# You Can't Tell What an Agent Skill Will Do by Reading It - Roey Ben Chaim, Zenity

Roey Ben Chaim, Zenity

[Talk page](https://ai.engineer/talks/_7P580m4kPY-you-cant-tell-what-agent-skill-will) · [Video](https://www.youtube.com/watch?v=_7P580m4kPY)

## You Can't Tell What an Agent Skill Will Do by Reading It

Roey Ben Chaim and the Zenity team ran thousands of agent skills in a detonation chamber. To understand a single run, they had to give the skill a plausible task and follow its effects from the agent’s tool call to the files and services a child process touched.

![A task prompt and a skill feed an agent in an isolated environment. The agent’s messages and tool results form a trace for assessing the run.](https://ai.engineer/api/talk-essay-media/b6fa6907faeed9a9af51278f0b835e6971d05b7b6dd4b306a761dd2dd4832edc)

The team began with an isolated agent, a skill and a task, then examined what the agent did.

### What does a sensitive read actually tell you?

[0:03](https://www.youtube.com/watch?v=_7P580m4kPY&t=3s)

An official Azure diagnostic checked the identity and configuration of a cloud environment. An information stealer might also look for sensitive information on that machine. If a security reviewer saw only the access event, how could they distinguish legitimate troubleshooting from credential theft? Roey Ben Chaim, a staff engineer at Zenity and a MATS research fellow, opens with this ambiguity. Even knowing which product supplied the skill leaves an investigator with the job of explaining what happened on a particular run.

A skill gives an agent a capability on demand. Someone else supplies the instructions, resources and sometimes executable code. That leaves anyone adopting a skill with two questions. What work did it cause the machine to do? Does that work make sense for the task the user gave it? Even a trace that answers the first question can leave the second open.

### What a scan of SKILL.md can miss

[1:38](https://www.youtube.com/watch?v=_7P580m4kPY&t=98s)

A skill can depend on packages, instructions or services outside its initial file. A reviewer examining the installed document sees what the author provided at that moment. The agent may encounter different material when it uses the skill. A thorough investigation needs to identify what influenced the run, including dependencies the user never selected directly.

Ben Chaim cites work by Trail of Bits in which an automated reviewer accepted a misleading explanation for a software change. The same material offered both the proposed change and the claim that somebody had authorized it. A reviewer needs an independent source for that assertion. Reading more words from the same source cannot establish who approved a change.

### Give the skill somewhere to run and something specific to do

[2:49](https://www.youtube.com/watch?v=_7P580m4kPY&t=169s)

Zenity borrowed detonation from malware research. The team put an agent and a skill in a sandbox, supplied a task prompt, let the agent work for minutes or hours, then examined its trace. The first version ran into a mundane problem. Many skills expected a command-line tool, a service or an existing project. A Notion skill in an empty sandbox has no Notion service to talk to. A run that stops there tells you little about what the skill does once it connects.

The team added a **world builder** that reads the skill and prepares the environment it expects. That addressed one reason a run could stall. The next was the assignment itself. A presentation skill needs a deck to make, a deployment skill needs a service to ship, and a brainstorming skill needs an idea to explore.

Even asking the agent to ship a service leaves choices. Configuring the service, deploying it and recovering it from a snapshot exercise different parts of the skill. A successful deployment says little about the recovery path. The team added an **operator** that reads the skill, identifies routes worth exercising and supplies prompts for them. Coverage depends on which routes the operator recognizes and which ones the agent follows.

A model can also stop in the middle of a test. Some agents declined to continue when a step looked unsafe. That is an observation worth retaining alongside the task and environment. It narrows what the team can conclude from that run. Ben Chaim notes that legitimate tasks can trigger a safeguard, too. Treating every refusal as proof of malice would misclassify some skills; treating an unfinished test as evidence of safety would hide what the researchers had yet to observe.

![A highlighted world builder points to the isolated environment where the agent uses the skill. The task prompt, agent trace and assessment remain visible.](https://ai.engineer/api/talk-essay-media/610979bf10edeb181e360a8983c369c2c003771f696a252820125073f66f2a2b)

The world builder supplied the services and project context a skill expected.

### Look below the model’s tool call

[5:59](https://www.youtube.com/watch?v=_7P580m4kPY&t=359s)

Suppose the agent trace shows a single installation. Can an investigator use that entry to say which files were touched? Some of the work happens outside the model’s conversation. Processes started during installation may have effects that the agent never describes. The model can report that its request succeeded without knowing the consequences for the rest of the machine.

The chamber kept the agent trace and added three kinds of evidence. Process creation events showed what the installer launched. Filesystem events showed what those processes touched. Network packet capture recorded their traffic. Together the records let an investigator work back from a file access or an outbound connection to the installation that set it in motion.

![The agent trace and three sources of activity from the isolated environment feed an analysis that links an instruction to its execution and observed effect.](https://ai.engineer/api/talk-essay-media/445a787a2d562e05f667fa18d72bcefad4cef0ad0076a749f5ef021528c12981)

The research environment joined host-level observations to the agent trace.

### The dependency the user never chose

[7:07](https://www.youtube.com/watch?v=_7P580m4kPY&t=427s)

In a harmless proof of concept by Zach Corman, the skill a user chose drew in another component. The first file gave no clear account of the behavior that followed. The chamber’s records let the researchers attribute the later action to an indirect dependency. A single successful test established a concrete possibility. It did not establish what every installation would do.

Across thousands of skills examined, Ben Chaim reported that the team identified 100 malicious skills and that those skills were taken down from `skills.sh`. That count describes findings in the collection the team examined. It leaves open how many malicious paths the chamber missed.

In another case, a skill appeared to use a Polymarket dependency. Its package identity differed slightly from the expected one, and the researchers traced it to an unofficial source. Inspection showed that the substituted software collected sensitive information. The meaningful comparison was between the dependency a user believed they had chosen and the one the installer actually supplied.

### What survives installation and changes the next run

[8:49](https://www.youtube.com/watch?v=_7P580m4kPY&t=529s)

An uninstall is an unusually good test of what a reviewer knows about the environment. Some skills returned after users thought they had removed them. In a separate case, an unofficial skill creator quietly replaced the familiar implementation. A product interface could appear unchanged while a different component handled the user’s next request. An inventory from before installation, followed by a fresh look after removal, gives the investigator something concrete to compare.

The installed package can also stay unchanged while the material it relies on changes. A remote source can be updated or change hands. Some skills can run in response to later activity, including work unrelated to the original assignment. A good review therefore has a date and a scope: which version, which dependencies, under what conditions, and which behavior did someone actually observe?

### Following a lookalike back to its source

[10:35](https://www.youtube.com/watch?v=_7P580m4kPY&t=635s)

Paperclip, an open-source project for orchestrating agents, gave the researchers a comparison case. They found an imitation of the project that looked familiar enough to borrow its reputation. Activity advertised as routine logging led somewhere outside the genuine project. Examining the destination gave the team a reason to investigate beyond the feature name.

In this case, the researchers established that sensitive authentication data left the machine and reached a service controlled by the attacker. They also observed that part of the activity was short-lived, which made the recording of the run especially important. Recall the genuine Azure diagnostic from the start of the talk. The destination and purpose of the transfer gave the team a much stronger basis for calling this credential theft.

The investigation linked the same infrastructure to software distributed through the Python ecosystem and then to a set of agent skills. Some packages disappeared quickly. The related skills had accumulated what Ben Chaim reported as **1.7 million total downloads**. This is a distribution count. It cannot tell a responder how many installations completed, how many machines ran the behavior or how many people lost credentials.

Finding the same infrastructure across distribution channels changed the response. Removing one copy of a package could leave users exposed through another source. Ben Chaim reports that after the team notified the relevant platforms, the remaining campaign material was removed within 12 hours.

### Treat the skill as a software dependency

[13:33](https://www.youtube.com/watch?v=_7P580m4kPY&t=813s)

A skill is one way outside material enters an agent’s context. A website, a database row, a package or even a YouTube comment can also supply text the model reads while deciding what to do. Any of those sources can influence a task once the agent has read it.

Ben Chaim’s advice starts with established software dependency practices. Identify who supplies a skill and what it loads. Limit access to what its task requires. Keep enough runtime evidence to relate a sensitive action to the process that performed it and to the destination of any transfer. Someone who can answer those questions can explain why the Azure diagnostic and the Paperclip lookalike deserved different responses.

## Key takeaways

- Interpret a sensitive read in the context of the task and the destination of the data. The Azure diagnostic and the Paperclip lookalike called for different conclusions once the researchers could account for the observed activity.
- A sandbox run tests a particular path. Supplying a missing service makes the path possible, and asking for snapshot recovery exercises different behavior from asking for a deployment.
- Keep the agent trace alongside process creation, filesystem and network records. A single package installation can account for multiple actions that never appear as separate model tool calls.

## Slides

### What Happens When You Detonate Thousands of Agent Skills?

Roey Ben Chaim introduces his team’s detonation chamber, where they run thousands of agent skills to see what the skills actually do.

[0:00](https://www.youtube.com/watch?v=_7P580m4kPY&t=0s) [The conference title slide asks what happens when thousands of agent skills are detonated. The subtitle reads “Inside the detonation chamber.”](https://assets.ai.engineer/sites/aiecode2025/sha256/b33a0121b1f4b164196d0916347a1e5ffd8b90950fcd91a52838ebd61441cc06.webp)

AI ENGINEER CODE SUMMIT / SAN FRANCISCO

What Happens When You
Detonate Thousands
of Agent Skills?

Inside the detonation chamber

Interface text:
Roey Ben Chaim

### About Me — Roey Ben Chaim

Roey Ben Chaim introduces himself as a staff engineer at Zenity and a MATS Research Fellow. He often speaks about AI safety and security.

[0:15](https://www.youtube.com/watch?v=_7P580m4kPY&t=15s) [A portrait appears beside Roey Ben Chaim’s name and two roles, Staff Engineer at Zenity and MATS Research Fellow. Social profiles appear below.](https://assets.ai.engineer/sites/aiecode2025/sha256/c07cc94ac8b38a5c3cad1cb39424224d9ec1052edbf8b33f1664ae803a9a026b.webp)

ABOUT ME

Roey Ben Chaim
Staff Engineer at Zenity
MATS Research Fellow

X / TWITTER
@roeybc

LINKEDIN
/in/roeybc

Interface text:
Roey Ben Chaim

### Capabilities, on demand.

“I know kung fu.” The film still captures the appeal of an agent skill: a new ability on demand. To use it, the agent follows someone else’s instructions, which may come with resources and scripts.

[0:25](https://www.youtube.com/watch?v=_7P580m4kPY&t=25s) [The slide lists instructions, resources and new behavior beside a film still captioned “I know kung fu.” A note says the capability comes with someone else’s instructions.](https://assets.ai.engineer/sites/aiecode2025/sha256/bc30f3e8daeb0420a305267d6db3fd176c0523b7c84b6e0c86758371816e3d34.webp)

THE ATTACK SURFACE
Capabilities, on demand.

Instructions.
Resources.
New behavior.

The capability comes with someone else’s instructions.

I know kung fu.

Interface text:
Roey Ben Chaim

### Can we just scan the skill?

Even an official Azure diagnostic skill can look suspicious. Ben Chaim asks whether scanning a skill’s files is enough to tell if its actions are malicious.

[1:37](https://www.youtube.com/watch?v=_7P580m4kPY&t=97s) [Large text on a dark background asks “Can we just scan the skill?” with “scan the skill?” highlighted in mint green.](https://assets.ai.engineer/sites/aiecode2025/sha256/41cbd0f2470adcdb8f235df92c94e70f2f310e353878e8fe183fc09cf5cc7088.webp)

Can we just
scan the skill?

Interface text:
Roey Ben Chaim

### Just run it.

The meme’s “JUST RUN IT” captures how Roey Ben Chaim’s team adapted malware detonation to test agent skills. They let an agent use the skill in a sandbox so they could see what it actually did.

[2:53](https://www.youtube.com/watch?v=_7P580m4kPY&t=173s) [Text introduces malware detonation for agent skills beside a meme of a man pointing to his temple, captioned “JUST RUN IT.”](https://assets.ai.engineer/sites/aiecode2025/sha256/c8e6efca48f3dd5ec00dfb3a01da18fb16945d631c0df59a08d5d0dc2f1c26c7.webp)

WHY DETONATE
Just run it.

