Researchers say attackers can abuse recurring AI hallucinations to make coding assistants download malicious repositories or packages and execute commands on a user’s machine. The 'HalluSquatting' technique pre-registers fake resource names that large language model tools such as Cursor, Windsurf, GitHub Copilot, Cline, Gemini CLI, and OpenClaw repeatedly invent during repo-cloning or skill-installation tasks, creating a scalable prompt-injection path to remote code execution and possible malware or botnet deployment.
Why it matters: Organizations using AI coding or automation assistants could be exposed even without a direct phishing message or malicious email. Teams should treat AI-suggested package and repository names as untrusted, restrict agent terminal actions, and add allowlists or review gates before assistants install software or run commands.
Eduard Kovacs
2026.07.10
100% relevant
This article establishes a distinct story around the newly named HalluSquatting technique and its use of AI hallucinated package and repository names as a malware-delivery and agentic botnet vector, rather than updating a single previously tracked vendor-specific flaw.
← Back to all stories