ESET published a look at where small and mid-sized businesses actually stand on AI, and the headline number is blunt: of 4,400 SMB decision makers surveyed, 40 percent had no AI policy at all. Paired with that is the other half of the story, the add-on ecosystem those businesses are installing from. ESET scanned close to 900,000 AI agent skills and found more than 25,000 suspicious and more than 3,000 outright malicious.
What an AI skill is, and why a bad one matters
A skill (you may also see them called plugins, extensions, connectors or tools) is an add-on that gives an AI assistant an ability it does not have on its own: read a folder, query a database, send an email, run a command. Somebody on your team installs one because they want a feature. The skill then inherits whatever the assistant can already reach. ESET catalogued malicious capabilities including command execution, file access, downloading third-party tools, loading credentials, code injection and deliberate obfuscation to hide what the skill is doing.
Worth being precise about the numbers: the skill-scanning figures come from ESET's H1 2026 Threat Report, not from fresh September telemetry. What is new is the framing around small businesses. The growth trend in that report is the part that should get attention. Between March and May 2026 the number of unique skills scanned went from about 60,000 to nearly 900,000, and the malicious ones went from roughly 600 to more than 3,000. This is a supply chain forming in real time, with the usual consequence: most of it is fine, some of it is not, and nobody is checking on your behalf.
Why the 40 percent is the number that matters
A malicious plugin is a technical problem with a technical answer. No policy is an organizational problem, and it is the one that makes the technical problem inevitable. Without a policy there is no list of approved tools, so nobody notices a new connector. There is no rule about what may be pasted into a chat window, so client data goes in. There is nobody who signs off, so an assistant ends up with standing access to a mailbox because that was the easiest way to make it work. This is the same shape as the shadow AI problem we keep running into: the tools arrive before the decisions do.
What to actually do
- Write one page. Approved tools, what must never go into them, who approves a new one, and what happens if something goes wrong. A short policy people read beats a long one they do not.
- Approve connectors, not just tools. Saying yes to an assistant is not the same as saying yes to every add-on someone bolts onto it. Treat each skill as a separate decision.
- Install from somewhere accountable. Prefer a vendor's own marketplace over a link in a forum post, and check who publishes a skill before you grant it access to anything.
- Scope the access. Give an assistant its own account with the narrowest permissions that make it useful, rather than plugging it into an administrator login.
- Review the list quarterly. Connectors accumulate the way browser extensions do. Deleting the ones nobody uses is fifteen minutes well spent.
- Tell people about prompt injection. If an assistant reads a web page, a document or an email, instructions hidden in that content can try to steer it. Staff should know that an assistant can be tricked.
The takeaway
Nobody needs a governance department to close this gap. The businesses that get burned are not the ones with imperfect policies, they are the ones with no answer at all to what are we allowed to use and what can it reach. That answer fits on a page, and writing it is the cheapest security work available to a small business right now.