Agent Skills, Shadow AI, and MCP Connections: The Attack Surface Healthcare Can't See

AI Security Series #61

Yesterday's Industry Watch post covered ThreatDown's Cybercrime in the Age of AI report at a summary level. Today's post goes deeper on the section of that report with the most direct implications for healthcare security programs: the emergence of malicious agent skills as an attack surface category, the shadow AI problem inside clinical and administrative environments, and a line buried in the report's conclusion that healthcare security teams should not miss — the explicit callout of "unsanctioned AI tools, agent skills, and MCP connections" as the shadow AI attack surface IT teams currently can't see.

The agent skills story is not a theoretical future threat. ThreatDown's researchers documented it unfolding in real time between January and April 2026, with a level of operational detail that makes it directly applicable to healthcare organizations that are deploying or evaluating AI agents right now.

What Agent Skills Are and Why They Matter

Skills are plugins that extend an AI agent's capabilities the way apps extend a smartphone. Install a skill, and your agent can act like an expert web designer, open documents, book meetings, or analyze a specific type of data in a predictable, repeatable way. They can be discovered and installed from public marketplaces in seconds, exercise considerable influence over agents that are highly privileged, and often operate with few or no mandatory security controls.

The operational parallel in healthcare is already visible. AI agents deployed in clinical documentation, prior authorization, revenue cycle, and administrative workflows are increasingly extensible — vendors are building plugin and integration marketplaces that function structurally like ClawHub. The attack surface that emerged around OpenClaw in early 2026 is not an anomaly. It's a preview of what any sufficiently popular AI agent platform with a public skill or plugin marketplace will face.

The OpenClaw Attack Chain: What Actually Happened

In January 2026, a locally-run personal AI agent called OpenClaw went viral, triggering a Mac mini shortage as users rushed to buy hardware to run it. For millions of people it was their first experience with an AI agent they could run themselves, locally, continuously, with broad access to files, credentials, and connected systems. OpenClaw's official marketplace, ClawHub, had malicious skills within days of launch.

Generation one: direct skill manipulation

The first malicious skills were discovered on ClawHub within days of launch. Security researcher @chiefofautism found over 1,000 within a month, including the site's most downloaded skill. ThreatDown's researchers documented skills that stole credentials and exfiltrated data, installed malware, and poisoned an agent's core memory files to ensure persistence. The critical operational detail: malicious behavior was typically embedded inside otherwise functional skills, so agents operated as expected while harmful operations ran in the background. Users saw normal agent behavior. The exfiltration was invisible.

Generation two: the lure evolution

In April 2026, as security scanners began searching for harmful payloads in agent skills, criminals adapted. The next generation of malicious skill contained no malicious code at all. Instead, it contained a README file — a locally saved Telegraph blog post titled How Building a Weather Polymarket Bot with OpenClaw Skill and turn 100$ → 8000$. It was a fabrication, constructed to look like the get-rich-quick-with-AI content flooding the internet in early 2026.

The README instructed users to download a binary called Polymarket.exe to complete the setup. Users who downloaded it received either a Node.js single executable application or an Electron application. Either way, the download delivered the latest iteration of GachiLoader, which used fileless injection to install Rhadamanthys — a sophisticated infostealer that harvests credentials for identity-based attacks.

GachiLoader's command-and-control infrastructure was hosted on a Polygon blockchain smart contract, making it immutable and impossible to take down through conventional means. The GitHub account hosting the payload, blueberywoodsym, was purpose-built for OpenClaw targets, with its three releases named to match the stages a legitimate skill installation would present.

Detection rate across major endpoint security products at the time of discovery: near zero.

The two attack classes and what they share

ThreatDown identifies two distinct malicious skill classes that have now emerged. In the first, the skill itself is malicious — it manipulates the agent directly, operating harmful behavior in the background of legitimate functionality. In the second, the skill is a lure — it manipulates the agent's human operator rather than the agent itself, using detection-resistant social engineering.

What both attack classes share is the same vulnerability: the enthusiasm people have for AI tools. Criminals aren't just using AI. They're exploiting the trust and excitement that AI has generated, turning the rush to adopt these tools into an attack surface.

The Shadow AI Problem at Scale

By the end of March 2026, approximately half a million OpenClaw instances were exposed on the public internet. Most had been installed by employees without their IT team's knowledge. Between February and April 2026, a public vulnerability tracker logged over 100 separate security advisories for OpenClaw alone.

One in five organizations suffered a breach linked to shadow AI in 2025, costing an average of $670,000 more than a standard incident. Nearly half of employees who use generative AI at work do so through personal, unmanaged accounts.

The financial figure is significant, but the structural problem is more significant. AI tools have become high-value targets in their own right — they give access not just to conversations and shared data, but to connected systems, stored files, and integrated services. The OAuth credentials, API keys, and session tokens used to access AI tools have joined the ever-expanding list of secrets that need defending. Every AI tool account an employee creates without IT's knowledge is a potential identity attack waiting to happen.

The ThreatDown report's conclusion is specific about the scope: "Unsanctioned AI tools, agent skills, and MCP connections are a growing compliance, privacy, and security risk your IT team can't see."

That sentence deserves to be read twice. MCP connections — the Model Context Protocol integrations that extend AI agents' tool access — are now explicitly named alongside agent skills as a shadow AI attack surface. This is not a future concern. MCP server installations are already proliferating in enterprise environments, often deployed by individual developers or power users outside of formal IT procurement processes.

