Morning Edition · Friday, October 9, 2026Published at 2:20 AM EDT · New York

Two Security Papers Find Agent Defenses Miss Attacks: Skill Scanners Bypassed 94% to 100% of the Time, Triage Agents Miss 40% of Alerts

One attack hides malicious Python bytecode behind benign source code, and the other study finds that agents dismiss attack alerts when their own searches return no records.

The first paper, PyCache Trap, targets the scanners that marketplaces and enterprises use to vet third-party agent skills. Those scanners read a skill's documentation and visible source. Python, however, can execute a bundled bytecode cache…