AI Agent Supply Chain Attack Surface — ClawHub Malicious Skills, Exposed MCP Servers, and the Mexico Government Breach

1,184 malicious skills infiltrated ClawHub marketplace, 492 unauthenticated MCP servers exposed, 195M Mexican taxpayer records leaked via AI agent attack. In 2026, the AI agent supply chain attack surface is expanding rapidly — enterprises must reassess the security of their agent dependencies.

ClawHub Marketplace: 1,184 Malicious Skills Infiltrated

ClawHub, a leading marketplace for reusable AI agent skills, hosts tens of thousands of capability modules. Security researchers auditing the platform in 2026 discovered that 1,184 malicious skills had successfully blended into the marketplace — disguised as legitimate document processing, data analysis, or email management tools, silently exfiltrating data, harvesting credentials, and performing lateral movement in the background.

These malicious skills exploited the marketplace's trust model: after a developer uploads a skill, the platform performs only surface-level scanning with no behavioral sandbox verification. Once an enterprise agent installs one of these skills, the attacker gains an execution environment with the same privileges as the agent itself — including access to internal APIs, database connection strings, and OAuth tokens.

492 MCP Servers Exposed Without Authentication

Model Context Protocol (MCP) servers are the critical bridge connecting agents to external tools and data sources. Yet a full internet scan revealed that 492 MCP servers are publicly exposed without any authentication — anyone can directly invoke the file systems, databases, and command-line interfaces behind them.

This means a well-crafted prompt can let an external agent read sensitive files, execute system commands, or pivot into an enterprise's internal network through these MCP servers. The root cause: MCP's design assumes "the caller is a trusted agent," but in reality, the caller could be anyone.

Mexico Government Breach: 195 Million Taxpayer Records

The most devastating incident occurred in Mexico. Attackers, using a compromised AI agent skill, leveraged the agent's legitimate government system access to steal 195 million taxpayer records— covering nearly the entire Mexican population. This was not a traditional external breach: the attackers never directly attacked the government systems. They completed the data extraction through the agent's own permissions.

This exposes a fundamental problem: when an agent holds broad access to sensitive systems and its behavior is not auditable, a single compromised skill is equivalent to a full-scale data breach. An agent's permission boundary is far more dangerous than a human user's, because an agent operates at thousands of times the speed and scale.

What Enterprises Must Do

AI agent supply chain security requires three layers of defense:

Supply chain attacks are not a new concept, but AI agents have expanded the attack surface by orders of magnitude. A compromised npm package may affect one application; a compromised agent skill can compromise an entire enterprise's data assets. The governance layer must stay ahead of the deployment velocity.