Malware detonation.
Applied to agent skills.

JUST RUN IT
imgflip.com

Opening
Mon
Tues-Thurs
Fri-Sat
Sunday

Interface text:
Roey Ben Chaim

### Inside the detonation chamber.

The team gave an agent a task prompt and a skill to use in a sandbox. To assess what the agent did, they inspected its trace: the messages it produced and the results its tools returned.

[3:08](https://www.youtube.com/watch?v=_7P580m4kPY&t=188s) [A task prompt and a skill feed an agent in an isolated environment. The agent’s messages and tool results form a trace for assessing the run.](https://assets.ai.engineer/sites/aiecode2025/sha256/b6fa6907faeed9a9af51278f0b835e6971d05b7b6dd4b306a761dd2dd4832edc.webp)

BUILDING THE CHAMBER
Inside the detonation chamber.

01 USE
Task prompt

Skill
Instructions + files

Agent under test
Executes the task

ISOLATED EXECUTION ENVIRONMENT

02 CAPTURE
Agent trace
Messages + tool results

03 ANALYZE
Assess the run
Inspect the evidence

Interface text:
Roey Ben Chaim

### Problem: the environment is missing.

The robot playing The Sims has a world to act in. On a bare machine, an agent can have the skill yet lack the CLI, service, or project it needs. A Notion skill, for example, needs a Notion service it can reach.

[3:27](https://www.youtube.com/watch?v=_7P580m4kPY&t=207s) [The slide lists a missing CLI, an absent service and an empty project beside an illustration of a robot playing The Sims.](https://assets.ai.engineer/sites/aiecode2025/sha256/a12e8953ebc8987baaec171dcd49c577e56adfbe1f148faf40f1bee9096dc348.webp)

PROBLEM 01 · ENVIRONMENT
Problem: the environment is missing.

CLI missing.
Service absent.
Project empty.

The skill expects a world. A bare machine is not that world.

Interface text:
SIMS
[illegible]
Roey Ben Chaim

### Solution: add a world builder.

The world builder reads the skill and prepares the isolated environment it needs. The agent runs the prompted task there, and a reviewer can inspect its messages and tool results.

[3:47](https://www.youtube.com/watch?v=_7P580m4kPY&t=227s) [A highlighted world builder points to the isolated environment where the agent uses the skill. The task prompt, agent trace and assessment remain visible.](https://assets.ai.engineer/sites/aiecode2025/sha256/610979bf10edeb181e360a8983c369c2c003771f696a252820125073f66f2a2b.webp)

Solution: add a world builder.
SOLUTION 01 · ENVIRONMENT

01 USE
World builder
Prepare environment

Task prompt

ISOLATED EXECUTION ENVIRONMENT
Skill
Instructions + files

Agent under test
Executes the task

02 CAPTURE
Agent trace
Messages + tool results

03 ANALYZE
Assess the run
Inspect the evidence

Interface text:
Roey Ben Chaim

### Solution: add an operator.

The operator reads the skill and chooses prompts to test different paths the agent could take in the sandbox. The resulting trace captures the agent’s messages and tool results for review.

[4:40](https://www.youtube.com/watch?v=_7P580m4kPY&t=280s) [A world builder prepares an isolated environment. An operator supplies tasks, prompts and modes to the agent under test. The agent trace feeds the run assessment.](https://assets.ai.engineer/sites/aiecode2025/sha256/72cf00576742a270f4af50fc8bae8098c3e11a74b5ecf60de207dc44087e00ff.webp)

Solution: add an operator.
SOLUTION 02 · ACTIVATION

01 USE
World builder
Prepare environment

Operator
Tasks · prompts · modes

ISOLATED EXECUTION ENVIRONMENT
Skill
Instructions + files

Agent under test
Executes the task

02 CAPTURE
Agent trace
Messages + tool results

03 ANALYZE
Assess the run
Inspect the evidence

Interface text:
Roey Ben Chaim

### Problem: transcripts miss side effects.

The example trace shows npm install followed by “Installation completed.” That message leaves out what a post-install script can do, such as start a process that writes to a file.

[6:14](https://www.youtube.com/watch?v=_7P580m4kPY&t=374s) [An illustrative agent trace shows “npm install” followed by “Installation completed.”](https://assets.ai.engineer/sites/aiecode2025/sha256/0731f9355535034fb05eb454db18d01a298a410015eeef686db7fcb666778e8a.webp)

Problem: transcripts miss side effects.
PROBLEM 04 · VISIBILITY

ILLUSTRATIVE EXECUTION
AGENT / TOOL TRACE

> npm install
Installation completed.

Interface text:
Roey Ben Chaim

### Solution: capture below the tool call.

As the agent runs a skill in isolation, the system records its messages and tool results alongside process, filesystem and network activity. It uses both records to connect a skill instruction to what ran and what happened as a result.

[6:39](https://www.youtube.com/watch?v=_7P580m4kPY&t=399s) [The agent trace and three sources of activity from the isolated environment feed an analysis that links an instruction to its execution and observed effect.](https://assets.ai.engineer/sites/aiecode2025/sha256/445a787a2d562e05f667fa18d72bcefad4cef0ad0076a749f5ef021528c12981.webp)

Solution: capture below the tool call.
SOLUTION 04 · VISIBILITY

01 USE
World builder
Prepare environment

Adversarial operator
Probe execution paths

ISOLATED EXECUTION ENVIRONMENT
Skill
Instructions + files

Agent under test
Executes the task

02 CAPTURE
Agent trace
Messages + tool results

Processes
Filesystem
Network

03 ANALYZE
Correlate evidence
Instruction → execution → observed effect

Explain behavior

Interface text:
Roey Ben Chaim

### Then we took it to skills.sh.

Investigators ran thousands of skills from the skills.sh directory to see what they did. After review, the directory removed about 100 for malicious activity or behavior judged too dangerous to keep available.

[7:56](https://www.youtube.com/watch?v=_7P580m4kPY&t=476s) [Beside a skills directory screenshot, the slide reports that investigators exercised thousands of skills and that about 100 skills were removed after review.](https://assets.ai.engineer/sites/aiecode2025/sha256/5ea6d49aff301e98f3d74bb2e9798053071c08d36ecf05df6f11b62ef51855ce.webp)

THE INVESTIGATION
Then we took it to skills.sh.

Thousands
of skills exercised

~100
skills removed after review

Malicious activity or behavior judged too dangerous to remain available.

SKILLS
THE OPEN AGENT SKILLS ECOSYSTEM

Skills are reusable capabilities for AI agents. Install them with a single command to enhance your agents with access to procedural knowledge.

TRY IT NOW
$ npx skills init

AVAILABLE FOR THESE AGENTS

Interface text:
SKILLS LEADERBOARD
Search skills...    /
All Time (1,104,632)    Trending (24h)    Hot
#    SKILL    8W ACTIVITY    INSTALLS
Roey Ben Chaim

### Fine today. What about tomorrow?

When inspected, Journey’s remote instructions told the agent to start the kit task the user requested. On a later visit, the same URL could serve a different prompt if someone edits it or takes over the domain.

[10:00](https://www.youtube.com/watch?v=_7P580m4kPY&t=600s) [A getting-started excerpt appears above two columns. The left describes the instructions inspected today. The right explains that the same URL can serve different instructions tomorrow.](https://assets.ai.engineer/sites/aiecode2025/sha256/d8c1d8fc17688ce1158da2fcc4bdda6ac8489e95d605437cb4ae3e471f336979.webp)

Fine today. What about tomorrow?
REMOTE PROMPT EXECUTION

THE INSTRUCTIONS WE FETCHED · JOURNEY

### Getting Started

1. When first used in a conversation:
   - If the user asked you to search, install, or publish a kit, start that task directly.

Looks fine today.
The content we inspected.

Tomorrow?
Same URL.
The instructions can change.

Interface text:
Roey Ben Chaim

## Full transcript

[0:03](https://www.youtube.com/watch?v=_7P580m4kPY&t=3s) Hi everyone, welcome to my talk about

[0:05](https://www.youtube.com/watch?v=_7P580m4kPY&t=5s) Hi everyone, welcome to my talk about

[0:05](https://www.youtube.com/watch?v=_7P580m4kPY&t=5s) Hi everyone, welcome to my talk about what happens when you detonate thousands

[0:07](https://www.youtube.com/watch?v=_7P580m4kPY&t=7s) what happens when you detonate thousands

[0:07](https://www.youtube.com/watch?v=_7P580m4kPY&t=7s) what happens when you detonate thousands of agent skills. This is a look inside

[0:11](https://www.youtube.com/watch?v=_7P580m4kPY&t=11s) of agent skills. This is a look inside

[0:11](https://www.youtube.com/watch?v=_7P580m4kPY&t=11s) of agent skills. This is a look inside our agent detonation chamber and what we

[0:14](https://www.youtube.com/watch?v=_7P580m4kPY&t=14s) our agent detonation chamber and what we

[0:14](https://www.youtube.com/watch?v=_7P580m4kPY&t=14s) our agent detonation chamber and what we saw when we put skills in there. My name

[0:17](https://www.youtube.com/watch?v=_7P580m4kPY&t=17s) saw when we put skills in there. My name

[0:17](https://www.youtube.com/watch?v=_7P580m4kPY&t=17s) saw when we put skills in there. My name is Roey. I'm a staff engineer at Zenity

[0:19](https://www.youtube.com/watch?v=_7P580m4kPY&t=19s) is Roey. I'm a staff engineer at Zenity

[0:19](https://www.youtube.com/watch?v=_7P580m4kPY&t=19s) is Roey. I'm a staff engineer at Zenity and I'm a MATS research fellow. I talk a

[0:21](https://www.youtube.com/watch?v=_7P580m4kPY&t=21s) and I'm a MATS research fellow. I talk a

[0:21](https://www.youtube.com/watch?v=_7P580m4kPY&t=21s) and I'm a MATS research fellow. I talk a lot about AI safety and security. Follow

[0:24](https://www.youtube.com/watch?v=_7P580m4kPY&t=24s) lot about AI safety and security. Follow

[0:24](https://www.youtube.com/watch?v=_7P580m4kPY&t=24s) lot about AI safety and security. Follow me on Twitter and LinkedIn.

[0:27](https://www.youtube.com/watch?v=_7P580m4kPY&t=27s) me on Twitter and LinkedIn.

[0:27](https://www.youtube.com/watch?v=_7P580m4kPY&t=27s) me on Twitter and LinkedIn. Before we even start our uh session, we

[0:30](https://www.youtube.com/watch?v=_7P580m4kPY&t=30s) Before we even start our uh session, we

[0:30](https://www.youtube.com/watch?v=_7P580m4kPY&t=30s) Before we even start our uh session, we need to talk about what an agent skill

[0:32](https://www.youtube.com/watch?v=_7P580m4kPY&t=32s) need to talk about what an agent skill

[0:32](https://www.youtube.com/watch?v=_7P580m4kPY&t=32s) need to talk about what an agent skill is. Well, essentially an agent skill is

[0:35](https://www.youtube.com/watch?v=_7P580m4kPY&t=35s) is. Well, essentially an agent skill is

[0:35](https://www.youtube.com/watch?v=_7P580m4kPY&t=35s) is. Well, essentially an agent skill is capability of capability on demand. It

[0:38](https://www.youtube.com/watch?v=_7P580m4kPY&t=38s) capability of capability on demand. It

[0:38](https://www.youtube.com/watch?v=_7P580m4kPY&t=38s) capability of capability on demand. It has a bunch of instructions, resources,

[0:41](https://www.youtube.com/watch?v=_7P580m4kPY&t=41s) has a bunch of instructions, resources,

[0:41](https://www.youtube.com/watch?v=_7P580m4kPY&t=41s) has a bunch of instructions, resources, new behavior. It can contain scripts and

[0:43](https://www.youtube.com/watch?v=_7P580m4kPY&t=43s) new behavior. It can contain scripts and

[0:43](https://www.youtube.com/watch?v=_7P580m4kPY&t=43s) new behavior. It can contain scripts and it can even contain code. The problem is

[0:46](https://www.youtube.com/watch?v=_7P580m4kPY&t=46s) it can even contain code. The problem is

[0:46](https://www.youtube.com/watch?v=_7P580m4kPY&t=46s) it can even contain code. The problem is that it was written by someone else. And

[0:48](https://www.youtube.com/watch?v=_7P580m4kPY&t=48s) that it was written by someone else. And

[0:48](https://www.youtube.com/watch?v=_7P580m4kPY&t=48s) that it was written by someone else. And this is exactly where the problem start.

