Can AI leak your personal information?

The Three Ways AI Actually Leaks Your Data

Yes, AI can leak your personal information — and it happens through three distinct channels, none of which involve the AI model itself misbehaving. The leaks come from the ecosystem around AI: malicious agent skills, preventable infrastructure failures in AI apps, and employees using unapproved tools.

Channel one: malicious agent skills. Security researchers scanned 3,984 agent skills and found 13.4% contained at least one critical security issue, with 76 confirmed malicious payloads built for credential theft and data exfiltration, according to Snyk's ToxicSkills research. These skills inherit everything your agent can access — shell commands, files, credentials, even the ability to send messages. Worse, a fake skill passed scanners from Cisco, Nvidia, and skills.sh and reached 26,000+ users before its payload collected email addresses, as reported by CSO Online.

Channel two: broken AI app infrastructure. Between January 2025 and February 2026, at least 20 documented AI app incidents exposed personal data of tens of millions of users — nearly all from preventable configuration errors like misconfigured databases and hardcoded API keys. McDonald's AI hiring tool exposed 64 million job applicants' records through default credentials, and an AI toy leaked over 50,000 children's chat transcripts along with their names and birthdates. One developer admitted his app was compromised within three days of launch by a fix that would have taken "just two SQL statements."

Channel three: shadow AI. Security incidents involving unapproved employee AI use more than doubled to 43% of breaches, averaging $5.39 million per incident — and in 21% of those cases, organizations paid regulatory fines. Only 37% of companies have formal processes to assess AI tool security before deployment.

For business owners and builders alike, the pattern is clear: the risk isn't exotic AI attacks, it's ordinary supply chain and configuration failures moving at AI speed. That's why SkillzBench is building safeguards around agent skills — pinning every skill version to a commit SHA, security-scanning and sandbox-testing each one, and letting you give each agent only the skills you explicitly choose through its free MCP connector. If you're connecting skills to agents, browse and verify them free on SkillzBench. Skills, proven.

Why One-Time Security Scans Fail (and Trust Signals Can Be Faked)

A skill that passed every scanner it faced still went on to harvest users' email addresses. That's not a hypothetical — it's exactly what happened when security researchers decided to test whether one-time scanning actually works.

In a controlled experiment by AIR, a fake skill called "brand-landingpage" sailed through scanners from Cisco, Nvidia, and skills.sh, then reached more than 26,000 users through Instagram promotion. The trick was simple: the skill's payload lived behind a URL the researchers changed after distribution, so the version scanned was harmless and the version users eventually ran was not, as documented by CSO Online. The scan was accurate; the snapshot was stale.

Trust signals proved equally easy to fake. AIR gained credibility by getting a pull request merged into a popular open-source agents repository with roughly 36,000 GitHub stars. A big name in the byline made the malicious skill look legitimate — and it was, right up until the URL changed.

Traditional scanning also misses the signature attack of this ecosystem. Snyk's research on nearly 4,000 skills found that 91% of confirmed malicious skills use prompt injection alongside malicious code — a combination the researchers describe as a threat model traditional code scanners simply cannot address. Attackers can keep the logic on their own infrastructure and change behavior at any time by updating fetched content.

This is why experts have stopped treating skills as static text files. Cybersecurity researcher Devashri Datta argues skills are "executable instruction bundles" that must be governed like third-party packages, and Confidis founder Keith Prabhu calls them "living third-party dependencies" requiring continuous validation. The expert-endorsed safeguards are consistent:

• Pin every version to an immutable reference such as a commit SHA or cryptographic hash
• Re-scan continuously as upstream content changes, not once at install time
• Test skills in a sandbox before and after deployment
• Apply least privilege, so a skill sees only what its agent actually needs

Those principles are exactly what SkillzBench is being built around: pinning each skill version to a commit SHA, re-scanning and re-benchmarking as upstream changes occur, and letting users toggle skills and tools per agent so the agent only sees what was chosen. The lesson from the AIR experiment is blunt: a clean scan is a statement about the past, not a promise about tomorrow.

