HalluSquatting: AI Coding Assistant Hallucinations Weaponized to Deliver Botnet Malware via Fake Package/Tool/Skill Names — Threadlinqs Intelligence
As of 2026-07-10, HalluSquatting: AI Coding Assistant Hallucinations Weaponized to Deliver Botnet Malware via Fake Package/Tool/Skill Names is a medium-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 20 indicators of compromise.
Threat ID: TL-2026-1164 · Severity: MEDIUM · Status: ACTIVE · Category: VULNERABILITY
Academic researchers (Tel Aviv University, Technion, Intuit) demonstrated 'HalluSquatting' (aka Adversarial Hallucination Squatting), a class of scalable, untargeted promptware attacks that exploit AI
HalluSquatting was disclosed by researchers Aya Spira, Stav Cohen, Elad Feldman, Ron Bitton, Avishai Wool, and Ben Nassi (Tel Aviv University, Technion, and Intuit), the same group behind prior work on self-spreading AI email worms (Morris II) and Google Gemini calendar-invite prompt injection. The attack targets nine widely used AI coding assistants and CLIs: Cursor, Cursor CLI, Windsurf, GitHub Copilot, Cline, Google Gemini CLI, OpenClaw, ZeroClaw, and NanoClaw.
The attack chain runs in six phases: (1) Preparation — attackers identify trending repositories, tools, or skills and repeatedly probe target LLMs across varied phrasings and multiple foundation models to calculate the highest-probability hallucinated identifier for a given resource; (2) Trigger — a legitimate user asks their AI assistant to clone a repository, install a package, or install a 'skill'/plugin; (3) Planning — the agentic framework's planner formulates the actions needed to satisfy the request; (4) Hallucination — the underlying LLM outputs an incorrect resource name/location that happens to match the name the attacker has already registered; (5) Retrieval — the assistant's tool-use layer fetches the attacker-controlled resource (git clone, npm install, marketplace install) without verifying it resolves to a legitimate, previously-known source; (6) Context Poisoning & Tool Invocation — adversarial instructions embedded in the fetched resource are read into the assistant's context and, combined with auto-run/auto-execute terminal access, are executed as commands, installing a persistent bot agent on the victim's device.
Measured hallucination consistency was high enough to make the attack reliable at scale: up to 85% for repository-clone requests and up to 100% for skill/plugin install requests, with hallucinations transferring across different foundation models and prompt phrasings — meaning a single pre-registered squatted name can trap users of many different assistants. Researchers used only harmless placeholder payloads (not functional malware) for ethical/responsible-disclosure reasons, and withheld precise reproduction steps and target-specific hallucinated names from the public write-up; findings were privately disclosed to affected vendors, foundation model providers, and marketplace maintainers ahead of publication. The paper appears on arXiv as 2607.07433v1 and was presented at RWAISec'26 and discussed in a BlackHat webinar.
HalluSquatting builds on and generalizes 'slopsquatting', an earlier and now actively-exploited-in-the-wild variant limited to package-manager names. The canonical real-world slopsquatting case is 'react-codeshift': a nonexistent npm package name invented by an LLM that conflated two real tools (jscodeshift and react-codemod). The hallucinated name first appeared, unreviewed, in a single commit of 47 LLM-generated Agent Skills on GitHub, then propagated to 237 repositories via forks and translation (including into Japanese) before Aikido Security researcher Charlie Eriksen discovered and pre-registered it defensively; AI coding agents continued to attempt `npx` installs of the name daily even after Eriksen's claim. Separately, Palo Alto Networks Unit 42 catalogued roughly 250,000 unregistered domains that AI models hallucinate ('phantom squatting'), representing a large pre-existing pool of squattable names beyond code repositories/packages.
HalluSquatting represents an architectural trust weakness rather than a single software flaw: agentic coding tools resolve resource names supplied by an LLM as if they were ground truth, and then couple that unverified resolution to auto-execution/auto-run terminal capability. No CVE applies because the weakness is systemic across the agentic-AI-tooling category rather than isolated to one implementation.
Weaknesses (CWE)
CWE-1021, CWE-345, CWE-494, CWE-829
Target sectors: technology, software-development, all-sectors-using-ai-coding-tools
Target regions: Global
Detections & IOCs
As of 2026-08-25, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 20 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, MEDIUM, threat intelligence, cybersecurity, T1585, T1583.008, T1586, T1608.001, T1195.002, T1566, T1199, T1059, T1204.002, T1059.009
