Predictable Agent Hallucinations Enable Autonomous Botnets

New research published by BleepingComputer details a unified class of AI supply chain vulnerabilities categorized as late-binding attacks. A July 2026 paper from a joint team at Tel Aviv University, Technion, and Intuit coined the term HalluSquatting to describe how AI models predictably hallucinate non-existent software assets. By pre-registering these predictable names, attackers can deploy malicious code directly to developers’ environments.

Predictable Hallucinations Enable Botnets

The research team, led by Aya Spira in Ben Nassi’s group, tested popular AI developer tools including Cursor, Windsurf, GitHub Copilot, Cline, Gemini CLI, and OpenClaw. They found that these systems generate identical, non-existent repository names up to 85% of the time. When generating code to install agent skills, the models produced identical hallucinated skill names 100% of the time.

Because the model generates the target and automatically attempts to fetch it, the attack requires zero human intervention. The AI agent acts as the primary delivery mechanism, effectively functioning as an autonomous node in a botnet if it pulls from an attacker-controlled repository.

The Three Phases of Late-Binding Attacks

Security experts recognize HalluSquatting as the most severe iteration of an established pattern. Shane Warden, Principal Architect at ActiveState, groups these exploits under the late-binding umbrella, where execution systems blindly trust string outputs from a model. The industry has tracked this progression across three distinct asset classes in 2026.

Attack Vector	Discovery Date	Targeted Asset	Documented Scale
Slopsquatting	January 2026	Software packages	237 projects targeted via fake react-codeshift
Phantom Squatting	June 2026	Web domains	250,000 hallucinated domains identified by Unit 42
HalluSquatting	July 2026	Repositories and skills	100% predictability in skill generation

Exploiting Plausible Naming Conventions

Models invent names that align with established ecosystem conventions. A hallucinated npm package named unused-imports, generated by models attempting to reference the real eslint-plugin-unused-imports, recorded approximately 233 weekly downloads even while under a security hold. Attackers exploit this behavior by continuously parsing common prompts against local models to harvest and register plausible hallucinated outputs.

The vulnerability lies in the execution pipeline. Most AI coding assistants fetch dependencies immediately after generating the command, lacking an intermediate validation step to verify the asset against known registries before execution.

If you deploy autonomous agents in continuous integration pipelines, implement governed dependency management with strict pre-fetch verification. Restrict your agents to an explicit allow-list of verified repositories, blocking the execution of arbitrary network requests generated by the model.