Ghost in the Web Store: Preempting LLM-Hallucinated Browser Extension Supply Chain Attacks

TL;DR

• The threat model changed because the browsing population changed. Two decades of web defenses were built for humans browsing the web. The question now is how to build a web that protects agents — which in turn protects the humans behind them.
• Supply-chain hallucination is not hypothetical: prior work shows LLMs hallucinate PyPI and npm package names, and his team recently published research on hallucinated domain names. Extensions are worse: excessive permissions, visibility into session tokens and cookies, and a front-row seat to your operating system if compromised.
• Three hallucination-prone zones: (1) recency — roughly 20,000 new extensions per month now, versus that many per year previously, and LLMs are poor at recency; (2) deletion — thousands are removed in the same period, but LLMs are snapshot learners with no concept of deletion; (3) brand-less extensions, which lack the signal that anchors a model.
• Findings: one set of hallucinated extensions turned out to be real but deleted, many of them flagged as malware; another set were unclaimed identifiers the LLM still confidently told users to install. Monitoring the highest-hallucination extensions, they saw about a dozen subsequently registered and used for malicious activity.
• Takeaway: hallucination is inherent to LLMs and will not go away — never blindly trust a browser or chatbot recommendation.

Key Points

From protecting human browsing to building a web that protects agents (~03:38–03:39)

He works in web security at Palo Alto Networks, and framed the shift plainly: the protections built over the years assumed humans were the ones browsing. With LLMs and agents proliferating, that's no longer true — so the team has been thinking about how to build a web that protects agents, which by extension protects humans.

This talk narrowed to hallucinations, specifically hallucinations about browser extensions, on the premise that the browser is the new operating system, which makes it an attack surface worth understanding precisely. He also noted a gap in the literature: existing hallucination research and benchmarks mostly measure hallucination in summarization, not in supply-chain security artifacts.

An aside about sunsets on Mars (~03:40–03:41)

His young daughter asked what color the sunset would be if she stood on Mars. Not wanting to disappoint her, he asked his favorite chatbot, which described a red sunset beautifully. She was delighted with the answer — which was wrong. Martian sunsets are blue.

The model generalized from Earth and leaned on the fact that the Martian sky is red. The actual physics runs the other way: red has the longer wavelength and scatters out, blue the shorter one — and the rover photos show blue sunsets. Ever since, he double-checks answers.

Why browser extensions (~03:42–03:43)

Hallucination in security is already documented — hallucinated PyPI and npm package names, and his own team's recent research on hallucinated domain names. Extensions raise the stakes because they hold excessive permissions, see your session tokens and cookies, and hand a compromise attacker a front-row seat to your operating system.

The attack itself is, in his word, deceptively simple: attackers don't need to break into your system, they just need to trick the AI into walking them through the front door.

Three hallucination-prone zones, and what they found (~03:43–03:44)

The problem arises from how LLMs work. He named three zones where they perform badly:

1. Recency. AI has driven an extension boom — roughly 20,000 new extensions per month, where previously that many appeared over a whole year. LLMs are bad at recency detection, so they hallucinate while trying to be helpful.
2. Deletion. Thousands of extensions are deleted over the same period, but LLMs are snapshot learners with no representation of deletion — they think the deleted ones still exist.
3. No brand. Not every extension has a brand, and the absence of that signal invites hallucination.

Two categories of finding:

• Extensions the LLM hallucinated that were real but deleted, many of them marked as malware in the store.
• Unclaimed extensions the LLM nonetheless confidently told users to install — directly exploitable by attackers.

His closing slide showed the set they keep monitoring and rescoring. After the study, about a dozen of these highly-hallucinated extensions were registered and used for malicious activity.

Conclusion (~03:44)

Don't blindly trust recommendations from your browser or chatbot. Always fact-check, because hallucination is inherent to LLMs and won't go away.

Quotes

"Attackers don't need to break into your system. They just need to trick the AI to get through your front door." (~03:42:47)

The whole threat model in one line: the supply-chain entry point moved from vulnerabilities to hallucinations.

"LLMs are snapshot learners. They don't have an understanding of deleted extensions. They think they are already still existing." (~03:43:30)

"Deleted" is a concept that doesn't exist inside a training snapshot — which is exactly where the ghosts come from.