HalluSquatting Attack Exploits AI Hallucinations to Build Botnets

As AI coding assistants become more widespread, hackers are targeting one of their core weaknesses: hallucinations. A new attack known as “HalluSquatting” exploits large language models’ tendency to predict and invent nonexistent repository names when given unfamiliar instructions. Because many development assistants can execute terminal commands, attackers can register the fabricated repositories in advance and seed them with malicious code, causing the tools to automatically download malware and enabling remote control of victims’ systems.

Research published on July 10, 2026, by Tel Aviv University, the Technion–Israel Institute of Technology and cybersecurity company Intuit found that AI generated certain fabricated names in installation scenarios with a probability of up to 100%, while the repository repetition rate reached 85%. No specific financial losses from this type of attack have been reported, but tools including Cursor and GitHub Copilot have been confirmed to be affected.