HalluSquatting Attack Tricks AI Coding Assistants Into Fetching Botnet Malware

Researchers at Tel Aviv University have unveiled a novel supply chain technique called HalluSquatting that weaponizes the tendency of AI coding assistants to hallucinate the names of non-existent software packages. Detailed by Aya Spira and colleagues in Ben Nassi's group, the attack combines two AI failure modes—hallucination and indirect prompt injection—to hijack developer tools and silently execute attacker-supplied code on a victim's machine, opening a path to botnet-scale compromise.

The attack is straightforward in concept. An adversary identifies a trending repository or plugin that developers are actively asking their AI assistant to fetch. Because the resource is too new to appear in the model's training data, the assistant begins inventing plausible-sounding package names—and it does so predictably. Across multiple phrasings and competing models, the researchers observed the same fabricated name surfacing in up to 85% of repository requests and 100% of skill-install queries. The attacker registers that name on GitHub or a plugin marketplace, embeds adversarial instructions inside the project, and waits. When a real user prompts Cursor, Windsurf, GitHub Copilot, Cline, Google's Gemini CLI, or an OpenClaw assistant to grab the popular resource, the assistant pulls the booby-trapped version instead and uses its own terminal tool to run the hidden commands. Defenders investigating a suspicious registration can run a WHOIS lookup to trace who claimed the lookalike package before it was weaponized.

What makes HalluSquatting especially dangerous is its reach. A single planted dependency, suggested confidently by an AI to thousands of developers, can cascade across countless machines without any user clicking a malicious link or running an unfamiliar binary. The poisoned instructions are not standalone malware; they exploit the fact that coding assistants ship with built-in shell execution, so once the prompt is hijacked, installing a bot, exfiltrating credentials, or pivoting through the host becomes a native assistant action. Test payloads in the study were harmless placeholders, but the researchers stress a real payload would follow the identical execution path—turning a coding autocomplete into an initial access vector.

The findings put fresh pressure on the AI development ecosystem to rethink how assistants validate external resources, treat hallucinated names, and gate command execution behind human approval. Developers relying on these tools should treat AI-suggested package names with the same suspicion as a sketchy download link, verifying repositories manually before installation. Teams auditing their exposure to AI-driven supply chain risk can use a SSL/TLS checker to confirm the integrity of endpoints their assistants fetch from, and run a broader privacy checkup to identify which automated agents currently have network and shell access in their development environment.