AI coding assistants have become a common part of software development, helping developers clone repositories, install dependencies, and execute commands with minimal user interaction. New research suggests that convenience can also create a new attack surface.
Researchers from Tel Aviv University, Technion, and Intuit have introduced a technique called HalluSquatting, which exploits the tendency of large language models (LLMs) to hallucinate software repository and package names. Instead of compromising legitimate projects, attackers can register the fake resource names that AI assistants consistently invent, causing the assistants to retrieve attacker-controlled content and potentially execute malicious code.
The researchers demonstrated the technique against several popular AI coding tools, including Cursor, GitHub Copilot, Windsurf, Cline, Gemini CLI, OpenClaw, ZeroClaw, and NanoClaw, achieving remote tool execution and remote code execution under certain conditions.
Turning AI mistakes into an attack vector
Rather than relying on traditional phishing or software supply chain compromises, HalluSquatting targets the decision-making process of AI assistants themselves.
The attack begins by identifying a popular or recently released repository that developers are likely to request. Because newly published projects may not exist in an LLM’s training data, AI assistants are more likely to guess the repository name instead of retrieving the correct one.
Researchers found these guesses are often surprisingly consistent. Attackers can repeatedly query an AI assistant, identify the hallucinated repository names it generates most frequently, register those repositories on GitHub or other software marketplaces, and embed malicious instructions inside them.
When another user later asks an AI coding assistant to clone the legitimate project, the assistant may instead retrieve the attacker-controlled repository. If the assistant has permission to execute commands automatically, embedded prompt injection instructions can direct it to download malware, execute scripts, or perform other malicious actions.
High hallucination rates increase the risk
According to the researchers, hallucinated resource names appeared in up to 85% of repository cloning scenarios and reached 100% during skill installation testing. More importantly, many hallucinations were transferable across different prompts and multiple foundation models, meaning attackers can predict the same incorrect resource names across several AI assistants.
The researchers describe this predictability as the key innovation behind HalluSquatting. Instead of waiting for users to make typing mistakes, similar to traditional typosquatting attacks, threat actors exploit AI systems that consistently generate the same incorrect repository names.
The study refers to this as adversarial hallucination squatting because attackers intentionally register hallucinated resources before legitimate developers have an opportunity to use those names.
From prompt injection to malware execution
The researchers describe HalluSquatting as combining two existing attack techniques into a single workflow.
First, the AI assistant hallucinates an incorrect repository or package identifier. After retrieving the attacker-controlled resource, hidden prompt injection instructions manipulate the assistant into executing additional commands using its built-in tools.
The diagram below illustrates the HalluSquatting attack chain described in the research paper.
Rather than exploiting a software vulnerability, the attack abuses the permissions already granted to modern AI coding assistants. Many agentic development tools can access the terminal, download files, install software, and execute scripts on behalf of the user.
Researchers recommend stronger verification
The paper emphasizes that HalluSquatting is not tied to a single vendor or vulnerability. Instead, it stems from the way many LLM-powered applications resolve software resources and interact with external content.
To reduce the risk, the researchers recommend requiring AI assistants to verify repository names through live searches before cloning or installing resources, keeping human approval enabled before executing terminal commands, and avoiding fully autonomous execution modes that allow agents to run downloaded code without review.
The researchers also suggest repository hosting platforms could proactively reserve or block commonly hallucinated repository names, similar to defenses already used against typosquatting attacks.
The team said affected vendors, foundation model providers, and marketplace operators were notified before publication, and implementation details that could directly facilitate exploitation were intentionally withheld from the public research.
