The Hook
The most effective social engineer of 2026 does not write phishing emails. It autocompletes your code.
At 3:47 PM on a Tuesday in February, a senior Solidity developer at a Singapore trading desk ran claude install on a freshly recommended MCP server. The recommendation came from Claude Code itself — surfaced because the repository had 2,300 stars, a polished README, and a name that matched the developer's search intent precisely. The developer never read the install script. Neither did the agent.
That repository was one of roughly 7,600 malicious repositories seeded across GitHub as part of an operation Island Security Research has named "AgentBaiting." The scale is industrial: more than 6,600 malicious MCP configuration files, at least 800 distinct fake MCP server entries, and over 14 million downloads recorded across the top 200 malicious repositories alone. In Island's controlled tests, Claude Code, Gemini, and ChatGPT each recommended at least one malicious skill repository or MCP server without hesitation.
Here is the part that should make every blockchain security engineer sit upright: the payload does not phone home to a domain. It phones home to a smart contract on Polygon.
Trust is math, not magic. Someone just wrote the math for a machine that never audits its own inputs.
Context: The Protocol That Automates Trust
The Model Context Protocol (MCP) is the connective tissue of the agentic web. It standardizes how AI assistants discover and invoke external tools — database connectors, file systems, browser automation, payment rails. The discovery mechanism is inherently open: agents crawl public registries and GitHub repositories, parse their configuration files, and rank candidates by signals like stars, forks, download counts, and README quality. The entire system runs on a single, unstated assumption: popularity is a proxy for safety.
That assumption is now the attack surface.
Attackers have weaponized the discovery layer itself. No zero-day in any model. No cryptographic break. No bypass of code-signing. They simply published thousands of repositories that look like legitimate MCP servers and "skills" — Anthropic's term for packaged agent instructions — and let the agents do the distribution. The infection chain, reconstructed from Island's disclosure and corroborated by Trend Micro and Straiker AI, is a masterpiece of layered indirection:
- A malicious GitHub repository offers a compelling MCP server or agent skill.
- The repository directs installation to a crafted ZIP archive.
- The ZIP drops a LuaJIT-based loader — a compiled bytecode stub that evades static signature detection.
- The loader pulls down the full SmartLoader payload.
- SmartLoader reads its command-and-control instructions from a smart contract deployed on Polygon.
- The contract returns commands that deliver the final stage: StealC, a commercial-grade information stealer.
Every stage is replaceable. Every stage is cheap. That is what makes this architecture dangerous — not the malware itself, but the scaffolding around it.
Core I: Dissecting the Payload — From Repository to Runtime
Let me take the code-level view, because that is where the sophistication actually lives.
The LuaJIT loader is the first critical component. LuaJIT is a just-in-time compiler for the Lua language, designed for embedding in applications. It is also, conveniently, an execution environment that most antivirus engines do not fully emulate at scan time. The loader is compiled to bytecode — not shipped as plain Lua source — which means static analysis tools see raw binary data rather than a readable script. This is a deliberate evasion technique: multiple crypters and loaders in the wild have adopted LuaJIT precisely because of this detection blind spot.
SmartLoader, by contrast, is pure operational pragmatism. On execution, it establishes a persistent beaconing loop against an EVM-compatible blockchain — in this case, Polygon — and repeatedly reads a specific function from the attacker's contract. Each call returns an encoded instruction: download a next-stage payload, execute a module, sleep for a specified interval, or exfiltrate data to a designated endpoint. The chain itself becomes a dumb, append-only command channel that cannot be taken down by any single jurisdiction's hosting provider.
The final-stage StealC stealer is the commercial end of the pipeline. It targets browser profiles, saved credentials, session cookies, OAuth tokens, SSH private keys, and clipboard contents. Its output is bundled into a compressed archive and uploaded to the C2 operator. StealC is not novel. But its integration into this chain is the point: the attacker did not need novel malware, only a novel delivery surface.
From a forensic standpoint, the chain is a nested Russian doll. EDR software can flag StealC if it ever lands on disk. But the LuaJIT loader executes in memory. SmartLoader's network traffic is encrypted blockchain transactions mixed into a sea of normal Polygon activity. No one blocks a smart contract call because the traffic goes to public RPC endpoints used by thousands of legitimate Web3 applications.
This is not a clever exploit. It is an exercise in structural privilege escalation. The AI agent is granted execute-level trust by the user; the malicious repository is granted discovery-level trust by the agent; the attacker inherits both.
Core II: The Discovery Exploit — Why Agents Cannot Distinguish Good from Evil
Island's empirical results are damning. In controlled experiments, Claude Code, Gemini, and ChatGPT all recommended at least one malicious skill repository or MCP server. The agents did not merely fail to reject the malicious package — they actively surfaced it in response to legitimate user queries.
