AI coding agents vulnerable to late-binding dependency injection attacks

Security researchers have identified that 'slopsquatting,' 'phantom domains,' and 'hallusquatting' are variations of a single attack vector where AI agents are tricked into importing non-existent or malicious software packages. This vulnerability exploits the tendency of AI coding assistants to hallucinate dependencies, which are then registered by attackers to inject malicious code into development pipelines.