HalluSquatting: A New AI Attack Vector
Researchers at Tel Aviv University, Technion, and Intuit have discovered a new attack vector that exploits the predictable nature of language models. This attack, dubbed HalluSquatting, allows attackers to pre-compute fake repository, package, or skill names that AI coding agents predictably invent, register those names first, and load them with malicious instructions.
How HalluSquatting Works
HalluSquatting works by exploiting the flaw in AI coding agents that trust a name generated by a language model without verifying it. Attackers can calculate the names that an LLM will produce and subsequently access, allowing them to set a trap and wait for an automated process to fetch something malicious.
The researchers tested multiple prompts across various language models, including Cursor, Windsurf, GitHub Copilot, Cline, Gemini CLI, and OpenClaw. They found that the models hallucinated identical names up to 85% of the time for repository requests and 100% of the time for skill installs.
Comparison to Slopsquatting and Phantom Squatting
HalluSquatting is similar to Slopsquatting and Phantom Squatting, which also exploit the same flaw in AI coding agents. However, HalluSquatting scales further, allowing attackers to deliver malicious code directly through the agent's own tool-use permissions.
Slopsquatting and Phantom Squatting get an attacker's code onto one machine at a time, whereas HalluSquatting can compromise any machine running an exposed agent.
Verifying the Name Before Your Agent Trusts It
To prevent HalluSquatting, it is essential to verify the name before your agent trusts it. A governed catalog can close the gap, verifying every component before your agent ever sees it.
Design Principle Failure: Late Binding
The problem stems from two connected issues: language models generating outputs based on probabilities and developers building code that executes commands based on the generated output without verifying the source.
This reminds me of rainbow tables, where you can pre-generate the output of password hashes. You don’t have to know someone’s password if you can get the (insecure) hash and you know an input which creates that hash.
The Risk Extends Down the Dependency Tree
The risk extends beyond the top-level packages. An agent might select a real package with a real name, but modern security tools may not inspect the transitive dependencies three or four layers down the tree.
Developers cannot inspect those dependencies simply by reading the top-level source code or saying “That looks correct” and hitting Enter.
Traditional Security Backstops Fall Flat
Existing security tools fail against these attack patterns. Trail of Bits bypassed agent skill store scanners in less than an hour, and SSL certificates and DNSSEC fail to stop this threat.
Fixing the Intake Pipeline
To secure your systems, you must ensure that none of your pipelines ever execute unvetted code or data. That vetting and verification has to happen automatically, at the speed of AI.
Engineering teams must address this problem directly. They can spend significant time building internal verification pipelines, or they can adopt an existing governance solution.
FAQ
What is HalluSquatting? HalluSquatting is an attack where researchers pre-compute the fake repository, package, or skill names that AI coding agents predictably invent, register those names first, and load them with malicious instructions before a real user's agent goes looking for them.
How is this different from slopsquatting or phantom squatting? All three exploit the same flaw, an agent trusting a name nobody verified, but target different resources.
Can existing security scanners catch this? Not reliably. Trail of Bits bypassed every public skill-store scanner they tested in under an hour, because scanners inspect an unknown upload's stated content rather than its hidden payload.
Source: BleepingComputer