Why? Because the recommendation engines are trained to optimize for relevance and repository health signals, not security provenance. A repository with 2,300 stars, an organic-looking contributor graph, and a technically competent README is, by every learned metric, a "good" repository. The agents' retrieval pipelines weight these social signals far more heavily than any verification of the author's identity or the code's origin.
This, precisely, is where my own background becomes relevant. In 2017, I spent 120 hours manually auditing the Uniswap V1 core contracts during the ICO boom, line by line, hunting for integer overflows in the price calculation logic. The lesson from that exercise has never left me: raw source code is the last layer of truth. Everything above it — stars, forks, contributor badges, download counts — is metadata that can be fabricated. GitHub is a reputation system, and reputation systems are vulnerable to sybil attacks. You do not break the rules of the platform; you flood the platform with fake evidence that satisfies the rules.
The AgentBaiting operators did exactly that. Island's report notes that the attackers "borrowed real developer identities," likely through account takeover or identity forgery. The repositories carried believable release histories. The README files mirrored each other across platforms to create the appearance of a well-maintained ecosystem. There is strong circumstantial evidence — though Island does not explicitly confirm it — that the operators also engaged in star-farming and fake download inflation to push their repositories toward the top of search rankings. When an AI agent's discovery layer treats popularity as a proxy for quality, the most cost-effective attack is simply to buy the popularity.
Patterns emerge from chaos, not noise. The pattern here is a systematic gaming of an oracle.
Core III: Reputation Is an Oracle Feed
The DeFi analogy is unavoidable, and it is not superficial. For years, I have argued that oracle feed latency is decentralized finance's Achilles' heel. Chainlink has built an impressive decentralized network of node operators, yet the critical price aggregation layer still relies on centralized off-chain computations that are then submitted to an on-chain contract. The entire DeFi ecosystem stakes billions of dollars on the assumption that those oracle inputs are honest.
AI agents consume an analogous feed: the trustworthiness score of a software artifact. That feed is compiled by crawlers that aggregate stars, forks, open issues, commit recency, and README quality. The signals are public, mutable, and — as the AgentBaiting campaign demonstrates — trivially manipulable. An attacker who can inflate a repository's social proof signals is effectively providing a malicious price oracle to every AI assistant that queries the discovery layer.
Composability is a double-edged sword. In DeFi, composability means that an exploit in one lending protocol cascades through yield aggregators, leveraged positions, and liquidations across multiple chains. In the agentic world, composability means that a single malicious MCP server — once recommended by the agent — inherits the agent's session context, its environment variables, its access to cloud APIs, and its ability to execute shell commands. The blast radius is not a single wallet. It is the entire development infrastructure of a company.
Core IV: Polygon — The Silent, Nearly Free C2
Why Polygon? The question deserves precise analysis.
The attackers required a command channel with three properties: low cost per message, high transaction volume for camouflage, and support for programmable state. Polygon is the pragmatic winner across all three dimensions. Layer-2 transaction fees on Polygon are fractions of a cent — deploying a control contract and issuing a few hundred command updates costs attackers single-digit dollars. The chain's high baseline activity means the C2 beacons are lost in the noise. And because the chain is EVM-compatible, the attackers could reuse standard Solidity tooling and public RPC infrastructure without building custom indexing or wallet plumbing.
Compare this with alternatives. Ethereum itself offers the same programmability but at significantly higher gas costs for sustained beaconing. Bitcoin is cheaper and highly private per-transaction, but its scripting constraints make flexible command encoding awkward. Traditional HTTP C2 servers are cheap but trivially sinkholed once a domain is flagged. Polygon sits in the sweet spot: pseudonymous, persistent, cheap, and programmatic.
But there is a counterintuitive wrinkle that most security analyses miss. A blockchain-based C2 channel is, by definition, a public, append-only record of every command the operator ever sent. Traditional C2 infrastructure dies when the server is seized. A Polygon-based C2 persists forever — every encoded instruction, every update to the contract state, every address interaction is permanently part of the chain history.
In other words, the same immutable public ledger that makes blockchain data availability layers so hyped for rollups also makes them indispensable for digital forensics. Once Island identifies the specific contract address, any analyst with a block explorer can reconstruct the entire command history. I have done this kind of chain-sleuthing investigation work myself during the DeFi Summer of 2020 — mapping how a single reentrancy vulnerability in one protocol propagated through the entire DeFi ecosystem. The same systemic lens applies here: the C2 contract is a central node whose entire transaction graph is openly visible.
