USENIX Security '26: AI agent skills are becoming a software supply chain
A study published in the official USENIX Security '26 proceedings analyzes 98,380 AI agent skills and identifies 157 extensions with confirmed malicious behavior. For Belgian and French companies, the message is direct: agent components must be governed as a critical software supply chain, not as reusable prompt snippets.
1. What the study establishes
The authors explain that coding and automation agents increasingly rely on skills: natural-language instructions, helper scripts, configuration files, and sometimes undocumented capabilities. These extensions may run with the user's privileges, which makes them closer to a software package than to a prompt template.
The study combines static analysis and dynamic verification. It reports 632 distinct vulnerabilities across the 157 confirmed malicious skills, spanning 13 attack techniques. The authors also state that all reported skills were removed after responsible disclosure.
2. What this changes for Belgian and French companies
For SMEs, this means an extension downloaded to accelerate sales, support, or development work may gain access to files, secrets, credentials, or customer data. For mid-market companies, the risk shifts toward multiple registries, internal repositories, business connectors, and local automations. For large enterprises and public administrations, traceability becomes central: who approved the skill, with which rights, for which scope, and with which removal procedure.
The operational consequence is clear: before connecting an agent to Odoo, document RAG, a private cloud, business APIs, or an Apple Enterprise workstation, the organization must know where each extension comes from, what it runs, which data it can read, which secrets it can reach, and which logs remain available after an incident.
3. Underside analysis: sovereignty, agents, and business integration
This study highlights an important limit of sovereign AI strategies: local hosting is not enough if the tooling chain is compromised. A model running in Europe can still receive adversarial instructions through a skill; an agent connected to an ERP can propagate a dangerous action; an internal RAG system can expose documents if permissions and filters are not propagated to tools.
In Odoo Belgium, Odoo France, and Odoo Enterprise projects, the right governance unit is therefore not only the model. It includes the skill, connector, system prompt, scripts, permissions, secrets, logs, human approvals, and removal rules. This is also a cybersecurity and compliance topic: the AI Act, GDPR, and internal policies require evidence, not only intent.
4. Operational recommendation
CIOs should create an internal registry of approved agentic components. Each skill should have an owner, source, version, security review, permission list, business scope, behavioral tests, and revocation procedure. Production environments should block direct installation from unvalidated community registries.
Concrete priority: treat agent skills as third-party software dependencies, with review, sandboxing, least privilege, logging, and rapid removal before any integration with Odoo, RAG, cloud services, or sensitive data.
Audit an agentic chain