# 'HalluSquatting' Attack Weaponizes AI Hallucinations to Deploy Botnet Malware at Scale


A groundbreaking study from researchers at Tel Aviv University, Technion, and Intuit has uncovered a chilling new attack vector that transforms AI assistants' most frustrating flaw—their tendency to invent plausible-sounding resources that don't exist—into a scalable infection mechanism capable of compromising developer machines globally.


The technique, dubbed HalluSquatting, represents a fundamental departure from traditional prompt injection attacks. Rather than requiring attackers to embed malicious instructions into a specific channel the target will see, HalluSquatting operates untargeted at massive scale, exploiting the statistical likelihood that AI-powered coding tools will hallucinate the same nonexistent repository or package names repeatedly across different foundation models and users.


## The Threat: A New Class of Agentic Botnet


The attack works deceptively simply. An attacker identifies common package or repository names that popular AI assistants reliably hallucinate when users ask them to fetch resources. The researchers found hallucination rates as high as 85% for repository cloning and 100% for skill installations. The attacker then pre-registers these fake names across real platforms—registering a spoofed repository on GitHub, a malicious package on npm or PyPI, or a compromised skill repository.


When an unsuspecting developer later asks their AI coding assistant (Cursor, GitHub Copilot, Windsurf, Cline, Gemini CLI, or other tools) to clone a repository or install a skill, the AI doesn't consult a cached database of legitimate options. Instead, it hallucinates a plausible name—often the same one the attacker has already claimed. The assistant automatically pulls down the malicious package and executes arbitrary commands on the developer's machine via its integrated terminal access.


From there, the attack escalates rapidly. The injected commands can:

  • Deploy malware or ransomware
  • Exfiltrate source code, credentials, or API keys
  • Establish persistent backdoors
  • Pivot to internal networks
  • Establish command-and-control communications

    • The result is what researchers call an agentic botnet—a network of compromised machines that differs fundamentally from traditional botnets like Mirai or Emotet.


    ## Background and Context: Why This Changes Everything


    Traditional botnets rely on three components: discovery (finding vulnerable targets), exploitation (gaining initial access), and persistence (maintaining control). Each step requires the attacker to navigate firewalls, defeat security patches, or exploit specific vulnerabilities. The attack surface is constrained by the defender's security posture.


    HalluSquatting bypasses every layer of this model.


    AI-powered coding assistants have become ubiquitous in developer workflows. GitHub Copilot, Cursor, and similar tools integrate directly into IDEs and have native terminal access—a requirement for their core functionality of suggesting code completions and running diagnostics. Developers trust these tools implicitly because they're built by reputable vendors and run on authenticated systems.


    The attack exploits a cognitive blind spot. Developers expect their AI assistant to fail gracefully if asked to fetch a non-existent resource—to return an error or apologize and ask for clarification. What they don't expect is for the AI to *confidently invent a resource name and then automatically execute code from that invented location*. The assumption is that the AI "knows better" or will decline the request. In practice, models trained on internet-scale data see countless package names and repositories; when asked to fetch a popular package, they often generate a plausible hallucination rather than admitting uncertainty.


    The research team demonstrated that the same hallucinated names recur consistently across different foundation models—GPT, Claude, and others invent overlapping sets of package names when prompted the same way. This consistency is what makes the technique so dangerous: an attacker doesn't need to predict every possible hallucination; they only need to register the statistically most likely ones.


    ## Technical Details: How the Attack Unfolds


    The researchers conducted extensive testing across multiple AI coding platforms. Their methodology:


    1. Identify hallucination patterns: Prompt AI assistants repeatedly with requests like "clone the trending Python data processing library" or "install the latest web dev skill." Log what names the AI invents.


    2. Register squatted names: Create repositories and packages under those hallucinated names on legitimate platforms (GitHub, npm, PyPI). Plant malicious payload code.


    3. Wait for organic adoption: Users naturally ask their AI assistants to install tools, clone repos, and fetch resources. The AI hallucinates the attacker's squatted name and automatically executes the payload.


    The attack requires no credential compromise, no phishing, no watering-hole attacks. The infection vector is entirely embedded in the AI's behavior.


