HalluSquatting Attack Exploits AI Coding Assistants to Deliver Botnet Malware

Researchers from Tel Aviv University, Technion, and Intuit have identified a novel attack vector called HalluSquatting that exploits AI coding assistants’ tendency to hallucinate non-existent resource names. The attack involves three steps: identifying a popular repository or plugin that the AI frequently invents fake names for, registering those hallucinated names on platforms like GitHub or plugin stores, and embedding malicious instructions within the fake resource. When a user asks their AI assistant to fetch the legitimate resource, the assistant retrieves the attacker’s version instead, which contains hidden prompt injection commands. These commands hijack the assistant’s built-in terminal tools to execute arbitrary code, potentially installing botnet malware. The researchers tested the attack against Cursor, Windsurf, GitHub Copilot, Cline, Google Gemini CLI, and OpenClaw assistants, achieving consistent hallucination rates of up to 85% for repository requests and 100% for skill installs. The attack bypasses traditional security measures like firewalls because the payload is delivered as text rather than a network exploit. Mitigations include requiring assistants to perform real lookups before fetching resources, avoiding auto-run modes, and platforms pre-registering likely hallucinated names. The research was led by Aya Spira and Ben Nassi, with findings disclosed to affected vendors before publication.