You asked your coding agent to find a skill. It searched, read a README that looked like documentation, and told you to download a ZIP and run it. Nobody sent you a bad link. The agent found the malware on its own and recommended it — and in one test run, it cloned the repo and ran the files for you.

On July 21, 2026, Island published research on a campaign it calls FakeGit — and a delivery technique it names AgentBaiting. The numbers are large: roughly 7,600 malicious GitHub repositories across about 6,600 accounts, of which more than 800 pose as AI skills or MCP servers — Gmail and WhatsApp integrations, Databricks and Jenkins and Docker tooling, the kind of capability a developer asks a coding agent to go find. More than 600 of them were also listed on public AI registries like LobeHub, Glama, MCP.so, and MCP Market. By July, a subset of about 200 repositories had logged more than 14 million downloads of their release assets.

The payload is a Windows loader called SmartLoader that establishes persistence and pulls down StealC, an information stealer. The malware is the ordinary part. How it reaches you is the new part.

AgentBaiting: the agent is the delivery vector

Supply-chain attacks used to need a lure — a link in an email, a typosquatted package name you fat-fingered, a search result you clicked. FakeGit removes the human from that step. Island's finding, in their words: "An AI agent does not need to be given a malicious link. It can discover a FakeGit repository on its own, treat the README as legitimate documentation, and pass the attacker's instructions to the user."

They tested it against real agents:

Ask Claude Code to "find a free cinematic-prompt skill" and it surfaced adlaiponderous700/claude-skill-cinematic-prompt and, in some runs, recommended the download-and-execute steps.
Ask Gemini for a "free Walmart MCP server" and it returned DomingosNgongo/walmart-mcp as the top result, with a direct GitHub link.
ChatGPT listed the same repo among its options and singled it out as "the best place to start."

None of these were handed a link. The agents went looking for a capability, found the campaign's repositories through ordinary search and registry browsing, and read the attacker-authored README the way they read any documentation — as fact. The repos are dressed for exactly that reader: Mann1988/awesome-claude-skills copies the real ComposioHQ/awesome-claude-skills (67,000+ stars) and pads itself with 63 stars and 18 forks so it looks established. Usernames are one character off a known maintainer's. The README walks the reader through three steps: download the ZIP from GitHub Releases, run it, click past any security warning, follow the setup wizard.

And in at least one run, Island reports, Claude Code did not stop at recommending — it "cloned malicious repositories and downloaded the malicious files onto the test machine" before something in the indicators made it halt. That is the whole attack surface in one sentence: the agent, doing a routine task, brought the payload down to the disk itself.

What actually lands

The ZIP is not source code. Island is blunt about the tell: "A legitimate MCP server or Skill is source code with a manifest, not a Windows ZIP holding a launcher script, a renamed runtime, and a payload disguised as a text file." Inside a FakeGit release like server_databricks_mcp_1.6.zip you get a small .cmd or .bat launcher, a renamed LuaJIT-style runtime (luau.exe), and a ~300 KB obfuscated Lua payload wearing the name of a data file — ico64.txt. The launcher runs start luau.exe ico64.txt, the console window hides itself, and SmartLoader:

resolves its command-and-control address from a value stored in a Polygon smart contract — decentralized, awkward to take down;
registers scheduled tasks under %LOCALAPPDATA% so it survives a reboot;
pulls encrypted stages from GitHub and injects StealC into another process through a PE crypter.

StealC then does what infostealers do, and a little worse: it takes browser passwords and cookies, browser-extension data, email and remote-access credentials, screenshots, host details — and active sessions. Island's note on that last point matters: "StealC takes live sessions, not just passwords, so resetting passwords alone is not enough." A stolen session token is already past your login.

AgentBaiting closes the loop with no human lure. The agent searches for a capability, finds a FakeGit repo on its own, reads the attacker's README as documentation, and either recommends the install steps or clones and runs them itself. On a normal setup that runs on your machine: the Windows loader executes, StealC scrapes your real passwords and live sessions, and the loot beacons out.

Why vetting the repo was never the whole answer

The instinct is to catch the bad repo — flag the lookalike name, score the README, blocklist the account. Island's own advice points somewhere harder: "Watch the paths agents use, not only the paths users use. AgentBaiting means a download, a git clone, or a shell command can originate from an agent completing a routine task." The agent's search is not a path you can put a human checkpoint on. It runs at machine speed, across thousands of near-identical repos, and it treats whatever it finds as documentation because that is its job.

This is the same wall the rest of agentic security keeps hitting. A denylist that reads the command loses to the shell that rewrites it. A scanner that reads the package loses to the payload that isn't in the package. And a review meant to find malware runs the malware it was sent to find. FakeGit adds one more: a recommendation engine that treats an attacker's README as truth. Every one of these puts a filter where the bad thing is described and hopes to catch it before the bad thing runs. The description is the attacker's to write. The execution is the only place the outcome gets decided.

