TL;DR: HalluSquatting is not only an AI hallucination problem. It is a software supply-chain problem because AI coding agents can now make the first dependency trust decision before a developer searches a registry, opens a package page, or reviews a dependency. In the old flow, humans searched, chose, and installed packages; supply-chain controls inspected what followed. In the agentic flow, a model can infer a dependency, invent a plausible resource name, fetch it, install it, and keep working. The first trust decision has moved upstream into runtime reasoning, so verification has to move upstream too.
Developers already trust package managers. Increasingly, they also trust AI-generated package recommendations from coding agents and assistant-driven development tools. That changes the first trust decision in the software supply chain. The question is no longer only what package entered the lockfile? It is also why did the agent decide this external resource should be trusted in the first place?
In the traditional model, a developer searched for a dependency, evaluated a package, chose it, and installed it. Security controls inspected the result: lockfiles, signatures, SBOMs, vulnerability scans, CI policy, and code review. Those controls were never perfect, but they shared a useful assumption. The package had already been selected through a visible engineering decision.
AI coding agents weaken that assumption. A developer may ask for a feature, not a package. The agent may infer that a dependency is needed, generate an install command, fetch a repository, install a skill, or run a toolchain as part of a longer workflow. In autonomous or semi-autonomous workflows, the developer may only notice the dependency after it has entered the workspace.
The supply chain no longer begins when a package is installed. For AI coding agents, it begins when the agent decides that an external resource should be trusted.
What is HalluSquatting?
HalluSquatting, also called adversarial hallucination squatting, describes a pattern where attackers identify resource names that LLMs are likely to invent, register those names, and host adversarial content there. The recent HalluSquatting research from Tel Aviv University, Technion, and Intuit studies how predictable hallucinated identifiers can be used against agentic applications that retrieve repositories, skills, packages, and other resources from the internet.
The attack is broader than packages. It can apply to repositories, skills, and other external resources that agentic systems may fetch. But for engineering teams, the package-dependency framing is especially important: AI-generated dependencies are becoming part of the software supply chain.
In a HalluSquatting-style failure, the dangerous choice happens before the install command. The agent has already decided that the hallucinated identifier is the right resource. The registry resolves the name the agent supplied. The package manager installs what it was asked to install. Malware or adversarial instructions arrive through a reasoning error that became a runtime action.
Why this is not just typosquatting with AI branding
HalluSquatting is related to typosquatting, dependency confusion, slopsquatting, and malicious package campaigns, but it is not the same engineering problem. Typosquatting exploits human typing or recognition errors. Dependency confusion exploits resolution behavior across public and private registries. Traditional malicious packages exploit trust in maintainers, metadata, popularity, or ecosystem scale.
HalluSquatting exploits AI-mediated selection. The attacker is not betting that a human will mistype a known package name. The attacker is betting that an AI assistant will confidently invent a plausible package, repository, or skill name and then treat that invention as a real dependency. Earlier package-hallucination research already showed that nonexistent package names can recur, which makes them useful to attackers who register the names later.
That is why the first trust decision has moved. AI can create new dependency identifiers before the ecosystem has assigned trust to them. Once those identifiers are registered, a model's plausible suggestion can become a real supply-chain edge.
Why existing supply-chain controls miss the first decision
Most supply-chain controls begin after a package has entered the dependency graph. Signing can verify who signed an artifact. SBOMs can record what entered a build. Scanners can flag known vulnerabilities, suspicious metadata, or policy violations. Lockfiles can make a build reproducible. Code review can catch a strange dependency if the reviewer understands why it appeared.
All of these controls remain necessary. They also share a timing problem. HalluSquatting happens at the moment the agent turns a vague programming need into a specific external resource. That moment is not usually represented in supply-chain tooling. There may be no durable record of the prompt, the agent's dependency-selection path, the candidate packages considered, the registry lookup, or the confidence basis for the recommendation.
