AI coding agents vulnerable to HalluSquatting botnet technique

Researchers demonstrated a new attack, dubbed HalluSquatting, that exploits hallucinations in AI coding assistants. By predicting the non‑existent package names that tools such as GitHub Copilot, Cursor, Gemini CLI, Windsurf and others may generate, attackers pre‑register those names with malicious payloads. When a developer asks an AI agent to clone a "trending" repository or install a helper package, the agent automatically pulls the malicious code, executing reverse shells with the privileges of the coding environment. The technique was shown to succeed against nine major AI tools, achieving success rates between 85% and 100% for targeted requests, and requires no phishing or direct victim interaction.

Standard defenses—prompt‑injection filters and software‑composition analysis—miss the threat because the malicious package appears legitimate at the moment of download. Experts recommend disabling auto‑run modes in AI agents, blocking newly registered packages that mimic popular names, and enforcing real‑time verification of resource identifiers before execution.

The HalluSquatting method turns AI assistants into a scalable botnet‑building vector, highlighting a structural gap in current AI‑driven development pipelines.