Three attacks, three names, and one identical flaw: AI coding agents treat a hallucinated identifier as a verified command.
By Shane Warden, Principal Architect, ActiveState
Ask an AI coding agent to fetch a tool. Occasionally, it returns a name that sounds right, but does not exist. Developers used to ignore this mistake, assuming a compiler or test would stop it. Unfortunately, that assumption is dangerous and wrong.
Effectively now we’re giving root access to language models that sometimes guess words, and attackers know how to use that against us.
The attack goes like this: an attacker can calculate URLs, software library names, and other output an LLM will produce and subsequently access somehow. The attacker grabs the name, then sets a trap and waits.They do not need to steal passwords. They do not need to send phishing emails.
They do not need a human to click a link. They need someone, somewhere to give an automated process permission to fetch something malicious.
Researchers at Tel Aviv University, Technion, and Intuit published a paper on July 8, 2026. The team, led by Aya Spira in Ben Nassi’s group, proved that these fake names are predictable.
They tested multiple prompts across Cursor, Windsurf, GitHub Copilot, Cline, Gemini CLI, and OpenClaw. Models hallucinated identical names up to 85% of the time for repository requests. They hallucinated identical names 100% of the time for skill installs.
“Slopsquatting exploited a fake package name. Phantom squatting exploited a fake domain. HalluSquatting exploits a fake repository or skill,” Warden says. “In every case, the agent trusts a name nobody verified.”
This Time, the Payoff Is a Botnet
That comparison undersells what is new here. Slopsquatting and phantom squatting get an attacker’s code onto one machine at a time. HalluSquatting scales further for attackers, because the agent does the delivery work a botnet operator used to need real machine compromise for.
There are no stolen passwords, no worms crawling from device to device, and no single operating system to target. Any machine running an exposed agent can be a target.
The researchers built this attack specifically to demonstrate that it repeats at scale, which is why they treat their own numbers as a floor rather than a ceiling: “Attacks always get better,” they write. “They never get worse.”
Cordyceps passed every check because no single workflow file was wrong, it was the composition that was exploitable.
See how to close that gap by governing what enters your build at the source, not just what passes the scan.
Close the Gap
The Third Time Is a Pattern, Not a Coincidence
Security teams have seen this failure three times in six months.
January 2026 (Slopsquatting): Charlie Eriksen at Aikido Security caught AI agents trying to install a fake npm package named react-codeshift across 237 projects. He registered the name to stop attackers from taking it.
June 2026 (Phantom Squatting): Unit 42 at Palo Alto Networks found 250,000 domains that language models hallucinate. Anyone could register those domains.
July 2026 (HalluSquatting): Spira’s research team showed how attackers can take over AI agents by claiming predictable names in advance.
Every attack relies on the same core defect. The system trusts a name that a model generated without checking if anyone verified and validated it.
Design Principle Failure: Late Binding
This problem stems from two connected issues.
First, language models generate their outputs based on probabilities. Given the right inputs, they’ll produce predictable outputs (not deterministic, of course, but the paper shows that they’re predictable enough to produce attack vectors). This reminds me of rainbow tables, where you can pre-generate the output of password hashes.
You don’t have to know someone’s password if you can get the (insecure) hash and you know an input which creates that hash.
Second, developers build and run code and pipelines that execute commands based on the generated output of these language models. Unless you’re very careful, your agents will run code or fetch data before they take the opportunity to vet and verify the source of that code and data.
In software architecture, this kind of late binding offers flexibility. In security architecture, trusting an unverified external data source creates a massive vulnerability. The danger lives in the gap between text generation and code execution. What was safe and true may have changed since you last checked yesterday (or an hour ago).
Developers are rushing to ship products faster. They treat build infrastructure like disposable tooling, even while granting these tools expansive permissions to download, change, and deploy things. They have automated typosquatting and dependency confusion.
When agents now have permission to fetch and execute code without sufficient human review, your risks of attacks grow.
