The Campaign That Taught Agents to Recommend Malware

Security firm Island documented FakeGit in July. The campaign built roughly 7,600 fake GitHub repositories, 6,600 fraudulent profiles, and over 800 repositories that specifically impersonated AI skills and MCP servers. Downloads exceeded 14 million. The malicious packages distributed SmartLoader and the StealC infostealer.

The twist that makes this a commerce story: Gemini and ChatGPT independently recommended the same malicious walmart-mcp repository. The agents found the attacker's project in a public registry and handed users installation instructions.

This is not a phishing attack. Attackers did not need to deceive users. They deceived the agents users trusted to find services for them.

The architecture behind it is simple enough that it will recur. Agents process instructions and external information as text. A malicious instruction inside a README or tool description gets interpreted as something to follow rather than something to evaluate. Pair that with an agent that can act on those instructions and you get what security researcher Simon Willison calls the lethal trifecta: access to valuable information, exposure to untrusted external content, and the ability to move data outside the system.

FakeGit exploited something simpler alongside this: fabricated trust signals. Stars, downloads, contributor histories, and registry listings can make a malicious package look legitimate. Agents trained to read those signals as quality indicators read them the same way a human developer would, except faster and at scale.

The corroboration signal exists specifically to reduce exposure to this pattern. Of all the servers we crawl, 1,276 hosts appear in two or more independent registries. Cross-listing means at least two registry operators with different crawl strategies both chose to include the same host. A fake repo built to game one registry's ranking signals has to game multiple independent ones to pass this check. The FakeGit campaign distributed primarily through GitHub; independent registry corroboration is a layer that attack architecture skipped.

This is not a complete defense. A sophisticated attacker with enough resources can seed multiple registries. But the cheap version of the attack, pushing one convincing repo to one popular source, is what cross-registry corroboration catches, and it is the version currently in deployment at scale.

For builders, the immediate question is where your agent discovers dependencies. If the answer is a single public registry, the FakeGit campaign's reach of 14 million downloads across 800-plus fake MCP entries is the empirical baseline for what that trust model costs.