The 14 Million Download Blind Spot: How FakeGit Weaponized AI Agents and Turned Polygon Into a Crime Router

Over the past seven days, a number has been rattling around my head like a stone in a shoe: 14 million. That is how many times developers—or the AI agents acting on their behalf—downloaded code from a sprawling network of roughly 7,600 malicious GitHub repositories before Island Security's research team went public with its findings. The campaign, which analysts now call FakeGit, is a production-scale supply chain operation. It planted poisoned MCP servers and AI coding skills across public registries including LobeHub, Glama, MCP.so, and MCP Market. It borrowed real developer identities to manufacture social proof. And it routed command-and-control traffic through Polygon smart contracts. Then came the detail that should keep every developer awake at night. When researchers tested the ecosystem directly—creating malicious skill repositories and malicious MCP servers, then letting real AI agents loose—Claude Code recommended the poisoned skill. Gemini recommended the poisoned MCP server. ChatGPT did the same thing. Not one refused. Not one flagged suspicious behavior. Not a single model paused to ask whether the repository had a cryptographically verifiable publisher. The AI agents we have invited into our terminals, our IDE pipelines, and our CI/CD workflows simply said yes. Trust, it turns out, is not just the softest part of security architecture. It is the exploitable one. The Model Context Protocol has become the connective tissue of AI-native development. It was designed with an elegant promise: agents discover capabilities dynamically, connecting to servers that expose tools, data sources, and workflows without requiring bespoke integrations for each tool. Ask Claude Code to find a utility for parsing PDFs, and it will search public repositories, evaluate candidates, and install the highest-ranked option. For a developer, this feels like productivity magic. It is also a vote of blind confidence in the open source commons. MCP registries have exploded in popularity, and their vetting standards vary wildly. Some platforms require little more than an email address and a repository link to publish a server. GitHub, the foundation of this ecosystem, does not cryptographically authenticate the identity behind every repository. And AI agents, built to be maximally useful, optimize for discoverability and availability over security validation. Island's team confirmed this behavior in practice. When they seeded malicious repositories designed to look like legitimate utilities and let Claude Code, Gemini, and ChatGPT browse for MCP servers, all three eagerly recommended the poisoned code. The scale compounds the danger. Island's telemetry identified approximately 7,600 malicious repositories, roughly 6,600 configuration files tied to fake or borrowed developer identities, and hundreds of malicious listings across all four major MCP registries. About 200 of those repositories accumulated more than 14 million downloads before the campaign was exposed. Because the attackers mirrored README files across platforms, even a coordinated cleanup effort leaves residual copies scattered across mirrors, caches, forks, and archived snapshots. In a very real sense, the MCP ecosystem is only a few years old, and it grew faster than its own governance. Public registries operate like the early web: anyone can publish, reputation is self-reported, and the platforms' terms of service provide legal cover rather than technical protection. The explosion of AI agent adoption turned these registries from niche developer tools into critical infrastructure overnight. Security, as always, is running a lap behind. This is not a phishing email that lands in a spam folder. This is malware with a marketing funnel. Let me walk through what actually happens when a developer downloads one of these poisoned packages, because the technical architecture deserves more scrutiny than it has received. The chain begins with a malicious GitHub repository, dressed to look like a legitimate MCP server or coding skill. The repository references a real developer's identity—either stolen or closely imitated—to pass the trust heuristics that both humans and AI agents apply. The README looks professional. The stars look organic. The code structure mirrors legitimate projects in the same niche. This is the "borrowed identity" pattern: attackers cultivate or steal the reputation currency of the open source community and spend it as their own. Inside the package, the payload is a ZIP file containing a LuaJIT-based loader, tracked by security researchers as SmartLoader. This loader is a clever piece of engineering. LuaJIT gives the malware a scriptable runtime that traditional antivirus scanners struggle to parse, because the malicious behavior is encoded in scripts rather than compiled binaries. The loader executes in memory, pulling the next stage from an encrypted payload embedded in the package. That next stage establishes communication with a command-and-control server. But instead of a traditional HTTP endpoint—which network monitoring tools can detect and block via URL blacklists—the malware reads instructions from a smart contract deployed on Polygon. Here is where the choice