Slopsquatting, Phantom Domains, and HalluSquatting Are the Same AI Attack

Late Binding: The Architectural Flaw at the Heart of HalluSquatting

The unifying insight in the article is that all three attacks — slopsquatting, phantom squatting, and hallusquatting — exploit the same design failure. AI coding agents take a hallucinated identifier and act on it as if a human had verified it. As Warden puts it, "in every case, the agent trusts a name nobody verified." The predictability comes from language models being probabilistic engines: given similar inputs, they will return outputs that converge around the same hallucinated strings. The Spira et al. paper from Tel Aviv University, Technion, and Intuit demonstrated this empirically, showing 85% reproducibility for repository requests and 100% for skill installs across Cursor, Windsurf, GitHub Copilot, Cline, Gemini CLI, and OpenClaw.

The parallel Warden draws to rainbow tables is illuminating. Just as an attacker can pre-compute password hashes without knowing the plaintext, an adversary can pre-compute the package names, domains, or repository handles an LLM will invent under specific prompts. The comparison reframes the problem: this is not a novel vulnerability class but a well-understood cryptographic failure mode — trusting output without checking provenance — now applied to a new layer of the stack. Late binding offers flexibility in software architecture; in security architecture, it hands attackers a deterministic-looking oracle for malicious payloads.

From One-Off Infections to Scale Without Compromise

The article's most consequential framing is the shift in scale. Earlier slopsquatting incidents, like Charlie Eriksen's discovery of a fake "react-codeshift" npm package spread across 237 projects, typically delivered malware to a single machine at a time. HalluSquatting changes the economics. Because the AI agent itself performs the fetch, install, and execution, attackers no longer need worms, stolen credentials, or phishing — they need only register the predictable name and wait. Any machine running an exposed agent becomes a candidate. Unit 42's discovery of 250,000 hallucinated domains at Palo Alto Networks in June 2026 showed just how large the attack surface already is, and Spira's research team provided the academic proof of the same trick applied to repositories and agent skills.

The researchers themselves treat their numbers as a floor, not a ceiling. "Attacks always get better," they note. "They never get worse." That framing matters because it positions HalluSquatting as an infrastructure-level risk rather than a bug to be patched. The agent becomes a delivery mechanism that turns the developer's own permissions — the same ones granted for legitimate package fetches — into the attacker's entry point.

The Transitive Blind Spot Compounds the Problem

Even when an agent selects a real, legitimate package, defenders face a deeper problem the article highlights. Modern scanners typically inspect the top-level package but rarely trace the transitive dependencies three or four layers down. A clean top-level check can mask a compromised sub-dependency, and rules written yesterday cannot protect against a package that was safe at install time but malicious now. The "Cordyceps" example cited in the article passed every check because no individual workflow file was wrong — the exploit lived in the composition. That compositional attack surface is exactly the kind of thing automated dependency checkers are least equipped to catch.

This is the part of the story most likely to age poorly for defenders. Defenses built on hash-locking, signature verification, and SBOM diffing all assume the unit of trust is a single artifact. HalluSquatting pushes the trust decision back to the model, and once an attacker controls a hallucinated name, they can shape the entire dependency tree that follows. Until agent runtimes are designed to verify identifiers before they are bound, every AI-assisted build pipeline is running an experiment in attacker math.