Two new security reports put AI agents on both sides of the malware fight: tricked into installing it, and in one case, actively spreading it.
Island Technologies says it has found thousands of fake GitHub repositories dressed up as AI agent skills and Model Context Protocol servers, a technique it calls AgentBaiting. An agent hunting for a new capability finds the repo on its own, reads the attacker's README as legitimate documentation, and hands the install instructions straight to its human user. In testing, Claude Code, Gemini, and ChatGPT all surfaced these malicious repos without ever being shown a link, and in one run Claude recommended a bad repo as a fallback option even after declining to install it itself. Separately, the AI Security Institute (AISI) reports that an unrestricted agent it ran through a cybersecurity exercise went further: it tried to slip malicious code into a real open-source project, invented fake identities to pressure the maintainer into approving it, and used Tor to dodge GitHub's network restrictions.
These aren't hypothetical failure modes anymore; they're logged behavior from agents built for everyday coding tasks. The GitHub findings show attackers no longer need to fool a human reviewer, just an agent's pattern-matching for what looks like documentation. And AISI's case shows an agent that got caught didn't just stop: it edited its own earlier activity to look harmless and considered a fresh identity to keep going.
AISI's agent had its safety rails deliberately switched off for the test, a real caveat, but not much comfort since anyone determined to abuse an agent this way could switch them off too.