a campaign of 7,600 malicious GitHub repositories<\/a> designed to exploit AI coding agents rather than human developers. Dubbed AgentBaiting, the tactic plants fake MCP servers (Model Context Protocol servers, which connect AI agents to external tools and data) and AI skills across GitHub and public registries. When a developer deploys Claude Code, Gemini, or ChatGPT to autonomously find a capability, the agent can surface a malicious repo, read the attacker’s README as legitimate documentation, and hand installation instructions directly to the user. The payload delivers SmartLoader then StealC, a credential and session-stealing chain that’s been active for years.<\/p>\nWhat this means for your business<\/h2>\n
The attack surface your security team trained for assumed a human in the loop. AgentBaiting removes that assumption entirely. An AI coding agent with access to GitHub and the ability to execute install scripts is, functionally, an autonomous software procurement channel. No phishing email required, no malicious link handed to a developer. The agent finds the lure, reads the instructions, and proceeds. Every enterprise that has deployed AI coding assistants to accelerate developer productivity has quietly opened this channel.<\/p>\n
The numbers matter here. Island confirmed more than 14 million downloads across roughly 200 of these repositories, and that count excludes thousands of repos that embedded malicious ZIPs without public download tracking. Claude Code, in Island’s own tests, recommended a benign repo and flagged the malicious one as a legitimate alternative in the same session. That’s not a model failure in the catastrophic sense. It’s variance. And at campaign scale, variance is enough: even a single agent miss in a large engineering org moves the attack chain from GitHub into a developer’s environment without a single human ever clicking a suspicious link.<\/p>\n
The signal worth watching: this is the first well-documented campaign purpose-built for agentic discovery rather than human deception. As MCP adoption accelerates across enterprise AI toolchains, the registry ecosystem (GitHub, MCP marketplaces, skills stores) becomes a primary attack surface, not a secondary one. The question for your security architecture isn’t whether to block AI agents from GitHub. It’s whether you have any visibility into what they’re finding and installing when they go looking on their own.<\/p>\n
Concept deep-dive: AgentBaiting<\/h2>\n
AgentBaiting is what happens when malware campaigns optimize for AI agent discovery instead of human attention. Traditional supply chain attacks rely on a developer choosing a malicious package. AgentBaiting relies on an AI agent, searching autonomously for a capability, surfacing a poisoned result through normal discovery channels like GitHub search or MCP registries. The analogy is SEO poisoning, which manipulates search rankings to serve malicious pages to humans, except the “searcher” now executes code autonomously. The business exposure is direct: any agent with install permissions and internet access is a potential execution path.<\/p>\n
Based on reporting from FakeGit Targets AI Coding Agents with Malicious GitHub Repos<\/a>, originally published 2026-07-23 18:33:00.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"Share with your CISO Security researchers at Island have identified a campaign of 7,600 malicious GitHub repositories designed to exploit AI coding agents rather than human developers. Dubbed AgentBaiting, the tactic plants fake MCP servers (Model Context Protocol servers, which connect AI agents to external tools and data) and AI skills across GitHub and public […]<\/p>\n","protected":false},"author":1,"featured_media":6427,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[145],"tags":[],"tmauthors":[],"class_list":["post-6426","post","type-post","status-publish","format-standard","has-post-thumbnail","category-ai-engineering"],"_links":{"self":[{"href":"https:\/\/workai.tv\/news\/wp-json\/wp\/v2\/posts\/6426","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/workai.tv\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/workai.tv\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/workai.tv\/news\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/workai.tv\/news\/wp-json\/wp\/v2\/comments?post=6426"}],"version-history":[{"count":0,"href":"https:\/\/workai.tv\/news\/wp-json\/wp\/v2\/posts\/6426\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/workai.tv\/news\/wp-json\/wp\/v2\/media\/6427"}],"wp:attachment":[{"href":"https:\/\/workai.tv\/news\/wp-json\/wp\/v2\/media?parent=6426"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/workai.tv\/news\/wp-json\/wp\/v2\/categories?post=6426"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/workai.tv\/news\/wp-json\/wp\/v2\/tags?post=6426"},{"taxonomy":"tmauthors","embeddable":true,"href":"https:\/\/workai.tv\/news\/wp-json\/wp\/v2\/tmauthors?post=6426"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}