The code you reviewed is not always what the agent runs

An agent package can pass a review of readable source while the installer, loader or importer executes other bytes. Recent research on AI skills, model artifacts, OCI plugins and agent importers shows that this is not a single vulnerability. It is a recurring mismatch between what was inspected, what was authorized and what the runtime ultimately consumed.

The distinction has practical consequences. A safe-looking SKILL.md does not describe every file a skills installer will copy. A valid digital signature does not always identify the publisher you meant to trust. A clean Python source file does not guarantee that the interpreter will select that source over a cached binary. None of these observations proves that all skills, model files or plugins are malicious.

The first three rows include controlled scanner and runtime experiments. NEBULA concerns malicious packages observed in public distribution. Hyper-MCP and AgentCore are vulnerability disclosures with stated prerequisites. They do not share a population or a common success-rate denominator.

In PyCache Trap, the authors placed malicious cached bytecode alongside benign-looking agent skill files. They reported scanner bypass rates of 94% to 100% in tests using 100 skills and seven scanners. Their execution-aware validator detected all 100 source-present cache substitutions in one focused evaluation, while reporting 92.8% recall at a 10% false-positive rate in the broader follow-up. These are measurements from the study's selected loaders and samples, not a reliability guarantee for every Python environment. See the paper.

The FakeGit investigation examined a separate handoff. Apiiro counted 17,610 lure repositories in its October 6 snapshot and identified 167 AI skill folders that carried a malicious ZIP beside SKILL.md; 96 were also listed in directories. This demonstrates a distribution and packaging problem, not 167 proven infections. A file must still be executed after it is copied. The research disclosure is explicit about that separation.

An npm hook crosses the boundary earlier. CloudSEK's NEBULA analysis found seven packages distributed through four npm accounts. Their nebula.js entry point resembled an ordinary AI client, but the preinstall.cjs lifecycle script recovered and launched a modified KNTRAT Windows payload. The same executable hook could act during installation before anyone imports the SDK's advertised API. CloudSEK identified the payload in static analysis but did not observe live command-and-control beaconing in its isolated run or establish a named infected organization. Package names, downloads and malware executions are distinct measurements.

The general rule is to bind an approval to the exact installed set and the interpreter paths that can execute it, not to a selected README, code preview or declared entry point.

Pickle adds executable semantics to data loading. In the DITTO study, researchers reported that 9.3% of more than 10,000 surveyed Hugging Face repositories used Pickle serialization. That number measures a format, not the prevalence of malicious models. Their semantic analyzer recorded no missed malicious examples and a 0.7% false-positive rate on a specific 959-benign, 92-malicious benchmark, but the result does not cover unseen gadget families or behavior hidden in model weights. The primary study describes its benchmark limits.

LMCache's multiprocess transport moves this boundary from a downloaded model file to the serving network. JFrog reports that an unauthenticated ZeroMQ ROUTER message reaches DeviceIPCWrapper.Deserialize, which calls pickle.loads, while a MessagePack extension is still being decoded. A remote peer that can reach a routably bound transport may execute code before the intended registration handler checks arguments. The default loopback binding does not expose the same remote path, and an embedded single-process use need not open the port. The JFrog disclosure is a conditional RCE demonstration, not a verified campaign of compromised inference servers.

These cases require different controls. Scanning a static Pickle artifact may help at model admission. It does not authenticate a cache transport, and it cannot neutralize a pre-authentication unpickler reached by untrusted network frames.

The Hyper-MCP OCI race concerns which manifest is trusted. The loader resolves a mutable tag, while Cosign can verify a separately resolved value. An attacker who controls registry responses can make those resolutions disagree. The independent signer-policy weakness concerns whose signature is trusted: permissive keyless identity and issuer patterns can accept a correctly signed plugin from an unintended principal.

An immutable digest binding solves neither problem by itself. The admission decision must link the exact consumed manifest to the verified digest and independently restrict the signer identity. The loaded plugin's consequences still depend on its configured WASM host capabilities. The manifest-race advisory and signer-policy advisory describe separate defects; their version metadata is not proof of a corrected installed release.

AWS disclosed two Bedrock AgentCore Starter Toolkit flaws that begin with an authenticated actor modifying agent data inside the same account. In one path, data becomes unsafely encoded generated Python that may run when another principal imports and deploys it. In the other, OpenAPI external references can cause local file reads or outbound requests during the import. Both affect the deprecated Python toolkit through 0.3.13, and AWS lists 0.3.14 as patched.

The distinction changes how remediation is assessed. Upgrading the generator does not rewrite previously emitted Python. AWS calls for re-importing affected agents and replacing local or deployed output artifacts. A reference resolver needs constrained file and network authority at import time; code generated later has a separate execution boundary. Review the code-generation advisory and OpenAPI-reference advisory independently.

A defensible artifact admission record answers four questions in order: which exact bytes can be consumed; which authorized principal supplied them; which parser, installer or runtime will interpret them; and which permissions that consumer receives. Recheck the association when tags move, code is regenerated, caches are selected, or a package acquires new lifecycle hooks. A clean scan of one layer does not carry through an unverified layer below it.

This framework is a way to separate security decisions, not a claim that one scanner or policy would have stopped every example. Some findings are controlled evaluations, others are observed malicious distribution or vendor advisories. Keep exploitation status, mitigation versions and affected populations attached to each dossier rather than collapse them into a single headline statistic.