AI coding assistants are the new power tool for developers everywhere. But a team of academic researchers has revealed that the same hallucination habit that makes these tools creative can also be weaponized against us. The HalluSquatting attack turns an AI's tendency to make up fake names into a full supply-chain exploit that delivers malware straight to your machine.

GitHub Copilot, Cursor, Windsurf, Cline, Google's Gemini CLI, and the OpenClaw family of assistants are all affected. In tests, researchers achieved remote code execution on every single one of them, using nothing more than a made-up package name the AI reliably invents.

What Is HalluSquatting?

HalluSquatting is an attack that chains two well-known AI weaknesses into something new. The first is hallucination: an LLM making up a name for a resource that does not exist but sounds plausible. The second is indirect prompt injection: adversarial instructions hiding inside content the AI fetches from the outside world.

The researchers, led by Aya Spira from Tel Aviv University, with Stav Cohen at Technion and Ron Bitton at Intuit (Ben Nassi's group), call it adversarial hallucination squatting. The paper describes how attackers can exploit predictable LLM hallucinations of resource identifiers to launch scalable, untargeted prompt injection attacks without requiring any direct channel to the LLM application.

The result is a potential agentic botnet: an army of machines whose AI assistants have been tricked into installing malware, all because the AI reached for a name that was never real.

The 5-Step Attack Chain

The attack unfolds in five stages. No phishing email, no zero-day exploit, no weak password required.

Step 0: Preparation

The attacker monitors what is trending on GitHub, npm, or other package registries. A new popular repository or plugin means many developers will ask their AI assistant to fetch it. Crucially, a brand-new resource is unlikely to be in the AI's training data, which is exactly when the model starts guessing at names instead of recalling them.

The attacker then probes the target AI assistant (or the underlying LLM directly) with prompts like "clone repository X" or "install skill Y." They record which hallucinated name the model invents most consistently across different phrasings.

The hallucination rates are startling: up to 85% for repository cloning and up to 100% for skill installation across different LLM models and providers. Even more concerning, the same hallucinated names transfer between different foundation models and across different prompts.

Step 1: Registration

The attacker registers the hallucinated name on GitHub, npm, or the relevant plugin marketplace. Inside the repository or package, they embed hidden adversarial prompts: instructions that tell the AI assistant to download and run malware once the content is fetched and processed.

Marketplace security is not much of a barrier. In June 2026, Trail of Bits demonstrated that malicious "skills" could bypass several store scanners in under an hour.

Step 2: Trigger

A real developer asks their AI assistant to fetch a popular resource. The prompt could be as innocent as "Help me install the new framework" or "Clone the trending repo for me."

Step 3: Hallucination

Instead of finding the real resource, the AI reaches for the hallucinated name the attacker registered. Because the model has never seen the real name in training and hallucinates the fake one with high confidence, the assistant's planner picks the wrong target.

Step 4: Execution

The assistant fetches the attacker's booby-trapped resource. The adversarial instructions within it poison the AI's context: it now believes the attacker's payload is part of its task. Since most coding assistants have a terminal tool as one of their core capabilities, the hijacked assistant uses its own command-running abilities to install the malware. The machine joins the botnet.

No traditional exploit is involved. The payload arrives as text the AI reads, not as a network attack or a buffer overflow, making it invisible to standard security monitoring.

Why AI Assistants Are Especially Vulnerable

Several design characteristics make modern AI coding tools particularly susceptible to HalluSquatting:

Auto-run modes. Many tools offer "skip-permissions" flags or "yolo" modes that let the AI execute commands without asking the user first. Claude Code has its --skip-permissions flag, Gemini CLI has a yolo mode. These exist for productivity, but they are exactly what attackers need: no human in the loop to catch the trick.

Fetcher-as-executor. The same AI that plans which repository to clone is also the one that runs the clone command and, if instructed, any subsequent install scripts. There is no separation between the planning layer and the execution layer.

Predictable hallucinations. Unlike random guessing, LLMs hallucinate consistently. The researchers found that the same fake name appeared across different models (GPT-4o, Claude, Gemini) and across different phrasings of the same request. This consistency is what makes the attack scalable.

Trust-by-default. AI assistants consider anything they fetch from the internet as content to incorporate into their context. There is no "untrusted data" taint tracking like a browser's same-origin policy.

Which Tools Are Affected

The researchers tested HalluSquatting against these AI coding assistants and achieved remote code execution on all of them:

Tool	Type	RCE Achieved
Cursor	AI-powered IDE	Yes
Cursor CLI	Terminal coding agent	Yes
Windsurf	AI coding IDE	Yes
GitHub Copilot	Code completion + agent	Yes
Cline	VS Code agent	Yes
Gemini CLI	Google's terminal agent	Yes
OpenClaw	Open-source agent	Yes
ZeroClaw	Open-source agent	Yes
NanoClaw	Open-source agent	Yes

The attack was demonstrated using harmless test payloads. A real attacker would substitute actual malware that follows the same execution path.

