HalluSquatting Lets Attackers Turn AI Coding Assistants Into Botnet Installers

Researchers disclosed HalluSquatting, a prompt-injection technique that abuses AI coding assistants' tendency to hallucinate package, repository, plugin, or registry names and then retrieve them automatically. By predicting the fake identifiers a model is likely to invent, attackers can register those names on services such as GitHub or plugin stores, seed them with malicious instructions or payloads, and induce the assistant to execute attacker-controlled code. The researchers reported highly repeatable hallucinations—reaching up to 85% for repository requests and 100% for some skill-install scenarios—and said the method can deliver reverse shells and other malware without relying on software exploits, worms, or stolen credentials.

The attack was reported to affect tools including Cursor, Cursor CLI, Gemini CLI, Windsurf, GitHub Copilot, Cline, OpenClaw, ZeroClaw, and NanoClaw, many of which can fetch third-party resources and run with elevated command-line privileges. Researchers from Tel Aviv University, Technion, and Intuit said they disclosed the issue to vendors while withholding full reproduction details, warning that the technique could enable large-scale device compromise, botnet assembly, and DDoS activity across mixed environments. Recommended defenses include forcing assistants to search and verify resources before fetching them, validating package and repository names, disabling unattended auto-run behavior, and having platforms reserve likely hallucinated identifiers.