AI Risk Wire

Cases › security breach › LR-2026-0617

HalluSquatting: hallucinated resource names lead AI coding assistants to install botnet malware (research demonstration)

Confirmed Why: 2 independent outlets · 2 independent reports

Status: advice only, no fix reported

Severity negligible
Reported 8 Jul 2026
Could do terminal

No source states: loss or records, developer and model, agent tool, deployer, industry.

Severity negligible: test: the sources describe only test runs with harmless placeholder payloads and state no effect beyond the test systems

Researchers from Tel Aviv University, Technion and Intuit studied AI coding assistants that can fetch outside resources and run commands. The team found that these assistants often invent resource names that do not exist, and that an attacker could register such a name and hide instructions inside it. When a user asked for a popular resource, the assistant could fetch the attacker's version instead and follow its hidden instructions, using its command-running tool. In tests the assistant ran attacker-supplied code on the machine, using harmless placeholder payloads. The hallucination rates reported reached up to 85 percent in repository cloning and 100 percent in some skill installs. The team says it notified affected vendors, model makers and marketplace operators before publishing, and withheld the exact steps.

What happened

1 · What it was doingAI coding assistants that can fetch an outside resource and run commands were studied.
2 · What it reached or didThe hijacked assistant used its own command-running tool to carry out the planted instructions.

What was done

Tests used harmless placeholder payloads, not real malware.
Advice in source, not a fix by the party

“The most effective fix is also the simplest: make the assistant search before it fetches.”

Grounding and fact checks

Risks

Made-up output relied on
Primary36 incidents
Hidden instructions hijack the agent
Also50 incidents
Rising: 6 vs 2.8 a week
Supply-chain compromise
Also24 incidents
Rising: 4 vs 0.2 a week

Read from the sources; not yet reviewed by a person.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Application

Grounding and fact checks · Human approval for high-impact actions · Output filtering and redaction · People told they are dealing with AI

Evidence

No source states: what went wrong, how it was caught, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause.

Show the full account: 1 items from the primary sources

What happened, in order

Not dated in the sources:

  • Researchers notified affected vendors and marketplace operators before going public.
Show every field, with its source and grade

The AI system

Tools it was given
terminal
C one secondary source states it
Stage of use
in research
C one secondary source states it

What happened

Earliest source we hold
2026-07-08
D inferred by us from the described behaviour, reason shown
What set it off
hidden instructions in its input
C one secondary source states it
What went wrong
security breach
C one secondary source states it
AI agent
an AI agent acted
C one secondary source states it
primary risk
RK14
D inferred by us from the described behaviour, reason shown
secondary risks
RK01, RK06
D inferred by us from the described behaviour, reason shown
remediations
kind: advice; controls added: I7; quote: The most effective fix is also the simplest: make the assistant search before it fetches.; source index: 0, kind: advice; controls added: G3; quote: No single switch closes this, so also verify that a repository or package name resolves to the real, expected source before an agent pulls it in, and treat any name an AI hands you as a guess, not a fact.; source index: 0
C one secondary source states it

Impact

Severity
negligible
D inferred by us from the described behaviour, reason shown
Kind of harm
no harm happened
C one secondary source states it
Why this severity
test: the sources describe only test runs with harmless placeholder payloads and state no effect beyond the test systems
D inferred by us from the described behaviour, reason shown

Notes on gaps

This is a research demonstration; no in-the-wild incident, victim, or real loss is stated. The date of occurrence and the dates of the tests are not stated. The B1 and I7 outcomes and the C1 failure are inferred from the text. Safety layers such as Claude Code auto mode and Gemini CLI Conseca are mentioned only in general terms and were not linked to this incident. Marketplace scanner examples in the sources belong to other incidents and were excluded.

LR-2026-0617 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON