Cybersecurity researchers have identified a novel attack method named HalluSquatting that leverages a fundamental weakness in large language models used by AI coding assistants. The attack exploits the tendency of LLMs to incorrectly identify the locations of code repositories and skill resources, with hallucination rates reaching as high as 92.4 percent for recently published materials.
The technique represents a significant escalation in prompt injection attacks, moving from previous push-based attacks targeting individual users to a scalable pull-based approach. By predicting which resource identifiers LLMs are most likely to misidentify, attackers can register repositories or skills with similar names and embed malicious code, such as reverse shells, within them. When developers instruct AI assistants to access these resources, the systems unknowingly execute the malicious instructions across potentially thousands of devices simultaneously.
The attack affects nine popular AI coding tools including Cursor, GitHub Copilot, Gemini CLI, and others that routinely access code repositories and registries. The researchers conducted analysis across six major LLM models and found consistent hallucination patterns that are predictable without requiring advanced probing techniques. More recent repositories published in 2025 showed significantly higher hallucination rates compared to older repositories from before 2019, which had a mean hallucination rate of just 0.9 percent.
Once compromised, affected devices can be aggregated into botnets for conducting large-scale cryptocurrency mining operations, distributed denial-of-service attacks, or coordinated ransomware campaigns. The attack draws parallels to typosquatting, a technique first widely recognized in 2016 that involves registering domains or packages with names similar to legitimate ones. The research team, comprising academics from Tel Aviv University, Technion, and security professionals, published their findings Wednesday.
Security experts have acknowledged the significance of the discovery, noting that the vulnerability represents an inherent challenge in allowing AI agents to perform autonomous actions. Industry observers emphasize that users must continue to verify resource locations and other critical details rather than relying entirely on AI assistant recommendations, highlighting the limitations of current AI automation promises.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI