HalluSquatting attack exploits AI hallucinations to build botnets by tricking coding assistants

HalluSquatting Emerges as Scalable AI Security Threat

A team of researchers from Tel Aviv University, Technion, and Intuit has uncovered a critical AI security threat called HalluSquatting that exploits AI hallucinations to trick AI agents into executing malicious code 1

1

. Short for adversarial hallucination squatting, this AI-driven security threat represents a fundamental shift in how attackers can compromise systems at scale. The attack works by predicting which fake resource identifiers large language models are most likely to hallucinate, then registering those names and seeding them with instructions to install reverse shells or other malware . Unlike traditional push-based prompt injection attacks that must target each victim individually, HalluSquatting enables pull-based attacks where AI coding assistants actively seek out adversarial prompts planted on websites and repositories, making it possible to assemble AI-enabled botnets without targeting specific users 1

1

.

Nine Popular AI Coding Assistants Vulnerable to Attack

The research demonstrates that nine widely-used AI coding assistants are susceptible to HalluSquatting, including Cursor, Cursor CLI, Gemini CLI, Windsurf, GitHub Copilot, Cline, OpenClaw, ZeroClaw, and NanoClaw 1

1

. Testing revealed alarming hallucination rates: when developers instruct coding agents to clone popular new repositories, large language models hallucinate the correct location up to 85% of the time, while trending skills see hallucination rates reaching 100% 1

1

. At the application level, success rates for exploiting this cybersecurity threat ranged from 20-35% for Cursor, Gemini CLI, and GitHub Copilot, but increased dramatically to 80-100% on OpenClaw and its variants 2

2

. The mean hallucination rate for GitHub repositories published in 2025 reached 92.4%, compared to just 0.9% for repositories from 2019 or earlier 2

2

.

How Attackers Exploit AI Hallucinations at Scale

The attack mechanism builds on the inherent inability of AI agents to accurately identify resource locations, particularly for trending tools not included in their training data 1

1

. When met with unfamiliar terms, AI coding assistants will not acknowledge uncertainty and instead hallucinate a plausible answer using predictable patterns like owner/repository or toolname/toolname GitHub URLs 2

2

. Attackers identify recent applications or repositories, predict the hallucinated names AI agents will generate, then create malicious repositories using those names. When users instruct their AI agents to fetch these resources, the agents hallucinate the repository name and retrieve the malicious version, executing whatever code it contains 2

2

. This differs from traditional typosquatting because it exploits the hallucination mechanism itself rather than human typing errors 2

2

.

Massive Botnets and Supply-Chain Attacks Now Possible

Once attackers trick AI agents into running their code, they can create reverse shells that give remote command-line access to user machines, enabling data theft, password extraction, malware installation, or cryptocurrency mining 2

2

. The researchers warn that just one HalluSquatted piece of software has the potential to compromise tens of thousands of AI agents rapidly, as the exploit mechanism is universal and transferable across different models 2

2

. This enables large-scale ransomware campaigns and botnets for distributed denial-of-service attacks, objectives not previously achievable with prompt injection techniques 1

1

. Palo Alto Networks' Unit 42 analyzed 2.1 million URLs generated by large language models across 913 global brands, discovering more than 13,000 confirmed malicious URLs and approximately 250,000 hallucinated domains still unregistered and available for attackers 5

5

. Public forecasts now estimate machine-learning-driven cyberattacks will exceed 28 million in 2025, with 35% of botnet operations using ML to evade detection 5

5

.

Mitigation Strategies and Industry Response

The most effective mitigation requires instructing AI agents to always run web searches before installing software and providing them with additional context, though this is not the default workflow for most users 2

2

. The research team from Tel Aviv University notified affected vendors, model makers, and marketplace operators before publication and withheld specific attack reproduction steps 3

3

. Cybersecurity professionals have long advocated against blindly trusting AI agent actions and severely restricting access levels granted to these systems, yet many AI agents still operate with wide-ranging permissions over users' machines, API keys, and service accounts 2

2

. Users should verify generated domains, packages, and any links before execution, as the payload arrives as text that AI agents read rather than network exploits that firewalls monitor 3

3

. This represents a new category of supply-chain attacks where phishing pages and credential theft can occur through AI-generated resources 5

5

.