Security researchers have discovered that a new HalluSquatting attack can exploit popular artificial intelligence tools to build massive botnets. According to a report by Ars Technica, this method exploits the inherent tendency of large language models to hallucinate resource identifiers. Consequently, malicious actors can compromise numerous devices with minimal effort.
The research was conducted by Aya Spira, Elad Feldman, Avishai Wool, and Ben Nassi from Tel Aviv University, alongside Stav Cohen from Technion and Ron Bitton from Intuit. They found that coding assistants frequently access high-privilege command lines to run code from third-party resources. Therefore, predicting the identifiers that these models hallucinate allows attackers to register those names and seed them with malicious instructions.
What is the HalluSquatting attack?
This specific HalluSquatting attack targets the inability of large language models to accurately identify the location of a user-specified resource. When a developer instructs an assistant to clone a repository, the model hallucinates the correct location up to 85 percent of the time. Furthermore, when cloning a trending skill, these hallucinations occur 100 percent of the time.
Vulnerable AI Coding Assistants
The vulnerability affects nine popular AI coding assistants and agents. Specifically, the list of susceptible tools includes Cursor, Cursor CLI, Gemini CLI, Windsurf, GitHub Copilot, Cline, OpenClaw, ZeroClaw, and NanoClaw. These applications routinely pull code and other resources from repositories and registries during daily activities.
How the Exploitation Works
The underlying issue affects six major foundational models, including Gemini-2.5-flash, Gemini-2.5-pro, GPT-5.1, GPT-5.2, Sonnet-4.5, and Opus-4.5. Notably, these models correctly resolve older repositories published before 2019 with a low hallucination rate of 0.9 percent. However, the same models fabricate slugs for repositories published in 2025 at a rate of 92.4 percent.
Once attackers identify the predictable hallucinated names, they register them on platforms like GitHub. Subsequently, they upload a repository containing instructions to install a reverse shell on the user’s machine. Because the coding assistants have terminal access, they execute these commands automatically.
Security Implications for Developers
The researchers explained that this method allows attackers to infect many independent applications simultaneously. In their published paper, they stated:
“By exploiting integrated shells and terminals of agentic applications to run scripts and code, attackers can effectively ‘infect’ many independent agentic applications by embedding instructions to install reverse shells in the resources the attackers register.”
Aya Spira, Elad Feldman, Avishai Wool, Ben Nassi, Stav Cohen, and Ron Bitton
This vulnerability poses significant risks to the global cybersecurity sector. Specifically, attackers can use these compromised devices to launch large-scale distributed denial-of-service attacks or run cryptocurrency mining operations. As a result, organizations utilizing artificial intelligence tools for software development must implement stricter verification controls.
In the future, developers of AI engines will need to address these foundational flaws rather than relying on basic guardrails. Meanwhile, security teams must monitor the external resources retrieved by automated coding agents. This proactive approach is essential to prevent the execution of unauthorized code on local systems.
