The security architecture of AI agents is facing a fundamental challenge: the trust-through-defaults model. As developers increasingly rely on autonomous coding agents like Claude Code, Gemini, and ChatGPT to streamline workflows, these tools are being weaponized in a campaign codenamed FakeGit. This technique, termed AgentBaiting, exploits the agents’ propensity to autonomously discover and recommend external repositories.
According to Island, the operation involves approximately 7,600 malicious GitHub repositories, with over 800 specifically posing as AI Skills or MCP servers. These repositories are supported by roughly 6,600 profiles and have generated over 14 million downloads across approximately 200 repositories. The attack chain is sophisticated: the fake repositories deliver a malicious ZIP file containing a LuaJIT loader, which then executes SmartLoader. This loader utilizes a Polygon smart contract for command-and-control communication, ultimately deploying the StealC info stealer.
The attack is not limited to GitHub. Over 600 listings have been identified across public registries such as LobeHub, Glama, MCP.so, and MCP Market. These registries inadvertently amplify the threat by mirroring the malicious READMEs, thereby carrying the harmful download links onto additional platforms. This creates a feedback loop where the agent’s discovery process is fed by a poisoned ecosystem of registries that appear authoritative.
Empirical testing confirms the efficacy of this baiting technique. When prompted, Claude Code identified a malicious cinematic prompt skill repository and recommended installation steps to the user. Similarly, both Gemini and ChatGPT recommended the same malicious Walmart MCP server as a top pick for the requested task. These results demonstrate that the agents are prioritizing discovery and utility over rigorous security validation.
This development represents a significant escalation in AI supply chain security. It builds upon earlier patterns of agent trust model failures. Straiker AI (Feb 2026) flagged trojanized MCP servers spreading SmartLoader and StealC. Derp.ca analyzed the LuaJIT samples associated with FakeGit, while Trend Micro previously attributed similar operations to the threat actor ‘Water Kurita,’ who utilized Lumma Stealer. These incidents connect to the broader pattern observed in ChatMate RPE, Langflow, Unit 42 DeepSeek, PleaseFix, and the Azure SRE Agent – all trust model failures where agents inherit risk from the systems they connect to.
As Island noted, “FakeGit did not need to breach anything. It published convincing repositories, borrowed real developers’ identities, spread its listings across public registries, and let discovery do the rest.” This observation underscores a structural shift: discovery itself has become the primary attack vector. The reliance on autonomous agents to navigate and integrate external code creates a new surface area where the agent’s own utility is used against the user.
For security professionals, mitigating this risk requires a shift in defensive posture. Organizations should build a catalog of reviewed and approved Skills and MCP servers. Sandbox testing is essential for any new integration, and publishers must be rigorously verified. Furthermore, security teams should monitor agent download and install paths, and be prepared to isolate and revoke access if SmartLoader activity is suspected. Crucially, because StealC harvests live sessions – including browser cookies, OAuth grants, and SSH credentials – simple password resets are insufficient to remediate a compromise.
The AgentBaiting phenomenon marks a transition from traditional phishing to automated, agent-native exploitation. As the ecosystem matures, the security of the discovery process will become as critical as the security of the code itself.