AI Agents Vulnerable to AgentBaiting

A new wave of malicious activity targeting the software development ecosystem is exploiting the very tools meant to increase productivity. Researchers have identified a large-scale campaign that leverages AgentBaiting, a technique where autonomous AI models are manipulated into discovering and executing malicious code without human intervention.

The Mechanics of FakeGit

The operation, known as FakeGit, centers on a network of approximately 7,600 GitHub repositories created by 6,600 distinct user profiles. By mimicking legitimate developer tools and AI-focused infrastructure, these repositories serve as delivery vehicles for SmartLoader malware. Once a system is compromised, attackers typically deploy the StealC information stealer to harvest sensitive data.

These repositories often contain lookalike profiles and convincing documentation to lure both human developers and automated systems. The attack chain involves a ZIP archive that triggers a LuaJIT loader, ultimately facilitating the execution of obfuscated scripts on the target device.

FakeGit uses copied projects, lookalike developer profiles, convincing READMEs, and malicious ZIP files to deliver SmartLoader malware.

— Oleg Zaytsev, lead security researcher at Island

Automated Compromise via Agents

A critical evolution of this campaign is the ability for AI agents to be deceived during standard search tasks. When a user prompts an AI to find a specific skill or artificial intelligence component, the agent may inadvertently select one of these malicious repositories from public registries. This eliminates the need for attackers to share direct links, as the models discover the lures through natural search workflows.

Testing conducted by Island indicates that several prominent models, including Anthropic Claude Code, Google Gemini, and OpenAI ChatGPT, are susceptible to this manipulation. The agents treat the attacker-provided README files as authoritative documentation, effectively performing the attacker's installation instructions automatically.

Scale of the Campaign

• Total malicious GitHub repositories: 7,600
• Repositories posing as AI skills or MCP servers: 800
• Total malicious GitHub profiles involved: 6,600
• Total recorded downloads as of July 2026: 14 million
• FakeGit campaign repositories: 200
• Campaign listings on public MCP and Skill registries: 600

Implications for Security

This shift represents a transition from social engineering humans to poisoning the discovery pathways used by Developer Security tooling and automated agents. The reliance on public registries like LobeHub and MCP.so provides the campaign with a veneer of legitimacy that complicates standard detection efforts.

For organizations, this could mean that traditional security training may be insufficient to stop automated breaches. The emergence of AgentBaiting suggests that businesses must move toward rigorous sandboxing of agentic workflows and strict curation of external plugins. Interrupting the execution chain before an agent acts on untrusted repository data may become a necessary standard for those integrating AI assistants into enterprise development environments.