Seven thousand six hundred repositories. Fourteen million downloads. Six hundred registry listings. One Polygon smart contract at the end of the chain, whispering instructions to malware on infected developer machines.
That is the operational footprint of AgentBaiting, a campaign mapped by Island Security that I consider the most significant AI supply chain attack of the year. The data point that should disturb you most is behavioral, not statistical: in controlled tests, Claude Code, Gemini, and ChatGPT all actively recommended malicious repositories when users asked for legitimate development tooling. The agents did not merely fail to flag malware. They endorsed it.
That is not a vulnerability in the traditional sense. It is the structural default of how AI agents make trust decisions. And that default is now being exploited at industrial scale. If you deploy AI agents in your development pipeline, you are the target. Not because your credentials are weak. Because the discovery layer connecting your agent to the open-source ecosystem was never designed to validate what it recommends.
The Chain
The attack chain, documented by Island and corroborated by research from Straiker AI and Trend Micro, reads like a study in layered obfuscation: malicious GitHub repositories hosting embedded ZIP archives, a LuaJIT loader unpacking SmartLoader, and a Polygon smart contract serving as the command-and-control channel. The final stage is StealC, an infostealer that captures session cookies, OAuth tokens, and SSH credentials. Password rotation does not remediate that class of compromise. You are looking at out-of-band session revocation, API key rotation, and a long night of artifact hunting.
What makes this delivery mechanism genuinely new is the MCP ecosystem. Model Context Protocol registries like LobeHub, Glama, MCP.so, and MCP Market function as the app stores of the agent economy. A developer asks Claude Code to orchestrate a workflow; the agent searches these registries and recommends a package. The operator seeded more than 6,600 malicious configuration files across these platforms, borrowing real developer identities and mirroring READMEs between registries. The mirroring is the smart part: when one platform removes content, others keep it alive, and cross-registry synchronization re-infects the cleaned platform.
GitHub alone hosted roughly 7,600 malicious repositories. More than 200 of them accumulated over 14 million downloads. That is not the profile of a failed attack. That is a conversion rate. The economics are equally stark. Deploying hundreds of C2 contracts on Polygon costs on the order of a few hundred dollars. For an operation potentially harvesting credentials from thousands of enterprise systems, that is a rounding error.
The attacker profile emerging from the data is industrial. Registered accounts on multiple registry platforms, content marketing across README files, and synchronization across the ecosystem — this requires a team with engineering, operations, and social engineering skills. This is not a novel vector being tested. This is a production capability being run like a business. The use of LuaJIT rather than a simpler loader is also notable. Lua is not the default choice for malware; its use suggests the operators either have prior positive experience with LuaJIT-based evasion or borrowed the technique from a framework they acquired. Trust, like entropy, is easier to spend than to restore — and this operation is spending it aggressively.
Three Structural Observations
First: the Polygon choice is cost-optimization, not cryptographic capability. I have spent years on the defensive side of this stack. In 2019, I manually traced the constant product invariant in Uniswap v1 and identified an integer overflow in eth_to_token_swap_input that automated scanners missed. That exercise drilled one lesson into me: attackers choose infrastructure based on cost-avoidance, not capability. Polygon wasn't chosen because it offers unique anonymity. It was chosen because it is cheap, programmable, and statistically invisible. Consider the trade-off matrix. Bitcoin supports immutable storage, but is non-programmable; storing command structures requires awkward OP_RETURN hacks. Ethereum is programmable, but gas costs multiply when you need hundreds of contract deployments. Polygon offers near-zero transaction fees, EVM compatibility, and enough daily volume that a handful of malicious contract calls disappears into the noise floor. The tell is what is missing from the contract design: no multisig, no proxy patterns, no zero-knowledge proofs, no stealth-address gymnastics. This is a deliberately stupid command bus. Sophistication went into the delivery layer, not the chain component. That allocation tells me the operators understand exactly where the real security gap lives.
Second: the real innovation is eliminating verification entirely. Traditional supply chain attacks target package managers like npm or PyPI. Someone publishes a malicious package and waits for a pipeline to ingest it. Defenses exist: dependency review, code signing, runtime behavioral analysis, sandboxed execution. AgentBaiting short-circuits the entire defensive architecture. No package manager is compromised. No signature is forged. No vulnerability is exploited. The attacker publishes a repository that looks credible, then lets the agent's discovery algorithm — which treats "findable" as "safe" — perform the distribution. Island's live tests confirmed this. Claude Code recommended a malicious skill repository. Gemini recommended a malicious MCP server. ChatGPT did the same. I am not surprised. In 2026, when I audited an oracle network claiming to feed AI-generated predictions on-chain, I hit the same wall: non-deterministic model output violated blockchain consensus requirements. You cannot validate what a probabilistic system produces without a deterministic verification layer. AgentBaiting is the supply chain mirror of that exact problem. AI agents are probabilistic systems making irreversible trust decisions — install, execute, exfiltrate — and no deterministic check intervenes anywhere in the flow.