[0:51](https://www.youtube.com/watch?v=_7P580m4kPY&t=51s) this is exactly where the problem start.

[0:51](https://www.youtube.com/watch?v=_7P580m4kPY&t=51s) this is exactly where the problem start. So let's take a look at the skills

[0:52](https://www.youtube.com/watch?v=_7P580m4kPY&t=52s) So let's take a look at the skills

[0:52](https://www.youtube.com/watch?v=_7P580m4kPY&t=52s) So let's take a look at the skills trajectory. For instance, if we look at

[0:55](https://www.youtube.com/watch?v=_7P580m4kPY&t=55s) trajectory. For instance, if we look at

[0:55](https://www.youtube.com/watch?v=_7P580m4kPY&t=55s) trajectory. For instance, if we look at this uh if we look at the trajectory

[0:57](https://www.youtube.com/watch?v=_7P580m4kPY&t=57s) this uh if we look at the trajectory

[0:57](https://www.youtube.com/watch?v=_7P580m4kPY&t=57s) [Editorial paraphrase] The recorded

[0:59](https://www.youtube.com/watch?v=_7P580m4kPY&t=59s) activity involved

[0:59](https://www.youtube.com/watch?v=_7P580m4kPY&t=59s) cloud configuration and

[1:03](https://www.youtube.com/watch?v=_7P580m4kPY&t=63s) identity information.

[1:03](https://www.youtube.com/watch?v=_7P580m4kPY&t=63s) That caught

[1:05](https://www.youtube.com/watch?v=_7P580m4kPY&t=65s) our attention because

[1:05](https://www.youtube.com/watch?v=_7P580m4kPY&t=65s) malicious software

[1:07](https://www.youtube.com/watch?v=_7P580m4kPY&t=67s) can also access

[1:07](https://www.youtube.com/watch?v=_7P580m4kPY&t=67s) sensitive information.

[1:09](https://www.youtube.com/watch?v=_7P580m4kPY&t=69s) These events

[1:09](https://www.youtube.com/watch?v=_7P580m4kPY&t=69s) establish what the

[1:12](https://www.youtube.com/watch?v=_7P580m4kPY&t=72s) program touched;

[1:12](https://www.youtube.com/watch?v=_7P580m4kPY&t=72s) the trace by

[1:14](https://www.youtube.com/watch?v=_7P580m4kPY&t=74s) itself does

[1:14](https://www.youtube.com/watch?v=_7P580m4kPY&t=74s) not tell

[1:16](https://www.youtube.com/watch?v=_7P580m4kPY&t=76s) the investigator whether

[1:16](https://www.youtube.com/watch?v=_7P580m4kPY&t=76s) that work

[1:19](https://www.youtube.com/watch?v=_7P580m4kPY&t=79s) belonged to the

[1:19](https://www.youtube.com/watch?v=_7P580m4kPY&t=79s) user's task.

[1:21](https://www.youtube.com/watch?v=_7P580m4kPY&t=81s) In this

[1:21](https://www.youtube.com/watch?v=_7P580m4kPY&t=81s) case the skill

[1:24](https://www.youtube.com/watch?v=_7P580m4kPY&t=84s) was an

[1:24](https://www.youtube.com/watch?v=_7P580m4kPY&t=84s) official Azure diagnostic.

[1:26](https://www.youtube.com/watch?v=_7P580m4kPY&t=86s) an official Azure diagnostic skill. And

[1:26](https://www.youtube.com/watch?v=_7P580m4kPY&t=86s) an official Azure diagnostic skill. And this is exactly the point where it's

[1:28](https://www.youtube.com/watch?v=_7P580m4kPY&t=88s) this is exactly the point where it's

[1:28](https://www.youtube.com/watch?v=_7P580m4kPY&t=88s) this is exactly the point where it's kind of hard for us to identify whether

[1:30](https://www.youtube.com/watch?v=_7P580m4kPY&t=90s) kind of hard for us to identify whether

[1:30](https://www.youtube.com/watch?v=_7P580m4kPY&t=90s) kind of hard for us to identify whether a skill is malicious or benign. And we have

[1:33](https://www.youtube.com/watch?v=_7P580m4kPY&t=93s) a skill is malicious or benign. And we have

[1:33](https://www.youtube.com/watch?v=_7P580m4kPY&t=93s) a skill is malicious or benign. And we have to understand the original intent of the

[1:35](https://www.youtube.com/watch?v=_7P580m4kPY&t=95s) to understand the original intent of the

[1:35](https://www.youtube.com/watch?v=_7P580m4kPY&t=95s) to understand the original intent of the skills according to its actions. And at

[1:38](https://www.youtube.com/watch?v=_7P580m4kPY&t=98s) skills according to its actions. And at

[1:38](https://www.youtube.com/watch?v=_7P580m4kPY&t=98s) skills according to its actions. And at this point, you might ask, okay, so we

[1:39](https://www.youtube.com/watch?v=_7P580m4kPY&t=99s) this point, you might ask, okay, so we

[1:40](https://www.youtube.com/watch?v=_7P580m4kPY&t=100s) this point, you might ask, okay, so we can just like scan the skill, right?

[1:43](https://www.youtube.com/watch?v=_7P580m4kPY&t=103s) can just like scan the skill, right?

[1:43](https://www.youtube.com/watch?v=_7P580m4kPY&t=103s) can just like scan the skill, right? Well, it's it's it's more complicated

[1:45](https://www.youtube.com/watch?v=_7P580m4kPY&t=105s) Well, it's it's it's more complicated

[1:45](https://www.youtube.com/watch?v=_7P580m4kPY&t=105s) Well, it's it's it's more complicated than that. The the first problem problem

[1:47](https://www.youtube.com/watch?v=_7P580m4kPY&t=107s) than that. The the first problem problem

[1:47](https://www.youtube.com/watch?v=_7P580m4kPY&t=107s) [Editorial paraphrase] The installed

[1:49](https://www.youtube.com/watch?v=_7P580m4kPY&t=109s) skill file

[1:49](https://www.youtube.com/watch?v=_7P580m4kPY&t=109s) can refer to

[1:51](https://www.youtube.com/watch?v=_7P580m4kPY&t=111s) material that

[1:51](https://www.youtube.com/watch?v=_7P580m4kPY&t=111s) lives somewhere else.

[1:53](https://www.youtube.com/watch?v=_7P580m4kPY&t=113s) The reviewer

[1:54](https://www.youtube.com/watch?v=_7P580m4kPY&t=114s) sees what is

[1:57](https://www.youtube.com/watch?v=_7P580m4kPY&t=117s) in the

[1:57](https://www.youtube.com/watch?v=_7P580m4kPY&t=117s) original file. The

[1:59](https://www.youtube.com/watch?v=_7P580m4kPY&t=119s) agent may

[2:00](https://www.youtube.com/watch?v=_7P580m4kPY&t=120s) see different instructions,

[2:02](https://www.youtube.com/watch?v=_7P580m4kPY&t=122s) additional software

[2:02](https://www.youtube.com/watch?v=_7P580m4kPY&t=122s) or dependencies

[2:04](https://www.youtube.com/watch?v=_7P580m4kPY&t=124s) when it uses

[2:04](https://www.youtube.com/watch?v=_7P580m4kPY&t=124s) the skill.

[2:06](https://www.youtube.com/watch?v=_7P580m4kPY&t=126s) A static review

[2:06](https://www.youtube.com/watch?v=_7P580m4kPY&t=126s) ends too

[2:08](https://www.youtube.com/watch?v=_7P580m4kPY&t=128s) early if it

[2:08](https://www.youtube.com/watch?v=_7P580m4kPY&t=128s) stops at

[2:12](https://www.youtube.com/watch?v=_7P580m4kPY&t=132s) the first document.

[2:12](https://www.youtube.com/watch?v=_7P580m4kPY&t=132s) We need

[2:14](https://www.youtube.com/watch?v=_7P580m4kPY&t=134s) to know which

[2:14](https://www.youtube.com/watch?v=_7P580m4kPY&t=134s) material actually

[2:17](https://www.youtube.com/watch?v=_7P580m4kPY&t=137s) influenced the run.

[2:17](https://www.youtube.com/watch?v=_7P580m4kPY&t=137s) you would lose all of that and you would have to create some sort of mechanism to

[2:18](https://www.youtube.com/watch?v=_7P580m4kPY&t=138s) have to create some sort of mechanism to

[2:18](https://www.youtube.com/watch?v=_7P580m4kPY&t=138s) have to create some sort of mechanism to track all of these payloads if you don't

[2:20](https://www.youtube.com/watch?v=_7P580m4kPY&t=140s) track all of these payloads if you don't

[2:20](https://www.youtube.com/watch?v=_7P580m4kPY&t=140s) track all of these payloads if you don't want to lose them. The second problem

[2:22](https://www.youtube.com/watch?v=_7P580m4kPY&t=142s) want to lose them. The second problem

[2:22](https://www.youtube.com/watch?v=_7P580m4kPY&t=142s) want to lose them. The second problem that we've noticed is that LM analyzers

[2:25](https://www.youtube.com/watch?v=_7P580m4kPY&t=145s) that we've noticed is that LM analyzers

[2:25](https://www.youtube.com/watch?v=_7P580m4kPY&t=145s) that we've noticed is that LM analyzers can be tricked. Um there was a really

[2:27](https://www.youtube.com/watch?v=_7P580m4kPY&t=147s) [Editorial paraphrase] Trail of

[2:27](https://www.youtube.com/watch?v=_7P580m4kPY&t=147s) Bits showed that

[2:29](https://www.youtube.com/watch?v=_7P580m4kPY&t=149s) an automated reviewer

[2:29](https://www.youtube.com/watch?v=_7P580m4kPY&t=149s) could accept a

[2:32](https://www.youtube.com/watch?v=_7P580m4kPY&t=152s) misleading explanation

[2:32](https://www.youtube.com/watch?v=_7P580m4kPY&t=152s) for a change

[2:35](https://www.youtube.com/watch?v=_7P580m4kPY&t=155s) to a project's

[2:35](https://www.youtube.com/watch?v=_7P580m4kPY&t=155s) package source. The

[2:37](https://www.youtube.com/watch?v=_7P580m4kPY&t=157s) explanation was part

[2:37](https://www.youtube.com/watch?v=_7P580m4kPY&t=157s) of the

[2:39](https://www.youtube.com/watch?v=_7P580m4kPY&t=159s) material under review.

[2:39](https://www.youtube.com/watch?v=_7P580m4kPY&t=159s) It was not

[2:42](https://www.youtube.com/watch?v=_7P580m4kPY&t=162s) independent evidence of

[2:42](https://www.youtube.com/watch?v=_7P580m4kPY&t=162s) approval. A favorable

[2:45](https://www.youtube.com/watch?v=_7P580m4kPY&t=165s) judgment from

[2:45](https://www.youtube.com/watch?v=_7P580m4kPY&t=165s) a model was

[2:49](https://www.youtube.com/watch?v=_7P580m4kPY&t=169s) therefore insufficient to

[2:49](https://www.youtube.com/watch?v=_7P580m4kPY&t=169s) establish that the

[2:51](https://www.youtube.com/watch?v=_7P580m4kPY&t=171s) change was authorized.

