Security researchers have identified a vulnerability in nine popular AI coding assistants and agents that could be exploited to build massive botnets and launch coordinated attacks at scale. The technique, named HalluSquatting, represents a significant evolution in prompt-injection threats and works against tools including Cursor, Gemini CLI, Windsurf, GitHub Copilot, Cline, OpenClaw, ZeroClaw, and NanoClaw.
The attack leverages a fundamental flaw in large language models: their tendency to hallucinate and incorrectly identify resource locations when developers request code repositories or instruction sets. Research shows that when users ask coding assistants to retrieve popular repositories, the tools locate the wrong resource up to 85 percent of the time, and for trending instruction sets, hallucination rates reach 100 percent. This flaw exists across all major LLM architectures, including Gemini and GPT variants, and follows predictable patterns that attackers can anticipate.
Attackers exploit this vulnerability by registering repositories or resources with names that LLMs are likely to hallucinate, then embedding malicious code within those resources. When a coding assistant attempts to retrieve legitimate resources but ends up accessing the attacker-controlled alternatives instead, it executes the hidden instructions to install reverse shells on the user’s machine. Because AI coding assistants typically have access to command-line interfaces with elevated privileges, this gives attackers broad control over compromised systems without targeting individual users.
Unlike previous prompt-injection attacks that required targeting each victim individually, HalluSquatting operates at scale. Attackers can register high-probability hallucinated resource names and passively wait for coding assistants to access them, potentially compromising thousands of devices with minimal effort. This capability enables attackers to assemble distributed botnets for ransomware campaigns, cryptocurrency mining operations, or large-scale denial-of-service attacks.
The research was conducted by security specialists from Tel Aviv University, Technion, and Intuit, and has already attracted attention from the broader AI security community. Industry experts acknowledge the threat as real and persistent, comparable to typosquatting attacks that have plagued software repositories for years. The findings underscore inherent limitations in current AI safety measures and highlight the importance of user vigilance when relying on automated AI-assisted development tools.