A groundbreaking security research study has revealed a new class of cyberattack that exploits artificial intelligence coding assistants to potentially build massive botnets and launch unprecedented large-scale attacks. The technique, dubbed "HalluSquatting," represents a significant escalation in AI security threats by weaponizing the fundamental inability of language models to acknowledge uncertainty.

Researchers from Tel Aviv University, Technion, and Intuit have demonstrated that nine widely-used AI development tools are vulnerable to this attack method. The affected platforms include Cursor, Cursor CLI, Gemini CLI, Windsurf, GitHub Copilot, Cline, OpenClaw, ZeroClaw, and NanoClaw - representing a substantial portion of the AI-powered development ecosystem.

The attack exploits a core weakness in how large language models handle resource identification. When developers instruct AI coding assistants to access repositories or specialized "skills" (instruction sets that enhance AI capabilities), these systems frequently generate incorrect locations rather than admitting they don't know the answer. This hallucination behavior occurs at rates of up to 85% for popular repositories and reaches 100% for trending resources not included in training data.

What makes HalluSquatting particularly dangerous is its scalability. Unlike traditional prompt injection attacks that require targeting individual victims, this method allows cybercriminals to compromise multiple systems simultaneously through a "pull-based" approach. Attackers can predict the fake repository names that AI tools are likely to generate, register those names, and embed malicious code within them.

The research team tested six major language models including Gemini-2.5-flash, Gemini-2.5-pro, GPT-5.1, GPT-5.2, Sonnet-4.5, and Opus-4.5, finding that all exhibit predictable hallucination patterns. These models often create self-referential repository structures like "repo-name/repo-name" when unable to locate actual resources. The predictability of these patterns eliminates the need for complex model probing, making the attack accessible to a broader range of cybercriminals.

Timing plays a crucial role in the vulnerability. The models demonstrate remarkable accuracy with older repositories, correctly resolving those published before 2019 with only 0.9% error rates. However, their performance degrades dramatically with newer resources, showing 92.4% hallucination rates for repositories published in 2025. This temporal bias creates a window of opportunity for attackers targeting trending or recently released development resources.

The attack methodology involves several steps. First, attackers identify resource names likely to be hallucinated by AI systems. They then search for registrable variations of these names and upload repositories or skills that mimic legitimate resources. The malicious code can be embedded directly or hidden within readme files as instructions for the AI assistant to execute. Since these tools typically operate with elevated system privileges necessary for code execution, successful attacks can grant complete system control.

The potential consequences extend far beyond individual system compromises. Researchers warn that HalluSquatting could enable large-scale ransomware campaigns, cryptocurrency mining operations, and distributed denial-of-service attacks using networks of compromised machines. The passive nature of the attack means cybercriminals can establish malicious repositories and wait for victims to unknowingly access them, creating a persistent threat landscape.

Security professionals are recognizing the significance of this research. Industry experts note that the vulnerability reflects broader challenges with AI agent autonomy and the need to design systems that assume deception is inevitable. The attack highlights fundamental tensions between the convenience promised by AI automation and the security risks introduced by that same automation.

The research draws parallels to typosquatting attacks, where malicious actors register domain names or package identifiers similar to legitimate ones. A notable 2016 incident involved a student uploading 214 malicious packages to major repositories, resulting in over 45,000 executions across 17,000 domains. HalluSquatting represents an evolution of this concept, leveraging AI behavior patterns rather than human typing errors.

This vulnerability raises important questions about the reliability of AI-powered development tools and the balance between productivity gains and security risks. While these assistants promise to streamline development workflows, the need for constant verification of AI-generated suggestions may diminish their practical benefits. The research suggests that organizations must implement robust oversight mechanisms and security protocols when deploying AI coding assistants in production environments.

The findings underscore the importance of continued research into AI security vulnerabilities as these tools become increasingly integrated into software development processes. As the AI industry continues to emphasize the convenience and efficiency of automated coding assistants, security researchers are providing crucial reminders about the inherent risks that accompany these technological advances.

Related Links:

• College student schools govs and mils on perils of arbitrary code execution
• Malicious packages sneaked into npm repository stole Discord tokens
• 725 Bitcoin-stealing apps snuck into Ruby repository
• Malicious PyPI packages caught stealing developer data and injecting code
• Counterfeit PyPI packages with 5,000 downloads installed cryptominers
• Agent Skills
• Research Paper