Cases › security breach › LR-2026-0619
FakeGit campaign targets AI coding agents with malicious GitHub repos
Confirmed Why: 2 independent outlets · 2 independent reports
Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.
Status: no action reported
No source states: loss or records, developer and model, agent tool, could do, deployer, industry.
Severity major: Test: many third parties (a stated count of two or more affected parties). Fact: more than 14 million downloads recorded. Judgement: downloads are not stated as distinct affected parties.
Island researchers reported a campaign called FakeGit that created nearly 7,600 malicious GitHub repositories, more than 800 posing as AI skills or MCP servers, to deliver SmartLoader malware and then StealC. In Island's tests, Claude Code, Gemini and ChatGPT surfaced malicious campaign repositories without being shown a link, a technique Island named AgentBaiting. The repositories copied or imitated legitimate projects and were listed on public registries. Island advised a catalog of reviewed skills, sandboxed evaluation of new capabilities and publisher verification. The operation has recorded more than 14 million downloads as of July 2026.
What happened
What was done
No source states an action or fix.
Risks
Primary96 incidents
Rising: 24 vs 4.0 a week
Sorted by rule from the case's fields; not yet read from the sources.
Controls
Not yet read for controls. Controls that mitigate the primary risk:
ModelSafety training and refusal · Cyber and weapons safeguards · Abuse monitoring and account enforcement · Staged or restricted release · Dangerous-capability testing before release · Outside red-teaming · Content safety classifiers · Safeguards kept on in testing · Reasoning monitoring
Infrastructure / targetKnown flaws patched · Multi-factor sign-in and password policy · Network segmentation · Intrusion and endpoint detection · Backups and recovery · Phishing and fraud filters
Evidence
No source states: what went wrong, what it reached or did, how it was caught, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.
Show the full account: 1 items from the primary sources
What happened, in order
- 2026-07 The operation had recorded more than 14 million downloads across about 200 campaign repositories.
Show every field, with its source and grade
What happened
Impact
Notes on gaps
The remediation is advice from Island, not a change made by a party. No real-world agent loss is reported.
LR-2026-0619 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON