Most people are far more afraid of a shark attack than they are of the drive to the beach where that attack might happen. Vanishingly few people will ever meet a shark. Ordinary vehicles injure and kill people constantly. The fear is real. It's just pointed at the wrong thing.
That exact miscalibration plays out every time someone taps "Allow" on a new AI tool, skill, or plugin. People who'd never install an app from outside their phone's official store will authorize an AI agent to read their email, touch their files, or run commands on their machine, because the request came wrapped in something that felt legitimate, useful, or fun. A March 2026 survey of 1,000 U.S. adults by the phone-plan comparison site WhistleOut found 92% concerned about how websites and apps collect their personal data on mobile devices. The same survey found 40% have never reviewed their phone's privacy settings, and 23% don't check the permissions they've granted their apps. The concern is sincere. The vigilance isn't there. That gap is where all of this lives.
Cleared By Every Scanner
On June 22, 2026, security researchers Niv Hoffman and Or Nevo of the firm AIR published an experiment: a proof-of-concept AI skill called "brand-landingpage," pitched as a no-code way to build marketing landing pages using Google's Stitch tool. They got it merged into a popular GitHub-based skill marketplace with about 36,000 stars. Scanners from Cisco and NVIDIA, and the scanners on skills.sh, all rated it safe.
The skill was not safe. Its malicious behavior lived in an external resource its documentation pointed to, which is the part those scanners didn't check. Once adoption grew, the researchers swapped that external content so the skill instructed installed agents to download and run a script. Because the instruction arrived through what looked like trusted documentation, the agents followed it. AIR reports that about 26,000 agents were affected, including agents on corporate accounts. That figure is AIR's own count. Their proof-of-concept only collected email addresses, to prove the point without doing real damage. A real attacker running the same playbook could have read files, taken data, and reached internal systems.
This is the part worth sitting with: nothing about this skill looked sketchy. It came through a trusted marketplace. It had a plausible use case. It passed every scanner AIR tried. If your defense against this category of risk is "I only install things from reputable places," this is the case study that shows exactly why that defense doesn't hold. A legitimate publisher, platform, or marketplace can be compromised (or, in this case, deliberately tested) without ever tipping its hand. A trusted source is a different claim from a safe one.
No Sandbox Around the Shell
On May 31, 2026, PewDiePie launched Odysseus, a free, self-hosted AI tool positioned as a private alternative to ChatGPT and Claude. It went viral, and its GitHub page now shows more than 95,000 stars. Odysseus includes an agent that, for admin users, can run shell commands and read and write files on the machine it runs on. The project's own threat model lists "No shell/filesystem sandbox" as a known gap. Security researchers started finding real, exploitable vulnerabilities almost immediately. On June 1, Jamieson O'Reilly published a command injection flaw that allowed full server takeover. On June 14, Yunus Aydın reported that any logged-in user, admin or not, could redirect a server-wide setting to an address they control, which would send other users' chat and memory text to that address in plaintext.
Give a beloved creator's brand-new AI agent shell access to your computer, and people will queue up for it. Raise a mild concern about what Windows 11 sends back to Microsoft, and the same people will spend an afternoon in the settings menu disabling telemetry. Both concerns can be legitimate. Only one of them is being treated with anything like proportionate suspicion. And the "well, is Big Tech any better?" defense that gets wheeled out for indie security failures doesn't hold up either: one project's shortcuts don't cancel out another company's. They are two separate reasons to pay attention.
Why The Next One Doesn't Need A Programmer
Both of those happened in May and June 2026. The reason this keeps happening, faster and more often, is that the barrier to creating a threat has collapsed at the same time the barrier to spotting one has gone up.
Building something malicious used to require real skill. Now it can be a skill file, a plugin, or a set of natural-language instructions that almost nobody reads before installing, because it reads like a task list rather than code. It can hide in content the AI reads, such as a web page or a document, instead of a binary. Meanwhile, decades of security tooling that gatekept behind jargon, and decades of security warnings that told users nothing useful, have trained a great many people to treat every prompt the same way: next, next, next, ok. When every dialog box looks equally meaningless, none of them get read, including the one that matters. Layer on a very reasonable, well-earned fatalism about data brokers, ad platforms, and the regulators who've mostly let them operate unchecked, and you get people who've simply concluded that trying to protect their footprint isn't worth the effort. That is a predictable response to being failed, repeatedly, by an industry and a policy environment that never made caution easy or the stakes clear.
Ignorance makes you more likely to be the one who gets compromised, and part of how the compromise spreads to everyone else who trusted your "Allow."
If you're the one tapping "Allow" on your own phone, for a skill, a plugin, a new AI assistant your kid recommended, or whichever AI tool is trending, this deserves a real conversation rather than a settings-menu once-over. A Personal Cyber Exposure Review looks across your devices and accounts at what you've already granted access to, shows where you're exposed, and gives you a clear plan. If you'd rather build the judgment yourself so you're making these calls correctly going forward, an Advisory Hour does that directly with you.
And if you run a business, or employ people who do (a PA, an assistant, staff at a family office), the same "Allow" is happening on their devices, with access to systems that reach well past their own inbox. A Security Posture & Risk Review looks at what's been granted across your organization and explains, in plain English, what needs attention if any one of those approvals turns out to be the wrong one.
Either way, the fix starts with the same question: reach out, and let's find out what's been approved on your behalf.