AI assistants can now become part of a malware delivery chain without being directly compromised. The risk emerges when agents search public software repositories, interpret untrusted instructions and recommend tools that only appear credible.
An AI News analysis highlights FakeGit, a campaign documented by Island in July 2026. The campaign involved roughly 7,600 fake GitHub repositories, 6,600 fraudulent profiles and more than 14 million downloads. Over 800 repositories impersonated AI skills and Model Context Protocol servers while distributing SmartLoader and the StealC infostealer.
Fake Credibility Can Mislead Trusted Assistants
The surprising part of FakeGit was not the existence of fraudulent repositories. Gemini and ChatGPT independently recommended the same malicious `walmart-mcp` project and supplied installation instructions, according to the article. The assistants had not been taken over; they had treated attacker-created relevance and credibility signals as useful evidence.
That changes the attacker’s task. Instead of persuading every target directly, a campaign can try to influence the systems people ask for technical advice. Stars, download counts, contributor histories and registry listings become inputs to an agent’s judgment even when those signals have been manufactured.
The economics make that manipulation accessible. The source cites an April 2026 investigation that found GitHub stars advertised for three to ten cents each and identified about six million suspicious stars across 15,835 repositories. In another case, attackers reportedly spent three months building fake contribution histories around a cloned Oura connector before distributing it through legitimate registries.
These examples support a clear warning about discoverability, but they do not show that every popular package is unsafe. Popularity and provenance are simply different properties, and agents can confuse one for the other.
Instructions Become Dangerous When Agents Can Act
The analysis identifies two architectural weaknesses. Agents process both instructions and outside information as text, so malicious content hidden in a README, webpage or tool description may be treated as a command. They can then act on that instruction through connected tools.
Security researcher Simon Willison describes the dangerous combination as a lethal trifecta: access to valuable information, exposure to untrusted content and an ability to transmit data elsewhere. Tool poisoning demonstrates the pattern. In April 2025, Invariant Labs showed how hidden instructions in a malicious calculator description could manipulate a trusted email connector into copying outgoing messages to an attacker. The source correctly labels this as a demonstrated threat model, not a confirmed public incident.
Updates create another opening. Koi Security found that version 1.0.16 of `postmark-mcp`, an unofficial connector, added a hidden blind-copy recipient after earlier versions appeared benign. The package potentially exposed authentication links and password-reset messages tied to about 300 organizations. Postmark said the connector was not its product and its own service was not breached.
Agent Security Needs Continuous Verification
Static code review cannot catch every route. The article describes MCPoison, a Cursor vulnerability disclosed by Check Point that let attackers alter previously approved project configurations and execute commands without renewed consent. Cursor 1.3 addressed the issue. It also cites a demonstration in which an external documentation page changed after a skill had been distributed, leaving the submitted package untouched while its instructions became malicious.
Marketplaces face a related scale problem. One academic study examined 98,380 skills, confirmed 157 as malicious and catalogued 632 vulnerabilities across 13 attack techniques. During the 2026 ClawHavoc campaign, Koi Security identified 341 malicious skills among 2,857 reviewed, while Antiy CERT later tracked 1,184 malicious skills associated with 12 accounts.
Those figures come from different investigations and should not be combined into a single prevalence rate. Together, they show why one-time approval is inadequate. Packages, dependencies, descriptions, external pages and reputation signals can all change after an initial review.
The practical security boundary therefore extends beyond the agent model. Organizations must verify the tools an agent discovers, restrict its credentials and outbound actions, and reassess software after updates. As assistants gain authority over repositories, email and business systems, recommendation itself becomes a privileged operation rather than a harmless answer.
