AI Coding Assistants Can Now Be Tricked Into Installing Malware on Their Own

Security researchers at Island have identified nearly 7,600 malicious GitHub repositories built to infect not just human developers, but the AI assistants those developers now rely on to find code. More than 800 of the repositories pose as legitimate AI "skills" or Model Context Protocol (MCP) servers — plug-ins that let AI assistants connect to outside tools — and the campaign has already logged over 14 million downloads.

The operation, dubbed FakeGit, has been running since at least earlier this year and peaked in April 2026, when researchers say nearly 300 fake AI-related repositories went up in a single month, created by roughly 6,600 lookalike developer profiles. The fraudulent repos impersonate well-known integrations, including Gmail, WhatsApp, Databricks, Jenkins, and Docker tools, and rely on convincing README files and cloned project structures to look legitimate.

What sets this campaign apart is a technique Island calls AgentBaiting. Rather than waiting for a person to click a malicious link, the malware is positioned to be discovered directly by an AI coding assistant carrying out a routine search. In testing, Island found that Anthropic's Claude Code, Google's Gemini, and OpenAI's ChatGPT could all be led to surface one of the fake repositories on their own, without ever being shown a link, simply by being asked something as ordinary as "find a free AI skill for X" or "give me a link to Y's MCP server." The assistant then treats the fabricated README as trustworthy documentation and passes the attacker's setup instructions on to the user.

Once a victim — human or AI-guided — follows those instructions, a downloaded ZIP archive triggers a loader chain that installs SmartLoader, which in turn deploys StealC, an information-stealing malware capable of harvesting credentials, active browser sessions, and other sensitive data from the infected machine.

The fake listings haven't stayed confined to GitHub. Researchers found more than 600 of the campaign's AI-themed repositories cross-posted to public AI tool directories such as LobeHub, Glama, MCP.so, and MCP Market — platforms developers often treat as pre-vetted, which gave the malicious listings an added layer of false credibility.

The campaign builds on an existing pattern: trojanized MCP servers spreading SmartLoader and StealC were already flagged earlier in 2026 by other security researchers. AgentBaiting marks an escalation of that threat, since it removes the need for a human to make any error at all — an AI agent acting on a user's behalf can wander into the trap during what looks like routine, automated research.

Island recommends that developers and organizations using AI coding assistants maintain a reviewed, curated list of approved skills, MCP servers, and plug-ins rather than letting agents pull them in ad hoc; test any new agent capability in an isolated, sandboxed environment before wider rollout; independently verify a repository's publisher and history rather than trusting registry placement alone; and monitor what actions AI agents actually take once a new tool is connected.