AI agents are moving into software development and online shopping, but the same ability that makes them useful can also expose users to malware, scams, and data breaches. Attackers are building fake repositories that look trustworthy, while AI systems recommend some of those repositories to people searching for tools.
The risk does not stop with code. AI shopping bots are also gaining ground, and banks warn that these systems may create new paths to fraud, scams, and privacy breaches. Two fast-growing uses for AI agents now point to the same problem: systems that act on instructions can also act on malicious information.
Fake Repositories Turn Trust Into a Malware Delivery System
Island documented the FakeGit malware campaign in July 2026, linking it to roughly 7,600 fake GitHub repositories, 6,600 fraudulent profiles, and more than 14 million downloads. Over 800 repositories impersonated AI skills and MCP servers, distributing SmartLoader and the StealC infostealer.
These repositories did not rely on obvious warning signs. Attackers created convincing projects with realistic documentation, then distributed them through public registries. Fake stars, download counts, contributor histories, and registry listings helped the malicious software appear legitimate.
That strategy becomes more dangerous when AI tools join the discovery process. Gemini and ChatGPT independently recommended the same malicious walmart-mcp repository. A fake project can therefore reach users through a recommendation from the very systems they trust to help them find useful software.
The FakeGit campaign shows how fabricated trust signals can support malware distribution at scale. A repository with a polished description, a busy contributor history, and a large download count can look safe even when it delivers SmartLoader or the StealC infostealer.
AI Agents Can Treat Malicious Text Like an Instruction
AI agents process instructions and external information as text. That design creates an opening for indirect prompt injection, in which malicious text enters through outside content and influences what an agent does next.
Agents do not only generate answers. They can act on instructions, which creates a risk of data breaches when malicious text is interpreted as a command. If an agent can access valuable information, read untrusted external content, and send data outside the system, an attack can connect all three capabilities.
Security researcher Simon Willison calls this combination the “lethal trifecta”: “access to valuable information, exposure to untrusted external content and the ability to send data outside the system.” The phrase captures why agent security differs from a simple chatbot response. An agent that follows instructions and interacts with outside systems can turn hostile text into an action.
Fake repositories add another layer to that danger. An attacker can place realistic documentation in a public registry, use fabricated signals to make the project look established, and rely on an AI system to recommend it. The result links discovery, trust, and execution in one chain.
Shopping Bots Bring the Same Risk Into Consumer Decisions
AI chatbots are increasingly promoted as shopping tools by OpenAI, Anthropic, Google, and Meta. John Lewis reported that searches originating from AI agents rose to 2.5% from 0.3% in a year, showing how shopping activity is moving into conversations with AI systems.
That shift creates new concerns around scams, fraud, and data privacy. On September 22, 2026, banks including NatWest and Bank of America warned that AI shopping bots may request card details or steer users toward payment methods with weaker protections.
The banks described a basic problem: consumers may not know whether an AI agent will protect their interests when it chooses products, payment steps, or other actions. Their report stated:
“Consumers are unclear if AI will act in their interests. They are concerned that AI agents may buy the wrong thing or spend too much – or even worse, lose their money to scams and fraud. They are not sure whether they will be protected or who they will need to go to if things go wrong.”
That uncertainty grows as AI technology advances faster than industry standards and consumer protections. A shopping agent that handles personal information and payment decisions needs more than a useful recommendation; it also needs clear boundaries around what it can access and what it can do.
Trust Must Catch Up With Agent Capabilities
FakeGit and the warnings about AI shopping bots point to one expanding challenge. AI agents can search, interpret information, recommend options, and act on instructions, but those powers also give malicious content more opportunities to influence outcomes.
The danger is not limited to one platform or one type of user. It reaches developers choosing repositories, consumers using shopping tools, and anyone whose valuable information sits within an agent’s reach. Fabricated stars and downloads can mislead an AI system, while malicious text can manipulate its next action.
As AI agents move deeper into software and commerce, security will depend on how systems handle external content, verify trust signals, protect private information, and limit actions involving money or data. The technology is already changing how people find code and shop online. The next step is making sure those agents know when not to trust what they find.
Based on
