HalluSquatting is a supply-chain attack technique in which attackers register malicious software packages under names that AI coding assistants hallucinate during tool installation, so that an agent attempting to install a nonexistent resource fetches the attacker's package instead. The term was introduced in "Beware of Agentic Botnets: Scalable Untargeted Promptware Attacks via Universal and Transferable Adversarial HalluSquatting," a paper posted to arXiv in July 2026 (Source: arxiv.org).
Findings
The paper, dated July 8, 2026, reports hallucinated-resource rates up to 85% for repository cloning and 100% for skill installation across nine AI coding assistants, and cites the hallucinated npm package react-codeshift reaching 237 projects in January 2026 (Source: thehackernews.com). The authors warn that untargeted promptware attacks on AI agents could scale to botnets (Source: arxiv.org).
Relation to prior attack classes
The technique extends package-name-squatting attacks on human developers to the agentic setting: rather than relying on typos, it exploits the systematic character of model hallucinations, which the paper describes as universal and transferable across assistants. It operates alongside prompt injection as an attack surface specific to AI agents that install and execute tools autonomously (Agent Architecture Patterns, Autonomous cyber-agents).
Relationships
- related: Prompt Injection — sibling attack class against AI agents
- related: AI and Cybersecurity — defensive context
- related: Agent Architecture Patterns, Autonomous cyber-agents — the agentic infrastructure at issue