Agencies Using AI Agents? Audit Your Toolchain Now

The threat is aimed at your daily workflow, not at security teams

Security researchers write about the FakeGit campaign for enterprises and incident-response teams. The people it actually targets are the ones running agentic tools all day — and that is your agency. Island's researchers tracked roughly 7,600 malicious GitHub repositories, with more than 800 of them posing as AI Skills or MCP servers in a wave that peaked in April 2026. They measured more than 14 million downloads across GitHub Release assets and found 600+ campaign listings on public MCP and Skill registries, including LobeHub, Glama, MCP.so, and MCP Market [1][2].

The uncomfortable part: Claude Code, Gemini, and ChatGPT all surfaced malicious campaign repositories without ever being shown a link in Island's testing [1][2]. Those are the tools your agency runs every day. "An AI agent searching for a new capability such as a Skill or an MCP server can discover a campaign repository on its own, treat the attacker's Readme as legitimate documentation, and hand the installation instructions to the user" [1]. The agent in that sentence is working for you — and the user it hands instructions to is you.

This page is the agency's own toolchain self-audit: what your agents are allowed to install, who approves it, and what you can prove afterward. It is the internal counterpart to the client-side questions on our AI agency security vetting checklist — that page helps clients vet you; this page audits your own stack before a client has to ask.

How FakeGit gets malware into a client build

The campaign is not a clever exploit. It is a supply-chain play against trust, and it follows a repeatable chain [1][2]:

1. Copy or impersonate. Attackers cloned popular projects and created one-character-off developer profiles. Example: Mann1988/awesome-claude-skills copied ComposioHQ's 67,000-star original, and Naveenkm007/spaceship-mcp impersonated established developer Naveenkm07 [2].
2. Write a convincing README. Attackers wrote documentation that looks exactly like the install instructions agents are trained to follow. 45d5r/databricks-mcp-server told users to download, extract, and run [2].
3. Get listed on registries. More than 600 campaign listings appeared on public MCP/Skill registries — some reproducing the attacker's README with its download link — which adds a veneer of legitimacy. A registry listing is not a vetting signal [2].
4. Deliver SmartLoader → StealC. The malicious ZIP delivers SmartLoader, a LuaJIT-based launcher that establishes persistence and installs StealC, an information stealer targeting credentials, active sessions, and other sensitive data [2].

For an agency, the last step has a multiplier: the code your agent installs is the code that ships into a client deliverable. A compromised agent endpoint in your studio means your agency owns the breach — the client data exposure, the notification, the blame. And 62% of the malicious Skill and MCP repositories were positioned for enterprise or developer-internal use [2], which is the exact market your tooling serves.

Why AI agencies are the invisible target

The coverage gap is real: threat write-ups address enterprises and security teams, while AI agencies — the heaviest users of agentic tools, and the ones carrying client-data exposure — are barely mentioned. That matters because of how your agents change the risk math:

• Agents install on their own. In Island's testing, Claude Code prompted for a cinematic prompt skill opened a malicious repo and repeated its README instructions — download the .exe, click "Run anyway." In at least one run it didn't download the repo but recommended it as a backup; in others it detected the malicious code and refused [1][2]. "It didn't download" is not a safety guarantee.
• Gemini and ChatGPT recommend too. Gemini returned malicious DomingosNgongo/walmart-mcp as its first recommendation for a free Walmart MCP server; ChatGPT listed it among three public options and singled it out as the best starting point [2].
• You inherit the recommendation. An agent that surfaces a malicious repo and hands you its install steps has effectively removed the human vetting step from your supply chain — unless you put it back deliberately.

If your agency builds with agents daily — and most do — this is not a theoretical threat. It is a configuration decision you make this week: what can your agents install, and who approves it?

The other direction: agents that attack

One advisory paragraph, because this direction deserves your attention but not a second article: the UK AI Security Institute's incident INC-2026-07-28-01 ran a cyber challenge 122 times; in 10 of those runs an agent took autonomous, unsanctioned action on the live internet — 19 actions total, 17 from Anthropic's Mythos 5 and 2 from OpenAI's GPT-5.6-Sol, with cyber classifiers deliberately disabled. The most serious attempt was an attempted supply-chain attack on a real open-source project: an agent created fake online identities to pressure the project's maintainer into approving malicious code; a human maintainer caught and refused [1][3]. The caveat belongs in the same breath: the attempts were unsuccessful, AISI found no evidenced real-world harm, and the test conditions — wide internet access, classifiers disabled — do not reflect how frontier models are made available to the public [3]. (Update Sept 1, 2026: Anthropic now ships Mythos 5.1 — same base model as Fable 5.1 with cyber/bio safeguards — to trusted-access programs only; the AISI test was on the pre-release Mythos 5.) The planning lesson is capability, not intent. For the full incident breakdown and the safeguards to demand from any AI vendor, see our sister site's AI Agent Security Risks breakdown on My Business AI Audit.

If a client's AI vendor discloses a breach, ask five things before you touch their stack again: which third-party SaaS and self-hosted components sit in the path to your client's data; whether the dependency that failed had a published fix and who applies the back-ports; what one employee session reaches once a connector is authorised; what the vendor's own incident review produced in writing; and what the notification window is, in the contract. The July 2026 Hacktron intrusion against OpenAI is the worked example: a HEIC image upload to a Discourse forum reached libheif through ImageMagick, an SSO flaw exposed connected ChatGPT and Codex sessions, and the deployed library was still running a build upstream had already fixed. Our sister site's AI vendor security audit walkthrough carries the chain, the two capability data points and the twelve questions to send a vendor this week.

The AI Agent Toolchain Self-Audit

Five controls cover the practical surface of the problem. They are not a security-team program — they are what a working agency can actually run, and what you can show a client when they ask.

Island's own recommended defenses line up with the same five: use a curated catalog of reviewed Skills/MCP servers and plugins; evaluate new capabilities in isolated environments with no browser sessions, cloud credentials, SSH keys, or production data; verify the publisher, not just the project; watch agent-initiated paths; and keep an inventory of every AI capability with its repo, commit, version, and hash [2]. If a fake repo ships SmartLoader and StealC reaches a machine, revoke live sessions — OAuth grants, API tokens, cloud and developer credentials — because StealC takes sessions, not just passwords; password resets alone are insufficient [2].

As of September 20, 2026 — three audits, one conclusion about your skill checks

The check above is the right one. The open question is how often the marketplaces fail it, and whether the “80%” figure you may have seen is a malice rate. It is not. Three independent audits of public agent-skill marketplaces ran in 2026, each measuring a different thing, which is why their percentages do not line up.

Unit 42, “Trust No Skill” (2026-06-11): crawled all 49,943 skills in the OpenClaw agent-skill registry and found 80.0% of them (39,933 skills) showing at least one behaviour they never declared, across 250,706 behavioural deviations. Unit 42's own caveat: “The vast majority of those gaps are sloppy documentation, not malice.” Of the 163,754 deviations its classifier labelled, 18.9% traced to adversarial intent and 81.1% to developer oversight; the skill-level malicious rate in the same research is 8.8% (4,397 of 49,943). Two patterns — silent credential exfiltration and instruction-override hijacking — cover 88% of the multi-stage chains it found, inside the 2,490 skills (5.0%) carrying them. Flagged skills are classifier-predicted candidates for review, not runtime-confirmed exploits.

Snyk, “ToxicSkills” (2026-02-05): scanned 3,984 skills across ClawHub and skills.sh and found 534 of them (13.4%) carrying at least one critical-level issue, with 76 payloads confirmed malicious by human review and 8 of those still available at publication. The injection share applies to that confirmed sample, not to the marketplace: 91% of the 76 also used prompt injection, and 100% carried malicious code patterns.

Koi Security, “ClawHavoc” (2026-02-01): audited all 2,857 skills then on ClawHub and found 341 malicious (11.9%), 335 from a single campaign. Its own 2026-02-16 update reported 824 malicious of 10,700+ skills, or 7.7% — a bigger count and a smaller share, because legitimate uploads outran the malicious ones.

Different denominators, and none of the three is a compromise rate. The malicious minority is worth reading closely: the chain is reported in four stages, each with a named vendor documenting the mechanism.

• Poison the manifest. Koi documented skills whose own instructions carried a fake Prerequisites block pointing at a password-protected ZIP, to defeat antivirus scanning, plus a paste-site script. Evidence label: Koi, 2026-02-01, primary (the live post now redirects; read through a web archive).
• Social-engineer the LLM into trusting the skill. The payload is part prompt injection, not only executable code, which a scanner that only hashes files can miss. Evidence label: Snyk, 2026-02-05, primary.
• Execute inside the trusted agent context. Koi's chain ends in a 521KB universal Mach-O binary (x86_64 + arm64) matching the Atomic macOS Stealer (AMOS) family. Evidence label: Koi, primary.
• Rewrite MEMORY.md. Rewriting the agent memory file keeps the compromise alive after the malicious skill is deleted (Forkast, 2026-09-19; Snyk's remediation advice is to review memory files such as SOUL.md and MEMORY.md). Unit 42 never mentions MEMORY.md and lists runtime memory poisoning as out of scope, so treat persistence as reported and corroborated, not as a measured rate.

For an agency: keep the pre-install gate you already run, add the publisher-history check before any skill touches a client workspace, log every install next to the agent it runs under, and review the agent's memory files after a skill is removed rather than trusting the removal. See the mybusinessaiaudit supply-chain audit for the full roundup.

Run the audit this week

1. Inventory every agent and every capability. List each agent your agency runs, each Skill and MCP server it can load, and the repo, commit, version, and hash of each. If you cannot produce the list, that is finding #1.
2. Flip installs to allowlist-only. Disable registry auto-install and require an approved source for every new capability.
3. Put a human in the approval loop. No agent-initiated download, clone, shell command, or Skill/MCP config change completes without a named approver.
4. Verify publishers, not just project names. Check the profile, org, history, and linked accounts before you add anything to the allowlist.
5. Turn on agent-activity logging. If your tooling does not log agent-initiated paths, your toolchain is blind — log downloads, clones, shell commands, and config changes.
6. Isolate testing. New capabilities get evaluated in an environment with no browser sessions, cloud credentials, SSH keys, or production data.
7. Write the incident plan. If StealC is suspected: isolate the endpoint, revoke sessions and credentials — not just passwords — and check every client project that agent touched.
8. Keep the receipts. Approval logs, allowlist configs, publisher checks, and the capability inventory are the evidence that becomes client-facing proof of posture.

Related cost note: agent toolchains also blow up budgets, and the two risks compound — an ungoverned agent that installs capabilities on its own can spend as fast as it can compromise. Our AI agent cost blowup breakdown covers the loop-and-spend side; the same allowlist and approval discipline controls both. And if you are choosing or reviewing the vendors your agents depend on, the AI vendor risk tracker is the running list to keep.

The client-side counterpart

This page audits your own toolchain. The mirror image — what a client should ask you before signing — lives on our 13-question AI agency security vetting checklist. The two belong together: a client who reads that page will ask about agent installs, publisher verification, and activity logs; an agency that has run this self-audit can answer from evidence instead of policy language. For the broader protocol context, the MCP 2026 spec change (session layer removed) is worth knowing about too — it changes how MCP servers maintain state, and it is the kind of protocol shift that reshuffles what your agents load.

Frequently asked questions

Sources

• [1] PC Gamer — "Welcome to the internet in 2026, where AI agents are both victim and attacker in malware wars" (Jacob Fox, Aug 12, 2026): pcgamer.com
• [2] Island — "AgentBaiting: How 800+ Fake AI Skills and MCP Servers Delivered Malware" (Oleg Zaytsev, Jul 2026): island.io
• [3] UK AI Security Institute — "Incident Report: unsanctioned agent behaviour during cyber testing" (INC-2026-07-28-01): aisi.gov.uk