Clarissa Hana
The rapid integration of Artificial Intelligence into software development workflows has ushered in an era of unprecedented productivity gains. AI coding agents, designed to streamline tasks from code generation to dependency management, are becoming indispensable tools for developers worldwide. However, a critical vulnerability has recently come to light, demonstrating that these sophisticated AI assistants, when tasked with fetching resources, can inadvertently create potent attack vectors by hallucinating non-existent identifiers. This fundamental flaw, now categorized as "HalluSquatting," represents a significant escalation of previously identified risks like Slopsquatting and Phantom Squatting, enabling attackers to hijack automated processes without requiring stolen credentials, phishing, or user interaction.
The core of the problem lies in how Large Language Models (LLMs) underpinning these AI coding agents operate. They generate outputs based on complex probability calculations. While this allows for creative and contextually relevant suggestions, it also means they can confidently "hallucinate" – produce outputs that sound plausible but lack any real-world grounding. For developers accustomed to relying on compilers or testing frameworks to catch errors, the assumption that a hallucinated identifier would be harmless is proving to be a dangerous miscalculation. Attackers are now adept at predicting these hallucinations, registering the non-existent names, and waiting for automated systems to fall into their traps.
This insidious attack mechanism was rigorously detailed in a paper published on July 8, 2026, by a research team from Tel Aviv University, Technion, and Intuit. Led by Aya Spira within Ben Nassi’s group, the researchers demonstrated the predictable nature of these AI-generated identifiers. Their extensive testing, spanning multiple AI coding agents including Cursor, Windsurf, GitHub Copilot, Cline, Gemini CLI, and OpenClaw, revealed alarming consistency. For repository requests, models hallucinated identical non-existent names up to 85% of the time. Even more critically, for skill installations, they exhibited a staggering 100% rate of hallucinating identical, invalid names.
Shane Warden, Principal Architect at ActiveState, succinctly described the evolving threat landscape: "Slopsquatting exploited a fake package name. Phantom squatting exploited a fake domain. HalluSquatting exploits a fake repository or skill. In every case, the agent trusts a name nobody verified." This trust, Warden emphasizes, is the exploitable element.
The Escalation: From Single Compromises to Botnet Potential
While previous iterations of this vulnerability, Slopsquatting and Phantom Squatting, typically resulted in malicious code being delivered to a single machine, HalluSquatting represents a significant leap in scale and impact. Instead of requiring attackers to compromise individual machines, the AI agent itself becomes the delivery mechanism for a botnet. The research team highlighted that this new attack vector allows for a broader reach, as any machine running an exposed AI coding agent becomes a potential target. The researchers’ findings, which they consider a conservative estimate, underscore the dynamic nature of cyber threats, stating, "Attacks always get better. They never get worse." This implies that the efficiency and accuracy of HalluSquatting attacks are likely to increase over time.
A Pattern of Vulnerability: Three Incidents in Six Months
The emergence of HalluSquatting is not an isolated incident but the latest in a disturbing pattern of AI-driven security failures observed within a short timeframe. Security teams have witnessed a series of related attacks, each exploiting the fundamental flaw of trusting unverified AI-generated identifiers.
-
January 2026: Slopsquatting. Charlie Eriksen, working with Aikido Security, identified AI agents attempting to install a fake npm package named
react-codeshiftacross an estimated 237 development projects. Eriksen preemptively registered the malicious package name to prevent its exploitation by malicious actors. This incident demonstrated the potential for AI agents to inadvertently introduce compromised dependencies into software supply chains. -
June 2026: Phantom Squatting. Unit 42, the threat intelligence arm of Palo Alto Networks, uncovered a massive trove of approximately 250,000 domain names that language models were hallucinating. This discovery indicated a widespread vulnerability where attackers could register these predictable, AI-generated domain names and potentially intercept or redirect traffic intended for legitimate services. The sheer volume of these hallucinated domains presented a vast attack surface.
-
July 2026: HalluSquatting. The research by Aya Spira’s team at Tel Aviv University, Technion, and Intuit provided concrete evidence of how attackers can capitalize on predictable hallucinated repository and skill names. By registering these names in advance, they can position themselves to inject malicious payloads directly through the AI agent’s execution capabilities.
Each of these attacks, despite targeting different resources (packages, domains, repositories/skills), shares a common root cause: the AI system’s implicit trust in names generated without any form of external verification or validation.
The Design Principle Failure: The Perils of Late Binding in Security
The underlying vulnerability stems from a confluence of two critical design principles that, when applied without stringent security considerations, create significant security gaps.
Firstly, the probabilistic nature of LLMs means their outputs, while often accurate, are not inherently deterministic. However, as the research indicates, these outputs are predictable enough to serve as reliable vectors for attack. This predictability is akin to pre-computed rainbow tables used in password cracking, where a vast array of potential hash outputs can be generated in advance. Attackers don’t need to steal a password; they can exploit the predictable relationship between an input and its resulting (potentially insecure) hash. In the context of AI agents, attackers can similarly pre-compute the likely hallucinated outputs and prepare to exploit them.
Secondly, developers frequently construct and deploy automated pipelines that execute commands based directly on the outputs of these LLMs. Without rigorous safeguards, these AI agents will proceed to execute code or fetch data before undertaking any vetting or verification of the source. This practice, often referred to as "late binding" in software architecture for its flexibility, transforms into a critical security vulnerability in a security context. Trusting an unverified external data source creates a massive attack surface. The danger lies in the gap between the AI’s text generation and the system’s code execution. The security posture established yesterday might be rendered obsolete by a compromised dependency or a maliciously crafted hallucinated identifier today.
The pressure to accelerate product delivery cycles often leads engineering teams to treat build infrastructure and dependency management tools as disposable. This is exacerbated by granting these tools expansive permissions to download, modify, and deploy code. Consequently, developers have inadvertently automated traditional attack methods like typosquatting and dependency confusion. When AI agents are empowered to fetch and execute code without adequate human oversight or robust automated vetting, the risk of sophisticated attacks escalates dramatically.
The Cascading Risk: Deep Dependencies and the Supply Chain
The threat posed by AI-driven exploitation extends far beyond top-level dependencies. An AI agent might identify a seemingly legitimate package with a real name. While modern security tools may scrutinize these primary packages, they often fall short when it comes to inspecting transitive dependencies—those nested several layers deep within the software’s architecture.
Developers cannot reasonably inspect the security of every transitive dependency by simply reviewing the top-level source code. The complexity and sheer volume of code make manual vetting impractical. Moreover, if a dependency is compromised while previous versions were deemed safe, established security policies may no longer offer protection. An attacker capable of compromising a deep-seated dependency or any of its upstream dependencies can leverage an automated pipeline to introduce that compromise directly into an organization’s systems. This creates a ripple effect of vulnerability throughout the software supply chain.
Traditional Security Measures Prove Insufficient
The researchers’ findings are particularly concerning as they represent a baseline risk, suggesting that the sophistication and speed of these attacks are likely to increase. Existing security tools and protocols have demonstrated a significant inability to counter these novel attack patterns effectively.
For instance, in June 2026, researchers from Trail of Bits were able to bypass all publicly available AI skill store scanners in under an hour. These scanners typically rely on examining the stated claims or metadata of a package or skill rather than its actual hidden payload. This bypass highlights a fundamental flaw: static, post-hoc scanning is inherently reactive and struggles to keep pace with attackers who meticulously craft payloads to evade detection at the precise moment of fetch.
Furthermore, established security mechanisms like SSL certificates and DNSSEC, while crucial for establishing trust and domain integrity, do not address the core issue of HalluSquatting. An attacker who registers a domain predicted by an AI agent can easily obtain a free Let’s Encrypt certificate. While this certificate validates ownership of the domain, it provides no assurance that the user intended to connect to it or that the domain itself is safe. Similarly, DNSSEC prevents domain hijacking but does not mitigate the risk posed by a domain that was legitimately registered because an attacker predicted an AI model would direct users to it.
