Security researchers have identified a novel attack method that weaponizes a fundamental flaw in large language models: their tendency to hallucinate, or incorrectly predict, the locations of code repositories and resources. The technique, named HalluSquatting, represents a significant escalation in prompt injection attacks by enabling scalable, widespread compromise of devices without targeting individual victims.
The attack exploits a vulnerability present in nine popular AI coding assistants and agents, including Cursor, GitHub Copilot, and Google’s Gemini CLI. These tools routinely access repositories and registries to retrieve code and resources during normal operation. By registering resource names that LLMs are likely to hallucinate—particularly trending repositories published recently—attackers can seed these locations with malicious instructions. When developers request these resources, the AI assistants navigate to the attacker-controlled locations and execute embedded commands, such as installing reverse shells that grant attackers system access.
Research demonstrates that LLMs exhibit predictable hallucination patterns when resolving resource identifiers. Recent repositories published in 2025 experience hallucination rates as high as 92.4 percent, while older repositories from before 2019 show hallucination rates of only 0.9 percent. The LLMs follow common, self-referential patterns that attackers can predict without probing individual models, making the technique reliable and efficient to deploy at scale.
Once deployed, HalluSquatting creates opportunities for large-scale cybercriminal operations previously impractical with traditional prompt injection attacks. Attackers could assemble distributed botnets for cryptocurrency mining or conduct large-scale denial-of-service attacks. The technique also enables widespread ransomware deployment across multiple networks simultaneously. The attack parallels typosquatting, a decades-old technique that exploits user errors through deceptive naming, but automates the process by targeting AI systems’ inherent vulnerabilities rather than human judgment.
The research team from Tel Aviv University, Technion, and Intuit published their findings, drawing attention from AI security experts who characterized the threat as both significant and persistent. Industry analysts noted that the fundamental issue stems from allowing AI agents excessive autonomy and suggested that users must maintain skepticism about resource locations, undermining some of the efficiency gains that vendors claim these tools provide.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI