HalluSquatting Attack Lets Hackers Turn AI Coding Assistants Into Botnet Installers

A newly disclosed attack technique called “HalluSquatting” is raising serious concerns in the AI security landscape. This technique demonstrates how attackers can exploit large language model (LLM) hallucinations to covertly compromise systems and potentially create botnets on a large scale.

The research introduces “adversarial hallucination squatting,” a novel method that exploits AI models that generate incorrect or non-existent resource identifiers, such as repository names or software packages, during automated tasks performed by agentic AI applications, including coding assistants and command-line tools.

HalluSquatting Attack

Unlike traditional prompt injection attacks that rely on direct interactions, such as email or messaging, HalluSquatting operates without any direct access to the target system. Instead, attackers anticipate which fake resource names an LLM is likely to hallucinate.

By registering these resources in advance, such as malicious Git repositories or skill packages, they set a trap that AI systems might unknowingly access while fulfilling user requests. This transforms benign AI-driven actions, like cloning a repository or installing a tool, into potential vectors for remote code execution (RCE).

The study reveals that hallucination rates can reach up to 85% in repository cloning scenarios and even 100% in skill installation workflows. This highlights a systemic weakness across multiple LLM-driven platforms.

Google Sites researchers successfully demonstrated exploitation against widely used tools including GitHub Copilot, Cursor, Windsurf, Gemini CLI, and other autonomous AI agents.

In these scenarios, once a hallucinated resource is retrieved, embedded adversarial prompts can manipulate the AI’s execution flow, ultimately triggering unauthorized commands or installing malicious payloads on the host system.

The attack follows a structured chain that begins with reconnaissance, where attackers analyze trending repositories or tools and query LLMs to identify likely hallucinated outputs.

These predicted identifiers are then registered and weaponized with hidden instructions. When a user later prompts an AI assistant, such as to install or clone a resource, the LLM may generate the attacker-controlled identifier.

The agent retrieves the malicious resource, integrates it into its context, and executes embedded instructions, effectively turning the system into part of a botnet.

This approach is similar to typosquatting but operates at the level of AI cognition rather than through user input, making it significantly harder to detect. The transferability of hallucinated outputs across different models further amplifies the risk, enabling attackers to scale their campaigns across diverse platforms with minimal effort.

Researchers emphasized responsible disclosure, notifying affected vendors and redacting sensitive implementation details to prevent misuse.

They also implemented safeguards during experiments to limit unintended exploitation. While acknowledging the dual-use nature of their findings, the authors argue that exposing this class of vulnerability is critical for developing robust defenses.

Mitigation strategies include stricter validation of external resource identifiers, reducing autonomous execution privileges, and improving LLM grounding to minimize hallucinations. As the adoption of agentic AI accelerates, HalluSquatting highlights a critical need for security controls that address not just user inputs, but also the probabilistic behavior of AI systems themselves.

Interact with Cyber Threats in Windows, Linux, macOS VMs to Trigger Full Attack Chain - Analyse Malware & Phishing with ANY RUN