HalluSquatting: AI Coding Agents Tricked Into Fetching Malware

A new attack built on made-up names

AI coding assistants regularly invent things. Ask one to clone a trending repository or install a popular skill, and it may confidently produce a plausible name for a resource that doesn't exist. A team of academic and industry researchers has now shown how to weaponize that habit. Their technique, called HalluSquatting, works by predicting which fake names a model is likely to invent, registering those names first, and waiting for an assistant to fetch the trap on a user's behalf. 1

The work comes from Aya Spira, Elad Feldman, Avishai Wool and Ben Nassi of Tel Aviv University, Stav Cohen of the Technion, and Ron Bitton of Intuit. 3 They formally describe the method as "adversarial hallucination squatting." An attacker identifies trending resources, maps the distribution of hallucinated variants an LLM produces for those names, and pre-registers the variants to host adversarial prompts. 3

How the chain works

The attack combines two known weaknesses. The first is hallucination, where a model presents fabricated information as real. The second is prompt injection, specifically the indirect kind. The malicious instructions arrive inside content the assistant retrieves, not in anything the user types. 1 Once the agent pulls the attacker-controlled repository or skill and follows the embedded instructions, the path ends with attacker-supplied code running on the victim's machine. 1

The reported numbers explain why this is more than a curiosity. Hallucinations were highly repeatable, reaching up to 85% for repository requests and 100% in some skill-install scenarios. 2 The researchers say the technique delivered reverse shells and other malware without needing software exploits, worms or stolen credentials. 2

One commentator described it as prompt injection flipped around. Instead of pushing malicious input at a model, the attacker waits for the model to pull it in. 4 No phishing, social engineering or specific target is required. 4

Nine tools, one shared weakness

The affected list covers much of the current agent ecosystem: Cursor, Cursor CLI, Gemini CLI, Windsurf, GitHub Copilot, Cline, OpenClaw, ZeroClaw and NanoClaw. 2 The researchers describe these as LLM applications with integrated terminals among their tools. 3 Many can fetch third-party resources and run commands with elevated command-line privileges. 2 By one framing, the people at risk are anyone whose assistant can retrieve an outside resource and then execute commands with little human review. 1

This is where the botnet framing comes in. Because the targeted names derive from popular resources, a single planted name can hit many machines at once. That is why the researchers present the technique as a way to assemble an "agentic botnet" through untargeted, scalable attacks. 13

Not entirely new, but bigger

The underlying problem has precedent. LLMs suggesting nonexistent packages in pip install and npm install commands has been documented for a couple of years, a pattern often called slopsquatting. 4 What HalluSquatting adds is scale and autonomy. Earlier concerns assumed a human would copy a bad suggestion into a terminal. Here, an agent with shell access handles the whole sequence, from hallucinating the name to fetching it to executing the payload. 4 The scope also goes beyond package registries to GitHub repositories, plugin stores and agent skill marketplaces. 2

The disclosure also lands during a broader push toward autonomous agents. Industry roundups from the same week paired HalluSquatting with launches such as OpenAI's ChatGPT Work and new agent-building features in Google's open-source Genkit framework. 5 Those same roundups noted that traditional security tools struggle to detect prompt injection, model poisoning and AI supply-chain attacks. 5 Some vendors are responding with runtime governance layers for long-running agents. 5

What it means

The accounts largely agree on the mechanics and the affected tools. They differ mainly in emphasis. The academic paper stresses transferability and universality across models. 3 The trade coverage stresses the practical result: malware installed through tools developers already trust. 12

The most important lesson, in my reading, is structural rather than model-specific. Hallucination rates may fall as models improve, but the real exposure is the combination of three things: agents that resolve names on their own, open registries where anyone can claim a name, and execution with minimal oversight. That combination makes any residual hallucination exploitable.

For teams adopting agentic coding tools, the practical takeaways follow from the attack chain itself:

• Treat fetched content as untrusted input.
• Require confirmation before cloning unfamiliar repositories or installing skills.
• Limit agents' shell privileges.

Registries and marketplaces may also need to watch for names that closely shadow trending projects. The fix probably can't come from better models alone. It will need guardrails on what agents are allowed to do with whatever they find.