Third: the scale implies a factory, not a hacker. 7,600 repositories do not emerge from a single operator. This is automated campaign infrastructure: a pipeline that generates plausibly named repositories, seeds them on registry platforms, and uses borrowed developer identities for social proof. The operators are very likely manipulating stars, forks, and download counts to improve search-rank signals. AI agents that score repository trust based on community signals are trivially fooled by fabricated metrics. This detail matters because the attack surface is not the code. It is the scoring system. The Trend Micro connection — a similar campaign attributed to Water Kurita using Lumma Stealer — and the shared LuaJIT loader lineage point to an attack framework in active productization. Once a template reaches that stage, the marginal cost of new campaigns approaches zero. New chains, new payloads, new victims.
There is also a structural wrinkle the public analysis has missed. If each of those 6,600 configuration files points to a distinct C2 contract, then clusters of contract deployments become a fingerprint. Chain analysis tools can group them by deployment wallet, by gas funding pattern, by interaction timing. The same transparency that hides the C2 in transaction noise makes the campaign's structure visible to anyone with a block explorer and a graph query.
It is worth resisting the temptation to classify this as a blockchain-native attack. The contract code does nothing a web server could not do. But the decision to move C2 on-chain signals something important: attackers are increasingly comfortable treating public blockchains as infrastructure utilities. No domain registrars to subpoena. No hosting providers to pressure. No certificate authorities to revoke. The chain is neutral. It will carry the traffic regardless of who is paying the gas.
The remediation stack, from my experience auditing similar compromises, is concrete: map every agent-integration point in your organization; approve only internally reviewed repositories; sandbox any code an agent installs from external registries; monitor Polygon and other low-cost EVM chains for contract interactions originating from developer workstations. And treat any exposed session token as compromised — because StealC captures exactly the tokens that bypass MFA.
The Forensic Inversion
Everyone is focusing on the "blockchain as criminal infrastructure" narrative. They are missing why a blockchain C2 is actually a gift to defenders.
Network-layer monitoring cannot see this C2 — no domain to sinkhole, no IP to blocklist, no TLS certificate to revoke. But immutability cuts both ways. Every command the malware has received is permanently inscribed on a public ledger. The moment researchers identify the C2 contract address, the entire operational history is exposed. Every gas payment. Every funding wallet. Every interaction timestamp. Chain analysis firms have spent a decade building tooling to trace ransomware payments and bridge heists. The AgentBaiting operator just uploaded their operational database to a public block explorer. Traditional C2 infrastructure vanishes on server takedown. On-chain C2 becomes evidence that cannot be deleted.
The regulatory angle is also more nuanced than the headline suggests. On one hand, this event gives regulators a fresh reason to claim cryptocurrency infrastructure enables crime. On the other, the on-chain forensic trail makes this one of the most traceable C2 infrastructures ever observed. The same immutable ledger that allows pseudonymous operations allows deterministic attribution. Agencies like CISA and ENISA may shift their posture from "blockchain is risky" to "blockchain is evidence."
There are two additional blind spots. The first is the registry mirror hydra: even if GitHub deletes all 7,600 repositories, the malicious configuration files survive on the mirror network. MCP.so pulls from Glama, Glama pulls from LobeHub. Coordinated takedown is the only remedy, and no coordination mechanism exists today. The second is misaligned incentives among AI vendors. Companies building agents are commercially invested in demonstrating autonomy. An Anthropic that inserts a "verify this repository" interstitial before code execution is an Anthropic admitting its product cannot be trusted without supervision. That is a business-model problem, not a technical one.
The Template
This campaign will not be the last. It will be the template.
Low-cost chain as C2, stolen identities for credibility, registry mirroring for amplification, and an AI agent's discovery layer as the unwitting distributor. Zero-knowledge isn't a magic shield here — it's mathematics wearing a mask, useful for privacy, useless for trust. The only effective defense is redesigning the trust model: verifiable repositories with cryptographic identity, sandboxed execution for agent-installed code, and continuous monitoring of anomalous contract interactions on low-cost chains.
Every AI agent that recommends code without verification is spending down the trust of the entire open-source ecosystem. Code is law, but bugs are reality. The bug is in the default.
The market hasn't priced this yet. But it will.
