Slopsquatting, Phantom Domains, and HalluSquatting Are the Same AI Attack
Three AI attack names, Slopsquatting, Phantom Domains, and HalluSquatting, exploit the same hallucinated identifier
Slopsquatting, Phantom Domains, and HalluSquatting are identified as the same attack pattern where AI coding agents trust hallucinated package, repository, or domain names. Researchers have demonstrated that these fake names are predictable, allowing attackers to register them and inject malicious code into development pipelines without traditional exploits. This late-binding attack relies on AI models generating probable, yet unverified, identifiers, posing a significant risk to software supply chains.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Cursor?
Get an email when a new story names Cursor, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAI coding assistants frequently hallucinate plausible-sounding but non-existent package names, repository paths, and domain names — and attackers can predict and pre-register these fake identifiers to inject malicious code. Because developers often trust AI-generated recommendations without independent verification, a single hallucinated dependency can silently compromise an entire development pipeline. This 'late-binding' attack requires no traditional exploit; the vulnerability is the unconditional trust placed in AI output. As AI-assisted development becomes ubiquitous, the attack surface for supply chain poisoning expands dramatically, affecting any organization that integrates AI coding agents into their workflows.
What helps against this
How we list vendors- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
- AI application security
Prompt injection, data leaks through AI tools and unapproved AI use get caught.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Cordyceps