The Risk Extends Down the Dependency Tree
The risk extends beyond the top-level packages. An agent might select a real package with a real name. Modern security tools may check that top-level package. Do you know they rarely inspect the transitive dependencies three or four layers down the tree?
Developers cannot inspect those dependencies simply by reading the top-level source code or saying “That looks correct” and hitting Enter. Worse, if a dependency is compromised but the previous versions were fine, the rules you had in place yesterday may not protect you today.
If an attacker can compromise a deep dependency or anything it relies on, an automated pipeline can bring that compromise into your systems.
Traditional Security Backstops Fall Flat
The researchers note that their findings represent a minimum risk level. These attacks will become faster and more accurate in their targeting. Existing security tools fail against these attack patterns.
In June 2026, Trail of Bits bypassed agent skill store scanners in less than an hour. Scanners examine stated claims rather than hidden payloads.
SSL certificates and DNSSEC fail to stop this threat. An attacker who registers a fake domain can easily get a free Let’s Encrypt certificate. The certificate proves who owns the domain, but it cannot prove that the user intended to connect to it or that the domain is safe.
DNSSEC prevents other people from taking over a domain, but what if the domain were registered yesterday because an attacker predicted the latest model would send people there?
Fixing the Intake Pipeline
To secure your systems, you must ensure that none of your pipelines ever execute unvetted code or data. That vetting and verification has to happen automatically, at the speed of AI. Human review cannot keep up with automated AI tools.
Engineering teams must address this problem directly. They can spend significant time building internal verification pipelines, or they can adopt an existing governance solution.
Teams that patch individual tools will spend years chasing new variations of this exploit. Teams that fix the underlying design flaw will stop the attack before the model ever runs an untrustworthy command.
Organizations must resolve open source dependencies through something like ActiveState’s Curated Catalog, a private, policy-governed repository of vetted components. The catalog verifies the package before the agent downloads it. A package which fails this vetting is completely invisible to the agent, causing a failure before any bad code can enter your systems.
This is a different defense than scanning. Trail of Bits broke scanners because scanners inspect an unknown upload at the moment of fetch, exactly when an attacker has optimized the payload to slip past.
The Curated Catalog removes that moment entirely: it only ever serves components that were vetted and verified before any agent asked for them, so there is no unknown upload left to bypass. This single step turns a statistical guess into a trusted resource or a deliberate failure which needs human investigation.
If you want to see how many of your team’s current fetches would pass unchecked today, request an OSS Risk Assessment from ActiveState and find out before an attacker does.
FAQ
What is HalluSquatting?
HalluSquatting is an attack where researchers pre-compute the fake repository, package, or skill names that AI coding agents predictably invent, register those names first, and load them with malicious instructions before a real user’s agent goes looking for them.
How is this different from slopsquatting or phantom squatting?
All three exploit the same flaw, an agent trusting a name nobody verified, but target different resources. Slopsquatting targets npm package names, phantom squatting targets web domains, and HalluSquatting targets repositories and agent skills, then executes the payload directly through the agent’s own tool-use permissions.
Can existing security scanners catch this?
Not reliably. Trail of Bits bypassed every public skill-store scanner they tested in under an hour, because scanners inspect an unknown upload’s stated content rather than its hidden payload. A static, post-hoc scan is racing an attacker who built the payload specifically to defeat that scan.
What should engineering teams do this week?
Turn on pre-fetch verification wherever it exists; most agent frameworks ship with it off by default. Route open source dependency resolution through a governed, pre-vetted catalog instead of letting agents fetch directly from public registries.
Does this affect every AI coding agent equally?
The researchers found hallucinated names were consistent across tools built on different underlying models, including Cursor, Windsurf, GitHub Copilot, Cline, Gemini CLI, and OpenClaw. This is a pattern in how agents are built and permissioned, not a flaw isolated to one vendor.
Sponsored and written by ActiveState.
.png)
You must be logged in to post a comment Login