Term · named by Island, 20 July 2026 · reviewed 6 September 2026
Definition. AgentBaiting is the crafting and seeding of malicious repositories so that an AI coding assistant — searching for a capability on a user's behalf — discovers them on its own, reads the attacker's README as documentation, and recommends installing them. The victim never receives a link. They receive a recommendation, which is worse, because a recommendation reads as vetting and is not.
Island's security research team, in Oleg Zaytsev's analysis of the FakeGit campaign published on 20 July 2026, described how an agent looking for a Skill or an MCP server could find a campaign repository unaided and, in Island's words, “treat the attacker's README as legitimate documentation”. The Cloud Security Alliance's research note of the following day adopted the name and added the ecosystem context. Neither named a detection tool; the CSA note falls back to mandatory human review.
| Figure | Value | Source |
|---|---|---|
| Campaign repositories | ~7,600 | Island CSV, July 2026 |
| Fabricated maintainer accounts | ~6,600 | BleepingComputer / CSA |
| Repositories posing as AI Skills or MCP servers | over 800 | Island |
| Listings seeded into MCP and Skill registries | more than 600, across LobeHub, Glama, MCP.so and MCP Market | Island |
| Release-asset downloads | 14,084,688 across 335 assets in 211 repositories | BleepingComputer, from Island data |
| Assistants that surfaced campaign repositories in Island's tests | Claude Code, Gemini, ChatGPT | Island |
| Registries that accepted a proof-of-concept malicious MCP without review | 9 of 11 | OX Security, via CSA |
Two of those rows carry the whole technique. Six hundred listings is the seeding: registries are indexed, assistants search them, and nine of eleven registries accepted a malicious server on submission. Fourteen million downloads is the delivery: the payload was not in the source tree, it was a ZIP attached to a release, and the assistant's install instructions pointed at it.
An assistant that finds a repository has performed a search, not a review. It read the README — which the attacker wrote — and it ranked the result on relevance to your question, not on who published it or when the account was created. When Island asked for a capability, Gemini returned a campaign repository as its first recommendation and ChatGPT named the same one as the best place to start. Nothing in that exchange checked anything. The confidence in the answer is a property of the interface, not of the repository.
The vetting standard's rule for this is short: a repository an agent discovered gets the full provenance and execution-surface treatment, plus out-of-band verification of the publisher. No exceptions.
One thing, and it is the only place this signal exists. Check C22 runs in the browser extension, because the fact that an AI surface led you to a repository is visible only at navigation time — which tab you came from, which tab opened this one. The extension holds permission for eleven hosts: six AI chats and five MCP directories. Arriving at a GitHub repository from one of them records the provenance for thirty minutes; a download of that repository inside the window sends the surface's hostname only with the verdict request. A repository that would otherwise warn is blocked. A repository that passes stays passed, with the fact recorded on the decision page — because a recommendation is suspicion, not evidence, and the product does not pretend otherwise.
No backend can do this. No command-line scanner is invoked. No package-registry monitor is watching the right thing. That is why C22 was the first check RepoGates built rather than the last.
RepoGates sees a person who followed a recommendation into a
browser download. It does not see an agent that fetches code itself —
git clone, npm install, curl, a
fetch from inside the agent's own process — and nothing in a browser
can. For that path the product offers an
MCP server an agent can be told to call
before it fetches; an agent that never calls it is not stopped. Inside
Claude Code the RepoGates plugin
goes one step further: its hook refuses a clone or install that names a
blocked repository on the command line, before it runs — and it does not
see anything that is not a Bash tool call in that client. It also
sees only the enumerated surfaces: a new assistant is invisible until an
extension update names it. And it does not read your conversation.