HalluSquatting, short for adversarial hallucination squatting, is an attack in which someone registers the repository, package or skill names an AI model is likely to invent, then waits for an agent to go looking for one. The agent believes it is fetching a real project. It gets attacker-controlled content instead, carrying instructions the agent then executes through its own terminal. It works at scale because hallucinations are not random: the same fabricated names recur across models and across runs, so they can be predicted and registered in advance. HalluSquatting is to typosquatting what an agent is to a developer. One waits for a human to mistype. The other waits for a machine to imagine.
What is HalluSquatting? A working definition #
Supply chain attacks have always needed a mistake to land on. Typosquatting needs someone to fat-finger a package name. Dependency confusion needs a resolver to prefer the public registry over the private one. Both wait for an error that something eventually makes.
HalluSquatting does not wait for an error. It waits for an invention.
So the working definition: HalluSquatting is a supply chain attack in which an adversary pre-registers resource identifiers that large language models are statistically likely to fabricate, so that when an AI agent fetches the invented resource it retrieves attacker-controlled content instead of a legitimate project. The resource can be a GitHub repository, a package on a public registry, a plugin or an agent skill. What they share is that the agent asked for something by name, and the name belonged to someone who was expecting the call.
The technique was formally described in Beware of Agentic Botnets: Scalable Untargeted Promptware Attacks via Universal and Transferable Adversarial HalluSquatting, published on 8 July 2026 by researchers from Tel Aviv University, the Technion and Intuit. The paper’s framing matters as much as the mechanism. It describes an untargeted attack: the adversary never needs a channel to any specific victim. No email, no message, no access. They register names and let the ecosystem do the delivery.
Hallucination squatting, broken into its three parts #
The full name explains the mechanism better than the short one, so it is worth taking apart.
- Hallucination. When a model meets an unfamiliar request, it does not say it does not know. It produces something plausible. Asked for the repository of a tool it has not seen, it constructs a believable owner and project name in the shape such identifiers normally take.
- Squatting. The same logic as typosquatting and cybersquatting. Occupy a name before its legitimate claimant does, or before anyone notices it was never claimed at all.
- Adversarial. This is what turns a nuisance into an attack. Plain hallucination squatting is opportunistic: register names a model tends to favour, then hope. The adversarial version is deliberate, using universal and transferable triggers that steer models toward a specific attacker-chosen name. That removes the waiting and makes the attack repeatable.
Put together, the HalluSquatting meaning in one line: make the model invent a name you already own, then let the agent act on it.
Why Are Hallucinations Predictable Enough to Farm? #
The instinctive objection is that hallucinations are random, so nothing can be built on them. The measurements say otherwise, and this is the single most important thing to understand about what HalluSquatting is.
| Scenario | What it means | Hallucination rate |
|---|---|---|
| Skill installation prompts | The agent invents the identifier every time it is asked | Up to 100% |
| Repository cloning prompts | Asking an agent to clone a project is a coin flip weighted against you | Up to 85% |
| Repositories published in 2025 | Recent projects are almost always fabricated rather than recalled | 92.4% mean |
| Repositories published 2019 or earlier | Established projects are reproduced reliably. Recency is the variable | 0.9% mean |
Two patterns do the damage. First, recency drives fabrication. Models reproduce the identifiers of long-established projects reliably and invent the identifiers of recent ones at a rate approaching certainty. Anything that appeared after the training cutoff is a blank the model fills in. Second, hallucinations transfer. The same fabricated names recur across different foundation models and across repeated runs, so an attacker does not need to know which assistant a target uses. One registered name covers several.
That combination is what turns a quirk into infrastructure. A name invented once by one model is a curiosity. A name invented consistently, by several models, whenever anyone asks about a trending tool, is a distribution channel.
How does a HalluSquatting attack work? #
The chain has five links, and the notable thing is how little the attacker does after setup.
1. Predict. The attacker profiles which identifiers models fabricate for a given class of request: clone this repository, install this skill, add this package. Recent and trending resources give the highest yield.
2. Register. They claim those names on the real platform. The repository exists. The package resolves. Nothing fails a basic existence check, because the resource genuinely exists.
3. Seed. The resource is filled with content written to be read as instructions by a model: an adversarial prompt in a README, a configuration file, documentation or the resource description. This is promptware, and it is closely related to indirect prompt injection. The payload is not primarily code, it is language aimed at whatever reads it next.