[2:51](https://www.youtube.com/watch?v=_7P580m4kPY&t=171s) bulletproof we've resorted to a different kind of action and we actually

[2:53](https://www.youtube.com/watch?v=_7P580m4kPY&t=173s) different kind of action and we actually

[2:53](https://www.youtube.com/watch?v=_7P580m4kPY&t=173s) different kind of action and we actually decided to just run the skill with the

[2:55](https://www.youtube.com/watch?v=_7P580m4kPY&t=175s) decided to just run the skill with the

[2:55](https://www.youtube.com/watch?v=_7P580m4kPY&t=175s) decided to just run the skill with the agent. Um this is a technique employed

[2:57](https://www.youtube.com/watch?v=_7P580m4kPY&t=177s) agent. Um this is a technique employed

[2:57](https://www.youtube.com/watch?v=_7P580m4kPY&t=177s) agent. Um this is a technique employed by malware researchers for years now. Uh

[3:00](https://www.youtube.com/watch?v=_7P580m4kPY&t=180s) by malware researchers for years now. Uh

[3:00](https://www.youtube.com/watch?v=_7P580m4kPY&t=180s) by malware researchers for years now. Uh and it's called detonation donation

[3:03](https://www.youtube.com/watch?v=_7P580m4kPY&t=183s) and it's called detonation donation

[3:03](https://www.youtube.com/watch?v=_7P580m4kPY&t=183s) and it's called detonation detonation chamber. So we created the same one but

[3:06](https://www.youtube.com/watch?v=_7P580m4kPY&t=186s) chamber. So we created the same one but

[3:06](https://www.youtube.com/watch?v=_7P580m4kPY&t=186s) chamber. So we created the same one but for agent for for agents and skills. And

[3:09](https://www.youtube.com/watch?v=_7P580m4kPY&t=189s) for agent for for agents and skills. And

[3:09](https://www.youtube.com/watch?v=_7P580m4kPY&t=189s) for agent for for agents and skills. And this was our first version. In our first

[3:10](https://www.youtube.com/watch?v=_7P580m4kPY&t=190s) this was our first version. In our first

[3:10](https://www.youtube.com/watch?v=_7P580m4kPY&t=190s) this was our first version. In our first version uh we created a task prompt. We

[3:13](https://www.youtube.com/watch?v=_7P580m4kPY&t=193s) version uh we created a task prompt. We

[3:13](https://www.youtube.com/watch?v=_7P580m4kPY&t=193s) version uh we created a task prompt. We put an agent and a skill inside a

[3:15](https://www.youtube.com/watch?v=_7P580m4kPY&t=195s) put an agent and a skill inside a

[3:15](https://www.youtube.com/watch?v=_7P580m4kPY&t=195s) put an agent and a skill inside a sandbox. We let it operate over like

[3:18](https://www.youtube.com/watch?v=_7P580m4kPY&t=198s) sandbox. We let it operate over like

[3:18](https://www.youtube.com/watch?v=_7P580m4kPY&t=198s) sandbox. We let it operate over like minutes or or hours until until it

[3:20](https://www.youtube.com/watch?v=_7P580m4kPY&t=200s) minutes or or hours until until it

[3:20](https://www.youtube.com/watch?v=_7P580m4kPY&t=200s) minutes or or hours until until it completed a task. with unobserved agent

[3:23](https://www.youtube.com/watch?v=_7P580m4kPY&t=203s) completed a task. with unobserved agent

[3:23](https://www.youtube.com/watch?v=_7P580m4kPY&t=203s) completed a task. with unobserved agent traces and analyzed it. You can imagine

[3:26](https://www.youtube.com/watch?v=_7P580m4kPY&t=206s) traces and analyzed it. You can imagine

[3:26](https://www.youtube.com/watch?v=_7P580m4kPY&t=206s) traces and analyzed it. You can imagine that it wasn't enough. Our first problem

[3:28](https://www.youtube.com/watch?v=_7P580m4kPY&t=208s) that it wasn't enough. Our first problem

[3:28](https://www.youtube.com/watch?v=_7P580m4kPY&t=208s) that it wasn't enough. Our first problem was that the environment was missing

[3:31](https://www.youtube.com/watch?v=_7P580m4kPY&t=211s) was that the environment was missing

[3:31](https://www.youtube.com/watch?v=_7P580m4kPY&t=211s) was that the environment was missing most of the time. A lot of skills rely

[3:33](https://www.youtube.com/watch?v=_7P580m4kPY&t=213s) most of the time. A lot of skills rely

[3:33](https://www.youtube.com/watch?v=_7P580m4kPY&t=213s) most of the time. A lot of skills rely on CLIs. They rely on specific services

[3:37](https://www.youtube.com/watch?v=_7P580m4kPY&t=217s) on CLIs. They rely on specific services

[3:37](https://www.youtube.com/watch?v=_7P580m4kPY&t=217s) on CLIs. They rely on specific services and even on on existence of the pro of

[3:39](https://www.youtube.com/watch?v=_7P580m4kPY&t=219s) and even on on existence of the pro of

[3:40](https://www.youtube.com/watch?v=_7P580m4kPY&t=220s) and even on on existence of the pro of projects. You can imagine notion skill

[3:42](https://www.youtube.com/watch?v=_7P580m4kPY&t=222s) projects. You can imagine notion skill

[3:42](https://www.youtube.com/watch?v=_7P580m4kPY&t=222s) projects. You can imagine notion skill for instance. This will have to have a

[3:45](https://www.youtube.com/watch?v=_7P580m4kPY&t=225s) for instance. This will have to have a

[3:45](https://www.youtube.com/watch?v=_7P580m4kPY&t=225s) for instance. This will have to have a notion service available to talk to. So

[3:48](https://www.youtube.com/watch?v=_7P580m4kPY&t=228s) notion service available to talk to. So

[3:48](https://www.youtube.com/watch?v=_7P580m4kPY&t=228s) notion service available to talk to. So we've added a world builder that looks

[3:49](https://www.youtube.com/watch?v=_7P580m4kPY&t=229s) we've added a world builder that looks

[3:50](https://www.youtube.com/watch?v=_7P580m4kPY&t=230s) we've added a world builder that looks at a skill and builds the appropriate uh

[3:52](https://www.youtube.com/watch?v=_7P580m4kPY&t=232s) at a skill and builds the appropriate uh

[3:52](https://www.youtube.com/watch?v=_7P580m4kPY&t=232s) at a skill and builds the appropriate uh environment accordingly.

[3:55](https://www.youtube.com/watch?v=_7P580m4kPY&t=235s) environment accordingly.

[3:55](https://www.youtube.com/watch?v=_7P580m4kPY&t=235s) environment accordingly. But then we'll cover another issue. A

[3:57](https://www.youtube.com/watch?v=_7P580m4kPY&t=237s) But then we'll cover another issue. A

[3:57](https://www.youtube.com/watch?v=_7P580m4kPY&t=237s) But then we'll cover another issue. A generic task prompt might not be enough

[4:00](https://www.youtube.com/watch?v=_7P580m4kPY&t=240s) generic task prompt might not be enough

[4:00](https://www.youtube.com/watch?v=_7P580m4kPY&t=240s) generic task prompt might not be enough for all skills. I mean think about it.

[4:03](https://www.youtube.com/watch?v=_7P580m4kPY&t=243s) for all skills. I mean think about it.

[4:03](https://www.youtube.com/watch?v=_7P580m4kPY&t=243s) for all skills. I mean think about it. You can have a presentation skill uh

[4:06](https://www.youtube.com/watch?v=_7P580m4kPY&t=246s) You can have a presentation skill uh

[4:06](https://www.youtube.com/watch?v=_7P580m4kPY&t=246s) You can have a presentation skill uh that needs to create a deck or

[4:07](https://www.youtube.com/watch?v=_7P580m4kPY&t=247s) that needs to create a deck or

[4:07](https://www.youtube.com/watch?v=_7P580m4kPY&t=247s) that needs to create a deck or deployment skill that need to ship a

[4:08](https://www.youtube.com/watch?v=_7P580m4kPY&t=248s) deployment skill that need to ship a

[4:08](https://www.youtube.com/watch?v=_7P580m4kPY&t=248s) deployment skill that need to ship a service a brainstorming skill that needs

[4:11](https://www.youtube.com/watch?v=_7P580m4kPY&t=251s) service a brainstorming skill that needs

[4:11](https://www.youtube.com/watch?v=_7P580m4kPY&t=251s) service a brainstorming skill that needs to explore an idea. Each and every one

[4:13](https://www.youtube.com/watch?v=_7P580m4kPY&t=253s) to explore an idea. Each and every one

[4:13](https://www.youtube.com/watch?v=_7P580m4kPY&t=253s) to explore an idea. Each and every one of them has an entirely different modus

[4:15](https://www.youtube.com/watch?v=_7P580m4kPY&t=255s) of them has an entirely different modus

[4:15](https://www.youtube.com/watch?v=_7P580m4kPY&t=255s) of them has an entirely different modus operandi. Let's take shipping shipping a

[4:18](https://www.youtube.com/watch?v=_7P580m4kPY&t=258s) operandi. Let's take shipping shipping a

[4:18](https://www.youtube.com/watch?v=_7P580m4kPY&t=258s) operandi. Let's take shipping shipping a service for instance. You need to learn

[4:19](https://www.youtube.com/watch?v=_7P580m4kPY&t=259s) service for instance. You need to learn

[4:19](https://www.youtube.com/watch?v=_7P580m4kPY&t=259s) service for instance. You need to learn how to configure it. You need to learn

[4:21](https://www.youtube.com/watch?v=_7P580m4kPY&t=261s) how to configure it. You need to learn

[4:21](https://www.youtube.com/watch?v=_7P580m4kPY&t=261s) how to configure it. You need to learn to deploy it. You need to tell it to

[4:23](https://www.youtube.com/watch?v=_7P580m4kPY&t=263s) to deploy it. You need to tell it to

[4:23](https://www.youtube.com/watch?v=_7P580m4kPY&t=263s) to deploy it. You need to tell it to recover from snapshots using snapshots.

[4:26](https://www.youtube.com/watch?v=_7P580m4kPY&t=266s) recover from snapshots using snapshots.

[4:26](https://www.youtube.com/watch?v=_7P580m4kPY&t=266s) recover from snapshots using snapshots. Um each and every one of them uh

[4:29](https://www.youtube.com/watch?v=_7P580m4kPY&t=269s) Um each and every one of them uh

[4:29](https://www.youtube.com/watch?v=_7P580m4kPY&t=269s) Um each and every one of them uh requires different set of prompts and

[4:31](https://www.youtube.com/watch?v=_7P580m4kPY&t=271s) requires different set of prompts and

[4:31](https://www.youtube.com/watch?v=_7P580m4kPY&t=271s) requires different set of prompts and you also need to need to make sure that

[4:33](https://www.youtube.com/watch?v=_7P580m4kPY&t=273s) you also need to need to make sure that

[4:33](https://www.youtube.com/watch?v=_7P580m4kPY&t=273s) you also need to need to make sure that you um cover every route in the in that

[4:39](https://www.youtube.com/watch?v=_7P580m4kPY&t=279s) you um cover every route in the in that

[4:39](https://www.youtube.com/watch?v=_7P580m4kPY&t=279s) you um cover every route in the in that skill because one of them can be

[4:40](https://www.youtube.com/watch?v=_7P580m4kPY&t=280s) skill because one of them can be

[4:40](https://www.youtube.com/watch?v=_7P580m4kPY&t=280s) skill because one of them can be malicious. So we created the operator

[4:42](https://www.youtube.com/watch?v=_7P580m4kPY&t=282s) malicious. So we created the operator

[4:42](https://www.youtube.com/watch?v=_7P580m4kPY&t=282s) malicious. So we created the operator that does just that. It reads through

[4:43](https://www.youtube.com/watch?v=_7P580m4kPY&t=283s) that does just that. It reads through

[4:44](https://www.youtube.com/watch?v=_7P580m4kPY&t=284s) that does just that. It reads through the skill and tries to analyze what are

[4:46](https://www.youtube.com/watch?v=_7P580m4kPY&t=286s) the skill and tries to analyze what are

[4:46](https://www.youtube.com/watch?v=_7P580m4kPY&t=286s) the skill and tries to analyze what are the different trajectories um that we

[4:49](https://www.youtube.com/watch?v=_7P580m4kPY&t=289s) the different trajectories um that we

[4:49](https://www.youtube.com/watch?v=_7P580m4kPY&t=289s) the different trajectories um that we should invoke. And while it worked

[4:52](https://www.youtube.com/watch?v=_7P580m4kPY&t=292s) should invoke. And while it worked

[4:52](https://www.youtube.com/watch?v=_7P580m4kPY&t=292s) should invoke. And while it worked pretty well, if you worked with agent,

[4:54](https://www.youtube.com/watch?v=_7P580m4kPY&t=294s) pretty well, if you worked with agent,

[4:54](https://www.youtube.com/watch?v=_7P580m4kPY&t=294s) pretty well, if you worked with agent, you can especially in the security

[4:56](https://www.youtube.com/watch?v=_7P580m4kPY&t=296s) [Editorial paraphrase] Our tests

[4:56](https://www.youtube.com/watch?v=_7P580m4kPY&t=296s) also ran

[4:59](https://www.youtube.com/watch?v=_7P580m4kPY&t=299s) into agent safeguards.

