Researchers at Tel Aviv University, Technion and Intuit have published a prompt-injection technique that turns nine popular AI coding tools — Cursor, Cursor CLI, Gemini CLI, Windsurf, GitHub Copilot, Cline, OpenClaw, ZeroClaw and NanoClaw — into a delivery mechanism for large-scale botnets, ransomware and DDoS attacks. The technique, called HalluSquatting, exploits a measurable property of frontier models: when asked to clone a trending repository, the underlying LLM hallucinates the wrong location up to 85% of the time, and for trending skills the hallucination rate hits 100%.
The attack is the first pull-based prompt injection that scales. Earlier injections had to be pushed to each victim through an email or calendar invite. HalluSquatting inverts that: attackers pre-register the wrong names the models are most likely to invent, seed those repositories with reverse-shell payloads, and wait for coding agents across the internet to fetch them.
The measurement work is the more damaging half of the paper. Across Gemini-2.5-flash, Gemini-2.5-pro, GPT-5.1, GPT-5.2, Sonnet-4.5 and Opus-4.5, hallucinated repository slugs follow predictable patterns — most commonly a self-referential owner/repo form where the model treats the repository name as its own GitHub owner. Over 100 queries per (target repository, foundational LLM) combination, the researchers found the top hallucinated owner is stable enough to squat without probing the model at all.
Key facts
- 01HalluSquatting works against Cursor, Cursor CLI, Gemini CLI, Windsurf, GitHub Copilot, Cline, OpenClaw, ZeroClaw and NanoClaw.
- 02AI coding agents hallucinate a repository's correct location up to 85% of the time and hallucinate trending skill locations 100% of the time.
- 03Mean hallucination rate is 0.9% for repositories published before 2019 but 92.4% for those published in 2025.
- 04The pattern holds across Gemini-2.5-flash, Gemini-2.5-pro, GPT-5.1, GPT-5.2, Sonnet-4.5 and Opus-4.5.
- 05A 2016 typosquatting campaign of 214 booby-trapped packages ran 45,000 times across 17,000 domains, with more than half gaining admin rights.
The date effect is stark. Repositories published before 2019 resolve with a mean hallucination rate of just 0.9%. Repositories published in 2025 — exactly the ones absent from training data and pulled most often by developers chasing new tools — carry a mean hallucination rate of 92.4%. The models fail hardest on the resources developers most want to install.
“The scalable property of the attack enables the attacker to compromise a large number of users with minimal effort by targeting popular resources, thereby maximizing the likelihood that the squatted resource will be retrieved”— Aya Spira, Researcher, Tel Aviv University
Once an attacker has the list of likely hallucinated names, the workflow is mechanical. Register the name on GitHub or a package registry, upload a repository or skill that mimics the trending resource, and embed an instruction in the readme telling the coding agent to install a reverse shell. The agent, running with terminal access, complies. Alternatively the payload can be shipped as code the agent will execute directly.
The paper's authors — Aya Spira, Elad Feldman, Avishai Wool and Ben Nassi of Tel Aviv University, Stav Cohen of Technion, and Ron Bitton of Intuit — spell out the outcomes an attacker can chain from this primitive. Aggregating compromised developer machines yields a botnet suitable for cryptocurrency mining in the mold of Smominru, DDoS campaigns in the mold of Mirai, or coordinated ransomware runs across the networks those developers can reach.
The historical benchmark for scale is the 2016 typosquatting incident, when a college student uploaded 214 booby-trapped packages to PyPI, RubyGems and NPM. That code executed more than 45,000 times across more than 17,000 separate domains, and more than half of those executions ran with administrative rights. HalluSquatting swaps human typos for LLM hallucinations, and the surface area is larger because every AI coding agent instance is a fresh potential victim.
Independent researcher Johann Rehberger flagged the deeper implication: LLM resource resolution itself is now an attack path, and attackers can probe models offline to build a catalog of high-probability hallucinated names before registering a single one.
There is no obvious fix at the model layer. The researchers describe the hallucinations as an inherent product of training biases and context misinterpretation, not a bug to be patched. Registries could block newly created packages whose names collide with popular real ones, and coding agents could refuse to execute code from repositories below an age or star threshold — but both mitigations tax the exact workflow, installing new trending tools, that developers use these agents for.
The commercial consequence lands on the vendors of the nine affected products. Every agent that runs a shell command on behalf of a natural-language request is now shipping a supply-chain attack surface that scales with model popularity rather than with victim targeting. Cursor, GitHub Copilot and Gemini CLI have built their pitch on autonomous execution; that autonomy is precisely what HalluSquatting monetizes for the attacker. Expect the next round of agent releases to add verified-publisher gating, pinned resource lists and human-in-the-loop confirmation for any install command — and expect a measurable dip in the frictionless demo that has driven adoption to this point.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
