Attackers Planted 7,600 Malicious GitHub Repositories Targeting AI Agent Discovery
Security researchers documented a campaign called AgentBaiting in which attackers planted roughly 7,600 malicious GitHub repositories engineered for AI agents to discover without any user sharing a link. More than 800 impersonate AI skills or MCP servers, placing them where autonomous tools hunt for integrations. The pattern shifts agent risk from model hallucinations toward supply-chain poisoning, because agents may treat repository discovery as routine workflow and help install attacker-controlled dependencies. For teams deploying coding agents, the episode shows agent-mediated package discovery is an active malware vector, not a hypothetical edge case. Available reporting emphasizes campaign scale and targeting logic but does not detail full infection chains, remediation status, or independent corroboration beyond the cited research account.
Attackers Planted 7,600 Malicious GitHub Repositories Targeting AI Agent Discovery
Attackers planted 7,600 malicious GitHub repositories. The disturbing part is that agents could find them without anyone sending a link. They call it AgentBaiting.
Key takeaway
AI agents are becoming a primary vector for supply chain attacks, requiring automated cryptographic verification of agent-recommended dependencies instead of relying on human code review alone.
What happened
According to Towards AI reporting on security research, attackers planted about 7,600 malicious GitHub repositories in a campaign dubbed AgentBaiting, built so AI agents could discover and surface them without a user ever sending a link.
The same reporting states that more than 800 of these repositories masquerade as AI skills or MCP servers, specifically engineered to be found during agent-driven discovery and potentially used to auto-install malicious dependencies.
Evidence
Attackers planted 7,600 malicious GitHub repositories in a campaign called AgentBaiting.
Towards AI · attributed
Attackers planted 7,600 malicious GitHub repositories. The disturbing part is that agents could find them without anyone sending a link. They call it AgentBaiting.
Over 800 malicious repositories masquerade as AI skills or MCP servers to be discovered by AI agents.
Towards AI · attributed
Security researchers identified a campaign of 7,600 malicious GitHub repositories, over 800 of which masquerade as AI skills or MCP servers, specifically engineered to be discovered by AI agents.
The reported threat model shifts from model hallucinations to supply-chain poisoning via agent-driven dependency installation.
Towards AI · attributed
The attack surface for AI agents has shifted from model hallucinations to supply chain poisoning, where agents are weaponized to auto-install malicious dependencies.
Why it matters
Builders can no longer treat an agent's repository recommendation as a security boundary; agent workflows need sandboxing and signature verification before any recommended tool or dependency is installed.
Limits and uncertainties
The available packet truncates one research summary mid-sentence and does not provide full infection chains, remediation guidance, or independent corroboration beyond the cited Towards AI account.
Practical implications
Teams operating AI agents should verify signatures and run installs in sandboxes before trusting agent-discovered GitHub repositories, especially those presented as AI skills or MCP servers.
What to watch
Whether GitHub, MCP registries, or agent platforms publish detection rules, takedown counts, or verification requirements specifically for AgentBaiting-style repositories targeting autonomous discovery.
