AI Coding Assistants Confidently Invent Software Packages. Hackers Are Now Registering the Fakes.

AI coding assistants do not merely invent software package names. They fetch, install, and run them on the developer's machine. That single step, the autonomous fetch, turns a model-quality complaint into a supply-chain attack. A research team at Tel Aviv University, Technion, and Intuit has named the technique "HalluSquatting."

An attacker probes a coding assistant with prompts that produce consistent fabrications: a helper library that does not exist, a utility module whose name the model invents. The attacker registers those names as real packages on the public repositories the assistant reaches for, the npm and PyPI indexes and their cousins. Then the attacker waits. The next time a developer asks the assistant to scaffold a project, the assistant "helpfully" imports the package the model itself hallucinated, fetches it from the real repository, and runs it. The malicious code is now executing in the developer's environment, with no phishing step and no user error in the chain.

The paper, "Beware of Agentic Botnets: Scalable Untargeted Promptware Attacks via Universal and Transferable Adversarial HalluSquatting," reports hallucination rates of 85 to 100 percent across tested engineering tasks. The range is conditional on the task class, with name generation, dependency completion, and import scaffolding behaving differently. The headline number should be read with that scope, not as a uniform finding.

For readers who have only met ChatGPT in a browser: an AI coding assistant is a model plugged into an editor, asked to write functions, fix bugs, or scaffold whole projects, and given permission to run commands on the developer's behalf. That permission is the seam. The researchers call the resulting distributed attack an "agentic botnet" because the assistants themselves, acting on the attackers' pre-registered bait, become the distribution network.

SecurityWeek's write-up of the paper lists Cursor, GitHub Copilot, and other assistants as tested. A Futurism re-report extends the vendor list, including with names that do not appear in the original paper. Treat that list as test subjects, not accused parties, and use the paper itself as the authority on which assistants were tested and how.

Before going public, the team, Aya Spira, Stav Cohen, Elad Feldman, Ron Bitton, Avishai Wool, and Ben Nassi, notified the affected AI vendors, the foundation-model providers, and the package-index maintainers. They also withheld the exact prompts and the specific adversarial recipes that would let a copycat reproduce the attack at scale. The disclosure step does not undo the structural point. A hallucination that the model uses to fetch code on a developer's behalf is not a bug to be patched inside the model, it is a property of giving an autonomous agent the keys.

BleepingComputer's analysis argues that the technique is the same family of attack as "slopsquatting" and "phantom domains," three names for what amounts to the same move: an attacker monetizes the gap between what the model says and what the package index actually contains. Multiple names, one supply chain.

The attack reframes an output-quality problem as a supply-chain one. A model that suggests code is one thing; a model that fetches and runs it is another. A package name, in other words, has become a small futures market the assistant trades in on the user's behalf, and an attacker who guesses the next hallucination gets the fill.

What is worth watching next is whether the package indexes start treating AI agents as a distinct class of fetcher, with their own allowlists or signing requirements, and whether any of the tested vendors respond with a model-side blocklist for fabricated names. Both steps are tractable. Neither is in place.