AI Agents Are Becoming a New Malware Channel

The modern era of artificial intelligence is no longer just a productivity booster for end users, as threat actors increasingly leverage AI agents as a primary delivery channel for malware. Attackers no longer need to deceive users directly, opting instead to manipulate the trusted assistants that users rely on.

A report published by Island in July 2026 unveiled a malicious campaign named FakeGit, highlighting staggering operational metrics. The campaign involved roughly 7,600 fake GitHub repositories, 6,600 fraudulent profiles, and over 14 million total downloads. More than 800 of these repositories specifically impersonated AI skills and Model Context Protocol (MCP) servers to distribute the SmartLoader malware and the StealC information stealer.

The most surprising aspect for the cybersecurity community was who actually recommended these fraudulent repositories. Both Gemini and ChatGPT independently suggested the same malicious walmart-mcp repository, as the agents discovered the attacker's project and handed users installation instructions without realizing the threat.

Stock photo for illustration only, not from the actual event

Two core architectural characteristics make these attacks possible. First, agents process instructions and external text, meaning a malicious instruction hidden within a README file or webpage can be misinterpreted as a command to obey, known as indirect prompt injection. Second, these agents retain the capability to execute actions based on those instructions.