IA · 8 July 2026 · 3 min read
The Hallucination Trap: How HalluSquatting Turns AI Coding Agents into Botnets
In brief: Security researchers have uncovered a new vulnerability dubbed 'HalluSquatting' targeting major AI coding assistants and agents like Cursor, Copilot, and Windsurf. By exploiting the inherent tendency of Large Language Models to hallucinate non-existent package names, cybercriminals pre-emptively register these fake identifiers with malicious scripts that are automatically executed in the user's terminal.
by Team Mocchi's
Beyond the "push": The evolution of generative AI attacks
Until now, artificial intelligence security has focused almost entirely on prompt injection threats. In this traditional, "push-based" scenario, an attacker hides malicious commands within external data—such as emails, documents, or text files—hoping the LLM will execute them while processing the content. However, these are highly targeted attacks that are difficult to scale globally because they require physically delivering the bait to each individual victim.
That paradigm has now drastically shifted. A group of security researchers, led by Spira et al., has just unveiled a formidable new class of threat called HalluSquatting (short for adversarial hallucination squatting). As detailed by Ars Technica, this "pull-based" attack exploits one of the most well-known and previously deemed harmless weaknesses of large language models: their inherent tendency to hallucinate non-existent information.
The mechanics of preventive hallucination
HalluSquatting does not manipulate user input with direct prompt injections. Instead, it relies on cybercriminals' ability to predict an LLM's hallucinations. When a developer asks an AI-powered coding assistant to generate code for a complex task, the model often "invents" the existence of software libraries, npm packages, PyPI modules, or GitHub repositories that do not actually exist but sound highly plausible (e.g., utility-string-parser or similar).
Attackers monitor or forecast which fake resource identifiers are most likely to be hallucinated by popular models. They then preemptively register (squat) these exact names on public package registries or GitHub, uploading malicious code into them.
When the AI agent suggests the script to the user, or autonomously attempts to resolve dependencies by downloading the recommended packages, it ends up performing a "pull" (an active download) of the malicious code directly from the official public registry, installing malware, trojans, or reverse shells on the victim's machine.
Software in the crosshairs: From Cursor to Copilot
The primary danger of HalluSquatting lies in the level of autonomy granted to modern development agents. Many of the tools used daily by software engineering teams integrate terminals and command shells with execution privileges to speed up workflows.
The study demonstrated that 9 of the most popular AI programming tools and agents are vulnerable to this technique. Among them are industry-leading names such as Cursor, Cursor CLI, GitHub Copilot, Windsurf, Gemini CLI, and Cline, alongside open-source frameworks like OpenClaw, ZeroClaw, and NanoClaw.
Because these agents do not merely suggest text but actually execute commands to test code, compile applications, or install dependencies, the malicious code hosted on the "hallucinated" package is executed in the background without any action or awareness from the human developer.
The threat of self-generated global botnets
Unlike traditional cyberattacks, HalluSquatting does not require hackers to breach existing infrastructure or launch phishing campaigns. The artificial intelligence itself acts as the infection vector, spontaneously leading users into the traps laid by cybercriminals.
This inherent scalability transforms the threat from an individual risk to a systemic hazard. Attackers can compromise thousands of development machines worldwide with minimal effort, simply by occupying the "reality gaps" left by LLMs in public registries. The infected machines can then be aggregated into massive botnets, used to launch DDoS attacks, or leveraged to exfiltrate intellectual property and trade secrets directly from corporate development environments.
Mocchi's take
For a software agency like Mocchi's and for all Italian enterprises integrating AI agents into their workflows, HalluSquatting is a severe wake-up call. The excitement surrounding the massive productivity gains offered by tools like Cursor or Cline must not overshadow fundamental cybersecurity practices. Allowing an AI agent to execute scripts in non-isolated terminals or autonomously download dependencies is a high-risk practice that must be corrected immediately. The solution lies in adopting strictly sandboxed execution environments, implementing local package registry proxies that block the download of unverified libraries, and ensuring "human-in-the-loop" approval before authorizing any installation command.