On March 24, 2026, attackers used stolen credentials to publish two malicious versions of LiteLLM to PyPI. The code on GitHub never changed. Any pipeline that pulled the update ran the attacker’s code with its own credentials.
An AI agent is a model, a set of skills, a set of Model Context Protocol (MCP) servers, and a tree of Python packages. Everything an agent loads is attack surface, and security teams approve it once, if at all.
The model is the part you can compare
Models differ in how easily they can be pushed into harmful behavior, and you can measure it. Enkrypt AI by Anaconda publishes the LLM Safety Leaderboard, which ranks 300 models on four risk scores: jailbreak susceptibility, bias, malware, and toxicity. A jailbreak score of 18% means 18% of the attacks got through.
Each model scores differently, so swapping models is a security change, and last quarter’s approval doesn’t carry over. Retest after every model change. Enkrypt AI’s agent red teaming tests what ships: the agent, its tools, its retrieval-augmented generation (RAG) sources, and its MCP servers. It leaves behind a regression suite you can run in continuous integration (CI) before each release, so you can retest after an upgrade without starting from scratch.
Skills: installed in minutes, with no review step
Skills work a lot like browser extensions. They’re bundles of instructions and scripts an agent loads to learn a task, and they run with the agent’s permissions. Depending on the agent, a skill can be added with no install prompt, no review, and no record of what was approved.
The Enkrypt AI Skill Scan Hub scans public skills. As of September 30, 2026, it had scanned 99,643 skills from GitHub. Of those, 4.25% (4,231 skills) received an unsafe verdict, and 10.5% (10,467 skills) had at least one finding. An unsafe verdict is a scanner’s judgment, not proof of an attacker.
Unauthorized tool use means a skill calls tools beyond the ones it declares it needs. Unauthorized tool use made up 59.1% of categorized findings, followed by skill discovery abuse (16.4%), malware (11.7%), and transitive trust abuse (4.6%). Data exfiltration (2.1%) and prompt injection (1.8%) were rare. Scan depth matters too. Enkrypt AI researchers demonstrated an attack that hides instructions deep inside a SKILL.md, past the point where some scanners stop reading, and uses them to exfiltrate an SSH key.
Teams need a review step that keeps pace with how fast developers add skills. Our skill scanner takes a Git repository and a skill path and returns a verdict, a risk level, a findings count, and the full report, usually in 30 to 90 seconds. Under the hood is Skill Sentinel, which is open source and runs as a CI step. It reads complete files, runs multi-agent analysis, correlates threats across files, and checks bundled binaries against VirusTotal. A scanner catches what it recognizes, so we pair it with guardrails for coding agents that block credential access and restrict commands at runtime, even when a skill looks clean.
MCP: the fine print only your agent reads
MCP is an open standard for connecting agents to tools and data through MCP servers. Your agent reads the description and instructions for every tool it connects to. You usually don’t.
In September 2025, an attacker published a fake postmark-mcp package on npm that imitated Postmark’s legitimate email server. After 15 clean versions, version 1.0.16 added one line that blind-copied every email to the attacker. In two months, Enkrypt AI scanned more than 268,000 tools across 25,000 MCP servers and found more than 143,000 vulnerabilities, affecting 73% of those servers.
The fix has two halves. Before you connect, our MCP scanner inventories servers and tools, flags over-privilege, and returns a remediation plan. You can scan a GitHub repo, npm package, or endpoint for free, and the report arrives by email in about 10 minutes. During operation, the open-source MCP gateway sits between agents and MCP servers to approve, modify, or block tool calls, enforce least privilege, and keep an audit trail. Your team uses scan results to build the approved list, and the gateway enforces it.
Python packages: an old attack with a new target
Python-based agent frameworks, model software development kits (SDKs), and MCP servers sit on a tree of open-source dependencies. It’s also the layer Anaconda has secured for more than a decade.
When attackers used stolen PyPI publishing credentials to publish two malicious versions of LiteLLM (1.82.7 and 1.82.8), a popular library for routing calls to large language models (LLMs), the code on GitHub was never modified, so reading the repo would have shown nothing wrong. PyPI quarantined the packages about 40 minutes after upload, and an automated pipeline can pull in a new release well before that.
