{"schema_version":"0.10.0","id":"LR-2026-0619","record_version":1,"title":"FakeGit campaign targets AI coding agents with malicious GitHub repos","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":50.5,"score_breakdown":{"source_authority":12.1,"independent_corroboration":15.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":1.92,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"confirmed","reason":"2 independent outlets","original_document":null,"reports_total":2,"reports_independent":2,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"confirmed","reason":"2 independent outlets"}]},"sources_hash":"c2e16cedbc9b9aa2e7b4e3a73d9e4be9c42d9f59ab2e54009d0e184009ddcc02"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-07-20","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"Island researchers reported a campaign called FakeGit that created nearly 7,600 malicious GitHub repositories, more than 800 posing as AI skills or MCP servers, to deliver SmartLoader malware and then StealC. In Island's tests, Claude Code, Gemini and ChatGPT surfaced malicious campaign repositories without being shown a link, a technique Island named AgentBaiting. The repositories copied or imitated legitimate projects and were listed on public registries. Island advised a catalog of reviewed skills, sandboxed evaluation of new capabilities and publisher verification. The operation has recorded more than 14 million downloads as of July 2026.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"Test: many third parties (a stated count of two or more affected parties). Fact: more than 14 million downloads recorded. Judgement: downloads are not stated as distinct affected parties.","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://thehackernews.com/2026/07/fakegit-campaign-uses-7600-github.html","publisher":"The Hacker News","date":"2026-07-20","type":"press","title":"FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware - The Hacker News","archived_url":null,"attachment":"first_report","independence":"independent"},{"url":"https://www.helpnetsecurity.com/2026/07/21/github-repos-malware-campaign-fakegit-ai-agents/","publisher":"Help Net Security","date":"2026-07-21","type":"press","title":"AI agents tricked into recommending malicious GitHub repositories - Help Net Security","archived_url":null,"independence":"independent"}],"per_field_confidence":{"event.incident_class":"C","impact.severity":"D","impact.severity_because":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"event.incident_class":[{"source_index":0,"quote":"Cybersecurity researchers have discovered nearly 7,600 malicious GitHub repositories, out of which more than 800 pose as artificial intelligence (AI) skills or Model Context Protocol (MCP) servers to deliver a malware family known as SmartLoader as part of an ongoing campaign codenamed FakeGit."}],"impact.severity":[{"source_index":0,"quote":"As of July 2026, the FakeGit operation has recorded more than 14 million downloads across GitHub Release assets in about 200 campaign repositories."}],"impact.severity_because":[{"source_index":0,"quote":"As of July 2026, the FakeGit operation has recorded more than 14 million downloads across GitHub Release assets in about 200 campaign repositories."}],"event.summary":[{"source_index":0,"quote":"Cybersecurity researchers have discovered nearly 7,600 malicious GitHub repositories, out of which more than 800 pose as artificial intelligence (AI) skills or Model Context Protocol (MCP) servers to deliver a malware family known as SmartLoader as part of an ongoing campaign codenamed FakeGit."},{"source_index":0,"quote":"Island said its tests revealed Anthropic Claude Code, Google Gemini, and OpenAI ChatGPT to be susceptible to this trickery, allowing the models to surface malicious campaign repositories without even being shown a link."},{"source_index":0,"quote":"To counter the threat, it's advised to build a catalog of reviewed Skills, MCP servers, and agent plugins, evaluate new agent capabilities in a sandboxed environment first before broader rollout, verify both the publisher and the project to ensure credibility, and monitor agentic pathways."},{"source_index":0,"quote":"As of July 2026, the FakeGit operation has recorded more than 14 million downloads across GitHub Release assets in about 200 campaign repositories."}]},"notes_on_gaps":"No single deployed AI system is identified; the agent behaviour was observed in Island's own tests of Claude Code, Gemini and ChatGPT, so model versions, developer harness and deployer are not stated. Date of occurrence, failure class, trigger, root cause and loss figures are not stated and were left out. The date_detected value 2026-07 is inferred from the July 2026 report, not a stated detection date. Severity 'major' is a judgement: 14 million downloads are a stated count but not stated as distinct affected parties. The G3 'missing' outcome is inferred from Island's advice, not a stated finding. The remediation is advice from Island, not a change made by a party. No real-world agent loss is reported. Operator, country and industry are not stated. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Confirmed (2 independent outlets)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"AI agents searching for a skill or MCP server could discover a bogus GitHub repository and act on its README without a human involved.","quote":"This occurs when an AI agent searching for a skill or an MCP server ends up inadvertently discovering one of these bogus GitHub repositories, causing it to do the attacker's bidding on its own without any intervention from a human user.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://thehackernews.com/2026/07/fakegit-campaign-uses-7600-github.html","https://www.helpnetsecurity.com/2026/07/21/github-repos-malware-campaign-fakegit-ai-agents/"]},"analysis":{"sections":{"timeline":[{"text":"The operation had recorded more than 14 million downloads across about 200 campaign repositories.","quote":"As of July 2026, the FakeGit operation has recorded more than 14 million downloads across GitHub Release assets in about 200 campaign repositories.","source_index":0,"when":"2026-07"}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://thehackernews.com/2026/07/fakegit-campaign-uses-7600-github.html","https://www.helpnetsecurity.com/2026/07/21/github-repos-malware-campaign-fakegit-ai-agents/"]}}