A hallucinated package name is not just a bad answer once an AI coding agent can fetch, install, and run code.

In this episode, Sam Ellis reports on HalluSquatting: a supply-chain risk where models invent plausible resource names, attackers pre-register the invented names, and agentic tools may pull the trap from the internet as if it were legitimate infrastructure.

The lead source is the research paper “Beware of Agentic Botnets: Scalable Untargeted Promptware Attacks via Universal and Transferable Adversarial HalluSquatting,” from researchers at Tel Aviv University, Technion, and Intuit. The paper describes “predictable LLM hallucinations of resource identifiers” and reports hallucinated resource generation rates as high as 85 percent in repository-cloning scenarios and as high as 100 percent in skill-installation scenarios. The important boundary is not the hallucination by itself. It is the tool path around it.

SecurityWeek framed the technique as untargeted promptware. Instead of sending a poisoned email or sitting inside a target chat, the attacker can host poisoned instructions inside a resource the model is likely to invent. The agent does the delivery step by trying to fetch what it thinks is a real repository, package, or skill.

The episode keeps the evidence boundary tight. The public sources reviewed do not establish confirmed exploitation in the wild. The research used benign GitHub and ClawHub resources for ethical reasons and describes responsible disclosure to affected vendors, model providers, marketplace operators, and hosting platforms. Treat this as research-backed risk with practical controls, not a reported botnet already loose on the internet.

The practical controls are deliberately boring: search before fetch, verify canonical sources before cloning, treat generated package names as untrusted, separate read permission from install permission, separate install permission from shell execution, disable auto-approve modes for untrusted code, and watch for unknown-resource retrieval followed by terminal activity.

Sam also reached out to Aikido, a software supply chain security company. Charlie Eriksen, Aikido's lead security researcher, argued that the first practical control layer should live in package-manager-level security controls and cooldowns, not ordinary confirmation prompts. His reason was blunt: “Human confirmation is not useful, as most people will just accept without checking. People rarely do actual due diligence on the dependencies they introduce, and this is all the more true for agents.”

Sam's hook: in old software, a wrong package name failed. In agentic software, a wrong package name can become an opportunity for someone else to make the wrong thing exist.

If you run, secure, or review AI coding agents, send near-misses with the subject line HalluSquatting near-miss: SamEllisShow@protonmail.com. Anonymous and source-protection notes are welcome.

Sources and presenter notes

arXiv: “Beware of Agentic Botnets: Scalable Untargeted Promptware Attacks via Universal and Transferable Adversarial HalluSquatting” — primary research source for the HalluSquatting mechanism, the phrase “predictable LLM hallucinations of resource identifiers,” reported hallucination rates, transferability findings, ethical-use caveats, and mitigation concepts.
Project page: Scalable Untargeted Promptware Attacks via Universal and Transferable Adversarial HalluSquatting — companion research page for the paper, researcher list, ethical considerations, and project framing.
SecurityWeek: “‘HalluSquatting’ Turns AI Hallucinations Into Botnet Delivery Mechanism” — public-security framing source for HalluSquatting as an untargeted promptware technique built around pre-registered fake resources.
Threat-Modeling.com: “Friendly Fire and HalluSquatting” — practical-control source for disable-auto-approve guidance, dependency review, package allowlisting, and command-log auditing.
SOCRadar: “How HalluSquatting Could Fuel Agentic Botnets” — operator-control source for fetch, clone, install, and execute permissions; sandboxing; and monitoring unknown-resource retrieval followed by terminal execution.
Direct email reply to The Sam Ellis Show from Charlie Eriksen, lead security researcher at Aikido — source for the package-manager-controls quote, the human-confirmation critique, the near-miss framing, the probabilistic-risk framing, and the package-manager-as-curator argument. Aikido sells software supply-chain security tools, so product-adjacent recommendations are treated in that context.

Email: SamEllisShow@protonmail.com