In January 2026, a hallucinated package named “react-codeshift” spread into 237 repositories via AI-generated agent skills. This incident, documented by Aikido Security, served as a precursor to a more systematic threat disclosed in July 2026: HalluSquatting. Researchers Aya Spira and colleagues, working with Stav Cohen and Ron Bitton, have identified that AI coding assistants do not merely hallucinate non-existent packages; they do so with a high degree of determinism that can be weaponized.
HalluSquatting is a supply chain attack that exploits the gap between an AI agent’s intent and its execution. The attack follows a four-step mechanism. First, an adversary selects a target repository or plugin. Second, they repeatedly prompt an AI to fetch the target, recording the specific fake name the model invents most frequently. Third, the attacker registers that hallucinated name on platforms like GitHub or a plugin store, embedding adversarial instructions within the code. Finally, they wait for a real user’s assistant to hallucinate that same name and automatically fetch the malicious version.
This research represents a shift in the understanding of AI-driven supply chain risks. It builds upon the lineage of “slopsquatting,” a term popularized by research from USENIX Security 2025, which found that approximately 20% of AI-suggested packages do not exist and that 58% of these hallucinations are repeated across runs. While slopsquatting focuses on the registration of fake package names on registries like npm or PyPI, HalluSquatting is distinct because it hijacks the agent’s command-execution path, leading to actual code execution on the user’s machine.
The efficacy of this attack is high. Researchers observed an 85% repository request hit rate and a 100% skill install hit rate across various phrasings and models. This behavior remained consistent across tools from different vendors, including Cursor, Windsurf, GitHub Copilot, Cline, the Google Gemini CLI, and the OpenClaw family. The predictability of these hallucinations allows attackers to know with high confidence which fake names will be called by an agent. As the researchers behind the disclosure noted, “Attacks always get better; they never get worse.”
Beyond the react-codeshift case, North Korean APT groups have been observed crafting malicious packages specifically designed to appeal to AI coding agents. As independent security researcher Andrew Nesbitt, creator of Ecosyste.ms, noted, the core issue is that “Agents resolve packages programmatically without a human glancing at the name to notice something is off.”
In response to these findings, the research team notified affected vendors, model makers, and marketplace operators before making the disclosure public. To protect the ecosystem, they have withheld exact reproduction steps. The Cloud Security Alliance also highlighted the class-level risk of this attack vector in an April 2026 research note.
Mitigation strategies require rethinking how agents handle external dependencies. Recommendations include forcing assistants to perform a real-time lookup before fetching any package, and training AI planners to treat commands like clone, install, or fetch as high-risk flags. Users are advised to avoid auto-run modes, such as the yolo mode in the Gemini CLI or similar skip-permissions flags in tools like Claude Code. Developers should verify that repository or package names resolve to the expected source. Platforms can also proactively mitigate the risk by pre-registering names that are frequently hallucinated by these models.