AI coding assistants hallucinate package names. That habit has been a reliability nuisance for months. New research turns it into a supply chain attack: work out the fake names an AI reliably invents, register them first, and wait for the assistant to fetch your trap on a user’s behalf.
Researchers from Tel Aviv University (Aya Spira et al., Ben Nassi’s group), Technion (Stav Cohen), and Intuit (Ron Bitton) disclosed the technique, dubbed HalluSquatting, on July 8, 2026. The attack chains two AI behaviors: hallucination of non-existent resources and indirect prompt injection via booby-trapped content the assistant fetches.
The mechanism works because AI models do not hallucinate randomly. When an assistant is asked to suggest a tool or library, it often generates the same non-existent names across different phrasings and across models from different companies. Attackers identify these reliably hallucinated names, register them on GitHub or plugin stores, and hide adversarial instructions inside. When a developer asks their assistant for a tool, the AI fetches the attacker’s version instead.
The consistency of these hallucinations makes the attack practical. In controlled tests, researchers observed up to 85 percent hit rates on repository requests and 100 percent on skill installs. Those are peak rates across different phrasings and across models from different companies. The fake names are not random — they are deterministic enough to build an attack around.
The attack works against Cursor, Windsurf, GitHub Copilot, Cline, Google Gemini CLI, and the OpenClaw family of assistants. Each successfully ran attacker-supplied code on test machines. The test payloads were harmless placeholders; a real one would take the same path.
HalluSquatting completes a three-layer hallucination threat stack that has emerged in 2026. At the bottom: slopsquatting, where Aikido Security’s Charlie Eriksen found a hallucinated npm package, react-codeshift, that AI-written instructions had spread to 237 code projects. Above that: phantom squatting, documented by Palo Alto Networks Unit 42, involving approximately 250,000 hallucinated domains sitting unregistered and available for attackers to claim. HalluSquatting adds the third layer — hijacking the agent doing the fetching to run code on the victim’s machine.
The botnet angle is what distinguishes HalluSquatting from prior hallucination exploits. Traditional botnets require weak passwords or self-spreading malware. This needs none of that. The payload arrives as text the AI reads rather than a network exploit, so firewalls do not catch it. The machines it lands on can run any operating system. The researchers frame it as a way to assemble a botnet: one planted name, fetched by enough assistants, reaches many machines.
Marketplace scanners are not much of a backstop. In June 2026, Trail of Bits slipped malicious skills past several store scanners in under an hour. The researchers disclosed HalluSquatting to affected vendors, model makers, and marketplace operators before going public, and held back the exact steps needed to copy the attack.
The primary fix, per the researchers, is to force assistants to search before they fetch — grounding the agent in verifiable reality rather than probabilistic guessing. Users can protect themselves by not letting agents run unattended on anything they fetched. Auto-run modes like Claude Code’s skip-permissions flag and Gemini CLI’s yolo mode are the exposure point. Close those, and the attack stops.