HalluSquatting is the first botnet-shaped vulnerability that doesn't need the victim to do anything wrong. Researchers at Tel Aviv University and partner institutions found that nine of the most widely-used AI coding tools — including Cursor, GitHub Copilot, Gemini CLI, and Windsurf — will, on request, fetch and execute code from repositories whose names the model simply invents. The hallucination lands on a name, an attacker registers that name, and the next agent that asks for it pulls the attacker payload in. That is the whole attack chain, and it scales horizontally because the hallucination patterns are consistent across the six major LLMs the team tested.
This deserves credit before any criticism. Naming a specific property of LLM behaviour — "the model will confidently invent a package name and direct an agent to clone it" — and then proving it across nine production tools with reproducible numbers is real research, not a CVE-of-the-week panic piece. The 85% misidentification rate for popular repos and the 100% rate for trending resources not in training data is the kind of figure that forces a re-think, not a one-line patch.
What HalluSquatting actually is
HalluSquatting is named after typosquatting, with one structural difference worth stating up front: typosquatting needs a human to fat-finger a URL. HalluSquatting does not. The attacker studies what names the model invents, registers those names on GitHub (or any host the model is willing to clone from), waits, and harvests the incoming agent traffic.
The mechanism is the model's own resource-resolution behaviour. When an agent is asked to "install X" or "clone the Y library", it must produce a concrete URL or package identifier. The research team found that all six LLMs they tested follow predictable hallucination patterns when forced to resolve identifiers for resources that don't cleanly exist in their training data. The numbers sharpen the picture:
- Repositories published before 2019: less than 1% correctly identified
- Repositories published in 2025: 92.4% error rate
- Popular-but-misnamed resources: 85% misidentification
- Trending resources not in training data: 100% misidentification
Pre-2019 packages sit deep in the training corpus, so the model knows the real canonical names. Post-2025 packages don't, so the model invents plausible ones and an agent obediently goes looking. That's the entire exploit surface.
[[DIAGRAM: researcher enumerates hallucinated package names across LLMs → attacker registers GitHub repos with those exact names and embeds payloads in install scripts → developer asks any of the nine AI tools to install the library → agent clones the attacker's repo and runs the install command → reverse shell, credential stealer, or botnet implant executes with the user's permissions → compromised machines aggregated for cryptocurrency mining, ransomware distribution, or DDoS]]
The nine tools in scope
The research identifies nine widely-used AI tools, headlined by Cursor, GitHub Copilot, Gemini CLI, and Windsurf. The article doesn't enumerate the remaining five by name, and I won't invent them. What matters is the category: any tool that lets an LLM autonomously fetch code or run installation commands inherits the same hallucination risk. Coding agents are first in line because their entire job is "go get this and run it", but anything that turns natural language into a git clone, npm install, or pip install is in the same shape.
The scale concern is volume. These aren't obscure tools — they are the default editing environment for a large slice of working developers today. A hallucination pattern that an attacker can pre-compute once becomes a permanent, queryable landmine.
How the attack plays out, step by step
The chain has three steps and zero social engineering.
1. Enumerate. Run a battery of prompts against the target LLMs asking for libraries, SDKs, and code samples that don't cleanly exist. Harvest the names the models invent. Because the hallucination patterns are consistent across models — the research says "predictable" — one enumeration pass yields a reusable dictionary.
2. Register. Create GitHub repositories (or whatever registries the agents will fetch from) using those names, with a README, a plausible-looking package manifest, and — critically — an instruction embedded in code that the agent will execute during install. Reverse shells and other malicious software are the listed payloads.
3. Wait. Every developer who later asks any of the nine tools to "install that library" gets the malicious copy. The agent does the rest, with the user's own permissions, on the user's own machine.
The resulting fleet can be aggregated into a botnet for cryptocurrency mining, ransomware distribution, or large-scale cyberattacks — the three outcomes named in the research. Unlike prompt injection, which usually needs a targeted victim, HalluSquatting works passively against anyone who happens to ask.
What to actually do today
This is the part that matters for shipping teams. The defensive surface is small, concrete, and mostly already exists in your supply-chain tooling — it just hasn't been pointed at agent-driven installs yet.
Lock the registries your agent can reach. Most agents support an allowlist of sources or a proxy mode. Force every git clone and pip install through a vetted mirror, not the open internet. If the agent can't reach an unverified host, the hallucination has nowhere to land.
Pin by hash, not by name. Never let an agent resolve "the latest X" or "the standard Y". Hand it the exact repository URL plus a commit SHA, the way you'd pin a Docker image. This breaks the hallucination step entirely — there is nothing to invent when the answer is already in the prompt.
Sandbox the install. Run the agent's shell commands inside a disposable container with no network egress beyond the registries you trust, no credentials, and a snapshot to roll back to. The payload may still execute, but it can't phone home and the damage is contained.
Audit the model's name resolution. Add a CI step that asks the model "what package would you install for task X" without letting it actually install anything, and reject any answer that doesn't exactly match a name in your dependency lockfile. This is the inverse of the attack: you are forcing determinism where the attacker relies on hallucination.
# refuse any install whose resolved name isn't pinned in deps.lock
RESOLVED=$(agent ask "package for $TASK")
if ! grep -qxF "$RESOLVED" deps.lock; then
echo "refusing to install non-pinned: $RESOLVED"
exit 1
fi
Patch the tools themselves. Cursor, GitHub Copilot, Gemini CLI, Windsurf, and the rest are shipping fixes for this class of bug; track their release notes the way you would for any dependency with a CVE.
Educate the humans. The attack doesn't need a careless user, but a user who has been told "the agent sometimes invents names — paste any unfamiliar URL into a browser before approving an install" is a user who won't get owned on the slow path.
These are the steps that turn the research from "alarming" into "handled".
The part that doesn't change when the model does
Every AI coding vendor will ship a fix for this class of bug — confirmed-package lookups, signature checks, registry pinning — and each will announce it differently in their changelog. That's the model-churn part of the story. Worth using, worth tracking, but not the durable layer.
What's durable is the architecture around the agent: a sandbox that contains any payload, a registry allowlist that survives a hallucination, dependency locks that pin by hash, and a CI gate that refuses to install anything the model invented on the spot. None of that depends on which model Cursor ships next quarter. None of that needs a security team to approve per-vendor. It is the part of your stack that gets safer the longer it stays in place.
A coding workflow built on opinionated, validated templates — pinned dependencies, locked registries, sandboxed shells, conventions an agent cannot drift away from — is the same bet at a different level. The model changes. The trust boundary doesn't.
Closing
HalluSquatting is a serious finding because it turns the model's worst property — confident invention — into the attacker's best friend, and it does so at a scale no per-user prompt-injection defence can match. The fix is not "stop using AI coding tools". The fix is to stop letting an LLM be the source of truth on where a package lives. Pin by hash, sandbox the install, allowlist the registries, audit the names. Do those four things and a 92.4% error rate is someone else's research paper, not your incident report.
Top comments (0)