GoKawiilThree attacks, three names, and one identical flaw: AI coding agents treat a hallucinated identifier as a verified command.
By Shane Warden, Principal Architect, ActiveState
Ask an AI coding agent to fetch a tool. Occasionally, it returns a name that sounds right, but does not exist. Developers used to ignore this mistake, assuming a compiler or test would stop it. Unfortunately, that assumption is dangerous and wrong.
Effectively now we’re giving root access to language models that sometimes guess words, and attackers know how to use that against us.
The attack goes like this: an attacker can calculate URLs, software library names, and other output an LLM will produce and subsequently access somehow. The attacker grabs the name, then sets a trap and waits.They do not need to steal passwords. They do not need to send phishing emails.
They do not need a human to click a link. They need someone, somewhere to give an automated process permission to fetch something malicious.
Researchers at Tel Aviv University, Technion, and Intuit published a paper on July 8, 2026. The team, led by Aya Spira in Ben Nassi's group, proved that these fake names are predictable.
They tested multiple prompts across Cursor, Windsurf, GitHub Copilot, Cline, Gemini CLI, and OpenClaw. Models hallucinated identical names up to 85% of the time for repository requests. They hallucinated identical names 100% of the time for skill installs.
"Slopsquatting exploited a fake package name. Phantom squatting exploited a fake domain. HalluSquatting exploits a fake repository or skill," Warden says. "In every case, the agent trusts a name nobody verified."
This Time, the Payoff Is a Botnet
... continue reading