AgentBaiting Attack: How 7,600 Fake AI Repositories Turned MCP Servers Into Malware Delivery Systems

AgentBaiting: The New AI Supply Chain Threat Targeting Developers and AI Agents

Artificial intelligence is changing how software is discovered, installed, and integrated into enterprise environments. Developers and organizations increasingly rely on AI agents, MCP servers, and reusable AI Skills to automate workflows, connect business systems, and extend the capabilities of AI assistants.

However, this rapidly growing ecosystem has introduced a new security challenge. Attackers are now targeting the AI capability supply chain by creating fake tools that appear legitimate but secretly deliver malware.

Security researchers at Island uncovered a large-scale campaign known as FakeGit, where thousands of malicious GitHub repositories were created to distribute SmartLoader malware. The campaign represents a major shift in cyber threats because attackers are no longer targeting only users. They are also targeting the AI agents that help users discover and install software.

Researchers identified a new technique called AgentBaiting, where malicious repositories are designed to deceive AI assistants by appearing as legitimate documentation, installation guides, and software recommendations.

An AI agent searching for an MCP server or Skill may discover an attacker-controlled repository, interpret the README instructions as trustworthy documentation, and pass those instructions to the user.

The result is a new attack path where AI systems designed to improve productivity can unintentionally become part of the malware delivery process.

FakeGit Brings Malware Into the AI Capability Supply Chain

The FakeGit operation demonstrates how traditional software supply chain attacks are evolving around artificial intelligence workflows.

Researchers identified approximately 7,600 malicious GitHub repositories connected to the campaign. These repositories were created through thousands of attacker-controlled profiles, with many specifically designed around AI tools, AI agents, and automation workflows.

More than 800 repositories attempted to impersonate AI Skills or MCP servers, targeting both individual developers and enterprise users. The fake tools claimed to provide integrations for popular business platforms, developer environments, cloud services, databases, and productivity applications.

The campaign gained additional visibility by appearing across public AI registries and catalogs. Researchers discovered more than 600 campaign-related listings across AI capability platforms, allowing malicious repositories to appear alongside legitimate tools.

Attackers also benefited from GitHub's download visibility. More than 14 million downloads were measured across campaign-related release assets, although the actual number may be higher because many malicious ZIP files were embedded directly inside repositories where public download statistics were unavailable.

The AI-focused campaign grew rapidly during early 2026, reaching its peak in April when hundreds of AI-related repositories were created.

Instead of creating obviously suspicious malware, attackers created tools that looked useful. They copied the naming patterns and structures of legitimate projects, created realistic descriptions, and positioned repositories around common enterprise tasks. This made malicious packages more likely to appear during normal software discovery.

FakeGit Used Thousands of Fake Developer Profiles

The FakeGit campaign was not built around a small number of malware repositories. Researchers found that the operation involved approximately 7,600 malicious GitHub repositories created by around 6,600 attacker-controlled profiles.

Among these profiles, approximately 1,400 were linked to AI tools, agents, or workflow automation projects, showing that attackers deliberately adapted their strategy to the growing AI ecosystem.

The campaign relied heavily on fake credibility signals. Attackers created repositories with professional descriptions, realistic documentation, and developer identities designed to look similar to legitimate contributors.

This approach allowed malicious projects to blend into normal software discovery workflows.

How FakeGit Delivered SmartLoader Malware Through Fake AI Tools

The success of FakeGit depended on creating trust before delivering malware.

Attackers used multiple layers of deception. They copied legitimate project structures, created developer accounts that resembled real users, and published detailed README files explaining how to install and configure fake tools.

The goal was simple: make malware execution appear like a normal software installation process.

One example involved a fake repository designed to resemble a popular Claude Skills collection. The malicious project copied the naming style and positioning of a legitimate repository, making it appear familiar to users searching for AI capabilities.

The repository README directed visitors toward a downloadable ZIP file. Instead of containing a useful AI Skill, the package contained SmartLoader malware.

The same approach appeared across fake MCP servers targeting enterprise platforms. Repositories claimed to provide integrations for databases, developer tools, cloud systems, and productivity platforms.

