Cybersecurity researchers have identified a critical vulnerability where AI coding agents trust hallucinated package and domain names, allowing attackers to pre-emptively claim these identifiers and inject malicious code.

Key Takeaways

  • Three distinct attack names—Slopsquatting, Phantom Squatting, and HalluSquatting—all exploit the same underlying flaw.
  • AI coding agents frequently 'hallucinate' (invent) package, repo, or domain names that do not exist.
  • Attackers can predict these hallucinations with up to 100% accuracy in certain scenarios, allowing them to register these names in advance.

In the rapidly evolving landscape of AI-assisted development, a dangerous pattern has emerged. It goes by several names: Slopsquatting, Phantom Squatting, and HalluSquatting. While they sound different, they all stem from a single, critical design failure: AI coding agents treating a hallucinated identifier as a verified command.

The Mechanics of the Attack

When a developer asks an AI agent—such as GitHub Copilot, Cursor, or Gemini CLI—to fetch a specific tool, the model may occasionally generate a name that sounds plausible but is entirely fictional. Attackers have realized they can predict these 'hallucinations.' By calculating the URLs or library names an LLM is likely to produce, attackers can register those names before a developer even thinks to use them. They aren't stealing passwords; they are simply setting a trap and waiting for an automated process to walk into it.

Why This Matters

BozokMedia analysis shows that this is a fundamental shift in cyber warfare. Unlike traditional phishing, which requires human interaction, these attacks exploit the 'late-binding' flaw in software architecture. Because agents often have permission to fetch and execute code before verifying its source, the AI itself becomes the delivery mechanism for the malware. This scales the attack from individual machine compromises to the creation of massive, automated botnets.

"In every case, the agent trusts a name nobody verified." — Shane Warden, Principal Architect at ActiveState.

Recent research from Tel Aviv University and Technion highlights the severity of this issue. Their testing revealed that models hallucinated identical names up to 85% of the time for repository requests and a staggering 100% of the time for skill installs. This predictability turns a linguistic error into a high-precision weapon.

A Growing Pattern of Failure

The security industry has witnessed this pattern repeat three times in just six months. From Slopsquatting in January 2026 to Phantom Squatting in June, and now HalluSquatting in July, the trend is clear: as AI integration deepens, the attack surface expands. Traditional security scanners often fail because they inspect top-level packages but rarely scrutinize the deep, transitive dependencies where malicious code can hide.

Did You Know?: AI 'hallucination' occurs when a Large Language Model generates confident but factually incorrect information due to probabilistic patterns.

Frequently Asked Questions

1. Can standard security pipelines detect these attacks?
Not always. Many scanners focus on known vulnerabilities in existing packages but fail to catch a brand-new, malicious package that was generated by an AI's hallucination.

2. How can organizations mitigate this risk?
Organizations must implement strict dependency management and pre-fetch verification to ensure that every resource an AI agent attempts to access is validated against a trusted source.