Loading story…
Researchers disclosed HalluSquatting, a prompt-injection technique that abuses AI coding assistants' tendency to hallucinate package, repository, plugin, or registry names and then retrieve them automatically. By predicting the fake identifiers a model is likely to invent, attackers can register those names on services such as GitHub or plugin stores, seed them with malicious instructions or payloads, and induce the assistant to execute attacker-controlled code. The researchers reported highly repeatable hallucinations—reaching up to 85% for repository requests and 100% for some skill-install scenarios—and said the method can deliver reverse shells and other malware without relying on software exploits, worms, or stolen credentials.
The attack was reported to affect tools including Cursor, Cursor CLI, Gemini CLI, Windsurf, GitHub Copilot, Cline, OpenClaw, ZeroClaw, and NanoClaw, many of which can fetch third-party resources and run with elevated command-line privileges. Researchers from Tel Aviv University, Technion, and Intuit said they disclosed the issue to vendors while withholding full reproduction details, warning that the technique could enable large-scale device compromise, botnet assembly, and DDoS activity across mixed environments. Recommended defenses include forcing assistants to search and verify resources before fetching them, validating package and repository names, disabling unattended auto-run behavior, and having platforms reserve likely hallucinated identifiers.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
The researchers said they disclosed the HalluSquatting issue to affected vendors and withheld exact reproduction details. The disclosure accompanied recommendations such as verifying resources before fetching them, disabling unattended auto-run modes, and reserving likely hallucinated names on platforms.
Researchers from Tel Aviv University, Technion, and Intuit described HalluSquatting, a prompt-injection technique that exploits AI assistants' tendency to hallucinate package, repository, or plugin names and then fetch attacker-controlled resources. They demonstrated code execution against multiple coding assistants and characterized the technique as a scalable path to mass compromise and botnet assembly.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
11 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcezdnet.fr
Open sourcesocradar.io
Open sourcesecurityweek.com
Open sourcethehackernews.com
Open sourcearstechnica.com
Open sourcesites.google.com
Open sourcearxiv.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are exploiting AI-generated dependency hallucinations by registering malicious packages under names that coding assistants and autonomous agents invent, a technique known as **slopsquatting** or **hallusquatting**. The threat has progressed from a 2023 proof of concept around the nonexistent package `huggingface-cli` to broader evidence that AI tools repeatedly recommend packages that do not exist; a 2025 academic measurement found **19.7%** of AI-suggested Python and JavaScript packages were nonexistent, with many hallucinated names recurring across prompts and models. The risk escalated in 2026 as hallucinated package names began propagating through agentic development workflows and automated installs. Researchers reported the fake npm package name `react-codeshift` spreading across **237 repositories**, while the malicious package `unused-imports` continued to be installed, showing how model output can become a software supply-chain infection path. A July 2026 **HalluSquatting** variant further combined hallucinated resources with prompt injection to drive AI coding agents toward **remote code execution (RCE)**, expanding the attack surface from human typo-based dependency mistakes to model-generated and agent-executed compromise.
Jul 22, 2026
Researchers and security vendors warned that **slopsquatting** has evolved into a practical software supply-chain threat as code-generating LLMs repeatedly recommend nonexistent package names that attackers can register and weaponize. An arXiv study, *We Have a Package for You!*, found that **19.7%** of packages suggested by tested code-generation models did not exist, reinforcing earlier demonstrations that hallucinated names are often stable enough to be predicted and abused rather than being purely random errors. The threat has expanded from misleading human developers to compromising **AI coding agents** and automated workflows. Reporting cited the spread of the hallucinated npm package **`react-codeshift`** across **237 repositories**, continued downloads of a malicious package named **`unused-imports`**, and a newer **HalluSquatting** technique that combines hallucinated resources with prompt injection to steer AI-assisted development tools into fetching and executing attacker-controlled code.
Jul 16, 2026
Mozilla’s **0DIN** researchers demonstrated a supply-chain-style proof of concept in which an AI coding agent such as **Claude Code** can be manipulated into compromising a developer’s machine while cloning and initializing a seemingly benign GitHub repository. The repository itself can appear clean, with a legitimate-looking `README` and no obviously malicious code, but a staged setup flow causes a package to fail until initialization and prompts the agent to run follow-up commands it interprets as routine recovery steps. In the demonstrated chain, an initialization script fetched attacker-controlled data from a **DNS TXT** record and executed it, with the TXT record carrying a base64-encoded reverse-shell payload that could give the attacker interactive access under the developer’s privileges. Researchers warned that such access could expose environment variables, API keys, local configuration files, source code, documents, browser sessions, passwords, and enable persistence, while remaining difficult for scanners, human reviewers, and AI agents to detect because each step appears normal in isolation. They said threat actors could distribute these repositories through fake job offers, tutorials, blog posts, or direct messages, and urged agentic tools to reveal the full execution chain, including dynamically fetched scripts and runtime code.
Jul 13, 2026