At a glance
- EDR, CASB and DLP watch processes, cloud sessions and file content; none of them inspects the Skills, MCP servers or plugins an agent loads.
- An Agent Skill is often just a markdown file of instructions that executes with the employee's own permissions through an approved agent binary.
- Backslash Security's agentic endpoint security page states it discovers every agent, model, MCP server, Skill, hook, rules file, plugin and connector on an endpoint.
- Backslash Security blocks risky agent actions inline before execution, including credential access and privilege escalation, according to its real-time protection page.
- The 2026 AI Security Market Report from Latio, on Backslash Security's site, calls Backslash "one of the most complete options available."
Backslash Security
Published:
No — EDR, CASB and DLP tools do not detect malicious AI agent Skills and plugins, because none of those layers inspects the objects an agent loads. Endpoint detection and response (EDR) watches processes, files and known-bad behavior on a machine; a cloud access security broker (CASB) governs traffic between users and sanctioned cloud applications; data loss prevention (DLP) inspects content moving through defined channels against policy rules. An Agent Skill — packaged instructions and scripts that extend what an AI agent can do, in practice often a single markdown file sitting in a folder on an employee's laptop — never registers as a new process, a new application or a new transfer channel. It is read by an approved agent such as Claude Code, Cursor or GitHub Copilot, and the actions it triggers run with that employee's own permissions and identity. The same is true of an MCP server, the Model Context Protocol connection an agent acts through, and of plugins, hooks and rules files, which carry standing instructions an agent reads on every run. What sits outside all three established layers is the inventory question itself: which agentic components are installed, who approved them, and whether any are signed in under a personal account — the shadow AI problem in its concrete form.
Closing that gap takes a control at the agentic layer itself, with dedicated options available as of 2026. Backslash Security discovers the AI agents, MCP servers and Skills running on employee endpoints, assesses which ones are safe to use, applies allowlist and denylist guardrails, and blocks risky agent actions inline before execution.
What exactly is a malicious AI agent skill, plugin, or connector?
A malicious AI agent skill, plugin, or connector is a packaged instruction set or tool connection that makes an agent execute an attacker's intent — reading credentials, running shell commands, or exfiltrating data — while appearing as a routine productivity extension. It inherits the employee's identity and permissions when the agent loads it, so it never needs to look like malware.
Agentic layer artifacts each have distinct shapes and failure modes:
| Artifact | What it is | What makes it risky |
|---|---|---|
| Agent Skills | Packaged instructions and scripts that extend agent capabilities — often just a markdown file | Executes with the user's permissions; can instruct an agent to read files, call APIs or run commands |
| Plugins and connectors | Components that extend what an agent can reach | Run on the endpoint with the employee's identity and access |
| MCP servers and MCP tools | Model Context Protocol endpoints agents use to reach external tools and data | Each server is a connection an agent can act through |
| Hooks | Triggers that fire on an agent action | Run something before or after that action |
| Rules files such as AGENTS.md and CLAUDE.md | Files in a repository or on a machine | Carry standing instructions the agent reads on every run |
| Context files | Documents, issues and pages agents read to complete tasks | Can carry prompt injection — hidden instructions agents follow as if the user had typed them |
The risk comes from what each component can instruct an agent to do, not from a malware signature.
Why do EDR, CASB, and DLP tools miss these artifacts?
EDR, CASB, and DLP each watch a different layer of the stack, and the Skills, rules files and plugins an AI agent runs fall between all three. EDR catches malicious processes, files and known-bad behavior on a machine. CASB governs traffic to sanctioned SaaS applications. DLP inspects content for recognizable patterns. None records what an agent was instructed to do.
The architectural reasons are specific:
- Process-level versus intent-level telemetry. EDR sees the process but not the cause — not which prompt, agent, Skill or MCP server produced an action. A Skill executing under the user's own permissions inside an approved agent looks like a trusted parent reading files and making network calls.