[4:59](https://www.youtube.com/watch?v=_7P580m4kPY&t=299s) Some agents

[5:02](https://www.youtube.com/watch?v=_7P580m4kPY&t=302s) refused to

[5:02](https://www.youtube.com/watch?v=_7P580m4kPY&t=302s) continue when the

[5:04](https://www.youtube.com/watch?v=_7P580m4kPY&t=304s) requested behavior

[5:04](https://www.youtube.com/watch?v=_7P580m4kPY&t=304s) looked risky.

[5:08](https://www.youtube.com/watch?v=_7P580m4kPY&t=308s) A refusal affects

[5:08](https://www.youtube.com/watch?v=_7P580m4kPY&t=308s) how much

[5:10](https://www.youtube.com/watch?v=_7P580m4kPY&t=310s) of the

[5:10](https://www.youtube.com/watch?v=_7P580m4kPY&t=310s) skill we can

[5:12](https://www.youtube.com/watch?v=_7P580m4kPY&t=312s) observe in

[5:12](https://www.youtube.com/watch?v=_7P580m4kPY&t=312s) one run.

[5:15](https://www.youtube.com/watch?v=_7P580m4kPY&t=315s) The team explored

[5:15](https://www.youtube.com/watch?v=_7P580m4kPY&t=315s) that limitation

[5:18](https://www.youtube.com/watch?v=_7P580m4kPY&t=318s) inside its isolated

[5:18](https://www.youtube.com/watch?v=_7P580m4kPY&t=318s) research environment.

[5:20](https://www.youtube.com/watch?v=_7P580m4kPY&t=320s) We needed

[5:20](https://www.youtube.com/watch?v=_7P580m4kPY&t=320s) to distinguish a

[5:22](https://www.youtube.com/watch?v=_7P580m4kPY&t=322s) test that

[5:22](https://www.youtube.com/watch?v=_7P580m4kPY&t=322s) stopped early

[5:25](https://www.youtube.com/watch?v=_7P580m4kPY&t=325s) from a test

[5:25](https://www.youtube.com/watch?v=_7P580m4kPY&t=325s) that showed

[5:28](https://www.youtube.com/watch?v=_7P580m4kPY&t=328s) the skill

[5:28](https://www.youtube.com/watch?v=_7P580m4kPY&t=328s) completed safely. The

[5:33](https://www.youtube.com/watch?v=_7P580m4kPY&t=333s) results depend

[5:33](https://www.youtube.com/watch?v=_7P580m4kPY&t=333s) on the

[5:36](https://www.youtube.com/watch?v=_7P580m4kPY&t=336s) setting, the task

[5:36](https://www.youtube.com/watch?v=_7P580m4kPY&t=336s) and the

[5:38](https://www.youtube.com/watch?v=_7P580m4kPY&t=338s) particular decisions

[5:38](https://www.youtube.com/watch?v=_7P580m4kPY&t=338s) the agent made.

[5:40](https://www.youtube.com/watch?v=_7P580m4kPY&t=340s) There were

[5:40](https://www.youtube.com/watch?v=_7P580m4kPY&t=340s) false alarms too.

[5:42](https://www.youtube.com/watch?v=_7P580m4kPY&t=342s) A legitimate

[5:42](https://www.youtube.com/watch?v=_7P580m4kPY&t=342s) skill may

[5:44](https://www.youtube.com/watch?v=_7P580m4kPY&t=344s) involve an operation

[5:44](https://www.youtube.com/watch?v=_7P580m4kPY&t=344s) that a

[5:46](https://www.youtube.com/watch?v=_7P580m4kPY&t=346s) model judges

[5:46](https://www.youtube.com/watch?v=_7P580m4kPY&t=346s) risky. The control

[5:48](https://www.youtube.com/watch?v=_7P580m4kPY&t=348s) can act

[5:48](https://www.youtube.com/watch?v=_7P580m4kPY&t=348s) as intended

[5:50](https://www.youtube.com/watch?v=_7P580m4kPY&t=350s) and still limit

[5:50](https://www.youtube.com/watch?v=_7P580m4kPY&t=350s) what the

[5:53](https://www.youtube.com/watch?v=_7P580m4kPY&t=353s) researchers can

[5:53](https://www.youtube.com/watch?v=_7P580m4kPY&t=353s) conclude about that

[5:55](https://www.youtube.com/watch?v=_7P580m4kPY&t=355s) run. We

[5:55](https://www.youtube.com/watch?v=_7P580m4kPY&t=355s) recorded the

[5:56](https://www.youtube.com/watch?v=_7P580m4kPY&t=356s) observed behavior and

[5:56](https://www.youtube.com/watch?v=_7P580m4kPY&t=356s) the limits

[5:59](https://www.youtube.com/watch?v=_7P580m4kPY&t=359s) of the evidence.

[5:59](https://www.youtube.com/watch?v=_7P580m4kPY&t=359s) would still be triggered. So up until now we were dealing with the

[6:01](https://www.youtube.com/watch?v=_7P580m4kPY&t=361s) So up until now we were dealing with the

[6:01](https://www.youtube.com/watch?v=_7P580m4kPY&t=361s) So up until now we were dealing with the sandbox.

[6:03](https://www.youtube.com/watch?v=_7P580m4kPY&t=363s) sandbox.

[6:03](https://www.youtube.com/watch?v=_7P580m4kPY&t=363s) sandbox. At this point, we we we started to

[6:05](https://www.youtube.com/watch?v=_7P580m4kPY&t=365s) At this point, we we we started to

[6:05](https://www.youtube.com/watch?v=_7P580m4kPY&t=365s) At this point, we we we started to tackle the the the the capturing

[6:08](https://www.youtube.com/watch?v=_7P580m4kPY&t=368s) tackle the the the the capturing

[6:08](https://www.youtube.com/watch?v=_7P580m4kPY&t=368s) tackle the the the the capturing mechanism. So, agent traces can go that

[6:13](https://www.youtube.com/watch?v=_7P580m4kPY&t=373s) mechanism. So, agent traces can go that

[6:13](https://www.youtube.com/watch?v=_7P580m4kPY&t=373s) mechanism. So, agent traces can go that far. At some point, you'll be missing

[6:16](https://www.youtube.com/watch?v=_7P580m4kPY&t=376s) [Editorial paraphrase] A package

[6:16](https://www.youtube.com/watch?v=_7P580m4kPY&t=376s) installation can have

[6:18](https://www.youtube.com/watch?v=_7P580m4kPY&t=378s) side effects

[6:18](https://www.youtube.com/watch?v=_7P580m4kPY&t=378s) beyond the tool

[6:21](https://www.youtube.com/watch?v=_7P580m4kPY&t=381s) call shown

[6:21](https://www.youtube.com/watch?v=_7P580m4kPY&t=381s) in the agent's

[6:24](https://www.youtube.com/watch?v=_7P580m4kPY&t=384s) conversation. Work done

[6:24](https://www.youtube.com/watch?v=_7P580m4kPY&t=384s) by another

[6:26](https://www.youtube.com/watch?v=_7P580m4kPY&t=386s) process may touch

[6:26](https://www.youtube.com/watch?v=_7P580m4kPY&t=386s) files or

[6:28](https://www.youtube.com/watch?v=_7P580m4kPY&t=388s) communicate with a

[6:28](https://www.youtube.com/watch?v=_7P580m4kPY&t=388s) service. A

[6:29](https://www.youtube.com/watch?v=_7P580m4kPY&t=389s) reviewer following only

[6:30](https://www.youtube.com/watch?v=_7P580m4kPY&t=390s) the model's messages

[6:32](https://www.youtube.com/watch?v=_7P580m4kPY&t=392s) could miss

[6:32](https://www.youtube.com/watch?v=_7P580m4kPY&t=392s) those effects. We

[6:33](https://www.youtube.com/watch?v=_7P580m4kPY&t=393s) wanted the

[6:33](https://www.youtube.com/watch?v=_7P580m4kPY&t=393s) system to capture

[6:36](https://www.youtube.com/watch?v=_7P580m4kPY&t=396s) what the

[6:36](https://www.youtube.com/watch?v=_7P580m4kPY&t=396s) machine actually did

[6:38](https://www.youtube.com/watch?v=_7P580m4kPY&t=398s) during the installation.

[6:38](https://www.youtube.com/watch?v=_7P580m4kPY&t=398s) also events and signals that we need to

[6:39](https://www.youtube.com/watch?v=_7P580m4kPY&t=399s) events and signals that we need to

[6:40](https://www.youtube.com/watch?v=_7P580m4kPY&t=400s) events and signals that we need to capture and we did just that as part of

[6:42](https://www.youtube.com/watch?v=_7P580m4kPY&t=402s) capture and we did just that as part of

[6:42](https://www.youtube.com/watch?v=_7P580m4kPY&t=402s) capture and we did just that as part of the capturing mechanism. We added

[6:44](https://www.youtube.com/watch?v=_7P580m4kPY&t=404s) the capturing mechanism. We added

[6:44](https://www.youtube.com/watch?v=_7P580m4kPY&t=404s) the capturing mechanism. We added process creation event file system event

[6:47](https://www.youtube.com/watch?v=_7P580m4kPY&t=407s) process creation event file system event

[6:47](https://www.youtube.com/watch?v=_7P580m4kPY&t=407s) process creation event file system event and network a network packet capturing

[6:50](https://www.youtube.com/watch?v=_7P580m4kPY&t=410s) and network a network packet capturing

[6:50](https://www.youtube.com/watch?v=_7P580m4kPY&t=410s) and network a network packet capturing given all of that along with the agent

[6:51](https://www.youtube.com/watch?v=_7P580m4kPY&t=411s) given all of that along with the agent

[6:51](https://www.youtube.com/watch?v=_7P580m4kPY&t=411s) given all of that along with the agent traces. We then moved it uh to a quality

[6:54](https://www.youtube.com/watch?v=_7P580m4kPY&t=414s) traces. We then moved it uh to a quality

[6:54](https://www.youtube.com/watch?v=_7P580m4kPY&t=414s) traces. We then moved it uh to a quality evidence and capture the behavior

[7:00](https://www.youtube.com/watch?v=_7P580m4kPY&t=420s) evidence and capture the behavior

[7:00](https://www.youtube.com/watch?v=_7P580m4kPY&t=420s) evidence and capture the behavior even this final form of the detonation

[7:03](https://www.youtube.com/watch?v=_7P580m4kPY&t=423s) even this final form of the detonation

[7:03](https://www.youtube.com/watch?v=_7P580m4kPY&t=423s) even this final form of the detonation chamber. Let's take a look at

[7:07](https://www.youtube.com/watch?v=_7P580m4kPY&t=427s) chamber. Let's take a look at

[7:07](https://www.youtube.com/watch?v=_7P580m4kPY&t=427s) chamber. Let's take a look at at an example skill. So Zach Corman, you

[7:09](https://www.youtube.com/watch?v=_7P580m4kPY&t=429s) at an example skill. So Zach Corman, you

[7:09](https://www.youtube.com/watch?v=_7P580m4kPY&t=429s) at an example skill. So Zach Corman, you should follow him on Twitter. He created

[7:11](https://www.youtube.com/watch?v=_7P580m4kPY&t=431s) should follow him on Twitter. He created

[7:11](https://www.youtube.com/watch?v=_7P580m4kPY&t=431s) [Editorial paraphrase] In Zach

[7:13](https://www.youtube.com/watch?v=_7P580m4kPY&t=433s) Corman's proof of

[7:13](https://www.youtube.com/watch?v=_7P580m4kPY&t=433s) concept, the

[7:17](https://www.youtube.com/watch?v=_7P580m4kPY&t=437s) first skill introduced

[7:17](https://www.youtube.com/watch?v=_7P580m4kPY&t=437s) another component

[7:19](https://www.youtube.com/watch?v=_7P580m4kPY&t=439s) whose behavior was

[7:19](https://www.youtube.com/watch?v=_7P580m4kPY&t=439s) absent from

[7:21](https://www.youtube.com/watch?v=_7P580m4kPY&t=441s) the file the

[7:22](https://www.youtube.com/watch?v=_7P580m4kPY&t=442s) user originally

[7:24](https://www.youtube.com/watch?v=_7P580m4kPY&t=444s) inspected. The additional

[7:24](https://www.youtube.com/watch?v=_7P580m4kPY&t=444s) material influenced

[7:26](https://www.youtube.com/watch?v=_7P580m4kPY&t=446s) what the agent

[7:26](https://www.youtube.com/watch?v=_7P580m4kPY&t=446s) did. The

[7:27](https://www.youtube.com/watch?v=_7P580m4kPY&t=447s) researchers used an

[7:27](https://www.youtube.com/watch?v=_7P580m4kPY&t=447s) innocuous demonstration

[7:29](https://www.youtube.com/watch?v=_7P580m4kPY&t=449s) to make that

[7:30](https://www.youtube.com/watch?v=_7P580m4kPY&t=450s) gap observable.

