The Trust Default: Reading AgentBaiting's 7,600 Ghosts Through a Polygon Lens

Island Security published something in late February 2026 that should have been louder than it was. Their researchers went to Claude Code, Gemini, and ChatGPT and asked them, with no particular urgency, to find useful MCP servers and AI skills. All three agents recommended malicious repositories. Not by accident. Not after a sophisticated prompt-injection campaign. The repos were simply there, published weeks earlier, carrying the right signals — READMEs that looked professional, stars that looked organic, names that matched what a developer would search for. The numbers don't comfort me. Roughly 7,600 malicious repositories. More than 6,600 malicious configuration profiles. At least 800 MCP servers disguised as legitimate tools. Over 14 million downloads across 200 or so of the most successful lures. And at the end of the kill chain, a Polygon smart contract serving as command-and-control for StealC, a credential-stealing Trojan. The attack chain runs: malicious repo → ZIP → LuaJIT loader → SmartLoader → Polygon C2 → StealC. It's complete. It's operational. And it worked against the most advanced AI coding tools in production. I have spent the last seven years reading attack chains. But this one stopped me cold for a different reason. The code itself is not extraordinary. The extraordinary thing is what it exploits: the quiet default trust that an agent's recommendation carries. The timing matters. We are in the middle of a bull market for AI infrastructure. New agent frameworks launch weekly. New registries appear without centralized vetting. The enthusiasm has created a vacuum where verification should live. To understand why this matters, you have to understand how agents discover the world. The Model Context Protocol, or MCP, has become the connective tissue of modern AI tooling. Agents don't browse the web the way a human does. They query registries. They inspect public repositories. They look at stars, forks, release dates, download counts, and README quality. The entire route is automatable, and that automation was never designed with malice in mind. For the last two decades, the software supply chain ran on a simple premise: if a package is available on a public registry, it has a reputation. Stars, forks, download counts updated hourly, crafted to mimic community signal. The repos in this campaign didn't just exist. They were cultivated. They borrowed real developer identities, mirroring the README structure of legitimate projects so that their profiles would pass the shallow inspection that most developers — and all modern agents — rely on. The market context makes this worse. Bull markets compress judgment. Teams ship faster, install more dependencies with less scrutiny, and are more likely to trust an agent's recommendation because the perceived cost of falling behind feels higher than the cost of being compromised. Security warnings become noise. And attackers know this. This is not a bypass of security. This is a walk through an open door. I first learned about open doors in a different decade. In 2017, I was 24 years old in Zurich, a junior researcher at a boutique security firm, auditing smart contracts for an ICO-called Project Aether. I found a reentrancy flaw worth 500 ETH. I wrote a technical report. The frontend team rejected it for being "too academic." They weren't wrong in a strict sense — the syntax was dense, the mitigation path unclear. But the larger lesson had nothing to do with style. The code was not the problem. The problem was trust: the team had built a narrative that the code was safe, and no report could puncture it. I have carried that lesson into every analysis since. Code is never the primary vulnerability. The model of trust is. AgentBaiting — the name Island gave this campaign — is the same story wearing a different skin. No system was compromised. No package was hijacked in the traditional sense. The attackers manufactured the trust signal itself. Their coding assistants looked at a malicious skill repository and judged it based on visibility, discoverability, and phrasing. The agents recommended it with the same confidence they'd recommend an official library. The developers installed it. The ZIP executed. The LuaJIT loader woke up. SmartLoader called home — not to an HTTP server that would be easy to kill, but to a smart contract deployed on Polygon, where the commands would be recorded forever in a public ledger. The C2 architecture deserves a closer look, because it reveals the attacker's reasoning. When I traced the design in Island's report, I found no technical innovation. The Polygon contract is simple. It stores instructions. It is called by the loader. It reads state. It is, in effect, a programmatic dead drop. No zero-knowledge proofs, no proxy contracts to hide the implementation, no multi-sig, no obfuscated bytecode. The attacker chose Polygon for practical reasons: low gas, high transaction volume, EVM compatibility, and an ecosystem large enough that a few thousand contract calls vanish into noise. This is not blockchain-native attack sophistication. This is infrastructure as a utility. Someone needed a cheap, immutable bulletin board. They picked Polygon. And that is exactly why it will keep happening. There are perhaps a few thousand developers who noticed the 14 million download count and hesitated. But most didn't. Most trusted the recommendation, because the recommendation came from a machine they'd learned to trust with their code. The cognitive loop is almost beautiful, in a terrible way: the agent recommends, the developer executes, the attacker harvests. And the channel that completes the attack — the Polygon ledger — is the same channel that preserves the evidence. The data behind the campaign also tells a quiet story about the attackers' operational maturity. Island counted roughly 6,600 malicious configuration files tied to the repositories and found the malicious entries seeded across LobeHub, Glama, MCP.so, and MCP Market simultaneously. The mirroring is not an accident; it is a propagation strategy. When one list is flagged, the others keep the infection alive. This is a team that has built not a single lure, but an entire content-generation pipeline. Add to this the "borrowed identities" detail — real developers whose public profiles were cloned to give the repositories a human face — and you get a picture of a sophisticated criminal operation with a high tolerance for ongoing effort. Identity is a protocol; soul is the private key. The attackers copied the protocol and discarded the soul. That is what makes this attack so difficult to defend against: it doesn't break anything. It impersonates. This is the counter-intuitive insight that a straight security brief will not give you. Blockchain-based C2 is not merely