Artificial intelligence coding assistants have become indispensable tools for millions of developers worldwide. Tools like Cursor, GitHub Copilot, Windsurf, and Google’s Gemini CLI can clone repositories, install packages, write boilerplate code, and execute terminal commands — all on a developer’s behalf. But this convenience comes with a hidden vulnerability that researchers have just disclosed: a novel attack technique called HalluSquatting that turns an AI’s tendency to hallucinate into a scalable mechanism for building botnets.
The research, conducted by Aya Spira and colleagues at Tel Aviv University, Stav Cohen at the Technion, and Ron Bitton at Intuit, was disclosed in early July 2026 — and it represents one of the most creative and alarming exploitations of AI behavior seen to date.
What Is an AI Hallucination?
Before understanding HalluSquatting, it helps to understand the underlying quirk being exploited. Large language models (LLMs) powering today’s coding assistants are trained on vast corpora of text and code. When asked to reference a package, repository, or tool that is trending or newly released — and therefore may not be in their training data — these models sometimes invent a plausible-sounding name rather than admitting uncertainty. This is a hallucination: the AI presents fabricated information as fact.
In isolation, a hallucinated package name is merely an annoyance. A developer asks their AI to install a library, gets a made-up name, tries to install it, and hits a 404 error. Frustrating, but harmless.
HalluSquatting changes that calculus entirely.
The Attack: Claim the Name First
The HalluSquatting technique chains two well-understood AI behaviors — hallucination and prompt injection — into a single, scalable attack.
Step 1: Find a trending resource. Attackers identify a popular, recently released repository, package, or AI skill that many developers are asking their coding assistants to fetch. Critically, the resource should be new enough that it may not be fully represented in AI training data, maximizing the chance that the assistant will guess at its name.
Step 2: Learn the hallucinated name. The attacker repeatedly prompts AI assistants to fetch that resource and records the fake name the model most consistently invents. In the researchers’ experiments, this hallucinated name was remarkably consistent — the same wrong name appeared in up to 85% of repository-cloning prompts and 100% of skill-installation requests, even across different foundational models and different phrasings of the same request.
Step 3: Register the fake name. The attacker claims that hallucinated name on GitHub, npm, PyPI, or an AI skill marketplace — before any real entity does — and plants malicious instructions inside it. These instructions are not traditional executable malware; they are adversarial prompt-injection content disguised as legitimate code or metadata.
Step 4: Wait for victims. When a real developer asks their coding assistant to install or clone the popular resource, the assistant hallucinates the same fake name, fetches the attacker’s poisoned repository, and then — because these agents have built-in terminal access — executes the attacker’s instructions on the victim’s machine.
The result? Malware installation, remote access tools, or full botnet enrollment, delivered not through a network exploit or a phishing email, but through a developer’s own trusted AI assistant.
Why Traditional Defenses Fail
What makes HalluSquatting particularly troubling is that it bypasses nearly every conventional security control.
Traditional botnets rely on network exploits, weak passwords, brute-force attacks, or social engineering. Security teams have built years of defenses around these vectors: firewalls, endpoint detection, patch management, and phishing awareness training. HalluSquatting sidesteps all of them.
Because the payload arrives as text that the AI reads rather than executable code that runs over a network, firewalls do not flag it. Because the agent itself executes the terminal commands, endpoint tools may see legitimate AI assistant processes running, not obvious malware. And because the attack scales with however many developers are using AI coding tools, the botnet can grow organically across operating systems, architectures, and corporate networks alike.
The researchers draw an explicit contrast with Mirai, the notorious IoT botnet that achieved massive scale by exploiting a single class of device with a single vulnerability. An agentic botnet built via HalluSquatting can infect Linux machines, Windows workstations, macOS laptops, and cloud-hosted development environments indiscriminately — because the attack lives at the AI layer, not the OS layer.
The Scale of Exposure
The researchers tested their technique against Cursor, Windsurf, GitHub Copilot, Cline, Gemini CLI, and the OpenClaw family of assistants. All were successfully manipulated into running attacker-supplied code during controlled experiments. The test payloads were harmless placeholders, but the researchers note that a real attacker payload would traverse the same path with identical results.
This is not a theoretical edge case. AI coding assistants are now mainstream. GitHub reports that Copilot is used by tens of millions of developers globally. Cursor and Windsurf have surged in adoption among professional developers. Google’s Gemini CLI is embedded in standard developer workflows. Every one of these users is a potential vector.
The research also builds on a documented trail of related discoveries. In January 2026, Aikido Security researcher Charlie Eriksen found a hallucinated npm package — react-codeshift — that AI-generated developer instructions had already spread across 237 code projects, with AI agents still attempting to install it daily. He registered the package himself to prevent exploitation. Separately, Palo Alto Networks’ Unit 42 recently identified roughly 250,000 hallucinated domains sitting unregistered and vulnerable to “phantom squatting.” And in June 2026, Trail of Bits demonstrated that malicious skills could be slipped past multiple AI marketplace scanners in under an hour.
HalluSquatting synthesizes these threads into a coherent, weaponized attack chain.
Defenses: What Developers and Teams Can Do Now
The research team was careful to notify affected vendors, model makers, and marketplace operators before publication, and withheld specific exploit details that could enable direct copying of the attack. But they are clear that this is not a single CVE to patch — it is a structural weakness in how AI agents trust names they were never actually verified to receive.
In the near term, the most important defensive principle is straightforward: do not let an AI agent run unattended on anything it fetched without human review. Most AI coding tools default to asking for permission before executing terminal commands. The danger lies in auto-run modes — Claude Code’s --skip-permissions flag, Gemini CLI’s yolo mode — that disable that check. Developers should avoid enabling these modes, especially in environments where the AI is pulling in external resources.
Beyond that, developers should treat any package or repository name an AI generates as an unverified suggestion, not a fact. Look the name up independently before the agent fetches it. Compare it against official documentation or the real project’s GitHub page. The extra thirty seconds can prevent a machine from joining a botnet.
For platform operators and AI tool developers, the mitigations are deeper: train the planning components of AI agents to perform a real lookup before fetching, so the model is grounding itself in what actually exists rather than guessing. Pre-register the hallucinated names that models consistently invent for popular resources — the same defense already used against traditional typosquatting in package registries. And invest in marketplace scanners that specifically look for adversarial prompt-injection content, not just traditional malware signatures.
An Expanding Attack Surface
The researchers close their paper with a sobering observation: “Attacks always get better; they never get worse.” HalluSquatting is not the end state of AI-assisted threat delivery. It is the beginning.
As AI coding agents gain more permissions — access to cloud credentials, deployment pipelines, production databases, communication tools — the value of controlling an agent grows exponentially. The hallucination problem is not going away quickly; it is an inherent property of probabilistic language models, especially when dealing with fast-moving ecosystems that outpace their training data.
The security community has spent decades hardening the perimeter. The next frontier is hardening the AI layer sitting inside that perimeter, making decisions and taking actions that no firewall was ever designed to inspect.
HalluSquatting is the clearest demonstration yet that this work is urgent.
Sources: SecurityWeek, The Hacker News, Cybersecurity News, GBHackers, Decrypt