    A concrete example from the research:

  • User asks Cursor: *"Clone the latest trending repo for machine learning pipeline optimization"*
  • Cursor hallucinates: "ml-pipeline-v2" (doesn't actually exist)
  • Attacker has pre-registered this exact repository on GitHub with malicious workflow files
  • Cursor clones it and executes the attacker's code on the developer's machine
  • Malware establishes persistence and beacons to attacker infrastructure

    • The malicious instructions can be disguised in setup scripts, GitHub Actions workflows, build hooks, or package installation routines—places where developers expect code execution to happen naturally.


    ## Implications for Developers and Organizations


    This discovery reveals three critical vulnerabilities in the AI-assisted development ecosystem:


    For individual developers: Your AI coding assistant now represents a significant attack surface. The tool you rely on for productivity carries the same risk as running untrusted scripts from the internet—except the attack is probabilistic and untargeted, making it harder to detect.


    For enterprises: Organizations using AI coding tools across development teams have dramatically expanded their attack surface without traditional visibility or control. Unlike malware signed by a specific threat group, HalluSquatting attacks are statistically distributed and come through trusted vendor channels.


    For tool vendors: Copilot, Cursor, and similar platforms must fundamentally rethink how their assistants handle uncertainty. Hallucinating a resource name and then automatically executing code from it is a severe design flaw, but fixing it may require fundamental changes to how these tools operate.


    For open-source platforms: npm, PyPI, and GitHub now face resource squatting as a viable attack strategy. Defending against this requires detecting when a package is a likely hallucination target and either refusing registration or imposing stricter ownership verification.


    ## Recommendations: Defensive Actions


    For developers:

  • Review recent AI-assisted commands: Check git history and deployment logs for any packages or repositories installed via AI suggestions in the last 90 days
  • Audit AI tool permissions: Disable terminal access in AI assistants where possible; manually approve package installations rather than letting the AI execute them
  • Use isolated environments: Run AI suggestions in containerized or sandboxed environments before deploying to production
  • Verify package provenance: When an AI suggests installing a package, manually verify its official repository and maintainer before allowing execution

    • For organizations:

  • Implement sandbox policies: Restrict AI-assisted code execution to isolated development environments
  • Monitor for suspicious registrations: Watch for packages or repositories created just before AI tools attempt to clone them
  • Audit third-party package usage: Identify all packages installed via AI assistants and verify their legitimacy
  • Mandate code review: Require human review of all code generated or modified via AI tools before merge

    • For tool vendors:

  • Eliminate automatic execution on hallucinated names: When uncertain about a resource name, return an error or require explicit user confirmation rather than guessing
  • Implement verification checks: Cross-reference hallucinated package names against known registries before attempting installation
  • Add audit logging: Log all terminal commands AI assistants execute and make these logs easily accessible for security review

    • ---


    ## HackWire Analysis


    HalluSquatting represents a watershed moment in AI security—the first weaponization of a model's core behavior into a mass-scale infection vector. Unlike traditional exploits that target a specific CVE or weakness, this attack is statistically inevitable given how language models operate. Every AI coding assistant will hallucinate; the only variable is which hallucinations an attacker has already claimed.


    What makes this particularly dangerous is the opacity. A developer sees their trusted AI tool execute a repository clone—a normal operation—and has no warning that the repository was statistically likely to be fabricated. The attack is indistinguishable from legitimate functionality, which means defenders cannot simply "be more careful." The burden shifts entirely to vendors and tool maintainers to stop hallucinating and executing.


    The timing is critical. AI coding assistants are reaching saturation in developer workflows—GitHub Copilot reports millions of daily active users; Cursor and similar tools are growing exponentially. The larger the installed base of AI-assisted developers, the larger the addressable botnet population. Unlike traditional botnets that require heterogeneous vulnerability chains, an agentic botnet can compromise a consistent percentage of any population that uses an affected AI tool. Scale becomes automatic.


    For enterprises, this is a reminder that outsourcing code execution—even to vendors—carries infrastructure risk. The supply chain vulnerability here isn't in the AI vendor itself, but in the model behavior those vendors ship by design. Until this is architecturally fixed, organizations should treat AI-assisted development as a convenience that requires sandboxing, not as a trusted component of their development pipeline.


    The research team's responsible disclosure approach—notifying vendors before publication—suggests the fix is possible but non-trivial. Expect patches in Copilot, Cursor, and others within Q3 2026. Until then, assume your AI assistant will occasionally execute malicious code, and defend accordingly.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)