The Poisoned Recommendation: Inside the 14-Million-Download Attack AI Agents Can't See

Claude Code didn't fail. That's the most unsettling part of the story Island's security team published this February. Asked to find a useful MCP server, the agent recommended a malicious repository. Gemini did the same. So did ChatGPT. No exploit, no zero-day. The machines performed exactly as engineered — found something useful, fast, and handed it to a developer. The malware rode in on a recommendation, not an intrusion. The scale is the second unsettling part: 7,600 GitHub repositories, 800-plus disguised MCP servers, over 14 million downloads tied to a single active campaign. Finding the signal in the silence of the bear taught me to look where nothing appears to go wrong. Here, nothing did. And that is precisely the problem. The attack chain reads like a textbook: malicious repository to booby-trapped ZIP to LuaJIT loader to SmartLoader to a Polygon smart contract serving as command-and-control, ending at StealC infostealer harvesting credentials, cookies, and OAuth tokens. But the textbook never covered an attacker who doesn't need to break anything. The targets aren't obscure. MCP, the Model Context Protocol, is rapidly becoming the wiring of autonomous AI agents — the way tools talk to models. With that wiring came public registries: LobeHub, Glama, MCP.so, MCP Market. Developers browse these the way earlier generations browsed PyPI or npm. Trust is the default posture. During DeFi Summer I learned gas fees were a psychological barrier before a technical one. The same dynamic governs this attack: a usability gap becomes a trust gap, and a trust gap becomes a vector. Island's report, published in February, stresses these are not theoretical. The researchers ran the tests and watched the agents comply. They published no full indicator list or C2 addresses, limiting independent verification, but the three-agent results are reproducible proof. Island details a supply-side poisoning operation. Attackers borrowed real developer identities, spinning up thousands of repositories that looked like active open-source practice. They listed malicious tools across four MCP registries simultaneously, then mirrored READMEs so each platform fed the others. One poisoned listing looked like validation for the next. About 6,600 configuration files directed agents toward the payload. The downloads — 14 million and counting — speak to how effectively these recommendations converted. Trend Micro previously attributed similar loader behavior to an actor it calls Water Kurita, tied to Lumma Stealer. This campaign runs SmartLoader and StealC instead. Whether this is the same group or an imitator, the operational template now exists. And templates in the underground economy get copied fast. What matters more than attribution: no vulnerability is required. The attack depends on the way AI agents weigh discoverability and usefulness above verification. That is a design decision, not a bug. It can be redesigned, but only if we stop treating it as an implementation flaw. Listening to what the data refuses to say: the numbers alone obscure the mechanism. Why would an agent recommend a malicious repository? Because it was trained to recommend useful things, and usefulness in open-source culture is signalled by stars, forks, download counts, and recency. Everything in that signal set can be manufactured. Fabricated social proof costs pennies; a thousand stars is cheaper than a single exploit development cycle. The platform tests were direct: Claude Code recommended a malicious skill repository when asked for a coding helper. Gemini and ChatGPT recommended malicious MCP servers. None flagged provenance. None checked whether the account behind the repository had a credible history. The agents were not tricked into doing something wrong; they were doing their job in a system that never taught them suspicion. Decoding the hidden stories behind the tokenomics has always meant asking who benefits from the silence. Here, the silence is the absence of verification, and the beneficiary is the operator of the fake repository. Attack infrastructure of this scale is not built in a weekend. Operating thousands of repositories, maintaining multiple identities, and syncing listings across registries requires disciplined automation. The pattern I tracked across 200 meme token launches in 2021 applies: the winners were never the loudest, but the ones that manufactured belonging. Malicious repositories manufacture belonging the same way — commit histories, issue threads, README polish that make a fake project look alive. The mirroring between registries amplifies the deception; when MCP.so and Glama carry the same listing, each becomes evidence for the other's legitimacy. Fourteen million downloads deserves suspicion as much as fear. Automated crawlers and virtual machine sandboxes that pull payloads for analysis likely inflate the figure. The more relevant number is conversion — how many downloads actually executed the loader — and that data refuses to speak. Yet even a small fraction of this volume represents significant credential exposure. StealC takes session cookies and OAuth tokens that survive password resets, quietly granting persistent access to corporate GitHub, cloud consoles, and CI/CD pipelines. The theft is quiet; the access is loud. Then the Polygon layer. It is tempting to call this a blockchain attack, but that misreads the intent. The smart contracts are not the target; they are a cost-efficient, programmable communication channel. Polygon offers low gas fees, an enormous transaction volume to hide within, EVM compatibility, and state storage that can hold new commands. Traditional HTTP-based C2 gets blocked by network-layer detection. A contract call looks like ordinary activity — until you know the contract address. But here is the twist the security world should not miss: once the contract address is known, the entire C2 history is permanently public. Every command, every interaction, every wallet that funded the operation sits on a transparent ledger. Alchemy is just storytelling with better chemistry — and in this case, the story is written by the attacker and signed by the chain. In my experience auditing token launches, most projects never consider the adversarial reading of their own infrastructure. This is the same failure mode, inverted: the attacker used infrastructure exactly as intended. The chain did nothing wrong. The code did exactly what it was told. The absence of sophistication in the on-chain portion — no proxy contracts, no zero-knowledge wrappers, no multi-sig obfuscation — confirms this is pragmatic tooling, not a blockchain-native exploit. That should worry defenders more, not less. A pragmatic attacker needs no novel chain tricks; the commodity infrastructure does the work. The emerging regulatory narrative will frame this as another example of blockchain enabling crime. That is the wrong lesson, and the evidence points the other way. The blockchain is the most recoverable component of the entire attack chain. The GitHub accounts can be deleted. The registries can scrub their listings. The loaders can be recompiled. But the Polygon C2 contract — and every transaction it ever made — is permanent. For forensic analysts, that is a gift traditional web infrastructure never provides. Wallet clustering, gas-funding analysis, and contract timelines turn the attacker's chosen channel into a honeypot of evidence. Regulators rarely thank a public ledger for anything, but this is the case where they should. The genuine vulnerability is not the chain. It is the single-point trust model of AI agents. The deeper error would be to add compliance theater — the kind of KYC I have watched projects slap on like a costume, easily bypassed by a handful of wallet holdings — while agents still default to trusting anonymous repositories. Attackers will copy this playbook. They are already copying it. The question is not whether imitation comes, but whether the industry will build agent-native verification, sandboxed execution, and reputation systems that make trust a property of software rather than a wish. The next narrative will not be about the malware. It will be about the trust layer that must now exist for AI agents — MCP firewalls, AI supply-chain software bills of materials, behavioral monitoring of agent actions. The crash of the old trust model is just a chapter, not the end. The real question: will we teach our agents suspicion, or will we keep handing them keys to a house full of strangers?