New research highlights that ‘slopsquatting,’ ‘phantom squatting,’ and ‘HalluSquatting’ are variations of the same attack pattern exploiting AI coding agents. These attacks occur when AI agents hallucinate and trust non-existent or malicious package, repository, or domain names during code generation. This ‘late-binding’ vulnerability allows malicious code to be introduced into the development pipeline if not mitigated by pre-fetch verification and governed dependency management.