Anaconda: Agentic AI Security Starts With Everything an Agent Loads

The LiteLLM compromise as a case study

Anaconda opens with an incident from March 24, 2026, when attackers used stolen credentials to publish two malicious versions of LiteLLM to PyPI. The code on GitHub never changed, so reading the repository would have shown nothing wrong. According to Anaconda, any pipeline that pulled the update ran the attacker's code with its own credentials.

PyPI quarantined the packages about 40 minutes after upload, Anaconda says, but an automated pipeline can pull in a new release well before that. The company describes an agent as a model, a set of skills, a set of MCP servers and a tree of Python packages. In its words: "Everything an agent loads is attack surface, and security teams approve it once, if at all."

Models and skills: swapping is a security change

Anaconda's Enkrypt AI unit publishes the LLM Safety Leaderboard, which ranks 300 models on four risk scores: jailbreak susceptibility, bias, malware and toxicity. A jailbreak score of 18% means 18% of the attacks got through. Because each model scores differently, the company says, swapping models is a security change and should trigger a retest. Its agent red teaming tests the agent, its tools, its retrieval-augmented generation sources and its MCP servers, and leaves behind a regression suite that can run in continuous integration.

Skills are bundles of instructions and scripts that an agent loads to learn a task, and they run with the agent's permissions. Anaconda compares them to browser extensions and says that, depending on the agent, a skill can be added with no install prompt, no review and no record of what was approved.

As of September 30, 2026, the Enkrypt AI Skill Scan Hub had scanned 99,643 skills from GitHub. Of those, 4.25% (4,231 skills) received an unsafe verdict, and 10.5% (10,467 skills) had at least one finding. Anaconda stresses that an unsafe verdict is a scanner's judgment, not proof of an attacker.

• Unauthorized tool use: 59.1% of categorized findings
• Skill discovery abuse: 16.4%
• Malware: 11.7%
• Transitive trust abuse: 4.6%
• Data exfiltration: 2.1%
• Prompt injection: 1.8%

Enkrypt AI researchers also demonstrated an attack that hides instructions deep inside a SKILL.md, past the point where some scanners stop reading, to exfiltrate an SSH key. Anaconda's open-source Skill Sentinel reads complete files, runs multi-agent analysis, correlates threats across files and checks bundled binaries against VirusTotal. It can run as a CI step.

MCP servers and the fine print agents read

MCP is an open standard for connecting agents to tools and data. The agent reads the description and instructions of every tool it connects to, while people usually do not. Anaconda points to a September 2025 case in which an attacker published a fake postmark-mcp package on npm that imitated Postmark's legitimate email server. After 15 clean versions, version 1.0.16 added one line that blind-copied every email to the attacker.

In two months, Enkrypt AI scanned more than 268,000 tools across 25,000 MCP servers and found more than 143,000 vulnerabilities, affecting 73% of those servers, according to the company. Its answer has two parts. Before connecting, an MCP scanner inventories servers and tools, flags over-privilege and returns a remediation plan. Users can scan a GitHub repo, npm package or endpoint for free, with the report arriving by email in about 10 minutes. During operation, an open-source MCP gateway sits between agents and servers to approve, modify or block tool calls, enforce least privilege and keep an audit trail.

Python packages and hallucinated dependencies

Python-based agent frameworks, model SDKs and MCP servers rely on a tree of open-source dependencies, a layer Anaconda says it has secured for more than a decade. The company also cites a USENIX Security 2025 study in which code-generating models hallucinated package names at average rates of at least 5.2% for commercial models and 21.7% for open-source models, with many invented names repeating. Attackers can register such names ahead of time, so a coding agent that installs whatever the model suggests could pull in a malicious package without human review.

Anaconda's guardrails for coding agents can block package installs by default and permit only approved commands. Its AI Artifacts product offers a curated package source with vulnerability scanning, custom security policies and package signatures, in the cloud or on-premises, including air-gapped networks. It generates an SBOM for each artifact and can hold brand-new upstream versions for review. According to Anaconda, a short hold would have kept the LiteLLM versions out.

What security teams are told to do

Anaconda says the pattern across all four layers is the same: a component earns trust once, at install, approval or download, and is not checked again. It frames the resulting gaps as three questions: what is in the stack, what changed since approval, and can the team prove it. Its agent policy engine turns governance policy and regulation text into controls, with defaults covering the EU AI Act and frameworks from NIST and OWASP. Guardrails log each enforcement decision with a policy ID and reason code.

The post also points to OWASP's Top 10 for Agentic Applications, published December 9, 2025 with input from more than 100 experts, as a shared vocabulary for risks such as tool misuse and agentic supply chain vulnerabilities. For the first week, Anaconda recommends five steps:

• List every agent and everything it loads, including model, skills, MCP servers, packages and credentials.
• Scan every skill before it runs, for example by adding Skill Sentinel as a CI step.
• Pin versions, verify hashes, re-approve anything that changes and wait a day or two on brand-new releases.
• Give each agent the least access it needs, and keep agents that read untrusted content away from critical credentials.
• Attack your own agents by planting malicious content where they read, then turn findings into runtime guardrails.

The post is vendor material, and the scan figures are the company's own. Even so, its core advice, to keep a current inventory and recheck it whenever something changes, applies to any team running agents.