The Poisoned Playlist: How 7,600 GitHub Repositories Weaponized AI Agent Trust and Found Their C2 on Polygon

Over the past several weeks, a quiet infestation took root in the open-source ecosystem. Approximately 7,600 repositories on GitHub, masquerading as legitimate AI agent skills and MCP servers, accumulated more than 14 million downloads before security researchers at Island began peeling back the layers. The kicker? Claude Code, Gemini, and ChatGPT — the very tools developers trust to recommend useful code — were caught recommending the malicious packages in live testing. The trust machine had been weaponized from the inside. This isn't another npm typo-squatting story. It's an attack that treats AI agents as a distribution channel, exploiting what I'd call the recommendation inertia built into modern agentic workflows. When an agent scrapes the ecosystem for tools, it prioritizes availability and discoverability over verification. In my years tracking narrative shifts across crypto ecosystems, I've rarely seen an attack that so cleanly bypasses the entire defensive stack. Zero zero-day exploits. Zero network breaches. Zero individual phishing lures. Just well-positioned content and the gravitational pull of popularity metrics. The agent doesn't hack the system. It just follows the crowd — and the crowd was bought. The campaign, which researchers have branded AgentBaiting, follows a modular attack chain that reads like a dark alchemy textbook: malicious repositories → weaponized ZIP archives → LuaJIT loader → SmartLoader → Polygon smart contract command-and-control → StealC infostealer. Each hop is deliberately chosen. LuaJIT gives the loader an execution layer that traditional antivirus engines often miss. StealC harvests session cookies, OAuth tokens, and SSH credentials — the kind of persistent access that survives password resets and MFA rollovers. The operators didn't just want a foothold; they wanted the keys to the castle, including the ones that rotate. In the parlance of my world, they built a narrative where victims believe they are enhancing their workflow when, in reality, they are opening the gates. But the most architecturally interesting piece is the command-and-control layer. The attackers chose Polygon for their C2 infrastructure, and the logic is coldly rational. Transaction costs are negligible. The sheer volume of daily activity creates natural noise that obscures smart contract calls. And because Polygon is EVM-compatible, the tooling ecosystem for deploying and maintaining contracts is mature enough that any competent Solidity developer could spin up a C2 channel in an afternoon. The blockchain isn't the vulnerability here — it's the camouflage. Deploying hundreds of C2 contracts costs, at most, a few thousand dollars. That's a rounding error for a criminal operation already monetizing stolen credentials at scale. What looks like sophistication is actually cost engineering. Island's researchers validated the attack surface with uncomfortable precision. In live tests, Claude Code recommended a malicious skills repository when prompted for useful agent skills. Gemini and ChatGPT followed suit with malicious MCP servers. This is the empirical proof that the current trust model is broken at the architectural level. AI agents are not verifying; they're recommending. There is a difference, and this campaign exists in that gap. Alchemy fails when the intent is hollow — but here the intent wasn't hollow. It was fully operational, spanning 800+ fake MCP repositories and 6,600 malicious configuration files across LobeHub, Glama, MCP.so, and MCP Market. Every platform that mirrors another platform copied the poison into its own shelves, turning the registry ecosystem into a distribution network for the same payload. The multi-platform mirroring deserves attention. The malicious listings didn't stay in one registry; they proliferated across every major MCP marketplace, with mirrored READMEs that amplified discoverability and created a feedback loop. Even if GitHub purges its repos today, the infection remains dormant in other registries, ready to resurface. This is the difference between a single incident and an infrastructure investment. The operators built something reusable — likely with automated repository generators and squad-based account rotation. The borrowed identity technique, where attackers repurpose real developer identities to boost trust scores, adds a social engineering layer that no code scanner can detect. It's the oldest trick in persuasion: give the audience a reason to believe the source is one of them. From a risk standpoint, the severity rating lands somewhere between alarming and existential for the agent ecosystem. We're not talking about a two-day cleanup. We're talking about a fundamentally broken trust model with no consensus fix. The recommended mitigations — approved catalogs, sandboxed execution, token rotation, cross-registry blacklists — are all reasonable. But none of them addresses the core vulnerability: the agent's default posture of acceptance. That's a design philosophy issue, not a patch. My suspicion is that AI companies will move toward curated registry models, essentially walled gardens for agent tooling. That will reduce exposure, but it will also throttle the organic discovery that made agents feel magical. Now, the contrarian lens. In a bear market, we're trained to see the worst in everything. And it would be easy to read this as another narrative weapon against crypto — blockchain used for criminal infrastructure. But the Polygon C2 choice is actually a forensic gift wrapped in camouflage. Smart contracts are deterministic. Every command the attackers pushed through their C2 is permanently inscribed on a public ledger. Once security teams identify the contract addresses, they can reconstruct the entire command history, cluster related deployments, and trace gas payments back through the financial graph. Traditional HTTP-based C2 infrastructure evaporates the moment the server goes dark. On-chain C2 persists forever. The immutability that crypto maximalists tout as a feature is, in this context, a self-incriminating tape recorder. I've audited enough on-chain forensics to know this changes the incident response playbook. Instead of waiting for a domain registrar to cooperate, investigators can follow the money — literally. Every gas payment, every contract interaction, every wallet that funded the C2 operations becomes a data point. The attackers chose Polygon for cost and concealment, but they inherited a permanent paper trail. The more you use public blockchains to hide, the more evidence you manufacture. That tension sits at the heart of crypto crime, and it's the reason blockchain analysis firms will be essential to untangling this campaign. The researchers hinted that Trend Micro's attribution of similar activity to a group called Water Kurita may hold clues. Whether this is the same actors or an expanded playbook, the forensic approach remains identical: follow the contracts. The ecosystem-level damage, however, runs deeper than any single cleanup effort. This campaign reveals that AI agents operate on a single-point trust model, and that trust is trivially exploitable. The downstream victims are developers whose session tokens are now in the hands of operators who moved laterally into enterprise systems. The upstream pressure falls on Anthropic, Google, and OpenAI to redesign how agents validate external tools — a process that will inevitably slow down the autonomous workflows that made agents attractive in the first place. Efficiency versus security. The market hasn't priced the resolution yet. And narratives don't die when they're proven false; they die when a better story takes their place. The better story here is that AI agents require an independent security layer, and a new market is emerging to supply it. Expect a wave of venture capital flowing into AI supply chain security startups. Agent behavior monitoring, MCP firewalls, and AI-native software bills of materials are the fresh narrative seeds. But caution is warranted. The same hype cycle that drove agent adoption will try to sell you the cure — algorithms watching other algorithms. Remember that the attack succeeded not because the defenses were weak, but because the trust model was naive. Infrastructure doesn't fix naivety. Culture does. The real shift must come from developers who stop treating agent recommendations as gospel and start treating them as leads to be verified. In a bear market, narratives are the only currency that doesn't devalue — and this one is being minted in real time, out of stolen session tokens and dormant repositories. The next narrative isn't about Polygon or GitHub. It's about whether the agentic web can grow a skeptic's instinct without losing its utility. In a bear market, survival means knowing what bleeds. This time, it was the entire open-source trust layer that bled — and the only silver lining is that the blood is visible on-chain. Permanent. Auditable. Impossible to scrub. That's a story no amount of repo deletion can erase.