Tencent's AI-Infra-Guard turns agent skills into a CVE-style attack surface

Tencent’s Zhuque Lab has open-sourced AI-Infra-Guard, a full-stack AI red-teaming platform that treats the agent ecosystem the way traditional security treats a network: as a surface to fingerprint, probe, and patch. The project, which reached v4.5.2 on August 17, bundles five scanning engines: Agent Scan, Skills Scan, MCP Server scan, AI infrastructure vulnerability scan, and LLM jailbreak evaluation. It ships under the Apache 2.0 license with Docker deployment, a web UI, and CLI tools that slot into CI/CD pipelines.

The most striking part is not the jailbreak evaluation, which every lab now offers. It is the infrastructure scanner. A.I.G fingerprints live AI services and matches them against a vulnerability library that has grown to over 2,000 CVE rules across more than 100 AI framework components, including Ollama, ComfyUI, vLLM, n8n, and Triton Inference Server. The v4.5.2 release notes a vuln library expanded to 2000+ CVE rules, and the June 25 release added six new llama.cpp CVE rules alongside MCP threat detection for tool poisoning, credential exfiltration, and command injection.

This is the first serious attempt to bring the CVE regime, the decades-old vulnerability-identification system that underpins enterprise patching, to the AI software stack. The implications for builders are direct: if you run vLLM or ComfyUI on an exposed port, Tencent now maintains a public, continuously updated list of known flaws in those components, and a free tool to check your deployment against it.

The skill layer is the new attack surface

The most forward-looking piece of A.I.G is Skill Scan, the engine that audits agent skills, the packaged capabilities that LLM agents load at runtime. The v4.5.0 release introduced a nine-category risk taxonomy, SkillTrustBench T01 through T09, covering skill instruction hijacking, memory poisoning, remote payload download and execution, embedded malicious code, privilege escalation, system persistence, tool hijacking and spoofing, insecure dependencies, and insecure coding practices.

Tencent reports benchmark scores from aig-skill-scan on SkillTrustBench. Claude Opus 4.6 tops the list with an F1 of 0.9848, followed by GLM 5.1 at 0.9836, Gemini 3.5 Flash at 0.9792, Kimi 2.6 at 0.9780, and DeepSeek v4 Flash at 0.9740. The scanner runs as a standalone CLI via pip install aig-skill-scan, takes a local skill directory, and outputs a JSON report aligned to the T01–T09 taxonomy. It is designed for enterprise CI/CD integration, which means skill security checks can run on every commit, the same way SAST tools run on code.

The v4.5.2 release adds two notable defenses: .pyc bytecode bypass detection, which catches attackers hiding malicious code in compiled Python files, and charset smuggling defense, which catches encoding tricks that hide payloads from text-based scanners. It also names a new research project, SkillJack, and a new skill category for agent red-team assessment.

The v4.5.1 release added four multi-turn jailbreak attacks to the evaluation suite: Many-Shot, PAIR, GOAT, and ActorAttack. Multi-turn matters because single-turn jailbreaks are largely a solved problem for frontier models; the interesting failures now come from conversation-length manipulation, where an attacker slowly steers a model across many exchanges.

MCP is where the real risk concentrates

The MCP Server scan is the piece most worth watching. MCP, the Model Context Protocol, is the emerging standard for connecting LLMs to external tools and data. Tencent’s scanner detects 14 major categories of security risk across MCP servers and agent skills, and it can scan from source code or remote URLs without requiring a running instance.

The v4.5.2 dynamic-mode fix is telling: it adds RCE prevention via tool whitelisting. That phrasing suggests the scanner found, and now blocks, remote code execution paths in MCP servers running in dynamic tool-loading mode. The June release’s tool poisoning and credential exfiltration rules point the same direction: MCP servers are becoming a prime target because they sit between the model and the outside world, and a compromised MCP server can exfiltrate data or execute commands with the privileges of the host process.

The project also integrates with OpenClaw, the open-source agent platform, via a scanner skill installable from ClawHub. That integration is significant. It means security scanning is no longer a separate step; it becomes a skill the agent itself can invoke. An agent can scan its own toolchain before executing a task.

What this means for the AI economy

Tencent’s move signals a maturing of the AI security market. The company’s Zhuque Lab, founded in 2019 under the Tencent Security Platform Department, has helped major vendors including NVIDIA, Google, and Microsoft with offensive and defensive research. Now it is commoditizing that expertise into an open-source tool that any enterprise can run.

The business logic is clear. AI infrastructure vendors like vLLM and Ollama are racing to ship features, and security often lags. Tencent is positioning itself as the neutral auditor of that ecosystem, the one maintaining the canonical list of AI-specific vulnerabilities. That is a powerful position. The CVE system, run by MITRE, became the backbone of enterprise security because everyone agreed on the numbering. Tencent is effectively trying to bootstrap a similar regime for AI components, with SkillTrustBench as the evaluation standard and A.I.G as the reference scanner.

There are caveats. The project README notes it lacks authentication and should not be deployed on public networks. The Pro version at aigsec.ai requires an invitation code, suggesting the hosted offering is gated for now. And the project asks for GitHub stars to accelerate iteration, a reminder that this is still an early-stage community effort.

But the direction is unmistakable. Agent skills and MCP servers are becoming a new class of software supply chain, and Tencent is building the tooling to inspect that chain. The 2,000+ CVE rules, the nine-category skill taxonomy, the four multi-turn jailbreak attacks, the 0.9848 top F1 score on SkillTrustBench: these are concrete numbers that mark the beginning of AI security as an engineering discipline rather than a research curiosity.

For builders, the practical takeaway is to run the scanner against your own stack. The Docker image spins up in minutes, the skill-scan CLI drops into a pipeline, and the MCP scan works against a URL with no running instance. The tool is free, the rules are open, and the taxonomy is becoming a de facto standard.

The open question is whether the CVE-style model scales to the agent world. Traditional CVEs work because software versions are discrete and patchable. Agent skills are often distributed as opaque packages, loaded dynamically, and updated without versioning discipline. Tencent’s .pyc bytecode bypass detection and charset smuggling defense show the attackers are already one step ahead. The race between skill-level exploits and skill-level scanners is now public, and Tencent has picked a side.