# HalluSquatting

> From AI hallucinations straight to botnets

By Zsolt Bizderi · Published 2026-08-01
Canonical: https://ambientnode.uk/hallusquatting

HalluSquatting is a supply chain attack that exploits the fact that AI hallucinates information by confidently inventing resource names that do not (yet) exist. Ask an assistant to clone a repo or install a package for some popular tool, and it will sometimes return a made up name that does not exist. HalluSquatting is the act of registering that invented name first, filling it with malicious code, and making the agent fetch it.

## Inventing Names

Because LLMs generate text probabilistically, models tend to reach for the same right-sounding answer, and when the real answer does not exist they make something up with the same invention. [Researchers found](https://thehackernews.com/2026/07/new-hallusquatting-attack-could-trick.html) the hallucinated names recur across different prompts and different foundation models. This pattern makes them predictable as nobody has to guess randomly. You can probe the models, log the names that come up repeatedly, and register the ones that are still free.

Because the behaviour is inherently how LLMs work, it cannot be patched out. You can reduce the rate, but you cannot fully eliminate it.

## Attack Chain

This is straightforward:

1. Probe: The attacker feeds an LLM a large batch of prompts asking it to install packages, clone repos, or add skills for popular tools, then records the names it hallucinates.
2. Register: The attacker claims the invented names on npm, PyPI, GitHub or a skills registry and plants malicious instructions inside.
3. Wait: A dev later asks their coding agent to do the same kind of task. The agent hallucinates the same name, pulls the squatted resource down, and runs it through its own terminal.

This isn't the same as typosquatting as there is no typo to make or wrong link to click. The agent does the fetching and the executing on its own, which turns a random hallucination into remote code execution. Tools named in [the research](https://sites.google.com/view/agentic-botnets/home) include Cursor, Windsurf, GitHub Copilot, Cline, and Gemini CLI.

## Scaling It

Tel Aviv University, Technion, and Intuit (the team behind the July 2026 disclosure) framed it as a way to build agentic botnets. Traditional botnets need vulnerabilities, weak credentials, or lateral movement to spread whereas HalluSquatting needs none of that. Any machine running an exposed coding agent can be and is a target regardless of OS, and the agent itself delivers the payload. Reported hallucination rates were high enough to make this practical with 85% for repo-cloning prompts and 100% for skill installations in their tests.

Historical timeline so far:

* Slopsquatting in Jan 2026: Charlie Eriksen [found](https://rafter.so/blog/incidents/slopsquatting-react-codeshift) a hallucinated npm package, `react-codeshift` that had AI-generated instructions already spread to 237 projects. He registered it himself before anyone with malicious intent could.
* Phantom squatting in June 2026: Palo Alto Networks Unit 42 [found](https://unit42.paloaltonetworks.com/phantom-squatting-hallucinated-web-domains/) roughly 250k hallucinated web domains unregistered, pretty much waiting to be turned into phishing infrastructure.
* HalluSquatting in July 2026: same idea pushed all the way to code execution using agents.

## Defence Options

You cannot fix this at the model level, but you can fix it around the agent.

* Pin dependencies and resources to known-good versions and sources. Do not let an agent resolve names freely at install time.
* Use allowlists for the registries and repos an agent is permitted to fetch from.
* Do not give coding agents a terminal that runs arbitrary install commands without review: human in the loop
* Verify that a package or repo actually exists and has a credible history before installing. This is probably the most painstaking but highest value action you can do.
* Sandbox agent execution so a fetched payload cannot reach the rest of the system.