The Expert-Endorsed Safeguards That Actually Work

A malicious skill that passed scanners from Cisco, Nvidia, and skills.sh still reached more than 26,000 users before its payload fired — proof that a single clean scan means very little. The safeguards experts now demand are less about better scanning and more about governing skills the way you govern any third-party dependency.

That shift starts with version pinning. Experts recommend pinning every skill to an immutable reference such as a commit SHA rather than tracking a moving branch, because attackers can host attack logic off-platform and change behavior at any time by editing fetched content. Sandbox testing before deployment and continuous re-validation of upstream changes follow the same logic: a one-time security scan is no longer sufficient.

Least privilege is the second half of the defense. Agent skills inherit full agent permissions — shell access, file system read/write, credentials in environment variables, and outbound messaging — and MCP servers by default hand agents every tool they offer, with no consent prompts or audit logs. Per-agent tool selection, where an agent only sees what you explicitly enable, closes that gap. A practical checklist looks like this:

• Pin every skill to a commit SHA, never a branch or tag.
• Test in a sandbox before it touches a real agent or real data.
• Re-scan continuously, since upstream content can change after install.
• Grant each agent only the tools and skills it actually needs.
• Treat skills as governed supply chain dependencies, not prompts.

This is becoming a formal discipline rather than a niche concern. OWASP's Agentic Skills Top 10 is described as the first comprehensive security framework for AI agent skills, documenting the most critical risks with evidence-based mitigations. The stakes are already measurable: Snyk's scan of 3,984 skills found 13.4% carrying at least one critical security issue, and hardcoded secrets appear in 10.9% of ClawHub skills.

SkillzBench is building these safeguards into its pillars. Verify pins every version to a commit SHA and runs security scans; Benchmark tests each skill in a sandbox with and without it to publish a Lift score; Equip provides per-agent loadouts so agents only see chosen skills and tools; and Stay current tracks upstream changes, re-scans, and notifies. Everything on the platform is free, and money never touches scores.

Agent skills can automate the rest of this workflow — browse, verify, and benchmark them free on SkillzBench. Skills, proven.

Your Action Plan: Vet Every Skill Before You Connect It

The difference between a safe AI rollout and a costly breach often comes down to one habit: vetting what you connect before you connect it. With only 37% of companies reporting formal processes to assess AI tool security before deployment, most organizations leave this gate wide open.

If you lead a team adopting AI, treat every new tool, skill, or MCP server like a vendor onboarding. Shadow AI now accounts for 43% of security incidents at an average cost of $5.39 million, with regulatory fines in 21% of cases. A written policy closes the gap.

• Require pre-approval for any AI tool or agent skill that touches customer data, credentials, or internal systems.
• Demand a security review before deployment — scan for hardcoded secrets and dynamic content fetching, the two most common leak vectors in published skills.
• Pin every version to a specific commit so upstream changes can't silently alter behavior after install.
• Limit tool exposure per agent — grant each agent only the skills and tools it actually needs, nothing more.
• Re-scan on a schedule, because point-in-time checks demonstrably fail: one malicious skill passed scanners from Cisco, Nvidia, and skills.sh and reached 26,000+ users before its payload triggered.

If you build or install agent skills, run a pre-install vetting routine every time. Snyk's scan of nearly 4,000 skills found that 13.4% contain at least one critical security issue and 10.9% ship hardcoded secrets. Read the SKILL.md line by line, check for runtime content fetching, and never give a new skill more permissions than the task requires.

Going further, SkillzBench is building a free, independent directory of agent skills designed to make this vetting routine automatic: a 0–100 trust score drawn from security, quality, license, maintenance, and community signals; sandbox benchmarks that show each skill's actual Lift in percentage points; and per-agent loadouts that let you toggle exactly which skills and tools each agent sees. Every version is pinned to a commit SHA and continuously re-scanned as upstream code changes. The waitlist is live now at skillzbench.com.

Skills, proven.