AgentBaiting uses 600 fake MCP and Skills listings to lure AI assistants
TechNadu · x · 2026-07-21
Researchers say a new attack called AgentBaiting can trick AI assistants such as Claude Code, Gemini, and ChatGPT into recommending malicious Skills and MCP servers. The campaign reportedly seeds more than 600 fake listings in public registries to spread malware, showing how easily agent toolchains can be weaponized.
More from coding & agent
- Hugging Face ships hf CLI updates: deduped cache saves 19GB, faster buckets, retryable GPU jobs — yb2698 · 2026-10-26
- Fern 0.1 debuts: a model built to audit training data and debug agent traces for AI builders — bneyshabur · 2026-10-26
- Fern 0.1 posts 73.4 on SWE-Bench Verified, far behind frontier models on agentic benchmarks — bneyshabur · 2026-10-26
- One prompt, full Blender animation: dev says he never touched Blender once — iamfakhrealam · 2026-10-26
- Claude Code finds root backdoor in Honda Civic head unit, then debloats it — IndraVahan · 2026-10-26
- Claude Code + Monid MCP builds a $12K/year B2B prospecting engine on live data — aryanXmahajan · 2026-10-26