The failure is not simply that a bad package got installed. The failure is that dependency selection became an unobserved runtime decision.
The Dependency Selection Boundary
Dependency selection deserves its own security boundary because it is the point where generated reasoning becomes external trust. Before that moment, the agent is producing code, plans, and suggestions. After that moment, it may be bringing another maintainer, registry, install script, update channel, and transitive dependency graph into the project.
The Dependency Selection Boundary is the moment an AI agent proposes, fetches, clones, installs, or adds an external software resource. It should be treated differently from ordinary code generation. Suggesting a helper function and suggesting a dependency are not equivalent. A dependency turns a local implementation choice into a supply-chain relationship.
At this boundary, the runtime should establish a few facts before installation: whether the package exists in the intended registry, whether it is the canonical package for the task, whether the organization already approves it, whether the agent found it through documentation or generated a plausible name, and whether the package is new, obscure, abandoned, or unusually privileged.
How teams should move verification upstream
Defending against HalluSquatting does not require treating every AI recommendation as malicious. It requires changing where verification happens. Agents should verify package existence and provenance before suggesting installation. A model-generated name should not be enough.
New external dependencies should trigger workflow-level review. The approval prompt should say more than "run npm install" or "run pip install." It should explain that the agent is introducing a new external package, whether the package is already approved, which registry lookup validated it, and why the package is needed for the current task.
CI should distinguish between known dependencies and AI-introduced dependencies. A package added by an agent should carry metadata: which task introduced it, which model or tool suggested it, which registry lookup validated it, which policy allowed it, and which human approved it if review was required.
Package installation should be treated as a runtime operation with security consequences. For coding agents, pip install, npm install, go get, cargo add, skill installation, repository cloning, and MCP server installation are not routine helper actions. They are supply-chain boundary crossings.
Where Gensee Crate fits
Gensee Crate focuses on runtime safety for AI coding agents. HalluSquatting fits the same pattern as other agent risks: the weak point is not only model output, but the workflow moment where generated reasoning becomes system action. A runtime enforcement layer should identify when an agent crosses the Dependency Selection Boundary and require validation before external code enters the project.
Crate is designed to connect the human request, agent behavior, tool calls, file operations, shell commands, network activity, skills, memory, and long-horizon workflow history. In this case, that means preserving evidence around the dependency decision: what the user asked, why the agent selected the resource, whether a registry lookup occurred, what package manager command was proposed, and whether policy approved the external dependency before installation.
The practical rule is simple: an AI agent should not be allowed to invent a trust relationship.
Frequently asked questions
What is HalluSquatting?
HalluSquatting, or adversarial hallucination squatting, is an attack pattern where adversaries identify resource names that AI systems are likely to hallucinate, register those names, and host adversarial content that agentic applications may retrieve.
Why is HalluSquatting a software supply chain problem?
It moves the first trust decision upstream. An AI agent may invent or choose an external dependency before a developer searches a registry or reviews a package page, so the supply-chain decision begins inside agent reasoning.
How is HalluSquatting different from typosquatting?
Typosquatting exploits human typing or recognition errors. HalluSquatting exploits AI-mediated selection: the model generates a plausible package, repository, or skill identifier and the agent retrieves the attacker-controlled resource.
What is the Dependency Selection Boundary?
The Dependency Selection Boundary is the moment an AI agent proposes, fetches, clones, installs, or adds an external software resource. It should be treated as a supply-chain security decision rather than a routine helper step.
How should teams defend against HalluSquatting?
Teams should require registry lookups before fetch or install, validate canonical package pages and maintainer metadata, use approved registries or allowlists, attach provenance to AI-introduced dependencies, and enforce runtime review before external code enters the project.
Sources
This post references the HalluSquatting research project, SecurityWeek's coverage of HalluSquatting, USENIX ;login:'s summary of package hallucination research, and the OWASP Secure Coding with AI Cheat Sheet.