What This Means for Healthcare

Healthcare environments combine the worst of every factor the ThreatDown report identifies: high-value data, legacy infrastructure, constrained IT visibility, and a workforce that has genuine productivity needs that AI tools are beginning to address. The agent skills attack surface maps directly onto conditions that already exist in clinical and administrative environments.

AI agent plugins and skill marketplaces are already here

Healthcare AI vendors — clinical documentation tools, revenue cycle automation platforms, prior authorization assistants — are increasingly building plugin and integration capabilities that function structurally like ClawHub. If your organization is evaluating or has deployed an AI agent platform that supports third-party plugins, extensions, or skill-like integrations, the OpenClaw attack chain is directly relevant to your threat model.

The security questions to ask of any AI agent platform with marketplace or plugin capability: Who reviews skills or plugins before they appear in the marketplace? What vetting process exists? What permissions can a skill exercise over the agent? Can skills access credentials, session tokens, or connected system integrations? How are skill actions logged relative to the agent's core activity?

These questions don't currently appear on most healthcare AI vendor security assessment checklists. They need to.

The fileless injection detection gap is a healthcare EDR problem

The GachiLoader attack chain — a skill lure that delivers fileless injection with near-zero detection at the time of discovery — is an EDR and endpoint protection problem that healthcare environments are particularly exposed to. Healthcare organizations frequently run a mix of endpoint protection generations, with legacy systems running older signature-based detection alongside more modern deployments. The ThreatDown finding is explicit: static signature scanning will not catch AI-generated, in-memory malware.

If your healthcare organization hasn't done a recent review of behavioral detection coverage across your endpoint estate — specifically whether your EDR is configured for behavioral analysis rather than relying primarily on signature matching — the GachiLoader finding is the argument for doing that review now.

MCP connections need to be in your shadow AI discovery scope

Healthcare security teams doing shadow AI discovery work typically look for unauthorized SaaS applications, unapproved AI tool accounts, and ungoverned data sharing. MCP server installations should now be explicitly on that list.

MCP servers are lightweight and developer-friendly. They can be installed locally by a single user, connect an AI agent to internal systems, and be entirely invisible to network monitoring if they run over localhost or authorized outbound HTTPS. A clinical informaticist, a data analyst, or a developer connecting an AI coding agent to internal healthcare systems via an ungoverned MCP server is exactly the kind of MCP connection the ThreatDown report is flagging — and it's one that most healthcare IT teams don't have tooling to detect today.

The MCP Security series on this blog has covered the authorization and governance requirements for sanctioned MCP deployments. The shadow AI angle is the other side of that: the MCP connections that exist outside sanctioned deployments entirely.

Credential hygiene now includes AI tool accounts

The IBM data cited in the ThreatDown report — $670,000 in additional breach costs for shadow AI incidents — reflects in part the credential exposure that AI tool accounts create. Healthcare employees using personal AI accounts to interact with clinical data, administrative workflows, or internal systems are creating credential exposure that extends well beyond the data they share in those sessions.

Healthcare security programs should explicitly include AI tool accounts in their credential hygiene and identity governance programs. This means discovery (what AI tools are employees using on personal accounts), offboarding (are AI tool credentials revoked when employees depart), and access review (do personal AI tool accounts have OAuth connections to clinical or administrative systems). These aren't novel identity governance problems — they're existing problems applied to a new account category that most programs haven't extended their processes to cover yet.

The patching paradox hits healthcare hardest

The Mythos patching paradox identified in the report — that Mythos-class vulnerability discovery will generate patch volumes organizations can't absorb, creating a larger exploit window rather than a smaller one — is a particular concern for healthcare. Healthcare organizations are already among the most constrained on patching velocity, for well-documented reasons: legacy medical device software, clinical system availability requirements, vendor-managed update cycles, and limited change windows.

The organizations that will be most exposed when Mythos-class vulnerability discovery reaches criminal markets aren't the ones with the best security teams. They're the ones with the largest patching backlogs — and healthcare is disproportionately represented in that category. Automated vulnerability assessment and patch management isn't optional infrastructure anymore. For healthcare organizations still relying on manual patching processes or quarterly vulnerability review cycles, the six-month window the ThreatDown report identifies is the argument for accelerating that automation investment now.

The Bigger Picture

The agent skills attack chain that ThreatDown documented in early 2026 is a template, not a one-time event. It will recur on every AI agent platform with a public plugin or skill marketplace that achieves sufficient adoption. The criminal ecosystem adapts quickly — the pivot from direct malicious skills to detection-resistant lures happened within months of the first generation being caught. Healthcare security programs that wait for a healthcare-specific incident to take this seriously will be responding rather than preparing.

The explicit MCP connection callout in the ThreatDown conclusion is worth treating as a signal about where the industry's collective security attention is going. MCP governance has moved from a niche concern for AI practitioners to something that appears in mainstream threat intelligence reporting alongside agent skills and shadow AI. That's a maturity marker — and it means healthcare security programs that haven't started their MCP governance work are now measurably behind where the field expects them to be.

The ThreatDown report frames the next six months as a window. For healthcare, the window is real but the constraints are different from most industries. The combination of high-value targets, legacy infrastructure, and constrained change velocity means healthcare organizations have less room to absorb a miss than most. The agent skills attack surface, the shadow AI credential exposure, and the patching paradox are all active now — not in six months. The six-month window is when the Mythos-class capability amplification arrives. The foundational vulnerabilities it will exploit are already present.

This is entry #61 in the AI Security series. For related coverage, see Six Months to Prepare: What ThreatDown's Cybercrime in the Age of AI Report Means for Security Teams and MCP Goes Stateless on July 28: What the New Spec Means for Healthcare Security Programs.