HalluSquatting turns AI hallucinations into a delivery path

What this is about

On July 8, 2026, researchers from Tel Aviv University, Technion and Intuit published a paper on HalluSquatting. The idea is uncomfortable because it is simple: when an AI agent invents the wrong GitHub path or skill name for a known resource, an attacker can register exactly that invented name in advance.

This is not a normal hallucination where only an answer is wrong. For agents with terminal access, repository access or skill installation, an invented name can become a real action. The agent may then fetch not just bad information, but someone else's code.

What HalluSquatting actually does

HalluSquatting exploits the gap between natural language and exact resources. A person may write: "Clone the new project X." The agent has to turn that into a precise slug such as owner/repository. If the model guesses the owner incorrectly, it creates a non-existent but plausible path.

The researchers describe how attackers can systematically measure these likely invented paths. They can then register matching repositories or skills and place content there that tries to push the agent into a dangerous action. The paper describes scenarios involving tool invocation and remote code execution. In repository scenarios, hallucinations occurred at rates up to 85 percent according to the paper; in some skill-installation setups, they reached up to 100 percent.

Why it matters

The point is not that every AI tool is now automatically compromised. The point is that agents have a different attack surface from classic software. A normal package manager does not verify every name perfectly, but it usually works with fixed package sources and known commands. An agent translates imprecise language into actions.

SecurityWeek, SC Media and Tom's Hardware covered the research on July 9 and July 10, 2026 because it shows a practical weakness in coding assistants, CLI agents and personal assistants. It matters most for teams running agents with write access, terminal access or automatic installation. In that setting, a wrong resource name no longer causes only confusion; it can turn into a supply-chain incident.

In plain language

Imagine asking someone to pick up a parcel from a shop, but you only roughly remember the name. The person guesses the pickup number. If a fraudster has already placed a parcel under exactly that wrong number, the person comes back with the wrong parcel. In HalluSquatting, the parcel shop is GitHub or a skill marketplace, and the wrong parcel may contain instructions the agent executes.

A practical example

A development team tests a coding agent on 20 tasks per day. One task says: "Set up the new monitoring repository for Project Atlas." The agent does not immediately find the official link and produces a plausible GitHub path. If that path belongs to an attacker, the agent may read a README, start a setup script or suggest a command.

Even if only 2 of 20 tasks involve external resources and only one is resolved incorrectly, the risk is serious once the agent is allowed to run commands without review. The practical countermeasure is simple but inconvenient: agents should not install newly guessed repositories, skills or packages unless the source, owner and signature have been checked.

Scope and limits

• The paper is research from July 8, 2026, not a public incident count. It demonstrates feasibility and measurements in test setups, not the number of real victims.
• The risk is much higher for agents with terminal, file or installation permissions. Tool-less chatbots are less exposed.
• Web search alone does not solve the problem. It can help, but search results can also be ambiguous. The stronger controls are allowlists, human approval, signed artifacts and restricted execution rights.

SEO & GEO keywords

HalluSquatting, AI security, agentic botnets, promptware, GitHub repository squatting, coding agents, AI supply chain, prompt injection, remote code execution, Tel Aviv University, Technion, Intuit