# GitHub Has a Fake AI Tools Problem. 7,600 Repositories Worth.
The repositories look legitimate. They have star counts, forks, activity graphs, convincing README files, and profile pictures of developers who appear to have shipping histories. One of them offers an MCP server for connecting an AI assistant to a popular API. Another packages itself as an AI agent skill ready to drop into your development environment.
Open the ZIP file inside, and you've just installed SmartLoader.
Cybersecurity researchers have uncovered nearly 7,600 malicious GitHub repositories operating as part of a coordinated campaign called FakeGit. More than 800 of those repos specifically impersonate AI tools — Model Context Protocol servers, AI agent skills, and developer utilities built for the booming ecosystem around large language models. The campaign is ongoing. The scale is not an accident.
## The Trust Stack Being Exploited
To understand why this works, you have to understand what GitHub means to a developer in 2026. It isn't just a code host. It's a reputation system, a social graph, and a procurement channel. When a developer searches for an MCP server that connects Claude or another assistant to their database, they go to GitHub. They look at stars, they scan the README, they check if the account has other repos. FakeGit understood this workflow and built infrastructure to defeat every surface check.
The campaign uses what researchers describe as copied projects with lookalike developer profiles. That means these aren't freshly generated accounts with zero history — they appear to have contributed to other repos, followed real developers, accumulated some social texture. The READMEs are well-written. The package descriptions match what a legitimate tool would say about itself.
The malicious payload lives in a ZIP archive linked from the repository. It's a small but important detail: the code visible in the repo may be entirely clean. Static analysis tools, automated scanners, and even a careful human code review might miss the infection vector entirely because the vector isn't in the repository code at all. It's in a file you're expected to download and run.
## Why AI Tooling Is the Right Target, Right Now
Model Context Protocol didn't exist two years ago. Anthropic released the open specification in late 2024, and within months it had become the de facto standard for connecting AI assistants to external tools, data sources, and APIs. The ecosystem exploded — developers building MCP servers for everything from GitHub itself to internal databases to productivity tools. That explosion happened faster than any security review process could track.
When a new ecosystem grows that fast, three things happen simultaneously: the tools aren't yet in package registries with security scanning, the community doesn't yet have established trust signals, and developers are actively searching for solutions that don't exist in official channels. That's an attacker's ideal window. Supply chain attackers have exploited analogous moments before — the npm ecosystem circa 2018, PyPI in 2021 and 2022, and VSCode extension packages through the mid-2020s. FakeGit is running the same playbook but with better timing and a higher-value target.
The developers installing MCP servers aren't junior engineers blindly running scripts. They're often senior engineers building agentic workflows, connecting AI systems to production databases and internal APIs. The access those systems have — and the access they can be coerced into providing by a malicious "skill" — is substantial.
## What SmartLoader Actually Is
SmartLoader's name describes its function: it's a loader, not a payload. What that means in practice is that installing it doesn't trigger an obvious, scannable infection. It establishes a persistent dropper that pulls down secondary payloads after installation — the actual malware that does damage. That architecture is deliberate. It makes the initial file less detectable because the file itself isn't doing anything immediately suspicious. The real payload arrives later, after the system has been profiled, and it can be tailored to the environment.
Loaders of this class have historically delivered infostealers, remote access trojans, and ransomware precursors. The choice of delivery mechanism tells you about the campaign's ambitions: this is not a bulk spray-and-pray operation. Deploying this into developer workstations connected to AI workflows, internal APIs, and credential vaults is a targeted intelligence operation dressed up as a developer tool.
## What Defenders Can Actually Do
The conventional advice — "don't download untrusted code" — doesn't map cleanly onto an ecosystem where finding new tools requires downloading from unknown authors by definition. More useful countermeasures:
For individual developers: Run MCP servers and AI agent tools in isolated environments. A containerized sandbox that has no access to your production credentials, API keys, or sensitive filesystem paths limits blast radius significantly. Treat every new MCP server like a browser extension — assume it has read access to everything you give it.
For security teams at organizations: The developer workstation is increasingly a privileged network node because of how AI workflows are structured. Endpoint monitoring needs to account for Python scripts, Node packages, and binary executables spawned from AI tool directories. Flag outbound connections from those paths to unexpected hosts.
For platform trust: GitHub has existing tooling for detecting coordinated inauthentic behavior — it uses it for bot networks and spam. The FakeGit campaign's scale (7,600 repositories with lookalike profiles) should be detectable at the platform level with the right signals. Whether GitHub prioritizes this as a trust-and-safety problem at the same level as other abuse is a policy question, not a technical one.
---
## HackWire Analysis
The FakeGit campaign is worth reading as a leading indicator, not just as an incident report.
Every major software ecosystem has gone through a variant of this attack pattern. The timeline is consistent: ecosystem grows fast, trust signals lag, attackers exploit the gap, the community eventually develops better tooling and practices. npm, PyPI, and VSCode extensions all went through this arc. The MCP and AI agent tooling ecosystem is earlier in that cycle than most people realize — which means the window for this class of attack is probably wider, not narrower, than it appears today.
What makes this iteration especially interesting is the target population. The developers building agentic workflows and MCP integrations are not the same people who fell for malicious npm packages in 2019. They're experienced engineers who have normalized the risk calculus for running open source code. FakeGit is betting that their trust in GitHub's social signals overrides their skepticism about the actual package — and based on the campaign's scale, that bet appears to be paying off.
The other thing worth flagging: this isn't primarily a consumer threat. The damage surface here is corporate. Developers with access to production APIs, internal databases, and sensitive AI pipelines represent a much more valuable target than a typical end-user machine. Organizations that have invested in AI-assisted development workflows should be treating developer workstations with the same scrutiny they apply to cloud infrastructure — because through the lens of an attacker with a SmartLoader payload, those two environments are already connected.
The AI tooling gold rush has a security debt that's starting to come due.
— HackWire Editorial
---
## Related Coverage