Somewhere this week, a researcher opened an HTML phishing attachment and found it stuffed with thousands of lines of nonsense HTML comments. Not obfuscation exactly, just padding. Junk. The kind of thing a lazy student adds to hit a word count. And it worked, because the AI-based filter scoring that email wasn’t reading it the way a human would. It was scoring statistical patterns, and enough junk text changes the pattern enough to slip past the model. That’s not a clever exploit. That’s a filter getting caught skimming its own homework.

It’s a small story on its own, buried in an ISC SANS diary entry. But put it next to two other stories from this week and a pattern shows up that’s bigger than any one phishing sample. Attackers have stopped trying to out-hack your defenses and started studying how your defenses actually think. That’s a meaningful shift for anyone doing cybersecurity work day to day, because it means the thing you trusted to catch the obvious stuff is now the thing being gamed on purpose.

Your Phishing Filter Skims, Just Like You Do

The “comment stuffing” technique the SANS diary describes is almost insultingly simple. Take a phishing HTML attachment, the kind that carries a fake login page or a credential-harvesting form, and bury the malicious payload inside a mountain of meaningless HTML comments. The visible content barely changes. What changes is the file’s entropy profile and its overall statistical shape, the exact features a lot of AI-assisted detection tools use to flag something as suspicious in the first place.

Here’s the uncomfortable part. Traditional signature-based filters would probably still catch a lot of this, because they’re looking at known bad strings and structures regardless of how much filler surrounds them. It’s the newer, fancier layer, the one marketed as smarter and more adaptive, that gets fooled by volume. That’s not an argument against AI-assisted threat detection. It’s an argument against relying on any single detection layer, no matter how modern it sounds, as your last line of defense.

AI Assistants Hallucinate. Attackers Take Notes.

Meanwhile, over in SecurityWeek, researchers demonstrated something with a name almost too on-the-nose to be real: HalluSquatting. AI coding assistants regularly hallucinate package names, library references, and URLs that sound completely plausible and don’t actually exist. This isn’t news to anyone who’s used one for more than a week. What’s new is that attackers are now systematically registering those hallucinated names ahead of time, seeding them with malicious code, and waiting for the assistant to recommend them again to the next developer.

The researchers took it further, chaining hallucination squatting into remote code execution and, from there, into a botnet delivery mechanism. Think about what that means operationally. The attacker doesn’t need to breach your network. They need to predict what your AI assistant is statistically likely to make up, and get there first. It’s typosquatting for a world where the typo is generated by a language model instead of a tired developer’s fingers.

This Is A Cybersecurity Problem, Not An AI Problem

It’s tempting to file both of these under “AI is broken, news at eleven.” Resist that. The actual lesson is older and more familiar to anyone who’s spent time on threat intelligence or incident response: predictable systems get predictably exploited. Comment stuffing works because a scoring model has a predictable blind spot. HalluSquatting works because a language model has predictable failure modes that repeat across users and sessions. Even the unrelated Ill Bloom story making the rounds this week, where a crypto wallet’s recovery phrase was generated with weak randomness and attackers reverse-engineered it to drain $3.1 million, fits the same shape. Weak randomness is just predictability with better branding.

None of these are zero-days in the traditional sense. Nobody found a buffer overflow. They found a pattern, a habit, a shortcut baked into how a system behaves, and they built tooling around exploiting that habit at scale. That’s a harder problem than patching a CVE, because you can’t patch a probability distribution. You have to change how the system is designed to fail.

What To Actually Do About It This Week

None of this means throw out your AI-assisted filtering or ban coding assistants outright. It means stop treating any single detection layer, AI-based or otherwise, as sufficient on its own. Defense in depth isn’t a slogan, it’s the actual answer here.

• Keep signature and heuristic-based email filtering running alongside AI-based scoring, not instead of it. The two catch different things, and comment stuffing is a good reminder why redundancy matters.
• Pin dependencies explicitly and verify package names against known registries before a developer or an AI assistant installs anything new. Don’t let “the assistant suggested it” become an implicit approval step.
• Sandbox AI coding tools and log the commands and package installs they trigger, so a hallucinated dependency shows up in review before it runs in production.
• Treat weak entropy, whether in a wallet seed, a session token, or a password generator, as a hardening priority, not a theoretical risk. Ill Bloom is what happens when nobody audits the randomness.
• Layer brute-force protection and threat detection at the network edge so that even if a phishing email or a squatted package gets through, lateral movement and credential stuffing attempts get caught fast. Tools like IPBan Pro exist specifically to automate that blocking layer so it’s not sitting on a human’s to-do list.

Incident response planning should assume some of this gets through. It will. The goal isn’t a perfect filter, it’s a shorter gap between something slipping past your first layer and someone noticing on your second or third. Security hardening was never about building one wall. It’s about making sure the attacker has to guess right more than once.

Sources

• “Comment stuffing” in an HTML phishing attachment as a mechanism for evading AI-based detection?
• ‘HalluSquatting’ Turns AI Hallucinations Into Botnet Delivery Mechanism
• Attackers Exploit ‘Ill Bloom’ Vulnerability to Drain $3.1 Million From Cryptocurrency Wallets