A Critical Flaw in AI Coding Agents Exposed as Researchers Uncover a Single, Deadly Attack Vector
Researchers at Tel Aviv University, Technion, and Intuit have revealed a shocking truth about artificial intelligence (AI) coding agents. These tools, designed to assist developers with tasks such as fetching software libraries and installing packages, are vulnerable to a single, devastating attack vector. Dubbed “HalluSquatting,” this exploit allows attackers to hijack AI agents by exploiting their tendency to generate predictable, yet unverified, names.
In essence, HalluSquatting works because AI coding agents trust a name that sounds right but doesn’t exist. This can happen when an attacker calculates a URL or software library name that the agent will produce and subsequently access. The attacker then sets a trap and waits for someone to give permission for the agent to fetch something malicious.
The researchers tested multiple prompts across popular AI coding agents, including Cursor, Windsurf, GitHub Copilot, Cline, Gemini CLI, and OpenClaw. Their findings were alarming: models hallucinated identical names up to 85% of the time for repository requests and 100% of the time for skill installs. This means that attackers can predictably generate fake names that AI agents will trust without verification.
This vulnerability is not new; it’s a variation on previous attacks known as “Slopsquatting” and “Phantom Squatting.” However, HalluSquatting takes it to the next level by allowing attackers to scale their exploits. Unlike traditional botnet operations, which require compromised machines or stolen passwords, HalluSquatting relies on AI agents doing the dirty work.
The researchers built this attack specifically to demonstrate its potential for scale and impact. They intentionally treated their findings as a floor rather than a ceiling, warning that attacks will only improve over time.
So, what can developers do to mitigate this risk? The answer lies in verifying the name before trusting it. A governed catalog can close the gap by validating every component before your agent ever sees it. This simple step can prevent attackers from exploiting AI agents’ tendency to trust unverified names.
Security teams have seen this failure play out three times in six months, with each attack relying on the same core defect: trusting a name generated without verification. The design principle of late binding, which offers flexibility in software architecture but is a security nightmare, has led to this critical flaw.
In conclusion, HalluSquatting exposes a fundamental vulnerability in AI coding agents that attackers can exploit with ease. To protect yourself and your organization from this threat, make sure to verify the name before trusting it. It’s time to take control of our AI-powered tools and ensure they don’t become vectors for attack.
Source: Bleeping Computer — 2026-07-24