AgentBaiting is the clearest sign yet that AI agents and their capability ecosystems have become a first‑class malware delivery surface, with FakeGit’s 7,600‑repo operation pushing SmartLoader and StealC directly into AI Skills and MCP workflows.
By turning agent‑readable READMEs, public AI registries, and GitHub trust signals into a weaponized “AI capability supply chain,” attackers now let agents not just humans walk victims to execution.
The latest wave comprises around 7,600 malicious GitHub repositories created by roughly 6,600 accounts, with about 1,400 tied to AI tools, agents, or workflows and over 800 explicitly posing as AI Skills or MCP servers.
These AI‑branded repositories span both individual and enterprise use cases, from Gmail and WhatsApp automation to Databricks, Jenkins, and Docker connectors, mirroring legitimate AI‑augmented workflows inside modern organizations.
The campaign’s reach extends well beyond GitHub search. Island reports more than 14 million measured downloads across GitHub Releases in roughly 200 campaign repositories, with high‑volume projects like Zilts345890/Golang-html-parsing, MRX-slayer/ai-resume-parser, and huizuohaode/AI-Image-Generator driving six‑figure download counts alone.
These figures undercount the true exposure, because thousands of additional repositories embed malicious ZIPs directly in the code tree where download metrics are not publicly visible.
At the core of FakeGit’s AI wave is the same SmartLoader‑based chain already seen in earlier GitHub‑borne campaigns that delivered StealC and other infostealers.
Repositories are cloned or fabricated to resemble popular tools, then fronted by convincing developer profiles and READMEs that treat SmartLoader payloads as routine installers.
Islands’ findings align with prior SmartLoader activity where compressed archives in GitHub projects unpack launcher scripts, a LuaJIT‑style runtime, and heavily obfuscated Lua payloads that ultimately stage StealC.
StealC itself is a mature infostealer, documented by multiple vendors as targeting browser credentials, cookies, sessions, email and remote‑access logins, wallet data, and host telemetry, with a particular focus on high‑value developer and cloud credentials.
Earlier SmartLoader campaigns already weaponized trojanized MCP servers such as cloned Oura Ring integrations to drop StealC into developer environments, highlighting how MCP and AI tooling bridges directly into production‑adjacent data and secrets.
Island’s research said in a report shared with GBhackers, traces FakeGit as a long‑running SmartLoader distribution operation that has pivoted from generic developer lures into the AI capability ecosystem.
AgentBaiting Uses Fake AI Skills
What makes this wave notable is not just the payload but the path: AgentBaiting describes how FakeGit turns AI agents into the delivery mechanism.
GitHub creation dates show it building through March and peaking in April 2026, when nearly 300 AI-related repositories were created.
Island’s testing shows that tools like Claude Code, Gemini, and ChatGPT can autonomously discover malicious Skills and MCP servers by following normal search and registry flows, then treat attacker‑written READMEs as legitimate documentation and surface their installation steps to users.
This behavior mirrors broader concerns about “agentic AI” where autonomous agents, given tool access and internet search, struggle to distinguish benign from poisoned instructions and can be driven into executing adversarial playbooks.
Crucially, AgentBaiting doesn’t require explicit social engineering in the prompt. An agent asked to “find a free cinematic prompt Skill” or a “free Walmart MCP server” can legitimately land on FakeGit repositories that have already been indexed by public Skill and MCP registries, then elevate them as recommended starting points.
In parallel, prior SmartLoader operations show the same trust‑engineering pattern: cloned GitHub projects, manufactured stars and forks, fake contributor networks, and submissions to legitimate registries to ensure that every familiar trust signal points in the wrong direction.
current command server through a value stored in a Polygon smart contract, establish persistence through scheduled tasks under %LOCALAPPDATA%, and retrieve encrypted stages from GitHub.
AgentBaiting succeeds in part because public AI capability registries treat GitHub as an implicit root of trust.
Island observed more than 600 campaign entries across registries like LobeHub, Glama, MCP.so, and MCP Market, many of which re‑publish the repository README including raw download links and attacker‑controlled installation sequences.
This pattern closely resembles earlier AI supply‑chain incidents where trojanized MCP servers were submitted to legitimate catalogs, allowing them to sit alongside authentic integrations and accumulate credibility over time.
In effect, FakeGit has transformed the AI capability supply chain into a new enterprise attack surface: a mesh of Skills, MCP servers, plugins, and connectors whose trust is derived almost entirely from GitHub presence, registry listing, and shallow reputation metrics.
As other researchers have warned in adjacent campaigns, that emerging surface is poorly instrumented by traditional controls SIEMs, DLP, and vulnerability scanners rarely inventory MCP servers or watch what AI assistants connect to, even as those connectors gain direct access to cloud tokens, build pipelines, and production data paths.
Defending against AgentBaiting and FakeGit‑style SmartLoader distribution requires treating AI capabilities as supply‑chain artifacts rather than convenience plugins.
Island and other vendors converge on several practical priorities: build curated, security‑reviewed catalogs of Skills, MCP servers, and agent plugins; evaluate new AI capabilities in isolated environments where browser sessions.
SSH keys, and cloud credentials are unavailable; and reject any “capability” that arrives as an opaque executable or ZIP with a launcher, runtime, and disguised payload instead of transparent source and manifests.
Organizations should verify publishers, not just projects; treat registry listings as neutral, not positive, signals; monitor agent‑initiated downloads, git operations, and MCP configuration changes as rigorously as human‑initiated actions.
An inventory of all AI capabilities in use, including source repository, version, and hash, so newly identified campaign repositories can be matched and eradicated quickly.
As FakeGit and AgentBaiting demonstrate, the attack surface is no longer just the model it is every Skill, MCP server, and agent workflow that stands between development teams and the systems they control.
𝗔𝗜 𝗦𝗢𝗖 𝘃𝘀 𝗠𝗗𝗥 𝘃𝘀 𝗠𝗦𝗦𝗣 Which is Best in 2026? Compare costs, Automation, and response: Download Free Guide
