They Didn't Hack the Agent. They Forged the Badge.
Second in a series on trust theft. A security firm never hacked anything. It forged a badge: merged a fake skill into a 36,000-star marketplace, ran an Instagram ad, and watched it spread to roughly 26,000 AI agents while every scanner called it safe. The payload was never in the package. It lived on a page the skill pointed to, swapped clean after the scan cleared.