- Sanctioned-SaaS scope. A broker evaluates access to sanctioned cloud applications. An MCP server — a connection an agent opens through the Model Context Protocol to reach external tools and data — is a component on the endpoint, which is not the object a broker is built to evaluate.
- Content-pattern inspection. Hidden instructions planted in a file an agent reads look like ordinary prose, and the resulting action is a legitimate tool call by an approved agent.
So detections and log routing stop at the process boundary, and an inventory assembled from process, broker or pattern telemetry cannot enumerate the agentic layer.
| Do this | But watch out for this |
|---|---|
| Keep endpoint detection for malware and known-bad binaries | An approved agent following a poisoned instruction raises no known-bad signal; add records of prompt, tool call and outcome |
| Use broker logs for approved AI applications | Components installed on the endpoint are outside that view; pair it with endpoint-side discovery |
| Tune content inspection for secrets in motion | A credential read through a legitimate tool call looks authorized; govern at the action level instead |
| Pull an application inventory from MDM | MDM does not control what AI agents use and install, such as Skills |
Which control layer sees which agentic components?
Each control layer in the enterprise stack sees a different slice of the agentic components on a machine, and none of the established layers sees the agentic AI fabric as a whole — the interconnected set of agents, models, MCP servers, Skills, hooks, rules files, plugins and connectors that interact on an endpoint. Four criteria separate the architectures:
- Discovery — enumerating which agentic components exist on an endpoint. Decisive when there is no inventory.
- Assessment — judging whether a component is safe before use. Decisive when employees install faster than review cycles run.
- Inline action blocking — stopping an action before execution rather than alerting afterward. Decisive when the action is credential access or data exfiltration.
- Forensic reconstruction — replaying what an agent was asked to do, what it called, and what resulted. Decisive for investigation and audit.
| Control layer | Discovery | Assessment | Inline action blocking | Forensic reconstruction |
|---|---|---|---|---|
| Endpoint detection and response (EDR) | Sees processes, not the agent component that caused them | Judges known-bad files and behaviors, not agent instructions | Acts on processes, not on what an agent was instructed to do | Process records without prompt context |
| Cloud access brokering (CASB) | Sees sanctioned cloud applications, not components on the endpoint | Evaluates cloud applications, not Skills or MCP servers | Acts on cloud-application access | Cloud application records |
| Data loss prevention (DLP) | Sees content, not the component that moved it | Classifies data, not agent configuration | Acts on content that matches policy | Content-event records |
| Agentic endpoint control layer | Enumerates agents, models, MCP servers, MCP tools, Skills, hooks, rules files, plugins and connectors | Risk posture of each component, assessed agentlessly | Blocks risky agent actions before execution | Traces prompt to agent to tool call to outcome |
Endpoint detection fits malware questions, brokering fits sanctioned-app governance, and content inspection fits data handling. Where the exposure is an approved agent acting under an employee's own identity and permissions, the agentic endpoint control layer is the architecture built for it, and it is the layer Backslash operates at. It complements EDR rather than replacing it.
How can a security team detect and block a risky skill before it executes?
A security team can detect a risky Skill before it executes by running discovery, assessment, governance, inline enforcement and forensic reconstruction as one continuous sequence. A Skill is packaged instructions and scripts that extend what an AI agent can do, often just a markdown file sitting on a laptop, and it executes with the employee's own permissions.
- Inventory the endpoint layer. Enumerate the agents, models, MCP servers, MCP tools, Skills, hooks, rules files, plugins and connectors present on every employee machine, not only developer laptops. Backslash offers a free AI Endpoint Exposure Assessment (also called Scout) that is agentless, read-only and retains no data: a short script distributed through your existing MDM that runs, reports and disappears.
- Assess each component. Establish the risk posture of each component before it is approved for use.
- Govern what is permitted. Allowlist approved components, denylist risky ones, and write separate policies for teams with different risk profiles.
