HalluSquatting: Researchers Show How AI Hallucinations Become a Gateway for Malware

A team of researchers from Tel Aviv University, Technion, and Intuit has described a new attack method targeting AI-based coding assistants, in which the entry point for malware is not a flaw in the code itself, but the tendency of language models to hallucinate nonexistent packages and repositories. The technique has been named HalluSquatting.

How the Attack Works

The mechanism is simple and requires no break-in to any system. Attackers first determine which package or repository names AI assistants regularly hallucinate when asked to fetch a popular or trending resource. They then register these fabricated names as real repositories or packages in public registries and plant malicious code inside them.

When a user instructs an AI assistant to clone a repository or install a so-called skill, the tool may reproduce the hallucination instead of the real resource, download the tampered package, and execute the commands it contains through its own built-in terminal. The victim usually has no idea anything went wrong until the malicious code starts running.

The Scale of the Vulnerability

What's most troubling isn't the mechanism itself but how consistently it repeats. In the researchers' tests, the same fabricated names appeared repeatedly across different underlying models, meaning the attack isn't tied to a single AI provider but transfers across tools built on different engines.

The success rates confirm the scale of the problem: for repository-cloning requests, the same incorrect name appeared in as many as 85 percent of cases, while for skill installations, assistants consistently picked the same fabricated name in 100 percent of tests, regardless of how the command was phrased.

Injection, Not Intrusion

The key technical detail is that the malicious instructions work through indirect prompt injection - they're embedded in content the assistant fetches from the web on its own, rather than in a command typed by the user. This bypasses typical security assumptions, since the hijacked instructions blend into what the model interprets as a legitimate request.

The researchers stress that since AI has access to a terminal and system privileges, malicious commands can be used to download additional malware or hacking tools, creating what they call agentic botnets - networks of compromised machines controlled not by classic code, but by the model's own susceptibility to suggestion.

Attacks only ever get better, never worse - the research team, describing HalluSquatting as a floor on what's possible, not a ceiling

Why This Is More Than Another Supply Chain Attack

Impersonating package names, previously known as typosquatting or slopsquatting, isn't new. What's new is that HalluSquatting doesn't require a user typo or a coding error - it's enough for the model to consistently hallucinate the same false name, letting the attacker know in advance exactly what to register. That shifts the attack's center of gravity from the human to the assistant's own architecture.

For developers and companies using Cursor, GitHub Copilot, Gemini CLI, or other coding agents, this means even a cautious developer who doesn't click suspicious links or copy code from third-party sites can fall victim simply by trusting their own AI assistant's suggestion.

The scale of the problem is growing alongside the popularity of coding agents - earlier research already cited shows that more than 91 percent of Polish developers now use AI when writing code, and it's precisely that growing trust in model suggestions that HalluSquatting exploits as a vulnerability.

What's Next

The researchers notified tool makers, model providers, and package registry operators before publishing their results, and deliberately omitted from the report the details needed to directly reproduce the attack. It remains undisclosed, however, whether and what specific fixes Cursor, GitHub, Google, or the creators of OpenClaw have already implemented.

For Polish companies and development teams, the practical takeaways are clear: verifying a package's origin before installing it, limiting the terminal privileges available to AI assistants, and treating model suggestions as proposals to check rather than ready-made commands to execute are becoming part of basic security hygiene when working with coding agents.