HalluSquatting Attack: Hackers Weaponize AI Hallucinations to Build Botnets

When Your AI Coding Assistant Becomes the Attacker: Inside HalluSquatting

The bug is built into the architecture.

Seven years ago, a college student uploaded 214 malicious packages to PyPI, RubyGems, and NPM. Each name was a hair-splitting variation of a popular library. The result: 45,000 executions across 17,000 domains, half gaining admin access. That was Typosquatting. It worked because humans make typos.

A new class of attack has now made the human element optional.

On July 8, 2026, security researchers published findings on HalluSquatting – a method that exploits the one flaw every LLM shares: an inability to say “I don’t know.” When a developer asks an AI coding assistant to clone a popular repository, the underlying model invents a location for it 85 percent of the time. When the request involves a skill – a script or instruction set that extends an AI agent’s capabilities – the hallucination rate hits 100 percent.

And those hallucinations are not random. Six major LLMs – Gemini-2.5-flash, Gemini-2.5-pro, GPT-5.1, GPT-5.2, Sonnet-4.5, and Opus-4.5 – produce errors that follow predictable, overlapping patterns. That predictability is the weapon.

The Mechanism

HalluSquatting works in two steps. First, an attacker runs automated probes against a target LLM to map which resource names it hallucinates. Second, the attacker registers the predicted false locations and populates them with malicious code. When an AI coding assistant later attempts to fetch that resource for a developer, the payload executes automatically – installing a reverse shell, exfiltrating credentials, or enrolling the machine in a botnet.

The attack surface is large and growing. Nine AI coding tools were confirmed vulnerable: Cursor, Cursor CLI, Gemini CLI, Windsurf, GitHub Copilot, Cline, OpenClaw, ZeroClaw, and NanoClaw. The 2026 AI coding tool market has ballooned to $12.8 billion. GitHub Copilot has 4.7 million paid subscribers. Cursor crossed $2 billion in annualized revenue with over 1 million paid users. Most developers do not stop at one tool – 70 percent use two to four different AI coding assistants simultaneously, and 15 percent use five or more.

This means a single successful HalluSquatting campaign could, in theory, hit every major AI coding platform at once. The compromised machine then becomes a pivot point into the company’s entire code supply chain. Every commit, every deployed package, every updated library passing through that machine is a potential insertion point for a backdoor.

The Number That Should Alarm Every Security Team

Phoenix Security’s telemetry data shows supply chain attacks accelerating at a pace that defies conventional scaling:

2024: 6 campaigns, 30 malicious packages
2025: 14 campaigns, 111 malicious packages
2026 (first half only): 37 campaigns, 497 malicious packages

That is 4.5 times the 2025 total in just six months. Every one of these campaigns exploited trust abuse with zero CVE assignments – meaning traditional vulnerability scanners missed them entirely.

Snyk ran the first security audit of the AI agent skills ecosystem and found 36.82 percent of 3,984 skills contained at least one security vulnerability. The issues ranged from hardcoded API keys to credential leakage to malicious third-party content loading. Seventy-six skills were confirmed to harbor active malicious payloads.

Michael Bargury, CTO of Zenity, put it plainly: “This is like typosquatting. It is a problem that will not go away. At the end of the day, it comes down to how much automation authority we give to agents. They will always find ways to be tricked. That is an assumption our defenses need to be built around.”

Johann Rehberger, an independent security researcher, noted the core contribution of the research was finding a technique to make models more likely to use or confuse certain resource names. “This means a large number of agents in the real world are likely falling for this,” he said.

Why LLMs Cannot Say “I Don’t Know”

The root cause is not a bug. It is a training objective.

Generative models are trained to predict the next token given prior context. When a developer asks to clone that popular repo or install this skill, the model faces a distribution problem. “I don’t know” is a valid token – but it is never the most probable token. The training objective penalizes uncertainty as heavily as it penalizes error. The result is a model that will produce a confident, plausible-sounding answer rather than admitting ignorance.

This behavior survives model improvements. The six LLMs tested included the latest generations of GPT-5, Gemini-2.5, Claude Sonnet-4.5, and Claude Opus-4.5. All exhibited the same pattern. HalluSquatting is not a bug in one model’s retrieval logic. It is a feature of the generative AI paradigm.

Three Uncomfortable Projections

First: the attack surface will keep expanding. As of 2026, 85 percent of developers use AI coding tools, and 73 percent use them daily. The installed base of potentially compromised machines grows with every new paying subscriber to Cursor, Copilot, or any of the other tools in this ecosystem.

Second: supply chain attack economics are about to change. Traditional supply chain attacks require continuous investment – phishing campaigns, exploit development, social engineering. HalluSquatting converts attack cost from ongoing spending to asset holding. Register a batch of predicted names, plant the payload, and wait. The marginal cost of infecting the next machine approaches zero.

Third: the mitigations have structural problems. Cross-validation against external APIs introduces latency – the enemy of user experience, which is the entire value proposition of these tools. Human confirmation breaks the automation promise entirely. Reinforced dependency parsers can only catch known malicious packages; they are blind to newly registered resources sitting dormant until an AI assistant happens to call them.

The Convenience Tax

AI coding tool vendors market their platforms around speed and automation. Fewer developers are reading documentation end-to-end. More are delegating setup, configuration, and library management to AI agents that operate with filesystem access, command-line privileges, and package installation permissions.

These tools have become operationally critical. That also makes them high-value targets. A backdoor installed through HalluSquatting does not just compromise one developer machine. It compromises every system that developer touches – every git commit, every CI/CD pipeline, every package that later gets distributed as a dependency update.

The irony is that these tools were adopted because they made developers faster and more productive. They are now also the most effective single point of failure in the modern development stack. The same automation that saves hours is the vector through which an attacker with minimal effort can gain access to millions of machines running across enterprise environments.

The vulnerability exists because the models that power these tools were never trained to tell you when they are lost. Until that changes at the architectural level, HalluSquatting and its successors will keep finding new targets.