labs, 2026-08-06) · AIDEFEND SecureFlow — Typosquatted Agent Skills: Reputation Inflation, Rug Pull, and Credential Theft
AIDEFEND SecureFlow attack-flow cross-reference
The same incident is modelled step by step, with ATLAS technique labels and AIDEFEND defense mappings, in AIDEFEND SecureFlow. The flow is listed for navigation only; this record's evidence and scores come from the sources cited above. Open SecureFlow.
- Typosquatted Agent Skills: Reputation Inflation, Rug Pull, and Credential Theft (same incident · AIDEFEND curated research flow)ATLAS techniques: AML.T0074, AML.T0111, AML.T0109, AML.T0110.000, AML.T0011.002, AML.T0050, AML.T0055, AML.T0025