How your AI coding assistant can quietly install a virus

Ask an AI coding assistant which library to install for a task it hasn't seen before, and there's a real chance it will confidently name a package that doesn't exist. That's not a rare glitch. It's a documented attack surface — and in 2026 it evolved from a lab curiosity into a technique capable of assembling botnets out of developer machines, with no stolen password and no traditional exploit involved.

Part 1: why installing someone else's package is always an act of trust

Modern software isn't written from scratch. It's assembled from other people's building blocks — packages, libraries, modules. Need an HTTP request? Pull in requests. Need a server? Pull in express. Writing that yourself in 2026 just doesn't make sense.

Those blocks live on open registries — PyPI for Python, npm for JavaScript. Anyone can publish there. Anyone can install someone else's package with a single command.

That's where the risk nobody talks about out loud sits: an installed package runs with the same privileges as your program. It can read files, reach the network, exfiltrate environment variables. And because packages have their own dependencies, which pull in more dependencies, installing one package means implicitly trusting the code of a thousand strangers you'll never meet.

The classic attack on that trust is typosquatting: registering a package name close to a popular one (matplotltib instead of matplotlib), betting on a developer's typo. It works, and it still works. But it has a ceiling — it needs a human to make the mistake.

The next step removed that ceiling. Now the one making the mistake can be the model.

Part 2: slopsquatting — when the AI invents the name for you

When a language model isn't sure of an exact package name, instead of saying "I don't know," it tends to generate something plausible-sounding. That's a hallucination. To a developer skimming generated code, it's indistinguishable from a real package name.

The attack mechanics are simple:

1. An attacker runs hundreds of similar prompts through a model and records which nonexistent names it produces.
2. Some names repeat systematically — models follow internal naming patterns, not randomness.
3. The attacker registers those names on PyPI or npm, where registration is free and content review is close to nonexistent.
4. Malicious code goes inside, sometimes wrapped in a working function as cover.
5. Then it's a waiting game: sooner or later, the model recommends that same name to a real developer.

How widespread is it. The foundational study behind this, from a team at the University of Texas at San Antonio (Spracklen et al.), presented at USENIX Security 2025 — one of the most rigorous security conferences there is — tested 16 popular models across 576,000 generated code samples. The result: on average, 5.2% of commercial-model responses and 21.7% of open-source-model responses referenced a nonexistent package — over 205,000 unique hallucinated names in total [1].

A follow-up 2026 study replicating that methodology on newer models (Claude Sonnet 4.6, GPT-5.4-mini, Gemini 2.5 Pro, and others) found the spread between models had narrowed considerably (4.6–6.1%) — but also found 127 names that every tested model invents identically, some of which were still available to register at publication time [2]. The range shrank. The threat didn't.

The precedent that predates the trend. In early 2024, researcher Bar Lanyado (Lasso Security) noticed models repeatedly recommending huggingface-cli for installation — when the real install command is pip install -U "huggingface_hub[cli]". He registered the nonexistent name as an empty, harmless package just to measure the scale. Within three months it had over 30,000 authentic downloads, and the install instruction had made its way into the official README of one of Alibaba's public repositories [3]. The package was harmless only because a researcher got there first. Next time, the same slot could belong to anyone.

Part 3: HalluSquatting — when it's the agent installing it, not you

The scheme above still has a bottleneck: it needs a human to copy the AI's suggestion and manually run it. In 2026, that bottleneck disappeared. Autonomous coding agents (Cursor, Windsurf, GitHub Copilot, Cline, Gemini CLI, and others) now open a terminal and run commands themselves.

Researchers from Tel Aviv University, Technion, and Intuit (the same group behind an earlier self-spreading AI email worm and a calendar-invite attack that hijacked Gemini) described a technique in July 2026 they call HalluSquatting — adversarial exploitation of an agent's tendency to hallucinate [4][5].

Here's how it works:

1. An attacker picks a trending repository or plugin — something agents are frequently asked to clone or install.
2. They repeatedly prompt different models to fetch that resource and record the nonexistent name that comes up most often — which turns out to be strikingly consistent across models from different vendors.
3. That name gets registered, and instead of just malware, it's loaded with a prompt injection — a hidden instruction the agent will read as part of the task it thinks it's doing.
4. A real user asks their agent to fetch the popular resource. The agent hallucinates the same wrong name, pulls the attacker's version instead of the real one, reads the embedded instruction — and executes it through its own built-in terminal. No confirmation. No awareness from the user.

According to the research, in peak-rate scenarios agents got the name wrong up to 85% of the time when cloning a repository, and up to 100% of the time when installing what are called "skills" [4].

The authors explicitly frame this as a new kind of botnet: a traditional botnet needs weak passwords or a network exploit, and it usually herds one type of device (Mirai herded cameras and routers). This needs neither — the payload arrives as text the agent itself interprets as a command, so a standard firewall never sees it. Any machine running a vulnerable agent can be infected, regardless of operating system [4].

The idea is already spreading beyond packages: Palo Alto Networks' Unit 42 described a similar effect for web domains — "phantom squatting" — estimating roughly 250,000 hallucinated-but-unregistered domains sitting there for the taking [4]. And in June 2026, Trail of Bits showed that the marketplaces meant to screen "skills" for malicious content let a test payload slip past several scanners in under an hour [4].

The researchers deliberately withheld the exact list of hallucinated names to avoid handing attackers a ready-made playbook — but they were direct about the timeline: the technique already works. It's a question of when it's first seen in the wild, not if.

What to actually do about it

1. Never install a package an AI recommends without checking it. Look up the publish date and download count on PyPI or npm. A package published yesterday with five downloads is a red flag.
2. Don't let agents run commands without confirmation. Modes like "skip permissions" or "yolo mode" are exactly what turns a harmless hallucination into executed code on your machine.
3. Audit your dependency file (requirements.txt, package.json) for unfamiliar, previously-unseen names — that's the typical entry point.
4. Where possible, require the agent to look a resource up through the registry's actual API first, rather than relying on its own memory — this sharply cuts the odds of substitution.

---

Sources

[1] Spracklen et al., We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs, USENIX Security Symposium 2025.
[2] The Range Shrinks, the Threat Remains: Re-evaluating LLM Package Hallucinations on the 2026 Frontier-Model Cohort, arXiv:2605.17062.
[3] Bar Lanyado / Lasso Security research on the hallucinated huggingface-cli package, 2024; covered by The Register and InfoWorld.
[4] Spira, Cohen, Feldman, Bitton, Wool, Nassi, Beware of Agentic Botnets: Scalable Untargeted Promptware Attacks via Universal and Transferable Adversarial HalluSquatting, arXiv:2607.07433 (July 2026).
[5] The Hacker News, New HalluSquatting Attack Could Trick AI Coding Assistants Into Installing Botnet Malware, July 8, 2026.