In the wild
Realized harm
FakeGit: ~7,600 malicious GitHub repos, 800+ posing as AI skills or MCP servers, with 'AgentBaiting' to lure agents
AIR-2026-0166 AIR record · 2026-07-island-fakegit-ai-skill-repos
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
more than 800 pose as artificial intelligence (AI) skills or Model Context Protocol (MCP) serversthehackernews.com
The record
Disclosed
2026-07-20
Occurred
2026
Vendor
GitHub
Product
GitHub repositories posing as AI skills / MCP servers
Risk domain
Tool misuse › Supply chain vulnerabilities
Also touches
Credential theft
System type
Generative model
Who acted
Agent acted — agents discover and install the fake skill and MCP repos themselves
Attack surface
Skill / plugin
Autonomy level
Semi-autonomous
Initial vector
Mass fake repository seeding
Impact type
Malware distribution, Credential theft
Confidence
Medium
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI04 – Agentic Supply Chain Vulnerabilities
- MITRE ATLAS
- AML.T0040 – AI Supply Chain Compromise
- NIST AI RMF
- MAP 4.1
- EU AI Act
- Annex III §2
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Scan dependencies and container images for vulnerabilities; Use trusted sources.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
~6,600 profiles, ~7,600 repositories, 14 million+ downloads recorded across GitHub Release assets
Capability abused
Taxonomy & references
Curator notes
'AgentBaiting' is the novel element: repositories are SEO'd so that Claude, Gemini and ChatGPT surface and install them without a user-supplied link, i.e. the agent is the delivery vector. Reported by Island's research team (Oleg Zaytsev) exclusively to The Hacker News; no standalone vendor writeup was reachable, hence medium confidence. The 14M download figure covers the whole campaign, not just the AI-themed repos.
Supporting sources
Cite as
Enkrypt AI. "FakeGit: ~7,600 malicious GitHub repos, 800+ posing as AI skills or MCP servers, with 'AgentBaiting' to lure agents". AIR, AIR-2026-0166. https://agentincident.vercel.app/i/AIR-2026-0166/ (accessed 2026-10-19).