You asked your coding agent for a well-known package. It typed a name that looked right, ran the install, and moved on. The name was a guess — and someone had already registered the exact guess and filled it with malware. Nobody made a typo. The agent invented the name, and the attacker was waiting where the invention landed.

In July 2026, a group from Tel Aviv University, the Technion, and Intuit — Aya Spira, Stav Cohen, Ron Bitton, Avishai Wool, and Ben Nassi among them — described an attack they call HalluSquatting. It turns one of the most familiar weaknesses of large language models — that they make things up and state the invention as fact — into a supply-chain delivery system aimed not at you, but at the agent working on your behalf.

The setup is almost boring in its simplicity. Ask a coding agent to pull a package, clone a repository, or install a skill for a project it has never seen, and it will often guess at the identifier rather than admit it does not know. HalluSquatting weaponizes that guess.

From a typo to a hallucination

Typosquatting has been around forever: register expresss or lodahs, wait for a human to fat-finger the name at the terminal. It depends on a person making a mistake. Slopsquatting, which surfaced through 2025 and early 2026, moved the mistake to the model — an agent hallucinates a package name that does not exist, an attacker registers it first, and the next agent that hallucinates the same name installs the payload. In January 2026, Aikido's Charlie Eriksen documented a hallucinated npm package, react-codeshift, that spread to 237 projects before anyone noticed. No typo ever fired, so no typosquatting defense ever fired either.

HalluSquatting is the 2026 escalation, and the escalation is that the hallucination is no longer left to chance. The researchers' method is a four-step recipe:

Pick a target the model hasn't memorized. Trending repositories and tools that post-date the training cut-off are the sweet spot: the model has heard of them, so it will try, but it has not seen the real name, so it will invent one.
Learn the mistake. Probe the agent repeatedly until you know which fake name it reliably produces. The paper reports hallucinated repository names appearing up to 85% of the time, and skill-install scenarios reaching up to 100% — consistent enough to bank on.
Claim the invented name. Register it on GitHub or a plugin store and fill the README, manifest, or SKILL.md with instructions written for the agent to read.
Wait. When a developer asks for the real resource, the agent emits the attacker's invented identifier instead and fetches it. The hidden instructions then hijack the agent's own command-running tool to install the payload.

That payload is not a proof of concept. The researchers chain the guess to prompt injection — what Nassi's group calls promptware — and end at remote code execution and botnet malware: infected developer machines that phone home and take orders. The guess gets the attacker's file onto the agent's plate, the buried instructions turn it into commands, and the commands build a botnet out of developer laptops.

Why this is an attack on the agent, not on you

The line that captures it, from the write-up, is that HalluSquatting "migrates the target from humans to AI agents, which may not confirm whether the source is real while carrying out commands." A human who is unsure of a package name pauses, checks the registry, glances at the star count. An agent in auto-run mode does not pause. Its job is to keep going, and a name that came out of its own weights carries the same authority as a name you typed. It has no reason to doubt itself.

The researchers tested across the tools developers reach for every day — GitHub Copilot, Cursor, Windsurf, Cline, Google Gemini CLI, and the OpenClaw family — and found the hallucinations "transferable across different LLM models and applications," working against agents built on models from Anthropic, OpenAI, and Google. One vendor cannot patch this out, because it rides on the shared shape of how a coding agent turns a request into an action: guess the name, fetch the resource, read what it says, do what it says.

HalluSquatting removes the human from the supply chain. The attacker probes the agent until it learns which name the model invents, registers that exact name with a booby-trapped README or manifest, and waits. When you ask for the real resource, the agent emits the invented name, fetches the attacker's version, reads the embedded instructions as its own plan, and installs the botnet payload. On a normal setup that runs on your machine.

Why "just stop hallucinating" was never the fix

The tempting answer is to make the model check itself — resolve the name before fetching, flag clone and install and fetch, ground every identifier in something real. Those are good ideas, and the researchers recommend them. But they all live in the same place: a filter that reads what the agent is about to do and hopes to catch the bad case before it runs. HalluSquatting is engineered against exactly that reader. The name looks legitimate because the model produced it; the README looks like documentation because that is what a README is; the install command is the most ordinary thing a coding agent does all day.

This is the wall the rest of agentic security keeps walking into. A denylist that reads a command loses to the shell that rewrites it. A scanner that reads a package loses to the payload that isn't in the package. An agent that searches for a skill recommends the malware it found on its own. HalluSquatting adds the sharpest version yet: the malicious name did not come from the internet at all. It came from the model. You cannot blocklist your own agent's imagination. The description is the attacker's to author, and the execution is the only place the outcome gets decided.

