A recent study has uncovered a significant vulnerability in AI coding agents that enables attackers to exploit fake names and gain access to systems. Researchers at Tel Aviv University, Technion, and Intuit have identified the same flaw behind three distinct attacks: slopsquatting, phantom squatting, and hallusquatting.
The researchers published their findings on July 8, 2026, in a paper demonstrating that fake names generated by language models are predictable. They tested multiple prompts across various AI agents, including Cursor, Windsurf, GitHub Copilot, Cline, Gemini CLI, and OpenClaw, and found that the models hallucinated identical names up to 85% of the time for repository requests and 100% of the time for skill installs.
The attacks work by an attacker calculating URLs, software library names, or other output an LLM will produce and subsequently access. The attacker then sets a trap and waits for someone to give an automated process permission to fetch something malicious. Unlike traditional attacks that require stolen passwords or phishing emails, these attacks rely on the agent’s trust of unverified names.
The researchers built this attack specifically to demonstrate that it repeats at scale, which is why they treat their numbers as a floor rather than a ceiling: “Attacks always get better,” they write. “They never get worse.”
This vulnerability stems from two connected issues. First, language models generate their outputs based on probabilities, making them predictable enough to produce attack vectors. Second, developers build and run code that executes commands based on the generated output of these language models without sufficient human review.
The danger lies in the gap between text generation and code execution. What was safe and true may have changed since you last checked yesterday (or an hour ago). Developers are rushing to ship products faster, treating build infrastructure like disposable tooling while granting expansive permissions to download, change, and deploy things.
This flaw has been seen three times in six months: January 2026 (Slopsquatting), June 2026 (Phantom Squatting), and July 2026 (HalluSquatting). Every attack relies on the same core defect – the system trusts a name that a model generated without checking if anyone verified and validated it.
The risk extends beyond the top-level packages. An agent might select a real package with a real name, but modern security tools rarely inspect transitive dependencies three or four layers down the tree. Developers cannot inspect those dependencies simply by reading the top-level source code or saying “That looks correct” and hitting Enter.
The researchers note that their findings represent a minimum risk level. These attacks are predictable and scalable, making them a significant threat to AI agents and systems relying on them.
Source: Original article