HalluSquatting: attackers register the packages your coding agent dreams up
No prompt injection, no access to the target. Predict the names agents hallucinate, register malicious versions, and wait. Hallucination rates ran as high as 85%.
Photo: Artificial intelligence brain circuit board techno. // GaaS News- Researchers from Tel Aviv University, the Technion, and Intuit disclosed Adversarial HalluSquatting: predicting the repo, package, and skill names coding agents hallucinate, then pre-registering malicious versions.
- Repository-request hallucination rates ran up to 85%, with skill installs peaking at 100%, consistent across models and phrasings, per the researchers.
- A real precedent already exists: a hallucinated npm package name spread to 237 repositories through 47 agent skill files.
A research team from Tel Aviv University, the Technion, and Intuit has disclosed an attack class that needs no prompt injection and no access to the victim at all. They call it Adversarial HalluSquatting: figure out which resource names a coding agent tends to hallucinate, register malicious code under those names, and wait for an agent to install it, The Hacker News reported.
Hallucinations are predictable, which makes them a namespace
The numbers, per the researchers, are the alarming part. Repository-request hallucination rates ran up to 85%, skill installs peaked at 100%, and the behavior held consistent across models and phrasings. Testing covered Cursor, Windsurf, GitHub Copilot, Cline, Gemini CLI, and the OpenClaw family. One detail explains the mechanism neatly: agents hallucinated names for repos published in 2025 at a 92.4% mean rate, versus 0.9% for pre-2019 repos, per GBHackers' account of the paper. Models guess most where their training data ends, and the guesses cluster, which turns imagination into an attackable namespace.
This is not theoretical. A hallucinated npm package name, react-codeshift, spread to 237 repositories via 47 agent skill files, and agents were still attempting daily installs when a researcher claimed the name in January. The team notified vendors before publication and withheld reproduction steps.
How this differs from GitLost, and why that matters
Readers may recall GitLost, where a public GitHub issue steered an agent into leaking private repos. The mechanisms share nothing. GitLost was prompt injection: attacker content reaches the agent's context. HalluSquatting rides entirely on the model's own behavior; the attacker never touches the target's environment, just the public registries around it. That is why procurement checklists built on prompt-injection defenses and marketplace scanning are already behind. If your agents have terminal access and install dependencies, the mitigation is unglamorous: lockfiles, allow lists, and treating every name a model proposes as unverified input. The agents doing 466-million-line code audits are also the agents typing install commands, and this paper is about what happens between those two facts.