BEIJING — The advisory landed on the website of China’s national computer emergency response center with the clipped, technical tone of a routine warning, but its subject was new. The center said it had identified AI agent “skill” packages circulating under names promising “large-model jailbreak” and “mining money,” and it warned that using or distributing such packages carries legal liability and security risk.
The warning is a sign of how far agent technology has moved into the mainstream — and how fast the security questions are following. Skill packages are small, reusable capability bundles that agents can install and invoke, a format popularized by Anthropic’s Agent Skills and now adopted across the industry. They are distributed through marketplaces that have grown quickly: Tencent’s SkillHub, launched as part of its enterprise agent suite, hosts more than 70,000 skills and has logged more than 30 million downloads. The model is appealing — install a skill, and the agent gains a capability without new development.
The risk model is equally simple, security researchers said. An agent is an execution environment: it can read files, run code, call APIs and hold credentials. A malicious skill is a trojan that inherits those permissions. Jailbreak packages, which strip safety filters from large language models, expose users to legal risk in China, where content-moderation rules for generative AI have been in force since August 2023 and where regulators have repeatedly tightened enforcement. Crypto-mining packages present a different problem: they consume the host’s computing power, and in enterprise settings, the electricity and hardware costs land on the victim.
The pattern echoes the early days of mobile app stores, analysts said, when malware rode in on the popularity of new platforms before curation matured. Agent ecosystems are at that stage now. Skills are often unsigned, reviewed by volunteers at best, and installed with permissions that are described in natural language rather than enforced by the system. A skill that promises to summarize a document can, in practice, read a much wider range of files and send their contents somewhere.
Prompt injection compounds the problem. Researchers have shown that instructions embedded in skill content or in documents the agent processes can redirect its behavior, coaxing it to exfiltrate data or take actions its operator never requested. In China, where enterprise adoption of agents is accelerating through products like Tencent’s WorkBuddy and Alibaba’s enterprise offerings, the incident response center’s advisory lands at a sensitive moment: the first wave of corporate deployments is happening now, and security teams are still writing the policies that will govern them.
The center’s warning did not name specific vendors or packages, and it did not say whether any incidents had been reported. The advisory’s function, people familiar with such warnings said, is largely prophylactic: put the ecosystem on notice, push platforms to tighten review, and give enterprises a basis for internal policy. Vendors are responding. Tencent’s Managed Agents runtime advertises prompt-injection protection, with system prompts managed centrally and kept off local machines; other platforms have begun signing skills and sandboxing their execution.
The advisory is part of a longer pattern of Chinese regulators moving early on AI risks. The emergency response center has issued warnings on deepfakes, on the misuse of large language models and on data-collecting apps, usually before serious incidents become public. The generative AI rules that took effect in August 2023 made providers responsible for content moderation, and the center’s latest notice extends that logic to the agent layer: the skills an agent runs are now treated as part of the content pipeline, subject to the same review duties as the models themselves. The warning also reflects a practical reality of the Chinese market, where agent adoption is being driven by enterprise vendors racing to ship products, and where skill marketplaces are growing faster than the review processes around them.
The regulatory angle matters in China more than most markets. The legal regime that governs generative AI holds providers responsible for the content their models produce, and that responsibility extends to the tools wrapped around the models. A company whose agent runs a jailbreak skill could face penalties for the output; a company whose agent runs a mining skill has already been harmed by its own deployment. The advisory, by naming both, put the two failure modes on the same page.
For enterprises, the warning is a practical checklist as much as a legal one. Security teams are being told to inventory the skills their agents can invoke, restrict installation to trusted sources, review permissions before enabling packages and monitor agent activity logs for unusual patterns — the same discipline that email filters and browser extensions received a decade ago.
The deeper issue is that agent security cannot be solved with a patch. The boundary between a useful automation and an exploitable attack surface is drawn at design time: what the agent can read, what it can execute and what it can be told to do. The center’s advisory is the latest sign that regulators are watching that boundary closely. Analysts said the industry’s next test is whether skill marketplaces mature their review and signing processes before the next wave of abuse arrives.
