The AI tooling ecosystem just hit a supply-chain landmine. Researchers at Island uncovered nearly 7,600 malicious GitHub repositories, over 800 of them disguised as AI Skills or Model Context Protocol (MCP) servers, spreading SmartLoader malware in a campaign they're calling FakeGit. And here's the twist: you don't even need to be fooled by the repo yourself. AI agents can be fooled on your behalf.
This is a new class of attack. It doesn't exploit a code vulnerability. It exploits trust in the AI agent you delegated discovery to.
How FakeGit Works
The mechanics are deceptively simple. Attackers created around 6,600 GitHub profiles that published repositories mimicking legitimate AI integrations — Gmail helpers, WhatsApp connectors, Databricks tooling, Jenkins pipelines, Docker automation. Each included convincing READMEs, borrowed legitimate developer identities, and ZIP archives loaded with SmartLoader.
When a developer (or an AI agent) discovers the repo and follows installation instructions, the ZIP triggers a LuaJIT loader chain that executes an obfuscated script, drops SmartLoader, and then deploys StealC — an infostealer that harvests browser credentials, crypto wallets, session tokens, and system data.
As of July 2026, the operation had accumulated over 14 million downloads across GitHub Release assets. That's not a small phishing run. That's industrial-scale deception.
AgentBaiting: The AI-Powered Evolution
This is where FakeGit gets genuinely novel. Island researchers tested whether AI coding agents could be tricked into discovering and recommending these malicious repos without any human prompting toward a specific malicious link.
They could. Claude Code, Google Gemini, and OpenAI ChatGPT all surfaced malicious FakeGit repositories autonomously when asked general-purpose prompts like "Find a free Walmart MCP server" or "give me installation instructions for a Claude cinematic prompt skill."
The term they gave it: AgentBaiting. An AI agent, acting on your behalf, goes searching for a tool, stumbles on a malicious repo, reads the attacker's README as legitimate documentation, and passes the attacker's instructions directly to your execution environment. No human ever inspected the source. No human ever noticed the red flags. The agent did exactly what it was asked to do, and the malware rode right through.
Supply Chain Meets AI Registry
The campaign didn't stay on GitHub. Over 600 listings from the operation were flagged across public MCP and Skill registries: LobeHub, Glama, MCP.so, and MCP Market. These registries aggregate and surface AI capabilities to developers and agents alike. By flooding them with polished lures, the attackers built a false sense of legitimacy that compounded the GitHub deception.
This is the supply chain problem, remixed for the AI era. Instead of poisoning npm packages, you poison the discovery pipeline that feeds AI agents and the developers who use them.
What Your Team Should Do Now
Catalog your AI tooling. If your developers or agents are pulling MCP servers or AI Skills from public registries without review, you have an open door. Build an internal registry of reviewed and approved capabilities.
Sandbox agent discoveries. Any AI agent that surfaces a new tool, repo, or integration should trigger a sandboxed evaluation before anything touches production code or credentials.
Verify publishers and projects. Look beyond the README. Check contributor history, cross-reference profiles, verify commit patterns. FakeGit's profiles were convincing at a glance but collapsed under light scrutiny. The problem was, nobody scrutinized.
Monitor agentic pathways. Log what your agents discover, recommend, and execute. Anomaly detection here isn't about code signatures. It's about behavioral patterns that don't match legitimate discovery workflows.
The Bottom Line
FakeGit didn't breach anything. It didn't exploit a zero-day. It published convincing repositories, copied real developers' identities, spread across public registries, and let discovery do the rest. The AI agents, eager to help, did the delivery work.
This is the shape of attacks to come. Not exploits against models, but exploits through models — using their helpfulness, their autonomy, and their access to your toolchain as the attack surface.
Treat your AI agent's recommendations the same way you'd treat a stranger's USB drive found in the parking lot. The era of blind trust in AI-assisted discovery is over.