The README Is the Payload

The invariant: discovering a capability is never trusting it. A README, a manifest, or a tool result is data to be scanned, never an instruction to be followed or relayed. And nothing external runs, outside a sandbox, without a human signing for it.

A finance worker in Arup's Hong Kong office joined a video call in January 2024. On it were the company's chief financial officer and a few colleagues he knew. The email that set up the meeting had made him uneasy, since it asked for a confidential transaction. The familiar faces settled him. Over that day he approved fifteen transfers to five accounts, about 25.6 million dollars. Every face and voice on the call was a synthetic forgery, built from public footage. Hong Kong police reported it a month later. The money never came back.

That case marks the last version of this attack that still needed a person in the chair. The lure reached a human. A human weighed it. A human moved the money. Everything since has worked to remove that human from the loop, and the removal is now most of the way done.

The attack types haven't changed. Phishing, fraud, ransomware, espionage, worms, all of it predates the current wave by decades. What artificial intelligence adds is a multiplier on each stage of the old playbook. It buys reach, believability, speed, and the ability to rewrite the attack while it runs. Malwarebytes, closing its year-end review, called 2026 the year of the first confirmed AI-orchestrated attacks, alongside deepfake social engineering and agents that beat humans at finding the holes.

The accelerant, measured

The clearest single number comes from Microsoft. It clocked AI-written phishing at a 54 percent click-through rate, against 12 percent for lures that skipped the AI. That's more than four times the hit rate on the most common way into an organization. Clean grammar is part of why. The old advice was to watch for typos and stilted English. That advice now teaches people to trust the exact thing they should doubt, because the machine-written lure reads like the person it imitates.

The families worth knowing sort into a few shapes.

Social engineering is the largest by volume, and the Arup loss lives here. Language models draft, translate, and personalize the lures. They power business email compromise, the scam where an attacker poses as an executive or a vendor to redirect a payment. Voice cloning carries it to the phone. Real-time video forgery carries it to the conference call. Most firms built verification habits that assume the person on the other end is who they claim to be. That assumption is the soft spot.

Criminal language models had a moment and then mostly collapsed into fraud. WormGPT and FraudGPT surfaced on criminal forums in 2023. Two years on, the research consensus is that WormGPT was the only real purpose-built one. Most successors were jailbroken commercial chatbots, or outright scams that returned the original model's refusals when asked to do the crime. Trend Micro's read is that criminals now lean on jailbreaking commercial models rather than building their own. That puts the decisive fight on the provider's side of the fence.

AI-written malware arrived as a working proof last summer. ESET disclosed PromptLock, the first known AI-powered ransomware, in August 2025. It ships no fixed payload. Instead it hands hard-coded prompts to a locally hosted model, which generates fresh scripts on each run to hunt, copy, and encrypt files. It runs across Windows, Linux, and macOS. Because the code is regenerated every time, the indicators a scanner keys on change from one infection to the next. That's precisely what signature matching cannot follow.

The genuine break is the autonomous agent, and it has a landmark. In September 2025 Anthropic caught a Chinese state-sponsored group, tracked as GTG-1002, using its Claude Code tool for espionage. The operation hit roughly thirty targets across technology, finance, chemical manufacturing, and government, and breached a handful. The AI ran an estimated 80 to 90 percent of the tactical work, at request rates no human could sustain. The operators stepped in only to approve a few escalation gates. Two details deserve to survive the headline. The operators broke the job into small tasks the tool read as innocent. They also dressed the whole thing up as authorized defensive testing to slip the guardrails. The one thing that slowed the campaign was the model's own unreliability. It overstated results and forced the humans back in to check. Model reliability is the metric improving fastest, so that brake is on a timer.

Two more shapes matter for what follows. The first is agent hijacking. The National Institute of Standards and Technology defines it as planting instructions in data an agent will read, so it takes an action nobody authorized. The second is the self-propagating worm, proven by the Morris II research. It hides a self-replicating instruction in a retrieval database and spreads to new agents with zero clicks. Google, scanning the open web, watched malicious prompt-injection payloads in public content rise 32 percent in a single quarter. Forcepoint framed the stakes in the line to keep. A browser assistant that only summarizes is low risk. An agent that can send mail, run commands, or move money is a high-value target. Impact scales with what you let the agent touch.

