FakeGit uses AI agents to pull malicious GitHub repos, hijacking code assistants
Attackers have uploaded roughly 7,600 fake GitHub repos that masquerade as AI skills and Model Context Protocol servers. AI coding agents like Claude Code, Gemini, and ChatGPT automatically surface these repos, tricking developers into downloading the SmartLoader/StealC malware chain. The new "AgentBaiting" tactic forces teams to verify AI‑sourced code and isolate agents.