HalluSquatting attack exploits AI coding assistants to install botnet malware
Researchers from Tel Aviv University, Technion, and Intuit demonstrated a cyberattack called HalluSquatting that exploits AI coding assistants' tendency to hallucinate fake package names. Attackers preemptively register the hallucinated names with malicious code, allowing them to infect developers' systems and create botnets when AI agents attempt to download the fake packages.
What happened
Researchers from Tel Aviv University, Technion, and Intuit published a paper on July 9 detailing a cyberattack called 'HalluSquatting,' which weaponizes the tendency of large language models to invent fake software packages. Attackers analyze trending repositories and probe LLM systems to identify likely hallucinated names, then preemptively register these fake resources with malicious code embedded within them.
When developers ask AI coding assistants to install a package or retrieve code, the models sometimes invent package names that do not exist. When the AI agent later hallucinates that exact attacker-controlled name and attempts to download it, the developer unknowingly pulls in malware.
Reported impact
Across various test scenarios, LLMs hallucinated incorrect repository names up to 85% of the time, with some tests targeting particular skill installations hitting 100% hallucination rates. The attack enabled remote code and tool execution across multiple platforms, effectively allowing attackers to install malware on users' systems and create botnets with remotely controllable compromised devices.
Index analysis
The danger emerges with agentic AI systems that execute commands rather than just suggest code. Tools like GitHub Copilot and other AI coding assistants increasingly have terminal access, meaning they can install packages and run code without a human double-checking each step.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.