Notifications
Clear all
Topic starter
01/08/2026 10:51 pm
TL;DR: About 7,600 malicious GitHub repositories, more than 800 posing as AI Skills or MCP servers, and over 14 million measured downloads were found in the FakeGit operation, according to Island security research. The evidence shows a supply chain attack pattern where agent-readable instructions, public registries, and lookalike developer profiles can turn routine capability discovery into malware delivery.
NHIMG editorial — based on content published by Island: AgentBaiting: How 800+ Fake AI Skills and MCP Servers Delivered Malware
By the numbers:
- The FakeGit operation recorded more than 14 million measured downloads.
- Island security research uncovered about 7,600 malicious GitHub repositories.
- 800 of them posed as AI Skills or, Skills or MCP servers.
Questions worth separating out
Q: How should security teams govern MCP servers used by AI coding assistants?
A: Treat MCP servers as privileged trust boundaries, not simple data sources.
Q: Why do public registries make malicious AI capabilities more dangerous?
A: Public registries can amplify trust by reproducing attacker-written README instructions and making a repository easier to find.
Q: What do teams get wrong about AI agent discovery?
A: Teams often treat discovery as a one-time inventory exercise, but AI-connected access changes as users add apps, permissions, and workflows.
Practitioner guidance
- Build a curated capability catalog Allow AI Skills, MCP servers, and agent plugins only from reviewed sources with known provenance, maintained versioning, and explicit approval for use in enterprise environments.
- Block executable capability packages by default Reject installations that rely on downloaded executables, ZIP launchers, or disguised payloads instead of source code, manifests, and auditable setup steps.
- Review agent discovery paths Log and constrain the repositories, registries, and search results that agents can surface for users, especially when the agent returns installation guidance.
What's in the full article
Island's full research covers the operational detail this post intentionally leaves for the source:
- Per-repository examples of malicious AI Skills and MCP servers with their ZIP filenames and hashes.
- Detailed screenshots and walkthroughs of the AgentBaiting discovery flow across Claude Code, Gemini, and ChatGPT.
- Campaign infrastructure patterns, including lookalike developer identities and registry propagation behaviour.
- Representative IOCs and the full GitHub repository list for matching against internal inventories.
👉 Read Island's analysis of the FakeGit operation and AgentBaiting →
AI capability supply chain abuse: are your MCP controls ready?
Explore further
01/08/2026 10:59 pm
Agent baiting is the right named concept for this campaign pattern: the attack does not start with exploitation, it starts with capability discovery. A malicious repository is written so that a user or agent believes the README is documentation and the download is routine. That means the governance issue is not only repository trust, but the trust delegated to discovery surfaces, registries, and installation instructions. Practitioners should recognise agent baiting as a supply-chain control problem, not just a malware problem.
A few things that frame the scale:
- the average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.
A question worth separating out:
Q: Who is accountable when AI tools are abused to support malware operations?
A: Accountability sits across AI governance, security operations, and identity ownership. Teams that approve models, expose them to users, or connect them to tools need documented controls for abuse detection, access restriction, and incident response. Where AI assistants are integrated into workflows, governance must cover both the model and the permissions around it.
👉 Read our full editorial: Agent baiting turns fake MCP servers into a malware supply chain
