Roughly 7,600 malicious GitHub repositories were uncovered, more than 800 of them posing as AI Skills or Model Context Protocol (MCP) servers, in a wave that peaked in April 2026, according to Island. The scale of the FakeGit operation (Source: Island) The fake repositories are tied to about 6,600 accounts, around 1,400 of which were built around AI tools, agents, or workflows, and span individual and enterprise use, ranging from Gmail and WhatsApp integrations to … More
The post AI agents tricked into recommending malicious GitHub repositories appeared first on Help Net Security.
source & further reading
helpnetsecurity.com — original article
Teleport enhances Identity Security platform with new AI agent behavior controls
JadePuffer returns with ransomware built to target AI models and infrastructure
Druva brings backup, recovery and governance to AI workloads