--- title: Slopsquatting, Phantom Domains, and HalluSquatting Are... description: Three attack variants — slopsquatting, phantom squatting, and HalluSquatting — all exploit the same flaw: AI coding agents trust hallucinated package,... canonical: https://daily.dev/posts/slopsquatting-phantom-domains-and-hallusquatting-are-the-same-ai-attack-h28tgivyd twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Slopsquatting, Phantom Domains, and HalluSquatting Are the Same AI Attack | daily.dev og:description: Three attack variants — slopsquatting, phantom squatting, and HalluSquatting — all exploit the same flaw: AI coding agents trust hallucinated package,... og:url: https://daily.dev/posts/slopsquatting-phantom-domains-and-hallusquatting-are-the-same-ai-attack-h28tgivyd og:image: https://api.daily.dev/og/posts/H28TGiVyd.png og:image:alt: Slopsquatting, Phantom Domains, and HalluSquatting Are the Same AI Attack og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Slopsquatting, Phantom Domains, and HalluSquatting Are the Same AI Attack **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 8 min read · 2 upvotes · 0 comments ## Summary Three attack variants — slopsquatting, phantom squatting, and HalluSquatting — all exploit the same flaw: AI coding agents trust hallucinated package, repository, or domain names without verification. Researchers from Tel Aviv University demonstrated that LLMs produce predictable hallucinated names (up to 100% consistency for skill installs), allowing attackers to pre-register those names with malicious payloads. The attack scales like a botnet without requiring stolen credentials or human interaction. Traditional scanners fail because they inspect uploads at fetch time, exactly when attackers optimize payloads to evade detection. The recommended fix is pre-fetch verification and routing dependency resolution through a pre-vetted, policy-governed catalog rather than public registries. The article is sponsored by ActiveState, which promotes its Curated Catalog as a solution. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is HalluSquatting and how does it differ from slopsquatting? HalluSquatting is an attack where researchers pre-compute the fake repository, package, or skill names that AI coding agents predictably hallucinate, register those names first, and load them with malicious instructions before a legitimate agent requests them. Unlike slopsquatting, which targets npm package names, HalluSquatting targets repositories and agent skills and executes payloads directly through the agent's own tool-use permissions. _Teams evaluating AI agent security risks can follow coverage of emerging attack patterns like this on daily.dev._ ### How often do AI coding agents hallucinate the same fake package or repo names? Researchers from Tel Aviv University, Technion, and Intuit tested prompts across Cursor, Windsurf, GitHub Copilot, Cline, Gemini CLI, and OpenClaw and found models hallucinated identical names up to 85% of the time for repository requests and 100% of the time for skill installs, meaning attackers can predict and pre-register these names before a real user's agent looks for them. _Developers weighing which AI coding agents to trust can track findings like these on daily.dev._ ### Can existing security scanners detect malicious AI-agent skill installs? Not reliably. Trail of Bits bypassed every public skill-store scanner they tested in under an hour because scanners inspect an unknown upload's stated content rather than its hidden payload, so a static post-hoc scan is racing an attacker who built the payload specifically to defeat that scan. _Engineers hardening CI/CD against supply-chain tricks can keep up with scanner limitations via daily.dev._ ## Similar posts on daily.dev - [‘HalluSquatting’ Compromises AI Coding Agents to Install Malware, Create Botnets](https://daily.dev/posts/hallusquatting-compromises-ai-coding-agents-to-install-malware-create-botnets-qkcjydbad) · DevOps.com · 2 upvotes · 1 comments - [Hackers can use 9 of the most popular AI tools to assemble massive botnets](https://daily.dev/posts/hackers-can-use-9-of-the-most-popular-ai-tools-to-assemble-massive-botnets-j8cybjfqg) · Ars Technica · 13 upvotes · 4 comments - ['Phantom Squatting': An Emerging AI-Driven Supply Chain Threat](https://daily.dev/posts/phantom-squatting-an-emerging-ai-driven-supply-chain-threat-8b1vv6jbi) · Dark Reading · 0 upvotes · 0 comments - [Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector](https://daily.dev/posts/phantom-squatting-ai-hallucinated-domains-as-a-software-supply-chain-vector-tfozy1c4i) · Unit 42 · 0 upvotes · 0 comments - [New Study Identifies 53 Slopsquatting Targets Across 5 Front...](https://daily.dev/posts/new-study-identifies-53-slopsquatting-targets-across-5-front--6t7a1jnzb) · Socket · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#llm](https://daily.dev/tags/llm), [#ai-agents](https://daily.dev/tags/ai-agents) [View this post on daily.dev](https://daily.dev/posts/slopsquatting-phantom-domains-and-hallusquatting-are-the-same-ai-attack-h28tgivyd) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Slopsquatting, Phantom Domains, and HalluSquatting Are the Same AI Attack","url":"https://daily.dev/posts/slopsquatting-phantom-domains-and-hallusquatting-are-the-same-ai-attack-h28tgivyd","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/slopsquatting-phantom-domains-and-hallusquatting-are-the-same-ai-attack-h28tgivyd"},"datePublished":"2026-07-24T14:03:44.726Z","dateModified":"2026-09-14T08:33:28.899Z","description":"Three attack variants — slopsquatting, phantom squatting, and HalluSquatting — all exploit the same flaw: AI coding agents trust hallucinated package,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7174d247cd3e0a87daf5b2e681b9c921?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7174d247cd3e0a87daf5b2e681b9c921?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/slopsquatting-phantom-domains-and-hallusquatting-are-the-same-ai-attack-h28tgivyd","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,llm,ai-agents","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Slopsquatting, Phantom Domains, and HalluSquatting Are the Same AI Attack"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/slopsquatting-phantom-domains-and-hallusquatting-are-the-same-ai-attack-h28tgivyd#faq","mainEntity":[{"@type":"Question","name":"What is HalluSquatting and how does it differ from slopsquatting?","acceptedAnswer":{"@type":"Answer","text":"HalluSquatting is an attack where researchers pre-compute the fake repository, package, or skill names that AI coding agents predictably hallucinate, register those names first, and load them with malicious instructions before a legitimate agent requests them. Unlike slopsquatting, which targets npm package names, HalluSquatting targets repositories and agent skills and executes payloads directly through the agent's own tool-use permissions. Teams evaluating AI agent security risks can follow coverage of emerging attack patterns like this on daily.dev."}},{"@type":"Question","name":"How often do AI coding agents hallucinate the same fake package or repo names?","acceptedAnswer":{"@type":"Answer","text":"Researchers from Tel Aviv University, Technion, and Intuit tested prompts across Cursor, Windsurf, GitHub Copilot, Cline, Gemini CLI, and OpenClaw and found models hallucinated identical names up to 85% of the time for repository requests and 100% of the time for skill installs, meaning attackers can predict and pre-register these names before a real user's agent looks for them. Developers weighing which AI coding agents to trust can track findings like these on daily.dev."}},{"@type":"Question","name":"Can existing security scanners detect malicious AI-agent skill installs?","acceptedAnswer":{"@type":"Answer","text":"Not reliably. Trail of Bits bypassed every public skill-store scanner they tested in under an hour because scanners inspect an unknown upload's stated content rather than its hidden payload, so a static post-hoc scan is racing an attacker who built the payload specifically to defeat that scan. Engineers hardening CI/CD against supply-chain tricks can keep up with scanner limitations via daily.dev."}}]} ```