Where the human drops out

Put those last two shapes together, because their intersection is where this piece has been heading.

Through the first half of 2026 a supply-chain campaign called FakeGit ran at a scale that reads like a misprint. Researchers at Island, reporting through The Hacker News in July, counted roughly 7,600 malicious GitHub repositories. Independent tallies reach past 9,000. About 800 of them, better than one in ten, posed as AI skills or servers speaking the Model Context Protocol, the standard that lets an agent reach out and call an outside tool. The repositories cloned real projects and forged plausible star counts and commit histories. They hid the payload where a quick source review misses it, inside a release asset rather than the source tree. Across about 200 core repositories the campaign logged more than 14 million downloads. That averages roughly seventy thousand pulls apiece.

The mechanics underneath are a known chain. A lookalike repository lures a victim into a malicious archive. The archive triggers a loader chain built on LuaJIT, a fast compiler for the Lua scripting language. That runs an obfuscated script, and the script is itself SmartLoader, the tool that establishes persistence and pulls down a stealer. The stealer harvests credentials, tokens, browser data, and wallet material. The control address hides using a technique called EtherHiding. The malware makes an ordinary-looking read against a Polygon blockchain contract to fetch the current server, then exfiltrates over plain web traffic. The blockchain read can't be taken down, which makes it the durable fingerprint. The web endpoint it returns rotates, and has to be caught on its own.

None of that is the new part. The new part is a single move Island named AgentBaiting, and it's the reason a system like MAX has to care.

Classic phishing needs a human to click. AgentBaiting deletes the human. An agent runs an ordinary errand, asked to find an MCP server or a skill or a tool. It discovers a FakeGit repository on its own. It reads the attacker's README as if it were documentation. Then it carries the embedded instructions forward, either handing them to the person it works for or acting on them directly. The README is the front-page documentation file every repository opens with. Here it stops being a description of the software. It becomes the software. The README is the payload.

Figure 1. Classic phishing needs a person to click. AgentBaiting removes the person, so the agent finds the lure and obeys the README itself.

Island tested this against the real agents, and the finding should end any argument about whether this is hype. Claude Code, Gemini, and ChatGPT all surfaced the malicious repositories on their own, without a human ever pasting a link. A technique built to socially engineer people now works, unchanged, on the machine sent to do the person's errands. Any system that connects to arbitrary MCP servers, searches and adapts public code, or learns a tool from its own documentation has every surface this abuses. That describes MAX exactly. It describes most of the agent stacks now being wired into real work.

The door

The first instinct is to lock the agent down. No browsing public code, no arbitrary servers, no self-development. That instinct trades away the whole reason the agent is useful. The harder answer keeps the reach and removes the blast radius. That's what the CapabilityTrustGate is built to do.

The design rests on one invariant, stated plainly enough to check against every path. Discovering a capability is never the same as trusting it. A README, a manifest, or a tool result is data to be scanned, never an instruction to be followed or relayed. And nothing external runs, outside a sandbox, without a human signing for it. Everything else is machinery for holding that line.

The machinery is a single default-deny choke point. Every capability-adoption path has to call it before anything gets registered, learned from, adopted, or run. It generalizes what MAX already did in two narrower places, the explicit-allow list on its server connections and the parked frontier on its crawler, into one gate. Then it adds the control the new threat demands. The manifest is treated as hostile data, scanned for injection and exfiltration patterns and never obeyed. The gate returns one of four verdicts. ALLOW means a human-signed, address-pinned entry, and only that is runnable on the box. DENY refuses outright. SANDBOX runs the thing network-isolated and credential-less. PARK queues the unknown for a person. A separate runtime detector watches the box, on the assumption that the gate can be beaten.

Around that core sit three layers. Honesty about their build state is part of the design rather than a footnote to it. Layer A is the adoption-time gate. It's shipped and running, verified by twenty-six tests, with fail-closed defaults so that missing evidence never grants trust. Layer B is runtime containment, designed and queued. It treats every tool description and every tool result as untrusted on each call. It pins the approved content by hash, so a server that quietly changes its behavior after approval gets caught. It brokers all outbound traffic, so a resolver reaching for a blockchain endpoint hits a wall. Layer C is the assume-breach backstop, also designed. It adds rename-resilient behavioral detection, a reaper that removes both the scheduled tasks and the staging directory in one action, and credential rotation the moment anything trips.

