Toro4BTC on Nostr: AI coding assistants just became a documented supply chain attack surface. ...
AI coding assistants just became a documented supply chain attack surface. Researchers call it HalluSquatting, short for adversarial hallucination squatting.
When a developer asks an agent to install a package or pull a repo, the model can invent a plausible sounding but nonexistent name. Those names are predictable. An attacker registers the predicted name first, stuffs it with malware. When the agent later hallucinates that exact name and downloads it, the developer pulls malicious code without realising. First prompt injection class that scales into a full botnet.
9 popular AI coding assistants are affected. Trending repos hit 85% hallucination rate. Trending skills hit 100%. The forerunner slopsquatting was already documented January 2026 by Aikido Security with a fake npm package react codeshift appearing in real AI written code.
Hallucination rates of 85% to 100% on trending content are way above what average developers assume. Most do not verify package metadata. Threat model is not theoretical. What is the next supply chain layer AI agents should not be trusted to verify?
Published at
2026-07-10 01:31:48 UTCEvent JSON
{
"id": "ac1afe39e2d729a1c17c7b7e1be344556bc63a2c49cfe8a649b2aa578f8b1cac",
"pubkey": "b984a34eafc305b1b82eb3746b5300d807e8c3876da9e623e1926fac639cfc7b",
"created_at": 1783647108,
"kind": 1,
"tags": [
[
"imeta",
"url https://blossom.primal.net/8809efb4bd3d0ab1f96c6c674662a10e7c2fb1e4501b9a9765743202c5194097.png",
"m png",
"dim 1280.0x720.0"
],
[
"client",
"Primal iOS"
]
],
"content": "AI coding assistants just became a documented supply chain attack surface. Researchers call it HalluSquatting, short for adversarial hallucination squatting.\n\nWhen a developer asks an agent to install a package or pull a repo, the model can invent a plausible sounding but nonexistent name. Those names are predictable. An attacker registers the predicted name first, stuffs it with malware. When the agent later hallucinates that exact name and downloads it, the developer pulls malicious code without realising. First prompt injection class that scales into a full botnet.\n\n9 popular AI coding assistants are affected. Trending repos hit 85% hallucination rate. Trending skills hit 100%. The forerunner slopsquatting was already documented January 2026 by Aikido Security with a fake npm package react codeshift appearing in real AI written code.\n\nHallucination rates of 85% to 100% on trending content are way above what average developers assume. Most do not verify package metadata. Threat model is not theoretical. What is the next supply chain layer AI agents should not be trusted to verify?\nhttps://blossom.primal.net/8809efb4bd3d0ab1f96c6c674662a10e7c2fb1e4501b9a9765743202c5194097.png",
"sig": "765b86c9e5f1fdacdd4665d59b4c3dcab9a54ece7eb2622b1eea3dbd03b217760ae9d00c14f654f5b6d03a5c411cc299e8c3033638fdd58642d9a1375e1acd04"
}
