Your AI coding agent just recommended a malicious repository. It read the attacker’s README as legitimate documentation, handed you the installation instructions, and never flagged a thing. Welcome to agentbaiting — the supply chain attack designed specifically for the age of AI-assisted development.
On 20 July 2026, researchers at Island published findings on FakeGit, a campaign that weaponised roughly 7,600 GitHub repositories and 6,600 fake developer profiles to distribute SmartLoader malware. What makes FakeGit different from prior supply chain attacks is not just its scale — 14 million downloads and counting — but its attack vector. Over 800 of those repositories posed as AI skills or Model Context Protocol (MCP) servers, and they were specifically designed to be discovered and recommended by AI agents.
TL;DR
- The FakeGit campaign created 7,600 malicious GitHub repositories — over 800 disguised as AI skills or MCP servers — to deliver SmartLoader malware and the StealC information stealer.
- A new technique called “agentbaiting” targets AI coding agents (Claude Code, Gemini, ChatGPT) which autonomously discover and recommend malicious repositories without ever being shown a link.
- Attackers listed fake tools across 600+ entries in public registries like LobeHub, Glama, and MCP.so, poisoning the discovery pipeline AI agents rely on.
- Traditional supply chain defences (lockfiles, SCA scanners, code review) do not cover the agent discovery-to-execution chain.
- Development teams need curated internal catalogues, sandboxed evaluation, and agent-specific governance to close this gap.
What Is Agentbaiting?
Traditional supply chain attacks rely on developers finding and installing a malicious package. Typosquatting, dependency confusion, and star-jacking all target human decision-making. Agentbaiting flips this: the target is the AI agent itself.
When a developer asks their coding agent to “find a free cinematic prompt skill” or “recommend an MCP server for Walmart integrations,” the agent searches public repositories and registries. It reads README files as documentation. It parses installation instructions as authoritative. And because attacker-controlled repositories are designed to look legitimate — copied layouts, convincing descriptions, profiles that differ by a single character from real developers — the agent recommends them alongside genuine tools.
Island’s researchers tested this against Claude Code, Google Gemini, and OpenAI ChatGPT. All three surfaced malicious FakeGit repositories “without ever being shown a link.” Claude Code, in some cases, recommended the malicious option alongside step-by-step installation instructions for downloading executables. Gemini and ChatGPT both recommended the same fake Walmart MCP server as their top pick.
The Anatomy of the FakeGit Campaign
The numbers are staggering, but the methodology is what should concern development teams most.
Scale and Sophistication
The campaign operated across roughly 7,600 repositories tied to 6,600 fraudulent GitHub accounts. Around 1,400 of those accounts were built specifically around AI tools, agents, and workflows. The fake repositories spanned everything from Gmail and WhatsApp integrations to enterprise tooling for Databricks, Jenkins, and Docker.
Attackers did not create these repositories from scratch. They copied legitimate projects — in one case, mirroring a repository with over 67,000 stars — and created developer profiles that differed from real handles by a single character. The READMEs were polished and convincing.
Registry Poisoning
What sets FakeGit apart from earlier GitHub-based campaigns is its use of public AI registries. The fake MCP servers and skills appeared more than 600 times across LobeHub, Glama, MCP.so, and MCP Market. These are the registries that AI agents query when searching for capabilities. By poisoning them, the attackers ensured their repositories would surface in agentic discovery flows — not just in manual GitHub searches.
The Malware Chain
The payload delivery follows a LuaJIT loader chain. Victims download a ZIP archive from a GitHub Release asset. Inside, an obfuscated Lua script deploys SmartLoader, which establishes persistence and then installs StealC — an information stealer that harvests credentials, active browser sessions, OAuth grants, API tokens, and cloud credentials. Crucially, StealC captures live sessions, which means password resets alone are insufficient for remediation. Compromised teams must revoke all active sessions, tokens, and grants.
Why Traditional Defences Miss This
Most development teams have invested in supply chain security over the past few years: lockfiles, software composition analysis (SCA), signed commits, and code review. These are necessary. They are also insufficient for agentbaiting.
The gap is in the discovery-to-execution chain. SCA scanners analyse dependencies after they are installed. Code review catches problems after code is written. But agentbaiting operates upstream of both — at the point where a developer or agent decides what to install. If your agent recommends a malicious MCP server and you follow its instructions, the malware executes before any of your existing safeguards engage.
This is not a theoretical concern. The FakeGit campaign logged 14 million downloads. The repositories appeared in legitimate registries. And frontier AI models from three major providers all failed to distinguish the fakes from the real thing.
What Your Development Team Should Do Now
1. Build an Internal Catalogue of Approved Tools
Do not rely on AI agents to discover MCP servers, skills, or plugins from public registries. Maintain a curated, reviewed catalogue of approved tools. This is the single most effective defence — it removes the discovery vector entirely.
2. Sandbox Before You Ship
Evaluate every new agent capability in a sandboxed environment before rolling it out. This means isolated containers or VMs, not just a staging branch. Monitor network calls, file system changes, and process spawning during evaluation.
3. Verify Publisher Identity
Before trusting any repository, verify the publisher. Check account age, contribution history, and cross-reference with known maintainers. A polished README and a familiar-looking username are not verification — they are exactly what attackers optimise for.
4. Constrain Your Agents
If your team uses AI coding agents, configure them to operate within defined boundaries. Restrict which registries agents can query. Disable autonomous installation of dependencies. Require human approval before any agent-recommended tool is added to the project.
5. Incident Response for SmartLoader
If you suspect SmartLoader execution on any endpoint, isolate the machine immediately. Then revoke — do not merely reset — all active browser sessions, OAuth grants, API tokens, and cloud credentials associated with that machine. StealC captures live sessions, so credential rotation without session revocation leaves you exposed.
The Bigger Picture
Agentbaiting is not an isolated technique. It is the logical evolution of supply chain attacks in a world where AI agents mediate an increasing share of developer decisions. We have already seen prompt injection weaponised against agents (indirect prompt injection), memory poisoning used to establish persistent footholds (MemGhost), and configuration files turned into execution vectors (Miasma). FakeGit adds a new dimension: the agent’s discovery layer itself is now an attack surface.
The implication is clear. Every organisation using AI agents in development needs to treat agent governance as a security function, not a productivity concern. The tools your agents recommend, the registries they query, and the instructions they follow — all of these are now part of your threat model.
At REPTILEHAUS, we help development teams build secure, agent-aware workflows — from CI/CD pipeline hardening to AI governance frameworks. If your team is adopting AI coding agents and you are not sure where your exposure lies, get in touch.
📷 Photo by Clint Patterson on Unsplash