Figure 2. Only an ALLOW is runnable on the box. Layer A is shipped today; Layers B and C are designed and queued.

The external hardening review did the useful thing and argued with the first version. It corrected three facts about the threat. The most important is that the stealer is swappable, so the controls key on the loader and the delivery, not on one malware family that ages out the day it rotates. It named eight gaps and closed them on paper. And it promoted one gap to a first-class requirement, which is the one worth dwelling on. It's the gap the design's own principle implies, but its focus on the box might have missed. A verdict can refuse to run something on the machine, and then print the attacker's instruction to run it into the reply a human reads. That hasn't stopped the attack. It has moved the execution off the box and onto a person. The gate has to strip the imperative install steps out of anything it relays. Otherwise the whole default-deny posture leaks straight through the output channel.

That's a strong piece of engineering. The instinct underneath it is correct: a default-deny front door plus a backstop that assumes the front door failed. The review's own verdict is fair. The architecture is right, and the remaining gaps are coverage rather than design flaws. The design invites one question, and it deserves to be held to it. What does a patient adversary do with the coverage that isn't there yet.

What time gets past

Start with the admission, because it's the honest place to start. Every control below the invariant is a pattern, and a pattern is a thing an attacker studies. The gate's manifest scanner keys on a fixed set of injection and exfiltration patterns, anchored to word boundaries so a benign document doesn't trip them. That precision is also the seam. The patterns are readable in the shipped code. An attacker who reads them can phrase the same imperative in words the regex doesn't hold. A paraphrase. Another language. An instruction split across lines that each look harmless. Or the instruction moved into an image the README displays and the scanner never parses. Lexical scanning of an attacker-controlled document is a race the defender re-runs every time the wording shifts, and the attacker moves first.

The release-asset veto has the same shape, sharper. It refuses any run-me archive that bundles an interpreter, a library, and an encrypted blob. That's a clean, behavior-based kill for the way FakeGit packages its payload today. It says nothing about the next packaging. A single signed-looking binary would pass it. So would a language package pulled from a public registry, a container image, or a repository that fetches its real payload during a build step. Each delivers the same capability while showing none of the three ingredients the veto looks for. The control catches this campaign's suitcase. The campaign can buy a different suitcase in an afternoon.

The deeper gap isn't in any one check. It's in the assumption that the set of capability-adoption paths is fully known. The gate defends the doors it knows about. An agent that grows a new tool, a new step in its self-development loop, or a new way of acting on a document grows a new door. A door that shipped after the gate did doesn't call the gate until someone wires it in. The README doesn't even have to route through anything labeled capability adoption. It can tell the agent to add a line to a shell profile, set an environment variable, or drop a server address into a config file. Those are ordinary side effects that don't look like adopting a capability, and they may never touch the choke point. Coverage of paths is not a milestone you reach. It's a debt that grows every time the agent learns something new, and the attacker's whole job is to find the path that shipped last week.

The human-signed ALLOW is the trust anchor, and a trust anchor is a target. The hardening review already moves the reviewer to a provenance-first queue that renders the attacker's README inert. That's right, and it doesn't solve the fatigue. Agent-discovered capabilities multiply. A person gets asked to sign, again and again, under exactly the time pressure the attack is designed to exploit. The patient version of the attack doesn't fight that review at all. It earns a genuine approval by shipping a real, useful server. It waits. Then it turns. Layer B's hash pin is the answer to that turn, and it catches a server that changes its content. It's blind to a server that keeps its content and changes its behavior by input. Benign to the reviewer's test cases, hostile to the real ones. That's the same defeat-device logic that let rigged engines pass emissions tests for years. Pinning what a thing says can't catch a thing that decides what to do based on who's asking.

The egress broker is the strongest control in the stack, and it still lives on a destination list. It denies the blockchain resolver and every undeclared endpoint, which shuts the current channel hard. It also invites the attacker to move the channel somewhere the broker has to allow. A raw file on a trusted code host. A content delivery network. Name resolution itself. The endpoint of an already-approved server, used as a relay. Exfiltration that rides a permitted channel is a solved problem for the adversary and an unsolved one for destination-based control. The list is a good filter and a bad fence.