How HalluSquatting Differs From Older Attacks

This is not the first time someone noticed that AI hallucinations create security risks. In January 2026, Charlie Eriksen from Aikido Security found that the hallucinated npm package react-codeshift had already spread across 237 repositories through AI-generated agent skills. He registered the package himself before an attacker could, preventing harm.

In July 2026, Palo Alto Networks' Unit 42 described "phantom squatting," identifying roughly 250,000 hallucinated domain names sitting unregistered and available for attackers to claim.

What makes HalluSquatting different is the full chain to code execution. Earlier work stopped at the naming level. HalluSquatting reaches through to RCE by weaponizing the AI's own command-running capabilities. And because the attack is untargeted (anyone asking for a popular resource could trigger it), the scale potential is enormous.

Mitigation: What Developers and Teams Should Do

There is no single CVE to patch here. The vulnerability is architectural: it is about how AI agents trust names and execute fetched content. But there are practical steps to reduce risk immediately:

For Users of AI Coding Assistants

1. Disable auto-run modes. Never let your AI assistant execute commands without explicit confirmation. Auto-run flags like --skip-permissions and yolo modes are convenient but remove the human safety net.

2. Verify before fetching. Before an AI assistant clones a repository or installs a package, check that the name resolves to the real, expected source. Treat any name an AI produces as a guess, not a fact.

3. Use safety layers. Some tools now offer pre-execution inspection layers such as Claude Code's auto mode scanning, Gemini CLI's Conseca checks. Enable them. They do not eliminate the risk but they raise the bar.

4. Limit terminal access. If your AI assistant does not need arbitrary command execution for your workflow, restrict its tool permissions.

For Platform and Tool Builders

1. Add a search step before fetch. The most effective architectural fix is to make the assistant search for a resource before attempting to fetch it. A real lookup grounds the agent in what actually exists and eliminates the guessing.

2. Pre-register hallucinated names. The same defense used against typosquatting applies here. Registries can identify common hallucinated names and either register them defensively or redirect them to the real project.

3. Prevent account re-use of known names. Marketplaces should block new accounts from registering names that closely match known popular projects.

4. Treat fetch operations as sensitive. The planner layer should treat commands like clone, install, and fetch as security-sensitive operations requiring explicit user confirmation, separate from read-only actions.

Frequently Asked Questions

Q: Is this a vulnerability in one specific tool? A: No. HalluSquatting exploits a fundamental architectural pattern shared by most AI coding assistants: the combination of hallucination-prone LLMs with permission to fetch external resources and execute commands.

Q: Has this been exploited in the wild? A: The researchers responsibly disclosed their findings before publication. There are no confirmed reports of active exploitation using this exact technique, but the underlying mechanism (hallucinated package names being registered) has already been observed with react-codeshift.

Q: Can my antivirus or firewall detect this? A: Unlikely. The attack payload arrives as text content that the AI reads, not as a binary file or network exploit that pattern-matching tools can flag. Standard endpoint protection is not designed to detect adversarial instructions in fetched README files.

Q: Do open-source tools have lower risk? A: Not inherently. The research found that open-source tools (Cline, OpenClaw family) were equally affected. The risk depends on whether the tool has terminal access and auto-run capability, not on its license.

Q: Are AI chat bots (ChatGPT, Claude.ai) affected? A: The research specifically targeted coding assistants and CLI tools with terminal access. General-purpose chatbots without command execution capabilities are not directly affected by the RCE vector, though indirect prompt injection remains a concern.

Key Takeaways

• HalluSquatting is a new attack that combines AI hallucination with prompt injection to achieve remote code execution through AI coding assistants.
• Up to 85-100% hallucination rates were observed across models, with the same fake names transferring between different AI systems.
• Nine popular tools including Cursor, Windsurf, GitHub Copilot, Cline, and Gemini CLI are confirmed affected with demonstrated RCE.
• No traditional exploit is needed: the attack uses the AI's own capabilities against it, bypassing standard security monitoring.
• Disable auto-run modes on your AI assistants as the most immediate mitigation.
• The broader lesson is that AI agent architectures need security boundaries similar to web browsers: origin isolation, permission models, and untrusted-data taint tracking.

The HalluSquatting research is a wake-up call for how we design and use AI coding tools. The same features that make them powerful: fetching external content, running commands, planning without user input: are the features attackers can exploit. The fix is not to abandon AI assistants but to build them with the security boundaries they have been missing.

---

Sources: The Hacker News | Research Paper | Aikido Security - Slopsquatting | Trail of Bits - Skill Distribution Security | Unit 42 - Phantom Squatting