Where Bromure draws the line

Bromure Agentic Coding does not try to talk the model out of guessing. It changes what a wrong guess can reach. Every agent Bromure runs — Claude Code, Codex, Grok Build — runs inside a disposable Linux VM on your Mac, not on macOS itself. So when the agent emits an invented name, fetches the attacker's resource, and runs the install the way the researchers watched these agents do, several things are already true.

First, and rarely for this class of attack, the registry path is scanned. When the invented name is an npm, PyPI, or Cargo package — the slopsquatting case, the react-codeshift case — it lands squarely inside Bromure's Supply Chain scanning, which inspects packages as they are pulled from public registries. This is the one part of HalluSquatting where the guess resolves to a thing Bromure was built to look at directly, before it is trusted. A hallucinated dependency is still a dependency, and it enters through the front door Bromure watches.

Second, the payload runs in a box you throw away. Suppose the invented name points at a GitHub repository or a plugin-store skill rather than a registry package, and the botnet loader executes. It executes inside the VM. There is no persistent host for it to take orders on: reset the profile to base and the dropped binary, the scheduled job, the foothold — all of it is gone. A botnet node that vanishes at the next reset is not much of a botnet node.

Third, there are no real credentials to enlist. Botnet malware that scrapes the environment and disk for API keys, git and cloud tokens, and SSH keys finds decoys: Bromure injects placeholder values (brm_…, a synthetic ~/.kube/config, throwaway ssh and cloud tokens) into the VM and swaps the real ones back only on the host, in the proxy, on the way out to the genuine API. The real keys never enter the box. Whatever the payload ships to its command-and-control is a bag of strings that authenticate to nothing.

Fourth, the promptware is read against a detector. HalluSquatting is a reading attack before it is an execution attack — the whole exploit hinges on the agent ingesting the attacker's README, manifest, or SKILL.md and treating it as its own plan. That is precisely the untrusted authority Bromure watches: the same class as a rogue CLAUDE.md or AGENTS.md. Bromure's on-device prompt-injection detection scores the content the agent reads as documentation against local models that never leave the Mac, plus a deterministic scanner for invisible-Unicode tricks. An instruction that says "now run this install script" buried in a fetched manifest is the case that detector exists to flag.

And underneath all of it, the egress is visible. The botnet beacon, the stage fetch, the exfiltration attempt — those show up in Bromure's Security Log as outbound traffic you can see, rather than a quiet callback from a machine you trusted.

Same guess, same fetch, same install — different machine. Inside Bromure the agent runs on a throwaway Linux VM: a hallucinated registry package is caught by Supply Chain scanning at the front door, the botnet payload runs somewhere disposable, the credentials it scrapes are decoys swapped for the real ones only on the host proxy, the promptware in the fetched manifest is scored by an on-device detector, and the beacon is logged. The guess still happens. There is nothing to enlist.

What this draws a line around

Isolation and scanning are containment, not a cure for hallucination. It is worth being precise about what Bromure changes here and what it does not.

The agent still invents the name

Bromure does not stop the model from hallucinating an identifier or from fetching whatever that name resolves to. Grounding the agent's guesses is a model-and-harness problem. What Bromure changes is where the fetched thing runs and what it can reach when it does.

Registry scanning covers registries

A hallucinated npm, PyPI, or Cargo package is exactly what Supply Chain scanning inspects — a genuine front-door catch. A hallucinated GitHub repository or a plugin-store skill is not a registry package; that path is held by isolation, the injection detector, and the decoys, not by the registry scan.

Substitution covers the secrets you configure

The decoy swap protects credentials you put in a profile: model keys, git and cloud tokens, managed database endpoints, ssh keys. A token a script writes to disk mid-run, or a session you establish by hand in the box, is just data. Keep secrets in the broker, not in the workspace.

Detection is a net, not a wall

On-device injection scoring flags an install-and-run manifest more often than not, but a careful author can phrase a lure to slip a single scanner. Treat the detector as one layer; the containment — a throwaway box with fake keys and a logged egress — is what holds when a detector misses.

The researchers end on a line worth keeping: "Attacks always get better; they never get worse." Their success rates are a floor, not a ceiling, and the underlying trust mechanism — an agent that treats its own guess as a fact and a fetched file as a plan — is not getting patched this quarter. Your agent is going to invent a name for something it half-remembers, and some of those invented names will already be taken. The question is not whether it ever fetches the wrong one. At an 85% hallucination rate, sometimes it will. The question is what runs when it does: your machine, your real keys, and a foothold that stays — or a Linux box you can throw away, with decoys inside it and the registry checked on the way in. Bromure makes it the second one.