Then there's the plainest gap of all, and the version numbers already admit it. Two of the three layers are designed and not yet built. Today the box has an adoption-time gate and a signature backstop. The runtime containment and the assume-breach response are on a roadmap. Anything that clears Layer A right now clears everything, because B and C aren't there to catch it. That's a gap measured in build time, which is the most literal reading of an exploit that only takes time to get past. The time in question is the defender's own.

None of this makes the design wrong. It makes it a first move in a game that keeps going. The invariants are general and correct. Discovery isn't trust. Content isn't instruction. Nothing runs unsigned. The enforcement is specific and dated, tuned to a campaign that will have changed shape by the time the queued layers land. The distance between the principle and the pattern is exactly where the time-limited exploits live. Closing that distance isn't a task that finishes. It's the standing cost of keeping an agent that's allowed to go out into the world and come back.

The brake that saved most of GTG-1002's targets was a machine not yet good enough to be trusted with the whole job. The gate is being built for the machine that will be. The open question isn't whether the door holds against the campaign it was designed to stop, because it does. It's how many new doors the agent will have grown by the time the next campaign comes looking for the one nobody remembered to gate.

Glossary

AgentBaiting. A supply-chain attack aimed at an AI agent rather than a person. The agent discovers a malicious code repository while searching for a tool, reads the attacker's documentation as legitimate, and carries the embedded instructions forward on its own. It removes the human click that older phishing required.

Business email compromise (BEC). A fraud in which an attacker poses as an executive, employee, or vendor to redirect a payment or extract sensitive data. It usually arrives by email, increasingly reinforced with cloned voice or video.

Command and control (C2). The server infrastructure a compromised machine phones home to, for instructions and to send stolen data.

CapabilityTrustGate. The default-deny choke point at the center of the defense described here. Every path by which the agent might adopt, learn from, or run an outside capability calls it first, and it returns one of four verdicts.

EtherHiding. A concealment technique that stores a control server's address inside a blockchain contract. The malware reads the address with an ordinary blockchain query, which can't be taken down, then talks over normal web traffic that can rotate freely.

Indirect prompt injection. An attack that plants instructions inside data an AI system will read, such as a web page, document, or tool result, so the system treats the planted text as a command rather than as content.

LuaJIT. A fast just-in-time compiler for the Lua scripting language, used in this campaign as the first stage of the loader chain.

Model Context Protocol (MCP). An open standard that lets an AI agent connect to and call outside tools and servers. It's the reach that makes an agent useful, and the surface AgentBaiting targets.

Phishing-resistant MFA. Multi-factor authentication built on hardware security keys or passkeys using the FIDO2 standard, whose cryptography binds the login to the real site. Unlike text-message codes or push prompts, it resists relay attacks, but only when no weaker fallback path is left active.

Polymorphic malware. Malicious code that rewrites its own form on each run, so the fixed signatures a scanner looks for change from one infection to the next.

README. The front-page documentation file a code repository opens with. In this campaign it stops being a description and becomes the delivery mechanism.

Reflective loading. Running a program directly in memory without writing it to disk first, which denies file-based scanners anything to inspect.

Retrieval-augmented generation (RAG). A design that lets a model pull relevant text from an outside store when it answers. A poisoned entry in that store can persist across sessions, and in the worm case, replicate.

Rug-pull. A capability that earns trust while behaving well, then turns malicious after approval. The runtime hash pin is the control aimed at catching the turn.

SmartLoader. The loader at the center of the FakeGit campaign. It establishes persistence and pulls down a follow-on stealer, and the payload it delivers is swappable rather than fixed.

Stealer. Malware that harvests credentials, session tokens, browser data, and cryptocurrency wallet material, and sends them to the attacker.

Typosquat. A lookalike name close enough to a real one to be mistaken for it, whether by a person skimming or an agent searching.

Verdict (ALLOW, SANDBOX, PARK, DENY). The four outcomes the gate can return. ALLOW is a human-signed, address-pinned entry, and the only one runnable on the machine. SANDBOX runs the item isolated and without credentials. PARK queues the unknown for a person. DENY refuses.

