Slopsquatting, Phantom Domains, and HalluSquatting Are the Same AI Attack

ActiveState summarizes research and incidents demonstrating "HalluSquatting": attackers pre-compute and register fake package, repository, or agent-skill names that AI coding agents hallucinate, then serve malicious payloads that automated agents will fetch and execute. The article explains this late-binding design flaw enables scalable, botnet-like compromise across any machine running an exposed agent, notes prior related incidents (slopsquatting, phantom squatting), highlights failures of scanners and TLS/DNSSEC to mitigate the threat, and recommends pre-fetch verification and use of a vetted, policy-governed component catalog.