Host: Imagine you're browsing an app store for your AI agent—looking for a simple weather widget or a calendar helper—but one out of every eight things you see is actually a trap designed to steal your data.

Listener: Wait, one in eight? That sounds incredibly high for a marketplace. Are we talking about actual malware, or just buggy code?

Host: No, it's actual malware. In February 2026, researchers audited ClawHub—a major marketplace for the OpenClaw agent—and found that over 300 out of roughly 2,800 skills were malicious. They were delivering things like keyloggers and tools to steal files from Mac users.

Listener: So if I install one of these 'skills,' I'm basically giving a hacker the keys to my computer? How does this even happen without anyone noticing?

Host: The problem is that an agent marketplace is essentially a wide-open door. You're letting code run with your agent's hands, your files, and your credentials. And the attackers are getting sophisticated. They aren't always malicious on day one.

Listener: What do you mean? They change later?

Host: Exactly. There was this case with an email tool called postmark-mcp. It had fifteen perfectly clean updates. Then, on version 1.0.16, they added just one line of code—line 231—that silently sent a copy of every single email to the author's server. Invoices, password resets, everything.

Listener: That's terrifying because even if I check it once, I can't be sure about the next update. But isn't the AI model itself supposed to catch this? Like, shouldn't the 'brain' of the agent realize it's being told to do something shady?

Host: You'd think so, but the research says otherwise. Even the most advanced models—the ones we call 'frontier models'—fail to resist these attacks. In a massive test of 1.8 million attacks against 22 different models, every single one of them broke. If an attacker tries 100 times, they have a 63 percent success rate at getting the model to do what they want.

Listener: So the 'brain' isn't a reliable filter. If the models are that vulnerable, can't we just build better defenses around them? Like a firewall for the AI?

Host: Researchers actually call this 'The Attacker Moves Second' problem. Every time we build a new defense, the attackers adapt. In one study, hackers bypassed twelve different published defenses with a 90 percent success rate. It's a loop where the attacker always gets the last move.

Listener: If the marketplaces are poisoned and the models can't defend themselves, is the whole idea of agents just a security nightmare?

Host: Not necessarily, but it means we have to change the architecture. Researchers at Google DeepMind and elsewhere are saying we should stop trying to make the model resist the injection and instead build the system so the injected text can't act on its own. It's about moving the 'rules' outside of the AI's conversation.

Listener: So, instead of hoping the AI 'chooses' to be good, you just take away its ability to be bad?

Host: Precisely. For example, myOrbit doesn't use that 'wild west' marketplace model. They only use first-party skills where they know the author. And they use what they call a 'governed pipeline'—a system where every action an agent takes has to pass through a gate that's completely separate from the AI. If the AI tries to do something unusual, a human has to sign off.

Listener: That makes sense. It’s like having a security guard at the door instead of just asking the people inside to behave themselves.

Host: Exactly. The big takeaway is that as agents run longer and do more tasks, the risk compounds mathematically. If you want to see the full data on how these models were broken, the research paper links are all in the report. It’s not a reason to avoid agents—it’s just a call to build them with proper guardrails that actually hold.