AI Agents Become a New Malware Channel as FakeGit Targets MCP Repositories

A malware campaign documented in July 2026 that used thousands of fake GitHub repositories and accounts, including repos impersonating AI tools and MCP servers, to push developers into downloading malware such as SmartLoader.

Because they operate with broad permissions over data and systems, and are often installed from open sources without sufficient vetting, so compromising one grants deep access inside the enterprise.

No, but they should delay uncontrolled adoption. A clear policy for verifying MCP repositories and skills, pinning versions, and reviewing permissions before production deployment is the better path.

Traditional attacks target well-known software packages, while FakeGit targets the agent and skill layer itself, which has far less mature scanning and monitoring tooling.