Seven thousand six hundred repositories. Fourteen million downloads. Zero exploits used.
Island's security research team published the receipts this week: Claude Code, Gemini, and ChatGPT all recommended malicious repositories to developers in controlled tests. Not because the models were tricked into executing obviously harmful code — but because their discovery mechanisms were poisoned at the source. The packages looked legitimate, ranked well in the signals AI agents use to evaluate trust, and led straight into a five-stage attack chain that terminates in a Polygon smart contract acting as command-and-control.
This is AgentBaiting, at industrial scale. The fact that a public blockchain sits at the center of the operation isn't incidental. It's the cheapest, most persistent C2 channel the attackers could have chosen.
Context: The AI Agent Trust Default
The Model Context Protocol (MCP) ecosystem was built for speed, not verification. AI agents like Claude Code, Gemini, and ChatGPT discover new capabilities by crawling public registries — LobeHub, Glama, MCP.so, MCP Market — alongside GitHub itself. They evaluate repositories using community signals, the same social proof mechanics the open-source world has leaned on for a decade: star counts, forks, download numbers, maintainer identity.
The problem: those signals can be manufactured in bulk.
Island's data suggests the operators behind this campaign created roughly 7,600 repositories and 800+ MCP servers, many posing as legitimate developer tools. They mirrored README files across platforms. They registered the same malicious packages on multiple registries simultaneously, creating a cross-platform propagation loop that makes takedown efforts sluggish. They borrowed real developer identities to add a layer of social proof that LLM-based crawlers are especially prone to believing.
About 6,600 configuration files accompany the repos — malicious skill definitions, MCP server configs, and instructions designed to pull AI agents toward the payload. The scale alone is impressive. But the technical architecture is what makes this a template rather than an incident.
Core: Inside the Attack Chain
The infection chain follows a clean, functional path. A developer asks an AI coding agent to find a tool for a task. The agent returns a recommendation from one of the poisoned registries. The developer — trusting the assistant — installs the package. Behind the scenes, a malicious ZIP archive opens, a LuaJIT loader executes, and the SmartLoader establishes a connection to a Polygon smart contract. That contract serves C2 instructions. Meanwhile, the StealC info-stealer harvests session cookies, OAuth tokens, and SSH credentials from the compromised workstation.
Two details stand out from a security veteran's perspective.
First, this attack breaks nothing. It doesn't exploit a memory-corruption bug. It doesn't forge a code-signing certificate. It doesn't bypass a sandbox. The attacker placed malicious content in the path of an AI agent's discovery layer and let the agent's recommendation engine do the rest. The AI agent is the distribution channel. The user's trust in the agent is the vulnerability. That's a fundamentally different threat model than anything the code-supply-chain world has seen — and it invalidates a decade of assumptions about how malware spreads.
Second, the attackers chose Polygon deliberately. Low transaction fees mean hundreds of C2 contracts can be deployed for pocket change. High public transaction volume means their chain messages get lost in the noise. EVM compatibility means standard tooling — no custom infrastructure, no exotic RPCs, no learning curve. In my years of forensic work — from the 2017 Parity Wallet fork dissection to the Terra-Luna death-spiral simulations I built with three independent developers — I've learned that attackers choose infrastructure the way portfolio managers choose assets: optimizing for cost and risk. Polygon is the high-yield, low-volatility play in this context. But here's the part analysts are missing: it's also the most recoverable component of the entire operation.
Island's live tests confirm the reach. Claude Code recommended a malicious skill repository. Gemini and ChatGPT recommended malicious MCP servers. The models didn't fail to detect malware — they were never asked to detect it. Their design optimizes for usefulness, not verification. That's the architectural gap that makes the 14-million-download number less surprising. Once an AI agent has recommended a tool, how many developers actually run a security audit before installing it? The download count suggests: very few.
Trend Micro previously attributed a similar campaign using LuaJIT loaders and Lumma Stealer to a group they track as Water Kurita. This operation swaps in SmartLoader and StealC — enough overlap that we're either looking at the same operator iterating on their toolkit, or a second group that borrowed the playbook. Both possibilities carry bad news for the ecosystem.
Contrarian: The Blockchain Isn't the Problem. It's the Record.
Everyone wants to talk about the horror of a Polygon smart contract acting as C2. I'd rather point out why that's the least worrying part of this incident — and the part that will crack the case.
A traditional HTTP-based C2 server dies the moment the domain gets blacklisted. Traffic analysis, DNS filtering, sinkholing — network defenders have decades of experience with that war. A smart contract C2 is different. Once a security team identifies the contract address, every command the malware ever received sits in a public ledger, permanently, with timestamps, transaction history, and the funding addresses that paid for the deployments. The attacker's on-chain financial footprint — gas purchases, wallet transfers, any interaction with the C2 contract — is all traceable. The ledger doesn't forget. I wrote about this after Terra-Luna's collapse: chain forensics are only as hard as the address you start from. Here, the address is published in the malware samples themselves.
Composability isn't the problem here; unverified discovery is. The vulnerability isn't the blockchain infrastructure. It's the absolute absence of a security check between "AI agent recommends" and "developer installs."
And here's the uncomfortable question about the fixes being proposed. Sandboxing, allowlists, approved directories — these make sense for enterprises. But they create a walled garden that fundamentally changes what AI agents are. Give me a curated list of pre-approved packages, and I've built an enterprise IDE with a recommendation engine — not an agent. The efficiency-versus-autonomy tradeoff's a philosophical trap disguised as an engineering problem. The security community can't wait for platform vendors to ship a perfect fix, because there isn't one that preserves both agent autonomy and supply-chain safety. The tradeoff is real, and no one's willing to say what they're losing.
Takeaway: What to Watch
The playbook for this attack — poison a registry, let the agent distribute, use a cheap L2 for C2 — is now public. Copycats across Base and Arbitrum are a matter of when, not if.
Watch for three signals in the coming months: registry-level kill switches on major MCP platforms; AI vendors shipping enforced allowlists that quietly reduce what agents can discover; and the first blockchain analysis firm publishing a C2 sinkhole report that identifies these contracts in bulk. On-chain forensics will be the unsung hero of this story.
The question I keep circling back to: how many more 14-million-download campaigns can the AI agent ecosystem absorb before the autonomous model gets gutted into compliance-safe nothingness?
