A new class of AI-driven supply chain attacks, variously dubbed "Slopsquatting," "Phantom Squatting," and "HalluSquatting," leverages a fundamental flaw in how AI coding agents operate: they trust hallucinated identifiers as legitimate commands. This vulnerability allows attackers to pre-register non-existent package names, domains, or repositories that AI models are prone to generate, then serve malicious code when an agent attempts to fetch these "hallucinated" resources.
The core issue stems from AI models' probabilistic generation of outputs. Given specific inputs, these models can predictably produce names for software libraries, URLs, or other resources that do not actually exist. Attackers can anticipate these hallucinated names, register them, and then wait for an AI agent, granted broad permissions, to attempt to fetch the non-existent resource. This process bypasses traditional security measures like password theft, phishing, or user interaction.
Researchers from Tel Aviv University, Technion, and Intuit, led by Aya Spira in Ben Nassi's group, published findings on July 8, 2026, demonstrating the predictability of these fake names. Their tests across various AI coding agents, including Cursor, Windsurf, GitHub Copilot, Cline, Gemini CLI, and OpenClaw, showed models hallucinating identical names for repository requests up to 85% of the time, and 100% of the time for skill installations.
This type of attack has been observed in several instances. In January 2026, Charlie Eriksen at Aikido Security identified AI agents attempting to install a fake npm package named `react-codeshift` across 237 projects. Eriksen registered the name to prevent malicious exploitation. In June 2026, Unit 42 at Palo Alto Networks discovered 250,000 domains that language models were hallucinating, which could be registered by anyone. The July 2026 research by Spira's team further illustrated how attackers could exploit predictable repository or skill names to compromise AI agents.
While Slopsquatting and Phantom Squatting typically affect one machine at a time, HalluSquatting presents a greater scaling risk. It enables an attacker to leverage the AI agent itself to distribute malicious code, effectively creating a botnet without requiring traditional machine compromise, stolen credentials, or worms. Any machine running an exposed AI agent is a potential target. The researchers emphasized that their findings represent a minimum risk level, expecting these attacks to become more sophisticated.
The underlying design flaw is characterized as "late binding" in software architecture. AI models generate outputs based on probabilities, and developers often build pipelines that execute commands based on these outputs without sufficient prior verification. This creates a security gap where an unverified external data source is trusted, allowing malicious code to be fetched and executed before its legitimacy is confirmed. The risk extends beyond top-level packages to transitive dependencies, which are often not thoroughly inspected by current security tools.
Traditional security measures are proving ineffective against these attacks. Scanners, for example, often examine stated claims rather than hidden payloads, and can be bypassed. SSL certificates and DNSSEC also fail to prevent this threat; an attacker can easily obtain a legitimate certificate for a newly registered, hallucinated domain, which only proves ownership, not safety or user intent.
To mitigate this vulnerability, organizations must ensure that no unvetted code or data is executed within their pipelines. This requires automated vetting and verification processes that can keep pace with AI tools, as human review is insufficient. Solutions that fix the underlying design flaw, rather than patching individual tools, are necessary. This includes implementing policy-governed repositories of vetted components, where packages are verified before an AI agent can access them, preventing malicious code from entering systems at the source.
