
HalluSquatting Makes AI Coding Agents a Supply-Chain Problem
A July 2026 paper shows how hallucinated repository and skill names can become promptware delivery paths. The practical fix is boring: search before fetch, verify names, and sandbox every install.