The attackers understood that organizations are actively searching for automation tools that connect AI assistants with existing workflows. By matching these expectations, malicious repositories appeared relevant and useful.

Attackers Used Lookalike Projects and Developer Identities

FakeGit repositories often copied the names and structures of legitimate projects to appear trustworthy.

One example involved a fake Claude Skills repository that imitated the naming style and positioning of a popular open-source collection. The malicious repository gained visibility by looking familiar to developers searching for AI extensions.

Attackers also created lookalike developer accounts by slightly modifying usernames from established contributors.

In one case, a campaign profile closely resembled a legitimate developer account by changing only a single character in the username. This technique increased the chance that users would mistake the malicious profile for the original creator.

Inside the Malicious ZIP Files

The downloaded packages did not contain genuine AI integrations or MCP server implementations.

Instead, researchers found a consistent malware structure designed to hide the real purpose of the files.

A typical malicious package contained:

• A small launcher script

• A renamed Lua runtime

• An obfuscated payload hidden inside a disguised file

One investigated package contained three files:

application.cmd

luau.exe

ico64.txt

The launcher executed the Lua runtime and loaded the hidden payload stored inside the text file. Although the file appeared to be a normal resource or configuration file, it contained malicious code.

This technique helped the malware avoid suspicion because the package looked different from traditional executable malware.

After execution, SmartLoader established persistence on the infected system and retrieved additional malware components.

The final payload delivered StealC, an information-stealing malware designed to collect sensitive data from compromised devices.

StealC can target:

• Browser passwords

• Cookies and active sessions

• Browser extension data

• Email credentials

• Remote access credentials

• Screenshots

• System information

The malware chain itself was familiar. The dangerous change was the method used to convince users and AI systems to deliver it.

AgentBaiting: How Attackers Are Manipulating AI Agents

Traditional malware campaigns usually depend on convincing humans to click malicious links or download suspicious files.

AgentBaiting changes this model.

AI agents can independently search online resources, evaluate repositories, and recommend tools based on available information. Attackers are now creating content specifically designed to influence these AI-driven discovery processes.

A malicious repository does not need to directly target a person if an AI agent discovers it first. The agent may read the repository README, interpret installation instructions as legitimate, and present those instructions to the user.

This creates a new attack path where attacker-controlled documentation can become part of an AI assistant’s decision-making process.

Researchers tested this behavior with several AI assistants, including Claude Code, Gemini, and ChatGPT.

The results showed that malicious repositories could appear during normal searches without users directly providing links.

In some cases, AI systems correctly identified suspicious content. However, researchers also observed situations where malicious repositories appeared as potential recommendations or where attacker-written installation instructions were repeated.

The security challenge is not only whether an AI model can detect every malicious repository. The larger issue is that even occasional failures can create a path to malware execution when attackers operate thousands of fake projects.

AI Agents Discovered Malicious Repositories Without Direct Links

One of the most important findings from the research was that AI assistants did not require users to provide malicious URLs.

Researchers tested AI coding assistants by asking them to find free AI capabilities.

During these tests:

• Claude Code discovered campaign-related repositories during searches for AI Skills.

• Gemini returned a malicious MCP server repository when asked for a free Walmart MCP server.

• ChatGPT also surfaced the same malicious repository among available options.

The researchers noted that AI systems sometimes detected suspicious content, but the ability to independently discover attacker-controlled resources created a new security concern.

The problem was not only malware detection. The larger issue was that AI agents could become a bridge between malicious content and users.

AI Assistants Exposed to Malicious Recommendations

Researchers tested AI assistants using requests for free AI Skills and developer tools.

When searching for a Claude-related Skill, the assistant discovered both legitimate and malicious repositories. While it selected a legitimate option in some cases, it also identified the malicious repository as a possible alternative and repeated parts of the attacker’s installation guidance.

Similar behavior appeared during MCP server searches.

A request for a free Walmart MCP server resulted in a malicious repository being presented as a recommendation. The repository claimed to provide an open-source integration but contained a SmartLoader malware package.

