Researchers: AI Coding Agents Can Be Fooled With Fake Hallucinated Packages

A team of researchers from Tel Aviv University, Technion, and Intuit has described a new attack technique targeting AI-based coding agents. The attack, named HalluSquatting, exploits the fact that AI assistants regularly invent names of libraries, repositories, and plugins that don't exist, and criminals can register those names in advance and plant malicious code inside them.

The attack mechanism relies on a phenomenon known from chatbots, but transplanted onto developer tools. Large language models, when asked to reference a specific library, repository, or plugin, can quite reliably invent names that sound plausible but don't actually exist. Until now, this was treated mainly as a response-quality problem. The researchers showed that the phenomenon can be predicted, and weaponized.

How the Attack Works

The process begins with an analysis of popular repositories and tools that developers frequently reference in conversations with AI assistants, especially ones too new to have made it into the models' training data. Attackers repeatedly query the assistants, recording which fake names appear most often and most consistently.

Once such a name is identified, criminals register it on GitHub, in the npm registry, or in a plugin store, embedding hidden malicious instructions inside it. When a real user later asks their AI agent to fetch the legitimate resource, the model invents the same fake name as before, the agent automatically downloads it, and the poisoned content hijacks the conversation's context and triggers unauthorized tool actions.

Unlike classic prompt injection, which requires some direct channel of contact with the victim, such as a malicious email, HalluSquatting needs no interaction with the target at all. It's enough for the attacker to correctly predict what the model will invent.

Impact on Developers

The researchers demonstrated that the technique allows remote code execution and tool invocation across multiple platforms simultaneously, which in practice means the ability to install malware on victims' computers. They also showed the attack can scale into building a network of hijacked devices remotely controlled by the attacker, essentially a classic botnet, this time operated by the hands of the AI agents themselves.

Testing covered the most popular tools on the market, including Cursor, Windsurf, GitHub Copilot, Cline, Google's Gemini CLI, and assistants from the OpenClaw family. The hallucinations proved to be a phenomenon that transfers across different models and applications, meaning the problem doesn't affect a single vendor but an entire category of tools built on large language models.

Scale of the Problem

The scale of the phenomenon the researchers documented is one of the more troubling parts of the work. References to a fabricated npm package called react-codeshift, which never officially existed, were found in more than 237 code projects, yet it still ended up in AI-generated instructions and was actually invoked by developers. The team also identified roughly 250,000 hallucinated domain names that remain unregistered and could be claimed by anyone.

Before the results were published, the researchers notified the tool makers, foundation model providers, and platform administrators, withholding the most sensitive implementation details from disclosure. This is standard practice in responsible vulnerability disclosure, giving companies time to patch the holes before the attack description goes public.

What Development Teams Can Do

The defensive recommendations focus on limiting agent autonomy at critical moments. The researchers recommend enforcing verification of discovered resources before downloading them, disabling automatic command-execution modes that skip confirmation, such as the permission-bypass mode in Claude Code or the yolo mode in Gemini CLI, and applying an additional layer of security review before actually executing downloaded code.

They also recommend that companies themselves preemptively register the most likely hallucinated names before criminals do, and that agents verify a repository or package name actually matches the expected source before downloading and running anything.

For Polish development teams increasingly using coding agents in fully autonomous mode, the study's conclusions are a concrete operational pointer, not just an academic curiosity. The scale of earlier reports about vulnerabilities in tools such as JetBrains plugins or MCP servers shows that the entire category of agentic tools still lacks mature mechanisms for verifying what it actually downloads and runs on the user's behalf.