Researchers Show How Predictable Names Can Trick AI Coding Agents
Summary
A study found AI coding agents often invent consistent repository and skill names, which attackers could register and use to deliver malicious content. The article recommends verifying dependencies before agents fetch or execute them.
Key points
- Researchers from Tel Aviv University, Technion, and Intuit tested prompts across several coding agents and reported identical hallucinated names up to 85% of the time for repository requests and 100% for skill installs.
- The article describes HalluSquatting as registering predictable fake repositories or skills before an agent looks for them, potentially exposing automated workflows to malicious content.
- The article connects HalluSquatting with slopsquatting, which targets fake package names, and phantom squatting, which targets fake domains.
- The article says Trail of Bits bypassed agent skill-store scanners in less than an hour; scanners may miss hidden payloads, according to the account.
- Recommended defenses include enabling pre-fetch verification and resolving dependencies through a governed catalog of pre-vetted components instead of allowing agents to fetch directly from public registries.
Article Details
- Topic
- Hallucinated names in AI coding agents can be pre-registered with malicious packages, repositories, domains, or skills, enabling automated supply-chain attacks.
People
Aya SpiraLed the research team that demonstrated how predictable names hallucinated by AI coding agents could be claimed and used to deliver malicious content.Ben NassiLed the research group in which Aya Spira's team conducted research on attacks exploiting predictable names generated by AI coding agents.Charlie EriksenCaught AI agents attempting to install the fake npm package react-codeshift across 237 projects and registered the package name to prevent attackers from taking it.
Vendors
Products
ClineThey tested multiple prompts across Cursor, Windsurf, GitHub Copilot, Cline, Gemini CLI, and OpenClaw.Curated CatalogOrganizations must resolve open source dependencies through something like ActiveState's Curated Catalog, a private, policy-governed repository of vetted components.CursorThey tested multiple prompts across Cursor, Windsurf, GitHub Copilot, Cline, Gemini CLI, and OpenClaw.Gemini CLIThey tested multiple prompts across Cursor, Windsurf, GitHub Copilot, Cline, Gemini CLI, and OpenClaw.GitHub CopilotThey tested multiple prompts across Cursor, Windsurf, GitHub Copilot, Cline, Gemini CLI, and OpenClaw.OpenClawThey tested multiple prompts across Cursor, Windsurf, GitHub Copilot, Cline, Gemini CLI, and OpenClaw.WindsurfThey tested multiple prompts across Cursor, Windsurf, GitHub Copilot, Cline, Gemini CLI, and OpenClaw.