A new class of supply-chain attack is emerging that doesn’t target software bugs — it targets AI hallucinations. Researchers have documented several related techniques under the umbrella of “AI squatting,” the most technically sophisticated of which is HalluSquatting: attackers pre-register package names, repositories, or domains that large language models reliably hallucinate, then populate them with malicious payloads. When a developer asks an AI coding assistant to fetch or install a dependency, the assistant confidently recommends the attacker-controlled resource. Studies have recorded hallucination rates as high as 85% for repository-cloning prompts and 100% for AI agent skill installations.
Related variants include Slopsquatting (registering fictitious npm, PyPI, or RubyGems package names that LLMs invent during code generation) and Phantom Squatting (registering hallucinated corporate portal or documentation domains to host phishing kits). Unit 42 documented a real-world Phantom Squatting case in March 2026 in which an attacker registered a postal-service domain routinely hallucinated by LLMs and deployed a fully functional phishing kit that intercepted both human and AI-agent traffic. HalluSquatting incidents have led to demonstrated remote code execution and the creation of botnets through agentic AI tool calls.
Source
- SecurityWeek — HalluSquatting Turns AI Hallucinations into Botnet Delivery Mechanism
- The Hacker News — New HalluSquatting Attack
- VentureBeat — Slopsquatting: the AI coding tool supply chain threat
Commentary
This attack class is a fundamental shift in supply-chain threat modeling. Traditional defenses — allowlists, typosquatting detection, exact-match package verification — don’t catch hallucinated names because those names never appeared in any known software registry before the attacker registered them. The attacker is ahead of every signature database by definition. For red teamers, this opens a new pre-access vector: systematically probe an organization’s AI coding stack for predictable hallucinations, register those packages, and wait for a developer to pull them.
The defensive answer is verification hygiene at the AI layer: AI coding agents should never autonomously install or fetch dependencies without a human or deterministic validation step. Organizations using agentic development pipelines need to treat LLM tool calls as untrusted inputs to their CI/CD surface — the same way they treat user-supplied strings in web applications. This threat is early-stage, active, and largely unaddressed by current enterprise tooling.