HalluSquatting: Your Agent Made Up a Repo, and Someone Was Waiting There

She didn’t type the wrong name. That’s the part I keep coming back to.

She asked her coding agent to clone a popular library, the kind of request you make twenty times a week without thinking about it. The agent found the project, pulled the files, started wiring things up. Every step looked normal. Ordinary. Boring, even. And the thing it was fetching had never existed until an attacker created it, specifically because a machine like hers was likely to ask for it by exactly that name.

We’ve spent a couple of years worrying about hallucination as a truth problem. The model says something confident and wrong, a person believes it, and the harm flows from the belief. That’s real, and it’s a different story from this one. A group of researchers at Tel Aviv University, the Technion, and Intuit have described something that moves the harm one step downstream, and the step is a big one. In their paper, Beware of Agentic Botnets, published in July 2026, the hallucination has become the delivery address.

What HalluSquatting actually is

They call the technique HalluSquatting, and the shape of it is simpler than it has any right to be.

Two ordinary things, chained together.

When you ask an agent for a resource it hasn’t memorized, it guesses. Confidently, in the exact shape a real name would take. And it guesses in predictable ways, because the formats are predictable: owner slash repository, toolname slash toolname, the tidy shapes we’ve all internalized. So the model produces a name that looks exactly right and points at nothing.

That’s the first ordinary thing. The second is prompt injection, which we already knew about: hidden instructions that ride in on fetched content and steer an AI toward the attacker’s goal instead of yours. What the researchers did was join them. An attacker registers the invented name first and tucks instructions inside it. Nobody aimed it at you. It just sits there, waiting for any agent, anywhere, to invent its way to that address and knock.

Two details make this worse than a lucky guess. The same invented names recur across foundation models built by different vendors, so one registration can catch many different tools. And the researchers went further than waiting for a convenient hallucination: they demonstrated a reusable adversarial trigger that can prompt an agent to produce a chosen name on demand. That’s the difference between an attacker hoping you wander into their trap and an attacker being able to point you at it.

No phishing email. No stolen password. No direct line to the victim at all. The attacker doesn’t need to reach you. Your own tool reaches them.

What the numbers say, and what they don’t

I want to give you these straight, because a post about AI making things up has no business rounding them up for effect.

In the researchers’ tests, agents invented fake repository names in up to 85% of clone requests, and fake skill names in up to 100% of some skill-installation requests. Running the full attack against real systems, including Cursor, Gemini CLI, Windsurf, and Cline, produced tool calls and remote code execution in 20% to 65% of the repository-clone evaluations.

The most useful figure is the split by age. The hallucination rate sat under 1% for repositories published before 2019, and above 92% for repositories published in 2025. An agent is most likely to invent a name exactly when someone asks it for the newest thing, which is most of the time, and which is also when nobody on the team has a memorized sense of what the real name should be.

Two caveats I won’t skip. These are research conditions, not a measurement of what’s happening in your shop today. And the researchers disclosed to the affected vendors and model providers before publishing. They also say plainly that their results are a lower bound, which matters, because techniques get cheaper to repeat once they’re public.

It’s already happening in the small

If HalluSquatting still sounds theoretical, the precursor isn’t.

In January 2026, a security researcher at Aikido registered an npm package called react-codeshift. The name is a plausible-sounding blend of two real tools, jscodeshift and react-codemod, and it had never existed. It traced back to a single commit of AI-generated agent skill files that nobody had reviewed, and from there it spread through forks into 237 repositories, with autonomous agents still attempting to install it daily. It was harmless only because the researcher claimed the name before anyone else did.

Palo Alto’s Unit 42 measured the same problem at the level of web domains. Querying two models about hundreds of well-known companies, they collected roughly 2.1 million generated URLs, of which about 250,000 were unregistered and available to anyone who wanted them.

So the landscape is already dotted with empty houses that AI keeps handing out the address to. HalluSquatting is the version where somebody is finally home, and where the thing that walks in has a terminal.

Why this is a governance problem and not only an engineering one

Here’s the objection I’d raise if I were reading this instead of writing it. This is dependency hygiene. Pin your packages, verify your URLs, don’t run what you didn’t vet. What does an AI management standard have to do with any of it?

My honest answer is that the objection has it backwards, and working out why took me a minute.

Hygiene is what one careful engineer does. A control is what your organization does whether or not that engineer is having a good day, or still works there. The whole reason management-system standards exist, and the reason they can feel like paperwork, is to take the good judgment living in one person’s head and put it somewhere it can be checked, repeated, and relied on. HalluSquatting works because we’ve quietly agreed to let agents fetch and run things on trust. The governance question is who decided, on the record, what this agent may pull, from where, and with what verification, and whether you could show that decision to someone later.

That’s the difference between a habit and a control.

What right-sized looks like

The answer here is a short list of unglamorous things, each of which maps to something a standard already asks for.

Treat every resource an agent fetches, whether that’s a repository, a package, a skill, or an MCP server, as an unverified third-party component until you’ve established otherwise. Prefer an allowlist of known-good sources over open-ended fetching. Put a gate in front of execution that inspects what’s about to be cloned or installed before it runs, which is the PreToolUse hook pattern if you’re in that world. Log every tool call, so that when a squatted name eventually shows up in an advisory you can answer the only question that matters: did we ever fetch it. And scope the agent’s permissions so an invented fetch can’t quietly reach a shell.

None of that is exotic, and none of it depends on models getting better at not making things up.

The part I didn’t expect to feel

I build these harnesses. The guardrail hooks I wrote for my own multi-agent pipeline, a gate that inspects tool calls before they run and an audit logger that records what the agents did, started life as traceability housekeeping. Reading this paper, I realized I’d written HalluSquatting countermeasures months before I had a name for the thing they defend against.

That’s the quiet argument for governance, and I trust it more than any alarming statistic. The controls that matter most are usually the boring ones you set up when nothing is wrong and then forget about, until the day a machine confidently fetches something that was never real, and the only reason you’re fine is that you’d already decided, on the record, not to run it.

Nobody typed the wrong thing. That’s still the part I keep coming back to, and it’s exactly why the answer has to be something you wrote down, rather than a resolution to be more careful.

If you’re building or approving agent workflows now, start with the fetch-and-execute moments. Decide which sources are allowed, what has to be verified, who can override the gate, and what gets logged. If you want help turning those decisions into an operating practice rather than a document, that’s what we do.