Forget the People. We'll Bait the Agents Instead!

AgentBaiting is a term that has been recently coined by Island researchers in the midst of uncovering a substantial FakeGit campaign. It describes a technique that involves targeting AI coding assistants or other autonomous software agents instead of targeting developers directly.

With the integration of AI assistants in the world of software development, coding agents are often tasked with locating libraries, plugins, or Model Context Protocol (MCP) servers that provide specific functionality for use in projects. AgentBaiting responds to this by creating repositories specifically to be discovered by these AI agents, which then get recommended to the developer for use in a project.

Instead of trying to exploit some sort of software vulnerability, AgentBaiting attempts to manipulate the selection process of AI agents. Repositories are created such that they have convincing documentation, realistic commit histories, along with a good project structure and installation instructions.

These repositories could look perfectly legitimate to both humans and AI, though it seems clear that these AI agents will have less of a critical lens when it comes to examining these projects. We can see an example of this below with a comparison between a legitimate tool repository and an imitation one that contains a link to download the SmartLoader malware.

(Source: Island)

A large-scale demonstration of the AgentBaiting technique was seen in a recent FakeGit campaign, which makes for a good representation of how attackers can influence this kind of AI-assisted discovery without having to compromise legitimate repositories or exploit technical flaws. Island researchers uncovered approximately 7,600 fake GitHub repositories across about 6,600 different accounts.

These repositories contained over 800 different AI "skills" and MCP servers intended to appear in public AI tool registries. The repositories found were able to mimic legitimate open-source projects by having complete and professional-looking documentation, realistic commit histories, release packages, and even detailed installation instructions. It seems that the creators of these repositories were also sure to keep their subject matter highly relevant to common requests from AI coding assistants.

(Source: Island)

It's also worth noting here that these malicious repos are not automatically being installed by the AI agents; user action is still required in that sense. The AI agent recommendation is another step in establishing a credible-looking tool, much like with how these repos will generally begin by copying a legitimate tool and utilizing README files to make the malware installation look routine.

Researchers found that several common AI assistants, including ChatGPT, Claude, and Gemini had little issue locating and recommending packages from this campaign without being given direct links. With multiple searches, it does seem that the AI assistants did occasionally identify these suspicious repos and refrain from recommending them.

These fake repositories were found to be using the SmartLoader malware to load the StealC infostealer onto the user's machine. This combination isn't a particularly novel aspect of this campaign, but we're still dealing with software capable of stealing credentials, browser cookies, and authentication tokens all the same. This loading process takes place during the installation of the recommended tool.

The FakeGit campaign we just discussed highlights the fact that the AI-assisted software discovery process has become a new attack surface for software supply chain attacks. The overall strategy for this kind of attack would appear to be to optimize malicious repositories for discovery and recommendation by common AI tools.

To that end, we can see that things like detailed project documentation, commit histories, the overall organization of a project (things we would normally associate with trustworthy projects) are indicators that can now be fabricated at scale.

Moving forward, organizations should seek to limit the permissions granted to AI tools and verify repository ownership before installing any new software. A human review should remain a necessary step in the process, because while all of this does not mean AI assistants are compromised, they can be manipulated in the sense that the information they rely on to make recommendations can be fabricated. Thus, a critical view of new software will be crucial in avoiding future compromise.

This article is shared at no charge for educational and informational purposes only.

Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. We provide indicators of compromise information (CTI) via a notification/Tier I analysis service (RedXray) or an analysis service (CTAC). For questions, comments or assistance, please contact the office directly at 1-844-492-7225 or feedback@redskyalliance.com