feat: AVE-2026-00066 -- hallucinated skill-name squatting (HalluSquatting) - #113
Open
chaksaray wants to merge 2 commits into
Open
feat: AVE-2026-00066 -- hallucinated skill-name squatting (HalluSquatting)#113chaksaray wants to merge 2 commits into
chaksaray wants to merge 2 commits into
Conversation
…ting) Verified genuine gap during an eight-candidate audit sweep against the live corpus: keyword sweep clean, no existing record covers a model-generated (hallucinated) resource name as the entry vector -- distinct from AVE-2026-00001/00034, which both require an attacker-controlled instruction to trigger the fetch. Here the model's own hallucination is the entry point, no injected content anywhere in the chain. Sourced from two independently corroborating papers (arXiv 2607.07433, 2607.12340) plus independent security-press coverage naming affected platforms directly (Cursor, Windsurf, GitHub Copilot, Cline, Gemini CLI, OpenClaw) -- the strongest sourcing of the five candidates that cleared this audit, per the deliberate sequencing choice to draft this one first. AIVSS: non_determinism scored deliberately low (0.25), not high -- the source research's own finding is that the hallucination is unusually predictable/transferable, the opposite of high run-to-run variance. thm=0.90 (demonstrated PoC against real production tools, not yet a disclosed in-the-wild campaign). MEDIUM severity reflects AARF's narrower amplification profile, not an inflated attempt to force a higher band onto a real but single-vector mechanism. Full researcher-process.md workflow: fixtures, validate_records.py, pytest, dist regeneration, CHANGELOG, README (badge/stats/index) all updated in this commit.
…ssumed Both fields were left off the initial draft. Per new standing repo convention: always include mitre_atlas and nist_ai_rmf, empty array when nothing genuinely maps, but the field itself never omitted. mitre_atlas: AML.T0010 (AI Supply Chain Compromise) + AML.T0011.001 (Malicious Package), both confirmed against MITRE's own ATLAS data repository, not inferred from how other records in this corpus happen to use similar-looking IDs. nist_ai_rmf: GOVERN-6.1 (third-party entity risk policy), confirmed against NIST's own subcategory text. This also caught a real, separate issue worth flagging (not fixed here): the corpus's heavy, repeated reuse of a small handful of mitre_atlas IDs (AML.T0043, AML.T0048, AML.T0051, AML.T0054) across dozens of unrelated attack_class categories looks like the same pattern-matching-instead-of-verifying mistake caught on this record's owasp_asi field. AML.T0054 in particular was returned by one search as 'Indirect Prompt Injection' and by MITRE's own data repository as 'LLM Jailbreak' -- a real discrepancy, not yet resolved. Worth a dedicated audit pass across the existing corpus at some point; out of scope for this PR.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
AVE-2026-00066: hallucinated skill-name squatting, "HalluSquatting" (MEDIUM, AIVSS 6.2). First of five records drafted from the eight-candidate verification audit's genuine gaps -- drafted first per the deliberate sequencing choice: this candidate has the strongest sourcing (two independently corroborating papers plus independent security-press coverage), making it the least likely to need revisiting.
Why this is a genuine gap, not a duplicate
Confirmed during the audit: keyword sweep against the live corpus returned no match. The mechanism is distinct from AVE-2026-00001 (metamorphic payload fetch) and AVE-2026-00034 (dynamic third-party import) -- both of those require an attacker-controlled instruction embedded in a component to trigger the fetch. Here, no component and no injected instruction exist at all; the entry point is the model's own hallucinated belief that a resource exists, exploited by an attacker who precomputed and pre-registered the exact name the model is statistically likely to generate.
Sourcing
AIVSS notes
non_determinismscored deliberately low (0.25), not high: the source research's own finding is that the hallucination is unusually predictable and transferable, the opposite of high run-to-run variance -- that predictability is precisely what makes precomputing a fixed squatting list viable for an attacker.thm=0.90: demonstrated PoC against real production tools, not yet a disclosed in-the-wild campaign. MEDIUM severity reflects AARF's narrower amplification profile (single-agent, no persistent memory/identity manipulation required), not an inflated attempt to force a higher band onto a real but single-vector entry mechanism.Validation
python3 scripts/validate_records.py: all 66 records valid.python3 scripts/check_fixtures.py: all 66 records have positive + negative fixtures.pytest tests/ -x -q: 264 passed.node scripts/build-records.js: dist regenerated (66 records); frozen v1.1.0 snapshot untouched.researcher-process.mdStep 8 in full.Scope notes
No detection-rule PR in bawbel/scanner -- separate, coordinated PR in that repo's own tracker, not requested here. Four more records from the same audit sweep to follow, each its own PR per the one-record-per-PR discipline.