4. Fetch. A developer asks an agent to clone the repository or install the skill. The agent hallucinates the name, lands on the attacker’s resource and pulls its content into its own context as material it was asked to retrieve.
5. Execute. The embedded instructions hijack the agent’s execution. Because current agents ship with integrated terminals, the demonstrated result was remote tool execution and remote code execution, ending with a bot installed on the host.
That last link is what gives the research its title. Each compromised machine joins an agentic botnet: a network that spreads not through vulnerabilities or weak credentials, but through agents reading instructions they were never meant to obey, on machines nobody targeted directly.
HalluSquatting vs Typosquatting vs Slopsquatting #
These three get used interchangeably and they are not the same thing. The difference is who makes the mistake and what happens next.
| Technique | Who makes the mistake | What the attacker waits for |
|---|---|---|
| Typosquatting | A human, mistyping or misremembering a real name | A slip of the fingers on a name that does exist |
| Slopsquatting | A model, inventing a package name a developer then installs | A developer trusting an assistant’s recommendation |
| HalluSquatting | A model, inventing a resource an agent then fetches and runs | Nothing. The agent fetches, reads and executes on its own |
Slopsquatting is the closest relative and the common ancestor: register package names models hallucinate, wait for someone to run the install. HalluSquatting escalates it in two directions. The target moves from the developer to the agent, which removes the human check entirely. And the posture moves from opportunistic to adversarial, because the name can be steered rather than merely hoped for.
The shift matters most for teams already doing agentic coding, where the decision, the lookup and the execution happen in one step inside a process the developer asked for and is no longer watching.
Why Existing Controls Miss It #
Every assumption behind conventional supply chain screening inverts here, which is the uncomfortable part.
The through-line is that every one of those controls asks some version of “has anyone seen this before”. Against a name registered four hours ago, the honest answer is no, and no is not a block.
Closing the window before the agent opens it #
The useful question is not whether your developers would fall for an invented package name. It is whether anything in your pipeline would notice a dependency that is four hours old, has no history, and was added by an agent rather than a person.
Three controls close most of that window, and none of them require guessing which names an attacker registered.
Treat age and provenance as a gate. A resource created hours ago and pulled by an agent is a different proposition from one with five years of history, and package age works far better as a policy input than as metadata nobody reads. Screen on behaviour instead of reputation, because a freshly registered name always passes a “has anyone seen this” check and never passes a “what does this actually do” one. And enforce where the install happens, since the decision point has moved to the developer’s machine and the agent’s terminal, and a control that only runs in CI arrives after the code already executed locally.
Xygeni works at that layer. Malware Early Warning screens packages on behaviour rather than reputation, flagging malicious ones before a signature exists, which is the only condition under which a name registered this morning is caught this morning. The weekly results are published openly in the Malicious Code Digest. Shield enforces policy on the developer endpoint itself, including minimum age requirements for packages and blocking of malicious installs, so an agent cannot pull something the moment it imagines it. DevAI applies guardrails inside the IDE and inside the coding agent, reviewing what the agent adds before it becomes a commit. And continuous AI asset discovery maps the agents, skills and MCP servers already running in your repositories, because the first question this attack raises is the one most teams cannot answer: what is fetching things on our behalf, and under whose authority?
Book a demo to see what your agents are pulling in.
FAQ: What is HalluSquatting, in short answers #
An attacker registers the fake names AI models tend to invent, so that when an agent goes looking for one it finds the attacker’s content instead of the real project. The model’s mistake becomes the delivery mechanism.
Mostly. LLM red teaming focuses on language models and the applications built on them. AI red teaming is That the hallucination is steered rather than merely exploited. Instead of registering names models happen to favour and waiting, the research demonstrated triggers that make agents fabricate a specific attacker-chosen name on demand, and that work across different models.
No. Typosquatting exploits human error, a mistyped or misremembered name. Hallucination squatting exploits machine fabrication, a name that was never real and that no human ever typed. Name-similarity detection does nothing here, because the fabricated name is not a near-miss of anything.
They overlap, and slopsquatting came first. Slopsquatting usually means registering hallucinated package names and waiting for a developer to install one on an assistant’s recommendation. HalluSquatting is the agentic escalation: the agent fetches and executes autonomously, the hallucination can be induced rather than awaited, and the demonstrated endpoint is remote code execution and botnet installation.
Find out what your agents can fetch and install without a human in the loop, then put an age and behaviour check in front of it. Both are configuration questions, answerable this week, and neither requires knowing which names an attacker has already registered.
