The AgentBaiting Paradigm: How Water Kurita Targets Autonomous Agents
Threat actors aren't just hacking developers directly anymore; they're tricking the autonomous AI coding assistants developers trust to do their work. A massive cybercriminal operation dubbed 'FakeGit' has deployed more than 7,600 malicious GitHub repositories designed to distribute SmartLoader and StealC malware. While traditional supply chain attacks rely on human engineers typo-squatting package names or downloading tainted dependencies, FakeGit introduced an insidious operational pivot: weaponizing public AI registries and Model Context Protocol (MCP) server directories to lure autonomous LLM agents into installing malicious software.
According to research reported by BleepingComputer, security researchers at enterprise browser platform Island discovered that the threat actor behind FakeGit—tracked by Trend Micro as Water Kurita—began aggressively expanding into the AI space in March, reaching a peak in April when hundreds of new AI-focused repositories were published. Out of the 7,600 repositories uncovered across the campaign, more than 800 specifically masqueraded as specialized AI skills, integration plugins, or MCP servers. These repositories appeared over 600 times across public AI catalogs including LobeHub, Glama, MCP.so, and MCP Market.
Island researchers termed this novel tactic "AgentBaiting." The goal isn't merely convincing a human developer to click a link. Instead, attackers design repo metadata, README documentation, and system prompts so that tools like ChatGPT, Claude, Gemini, and Cursor index the repositories as valid setup resources. When a developer asks an AI agent to set up an integration for Databricks, Jenkins, Docker, Gmail, or WhatsApp, the agent reads the poisoned documentation, parses the setup instructions as benign, and prompts the human to execute—or directly executes—the malicious bootstrap command.
While GitHub download counters logged 14,084,688 cumulative download events across 335 release assets in 211 FakeGit repositories, security researchers clarify that this metric includes automated scraping and repeat requests rather than 14 million compromised endpoints. Nevertheless, the sheer reach demonstrates how easily malicious listings penetrate third-party AI registries when discovery pipelines lack strict signature verification.
Inside the FakeGit Payload: From Lua Installers to Polygon C2 Networks
The mechanics behind FakeGit reveal a multi-stage infection routine engineered to evade static file scanners while establishing resilient command-and-control (C2) channels. Threat actors carefully mimic legitimate open-source repositories by fabricating star counts, forging fork metrics, copying genuine project descriptions, and using stolen developer profile handles to project authenticity.
The entry point typically sits inside the repository's README file. Visitors and AI agents are instructed to download a release ZIP archive containing setup tools or missing dependency scripts. However, these archives do not contain standard source code. Instead, they bundle a disguised Lua runtime payload that acts as the initial execution trigger for SmartLoader.
Once SmartLoader executes on a target host, it immediately executes several core evasion and persistence steps:
- Persistence Setup: SmartLoader creates Windows scheduled tasks to ensure execution survives system reboots.
- Blockchain-Based C2 Resolution: To prevent network defenders from blocking static C2 domain names or IP addresses, SmartLoader queries a smart contract deployed on the Polygon blockchain to resolve its active command server address.
- Stage Retrieval: SmartLoader fetches second-stage encrypted payloads directly from secondary GitHub repositories, decrypting them in memory.
- Final Payload Execution: The loader deploys the StealC information stealer, a lightweight malware variant designed to harvest saved browser credentials, session cookies, cryptocurrency wallets, SSH keys, and local environment secrets.
By leveraging Polygon smart contracts for infrastructure lookup, Water Kurita makes C2 teardowns exceptionally difficult, as security teams cannot take down decentralized smart contracts through standard registrar abuse requests.
Indirect Prompt Injection and Error-Driven Payload Tricks
The threat to AI agent security extends beyond static file downloads, intersecting with vectors explored in how a benign GitHub repo can hijack your machine through AI coding agents. Complementary research highlighted by BleepingComputer from Mozilla's Zero Day Investigative Network (0DIN) demonstrates how autonomous agents can be manipulated into executing host commands even when the GitHub repository itself contains zero malicious code.
In controlled testing by Island researchers, agentic tools like Claude Code were observed cloning FakeGit repositories and downloading release files onto test environments. While Claude Code occasionally detected suspicious indicators prior to final execution, the tests proved that coding agents routinely process instructions embedded in external README files without treating them as untrusted input.
Mozilla 0DIN demonstrated an even more subtle execution vector known as error-driven recovery exploitation. An attacker creates a completely clean GitHub repository containing standard-looking setup commands (e.g., pip3 install -r requirements.txt followed by python3 -m axiom init). The installed Python package is intentionally programmed to throw a setup error, directing the user—and the AI agent—to run an initialization script to fix the environment.
When an autonomous AI agent encounters the error, it attempts to self-heal by automatically running the suggested command. That command executes a shell script that retrieves a dynamic command payload stored in a remote DNS TXT record controlled by the attacker. Because the payload lives three levels of indirection away—inside a trusted error message, a launcher script, and an unmonitored DNS record—the agent executes an interactive reverse shell with the developer's full local privileges without triggering security flags or agent policy warnings.
Artificial Intelligence AI Cybersecurity Threats: Complete Defensive Practices
Defending software development pipelines against AgentBaiting requires updating security practices to account for autonomous agent behaviors. Organizations can no longer assume that developer tools will critically evaluate instructions fetched from third-party repositories. Enterprise security models—including guidance from frameworks like IBM Security architecture standards and strategies for securing agentic AI through guardian architectures—emphasize strict isolation and boundary verification for autonomous systems.
Essential Security Defenses for AI Agent Workflows
To mitigate artificial intelligence cybersecurity threats across dev environments, security teams must implement a complete set of defensive controls:
- Maintain Approved Skills Directories: Block developers and AI agents from resolving MCP servers or agent plugins directly from public index sites like MCP.so or LobeHub. Maintain internal, curated registries where every package is vetted and signed.
- Isolate Agent Execution Environments: Never run autonomous coding agents directly on developer workstations containing unencrypted API keys or production credentials. Use containerized dev containers or ephemeral sandboxes (such as Red Hat's secure agent sandbox framework) restricted by egress network filtering.
- Disable Auto-Execution of Unverified Shell Commands: Configure AI agent parameters to require mandatory human confirmation before executing system scripts, package installations, or shell commands fetched from external repositories.
- Implement DNS & Smart Contract Monitoring: Monitor endpoint network egress for calls to public blockchain RPC nodes (like Polygon endpoints) and unexpected DNS TXT queries originating from development tools.
- Enforce Secret Rotation Practices: If SmartLoader or StealC execution is detected or suspected, immediately execute an emergency secret rotation tutorial protocol across all local
.envfiles, SSH host keys, AWS tokens, and GitHub personal access tokens.
As autonomous AI agents take over more software engineering tasks, Securing the interface between models and untrusted external code becomes a mandatory pillar of software supply chain security. Without strict execution sandboxes and verified registries, AgentBaiting will remain one of the most effective threat vectors against modern engineering teams.