HalluSquatting Uses AI-Coding Assistant Hallucinations to Deliver Attacker Code

Summary

Researchers report that attackers could register names hallucinated by AI coding assistants and use hidden instructions to make agents run code. Tests used harmless placeholders, but the technique could enable botnet delivery.

Key points

In HalluSquatting, attackers register fake repository or plugin names that AI assistants predictably invent, then place hidden instructions in those resources.
The indirect prompt injection arrives through a resource fetched by the assistant; agents with command-running permissions may then execute attacker-supplied code.
Researchers report tests against Cursor, Windsurf, GitHub Copilot, Cline, Gemini CLI, and OpenClaw that caused assistants to run code; the payloads were harmless placeholders, not real malware.
The authors report peak hallucination rates of 85% for repository requests and 100% for skill installs in their experiments.
The researchers describe botnet creation as a potential use of the technique; the article does not report that a real botnet was deployed.
Recommended defenses include searching for resources before fetching them, verifying that names resolve to the expected source, and avoiding unattended command execution.

Article Details

Attack Vectors: An attacker identifies fake repository or plugin names that AI assistants repeatedly hallucinate, registers those names on GitHub or a plugin store, and embeds adversarial instructions in the registered resource.
When an assistant fetches the attacker-registered resource, indirect prompt injection can hijack the assistant and cause it to use its command-running tool to execute attacker-supplied code.
The researchers tested the approach against Cursor, Windsurf, GitHub Copilot, Cline, Gemini CLI, and OpenClaw; the test payloads were harmless placeholders, not real malware.
Exposure increases when an assistant fetches external resources and runs commands without human review, including when auto-run modes are enabled.
Defensive Notes: Configure assistants to search for and verify a repository or package before fetching it; confirm that its name resolves to the real, expected source.
Do not allow an assistant to run unattended on resources it fetched, and avoid auto-run modes such as Claude Code's skip-permissions flag and Gemini CLI's yolo mode.
Use available safety checks, including Claude Code's auto mode and Gemini CLI's Conseca check, while recognizing that they reduce rather than eliminate risk.
Platforms can prevent new accounts from reusing well-known repository names and pre-register likely hallucinated names so they point to the real project.