[7:32](https://www.youtube.com/watch?v=_7P580m4kPY&t=452s) It showed why

[7:32](https://www.youtube.com/watch?v=_7P580m4kPY&t=452s) reviewing a

[7:34](https://www.youtube.com/watch?v=_7P580m4kPY&t=454s) well-named component in

[7:34](https://www.youtube.com/watch?v=_7P580m4kPY&t=454s) isolation could

[7:37](https://www.youtube.com/watch?v=_7P580m4kPY&t=457s) give a misleading

[7:37](https://www.youtube.com/watch?v=_7P580m4kPY&t=457s) impression of

[7:39](https://www.youtube.com/watch?v=_7P580m4kPY&t=459s) the complete task.

[7:39](https://www.youtube.com/watch?v=_7P580m4kPY&t=459s) Inspecting what

[7:41](https://www.youtube.com/watch?v=_7P580m4kPY&t=461s) was present at

[7:41](https://www.youtube.com/watch?v=_7P580m4kPY&t=461s) installation time

[7:44](https://www.youtube.com/watch?v=_7P580m4kPY&t=464s) left part of

[7:44](https://www.youtube.com/watch?v=_7P580m4kPY&t=464s) the behavior

[7:48](https://www.youtube.com/watch?v=_7P580m4kPY&t=468s) unexplained. The chamber's

[7:48](https://www.youtube.com/watch?v=_7P580m4kPY&t=468s) evidence connected

[7:51](https://www.youtube.com/watch?v=_7P580m4kPY&t=471s) the later action

[7:51](https://www.youtube.com/watch?v=_7P580m4kPY&t=471s) with the

[7:53](https://www.youtube.com/watch?v=_7P580m4kPY&t=473s) earlier component that

[7:53](https://www.youtube.com/watch?v=_7P580m4kPY&t=473s) caused it.

[7:55](https://www.youtube.com/watch?v=_7P580m4kPY&t=475s) That attribution came

[7:55](https://www.youtube.com/watch?v=_7P580m4kPY&t=475s) from a

[7:57](https://www.youtube.com/watch?v=_7P580m4kPY&t=477s) particular observed run.

[7:57](https://www.youtube.com/watch?v=_7P580m4kPY&t=477s) chamber. Using this approach, we were able to

[8:00](https://www.youtube.com/watch?v=_7P580m4kPY&t=480s) Using this approach, we were able to

[8:00](https://www.youtube.com/watch?v=_7P580m4kPY&t=480s) Using this approach, we were able to uncover 100 malicious skill out of

[8:03](https://www.youtube.com/watch?v=_7P580m4kPY&t=483s) uncover 100 malicious skill out of

[8:03](https://www.youtube.com/watch?v=_7P580m4kPY&t=483s) uncover 100 malicious skill out of thousands and they were shut off uh the

[8:07](https://www.youtube.com/watch?v=_7P580m4kPY&t=487s) thousands and they were shut off uh the

[8:07](https://www.youtube.com/watch?v=_7P580m4kPY&t=487s) thousands and they were shut off uh the skills.sh framework.

[8:10](https://www.youtube.com/watch?v=_7P580m4kPY&t=490s) skills.sh framework.

[8:10](https://www.youtube.com/watch?v=_7P580m4kPY&t=490s) skills.sh framework. Now let's take a look at another

[8:12](https://www.youtube.com/watch?v=_7P580m4kPY&t=492s) Now let's take a look at another

[8:12](https://www.youtube.com/watch?v=_7P580m4kPY&t=492s) Now let's take a look at another example. Poly market. Uh this is this

[8:15](https://www.youtube.com/watch?v=_7P580m4kPY&t=495s) [Editorial paraphrase] Another skill

[8:15](https://www.youtube.com/watch?v=_7P580m4kPY&t=495s) claimed to

[8:17](https://www.youtube.com/watch?v=_7P580m4kPY&t=497s) use a Polymarket

[8:17](https://www.youtube.com/watch?v=_7P580m4kPY&t=497s) dependency. The

[8:19](https://www.youtube.com/watch?v=_7P580m4kPY&t=499s) researchers found

[8:19](https://www.youtube.com/watch?v=_7P580m4kPY&t=499s) that its package

[8:22](https://www.youtube.com/watch?v=_7P580m4kPY&t=502s) identity differed

[8:22](https://www.youtube.com/watch?v=_7P580m4kPY&t=502s) from the expected

[8:24](https://www.youtube.com/watch?v=_7P580m4kPY&t=504s) one and

[8:24](https://www.youtube.com/watch?v=_7P580m4kPY&t=504s) that its

[8:28](https://www.youtube.com/watch?v=_7P580m4kPY&t=508s) origin was unofficial.

[8:28](https://www.youtube.com/watch?v=_7P580m4kPY&t=508s) They compared

[8:31](https://www.youtube.com/watch?v=_7P580m4kPY&t=511s) what had actually

[8:31](https://www.youtube.com/watch?v=_7P580m4kPY&t=511s) been installed

[8:34](https://www.youtube.com/watch?v=_7P580m4kPY&t=514s) with what

[8:34](https://www.youtube.com/watch?v=_7P580m4kPY&t=514s) a user would

[8:37](https://www.youtube.com/watch?v=_7P580m4kPY&t=517s) reasonably have

[8:37](https://www.youtube.com/watch?v=_7P580m4kPY&t=517s) expected. Further inspection

[8:38](https://www.youtube.com/watch?v=_7P580m4kPY&t=518s) showed that

[8:38](https://www.youtube.com/watch?v=_7P580m4kPY&t=518s) the substituted

[8:41](https://www.youtube.com/watch?v=_7P580m4kPY&t=521s) software collected sensitive

[8:42](https://www.youtube.com/watch?v=_7P580m4kPY&t=522s) information. Similar

[8:44](https://www.youtube.com/watch?v=_7P580m4kPY&t=524s) names can hide

[8:44](https://www.youtube.com/watch?v=_7P580m4kPY&t=524s) a material

[8:47](https://www.youtube.com/watch?v=_7P580m4kPY&t=527s) difference in

[8:47](https://www.youtube.com/watch?v=_7P580m4kPY&t=527s) who supplied a

[8:49](https://www.youtube.com/watch?v=_7P580m4kPY&t=529s) dependency and

[8:49](https://www.youtube.com/watch?v=_7P580m4kPY&t=529s) what it does.

[8:51](https://www.youtube.com/watch?v=_7P580m4kPY&t=531s) [Editorial paraphrase] The team

[8:51](https://www.youtube.com/watch?v=_7P580m4kPY&t=531s) also saw cases

[8:56](https://www.youtube.com/watch?v=_7P580m4kPY&t=536s) in which

[8:56](https://www.youtube.com/watch?v=_7P580m4kPY&t=536s) a skill could

[8:58](https://www.youtube.com/watch?v=_7P580m4kPY&t=538s) return after

[8:58](https://www.youtube.com/watch?v=_7P580m4kPY&t=538s) someone removed it.

[9:01](https://www.youtube.com/watch?v=_7P580m4kPY&t=541s) Deleting the visible

[9:01](https://www.youtube.com/watch?v=_7P580m4kPY&t=541s) component did

[9:04](https://www.youtube.com/watch?v=_7P580m4kPY&t=544s) not always undo

[9:04](https://www.youtube.com/watch?v=_7P580m4kPY&t=544s) the changes

[9:09](https://www.youtube.com/watch?v=_7P580m4kPY&t=549s) the installation had

[9:09](https://www.youtube.com/watch?v=_7P580m4kPY&t=549s) made to the

[9:10](https://www.youtube.com/watch?v=_7P580m4kPY&t=550s) environment. That

[9:10](https://www.youtube.com/watch?v=_7P580m4kPY&t=550s) matters to someone

[9:12](https://www.youtube.com/watch?v=_7P580m4kPY&t=552s) investigating a

[9:12](https://www.youtube.com/watch?v=_7P580m4kPY&t=552s) machine that appears

[9:15](https://www.youtube.com/watch?v=_7P580m4kPY&t=555s) clean after

[9:15](https://www.youtube.com/watch?v=_7P580m4kPY&t=555s) an uninstall. Another

[9:17](https://www.youtube.com/watch?v=_7P580m4kPY&t=557s) example involved a

[9:17](https://www.youtube.com/watch?v=_7P580m4kPY&t=557s) third-party version

[9:20](https://www.youtube.com/watch?v=_7P580m4kPY&t=560s) of a skill

[9:20](https://www.youtube.com/watch?v=_7P580m4kPY&t=560s) creator silently

[9:22](https://www.youtube.com/watch?v=_7P580m4kPY&t=562s) replacing the official

[9:22](https://www.youtube.com/watch?v=_7P580m4kPY&t=562s) version. Users could

[9:24](https://www.youtube.com/watch?v=_7P580m4kPY&t=564s) believe they

[9:24](https://www.youtube.com/watch?v=_7P580m4kPY&t=564s) were still invoking

[9:27](https://www.youtube.com/watch?v=_7P580m4kPY&t=567s) a familiar

[9:27](https://www.youtube.com/watch?v=_7P580m4kPY&t=567s) capability while a

[9:30](https://www.youtube.com/watch?v=_7P580m4kPY&t=570s) different implementation

[9:30](https://www.youtube.com/watch?v=_7P580m4kPY&t=570s) answered. Those are

[9:33](https://www.youtube.com/watch?v=_7P580m4kPY&t=573s) observable changes to

[9:33](https://www.youtube.com/watch?v=_7P580m4kPY&t=573s) the installed

[9:35](https://www.youtube.com/watch?v=_7P580m4kPY&t=575s) environment, including changes

[9:36](https://www.youtube.com/watch?v=_7P580m4kPY&t=576s) a person

[9:37](https://www.youtube.com/watch?v=_7P580m4kPY&t=577s) might never see

[9:37](https://www.youtube.com/watch?v=_7P580m4kPY&t=577s) during the interaction.

[9:40](https://www.youtube.com/watch?v=_7P580m4kPY&t=580s) trick that we've seen a lot of actors

[9:40](https://www.youtube.com/watch?v=_7P580m4kPY&t=580s) [Editorial paraphrase] A skill

[9:42](https://www.youtube.com/watch?v=_7P580m4kPY&t=582s) can depend

[9:42](https://www.youtube.com/watch?v=_7P580m4kPY&t=582s) on instructions

[9:43](https://www.youtube.com/watch?v=_7P580m4kPY&t=583s) stored outside

[9:43](https://www.youtube.com/watch?v=_7P580m4kPY&t=583s) the installed

[9:46](https://www.youtube.com/watch?v=_7P580m4kPY&t=586s) package. Some

[9:46](https://www.youtube.com/watch?v=_7P580m4kPY&t=586s) legitimate skills

[9:48](https://www.youtube.com/watch?v=_7P580m4kPY&t=588s) do this

[9:48](https://www.youtube.com/watch?v=_7P580m4kPY&t=588s) too. The

[9:50](https://www.youtube.com/watch?v=_7P580m4kPY&t=590s) important point

[9:50](https://www.youtube.com/watch?v=_7P580m4kPY&t=590s) for review

[9:53](https://www.youtube.com/watch?v=_7P580m4kPY&t=593s) is that

[9:53](https://www.youtube.com/watch?v=_7P580m4kPY&t=593s) the material

[9:57](https://www.youtube.com/watch?v=_7P580m4kPY&t=597s) available today

[9:57](https://www.youtube.com/watch?v=_7P580m4kPY&t=597s) can change

[9:58](https://www.youtube.com/watch?v=_7P580m4kPY&t=598s) later, without

[9:58](https://www.youtube.com/watch?v=_7P580m4kPY&t=598s) a change to

[10:00](https://www.youtube.com/watch?v=_7P580m4kPY&t=600s) the local

[10:00](https://www.youtube.com/watch?v=_7P580m4kPY&t=600s) file. The

[10:02](https://www.youtube.com/watch?v=_7P580m4kPY&t=602s) original publisher

[10:02](https://www.youtube.com/watch?v=_7P580m4kPY&t=602s) may update

[10:04](https://www.youtube.com/watch?v=_7P580m4kPY&t=604s) it and

[10:04](https://www.youtube.com/watch?v=_7P580m4kPY&t=604s) control of

[10:07](https://www.youtube.com/watch?v=_7P580m4kPY&t=607s) the external

[10:07](https://www.youtube.com/watch?v=_7P580m4kPY&t=607s) location itself

[10:09](https://www.youtube.com/watch?v=_7P580m4kPY&t=609s) can change.

