HalluSquatting: AI Coding Agents Hallucinate Predictable Fake Package/Repo/Skill Names, Enabling Supply-Chain Squatting Attacks — Threadlinqs Intelligence
As of 2026-07-24, HalluSquatting: AI Coding Agents Hallucinate Predictable Fake Package/Repo/Skill Names, Enabling Supply-Chain Squatting Attacks is a high-severity supply chain threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 15 indicators of compromise.
Threat ID: TL-2026-1671 · Severity: HIGH · Status: ACTIVE · Category: SUPPLY_CHAIN
Researchers from Tel Aviv University, Technion, and Intuit show that nine popular AI coding agents (Cursor, Cursor CLI, Windsurf, GitHub Copilot, Cline, Gemini CLI, OpenClaw, ZeroClaw, NanoClaw)
HalluSquatting, formally described in the paper "Beware of Agentic Botnets: Scalable Untargeted Promptware Attacks via Universal and Transferable Adversarial HalluSquatting" (arXiv:2607.07433, published 2026-07-08) by Aya Spira, Stav Cohen, Elad Feldman, Ron Bitton, Avishai Wool, and Ben Nassi (Tel Aviv University, Technion, Intuit), identifies a systemic root cause behind three previously siloed AI-supply-chain incidents: LLM-backed coding agents generate probabilistic text that is predictable enough to precompute, and agent runtimes execute that text (clone a repo, install a package, install a skill) before any vetting or verification of the resource's authenticity -- a pattern the researchers call 'late-binding execution.'
The attack chain: (1) an attacker identifies a trending resource (a popular repository, npm package, or agent skill) that developers frequently ask AI assistants to fetch; (2) the attacker probes multiple LLMs and prompt phrasings to find the resource name(s) the models hallucinate most consistently -- across different models and phrasings, the same wrong name recurred in up to 85% of repository requests and 100% of skill-install requests; (3) the attacker pre-registers that exact hallucinated name on GitHub, npm, or a skill marketplace (ClawHub, Cisco's skill-scanner-fronted store, skills.sh) with an embedded adversarial/malicious payload or indirect prompt injection; (4) when a legitimate developer later asks their AI agent to fetch the real resource, the agent hallucinates the same wrong name and the agent's own terminal-execution tool installs and runs the attacker's payload -- typically enrolling the developer's machine into a botnet usable for cryptomining, DDoS, or as a foothold for further lateral compromise across networks the developer can reach. No exploit of the underlying OS or network stack is required; the AI agent's legitimate command-execution capability is the delivery mechanism.
The research explicitly ties HalluSquatting to two precedent incidents that motivated it: (a) Slopsquatting -- in January 2026, Aikido Security researcher Charlie Eriksen discovered 'react-codeshift', a hallucinated mash-up of the real packages jscodeshift and react-codemod, that had propagated via a single unreviewed AI-generated commit into 237 downstream repositories (via forks and translation) and was still receiving daily install attempts from autonomous agents; Eriksen defensively registered the name himself to prevent exploitation. (b) Phantom (domain) Squatting -- Unit 42 (Palo Alto Networks) ran a multi-agent adversarial-prompting pipeline across 913 global brands and 685,339 prompts against two LLM families, generating 2.1 million candidate URLs, of which 809,455 resolved to non-existent domains and roughly 250,000 remained unregistered and available for adversarial claiming; 13,229 of the generated URLs were already independently flagged as malicious. Confirmed hallucinated-domain abuse split 67.2% malware delivery, 16.2% phishing, 13.7% grayware, 3.0% C2 infrastructure, and documented real cases include a postal-service e-commerce phishing kit (23-day lead time between hallucination detection and attacker registration) and an Android malware (.apk) landing page (51-day lead time) targeting brand-impersonation victims.
A third, adjacent finding underlines that defenses are currently inadequate: Trail of Bits ('The Sorry State of Skill Distribution', 2026-06-03) bypassed every public AI-agent-skill scanner it tested (ClawHub's VirusTotal+LLM-guard pipeline, Cisco's skill-scanner, and all three scanners wired into skills.sh) in under an hour using trivial techniques -- prepending 100,000 blank lines to truncate scanner analysis before the payload, hiding logic in binary/archive formats, and prompt-injecting the scanner's own LLM judge. A related fake skill reportedly passed every scanner and reached roughly 26,000 agent installs before detection, underscoring that current skill-store vetting checks a
Weaknesses (CWE)
CWE-1426, CWE-494, CWE-829
Target sectors: technology, finance, health, ecommerce, government administration, gambling, logistics
Target regions: Global
Detections & IOCs
As of 2026-08-17, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 15 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, HIGH, threat intelligence, cybersecurity, T1593, T1583, T1585, T1608, T1195, T1566, T1059, T1136, T1027, T1036
