Security researchers have discovered a novel attack method that leverages fundamental vulnerabilities in large language models to enable large-scale malicious campaigns. The attack, termed HalluSquatting, represents a significant escalation in prompt injection threats by introducing a pull-based mechanism that can compromise devices at scale without targeting individual victims.
The attack exploits an inherent flaw in how AI coding assistants and agents resolve resource identifiers from repositories and registries. When users request that these tools clone repositories or install specialized skills, the underlying language models frequently hallucinate incorrect locations for these resources. For newly published repositories and skills, hallucination rates reach as high as 85 to 100 percent. Attackers can predict these common hallucination patterns and register malicious repositories or skills at the locations where AI tools are most likely to search.
The research identified nine popular AI tools as vulnerable to this attack: Cursor, Cursor CLI, Gemini CLI, Windsurf, GitHub Copilot, Cline, OpenClaw, ZeroClaw, and NanoClaw. When these tools access the attacker-controlled resources, they execute embedded instructions that install reverse shells, effectively compromising the user’s machine. Unlike previous prompt injection attacks that required targeting individual victims, HalluSquatting can indiscriminately infect large numbers of devices through minimal effort by targeting trending resources.
The threat potential is substantial. Attackers could assemble massive botnets for distributed denial-of-service attacks, conduct large-scale ransomware campaigns, or aggregate compromised machines for cryptocurrency mining. The vulnerability stems from training biases and model limitations that cause all six major language models tested to follow predictable patterns when resolving resource names, with particularly high error rates for recently published content.
The research was conducted by teams from Tel Aviv University, Technion, and Intuit. Security experts have noted that while the attack resembles traditional typosquatting schemes, it represents a new and scalable threat vector that will likely persist as organizations increasingly deploy AI coding assistants with access to command-line interfaces and privileged execution environments.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI