One in eight
In February 2026, researchers at Koi Security audited ClawHub, the community skill marketplace for the open-source agent OpenClaw. Of the skills they examined, 341 out of 2,857 were malicious — roughly 12 percent, about one in eight — delivering the Atomic macOS Stealer, keyloggers, and reverse shells to people who thought they were installing a weather widget or a calendar helper. The campaign earned a codename, ClawHavoc, and a supply-chain postmortem.
The lesson is not that one marketplace had a bad month. The lesson is what an open agent marketplace is: a distribution channel where anyone can publish code that will run with your agent’s hands, your files, and your credentials. Attackers noticed before most users did.
Fifteen clean releases, then line 231
Marketplaces are one door. Packages are another.
In September 2025 the security community documented the first publicly known malicious MCP server: an npm package called postmark-mcp that did its job faithfully through fifteen clean releases. Then version 1.0.16 added a single line — at line 231 — that silently BCC’d every outgoing email to the author’s own server. Password resets, invoices, confidential threads — everything the connected agent sent. Snyk’s analysis walked the code; Postmark — whose name the package had borrowed without any affiliation — had to publish its own advisory.
Fifteen clean releases is the detail worth sitting with. Auditing a package once tells you what it was, not what its next update will be. In an open supply chain, every update is a fresh decision made by someone who isn’t you.
The model layer will not save you
Perhaps the model itself can catch what the supply chain lets through? The measured answer is no.
On Gray Swan’s indirect prompt-injection benchmark, even the most injection-resistant frontier model tested falls to a strong injection a third of the time given ten attempts — 33.6 percent — and 63 percent of the time given a hundred. When the UK AI Security Institute and Gray Swan ran a red-team challenge totalling 1.8 million attacks against 22 frontier models, every single model was broken, and most target behaviors fell within 10 to 100 queries. NIST’s CAISI drew the same conclusion from its own look at large-scale red-teaming.
We’re deliberately not ranking vendors here — the tables are public, click through. The aggregate is the point: today, no frontier model from any lab withstands a determined injection attacker. A poisoned skill or a booby-trapped web page doesn’t need to beat the model every time. It needs to win once.
The attacker moves second
Couldn’t defenses close the gap? They keep not closing it. A paper bluntly titled “The Attacker Moves Second”, from researchers across OpenAI, Anthropic, and Google DeepMind, showed adaptive attacks bypassing twelve published prompt-injection defenses — at better than 90 percent success for most of them. The defense ships, the attacker adapts, the defense falls — that’s the loop, and the attacker always gets the last move.
Which is why the most interesting research response isn’t another filter. Google DeepMind and ETH Zurich’s CaMeL paper says it in its title: Defeating Prompt Injections by Design. Don’t ask the model to resist the injection. Build the system so the injected text never gets to act.
The arithmetic makes the same argument from the other side. An agent that’s 95 percent reliable per step is 36 percent reliable by step twenty — 0.95 to the twentieth power is 0.358. Long-running agents don’t just carry risk; they compound it. Probabilistic defense loses to exponents. Structure doesn’t.
Built like the researchers ask
This is the threat model myOrbit is built against, and the answer is architectural, not aspirational.
We don’t run an open skill marketplace. The MCP servers and skills our agents use are first-party — a supply chain with an author you can name, not a bazaar with 2,857 stalls and no customs desk.
And between what a tool returns and what an agent does about it sits the governed pipeline: one deny-wins gate for every action, guardrails enforced outside the model, tripwires that stop the unusual and hand it to a human. That is precisely the control the research points to — rules that hold because they were never inside the model’s context to begin with, on Echo OS and everywhere agents act here.
Open ecosystems gave agents reach. One in eight is what reach costs without law. We chose law.