HalluSquatting: When AI Hallucinations Become a Weapon

In July 2026, a research team from Tel Aviv University, Technion, and Intuit disclosed a disturbing attack technique called HalluSquatting. It turns large language model hallucinations — that familiar, occasionally amusing tendency to confidently generate plausible-sounding nonsense — into a scalable pipeline for building botnets out of developer machines.

From Slopsquatting to HalluSquatting

HalluSquatting did not emerge from nowhere. Earlier in 2026, security researchers first coined the term "slopsquatting": LLMs generating code frequently invent package names that sound legitimate but don't exist — typically blends of two real library names. Because these fabrications stem from how the model was trained rather than random error, the same invented names recur across prompts, sessions, and even different model families.

Academic analysis found that when identical prompts were repeated ten times against major frontier models, 43% of hallucinated package names appeared in every single run. This predictability is precisely what makes the vulnerability commercially exploitable: an attacker can run a modest batch of prompts, identify the names that recur most reliably, and pre-register them on public registries.

A real-world case arrived before the paper did. In January 2026, security researcher Charlie Eriksen discovered an npm package called react-codeshift — a blend of the real libraries jscodeshift and react-codemod — that had never been legitimately published. The name first appeared in a single commit containing 47 AI-generated Agent Skill files, then spread through forks and translations into 237 GitHub repositories, with automated agents attempting to install it daily.

How the Attack Works

HalluSquatting's breakthrough is extending the target beyond static package installation to any resource an AI agent can autonomously fetch and execute — including GitHub repositories and agent skill files.

The attack chain works as follows:

1. Profile hallucinations: Attackers batch-test prompts against target models to identify resource names the models consistently invent
2. Pre-register: Register those names on public platforms, seeding them with malicious payloads
3. Wait for the pull: When a developer asks an AI coding assistant to clone a repository or install a skill, the assistant autonomously "hallucinates" its way to the attacker's resource
4. Payload delivery: Embedded prompt injection instructions hijack the assistant's built-in terminal, installing and launching botnet malware directly

The researchers classify this as an untargeted, pull-based indirect prompt injection attack. No direct channel to a specific victim is needed — any agent that independently produces the same hallucination and retrieves the resource becomes compromised. The team describes this as "universal and transferable."

The test results are sobering: hallucination rates reached 85% for repository-cloning prompts and 100% for agent skill installations.

The Scope Extends Far Beyond Packages

Parallel research from Palo Alto Networks Unit 42, published the same month, demonstrated that the problem extends well beyond software registries. Analyzing 913 global brands across 685,339 queries against two frontier models, researchers generated 2.1 million candidate URLs. More than 13,229 were already confirmed malicious, and roughly 250,000 additional hallucinated domains remained unregistered — available for any attacker to claim.

In one documented instance, a hallucinated postal-service domain was flagged 51 days before an attacker registered it, wrapped it in a convincingly cloned brand page, and used it to distribute a malicious Android application. The Cloud Security Alliance has since characterized this as evidence that hallucination-driven squatting has become a durable attacker technique, not an isolated curiosity.

The Agentic Botnet Threat Model

Affected AI coding assistants include Cursor, Cursor CLI, Windsurf, GitHub Copilot, Cline, Gemini CLI, and the OpenClaw family. These tools are routinely granted shell execution privileges as part of their normal operation — and HalluSquatting's payloads exploit precisely that access, installing malware through the assistant's own terminal without requiring a separate software vulnerability.

The resulting "agentic botnet" differs fundamentally from traditional botnets like Mirai: instead of discovering vulnerable, poorly secured devices, it aggregates developer workstations and enterprise systems that already possess legitimate shell and network access. The attacker inherits capability that would otherwise require lateral movement or privilege escalation to obtain.

Defense Strategies

The research team notified affected vendors before publication and deliberately withheld specific exploit details that could be reused by attackers. But this restraint does not reduce the underlying exposure: the hallucination behaviors the attack depends on are intrinsic to how current frontier models generate code-related output, and no single vendor can patch this away.

Practical defenses include:

• Verify, don't trust: Treat every repository name, package reference, and skill identifier an AI coding assistant proposes as unverified until checked against an authoritative source
• Least privilege: Restrict shell execution and network egress privileges for AI assistants to the minimum required
• Human-in-the-loop: Require confirmation before an agent clones an unseen repository or installs a new skill
• Build pipeline hardening: Enforce lockfile pinning and cryptographic hash verification to prevent dependency substitution
• Expand monitoring scope: Extend existing typosquatting and brand-monitoring programs to include hallucination-pattern monitoring

Over the longer term, the organizations building coding assistant platforms are best positioned to close this gap structurally — by enforcing global uniqueness of repository and package names across registries, preemptively registering names their own models are most likely to hallucinate, and strengthening malicious-content detection for newly registered resources.

Not the First, Not the Last

HalluSquatting is the latest escalation in a chain of AI supply chain threats. As AI agents evolve from "answering questions" to "autonomously executing tasks," security boundaries blur accordingly. The result of a hallucination-triggered resource fetch is functionally indistinguishable from a traditional network intrusion.

For every team already deeply using AI coding assistants, the question today is not "will my model hallucinate?" — it's "does my system have guardrails for when it does?"