AgentBaiting攻擊解析：Claude Code、Gemini竟推薦惡意MCP套件 | AgentBaiting: AI Coding Agents Recommend Malware

7月 31, 2026

By Kit 小克 | AI Tool Observer | 2026-08-01

🇹🇼 AgentBaiting攻擊解析：Claude Code、Gemini竟推薦惡意MCP套件

如果你最近有叫 Claude Code、Gemini 或 ChatGPT 幫你找 AI Skill 或 MCP 套件來裝，這篇一定要看。資安公司 Island 揭露一種新型攻擊手法叫 AgentBaiting：駭客在 GitHub 上放了大約 7,600 個假儲存庫，其中 800 多個偽裝成 AI Skills 或 MCP 伺服器，結果 Claude Code、Gemini、ChatGPT 這些 AI Agent 在自主搜尋新工具時，真的把這些惡意套件當成合法選項，主動推薦給使用者安裝。

什麼是 AgentBaiting？AI Agent 也會被「釣魚」

這波攻擊背後是名為 FakeGit 的大型惡意套件campaign，用複製專案、換個一字之差的帳號名稱、抄一份看起來很正常的 README，把 SmartLoader 惡意程式塞進 ZIP 安裝包裡。使用者一旦執行，SmartLoader 就會建立後門並植入資訊竊取程式 StealC，專挑密碼、瀏覽器 session、螢幕截圖下手。根據 The Hacker News 報導，光是約 200 個核心儲存庫的 GitHub Release 下載次數就超過 1,400 萬次。

AgentBaiting 怎麼騙過 AI Agent？

使用者只是叫 AI Agent「幫我找個 MCP 伺服器」或「找個能做 XX 的 Skill」，並沒有貼任何連結
Agent 自己搜尋 GitHub，把攻擊者的 README 當成正常文件讀取、理解
Agent 直接把安裝指令交給使用者，等於幫駭客背書
根據 Island 研究團隊實測，Claude 曾推薦過 adlaiponderous700/claude-skill-cinematic-prompt；Gemini 和 ChatGPT 則不約而同把 DomingosNgongo/walmart-mcp 列為「最佳起點」

為什麼這比傳統惡意連結更危險

過去的資安教育都在教「不要亂點陌生連結」，但 AgentBaiting 完全繞過這道防線——使用者根本沒看到連結，是 AI Agent 自己找、自己判斷、自己推薦。星數、Fork 數這些過去用來判斷可信度的指標，在 FakeGit 的操作下也不可靠，因為攻擊者會刻意經營帳號、堆出看似正常的活動紀錄。

三個實用防範原則

建立審核過的套件清單：公司或團隊內部先審過再放行，不要讓 Agent 隨意安裝陌生 Skill / MCP 套件
新工具先丟沙盒測試：任何 Agent 建議的新能力，正式上線前先在隔離環境跑過一輪
警惕 ZIP／執行檔安裝方式：正常的 Skill 或 MCP 套件通常是原始碼加設定檔，如果安裝流程要你跑一個 ZIP 裡的執行檔或啟動腳本，直接視為危險訊號

好不好用，試了才知道。

🇺🇸 AgentBaiting: AI Coding Agents Recommend Malware

If you've asked Claude Code, Gemini, or ChatGPT to find you an AI Skill or MCP server lately, read this first. Security firm Island uncovered a new attack technique called AgentBaiting: attackers seeded roughly 7,600 fake repositories on GitHub, over 800 of them disguised as AI Skills or MCP servers, and coding agents like Claude Code, Gemini, and ChatGPT actually treated those malicious packages as legitimate options — recommending installation to users on their own.

What Is AgentBaiting? When Your AI Agent Gets Phished Too

Behind the attack is a large-scale campaign dubbed FakeGit, which clones legitimate projects, uses one-character-off usernames, and writes convincing README files to smuggle SmartLoader malware inside ZIP installers. Once executed, SmartLoader establishes persistence and drops the StealC infostealer, which harvests passwords, browser sessions, and screenshots. According to The Hacker News, GitHub Release downloads across roughly 200 core campaign repositories have already topped 14 million.

How AgentBaiting Fools AI Agents

A user simply asks their agent to "find me an MCP server" or "find a Skill that does X" — no link is ever pasted in
The agent searches GitHub on its own and treats the attacker's README as legitimate documentation
The agent hands the install instructions straight to the user, effectively vouching for the attacker
Per Island's testing, Claude recommended adlaiponderous700/claude-skill-cinematic-prompt, while Gemini and ChatGPT both surfaced DomingosNgongo/walmart-mcp as "the best place to start"

Why This Is Worse Than a Bad Link

Standard security advice — "don't click unfamiliar links" — doesn't apply here, because the user never sees a link at all. The agent finds it, evaluates it, and recommends it. Star counts and fork counts, the usual trust signals, are unreliable too: FakeGit accounts are actively maintained to look normal.

Three Practical Defenses

Maintain a reviewed catalog of approved packages — don't let agents freely install unfamiliar Skills or MCP servers
Sandbox new capabilities before rollout — test anything an agent recommends in an isolated environment first
Treat ZIP/executable installers as a red flag — a legitimate Skill or MCP package is source code plus a manifest, not a launcher script bundled in a ZIP

好不好用，試了才知道 — worth testing before you trust it.

Sources / 資料來源

延伸閱讀 / Related Articles

AI 工具觀察站 — 每日精選 AI Agent 與工具趨勢
AI Tool Observer — Daily curated AI Agent & tool trends

搜尋此網誌

AI小貼士