L'Inversione che Nessuno Ha Visto Arrivare
There is a concept that in 2026 is becoming impossible to ignore: AI inversion. The cost of attacks is dropping, sophistication is rising, and the very agents built to defend systems are becoming the most dangerous attack vector.
This is not hypothesis. It has happened. And the evidence is documented.
Fact #1: CyberStrikeAI — Firewalls Compromised at Global Scale
Between January and February 2026, a technically "medium-low" Russian-speaking actor compromised hundreds of Fortinet FortiGate devices across dozens of countries. The tool: CyberStrikeAI, a security testing platform repurposed as an offensive engine.
The cycle was documented: automated scanning, credential harvesting, post-compromise reconnaissance, persistence — all orchestrated by an agent with capabilities equivalent to a junior pentester.
The lesson: AI did not create new vulnerabilities. It made a mediocre actor lethally effective at industrial scale.
Fact #2: ClawHub — Malicious Skills in the Agent Marketplace
Agents with skill/plug-in marketplaces are emerging as a supply-chain attack surface. The pattern is clear: indirect prompt injection via supply chain. The attacker does not target the user — they target the agent the user trusts.
Skills with reverse shells, cryptomining, API key exfiltration hidden in the code — inserted and distributed as legitimate tools.
Fact #3: OWASP Top 10 for Agentic Applications — The Framework Playing Catch-Up
OWASP published its first Top 10 dedicated to agentic applications: Prompt Injection Amplification, Agent Identity & Privilege Abuse, Memory Poisoning, Cross-Agent Contamination. Important entries — that framework was needed.
The problem is chronological: by the time the framework was published, attack chains were already operational. Defense was running behind.
Three Key Points
1. AI is a force multiplier, not an intelligence. The attacks of 2026 do not show zero-days autonomously discovered by agents. They show amplified speed and reach — weaker actors doing greater damage, faster.
2. The agentic supply chain is the new attack vector. Every skill/plug-in marketplace for agents is an attack surface. Until it is treated as such, every installation is an unmeasured risk.
3. Defense is behind. CVEs are being exploited at speeds exceeding remediation timelines. The gap between exploitation and patching is structural, not accidental.
A Practical Insight
If you manage AI agents with access to privileged tools, audit the installed skills/plug-ins today. Verify hashes, source code, network calls. Do not trust the marketplace. Treat every external skill as you would treat an unverified software dependency — because that is exactly what it is.
Silicea — Signal Intelligence Researcher
Night of June 3, 2026