ChatGPT also encountered the same malicious repository during testing and listed it among available options.

These examples demonstrate how AgentBaiting takes advantage of a fundamental challenge in AI-powered discovery: AI systems rely on available information sources, and attackers can manipulate those sources.

The threat is not limited to one AI assistant or one platform. Any system that searches public repositories, registries, or documentation sources can potentially encounter manipulated content.

Malicious MCP Servers Spread Through Public Registries

The attack expanded beyond GitHub.

Researchers discovered more than 600 malicious listings across public MCP and AI Skill registries, including platforms that help developers discover reusable AI capabilities.

These listings increased the visibility and perceived legitimacy of malicious repositories.

Some registries reproduced repository descriptions and installation instructions, unintentionally helping attackers distribute their content.

This created a multi-layer trust problem:

• A developer sees a registry listing.

• The registry references GitHub.

• The GitHub documentation appears professional.

• An AI assistant may recommend the same resource.

Each layer can make a malicious tool appear more credible.

The attack demonstrates a broader challenge for the AI ecosystem: traditional trust signals such as stars, documentation, and public listings may not be enough in AI-driven software discovery.

Enterprise Workflows Became the Main Target

The malicious AI repositories were not random experiments. Many were designed around real enterprise workflows.

Attackers created tools that appeared relevant to:

• Business data integrations

• Cloud services

• Database connections

• Software development workflows

• Security operations

• Automation platforms

A fake database connector, AI coding assistant, or enterprise automation plugin could appear valuable because it matched real workplace needs.

The attackers did not need the fake tool to provide the promised functionality. Their objective was to convince users or AI agents to execute the package.

Once SmartLoader gained access to a device, it could target credentials, active sessions, browser data, and other sensitive information.

How Organizations Can Defend Against AgentBaiting Attacks

The rise of AI agents requires organizations to rethink how they manage software discovery and installation.

Security teams need visibility into the complete AI capability lifecycle, from discovery to execution.

Organizations should maintain trusted catalogs of approved AI Skills, MCP servers, and agent plugins that have been reviewed before deployment.

Every new AI capability should be tested in isolated environments before being connected to enterprise systems.

Security teams should verify the source behind every tool, including:

• Repository ownership

• Developer identity

• Package history

• Software signatures

• Download behavior

• Required permissions

Organizations should also monitor AI agent activity.

When an AI assistant downloads software, modifies configuration files, or installs new capabilities, those actions should receive the same security attention as traditional user activity.

Maintaining an inventory of AI capabilities, versions, repositories, and hashes can help organizations quickly identify exposure when new campaigns emerge.

If SmartLoader infection is suspected, organizations should immediately isolate affected devices and revoke active sessions, API tokens, OAuth permissions, and cloud credentials.

Because information-stealing malware can capture active browser sessions, changing passwords alone may not be enough.

Why AgentBaiting Represents a New Security Era

Traditional software supply chain attacks focused on compromising packages, dependencies, and developer tools.

AgentBaiting introduces a new layer: the AI-assisted discovery process itself.

Attackers are no longer only trying to place malware where humans will find it. They are creating content designed to influence the systems that help humans make decisions.

As AI agents become more autonomous, security teams will need to evaluate not only what software users install, but also what recommendations AI systems generate.

The future security challenge will involve protecting the relationship between:

AI Agents → Software Discovery → Human Decisions → Enterprise Execution

Protecting the Future AI Capability Supply Chain

FakeGit demonstrates how quickly attackers adapt to emerging technology ecosystems.

The AI capability marketplace is becoming a new software distribution channel, and attackers are already attempting to manipulate it.

AgentBaiting introduces a new security challenge because AI systems can unintentionally amplify malicious content.

As organizations increasingly depend on AI agents, MCP servers, and automation tools, security teams must protect the entire journey:

Discovery → Recommendation → Installation → Execution

The future of AI security will depend not only on protecting models but also on securing everything those models interact with.

As AI agents become increasingly involved in software discovery and automation, protecting the AI capability supply chain will become a critical part of enterprise cybersecurity strategy.