Topic starter
01/08/2026 10:51 pm
TL;DR: About 7,600 malicious GitHub repositories, more than 800 posing as AI Skills or MCP servers, and over 14 million measured downloads were found in the FakeGit operation, according to Island security research. The evidence shows a supply chain attack pattern where agent-readable instructions, public registries, and lookalike developer profiles can turn routine capability discovery into malware delivery.
Editorial analysis by NHI Mgmt Group, based on content published by Island: “AgentBaiting: How Fake AI Skills Deliver Malware at Scale”.
By the numbers:
- Island security research uncovered about 7,600 malicious GitHub repositories in the FakeGit operation.
- More than 800 of the malicious repositories posed as AI Skills or MCP servers.
- Those repositories appeared more than 600 times across public AI registries and catalogs.
Key questions
Q: What breaks when a fake MCP server is treated as a trusted capability source?
A: The trust boundary collapses before code execution begins.
Q: Why do public AI registries increase the risk of capability supply chain abuse?
A: They multiply exposure and credibility at the same time.
Q: How can security teams tell whether AI assistant configuration is being abused?
A: Look for unexpected network callbacks, unusual tool permissions in frontmatter, hidden model overrides, and repository content that behaves like executable policy.
Practitioner guidance
- Build a curated capability catalog Approve Skills, MCP servers, and agent plugins through a controlled catalog so users and agents have a safe default path for installation.
- Inspect every new capability in isolation Use an isolated environment with no browser sessions, cloud credentials, SSH keys, or production data before allowing any capability to run.
- Verify publisher identity and package provenance Check the repository owner, commit history, release asset structure, and package hash before trusting a capability that claims to be an MCP server or Skill.
Bottom line: The central problem is not only malware packaging, but the use of AI capability discovery as an entry point into trusted workflows.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 10:59 pm
Agent-readable documentation has become part of the attack surface: The FakeGit wave shows that the installer README is no longer just support material, it can be the delivery mechanism. When an AI agent can retrieve and relay instructions without human scrutiny, attackers can weaponise ordinary setup language. The implication is that capability governance must treat discovery artefacts as security-relevant objects, not just user convenience.
A few things that frame the scale:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations allow employees to install agent skills without review?
A: No, not if those skills can access files, credentials, or business communications through the host agent. Even a well-meaning productivity skill can become a data path if it inherits broad permissions. Review, allowlisting, and runtime policy are the minimum controls for employee-installed agent extensions.
👉 Read our full editorial: Agent baiting turns fake MCP servers into a malware supply chain