[10:09](https://www.youtube.com/watch?v=_7P580m4kPY&t=609s) A reviewer

[10:11](https://www.youtube.com/watch?v=_7P580m4kPY&t=611s) needs to

[10:12](https://www.youtube.com/watch?v=_7P580m4kPY&t=612s) distinguish what

[10:13](https://www.youtube.com/watch?v=_7P580m4kPY&t=613s) they actually

[10:13](https://www.youtube.com/watch?v=_7P580m4kPY&t=613s) inspected from

[10:16](https://www.youtube.com/watch?v=_7P580m4kPY&t=616s) what a

[10:16](https://www.youtube.com/watch?v=_7P580m4kPY&t=616s) later invocation received.

[10:18](https://www.youtube.com/watch?v=_7P580m4kPY&t=618s) [Editorial paraphrase] Some skills

[10:18](https://www.youtube.com/watch?v=_7P580m4kPY&t=618s) could become active

[10:20](https://www.youtube.com/watch?v=_7P580m4kPY&t=620s) in response to

[10:20](https://www.youtube.com/watch?v=_7P580m4kPY&t=620s) ordinary user activity,

[10:23](https://www.youtube.com/watch?v=_7P580m4kPY&t=623s) even outside the

[10:23](https://www.youtube.com/watch?v=_7P580m4kPY&t=623s) task for

[10:25](https://www.youtube.com/watch?v=_7P580m4kPY&t=625s) which they were

[10:25](https://www.youtube.com/watch?v=_7P580m4kPY&t=625s) originally chosen. That

[10:27](https://www.youtube.com/watch?v=_7P580m4kPY&t=627s) changes how often

[10:27](https://www.youtube.com/watch?v=_7P580m4kPY&t=627s) a risky behavior

[10:29](https://www.youtube.com/watch?v=_7P580m4kPY&t=629s) can occur and

[10:29](https://www.youtube.com/watch?v=_7P580m4kPY&t=629s) how visible

[10:31](https://www.youtube.com/watch?v=_7P580m4kPY&t=631s) it is to

[10:32](https://www.youtube.com/watch?v=_7P580m4kPY&t=632s) the user. The

[10:33](https://www.youtube.com/watch?v=_7P580m4kPY&t=633s) team treated that

[10:33](https://www.youtube.com/watch?v=_7P580m4kPY&t=633s) as part of

[10:35](https://www.youtube.com/watch?v=_7P580m4kPY&t=635s) the security review.

[10:35](https://www.youtube.com/watch?v=_7P580m4kPY&t=635s) be aware of that. But let's talk about a campaign that we

[10:37](https://www.youtube.com/watch?v=_7P580m4kPY&t=637s) But let's talk about a campaign that we

[10:37](https://www.youtube.com/watch?v=_7P580m4kPY&t=637s) But let's talk about a campaign that we that we've uncovered. Uh meet Carly or

[10:39](https://www.youtube.com/watch?v=_7P580m4kPY&t=639s) that we've uncovered. Uh meet Carly or

[10:39](https://www.youtube.com/watch?v=_7P580m4kPY&t=639s) that we've uncovered. Uh meet Carly or Carly paperclipipped as he known in

[10:41](https://www.youtube.com/watch?v=_7P580m4kPY&t=641s) Carly paperclipipped as he known in

[10:41](https://www.youtube.com/watch?v=_7P580m4kPY&t=641s) Carly paperclipipped as he known in GitHub. He faked the paperclip

[10:44](https://www.youtube.com/watch?v=_7P580m4kPY&t=644s) GitHub. He faked the paperclip

[10:44](https://www.youtube.com/watch?v=_7P580m4kPY&t=644s) GitHub. He faked the paperclip organization. And paperclipipped is a

[10:47](https://www.youtube.com/watch?v=_7P580m4kPY&t=647s) organization. And paperclipipped is a

[10:47](https://www.youtube.com/watch?v=_7P580m4kPY&t=647s) organization. And paperclipipped is a wellknown uh project is it's an open

[10:50](https://www.youtube.com/watch?v=_7P580m4kPY&t=650s) wellknown uh project is it's an open

[10:50](https://www.youtube.com/watch?v=_7P580m4kPY&t=650s) wellknown uh project is it's an open source uh project aimed for a a

[10:53](https://www.youtube.com/watch?v=_7P580m4kPY&t=653s) source uh project aimed for a a

[10:53](https://www.youtube.com/watch?v=_7P580m4kPY&t=653s) source uh project aimed for a a orchestration of of various agents. Um

[10:56](https://www.youtube.com/watch?v=_7P580m4kPY&t=656s) orchestration of of various agents. Um

[10:56](https://www.youtube.com/watch?v=_7P580m4kPY&t=656s) orchestration of of various agents. Um early here basically created a fake

[10:58](https://www.youtube.com/watch?v=_7P580m4kPY&t=658s) early here basically created a fake

[10:58](https://www.youtube.com/watch?v=_7P580m4kPY&t=658s) early here basically created a fake organization that mimics it. He bought a

[11:01](https://www.youtube.com/watch?v=_7P580m4kPY&t=661s) organization that mimics it. He bought a

[11:01](https://www.youtube.com/watch?v=_7P580m4kPY&t=661s) organization that mimics it. He bought a he he registered the domain under kind

[11:03](https://www.youtube.com/watch?v=_7P580m4kPY&t=663s) he he registered the domain under kind

[11:04](https://www.youtube.com/watch?v=_7P580m4kPY&t=664s) he he registered the domain under kind of the same name, created a lookalike

[11:06](https://www.youtube.com/watch?v=_7P580m4kPY&t=666s) of the same name, created a lookalike

[11:06](https://www.youtube.com/watch?v=_7P580m4kPY&t=666s) [Editorial paraphrase] Investigating the

[11:08](https://www.youtube.com/watch?v=_7P580m4kPY&t=668s) Paperclip lookalike,

[11:08](https://www.youtube.com/watch?v=_7P580m4kPY&t=668s) the team found

[11:11](https://www.youtube.com/watch?v=_7P580m4kPY&t=671s) behavior absent

[11:11](https://www.youtube.com/watch?v=_7P580m4kPY&t=671s) from the

[11:13](https://www.youtube.com/watch?v=_7P580m4kPY&t=673s) legitimate project. Something

[11:13](https://www.youtube.com/watch?v=_7P580m4kPY&t=673s) presented as

[11:15](https://www.youtube.com/watch?v=_7P580m4kPY&t=675s) ordinary application logging

[11:15](https://www.youtube.com/watch?v=_7P580m4kPY&t=675s) led to

[11:18](https://www.youtube.com/watch?v=_7P580m4kPY&t=678s) a service

[11:18](https://www.youtube.com/watch?v=_7P580m4kPY&t=678s) controlled by the

[11:19](https://www.youtube.com/watch?v=_7P580m4kPY&t=679s) attacker. Its

[11:20](https://www.youtube.com/watch?v=_7P580m4kPY&t=680s) relationship to

[11:22](https://www.youtube.com/watch?v=_7P580m4kPY&t=682s) the surrounding application

[11:22](https://www.youtube.com/watch?v=_7P580m4kPY&t=682s) made the

[11:25](https://www.youtube.com/watch?v=_7P580m4kPY&t=685s) change easy to

[11:25](https://www.youtube.com/watch?v=_7P580m4kPY&t=685s) overlook. The

[11:30](https://www.youtube.com/watch?v=_7P580m4kPY&t=690s) name of

[11:30](https://www.youtube.com/watch?v=_7P580m4kPY&t=690s) the feature did

[11:33](https://www.youtube.com/watch?v=_7P580m4kPY&t=693s) not establish

[11:33](https://www.youtube.com/watch?v=_7P580m4kPY&t=693s) what it did.

[11:35](https://www.youtube.com/watch?v=_7P580m4kPY&t=695s) [Editorial paraphrase] The additional

[11:35](https://www.youtube.com/watch?v=_7P580m4kPY&t=695s) software obtained

[11:39](https://www.youtube.com/watch?v=_7P580m4kPY&t=699s) sensitive local

[11:39](https://www.youtube.com/watch?v=_7P580m4kPY&t=699s) authentication material and

[11:42](https://www.youtube.com/watch?v=_7P580m4kPY&t=702s) sent it

[11:42](https://www.youtube.com/watch?v=_7P580m4kPY&t=702s) to the

[11:44](https://www.youtube.com/watch?v=_7P580m4kPY&t=704s) attacker. The

[11:44](https://www.youtube.com/watch?v=_7P580m4kPY&t=704s) researchers observed that

[11:48](https://www.youtube.com/watch?v=_7P580m4kPY&t=708s) a component

[11:48](https://www.youtube.com/watch?v=_7P580m4kPY&t=708s) of the

[11:51](https://www.youtube.com/watch?v=_7P580m4kPY&t=711s) activity was

[11:51](https://www.youtube.com/watch?v=_7P580m4kPY&t=711s) short-lived. The important

[11:53](https://www.youtube.com/watch?v=_7P580m4kPY&t=713s) evidence was

[11:53](https://www.youtube.com/watch?v=_7P580m4kPY&t=713s) the connection

[11:55](https://www.youtube.com/watch?v=_7P580m4kPY&t=715s) between access to

[11:55](https://www.youtube.com/watch?v=_7P580m4kPY&t=715s) sensitive information

[11:56](https://www.youtube.com/watch?v=_7P580m4kPY&t=716s) and a

[11:56](https://www.youtube.com/watch?v=_7P580m4kPY&t=716s) destination controlled

[11:59](https://www.youtube.com/watch?v=_7P580m4kPY&t=719s) by someone other

[11:59](https://www.youtube.com/watch?v=_7P580m4kPY&t=719s) than the

[12:04](https://www.youtube.com/watch?v=_7P580m4kPY&t=724s) user. That

[12:04](https://www.youtube.com/watch?v=_7P580m4kPY&t=724s) gave the

[12:05](https://www.youtube.com/watch?v=_7P580m4kPY&t=725s) team a much

[12:05](https://www.youtube.com/watch?v=_7P580m4kPY&t=725s) stronger basis

[12:07](https://www.youtube.com/watch?v=_7P580m4kPY&t=727s) for identifying

[12:07](https://www.youtube.com/watch?v=_7P580m4kPY&t=727s) credential theft

[12:09](https://www.youtube.com/watch?v=_7P580m4kPY&t=729s) than a record

[12:09](https://www.youtube.com/watch?v=_7P580m4kPY&t=729s) of a

[12:14](https://www.youtube.com/watch?v=_7P580m4kPY&t=734s) sensitive file

[12:14](https://www.youtube.com/watch?v=_7P580m4kPY&t=734s) access in isolation.

[12:17](https://www.youtube.com/watch?v=_7P580m4kPY&t=737s) did the same thing in browser. Um but

[12:17](https://www.youtube.com/watch?v=_7P580m4kPY&t=737s) did the same thing in browser. Um but this this was a Python package but he

[12:19](https://www.youtube.com/watch?v=_7P580m4kPY&t=739s) this this was a Python package but he

[12:19](https://www.youtube.com/watch?v=_7P580m4kPY&t=739s) this this was a Python package but he used the same command and control and

[12:21](https://www.youtube.com/watch?v=_7P580m4kPY&t=741s) used the same command and control and

[12:21](https://www.youtube.com/watch?v=_7P580m4kPY&t=741s) used the same command and control and then he tried to publish it in Pi. That

[12:24](https://www.youtube.com/watch?v=_7P580m4kPY&t=744s) then he tried to publish it in Pi. That

[12:24](https://www.youtube.com/watch?v=_7P580m4kPY&t=744s) then he tried to publish it in Pi. That didn't work. It like under two hours it

[12:26](https://www.youtube.com/watch?v=_7P580m4kPY&t=746s) didn't work. It like under two hours it

[12:26](https://www.youtube.com/watch?v=_7P580m4kPY&t=746s) didn't work. It like under two hours it was just dumb. He did the same thing

[12:28](https://www.youtube.com/watch?v=_7P580m4kPY&t=748s) was just dumb. He did the same thing

[12:28](https://www.youtube.com/watch?v=_7P580m4kPY&t=748s) was just dumb. He did the same thing with paperclip AI, which is the Python

[12:30](https://www.youtube.com/watch?v=_7P580m4kPY&t=750s) with paperclip AI, which is the Python

[12:30](https://www.youtube.com/watch?v=_7P580m4kPY&t=750s) with paperclip AI, which is the Python version of what we just saw. And that

[12:32](https://www.youtube.com/watch?v=_7P580m4kPY&t=752s) version of what we just saw. And that

[12:32](https://www.youtube.com/watch?v=_7P580m4kPY&t=752s) version of what we just saw. And that also went down after less than an hour.