of blockchain becomes instructive. Polygon offers low transaction fees, EVM compatibility, and millions of daily transactions. For an attacker, that combination is nearly perfect: the cost of deploying and updating C2 contracts is trivial, and the chain's high transaction volume provides natural obfuscation. A few hundred contract calls from a single address vanish into the noise of the chain's daily activity. Traditional network-layer defenses—DNS filtering, IP reputation, traffic pattern analysis—cannot see these communications, because they are just ordinary blockchain transactions riding public infrastructure. I calculated the economics in the quiet hours after reading the report. Deploying a few hundred smart contracts on Polygon costs at most a few hundred dollars in gas. Maintaining them costs less than running a single virtual private server. The entire C2 infrastructure can be funded with the proceeds of a single credential-theft batch sold on a darknet marketplace. For cybercriminals, this is asymmetric warfare: minimal cost, maximal operational lifetime, and anonymity through pseudonymity. The choice of Polygon also tells us something about the maturity curve of criminal infrastructure. Bitcoin was the first cryptocurrency used for command channels, but its lack of programmability limited attackers to simple signaling. Ethereum offered smart contracts, but gas costs made sustained C2 operation expensive. Polygon sits in a sweet spot: EVM compatibility for sophisticated logic, gas costs low enough to support high-frequency communications, and transaction volumes large enough to bury any single contract's activity. As other Layer2 networks scale, attackers will likely migrate to whichever chain offers the best cost-to-noise ratio. This is not a Polygon problem; it is an anyone-can-build-here problem. The final stage is the StealC infostealer. Once SmartLoader receives its instructions, StealC begins harvesting session cookies, OAuth tokens, SSH keys, and saved credentials from the compromised machine. This is the detail that makes the attack particularly vicious. Session cookies and OAuth tokens bypass multi-factor authentication entirely; rotating passwords does nothing to invalidate a stolen session. An attacker holding a valid session token steps into the victim's SaaS applications, cloud consoles, and code repositories as if they were the legitimate user. The amplification loop deserves special attention. The attackers did not simply upload malware and wait. They mirrored README files across registries, ensuring that the same malicious listing appeared on LobeHub, Glama, MCP.so, and MCP Market simultaneously. When AI agents synthesized recommendations across sources, each mirror reinforced the others, creating a feedback loop of apparent legitimacy. A repository recommended by three registries looks dramatically more credible than one sourced from a single platform. The attackers were not just distributing malware; they were gaming the citation graph that agents use to rank tools. What does this mean for the average developer team? First, the threat model has shifted. Your agent is now an attack surface, and every recommendation it makes is a potential entry point. Second, the standard mitigations—scanning downloaded files with antivirus, reviewing code before execution—are necessary but insufficient. SmartLoader's LuaJIT design means the malicious behavior is scriptable and can evade signature-based detection. Third, session rotation is not optional. If you have installed any MCP server or AI skill in the past six months, assume compromise until proven otherwise. Revoke OAuth tokens. Rotate SSH keys. Invalidate sessions across all connected services. I have spent years teaching people to audit smart contracts and verify protocol logic. But this attack chain does something different: it exploits the absence of verification in the AI agent layer, not a flaw in any particular contract. The Polygon contract is not the vulnerability. The vulnerability is the blank check we handed to our agents. Security researchers have a term for what FakeGit exploits: trust inertia. Humans and AI models alike default to trusting familiar signals—a recognizable name, a popular repository, a well-written README. Attackers do not need to break cryptography or exploit a zero-day. They just need to look like the community. What makes this campaign different from earlier supply chain attacks is the deliberate targeting of AI discovery mechanisms. Earlier campaigns poisoned npm packages or PyPI modules, waiting for developers to install them. FakeGit does not wait. It exploits the agent that installs things automatically. The attacker does not need a victim to make a mistake; the victim's own AI assistant makes the mistake for them. The numbers suggest this approach works at industrial scale. Fourteen million downloads is not a puddle; it is a reservoir. And the campaign's operational footprint suggests an organized group rather than a lone hacker. Creating thousands of repositories, maintaining hundreds of registry listings across four platforms, coordinating a multi-stage infection chain, and setting up blockchain infrastructure requires resources and process. Some researchers have drawn parallels to Water Kurita, a cluster tracked by Trend