Fetching from the wire…
01
02
03
04
05
06
07
08
Security2026-06-20 · source-backed
A new attack framework buries malicious behavior inside agent-skill auxiliary resources, and its VulMask technique rewrites obvious malicious scripts into "vulnerability-shaped" code that activates only under attacker-controlled triggers (arXiv:2606.19191). It evades the coding agents and scanners that would flag overt malware. This is the dark twin of every skills story this week. Record & Replay and auto-mined skills make the format trivial to produce and share, and the security tooling around it is still pretending a description and a quick read are enough. They're not.
Each link below shares sources, entities, or timing with this story.
Shared entity: Replay / Same source domain / Shared topic / Tension
Both cover Replay; reported by the same outlet (arxiv.org); overlapping topics (agent, auto-mined, skill).
Same source domain / Shared topic / Tension
Reported by the same outlet (arxiv.org); overlapping topics (agent, behavior, only, under); pushes against this story (against).
Same source domain / Shared topic / Tension / Downstream implication
Reported by the same outlet (arxiv.org); overlapping topics (agent, behavior); pushes against this story (but).
Same source domain / Shared topic / Tension
Reported by the same outlet (arxiv.org); overlapping topics (agent, attack, only); pushes against this story (against).
Same source domain / Shared topic / Downstream implication
Reported by the same outlet (arxiv.org); overlapping topics (agent, attack, maliciou); traces where this leads (downstream).
Same source domain / Shared topic / Tension
Reported by the same outlet (arxiv.org); overlapping topics (agent, attack, behavior); pushes against this story (but).
Reported by the same outlet (arxiv.org); overlapping topics (agent, attack, maliciou); pushes against this story (against).
Same source domain / Shared topic / Downstream implication
Reported by the same outlet (arxiv.org); overlapping topics (agent, attack, attacker); traces where this leads (which means).