Threat · curated 19 Aug 2026
AI Agents are Now Recommending Their Own Malware
First reported towardsai.net
Coverage timeline
Single-source incident — first reported, latest, and curated coincide.
Why it matters
AgentBaiting shows AI coding agents can autonomously discover and recommend attacker-planted MCP servers and skills, turning agentic tool-discovery into a malware delivery vector with no phishing link required.
Security researchers at Island documented a campaign dubbed "AgentBaiting" involving roughly 7,600 malicious GitHub repositories — more than 800 disguised as AI skills or MCP servers — engineered to be discovered and recommended by AI coding agents. Instead of phishing a human, attackers plant repos that look legitimate so that an agent searching GitHub finds them, reads the README, and recommends installing the malware, effectively removing the human-in-the-loop from the supply-chain attack chain.
Summary
Security researchers at Island documented a campaign they call AgentBaiting, in which attackers planted roughly 7,600 malicious GitHub repositories — more than 800 of them disguised as AI skills or MCP servers — specifically engineered to be surfaced by the AI coding agents developers now use to discover tools.[0]
The campaign inverts the traditional supply-chain economics: rather than sending a phishing email, typosquatting a package name, or gaming search to reach a victim, attackers simply build repositories that satisfy the queries an agent is likely to run, then wait for the malicious content to be pulled into results and recommended for installation. In this model the README is no longer just documentation — it may be the first step of the exploit.[0]
Attack chain
- Staging: Attackers plant roughly 7,600 malicious GitHub repositories, with more than 800 dressed up to look like legitimate AI skills or MCP servers.[0]
- Discovery: Instead of delivering bait to a victim, the attacker builds repositories designed to satisfy queries an AI agent is likely to run, so the malicious content gets pulled into agent search results without anyone sending a link.[0]
- Recommendation: A developer asks an agent to find a coding skill or MCP server; the agent searches GitHub, lands on a repository that looks legitimate, reads the README, and recommends installing it.[0]
- Execution: The README itself may act as the first step of the exploit, so the act of reading and following it during installation triggers the malicious behavior.[0]
How it works
The technique targets agentic discovery workflows rather than a software flaw: attackers seed a large corpus of repositories (about 7,600, over 800 posing as AI skills or MCP servers) crafted to match developer queries, so an AI agent surfaces and recommends them without any human first choosing attacker-supplied content. The malicious payload can be embedded such that the README is the initial exploitation step.[0]
Key takeaways
- AI agents that autonomously search, evaluate, and recommend GitHub repositories can be weaponized to deliver attacker-planted malware without any phishing link or human targeting, collapsing the traditional supply-chain attack chain.[0]
- Repository metadata such as READMEs should be treated as untrusted, potentially executable content in agent-assisted development, not merely as documentation.[0]
- The scale reported — roughly 7,600 repositories with over 800 masquerading as AI skills or MCP servers — indicates attackers are already optimizing for agent discovery as a scalable, low-cost delivery model.[0]