HalluSquatting: How AI Coding Assistants Could Be Turned Into Botnet Recruitment Tools
Prompt injection has been the dominant AI security headache almost since these tools went mainstream. The core problem is structural: LLMs genuinely cannot tell the difference between instructions coming from a trusted user and instructions sneaked in through an email, a document, or any other third-party content the model happens to be processing. Guardrails exist, but they treat the symptom rather than cure the disease.
Most prompt injection attacks so far have been what researchers call 'push' attacks. The attacker injects malicious instructions into something specific, like an email or calendar invite, and sends it to individual targets. Effective enough for targeted mischief, but the scaling problem is obvious. You can only poison so many wells one at a time.
Pull-based attacks, where an LLM actively fetches malicious content hosted on a website, have theoretically existed but never scaled either. Without a reliable way to drag large numbers of AI agents to your trap, the attack surface stays small.
That changes with HalluSquatting.
Researchers from Tel Aviv University, Technion, and Intuit have published a technique that combines two well-known weaknesses into something considerably nastier. The result is a pull-based attack capable of assembling botnets, staging DDoS campaigns, and installing reverse shells across thousands of machines, with minimal effort from the attacker.
The targets are AI coding assistants and agents: Cursor, Cursor CLI, Gemini CLI, Windsurf, GitHub Copilot, Cline, OpenClaw, ZeroClaw, and NanoClaw. All confirmed vulnerable.
The concept is straightforward, which makes it worse. LLMs hallucinate. Everyone knows this. What the researchers noticed is that when you ask a coding agent to clone a trending repository or install a trending skill, the model will confidently navigate to the wrong location a startling proportion of the time. For trending repositories, hallucination rates hit 85%. For trending skills, things like specialised scripts or domain-specific instruction sets, the rate reaches 100%. The models simply do not know where these things actually live, because they were published after the training cutoff.
Crucially, the wrong locations LLMs invent are not random. They follow predictable patterns. All six major models tested, including GPT-4.1, GPT-4.2, Gemini-2.5-flash, Gemini-2.5-pro, Sonnet-4.5, and Opus-4.5, tend to resolve a repository name by treating it as its own owner. So a repo called 'fastcoder' becomes 'fastcoder/fastcoder' in the hallucinated slug. Consistent, predictable, exploitable.
Contrast this with older repositories. Resources published before 2019 are hallucinated at a mean rate of just 0.9%. Repositories published in 2025 come in at 92.4%. Recency is the variable. Trending resources are precisely what an attacker should target.
So here is the attack: identify resource names that models are likely to hallucinate, register those locations before anyone else does, then seed them with malicious content. The payload can be embedded in a README file or similar, containing instructions that tell the agent to install a reverse shell on the user's machine. Or just include the shell installation code directly. Either way, the coding assistant, which already has command-line access by design, executes it.
No individual targeting required. Every developer who asks their coding agent to fetch the trending resource becomes a potential victim.
The researchers describe the scaling potential plainly: compromised machines can be aggregated into botnets for crypto mining or DDoS operations, or used to distribute ransomware across entirely separate networks. This is not theoretical extrapolation. The infrastructure for all of it follows directly from obtaining shell access at scale.
The name HalluSquatting is a nod to typosquatting, the older trick of registering package names that closely resemble legitimate ones. That attack caused chaos in 2016 when a single researcher uploaded 214 booby-trapped packages across PyPI, RubyGems, and NPM. The imposter code ran more than 45,000 times across 17,000 domains. HalluSquatting does not require even that level of effort. You do not need to mimic anything. You just need to predict where the model will go and be waiting.
Other security researchers have taken notice. Michael Bargury, CTO of Zenity, called it a real and persistent threat, drawing the obvious parallel: like typosquatting, this is not a problem that gets patched away. Johann Rehberger, an independent researcher, pointed to the attacker's ability to probe models in advance to identify high-probability hallucinated identifiers, then squat them and wait.
AI tool vendors are enthusiastic about advertising productivity gains. They are considerably quieter about the fact that their tools routinely invent locations for resources they cannot actually find. HalluSquatting is a fairly direct consequence of telling developers to trust their agent to handle the tedious details, while the agent confidently navigates to addresses it made up.
Users of AI coding tools should be manually verifying the location of every external resource their agent fetches. That advice is not exciting. It is also not optional.