FakeGit malware now targets AI coding agents via GitHub
If you use an AI coding agent to find new tools, skills, or MCP servers, this threat is aimed directly at your workflow.
The FakeGit campaign has expanded. Researchers have now identified nearly 7,600 malicious GitHub repositories distributing SmartLoader (a trojan loader) and StealC (an information stealer). The campaign is not new, according to Oleg Zaytsev, lead security researcher at Island, but the current scale and the targeting of AI agents specifically marks a meaningful escalation.
Why AI Agents Are the New Attack Surface
Island researchers tested Anthropic’s Claude Code, Google’s Gemini, and OpenAI’s ChatGPT against the campaign repositories. All three surfaced malicious repos to developers without being shown a direct link first.
The attack chain works because agents browse autonomously. As Zaytsev put it:
“An AI agent searching for a new capability such as a Skill or an MCP server can discover a campaign repository on its own, treat the attacker’s README as legitimate documentation, and hand the installation instructions to the user.”
The researchers named this technique AgentBaiting. The verdict from the Island team:
“A playbook built to deceive people now deceives the agents acting on their behalf.”
The Operator Takeaway
When your agent fetches a README and treats it as documentation, that README is now an attack vector. Any workflow where Claude Code, Gemini, or ChatGPT autonomously searches for and installs packages, MCP servers, or plugins is exposed to this pattern. Verify any repo your agent recommends before executing the install instructions it hands back to you.
I’m founder of BizStack at Cagri Sarigoz LLC and a passionate advocate for entrepreneurs.
With over 14 years in tech, marketing, and AI, including my role as Head of SEO at CitizenShipper and co-founder of TaleBot at Intale AI, I’m dedicated to sharing genuine, useful product insights and tips.
At BizStack, I aim to cut through the digital noise to provide clear, actionable advice.
And more than all else, I’m a father to a (always) little girl and a husband.
Contact me at [email protected] for assistance.
