China Warns Of Malicious AI Agent Extensions
China's CNCERT (National Computer Network Emergency Response Coordination Centre) warned in June 2026 that a fast-growing grey market of third-party AI agent "skills" is being sold to bypass model safety guardrails and enable banned cryptocurrency mining, according to Global Times and the South China Morning Post. The agency flagged specific packages, including one marketed as a "godmode" jailbreak skill, that can leak user data, trigger account bans, or expose enterprises to legal risk, and urged companies to source skills only from official channels and apply least-privilege access controls. Reporting citing the security-testing platform JailbreakBench notes malicious prompt injections still achieve high bypass rates against safety controls from major developers including OpenAI and Anthropic.
This advisory previews a problem that will hit AI agent platforms everywhere, not just in China: as agent ecosystems open up to third-party plug-ins, the same permissive execution model that makes skills useful also hands attackers a ready-made distribution channel for jailbreaks and cryptojacking.
What happened
China's CNCERT posted a warning on its official WeChat account about a rapidly growing grey market for third-party AI agent "skills" plug-ins, per Global Times and the South China Morning Post. CNCERT flagged specific packages, including one marketed as a "godmode" jailbreak skill, designed to bypass model safety guardrails, generate otherwise-prohibited content, or covertly run cryptocurrency-mining code that remains banned in mainland China. The agency warned these packages can cause data leaks, account suspensions, and legal exposure, and urged enterprises to source skills only from official channels, apply least-privilege access controls, and use whitelists for approved skills (Global Times, SCMP, tech360.tv).
Technical context
AI "skills" function like plug-ins that expand agent capabilities by connecting models to external databases, automating workflows, or running third-party code, similar to how apps extend a smartphone. Agent platforms including Manus, Coze, Dify, and Flowith have encouraged third-party developers to build these skills, tech360.tv reports. Reporting citing the open-source security-testing platform JailbreakBench notes that malicious prompt injections and compromised skills continue to achieve high success rates bypassing guardrails deployed by major developers including OpenAI and Anthropic, evidence that the underlying jailbreak techniques are not China-specific.
For practitioners
Opening agent platforms to third-party code inherently enlarges the attack surface, since skills introduce new execution contexts and privilege boundaries. The core engineering challenge is constraining what external components can request or execute, sandboxing runtime environments, classifying agents by data sensitivity, and monitoring for unexpected outbound network activity, such as covert miner downloads.
What to watch
- •Reports of compromised or malicious skills surfacing in public marketplaces or third-party registries beyond China.
- •Security benchmarks such as JailbreakBench quantifying bypass rates for guardrails across major model providers.
- •Vendor responses, including stricter skill vetting, whitelists, runtime sandboxing, or telemetry flagging unexpected outbound downloads.
Editorial analysis
The warning matters beyond China because enterprises everywhere are embedding agents into workflows that touch sensitive data and infrastructure, and unregulated skill marketplaces plus widely available mining code raise operational and compliance exposure well past the crypto-mining ban that motivated CNCERT's specific warning. It reflects a broader pattern: as agent ecosystems decentralize capability development across many platforms, both platform operators and enterprise adopters will need to rethink permission models and runtime isolation, not treat this as a one-off regional advisory.
Key Points
- 1China's CNCERT warned that unregulated third-party AI agent skills can bypass guardrails, enabling banned cryptocurrency mining.
- 2Agent platforms that run external skill plug-ins enlarge the attack surface, making runtime isolation and permission control critical.
- 3Security testing shows persistently high bypass success rates against major providers, showing the underlying risk is not China-specific.
Scoring Rationale
A formal advisory from China's national cybersecurity coordination center on a concrete, named threat pattern ('godmode' jailbreak skills, crypto-mining plug-ins) to enterprise AI agent deployments is relevant to security practitioners globally, and the underlying bypass techniques verifiably extend beyond China. It remains a watch-and-mitigate advisory rather than a new CVE or enacted regulation, so it sits at the notable tier.
Sources
Public references used for this report.
Practice with real FinTech & Trading data
90 SQL & Python problems · 15 industry datasets
250 free problems · No credit card
See all FinTech & Trading problems
