HalluSquatting

HalluSquatting is a novel attack technique that exploits AI coding assistants' tendency to hallucinate non-existent package names. Attackers register domains for packages that AI models reliably invent; when a developer's AI assistant fetches the trap, it executes attacker-supplied code on the developer's machine.

How It Works

1. An AI coding assistant (e.g. Claude Code, Cursor, OpenAI Codex) hallucinates a package name that doesn't exist
2. The developer, trusting the AI's suggestion, attempts to install the package
3. An attacker has pre-registered the domain/package name
4. The developer's machine executes the attacker's code

Scalability Risk

The technique could be scaled to assemble botnets by targeting popular hallucinated resources across many developers. (raw/digests/Cyber-Digest-2026-07-09.md)

Related Techniques

• Ghostapproval — Symlink-based attacks on AI coding assistants
• Mcp Tool Poisoning — MCP tool description poisoning attacks
• O Unc 066 — Social engineering attacks targeting credential theft