Where Bromure draws the line

Bromure Agentic Coding does not try to out-guess the agent's search results. It changes what happens at the one moment that matters — when the recommended thing runs. Every agent Bromure runs — Claude Code, Codex, Grok Build — runs inside a disposable Linux VM on your Mac, not on macOS itself. So when the agent clones the FakeGit repo and executes the ZIP the way Island watched Claude Code do, three things are already true.

First, the payload is inert. SmartLoader is a Windows program: a .bat launcher, a luau.exe runtime, a PE-crypter injection, scheduled tasks under %LOCALAPPDATA%. The Bromure agent runs on Linux. The .cmd launcher has no interpreter, the luau.exe and the injected StealC PE will not execute, and there is no %LOCALAPPDATA% and no Windows Task Scheduler for the persistence to attach to. An attack compiled for one operating system runs on the other and finds nothing it knows how to do.

Second, there are no real credentials to take. Suppose the attacker had shipped a Linux build. StealC's whole purpose is to scrape browser stores, live sessions, and saved credentials — and inside the VM there is no signed-in browser, no cookie jar, no session to lift. The secrets it can find on disk and in the environment are decoys: Bromure injects placeholder values (brm_…, a synthetic ~/.kube/config, throwaway ssh and cloud tokens) into the VM and swaps the real ones back only on the host, in the proxy, on the way out to the real API. The genuine keys never enter the box. Whatever reaches the Polygon-resolved C2 is a bag of strings that authenticate to nothing.

Third, the egress is visible and the box is throwaway. The C2 lookup, the encrypted-stage fetch from GitHub, the exfiltration beacon — those show up in Bromure's Security Log as outbound traffic you can see. And because the VM's home is disposable, the scheduled task and any dropped binary vanish the next time you reset the profile to base. There is no persistent host for SmartLoader to keep a foothold on.

Same repo, same recommendation, same clone — different machine. Inside Bromure the agent runs on a throwaway Linux VM: the Windows loader can't execute, there are no live sessions or real keys to scrape, the credentials on disk are decoys swapped for the real ones only on the host proxy, and the C2 beacon is logged. The recommendation still happens. The theft has nothing to take.

There is a fourth layer, because this attack is a reading attack before it is an execution attack. The FakeGit README is exactly the kind of untrusted authority Bromure watches — the same class as a rogue CLAUDE.md, an AGENTS.md, or a SKILL.md. Bromure's on-device prompt-injection detection scores the content the agent ingests as documentation against local models that never leave the Mac, plus a deterministic scanner for invisible-Unicode tricks. A README that tells the agent "download this ZIP, run it, click past the warning" is precisely the case that detector exists to flag. It is not a wall on its own — but in Bromure it sits on top of isolation, so a miss is still caught by a box with nothing real in it.

What this draws a line around

Isolation is containment, not a recommendation filter. It is worth being precise about what Bromure does and does not change here.

The agent can still recommend the repo

Bromure does not vet GitHub, MCP registries, or an agent's search results, and it does not stop the agent from surfacing a FakeGit repo or handing you its install steps. Its Supply Chain scanning covers package registries — npm, PyPI, Cargo and the rest — not a lookalike repo's README. What changes is where the recommended thing runs and what it can reach when it does.

A Windows payload is stopped by the OS boundary, not a rule

SmartLoader fails because the agent runs on Linux, not because Bromure fingerprinted it. A Linux-native stealer would execute — and still come up empty, because there is no signed-in browser or live session in the VM, the credentials are decoys, and the home is disposable.

Substitution covers the secrets you configure

The decoy swap protects credentials you put in a profile: model keys, git and cloud tokens, managed database endpoints, ssh keys. A live session you establish by hand inside the box, or a secret a script writes to a file mid-run, is just data. Keep secrets in the broker, not in the workspace.

Detection is a net, not a wall

On-device injection scoring flags an install-and-run README more often than not, but a determined author can phrase a lure to slip a single scanner. Treat the detector as one layer; the containment — a throwaway box with fake keys and a logged egress — is what holds when a detector misses.

Island's closing line is the one to sit with: "AI capabilities have become a route through which software enters the enterprise, and FakeGit will not be the last campaign to use it." Your agent is going to search for skills and servers, and some of what it finds will be dressed to be found. The question is not whether it ever recommends the wrong repo — at 7,600 repos and 14 million downloads, sometimes it will. The question is what runs when it does: your machine, your browser sessions, and your real keys, or a Linux box you can throw away with a handful of decoys inside it. Bromure makes it the second one.