AI Coding Agents Fall Victim to Predictable Hallucination Attacks
Security researchers from Tel Aviv University, Technion, and Intuit confirm that AI coding agents hallucinate predictable fake names for packages, domains, and repositories. The team tests multiple prompts across popular tools including Cursor, GitHub Copilot, Windsurf, and Gemini CLI. The results show that models hallucinate identical names up to 85% of the time for repository requests and 100% of the time for skill installs, making it trivial for attackers to pre-register malicious resources.
The attack works because AI agents treat hallucinated identifiers as verified commands. An attacker simply calculates what fake name an LLM is likely to produce, registers that package or domain, and waits. No stolen passwords or phishing emails are needed. When a developer allows an automated agent to fetch a tool, the agent retrieves the attacker's malicious payload and executes it, effectively handing over root access to a machine based on a name that nobody verifies.
While earlier attacks like slopsquatting and phantom domain squatting target one machine at a time, this new class of hallusquatting scales dramatically. Because AI agents handle delivery automatically, the approach functions like a self-assembling botnet without requiring traditional machine compromise techniques. The researchers note that any system running an exposed agent is vulnerable, and they treat their findings as a floor rather than a ceiling since attacks only improve over time.