AI Coding Agents Hallucinate

Overview

Three different names — Slopsquatting, Phantom Squatting, and HalluSquatting — all describe the same fundamental flaw: AI coding agents hallucinate identifiers and then treat them as verified commands. This design failure turns probabilistic guesses into exploitable attack vectors, allowing adversaries to pre‑register fake packages, domains, or repositories and weaponize them against automated pipelines.

How the Attack Works

• Slopsquatting — exploits fake package names (e.g., npm).
• Phantom Squatting — exploits fake domains hallucinated by models.
• HalluSquatting — exploits fake repositories or agent skills.

In each case, the agent trusts a hallucinated name without verification. Attackers predict these names, register them, and wait for automated processes to fetch malicious content — no phishing emails, no stolen passwords, no human clicks required.

Why It Matters

• Predictability: Researchers at Tel Aviv University, Technion, and Intuit showed that hallucinated names are consistent across tools like Cursor, Windsurf, GitHub Copilot, Gemini CLI, and OpenClaw.
• Scalability: HalluSquatting scales beyond one machine — the agent itself delivers malicious payloads across environments, effectively acting like a botnet.
• Silent compromise: Pipelines fetch and execute code before verification, creating a gap between text generation and execution that attackers exploit.

Real‑World Timeline

• January 2026 (Slopsquatting) — Fake npm package react-codeshift attempted installs across 237 projects.
• June 2026 (Phantom Squatting) — 250,000 hallucinated domains identified by Palo Alto Networks.
• July 2026 (HalluSquatting) — Predictable repository names exploited to hijack AI agents.

Three incidents in six months confirm this is a pattern, not coincidence.

Defensive Strategies

Security teams must address the design flaw of late binding:

• Pre‑fetch verification — ensure agents verify names before execution.
• Governed catalogs — route dependencies through vetted repositories like ActiveState’s Curated Catalog.
• Inspect transitive dependencies — security checks must go beyond top‑level packages.
• Disable unverified execution — prevent pipelines from running code fetched from hallucinated identifiers.

Traditional backstops like SSL certificates, DNSSEC, or static scanners cannot stop these attacks, as attackers optimize payloads to bypass them.

Expert in the Cloud Insight

Slopsquatting, Phantom Squatting, and HalluSquatting all exploit the same trust gap between AI text generation and code execution. The fix is not chasing each new exploit but governing intake pipelines so that agents never fetch unvetted code. By treating hallucinated names as potential attack vectors, organizations can close the gap before adversaries turn AI assistants into delivery mechanisms for botnets.