Security researchers testing Claude Code, Gemini and ChatGPT found that each could recommend malicious GitHub repositories posing as AI skills or Model Context Protocol servers. Some of the repositories directed users to ZIP files that installed SmartLoader and then the StealC information stealer.
Island reported the findings on July 20 after mapping about 7,600 malicious repositories in a broader FakeGit operation. More than 800 were presented as skills or MCP servers. The researchers also found more than 600 campaign listings across public AI capability catalogs.
The tests do not establish that agents routinely select malware. Results varied, and in some runs the client recognized suspicious details and refused to recommend the repository. They do demonstrate a plausible handoff: an agent searches for a useful capability, accepts an attacker-written README as documentation and gives the setup instructions to a person who trusts the recommendation.
Familiar projects gave the ZIP files cover
Island found FakeGit repositories that copied legitimate projects or adopted similar names. Some campaign accounts imitated established developers with one-character changes to their usernames. Modest star and fork counts helped the fakes look lived-in rather than newly assembled.
The AI-themed lures borrowed names from common enterprise products. Island found supposed connectors for Databricks, Jenkins, Docker and Gmail, among others. The repository description promised a useful integration while the README pointed to a packaged download.
One fake Databricks MCP server told visitors to download and run a Windows ZIP. The archive contained a command file, a renamed LuaJIT-style runtime and an obfuscated Lua payload disguised as text. It contained no MCP manifest or working Databricks server.
SmartLoader established persistence and installed StealC. Island said the malware targeted browser passwords, cookies, active sessions, remote-access credentials and host information.
The fake integration only needed to survive long enough for its setup command to run.
Figure details
An agent searches public catalogs and GitHub for a new capability. Lookalike project names, copied README files, and manufactured stars or forks lend credibility to a malicious repository. Its setup instructions tell the user to download a ZIP, extract it, and run an application even though the archive contains no MCP manifest or working server. The observed package launches application.cmd, which runs luau.exe ico64.txt and leads to SmartLoader and StealC execution.
Agent search carried the attacker’s instructions
Island asked Claude Code to find a free cinematic prompt skill. Claude opened a legitimate repository and a campaign-linked alternative. It ultimately recommended the legitimate option, but also repeated the fake repository’s directions to download an executable and bypass a Windows warning.
When prompted for a free Walmart MCP server, Gemini returned a campaign repository as its first choice. ChatGPT listed the same repository among three options and recommended it as a starting point. Island confirmed that its ZIP contained SmartLoader.
These were controlled tests conducted by a security vendor, not telemetry from customer compromises. The important result is that the malicious repositories were discoverable without feeding the model a known bad link. Search results and public catalogs supplied the initial credibility.
Agent behavior also changed between runs. That makes model judgment a poor enforcement point. A client may notice a suspicious executable on one attempt and pass along the same installation steps on another.
Public catalogs amplified the lures
Island found campaign repositories listed by LobeHub, Glama, MCP.so and MCP Market. The researchers could not determine whether every entry was submitted by an attacker or collected automatically.
Some catalog pages reproduced the repository README, including its download link. A developer could therefore encounter the lure through a site dedicated to AI capabilities rather than through a broad GitHub search. The catalog placement looked like another endorsement even when no meaningful review had occurred.
A registry listing should be treated as discovery metadata unless the operator documents a security review. Star counts and polished instructions deserve the same skepticism. Both are easy for a campaign to manufacture or inherit from a copied project.
The endpoint supplied the real value
Most of the fake capabilities never had to connect to the service they advertised. Execution on a developer or analyst workstation already placed the malware near useful access.
StealC’s focus on cookies and active sessions is especially relevant. A password reset may leave an exposed OAuth grant or browser session usable. The affected machine can also hold repository tokens, cloud credentials and SSH keys that are unrelated to the promised skill.
That turns capability intake into a software distribution decision. A person or agent that finds a new MCP server is introducing code into an environment with existing identity and network access. The review should be based on the repository, package and execution path rather than on the quality of the feature description.
Put a review step between search and execution
Maintain an approved catalog for skills, MCP servers and agent plugins used with company data or credentials. Record the source repository, reviewed commit, version and expected package hash so incident responders can compare the inventory with a newly disclosed campaign.
Test unfamiliar capabilities on an isolated system without authenticated browser sessions or developer credentials. Inspect the archive before running it. A claimed MCP server distributed as a Windows executable without source or a manifest should be rejected.
Agents that can browse and clone repositories need policy outside the model. Restrict which sources they may install from and require approval before a downloaded program or setup command executes. Log the repository URL and command so a later alert can be tied back to the discovery path.
If SmartLoader may have run, isolate the endpoint and revoke live sessions as well as passwords. Rotate API tokens and cloud or developer credentials that were available on the machine.
FakeGit succeeded by fitting malware delivery into a routine search for useful software. Agent recommendations can shorten that search, but they should not shorten the security review that follows it.