RESEARCHERS have disclosed a new attack named HalluSquatting that tricks AI coding assistants into downloading malware by exploiting their tendency to hallucinate resource names. The technique targets popular large language model tools used for code generation and skill installation. By registering names that the model is likely to invent, attackers can steer the assistant toward malicious repositories or packages. This creates a pathway for threat actors to build hidden botnets without relying on traditional software vulnerabilities.
According to security analysis, HalluSquatting works by squatting on package or repository identifiers that LLMs frequently hallucinate when asked for dependencies. When a developer asks the AI to install a library that does not exist, the model may confidently suggest the attacker‑controlled name and attempt to fetch it from a public registry. The request then reaches the attacker’s server which serves a payload containing malicious code or a backdoor. In laboratory tests the hallucination rate for repository cloning reached as high as 85% while skill installation prompts produced a false name 100% of the time. Because the interaction looks like a normal dependency resolution step, traditional antivirus or firewall rules often fail to flag the traffic.
According to industry research, the underlying issue is not a software bug that can be patched with a CVE but a property of how generative models fill knowledge gaps. LLMs generate the most statistically likely continuation of a prompt, and when the prompt concerns a non‑existent resource they often output a name that sounds plausible. An attacker only needs to register that name on a public package index and host a malicious artefact; no alteration of the model weights or prompt injection is required. This low‑complexity approach enables the same foothold to be reused across many instances of agentic botnets, increasing the potential scale of compromise.
While no specific threat actor has been publicly attributed, telemetry collected between July 8 and July 10 2026 shows HalluSquatting being used in the wild. The observed activity involved AI assistants reaching out to newly registered npm‑like repositories that contained PowerShell scripts designed to contact command‑and‑control servers. Because the traffic originates from a trusted AI process, signature‑based scanners and reputation filters often allow the connection to proceed. No CVE identifier has been allocated to this behaviour, which means defenders must rely on behavioural rather than vulnerability‑based detections.
Organisations should enforce strict allowlists that limit which external registries or domains AI tools are permitted to query. Any request to a name not present on the approved list should be blocked and logged for review. Before executing any downloaded artefact, verification steps such as checking cryptographic hashes or signatures must be mandatory. Continuous monitoring of agent behaviour for outbound connections to unfamiliar IP addresses or unusual process spawning can provide early warning of a HalluSquatting attempt.
Furthermore companies ought to limit the autonomy of AI assistants, restricting their ability to install packages or execute scripts without explicit human confirmation. Regularly updating the underlying models and auditing prompt configurations helps reduce the likelihood that a hallucinated name coincides with an attacker‑registered asset. Maintaining an inventory of approved skill repositories and version‑controlled dependency files further shrinks the attack surface. By combining network controls, execution guards and model hygiene, defenders can mitigate the risk posed by this novel hallucination‑driven technique.