HalluSquatting: New Prompt Injection Attack Uses LLM Hallucinations to Build Mass Botnets via AI Coding Tools
Summary
- • Researchers discovered 'HalluSquatting,' the first pull-based prompt injection attack scalable to mass botnets, large-scale DDoS, and widespread device infection.
- • Attack exploits LLMs' tendency to hallucinate package/resource identifiers; attackers preregister these names and seed them with reverse shells or malware, then wait for AI agents to pull them automatically.
- • Nine popular AI coding tools confirmed vulnerable: Cursor, Cursor CLI, Gemini CLI, Windsurf, GitHub Copilot, Cline, OpenClaw, ZeroClaw, and NanoClaw.
- • Root cause is structural LLM hallucination — not a patchable software bug — meaning guardrails can only mitigate, not eliminate the threat.
Details
HalluSquatting attack discovered
Novel pull-based prompt injection technique that exploits LLM hallucinations about resource identifiers to infect devices at mass scale without individual victim targeting.
9 AI coding tools confirmed vulnerable
Cursor, Cursor CLI, Gemini CLI, Windsurf, GitHub Copilot, Cline, OpenClaw, ZeroClaw, and NanoClaw are all susceptible to HalluSquatting attacks.
Prior prompt injections were scale-limited
Push attacks required per-victim targeting; prior pull attacks couldn't attract enough LLMs to malicious sites — both constraints prevented mass exploitation.
Attack mechanism: preregister hallucinated IDs
Attackers predict which identifiers (package names, URLs) LLMs are most likely to hallucinate, register them in real repos/registries, seed with malware, and wait for agents to pull automatically.
Coding agents run with high-privilege CLI access
Because agents execute code from external sources via command line, a successful pull can install reverse shells or persistent malware at the OS level — far beyond text-output-only harm.
Root cause is structural — not patchable
LLM hallucination is an intrinsic model property, not a correctable bug. AI engine developers can erect guardrails to mitigate damage but cannot solve the root cause.
First injection attack capable of mass botnet assembly
HalluSquatting is the first prompt injection technique able to assemble massive botnets and execute large-scale DDoS campaigns indiscriminately across developer environments.
New Tech = novel attack or technique; Security Alert = confirmed vulnerability or threat; Tech Info = mechanism or background; Insight = structural implication; Market Impact = scale or industry-wide consequence
What This Means
HalluSquatting marks a qualitative escalation in AI security threats — for the first time, a prompt injection attack can scale to infect massive numbers of devices without targeting individual victims. The root cause is LLM hallucination itself, making this category of attack structurally difficult to eliminate; guardrails can slow it but cannot solve it. With nine widely-used coding tools confirmed vulnerable and these agents typically running with elevated system privileges, the attack surface is immediate and substantial. Developers and enterprises using AI coding assistants should treat all untrusted resource pulls as a serious attack vector and implement strict dependency allowlisting as a minimum control.
Sentiment
Concerned and informative — practitioners and journalists highlighting a serious new scalable threat to AI coding tools
“We show that attackers can exploit predictable LLM hallucinations of resource identifiers to launch scalable, untargeted prompt injection attacks... By preemptively registering hallucinated resources—a technique we call adversarial hallucination squatting (HalluSquatting)—we demonstrate remote tool execution and remote code execution at scale across a range of popular agentic LLM applications, which could be exploited to the establishment of a botnet.”
Co-author of the original HalluSquatting research paper
“⚠️ New attack can turn AI coding assistants into BOTNET installers. Register a hallucinated repo name, hide prompt-injection instructions inside it, and wait for coding agents to fetch the wrong resource. Here's how HalluSquatting works.”
“AIツール悪用は「プロンプトで騙す」から「AIが勧めた偽部品を踏ませる」に進んだ。Ars Technica報道のHalluSquattingは、主要9つのAIツールの「I don't knowと言えない」癖を使い、大規模botnet組成まで狙える話だ。CVEで待つ類ではない。現場ではMCP/agent/pluginの許可リスト、pip/npm等のinstall log、lockfile差分、CI runnerの外向きDNS/HTTPを今日見るべき。”
“"HalluSquatting" weaponizes LLM hallucinations to build botnets. All 6 major models (GPT-5, Opus-4.5, Gemini-2.5). Coding agents hallucinate >92% of repo paths. Attackers squat them — your AI runs their code. First scalable pull-based prompt injection. AI trust is now measurable.”
Split
~90/10 concerned/informative vs. minimal pushback (no notable defenders of the status quo found)