In a USENIX Security 2025 study, code-generating models hallucinated package names at average rates of at least 5.2% for commercial models and 21.7% for open-source models, and many of the invented names repeated. Attackers can register them ahead of time. A coding agent that installs whatever the model suggests can pull in one of those attacker-registered packages with no human review.
Our guardrails for coding agents can block package installs by default and permit only approved commands, so the agent can’t install a hallucinated dependency. Anaconda’s AI Artifacts gives teams a curated source for packages, with vulnerability scanning, custom security policies, and package signatures, in the cloud or on-premises, including air-gapped networks. It also generates a software bill of materials (SBOM) for each artifact and can hold brand-new upstream versions for review before anyone installs them. A short hold would have kept the LiteLLM versions out.
The approval was a snapshot
Across all four layers, the pattern is the same. A component earns trust once, at install, approval, or download, and isn’t checked again. Security teams end up stuck on three questions.
What’s in the stack? Start with an inventory. The MCP scanner inventories MCP servers and tools, and our AI asset scanner covers AI endpoints, model files, and prompts. For packages, an SBOM lets you answer “are we affected?” with a lookup.
What changed since we approved it? Rescan on every update, hold new releases, and enforce policy at the tool boundary, where agent guardrails and the MCP gateway check each action before it runs.
Can we prove it? Our agent policy engine turns governance policy and regulation text into enforceable controls. Defaults cover the EU AI Act and frameworks from the National Institute of Standards and Technology (NIST) and the Open Worldwide Application Security Project (OWASP). Guardrails log every enforcement decision with a policy ID and reason code.
When each layer gets its own tool and its own approval process, gaps open between them. Anaconda has a control for each of the four layers: curated packages, skill and MCP scanning, model red teaming, and runtime guardrails.
OWASP’s Top 10 for Agentic Applications, published December 9, 2025, with input from more than 100 experts, gives security teams common names for these risks, including tool misuse and agentic supply chain vulnerabilities. If your security team hasn’t read it yet, read it alongside the checklist below.
Where to start this week
- List every agent and everything it loads. That means the model, skills, MCP servers, packages, and credentials. If you can’t produce that list, you can’t secure the agents.
- Scan every skill before it runs. Install Skill Sentinel with
pip install skill-sentinel, point it at a model (OpenAI by default, or a self-hosted model if skill contents can’t leave your network), and add it as a CI step. - Pin versions and verify hashes. Re-approve anything that changes.
- Wait a day or two on brand-new releases. The malicious LiteLLM versions were pulled about 40 minutes after upload.
- Give each agent the least access it needs. An agent that reads untrusted content should never sit next to your crown-jewel credentials.
- Attack your own agents before someone else does. Plant malicious content wherever the agent reads, then turn what you find into runtime guardrails.
Pick the agent you trust least
Start with one. The goal is a current list of what each agent loads and a check that runs every time that list changes. Scan an MCP server for free or book a demo. To see how these controls fit together, explore AI security and guardrails.
FAQ
What is agentic AI security?
Agentic AI security is the practice of protecting everything an AI agent loads and does, including its model, skills, MCP servers, Python packages, and the credentials they share. It covers scanning before an agent runs and enforcing policy while it runs.
How common are unsafe agent skills?
As of September 30, 2026, the Enkrypt AI Skill Scan Hub had scanned 99,643 skills from GitHub and gave 4.25% of them an unsafe verdict. Unauthorized tool use was the most common finding, at 59.1% of all categorized findings.
What is a package hallucination?
A package hallucination happens when a code-generating model recommends a package that doesn’t exist. A USENIX Security 2025 study measured average rates of at least 5.2% for commercial models and 21.7% for open-source models. Attackers can publish malicious packages under those invented names.
How do you secure MCP servers?
Scan each server before you connect it, keep an approved list, rescan any server that changes after approval, and enforce policy on tool calls at runtime through a gateway. See how a scan-and-enforce program works.