AI Coding Agents Face Hallucination Risks

When developers rely on AI coding agents to fetch tools or libraries, they often assume the underlying infrastructure includes inherent safeguards against invalid requests. New research indicates that this trust is misplaced, as these models frequently generate names for packages, domains, and repositories that do not exist but can be weaponized by attackers.

Predictable Failures in Generative Models

A research team from Tel Aviv University, Technion, and Intuit released findings on July 8, 2026, demonstrating that AI hallucination is not random. By testing prompts across various platforms, including GitHub Copilot, Cursor, Windsurf, Cline, Gemini CLI, and OpenClaw, the researchers proved that these models generate identical, nonexistent identifiers with high frequency. Attackers can calculate these predicted names, register them in advance, and populate them with malicious code before an agent attempts to retrieve them.

The Core Defect of Automated Trust

The vulnerability exists because agents are often granted root access or broad permissions to fetch and execute external data without prior verification. While terms like Slopsquatting, phantom squatting, and HalluSquatting have been used to describe these incidents, they all stem from a single architectural failure: the system executes instructions based on an unverified, model-generated string.

Slopsquatting exploited a fake package name. Phantom squatting exploited a fake domain. HalluSquatting exploits a fake repository or skill. In every case, the agent trusts a name nobody verified.

— Shane Warden, Principal Architect, ActiveState

Documented Security Incidents

• January 2026: Charlie Eriksen at Aikido Security identified AI agents attempting to install a fake npm package named react-codeshift across 237 projects.
• June 2026: Unit 42 at Palo Alto Networks discovered 250,000 domains that language models consistently hallucinate.
• June 2026: Trail of Bits bypassed agent skill store scanners in less than an hour.
• July 2026: Researchers confirmed AI models hallucinated identical names for repository requests up to 85% of the time and 100% of the time for skill installs.

Implications for Software Pipelines

This pattern suggests that traditional security measures, such as SSL certificates or standard DNSSEC, are insufficient because they only validate the identity of a domain, not the intent or safety of the content retrieved. As development teams prioritize speed, they may be treating build infrastructure as disposable, despite granting these tools broad authority to change and deploy code. The reliance on late binding—fetching resources at runtime—means that a dependency or package that was secure yesterday could be compromised by an attacker who has successfully predicted an agent's next move. For organizations, this underscores the necessity of implementing governed, pre-vetted catalogs that prevent agents from accessing unverified components entirely, rather than attempting to scan for threats after the fetch request has already been initiated.