Hackers can use 9 of the most popular AI tools to assemble massive botnets

Details

Researchers Spira et al. have documented HalluSquatting, a novel pull-based prompt injection attack that exploits AI coding assistants' inherent tendency to hallucinate package and resource identifiers. Unlike earlier push-based attacks requiring per-victim targeting, HalluSquatting operates at botnet scale: attackers predict which package names tools are statistically likely to hallucinate, register those identifiers in public repositories, then seed them with malicious payloads such as reverse shells. The attack is confirmed against nine widely-used AI coding tools: Cursor, Cursor CLI, Gemini CLI, Windsurf, GitHub Copilot, Cline, OpenClaw, ZeroClaw, and NanoClaw. These agents routinely fetch and execute code from third-party registries as part of normal workflow, often with elevated system privileges. When a tool hallucinates a squatted package name and fetches it, the payload runs silently with no user prompt required. The structural nature of the vulnerability is what makes it serious: LLMs cannot enforce a trust boundary between legitimate and hallucinated resource identifiers, and no model-level patch is possible. Defenders must rely on supply chain mitigations -- package signing, dependency scanning, registry allowlists -- that exist in tooling today but are inconsistently applied across developer environments. For enterprises deploying AI coding assistants at scale, this research is an immediate signal to audit agent permissions, restrict package installation to verified sources, and apply supply chain scanning policies before broad rollout.