Cybersecurity experts have sounded the alarm on a new type of attack that leverages artificial intelligence (AI) coding agents to compromise systems with alarming ease. Dubbed “HalluSquatting,” this threat is actually a variant of three earlier attacks, all of which exploit the same flaw in AI coding agents: their tendency to trust and execute code from unverified sources.
The problem lies in the way language models like those used by GitHub Copilot and other popular development tools generate output based on probabilities. While not deterministic, these models can produce predictable outputs up to 85% of the time for repository requests and 100% of the time for skill installs. Attackers can exploit this predictability by calculating URLs or software library names that an AI coding agent will subsequently access without verifying their authenticity.
This means that attackers don’t need stolen passwords, phishing emails, or even a human to click on a link. All they need is someone, somewhere, to give an automated process permission to fetch something malicious. In the worst-case scenario, this can lead to a botnet-style attack where compromised systems are used to spread malware and cause widespread disruption.
Researchers at Tel Aviv University, Technion, and Intuit have published a paper detailing their findings on HalluSquatting. They tested multiple prompts across various AI coding agents, including Cursor, Windsurf, and OpenClaw, and found that the models hallucinated identical names up to 85% of the time for repository requests.
The comparison between HalluSquatting and earlier attacks like Slopsquatting and Phantom Squatting undersells the severity of this threat. While these earlier attacks compromised individual systems one at a time, HalluSquatting has the potential to scale exponentially, turning any machine running an exposed agent into a target for attackers.
The key takeaway from this research is that AI coding agents are not foolproof and can be exploited by sophisticated attackers. To mitigate this risk, developers need to adopt a more security-conscious approach to building and running code. This includes verifying the authenticity of every component before allowing the AI coding agent to access it.
One potential solution lies in implementing a governed catalog system that verifies every component before it’s seen by the AI coding agent. This approach can help close the gap between hallucinated names and actual verified components, reducing the risk of HalluSquatting-style attacks.
As security teams continue to grapple with this emerging threat, one thing is clear: the failure to verify the authenticity of code and data before allowing an AI coding agent to access it has become a design principle flaw. Developers need to prioritize security over flexibility and take steps to mitigate the risk of HalluSquatting-style attacks.
In practical terms, developers should exercise caution when using AI coding agents and ensure that every component is thoroughly vetted before execution. This may involve implementing additional checks and balances or adopting more secure development practices. By taking proactive measures to address this vulnerability, we can reduce the risk of HalluSquatting-style attacks and prevent widespread compromise.
Source: Bleeping Computer — 2026-07-24