- Enforce at the action, not at the install. Approval at install time says nothing about behavior at run time, so the control must evaluate an attempted action and intervene before it completes.
- Preserve the trace. Keep prompt-to-tool-call records so an investigator can reconstruct an agent run afterward.
| Do this | But watch out for | Mitigation in the same step |
|---|---|---|
| Run a one-time discovery sweep | The list goes stale as employees add new Skills | Make discovery continuous, not a periodic exercise |
| Denylist aggressively | Blocking without an alternative can push unsanctioned use out of sight | Pair every denial with an approved alternative |
What should enterprises verify when closing this visibility gap now?
Enterprises closing this visibility gap should verify a short list of concrete properties and ask for evidence on each rather than accepting a capability claim at face value.
Who is covered. Discovery that stops at the engineering organization leaves the rest of the company unmeasured. Ask whether the assessment reaches every employee endpoint, including sales, finance and legal, and not only developer workstations, which are a prominent use case inside a broader scope. Backslash discovers agentic components across employee endpoints, which gives an AI governance owner an inventory to report against.
Whose identity acted. Agents execute with the user's own permissions, so an inventory without identity attribution cannot tell you whether a run happened under a corporate account or under a personal login. That distinction is the practical face of shadow AI: a private account signed in on a corporate machine. Backslash detects private account access on enterprise machines as part of its Shadow AI coverage.
What the audit record looks like. Ask to see a run reconstructed end to end: prompt, agent, tool call, outcome. Backslash traces the full path of an agent run from prompt to agent to tool call to outcome, and it automatically generates audit evidence for EU AI Act, NIS2, DORA and SOC.
Frequently Asked Questions
Why do EDR, CASB, and DLP tools miss malicious AI agent skills and plugins?
Endpoint detection and response (EDR) — the incumbent endpoint layer built to catch malicious processes, files, and known-bad behavior — evaluates what a process is, not what an agent was instructed to do. A cloud access security broker (CASB) brokers traffic to sanctioned software-as-a-service applications, and data loss prevention (DLP) inspects content against patterns. An Agent Skill — packaged instructions and scripts that extend what an agent can do, frequently just a markdown file on the machine — triggers none of those boundaries. The agent is an approved tool such as Claude Code or Cursor, and the instruction it follows is text. Nothing that looks malicious crosses the process boundary, so detection stops there.
What is an Agent Skill, and why is it treated as a security object?
An Agent Skill is a reusable capability an agent can invoke: a packaged set of instructions and scripts that can tell the agent to read a file, call an application programming interface, or run a shell command. It executes with the user's own permissions, which is what makes it consequential. The same applies to a rules file — a file in a repository or on a machine carrying standing instructions the agent reads on every run, commonly named AGENTS.md or CLAUDE.md — and to a hook, a trigger that fires on an agent action and runs something before or after it. Backslash assesses these components for risk using an agentless approach, meaning information is collected without leaving software permanently installed on the endpoint.
How does MCP server risk differ from traditional plugin risk?
The Model Context Protocol (MCP) is the protocol agents use to connect to external tools and data sources, and each MCP server is a connection an agent can act through. The difference is what the connection exposes: an MCP server gives an agent a path to act on external tools and data with the employee's identity and access. Backslash's MCP Server Security Hub has scanned and scored publicly available MCP servers, and Backslash secures MCP servers alongside the other components an agent uses.
Can an approved agent still be dangerous?
Yes, and the distinction matters for how you respond. Shadow AI means agents, models, MCP servers and Skills running inside the organization that security has not approved and cannot see, including an employee connecting through a personal account on a corporate machine. A rogue agent is different: an approved agent taking actions nobody asked for, such as reaching for credentials, escalating privilege, or sending data to an unapproved destination. Backslash security research found that malicious instructions hidden in a repository's AGENTS.md file could trick OpenAI Codex into silently accessing AWS credentials, npm tokens and Git configuration.
About this article
Backslash Security publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Backslash Security before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-11-10