Attackers have started writing for your AI, not for you

This one is a few weeks old and it did not get the attention it deserved, so here it is plainly.

On 20 July, security researchers at Island published an investigation into a campaign they call FakeGit. Roughly 7,600 malicious GitHub repositories, created by around 6,600 profiles. About 1,400 of them dressed up as AI tools or workflows, and more than 800 posing specifically as AI Skills or MCP servers — the add-ons people plug into AI assistants to give them new abilities. Island measured over 14 million downloads across about 200 of the repositories.

Copied projects, plausible developer profiles, well-written READMEs. Download the ZIP and you get a launcher, then a renamed LuaJIT runtime, then an obfuscated payload that looks up its command server via a smart contract on the Polygon blockchain, and finally StealC — an information stealer that goes for saved credentials and live sessions.

That is all fairly standard criminal engineering. The interesting part is who it was aimed at.

Three assistants recommended it, unprompted

Island tested whether AI coding assistants would find this stuff on their own. They did.

Claude Code, asked to find a particular kind of skill, turned up a campaign repository by itself, read the README as legitimate, and set out the installation steps — including downloading and running an executable, past the security warnings.

Gemini, asked for a specific MCP server, returned a malicious repository as its first recommendation, linking straight to it.

ChatGPT listed the same repository among three options, then singled it out as the best place to start.

Nobody was phished. No one clicked a dodgy link in an email. A person asked their assistant for a tool and the assistant went and found the poisoned one.

What actually changed

Fake packages are not new. Search-engine poisoning is not new. What is new is who the attacker is writing for.

For twenty years, the last line of defence against a dodgy download was a human glance. You'd land on the page and something would feel off — the English is odd, the project has four stars and no history, the author joined last month. Not reliable, but real. That glance is a filter, and attackers had to get past it.

An agent doesn't glance. It reads the README, finds it coherent and well-structured, and proceeds. Coherent and well-structured is not a hard target. It is, in fact, the one thing a language model is guaranteed to produce.

So the economics have flipped. It used to be expensive to make a fake project look convincing to a suspicious developer. It is now nearly free to make one look convincing to a machine that has no suspicion at all — and the machine has been handed permission to install things.

The human skim was quietly load-bearing. We removed it without replacing it.

If you run a small business

Be proportionate about this. If nobody in your firm uses an AI coding assistant, this particular campaign is not your problem this week, and you can stop reading with a clear conscience.

If somebody does — including a freelancer or agency working on your systems — there is one question worth asking:

Can their assistant install or run software without a person approving it, one thing at a time?

If the answer is yes, that is the thing to change, and it costs nothing but a setting and a habit. This is the same argument as the agent that invented fake people to get its code approved: an agent's reach determines the size of its mistakes, and the fix is always narrower permissions plus a human in front of anything irreversible.

There is now a real-world case of exactly that going wrong in the other direction: an agent running a shop dismissed an employee after being asked a leading question — having first recommended a warning, and having forgotten the handbook it wrote.

And the part that does generalise beyond code, to everybody:

An AI recommendation is not a vetting. When an assistant tells you a supplier, a plugin, a template or a tool is the one to use, it is judging presentation — and presentation is exactly the thing an attacker or a chancer controls completely. Treat it as a shortlist, never as due diligence.

Hold on — you're quoting a security company

Yes, and it would be inconsistent of me not to say so.

Yesterday I complained that AI pricing guides are written by firms selling AI implementation. Today I am relying on research published by a firm that sells security software. Island has an obvious commercial interest in you feeling that AI tooling is dangerous.

So what is the difference, and am I applying one standard to them and another to people I disagree with?

I think the difference is real, and it is method. Island named the researcher, described how the repositories were found and counted, named specific malicious repositories, and set out the payload chain step by step — all of which can be checked by somebody else, and has been picked up and reported independently. The pricing guides gave figures with no method, no source and no way to test them, and disagreed with each other by a factor of thirty.

Having an interest is not the problem. Every source has an interest. The question is whether they have shown their working, so you can disagree with them if the working is wrong. Island did. Take the finding, keep the scepticism.

What argues against alarm

Fourteen million downloads is not fourteen million infections. It counts downloads of release assets across the whole FakeGit campaign, not just the AI-targeted part, and a download is not an execution.

The AI-specific slice is the smaller number: about 1,400 AI-flavoured repositories and 800-odd impersonating Skills or MCP servers. Still a lot. Not the whole 7,600.

And the failure here is a supply-chain and permissions problem, not evidence that AI assistants are inherently unsafe. The same assistant with no ability to install anything is a research tool that occasionally suggests a bad link — which is roughly what a search engine has always been.

The short version

Attackers have noticed that the reader is now a machine, and machines are easier to write for than people. Assume anything your assistant recommends has been written to appeal to it, and keep a person between the recommendation and the install.

Source: “AgentBaiting” research published by Island, authored by lead security researcher Oleg Zaytsev, 20 July 2026. All figures above — the repository and profile counts, the AI-related and Skills/MCP subsets, the download total, the assistant test results and the payload chain — are taken from Island's own write-up, which was checked directly, and have been corroborated by independent reporting.