[12:35](https://www.youtube.com/watch?v=_7P580m4kPY&t=755s) also went down after less than an hour.

[12:35](https://www.youtube.com/watch?v=_7P580m4kPY&t=755s) also went down after less than an hour. Well, at this point, you'd think that

[12:36](https://www.youtube.com/watch?v=_7P580m4kPY&t=756s) Well, at this point, you'd think that

[12:36](https://www.youtube.com/watch?v=_7P580m4kPY&t=756s) Well, at this point, you'd think that we'd be winning, but no, because the

[12:40](https://www.youtube.com/watch?v=_7P580m4kPY&t=760s) we'd be winning, but no, because the

[12:40](https://www.youtube.com/watch?v=_7P580m4kPY&t=760s) we'd be winning, but no, because the skins that were using the same command

[12:42](https://www.youtube.com/watch?v=_7P580m4kPY&t=762s) skins that were using the same command

[12:42](https://www.youtube.com/watch?v=_7P580m4kPY&t=762s) skins that were using the same command and control were actually trading

[12:43](https://www.youtube.com/watch?v=_7P580m4kPY&t=763s) and control were actually trading

[12:44](https://www.youtube.com/watch?v=_7P580m4kPY&t=764s) and control were actually trading trending at that time to the point where

[12:46](https://www.youtube.com/watch?v=_7P580m4kPY&t=766s) trending at that time to the point where

[12:46](https://www.youtube.com/watch?v=_7P580m4kPY&t=766s) trending at that time to the point where they had 1.7 million total downloads.

[12:50](https://www.youtube.com/watch?v=_7P580m4kPY&t=770s) [Editorial paraphrase] Those skills

[12:50](https://www.youtube.com/watch?v=_7P580m4kPY&t=770s) had around 1.7

[12:53](https://www.youtube.com/watch?v=_7P580m4kPY&t=773s) million total downloads.

[12:54](https://www.youtube.com/watch?v=_7P580m4kPY&t=774s) That measures distribution.

[12:56](https://www.youtube.com/watch?v=_7P580m4kPY&t=776s) It does not

[12:56](https://www.youtube.com/watch?v=_7P580m4kPY&t=776s) establish how many

[12:59](https://www.youtube.com/watch?v=_7P580m4kPY&t=779s) devices executed the

[12:59](https://www.youtube.com/watch?v=_7P580m4kPY&t=779s) malicious behavior

[13:01](https://www.youtube.com/watch?v=_7P580m4kPY&t=781s) or how many

[13:01](https://www.youtube.com/watch?v=_7P580m4kPY&t=781s) credentials were stolen.

[13:03](https://www.youtube.com/watch?v=_7P580m4kPY&t=783s) When the researchers

[13:04](https://www.youtube.com/watch?v=_7P580m4kPY&t=784s) examined the skills,

[13:06](https://www.youtube.com/watch?v=_7P580m4kPY&t=786s) they connected them

[13:06](https://www.youtube.com/watch?v=_7P580m4kPY&t=786s) to the same

[13:08](https://www.youtube.com/watch?v=_7P580m4kPY&t=788s) infrastructure and recognized

[13:08](https://www.youtube.com/watch?v=_7P580m4kPY&t=788s) the same

[13:10](https://www.youtube.com/watch?v=_7P580m4kPY&t=790s) credential-harvesting behavior as

[13:10](https://www.youtube.com/watch?v=_7P580m4kPY&t=790s) in the earlier

[13:13](https://www.youtube.com/watch?v=_7P580m4kPY&t=793s) investigation. Taking down

[13:13](https://www.youtube.com/watch?v=_7P580m4kPY&t=793s) a package in

[13:15](https://www.youtube.com/watch?v=_7P580m4kPY&t=795s) one ecosystem had

[13:15](https://www.youtube.com/watch?v=_7P580m4kPY&t=795s) left another distribution

[13:18](https://www.youtube.com/watch?v=_7P580m4kPY&t=798s) route in place.

[13:18](https://www.youtube.com/watch?v=_7P580m4kPY&t=798s) same chain. We reported the incident to Versell and Microsoft and under lasted

[13:20](https://www.youtube.com/watch?v=_7P580m4kPY&t=800s) Versell and Microsoft and under lasted

[13:20](https://www.youtube.com/watch?v=_7P580m4kPY&t=800s) Versell and Microsoft and under lasted 12 hours they took everything down. If

[13:23](https://www.youtube.com/watch?v=_7P580m4kPY&t=803s) 12 hours they took everything down. If

[13:23](https://www.youtube.com/watch?v=_7P580m4kPY&t=803s) 12 hours they took everything down. If you want to read more about it, you

[13:24](https://www.youtube.com/watch?v=_7P580m4kPY&t=804s) you want to read more about it, you

[13:24](https://www.youtube.com/watch?v=_7P580m4kPY&t=804s) you want to read more about it, you should read the Zenity Labs blog. It's

[13:27](https://www.youtube.com/watch?v=_7P580m4kPY&t=807s) should read the Zenity Labs blog. It's

[13:27](https://www.youtube.com/watch?v=_7P580m4kPY&t=807s) should read the Zenity Labs blog. It's very interesting, incredible work.

[13:30](https://www.youtube.com/watch?v=_7P580m4kPY&t=810s) very interesting, incredible work.

[13:30](https://www.youtube.com/watch?v=_7P580m4kPY&t=810s) very interesting, incredible work. [snorts]

[13:32](https://www.youtube.com/watch?v=_7P580m4kPY&t=812s) [snorts]

[13:32](https://www.youtube.com/watch?v=_7P580m4kPY&t=812s) [snorts] Um,

[13:33](https://www.youtube.com/watch?v=_7P580m4kPY&t=813s) Um,

[13:33](https://www.youtube.com/watch?v=_7P580m4kPY&t=813s) Um, skill is just one single part of uh of

[13:37](https://www.youtube.com/watch?v=_7P580m4kPY&t=817s) skill is just one single part of uh of

[13:37](https://www.youtube.com/watch?v=_7P580m4kPY&t=817s) skill is just one single part of uh of the agent supply chain. Everything that

[13:39](https://www.youtube.com/watch?v=_7P580m4kPY&t=819s) the agent supply chain. Everything that

[13:39](https://www.youtube.com/watch?v=_7P580m4kPY&t=819s) the agent supply chain. Everything that goes inside the agent context is is part

[13:41](https://www.youtube.com/watch?v=_7P580m4kPY&t=821s) goes inside the agent context is is part

[13:41](https://www.youtube.com/watch?v=_7P580m4kPY&t=821s) goes inside the agent context is is part of it. It can be a website, it can be

[13:44](https://www.youtube.com/watch?v=_7P580m4kPY&t=824s) of it. It can be a website, it can be

[13:44](https://www.youtube.com/watch?v=_7P580m4kPY&t=824s) of it. It can be a website, it can be rows in your database, it can be

[13:46](https://www.youtube.com/watch?v=_7P580m4kPY&t=826s) rows in your database, it can be

[13:46](https://www.youtube.com/watch?v=_7P580m4kPY&t=826s) rows in your database, it can be packages, it can even be a YouTube

[13:47](https://www.youtube.com/watch?v=_7P580m4kPY&t=827s) packages, it can even be a YouTube

[13:47](https://www.youtube.com/watch?v=_7P580m4kPY&t=827s) packages, it can even be a YouTube comment. Everything that comes into the

[13:49](https://www.youtube.com/watch?v=_7P580m4kPY&t=829s) comment. Everything that comes into the

[13:49](https://www.youtube.com/watch?v=_7P580m4kPY&t=829s) comment. Everything that comes into the context is under risk.

[13:52](https://www.youtube.com/watch?v=_7P580m4kPY&t=832s) context is under risk.

[13:52](https://www.youtube.com/watch?v=_7P580m4kPY&t=832s) context is under risk. And if we talk about skills in

[13:54](https://www.youtube.com/watch?v=_7P580m4kPY&t=834s) And if we talk about skills in

[13:54](https://www.youtube.com/watch?v=_7P580m4kPY&t=834s) And if we talk about skills in particular,

[13:55](https://www.youtube.com/watch?v=_7P580m4kPY&t=835s) particular,

[13:55](https://www.youtube.com/watch?v=_7P580m4kPY&t=835s) particular, you need to treat them as uh as package

[13:57](https://www.youtube.com/watch?v=_7P580m4kPY&t=837s) you need to treat them as uh as package

[13:57](https://www.youtube.com/watch?v=_7P580m4kPY&t=837s) you need to treat them as uh as package dependencies. Um you need to inspect

[13:59](https://www.youtube.com/watch?v=_7P580m4kPY&t=839s) dependencies. Um you need to inspect

[14:00](https://www.youtube.com/watch?v=_7P580m4kPY&t=840s) dependencies. Um you need to inspect everything that it loads, limit what it

[14:02](https://www.youtube.com/watch?v=_7P580m4kPY&t=842s) everything that it loads, limit what it

[14:02](https://www.youtube.com/watch?v=_7P580m4kPY&t=842s) everything that it loads, limit what it can access, lease privileges as you're

[14:04](https://www.youtube.com/watch?v=_7P580m4kPY&t=844s) can access, lease privileges as you're

[14:04](https://www.youtube.com/watch?v=_7P580m4kPY&t=844s) can access, lease privileges as you're well aware, and observe what is actually

[14:07](https://www.youtube.com/watch?v=_7P580m4kPY&t=847s) well aware, and observe what is actually

[14:07](https://www.youtube.com/watch?v=_7P580m4kPY&t=847s) well aware, and observe what is actually being run.

[14:09](https://www.youtube.com/watch?v=_7P580m4kPY&t=849s) being run.

[14:09](https://www.youtube.com/watch?v=_7P580m4kPY&t=849s) being run. Now, this entire work on the detonation

[14:11](https://www.youtube.com/watch?v=_7P580m4kPY&t=851s) Now, this entire work on the detonation

[14:11](https://www.youtube.com/watch?v=_7P580m4kPY&t=851s) Now, this entire work on the detonation shaver was done by the entire research

[14:15](https://www.youtube.com/watch?v=_7P580m4kPY&t=855s) shaver was done by the entire research

[14:15](https://www.youtube.com/watch?v=_7P580m4kPY&t=855s) shaver was done by the entire research and engineering thing that you see over

[14:17](https://www.youtube.com/watch?v=_7P580m4kPY&t=857s) and engineering thing that you see over

[14:17](https://www.youtube.com/watch?v=_7P580m4kPY&t=857s) and engineering thing that you see over here. Highly talented people, and I

[14:20](https://www.youtube.com/watch?v=_7P580m4kPY&t=860s) here. Highly talented people, and I

[14:20](https://www.youtube.com/watch?v=_7P580m4kPY&t=860s) here. Highly talented people, and I encourage you to follow them.

[14:22](https://www.youtube.com/watch?v=_7P580m4kPY&t=862s) encourage you to follow them.

[14:22](https://www.youtube.com/watch?v=_7P580m4kPY&t=862s) encourage you to follow them. And with that, if you want to test out

[14:24](https://www.youtube.com/watch?v=_7P580m4kPY&t=864s) And with that, if you want to test out

[14:24](https://www.youtube.com/watch?v=_7P580m4kPY&t=864s) And with that, if you want to test out your skills, it's available in neoto.io.

[14:26](https://www.youtube.com/watch?v=_7P580m4kPY&t=866s) your skills, it's available in neoto.io.

[14:26](https://www.youtube.com/watch?v=_7P580m4kPY&t=866s) your skills, it's available in neoto.io. This is detonation chamber.