Overview
A unified attack class exploiting AI coding agent hallucinations has been formally documented by researchers at Tel Aviv University, Technion, and Intuit in a paper published 8 July 2026. Branded under three names—slopsquatting (fake package names), phantom squatting (fake domains), and HalluSquatting (fake repositories or skills)—the underlying mechanism is identical: a language model generates a plausible-sounding but nonexistent identifier, the agent trusts it without verification, and an attacker who has pre-registered that identifier intercepts the fetch. No credentials are stolen, no phishing lure is required, and no human click is needed. The agent does the delivery work autonomously.
Technical Analysis
The research team, led by Aya Spira in Ben Nassi’s group, tested multiple prompts against Cursor, Windsurf, GitHub Copilot, Cline, Gemini CLI, and OpenClaw. Key findings:
- Models hallucinated identical package/repository names up to 85% of the time for repository requests across repeated prompt runs.
- For skill installs, hallucination consistency reached 100%, meaning attackers can predict the exact name that will be requested before the developer ever issues a prompt.
- The determinism of hallucinations is the critical enabler: an attacker does not need to intercept traffic or compromise a registry—they simply calculate the likely hallucinated name, register it, and wait.
The attack flow is straightforward:
- Attacker profiles an LLM’s hallucination patterns for a given task category.
- Attacker registers the predicted package name, domain, or skill identifier on the relevant platform.
- Developer asks an AI coding agent to scaffold, extend, or automate a task.
- Agent outputs the hallucinated name and, if granted fetch/install permissions, retrieves and executes the attacker-controlled payload.
Unlike traditional dependency confusion, the attacker does not need an existing legitimate package to shadow—the name never existed in the first place.
Framework Mapping
| Framework | ID | Rationale |
|---|---|---|
| MITRE ATLAS | AML.T0010 | Malicious package injected into the ML-assisted development supply chain |
| MITRE ATLAS | AML.T0047 | Attack surface is the ML-enabled coding product itself |
| MITRE ATLAS | AML.T0051 | Agent output is manipulated through crafted prompts to produce predictable hallucinations |
| OWASP LLM | LLM08 | Agent acts on unverified output with excessive autonomy |
| OWASP LLM | LLM09 | Developer/pipeline overreliance on agent-generated identifiers without validation |
| OWASP LLM | LLM05 | Third-party package ecosystem compromised via hallucinated identifiers |
Impact Assessment
Any developer or CI/CD pipeline delegating fetch, install, or skill-acquisition tasks to an AI coding agent is exposed. The scale implication is significant: because agents handle delivery autonomously, a single attacker registration can propagate malicious code across every team using the same agent and prompt pattern. The researchers frame their measured hallucination rates as a floor, noting that attack techniques improve over time. Organisations running exposed agents in production pipelines face potential botnet-scale compromise without the traditional indicators of a supply chain attack.
Mitigation & Recommendations
- Enforce human-in-the-loop approval for any agent action that fetches, installs, or executes external code or resources.
- Implement package/domain allowlists and reject any agent-requested identifier not on a pre-approved list.
- Validate all agent-generated identifiers against live registry lookups before acting on them; treat a non-existent package as a red flag, not a fallback.
- Log and alert on novel external resolutions initiated by AI agents in development and CI/CD environments.
- Prefer pinned, hash-verified dependencies rather than agent-resolved names to eliminate the hallucination vector entirely.
- Assess which coding agent tools in your environment have autonomous fetch capabilities and reduce their permission scope immediately.