National Internet Emergency Center Announcement: Certain AI Agent Skill Packages Pose Jailbreaking and Mining Risks

Deep Tide TechFlow reports, on June 09, according to an announcement from the National Internet Emergency Center (CNCERT), it was recently discovered that certain AI agent skill packages (Skills) are being publicly distributed under names such as "large model jailbreaking" and "mining for profit." Among them, the skill package "godmode" uses methods like system prompt replacement and input obfuscation to induce large models to bypass security restrictions, potentially leading to permanent user account bans, privacy breaches, and legal liabilities. The skill package "Bonero-Miner" induces agents to download mining programs, with the mined cryptocurrency featuring anonymity characteristics, exposing users to risks of passive involvement in money laundering and other illegal activities. Additionally, prolonged high-load mining can degrade device performance. CNCERT recommends users obtain skill packages only from official channels, adhere to the principle of minimal permissions, and enterprise users should establish a whitelist mechanism for Skills access and implement tiered management for AI agents. This report is technically supported by Tencent, Volcano Engine, Baidu, NSFOCUS, and Qi An Xin.