Fortifying the Intake Pipeline: A Proactive Defense Strategy
To effectively secure systems against these emerging threats, organizations must implement a fundamental shift in their approach. The paramount principle is to ensure that no pipeline ever executes unvetted code or data. This vetting and verification process must be automated and operate at the speed of AI, as human review simply cannot keep pace with the rapid execution cycles of AI-driven development tools.
Engineering teams face a critical decision: either invest substantial resources in building bespoke internal verification pipelines or adopt existing, robust governance solutions. While patching individual tools might offer temporary relief, it will inevitably lead to a perpetual game of cat and mouse with evolving exploit variations. Addressing the underlying design flaw, however, can neutralize the attack before the AI model even has the opportunity to execute an untrustworthy command.
A key strategy involves resolving open-source dependencies through a curated, policy-governed repository. Solutions like ActiveState’s Curated Catalog exemplify this approach by providing a private repository of pre-vetted components. In this model, packages are rigorously verified before an AI agent can even access them. A component failing this vetting process is rendered invisible to the agent, preventing any malicious code from entering the system and causing a controlled failure that necessitates human investigation.
This proactive defense mechanism fundamentally differs from reactive scanning. The limitation of scanners, as demonstrated by Trail of Bits, is their reliance on inspecting an unknown upload at the moment of fetch—precisely when an attacker has optimized the payload for evasion. A curated catalog eliminates this vulnerability by exclusively serving components that have already undergone thorough vetting. This transforms a statistical guess into a trusted resource or a deliberate, investigable failure, thereby mitigating the risk of unseen malicious code infiltration.
Organizations concerned about their current exposure can proactively request an OSS Risk Assessment from providers like ActiveState. This assessment can reveal how many of a team’s current dependency fetches would pass unchecked, allowing them to identify and address vulnerabilities before they are exploited by malicious actors.
Frequently Asked Questions
-
What is HalluSquatting?
HalluSquatting is a cybersecurity attack where malicious actors pre-compute the non-existent repository, package, or skill names that AI coding agents are likely to hallucinate. They then register these predicted names and load them with malicious instructions. When a legitimate user’s AI agent attempts to fetch these resources, it inadvertently downloads and executes the attacker’s payload. -
How does HalluSquatting differ from Slopsquatting and Phantom Squatting?
All three attacks exploit the same core vulnerability: an AI agent trusting a name that has not been verified. However, they target different types of resources. Slopsquatting targets fake npm package names, Phantom Squatting targets fake web domains, and HalluSquatting targets fake repositories and AI agent skills. Crucially, HalluSquatting allows for the direct execution of malicious payloads through the agent’s own tool-use permissions, amplifying its impact. -
Can existing security scanners detect HalluSquatting?
Reliably detecting HalluSquatting with current security scanners is challenging. Research has shown that scanners can be bypassed relatively easily, as they often inspect the stated content of an upload rather than its hidden payload. Attackers can craft their malicious payloads specifically to evade these post-hoc scans. -
What immediate steps should engineering teams take?
This week, engineering teams should prioritize enabling pre-fetch verification features within their AI agent frameworks, as these are often disabled by default. Additionally, they should redirect their open-source dependency resolution through a governed, pre-vetted catalog instead of allowing agents to fetch directly from public registries. -
Does this vulnerability affect all AI coding agents?
The research indicates that the hallucination of predictable, non-existent names is a widespread issue. Consistent patterns were observed across AI agents built on different underlying models, including Cursor, Windsurf, GitHub Copilot, Cline, Gemini CLI, and OpenClaw. This suggests the vulnerability is tied to the fundamental architecture and permission models of AI agents rather than being an isolated flaw within a single vendor’s product.