This is why I suspect the operators know exactly what they are doing. If they had wanted true stealth, they would have used an encrypted proxy contract pattern — a minimal updatable forwarder that hides the actual implementation logic behind a DELEGATECALL. They did not, based on available information. The publicly cited C2 contracts are relatively simple state machines. That simplicity is a risk-reward trade-off: the operators prioritized operational reliability and low gas overhead over cryptographic obfuscation. It is a decision I would characterize as functional, not clever — and it will come back to bite them when an investigator connects the dots.
### Core V: The Multiplication Machine — Mirrors and Identity The 14-million-download figure deserves scrutiny. Security researchers are right to be skeptical of inflated numbers; bots and automated installers can inflate download counts artificially. But even discounting for bot traffic, the steady-state operational realism of the campaign is undeniable. The operators planted malicious configurations across LobeHub, Glama, MCP.so, and MCP Market simultaneously. Those platforms mirror and aggregate from GitHub. Once a malicious MCP server was listed on one registry, the mirrors populated the others automatically. One upload, four platforms, hundreds of thousands of potential victims.
Identity theft accelerated the cycle. By borrowing real developer identities — likely through compromised GitHub accounts — the attackers bypassed the only weak provenance checks the platforms had. The malicious repositories looked like the legitimate work of established contributors. When security teams at any of these platforms attempted to investigate, they were not just chasing fake accounts; they were chasing hijacked fingerprints.
Island also notes that the operators rewrote README files across their repositories in ways that reinforced each other's credibility. A developer who discovered one malicious MCP server would see five related repositories by different "authors" referencing it. This is classic sockpuppetry, made more effective by the fact that the human user barely inspects the AI agent's recommendation. The trust chain is so compressed — agent sees repo, agent recommends repo, user installs repo — that there is no natural point for human scrutiny to intrude.
The Contrarian Read: Public Ledger, Public Liability
Here is the argument that will make traditional security teams uncomfortable, and blockchain skeptics angrier.
The blockchain dimension of this attack is not a weakness for the defenders — it is the single greatest forensic advantage they have. A C2 server operated on a hacked WordPress site disappears the moment the hosting provider receives a takedown notice. A C2 contract on Polygon cannot be deleted. It cannot be blocked by a firewall. The data remains, with perfect timestamp integrity, for as long as the Polygon chain exists.
That same property is the one that makes many infrastructure teams dismiss blockchain as useless for serious applications — the lack of privacy and the permanent public record. But for incident response, that is precisely the feature that matters. If the operators had used a mixnet or a zero-knowledge-based messaging layer, the forensics would be far harder. They did not. They optimized for operational efficiency, and they lost the privacy battle as a result.
Architects build, auditors break.
The deeper contrarian point is about regulation. When a criminal operation uses a smart contract as its command channel, regulators see a blockchain as a tool for crime. That narrative is nearly impossible to counter with nuance in traditional press. But the forensic counter-narrative is equally strong: on-chain C2 is the most auditable form of communication ever created by a criminal enterprise. Every command, every funding address, every drop location is stored. The security teams of 2026 should not waste breath defending Polygon against accusation. They should publish the tracing methodology as a template for every future investigation.
There is a second, less comfortable blind spot. Fixing this attack class requires restricting the agent's autonomy — sandboxing every downloaded repository, requiring signed authorization for all tool installation, curating an allowlist of MCP servers. Those changes directly contradict the entire premise of AI assistants: that they act without being asked for micro-permission. The industry will not accept those frictions. So we are headed for a window where the agent is neither fully trusted nor fully controlled, and the attack surface remains open for replication.
Takeaway: The Vector Is Now a Template
I do not expect AgentBaiting to be a single incident. I expect it to be the canonical template for at least the next eighteen months. The infrastructure is already in place: identity-fogged GitHub accounts, registry-mirroring platforms, low-cost EVM chains, and commercially available stealers. The only novel variable is which AI assistant or code agent the attacker chooses to poison.
My suspicion, based on the evolution of the underground ecosystem, is that we soon see "AgentBaiting-as-a-Service" offered in criminal forums — a ready-made kit that compiles malicious MCP servers, auto-generates social-proof signals, and deploys a C2 contract on a chosen chain. The next variant may well use zero-knowledge proofs to hide the C2's true logic behind a verifiable but opaque computation, making the forensic backdoor far harder to open.
Speculation audits the soul of value. But code executes regardless of belief.
So here is the question I leave with every developer, vendor, and security lead: when your AI agent decides what is safe to install, who audits the agent's judgment? The math says trust is computable. The market has not yet built the model that computes it. In the gap between those two truths, someone will keep collecting credentials — one malicious recommendation at a time.