Micro that previously deployed the Lumma Stealer through similar LuaJIT-based loaders. Whether FakeGit is the same group, a splinter, or an imitator, the pattern is sobering: the playbook works, and it will be copied. This is where my background pushes me toward a specific conclusion. Education has always been the ultimate utility in this industry. We teach people to recognize phishing emails, verify contract addresses, and audit tokenomics. But very few developers have been taught to interrogate the recommendations their AI agents produce. We are not educating the next generation of developers to ask "why should this repository earn my trust?" The entire FakeGit campaign runs on that educational gap. From a Web3 perspective, the most uncomfortable part of this story is how depressingly mundane the blockchain usage is. Attackers did not use multisig wallets, proxy contracts, zero-knowledge proofs, or any sophisticated on-chain engineering. They treated Polygon as a cheap, programmable bulletin board. That is the unglamorous reality of blockchain-based command-and-control: the features that make public chains valuable to legitimate users—low fees, high throughput, programmability—are equally valuable to criminals. I have been critical of Layer2 narratives for years. The promise of decentralized sequencing has remained a PowerPoint slide for a while now. But this attack reveals a different kind of centralization problem: the trust concentration in a handful of AI agents and code registries that collectively decide what millions of developers install. Polygon did not fail here; the AI agent ecosystem did. The chain simply served as the substrate. There is, however, a contrarian angle almost nobody is talking about yet. Because FakeGit's C2 lives on Polygon, every command the attackers sent is permanently and publicly recorded. The smart contract address, once identified, becomes a Rosetta Stone. Blockchain analytics firms can trace every interaction with that contract, every associated wallet, every funding transaction that paid for gas. Law enforcement can follow the money trail backward to exchanges and payment gateways. Traditional C2 infrastructure is destroyed when the botnet is taken down; blockchain C2 persists as evidence long after the actors move on. The very immutability that makes the attack stealthy at the network layer makes it tractable at the forensic layer. That is a profound irony, and security teams should internalize it. For every malicious contract deployed, there is a permanent, auditable record of its operation. The attackers chose Polygon because it hides their communications in plain sight. But "in plain sight" cuts both ways. Somewhere on that chain, the attacker's wallet paid for gas. And that is a thread waiting to be pulled. Every conversation about this attack seems to default to a grim conclusion: AI agents cannot be trusted, so we must constrain them. Enterprise teams are being told to maintain approved directories of MCP servers, sandbox all downloaded code, and enforce strict allowlists. These are sensible mitigations. But taken too far, they transform our agents into glorified web browsers with extra steps—the exact outcome that undermines the productivity gains driving agent adoption. The counter-intuitive insight is that the problem is not AI agent intelligence. It is the information environment agents operate in. A social proof system designed for human developers—stars, forks, downloads, maintainer identity—has been repurposed as a signaling system for machines. We never updated the protocol for machine readers. The fix is not to make agents dumber. It is to add a verification layer that machines can actually parse: cryptographic proof of maintainer identity, signed releases, on-chain attestations, reputation systems that tokens cannot buy. This is where Web3 builders have a genuine edge. We have been arguing about identity, attestation, and verifiable credentials for years. The tools are immature, but the conceptual framework exists. The question is whether we can deploy them before the next FakeGit scales even larger. We build not for the token, but for the tribe. And right now, the tribe's infrastructure has a fundamental trust gap. In my years teaching blockchain fundamentals, I have always insisted that education is the primary risk mitigation. Audits, bug bounties, and insurance are important mechanisms, but they arrive after the damage is done. Understanding the threat model before an attack is the only defense that scales with community growth. This moment demands exactly that. The agents we are training to write our code, manage our infrastructure, and handle our credentials are navigating a world where malicious actors have learned to speak their language. FakeGit is not the last campaign of this kind. It is the calibration shot. The industry is writing a check right now: do we treat agent security as an afterthought, or do we build the verification layers, the education, and the community norms that close the gap? Community is not a user base; it is a shared soul. And a shared soul demands shared vigilance. The tribe that verifies together survives together. The next time your agent recommends a repository, ask it the same question we should all ask ourselves: what is this trusting, and why?