Researchers found language models hallucinated identical names 100% of the time for skill installs and up to 85% of the time for repository requests, a predictability attackers can exploit at scale.
The research: predictable hallucinations from Aya Spira's team
Researchers at Tel Aviv University, Technion, and Intuit published a paper on July 8, 2026, led by Aya Spira in Ben Nassi's group, showing that AI coding agents repeatedly invent the same fake identifiers. The team tested multiple prompts across Cursor, Windsurf, GitHub Copilot, Cline, Gemini CLI, and OpenClaw and reported identical hallucinated names up to 85% for repository requests and 100% for skill installs. The paper treats those numbers as a floor rather than a ceiling: “Attacks always get better,” the researchers write.
How HalluSquatting, slopsquatting, and phantom squatting are one flaw
Shane Warden of ActiveState summarizes the link plainly: "Slopsquatting exploited a fake package name. Phantom squatting exploited a fake domain. HalluSquatting exploits a fake repository or skill." In each variant, an AI agent trusts a name the model generated without verifying whether a real, vetted resource exists. The attacker precomputes likely names, registers them (domains, packages, repositories, or skills), populates them with malicious payloads, and waits for an agent with permission to fetch and execute the content.
From a single compromise to a botnet: why scale changes the risk
Unlike prior incidents that put malicious code onto one machine at a time, HalluSquatting leverages the agent’s own tool-use permissions to deliver payloads broadly. The article notes there are “no stolen passwords, no worms crawling from device to device, and no single operating system to target.” Any machine running an exposed agent that will fetch commands automatically can become part of a large-scale compromise — effectively turning many automated agents into the delivery mechanism a botnet operator once needed to build by compromising hosts directly.
The reporting cites concrete, recent examples. In January 2026 Charlie Eriksen at Aikido Security observed AI agents trying to install a fake npm package named react-codeshift across 237 projects and registered the name to block abuse. In June 2026 Unit 42 at Palo Alto Networks cataloged 250,000 domains that language models hallucinate and that could be registered by attackers. And researchers’ demonstration of HalluSquatting in July 2026 shows the same predictable-name tactic applied to repositories and skills.
Why late binding and dependency chains open the door
The root design failure identified is “late binding”: agents generate identifiers probabilistically and pipelines execute commands based on that generated output before vetting the source. Language models’ probabilistic outputs are predictable enough to be precomputed, like a rainbow-table attack on hashes, the article explains. Modern pipelines often accept flexible, disposable tooling and give those tools broad permissions to download and deploy.
Risk also extends down dependency trees. An agent might choose a legitimate top‑level package that security tooling checks, but transitive dependencies “three or four layers down” are rarely inspected. If an attacker compromises or pre-registers a deep dependency, an automated pipeline can introduce the malicious component into systems even when the top-level package appears acceptable. The piece also notes the example of Cordyceps, which “passed every check because no single workflow file was wrong, it was the composition that was exploitable.”
Why scanners, certificates, and DNS protections do not stop these attacks
The article documents several practical failures of existing defenses. Trail of Bits bypassed agent skill-store scanners in less than an hour because scanners inspect stated claims rather than hidden payloads. SSL certificates and DNSSEC also fail as defenses: an attacker who registers a fake domain can obtain a free Let’s Encrypt certificate, and a certificate only proves ownership of the domain, not that the domain is safe or intended for the requesting agent. DNSSEC prevents someone else from taking over a domain after registration, but it cannot prevent an attacker from registering a name predicted by a model.
What this means for technologists, procurement leaders, and end users
- Technologists and security teams: Turn on pre-fetch verification where it exists; most agent frameworks ship with it off by default. Route dependency resolution through a governed, pre‑vetted repository rather than letting agents fetch directly from public registries.
- Procurement leaders and enterprises: Consider governance solutions that enforce vetted intake at the source. The article recommends using a private, policy‑governed catalog (for example, ActiveState’s Curated Catalog) so agents only see components verified before any fetch.
- End users and operators of agent frameworks: Expect that automated human review cannot keep pace with AI-driven fetches; systems must automate vetting at AI speed or fail closed and require human intervention.
The pattern is clear in three incidents across six months: slopsquatting in January, phantom squatting in June, and HalluSquatting in July. The article’s prescription is design‑level: stop agents executing unvetted outputs by moving verification to intake, not post‑fetch scanning. ActiveState urges teams to route open source dependency resolution through a vetted catalog and offers an OSS Risk Assessment to inventory how many current fetches might pass unchecked today.
