Fourteen million downloads. Two hundred malicious repositories. Not a single vulnerability exploited.
In the first weeks of 2026, security firm Island ran a painfully simple experiment. Researchers asked Claude Code, Gemini, and ChatGPT to recommend MCP servers and coding skills from public registries. The agents didn't hesitate. They recommended malicious repositories tied to a sprawling, industrialized supply-chain poisoning campaign that researchers now call FakeGit — a network spanning roughly 7,600 GitHub repos, 6,600 configuration files, and more than 600 registry listings across LobeHub, Glama, MCP.so, and MCP Market.
No zero-day. No code-execution exploit. Just the quiet algorithmic trust we've baked into developer toolchains, inverted.
Context: At the Intersection of Trust and FOMO
FakeGit is the first documented, large-scale "AgentBaiting" operation on the modern AI-agent stack. Attackers cloned the identities of real developers — actual usernames, authentic README conventions, credible contribution histories — then seeded malicious packages that AI agents discover and recommend automatically. The scale is industrial: roughly 7,600 malicious GitHub repositories, about 6,600 malicious configuration and skill-definition files, and some 200 repositories that alone account for more than 14 million downloads. More than 600 malicious entries appeared across public MCP registries simultaneously.
The timing is not incidental. AI-agent adoption ramped aggressively through 2025 and into 2026, and the bull market only supercharged delivery pressure. In this environment, engineers ship faster, and security review is the first casualty. The FakeGit attackers understood that dynamic precisely: they built for discoverability, not for stealth. They knew the agents would do the marketing for them.
This is not a single drop-and-run operation. The infection chain is a modular attack pipeline: malicious repo → malicious ZIP → LuaJIT loader → SmartLoader → Polygon smart contract C2 → StealC stealer. Each layer is interchangeable; block one route and operators rotate to another. For the first time, an entire attack chain treats the AI-discovery layer as the primary vulnerability — not the parser, not the runtime, not the sandbox. The recommendation itself is the attack surface.
Core: The Economics of a Criminal Control Plane
When I first started auditing smart contracts, the threat models that kept me up at night were reentrancy and price-oracle manipulation. Nobody audited for a command-and-control channel. Yet here we are: FakeGit selected Polygon as its C2 backbone, and that choice explains how cheap — and how invisible — blockchain infrastructure has become for criminals.
The economics are straightforward. Polygon offers low gas fees, EVM compatibility, massive existing transaction volume, and readable contract state. An attacker can deploy hundreds of tiny Solidity registries — each holding encrypted instructions for SmartLoader to retrieve — at a total cost of a few thousand dollars. The surrounding transaction volume drowns their signals in legitimate traffic. There is no URL to block, no domain to sinkhole, no TLS fingerprint to flag. Network-level detection fails when the command channel runs through the same public ledger as a million routine transfers.
Post-Dencun economics made this inevitable. Across every Ethereum-aligned L2, transaction costs collapsed to fractions of a cent — and with them, the cost of running a criminal control plane. The uncomfortable corollary: when blob space saturates and rollup fees double again, my timeline puts that inside two years, attackers will simply shift chains or return to HTTP infrastructure. The economics of crime follow the economics of infrastructure.
Island's analysis found the attackers added no elaborate complexity — no proxy patterns, no decoy state, no ZK obfuscation. That's the point. When infrastructure is this cheap and this permissive, complexity is wasted effort. The chain's most dangerous innovation is not the loader and not the C2; it's the trust inertia of the AI agents themselves. "Recommend what's useful" has quietly replaced "recommend what's verified."
Island's live verification adds another uncomfortable data point. In their tests, Claude Code recommended the malicious skills repository; Gemini and ChatGPT recommended malicious MCP servers. The agents ranked these poisoned entries as useful — in some cases even when researchers included security-related context in their prompts. That means current model alignment does not yet include supply-chain provenance as a first-class decision factor. The models evaluate code, not origin.
Consider what "success" means here. StealC harvests session cookies, OAuth tokens, and SSH keys. Password rotation does not fix a stolen session. A developer who installs a poisoned MCP server hands over a key to every tool they use to ship code. Because agents recommend what they find rather than what is safe, exposure falls hardest on the newest engineers — the ones who most trust the assistant's suggestion. That is exactly what makes this campaign a corporate-network entry point rather than a consumer nuisance.
Trend Micro has linked similar LuaJIT loader activity to a cluster it tracks as Water Kurita, which historically abused Lumma Stealer. Naming matters less than the pattern: infrastructure matures, attackers iterate, loader families get repurposed. This isn't a side project; it's a production pipeline.
Contrarian: The Ledger Is the Witness, Not the Crime
The mainstream security narrative will say "criminals are abusing blockchain." Technically true. But blockchain's transparency is the best forensic breakthrough this attack could have handed defenders.
Because SmartLoader's C2 instructions live on Polygon's publicly verifiable ledger, the entire command history between malicious contracts and compromised machines is permanently visible. Every instruction broadcast, every handler-contract update, every interaction with the funding address awaits on-chain analysis. One known contract address allows investigators to reconstruct the campaign's operational timeline in a way HTTP-based C2 infrastructure never permits. During the Terra-Luna collapse, I watched the emotional devastation obscure a practical fact: on-chain data doesn't lie, and it doesn't forget. The property that makes layer-2 chains attractive as C2 channels is the same property that makes them terrible hiding places.
The second blind spot is the mitigation paradox. Security teams are rushing to build approved registries and sandboxed agent execution. But every safety control placed between an AI agent and the repositories it discovers is a tax on agent autonomy — the precise feature driving adoption. In early 2026, while helping draft the Autonomous Agent Transparency Standard, I watched builders dismiss it as over-regulation. This is the moment it becomes necessary. There is no zero-cost fix. The market will pay for safety in velocity, or pay for incidents in billions.
Regulators will parse this through a predictable lens: crypto as crime harbor. But the more compelling signal is on-chain: the funding addresses, the gas purchases, the interaction patterns are legally admissible breadcrumbs. The immutable ledger is not the crime scene; it's the evidence room.
Takeaway: What to Watch Next
FakeGit is not finished. Even if GitHub purges every listed repository today, the mirrored registries remain polluted, and 14 million downloads already prove that discovery-to-install conversion is brutal.
What matters now: rotate OAuth tokens and SSH keys as though the breach is active, because it probably is. Revoke session credentials across every internal system. And monitor on-chain addresses for unexpected interactions with your development infrastructure — the one C2 signal you can actually see.
In the ashes of Terra, we didn't expect the next trust collapse to arrive speaking fluent pseudocode, wearing a GitHub star count as its disguise. But here we are. The agents are already recommending. History will record whether we audited the recommendation, or simply watched it execute.