Appendix A. The evolutionary line, with public impact

The campaign in this piece didn't arrive from nowhere. It sits at the end of a short, fast line of public cases. Each one removed a little more of the human from the attack.

WormGPT and FraudGPT appeared on criminal forums in mid-2023. They were the first commercial attempt at crime-built language models. Most of their imitators turned out to be scams or jailbroken commercial tools.

The Arup deepfake fraud ran in January 2024. It moved roughly 25.6 million dollars across fifteen transfers in a single day, closed by a video call of forged executives. As of early 2025 the funds were unrecovered.

The Morris II research was published in March 2024 by teams at Cornell Tech, the Israel Institute of Technology, and Intuit. It proved a zero-click self-replicating prompt worm against AI email assistants. The guardrail it shipped against that worm was already trained only on known worm shapes.

Anthropic's vibe hacking case, disclosed in 2025, saw an actor drive its Claude Code tool through extortion across at least seventeen organizations. Humans still directed the work.

PromptLock, disclosed by ESET in August 2025, was the first known AI-powered ransomware. It generated its own scripts on each run, so its indicators varied between infections.

GTG-1002 was detected in September 2025 and disclosed that November. It was the first largely autonomous espionage campaign, with an AI running 80 to 90 percent of the tactical work against about thirty targets. Human operators were reduced to a handful of approvals.

FakeGit and AgentBaiting, reported in July 2026, closed the last gap by baiting the agent itself. Roughly 7,600 repositories, more than 800 posing as AI skills or servers, over 14 million downloads, and a documented ability to surface the lure to Claude Code, Gemini, and ChatGPT with no human in the loop.

Appendix B. Sources and references

The case study rests on public reporting confirmed across more than one outlet. The FakeGit figures and the agent-susceptibility finding come from Island's research through The Hacker News. The landscape figures around them are drawn from the vendor and research reports named below, and are attributed in the text as such.

1. The Hacker News, reporting Island research by Oleg Zaytsev. FakeGit campaign uses roughly 7,600 GitHub repositories to spread SmartLoader, with more than 800 posing as AI skills or MCP servers and the AgentBaiting escalation. July 2026.

2. Island. FakeGit and AgentBaiting research, including tests showing Claude Code, Gemini, and ChatGPT surfacing malicious repositories without a supplied link. July 2026.

3. Hexastrike Cybersecurity, and GBHackers. Cloned GitHub repositories delivering SmartLoader and StealC through a LuaJIT chain, with blockchain-backed control resolution. April 2026.

4. Trend Micro. AI-assisted fake GitHub repositories distributing SmartLoader and Lumma Stealer. March 2025. And The State of Criminal AI, on criminals jailbreaking commercial models rather than building their own. January 2026.

5. Anthropic. Disrupting the first reported AI-orchestrated cyber espionage campaign, on GTG-1002. November 2025. And the earlier vibe hacking disclosure of AI-driven extortion across at least seventeen organizations. August 2025.

6. ESET, WeLiveSecurity. PromptLock, the first known AI-powered ransomware, generating its scripts on each run. August 2025.

7. National Institute of Standards and Technology. Strengthening AI agent hijacking evaluations, defining indirect prompt injection against agents. January 2025.

8. Cohen, Nassi, and Bitton. Here comes the AI worm, the Morris II zero-click self-replicating prompt worm. March 2024.

9. Google web-content scan, and Forcepoint, reported through Help Net Security. A 32 percent quarterly rise in malicious prompt-injection payloads, and the finding that impact scales with an agent's privilege. April 2026.

10. Microsoft, reported through Axios. AI-written phishing reaching a 54 percent click-through rate against 12 percent for non-AI lures. October 2025.

11. Malwarebytes, reported through Cybersecurity Dive. The first confirmed AI-orchestrated attacks and AI agents outperforming humans at finding vulnerabilities. February 2026.

12. Hong Kong Police, reported through CNN and CFO Dive. The Arup deepfake fraud of roughly 25.6 million dollars across fifteen transfers. 2024.

Jason Newell has more than twenty-five years as a researcher, architect, developer, and leader, and works with the independent Max Research Collective.