Three attacks, three names, and one identical flaw: AI coding agents treat a hallucinated identifier as a verified command.
By Shane Warden, Principal Architect, ActiveState
Ask an AI coding agent to fetch a tool. Occasionally, it returns a name that sounds right, but does not exist. Developers used to ignore this mistake, assuming a compiler or test would stop it. Unfortunately, that assumption is dangerous and wrong.
Effectively now we’re giving root access to language models that sometimes guess words, and attackers know how to use that against us.
The attack goes like this: an attacker can calculate URLs, software library names, and other output an LLM will produce and subsequently access somehow. The attacker grabs the name, then sets a trap and waits.They do not need to steal passwords. They do not need to send phishing emails.
