A new research paper has revealed that three seemingly different attack methods targeting AI coding agents are actually variations of the same fundamental vulnerability. Researchers at Tel Aviv University, Technion, and Intuit published findings on July 8, 2026, demonstrating that slopsquatting, phantom squatting, and HalluSquatting all exploit the same core flaw: AI coding agents treat hallucinated identifiers as verified commands without proper validation.
How Does the HalluSquatting Attack Work?
The attack mechanism is remarkably straightforward yet dangerous. Attackers calculate and predict the URLs, software library names, and other outputs that language models will generate. They then register these hallucinated names in advance, set malicious traps, and wait for automated processes to fetch them. No password theft, phishing emails, or user clicks are required—only permission for an automated process to retrieve something malicious.
The research team, led by Aya Spira in Ben Nassi’s group, tested multiple prompts across Cursor, Windsurf, GitHub Copilot, Cline, Gemini CLI, and OpenClaw. Their findings were alarming: models hallucinated identical names up to 85% of the time for repository requests and 100% of the time for skill installs. This predictability transforms what appears to be random errors into exploitable attack vectors.
What Makes This Pattern Different from Previous Attacks?
While slopsquatting and phantom squatting compromise one machine at a time, HalluSquatting scales significantly further. The AI agent performs the delivery work that botnet operators previously needed real machine compromises to achieve. There are no stolen passwords, no worms spreading between devices, and no specific operating system to target. Any machine running an exposed agent becomes a potential victim.
Has This Vulnerability Been Exploited Before?
Security teams have witnessed this failure pattern three times within six months. In January 2026, Charlie Eriksen at Aikido Security discovered AI agents attempting to install a fake npm package named react-codeshift across 237 projects. By June 2026, Unit 42 at Palo Alto Networks identified 250,000 domains that language models hallucinate, all potentially registrable by attackers. The July 2026 HalluSquatting research demonstrated how attackers can systematically claim predictable names in advance.
Why Do Traditional Security Tools Fail?
Existing security backstops prove inadequate against these attack patterns. In June 2026, Trail of Bits bypassed agent skill store scanners in less than one hour. Scanners examine stated claims rather than hidden payloads, creating a fundamental weakness. SSL certificates and DNSSEC also fail to provide protection—an attacker registering a fake domain can easily obtain a legitimate certificate, which only proves domain ownership, not safety or user intent.
The vulnerability extends beyond top-level packages into the dependency tree. While security tools may check primary packages, they rarely inspect transitive dependencies three or four layers deep. If attackers compromise a deep dependency, automated pipelines can introduce that compromise into production systems without detection.
What Solutions Address This Vulnerability?
Organizations must ensure their pipelines never execute unvetted code or data. The researchers emphasize that vetting must occur automatically at AI speed, as human review cannot keep pace with automated tools. Engineering teams can implement pre-fetch verification, though most agent frameworks ship with this feature disabled by default. Routing open source dependency resolution through governed, pre-vetted catalogs instead of allowing direct fetches from public registries provides another layer of protection.
Source: BleepingComputer