A team of researchers from Tel Aviv University, Technion, and Intuit has identified a scalable attack method targeting AI coding assistants and agents, including Cursor, GitHub Copilot, Gemini CLI, Windsurf, and others. The attack, termed HalluSquatting, leverages a fundamental weakness in large language models: their tendency to hallucinate and misidentify the locations of code repositories and resources.
Unlike previous prompt injection attacks that required targeting individual users, HalluSquatting operates as a pull-based attack where the AI systems themselves actively seek out malicious content. The attack exploits the fact that LLMs frequently provide incorrect resource locations when users request code repositories or skills, with hallucination rates reaching up to 85 percent for popular repositories and 100 percent for trending skills. Attackers identify resource names most likely to be misidentified, register those names, and populate them with malicious code that installs reverse shells on compromised systems.
The research found that six major LLM models exhibit predictable hallucination patterns when resolving resource identifiers. Models correctly resolve repositories published before 2019 with a mean hallucination rate of 0.9 percent, but fabricate slugs for repositories published in 2025 with a mean hallucination rate of 92.4 percent. These hallucinations follow common patterns, such as treating repository names as owners, making them exploitable without requiring model probing.
Once attackers gain access to compromised systems through the coding assistants’ integrated command-line access, they can execute malicious instructions at scale. This capability enables large-scale operations previously impossible with traditional prompt injections, including ransomware campaigns, botnet assembly for cryptocurrency mining or distributed denial-of-service attacks, and mass device infections across multiple networks and organizations.
The findings have garnered attention from AI security researchers, who acknowledge the threat as both real and persistent. The research underscores inherent design vulnerabilities in current AI systems and highlights the critical importance of users verifying details about resources incorporated into projects rather than relying entirely on AI automation.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI