Research demo
HalluSquatting: registering hallucinated package and skill names to make AI coding assistants install attacker code
AIR-2026-0150 AIR record · 2026-07-hallusquatting-agent-supply-chain
From the supporting source
They ran it against tools including Cursor, Windsurf, GitHub Copilot, Cline, Google's Gemini CLI, and the OpenClaw family of assistants, getting each to run attacker code.thehackernews.com
The record
Disclosed
2026-07-01
Vendor
multiple
Product
Cursor; Windsurf; GitHub Copilot; Cline; Gemini CLI; OpenClaw-family assistants
Risk domain
Tool misuse › Supply chain vulnerabilities
Also touches
Privilege escalation
System type
Generative model
Who acted
Agent acted — the coding assistants resolved and installed the squatted packages
Attack surface
Coding agent
Autonomy level
Semi-autonomous
Initial vector
Hallucinated dependency resolution
Impact type
Remote code execution, Supply chain compromise, Arbitrary code execution, Botnet recruitment
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI04 – Agentic Supply Chain Vulnerabilities
- MITRE ATLAS
- AML.T0040 – AI Supply Chain Compromise
- NIST AI RMF
- MAP 4.1
- EU AI Act
- Annex III §2
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Scan dependencies and container images for vulnerabilities; Use trusted sources.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
any agent that resolves and installs dependencies without a human reading the package name
Capability abused
Defense & remediation
Recorded defense
none in the tested agents; classic slopsquatting relied on a human noticing an odd package name, and agentic resolution removes that checkpoint
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
none - mitigation is allowlisting, lockfiles, provenance and pre-install verification
Taxonomy & references
Curator notes
Aya Spira and colleagues in Ben Nassi's group (Tel Aviv University), with Stav Cohen (Technion) and Ron Bitton (Intuit). The hallucinated names reproduced in up to 85% of repository requests and 100% of skill installs across models and phrasings. Real-world corroboration exists but is separate and was not independently cited, so it is recorded here as notes rather than as its own record: the npm package 'unused-imports' (hallucinated in place of eslint-plugin-unused-imports, still ~233 weekly downloads in early Feb 2026 despite being security-held) and 'react-codeshift', which Aikido's Charlie Eriksen found in January 2026 had already propagated into 237 projects with agents still trying to install it. | Merged from duplicate id `2026-07-hallusquatting-coding-agents`. Also reported as: 'HalluSquatting: registering the repo, package and skill names coding agents reliably hallucinate'.
Cite as
Enkrypt AI. "HalluSquatting: registering hallucinated package and skill names to make AI coding assistants install attacker code". AIR, AIR-2026-0150. https://agentincident.vercel.app/i/AIR-2026-0150/ (accessed 2026-10-19).