ESET finds 25,000 suspicious AI plugins and agent skills
Security research firm ESET identified over 25,000 suspicious AI plugins and skills during an analysis of 800,000 extensions in early 2026. The research highlighted that autonomous AI agents and their plugins pose emerging cybersecurity risks, as these extensions can execute complex actions independently and potentially distribute malware.
What happened
ESET's research center analyzed approximately 800,000 AI skills and plugins between March and May 2026, identifying more than 25,000 suspicious cases.
AI agents operate autonomously and use specialized plugins and skills to execute complex tasks. These extensions can download files from the internet or execute independent code, creating substantial security gaps if they contain malicious software.
Reported impact
The real digital threat has shifted from traditional chatbots to autonomous AI agents and their numerous plugins, which can execute complex actions autonomously.
The continuous evolution of technology expands the attack surface available to cybercriminals, creating new cybersecurity challenges.
Index analysis
Popular AI chatbots including ChatGPT, Claude, Copilot and Gemini have achieved satisfactory security levels for basic daily use.
The primary security concern in 2026 has moved from content generation or summarization to autonomous AI agents and their various extensions, which operate independently as digital assistants undertaking significant initiatives to execute complex tasks.
Governance controls
ESET developed the AI Skills Checker, a free tool that analyzes files and URLs and simulates behaviors in a sandbox environment to protect end users.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.