a hiding mechanism. It is a permanent confession. Once Island identified the contract address, every interaction became visible. The gas payments, the callers, the timestamps, the command history — all on an immutable ledger that no takedown notice can erase. Traditional HTTP C2 infrastructure dies when a domain is seized. A Polygon contract does not die. It waits, fully documented, for anyone who knows where to look. The audit of that contract is not a check. It is a confession. The attacker's operational history is etched into a public record. This is the double-edged nature of choosing the chain as your dead drop: it is invisible only until someone finds the address. After that, it is archaeology, not espionage. This produces a strange inversion of the usual forensic timeline. In a traditional compromise, you discover the victim, then the malware, then the infrastructure, then the perpetrator. In an on-chain C2 case, the order changes: you discover a contract, then the loader, then the repositories, then the victims. The chain's permanence transforms an attacker's infrastructure into a public archive that anyone with a block explorer can read. The second contrarian layer: the offense will now imitate. If this attack can be executed at scale with moderate technical skill, it will become a template. "Agent poisoning as a service" is not a hypothetical. The infrastructure is already there — public repositories, mirror-based registries, agents that will happily recommend anything that resembles utility. The Polygon corner of this campaign will be adapted. Other chains will be used. Other loaders will replace LuaJIT. But the core mechanic will not change: an agent's recommendation is a trust certificate, and trust certificates are being minted by the wrong people. The third thing worth saying is the one that makes me uncomfortable as a researcher. The attack is more damaging to the human narrative than to any technical system. The malicious repositories were not created by bots, not entirely. They were crafted by someone — or a team — who understood how credibility is manufactured in open-source communities. They built registration profiles across multiple registries, ensuring that even if one removed the list, another would keep the infection alive. The scale — 7,600 repositories — suggests automation in the content generation. The precision suggests a human at the center who knows exactly what a developer wants to hear. In the code, I found the ghost of the architect. The ghost is not a metaphor. Someone spent weeks shaping these lures, knowing that the machines would do the rest. There is a lesson in the 2017 audit that applies here with brute simplicity. When I reported the reentrancy flaw, my technical correction was ignored because it conflicted with the emotional narrative of the project. The same thing is happening now. The technical facts are available. The security community has described the attack. But you and I will continue to see developers installing agent-recommended packages without checking anything, because the narrative that "my AI knows what it's doing" is stronger than any warning. The machine is the new authority. And authority is exactly what the attacker cloned. I don't think the fix will come from better AI models alone. The fix will come from changing the default. Agents must gate installs behind a verification layer: a signed manifest, a registry of already-approved publishers, a sandbox that executes new code without touching credentials. The infrastructure for this already exists in pieces — Snyk learned to scan dependencies, OSS-Fuzz learned to fuzz C libraries, Chainalysis learned to trace funds. What doesn't exist is the marriage of these domains into a single, agent-native trust framework. That is the gap that will be filled in the next twelve months, either by startups or by the platform companies whose reputations are on the line. The uncomfortable truth is that the major agent platforms are structurally incentivized to be permissive. An agent that asks too many questions is seen as slowing developers down. An agent that blocks unfamiliar publishers is seen as limited. In the competition for developer mindshare, safety becomes a feature that only matters after the breach becomes public. Polygon, for all its talk of scalability and adoption, will have to respond to this narrative twist. It is not the fault of Polygon that an attacker chose its ledger. But the public story is already forming: blockchains are tools for crime. The truth is more nuanced. The ledger exposed the crime. It made the attack traceable in ways a traditional C2 server never is. When the pool empties, only the intent remains. And the intent is now visible, on-chain, forensically alive forever. I was in Singapore during DeFi Summer. I watched governance go from idealistic to manipulated. I published a white paper on decentralized governance consensus that nobody wanted to hear. I took a cabin in New Zealand to recover from being right and unheard. In the years since, I learned to frame technical evidence inside human stories, because humans are the weakest link in every chain, including Ethereum. AgentBaiting is just the latest confirmation that security is not about code. It is about who we choose to trust and how our trust is automated. My year inside NFT communities taught me something similar about trust. A collection of generative avatars sold out in fifteen minutes, and then a week later the Discord had turned entirely to floor prices. The social meaning evaporated the moment speculation entered. I see the same pattern in agent ecosystems: the narrative of autonomy brought developers to these tools, and the security reflex after an attack will make every install feel like a negotiation. In the end, the attack does not need a new exploit. It does not need a zero-day. It needs what every successful attack of the last decade has needed: a person or a model that says yes when it should say wait. So here is the takeaway. The AI agent ecosystem is at the same point where open-source software was in 2015 — euphoric adoption, dangerously low verification, and an attack surface that is growing faster than the security community can map. The attack chains will keep evolving, and blockchains will continue to serve as the silent carrier layer. The question is not whether we can build a better agent. The question is whether we can build a better default. I know what I would ask every AI developer reading this: When your tool recommends a repository, does it know who published it? Does it know whether that publisher has ever been verified? Or is it simply repeating the oldest mistake on the internet — believing that if it looks useful, it must be safe? The machine did not learn this alone. We taught it to trust the way we trust. The only surprise is that we are surprised.