2026-07-08 · 2026-Q3
"HalluSquatting" Weaponizes AI Package-Name Hallucinations
Where did this code come from?
- Fixable
- Architectural
- Vendor response
- Unknown
- In the wild
- No
- Actor
- Attacker
Target
AI coding assistants Cursor, Windsurf, GitHub Copilot, Cline, Gemini CLI, and the OpenClaw family
Impact
Attackers register the fake package and repository names that models reliably invent, seed them with malicious code plus hidden prompt injection, and wait for an assistant to fetch the attacker version when a user asks for the "real" resource, chaining hallucination to code execution via the agent's terminal tool. Researchers measured an 85% consistency rate for the same incorrect repository names across phrasings and vendors and a 100% success rate for skill-install requests
Root cause
Structural LLM hallucination of plausible but non-existent artifacts combined with agents that fetch and run model-named resources without verification. Found by the Ben Nassi group (Tel Aviv University) with Stav Cohen (Technion) and Ron Bitton (Intuit)
Sources
Catalog
Cite this: AgentProv incident record: "HalluSquatting" Weaponizes AI Package-Name Hallucinations (2026-07-08). https://agentprov.com/incidents/2026-07-08-hallusquatting-weaponizes-ai-package-name-hallucinations
Related
- Also L4 · 2026-10-12Fake "Apex Accelerator" npm Packages Reroute a Coding Agent's LLM Traffic and Register an Attacker MCP ServerL4Code / Package
- Also L4 · 2026-07-24165 Malicious npm and PyPI Packages in One Week, Several Targeting AI ToolingL4Code / Package
- Also L4 · 2026-07-21"AgentBaiting": 7,600 Fake GitHub Repositories, 800+ Posing as AI Skills and MCP Servers, Deliver SmartLoaderL4Code / Package