The code whispered what the pitch deck screamed. In February 2026, Claude Code—Anthropic's flagship coding agent—recommended a repository that would steal its user's credentials. The recommendation was not the product of a hack. No system was compromised. No vulnerability exploited. The agent simply did what it was trained to do: find useful code. The repository was malicious. The user was a target. This is the new reality of AI supply chain security.
Island's security research team calls it AgentBaiting. I call it the most elegant malware distribution mechanism I have analyzed in nine years of auditing code. It requires no exploit. No zero-day. No social engineering beyond publishing a repository and waiting. The results, verified across three major AI platforms, are staggering: Claude Code, Gemini, and ChatGPT all recommended malicious MCP servers during Island's live testing. These are not fringe tools. These are the most widely deployed AI coding assistants in the industry. All of them failed the same test.
The campaign, tracked as FakeGit, is industrial in scale. Roughly 7,600 malicious repositories were cataloged. Approximately 200 of them recorded over 14 million downloads. More than 6,600 malicious configuration files were planted across the ecosystem. Over 800 fake MCP servers were deployed on public registries. The operation is sustained. It is still active.
Let me dissect the architecture. The code is unremarkable. That is the point.
The Model Context Protocol, or MCP, is the backbone of modern AI agent integrations. It standardizes how agents discover and interact with external tools. Public registries—LobeHub, Glama, MCP.so, MCP Market—catalog thousands of servers. Agents crawl these indexes. They evaluate repositories based on signals: stars, downloads, activity, documentation quality. Then they recommend. Developers install. The system is designed for convenience. It was never designed for verification.
FakeGit exploits this discovery mechanism directly. Attackers created hundreds of legitimate-looking repositories. They borrowed real developer identities, whether through credential theft or impersonation. They populated registries with malicious MCP servers bundled as ZIP archives. The payload chain is layered: malicious repository to malicious ZIP to LuaJIT loader to SmartLoader to Polygon smart contract C2 to StealC infostealer. The final payload harvests session cookies, OAuth tokens, SSH credentials, and browser profiles. It exfiltrates through encrypted channels. It persists silently on the victim's machine.
This is not a hack. It is a feeding strategy. The attackers did not break GitHub. They did not compromise MCP registries. They simply created content that AI agents were designed to find and recommend. The trust model itself was weaponized.
The teardown reveals deliberate engineering choices. First, the delivery layer. LuaJIT is an obscure but legitimate Lua just-in-time compiler. The malware uses it to execute staged payloads in memory, bypassing most static file scanning. Traditional antivirus tools exhibit low detection rates against this loader. SmartLoader, the second stage, communicates with a command-and-control contract deployed on Polygon.
Why Polygon? I have audited enough attack infrastructure to spot the calculus. Polygon offers EVM compatibility with near-zero transaction costs. High transaction volume provides natural obfuscation—the chain processes millions of daily transactions, so a handful of C2 calls disappear into the noise. And unlike traditional HTTP-based C2 servers, a smart contract cannot be seized by domain registrars or blocked by network filters. The C2 channel is permanent. It is programmable. It is immutable once deployed.
The attackers did not use sophisticated blockchain techniques. No proxy contracts. No CREATE2 cloaking. No zero-knowledge proofs. This absence is revealing. They are not blockchain-native hackers. They are malware operators who discovered that smart contracts are simply better C2 infrastructure. Cost per deployment is cents. Persistence is guaranteed by the chain's existence. The public ledger provides a tamper-proof command history. From the attacker's perspective, this is the optimal ratio of cost to capability.
Second, the trust exploitation layer. AI agents prioritize utility over security. The incentive structure is misaligned: an agent is evaluated on how quickly it produces working code, not on whether that code is safe. This creates what security researchers call default-allow behavior. When Claude Code evaluated the malicious skill repository during Island's testing, it recommended it in under ten seconds. The repo had favorable signals. It appeared well-maintained. The agent did not ask whether the code was safe. It asked whether the code was useful. The answer was yes. The code silently harvested session tokens after execution.
Third, the amplification layer. The campaign leveraged registry mirroring to create a propagation feedback loop. Malicious listings on one registry were replicated to others. READMEs were crafted to appeal to agent crawlers, embedding keywords and usage patterns that scoring algorithms favor. The result is a compounding distribution network. Removing one repository does not mitigate the campaign. The listings exist across multiple registries under multiple identities. The infrastructure is designed to survive individual takedowns.
From my experience auditing compromised developer environments, the most dangerous aspect is the credential harvesting. Session cookies and OAuth tokens are not invalidated by password changes. An attacker who steals a session token retains access until the token expires or is explicitly revoked. For enterprise users, an agent's recommendation becomes a persistent backdoor into corporate SaaS infrastructure. MFA is bypassed. The security stack is blind. The token is the key.
One hidden detail deserves emphasis. Attackers almost certainly inflated social proof signals to boost repository ranking. The parsed data confirms borrowed developer identities, but the manipulation of trust markers—stars, forks, download counts—is a standard technique in such operations. Agent crawlers weight these signals heavily. I have observed identical inflation patterns in my own audits of npm and PyPI supply chain attacks. The trust mechanics are the same. The scale here is unprecedented.
Now the counterintuitive angle, because the bulls in this story are not entirely wrong. The use of Polygon as a C2 channel is a double-edged sword for the attackers. Traditional C2 servers must be seized or disrupted by domain registrars. Here, the command history is permanently inscribed on a public blockchain. Every C2 interaction is auditable. Every gas payment trails back to addresses that can be clustered and analyzed. The immutable ledger is the attacker's weakest link.
Chainalysis, TRM Labs, and similar firms can trace these flows. Law enforcement can subpoena exchanges where attackers cash out. The transparency that crypto critics dismiss is the very property that will unravel this operation. The code is public. The contracts are public. The transactions are public. This campaign was possible because of blockchain's programmability. It will be dismantled because of blockchain's transparency. Truth hides in the assembly, not the press release. In this case, the assembly is visible to anyone with a block explorer.
There is a second contrarian point. The market has framed this as an AI security failure. It is also a blockchain security win. This attack demonstrates why public ledgers are superior to traditional infrastructure for forensic analysis. Every exploit is a story poorly told, but this one writes itself onto an immutable public record. The narrative of blockchain as criminal tool misses the deeper truth: blockchain is also the most powerful investigative tool available to defenders.
The industry now faces an uncomfortable question. If AI agents cannot distinguish between genuine tools and weaponized trust, can we afford to let them execute code autonomously? For enterprises, the answer is no. The mitigation strategy is clear. Establish curated directories. Sandbox all agent-executed code. Monitor for C2 contract interactions. Rotate session tokens aggressively. Treat every agent recommendation as unverified input until proven otherwise.
The code whispered what the pitch deck screamed. In 2026, the AI agent does not just recommend code. In the absence of verification, it becomes the attacker's delivery system. The only honest response is to change the trust model itself. Silence, after all, is the only honest consensus mechanism. And there has never been more silence around the security layers missing from AI agents than there is today.