Executive brief
Tencent AI-Infra-Guard's skill-scan component, which validates AI agent skills for security threats, systematically skips analysis of compiled Python bytecode files (.pyc, .pyo, .pyd). Attackers can distribute skills with harmless visible Python source code alongside malicious compiled bytecode that executes when the skill is imported; the scanner reports the skill as safe, but operators unknowingly install malicious code that runs with operator privileges.
Technical details
The vulnerability is a logic bypass in the skill-scan analyzer's file filtering mechanism. The scanner hardcodes __pycache__ directories and compiled Python extensions (.pyc, .pyo, .pyd) into skip lists across multiple scanning surfaces, assuming these files are not dangerous or will be regenerated from safe source. An attacker can craft a malicious skill package containing benign .py source files (which pass inspection) alongside pre-compiled .pyc files containing arbitrary code. When the skill is installed and imported by an operator, Python loads the compiled bytecode (which is executable code), bypassing the scanner's verdict. Network attack vector requires the skill to be distributed through the platform; no authentication bypass is required if the attacker can inject a skill package or convince an operator to install one.
Affected products
- Tencent AI-Infra-Guard <UNKNOWN>
Timeline
- 2026-09-02: disclosed
- other: CVE-2026-84809 assigned