AI Agents Tricked into Recommending Malicious GitHub Repositories
What Happened — Researchers identified a campaign, dubbed FakeGit, that created ~7,600 malicious GitHub repositories. The repos masquerade as AI Skills or Model Context Protocol (MCP) servers and have been used to deliver the SmartLoader malware family, which installs the StealC information‑stealer. In testing, leading AI agents (Claude, Gemini, ChatGPT) surfaced these malicious repos when asked for code or services, effectively “baiting” the agents themselves.
Why It Matters for Compliance & Audit Readiness
- The attack exploits third‑party code and open‑source supply‑chain controls—exactly the scenario SOC 2 vendor‑management criteria (CC6.1, CC6.2) are designed to monitor.
- Continuous evidence of third‑party risk assessments (e.g., repository provenance, SBOM validation) becomes critical audit evidence.
- Demonstrating a documented process for vetting AI‑generated recommendations aligns with the “monitoring” and “risk mitigation” principles of SOC 2.
Who Is Affected – SaaS platforms, AI‑tool providers, DevOps toolchains, and any organization that integrates third‑party code from public repositories (tech, finance, healthcare, etc.).
Recommended Actions
- Map the FakeGit technique to your vendor‑risk controls (SOC 2 CC6.x) and update your third‑party assessment checklist.
- Implement automated SBOM generation and repository provenance checks for any code pulled from public sources.
- Add AI‑agent interaction logs to your continuous monitoring pipeline as audit evidence of safe code sourcing.
Source: Help Net Security
Technical Notes – The campaign uses look‑alike developer profiles, copied READMEs, and malicious ZIP assets. SmartLoader establishes persistence and drops StealC, which harvests credentials and active sessions. No specific CVE is cited; the vector is malicious repository distribution (AgentBaiting). Source: same as above