Researchers warn of HalluSquatting attacks on popular AI coding tools

In short: Researchers say a new attack called HalluSquatting can trick popular AI coding assistants into downloading and running harmful code at scale.

What happened

Security researchers described a technique they call HalluSquatting, short for “adversarial hallucination squatting.” It targets AI coding assistants and “agents” (tools that can take actions for you, like downloading code and running commands). The researchers say the method could let attackers infect many computers without picking targets one by one.

The idea relies on something many AI tools do wrong. When a user asks the assistant to “install” or “clone” a software project, the AI may guess the wrong location for it. This is a form of “hallucination,” which in plain terms means the AI makes something up instead of saying “I don’t know.” The researchers report that for newer and trending projects, models often guess wrong, and those wrong guesses tend to follow predictable patterns.

An attacker can register the made-up project name first, like grabbing a confusingly similar address before someone else does. Then, when an AI tool tries to fetch that project during normal work, it may pull the attacker’s version. The researchers say the attacker can hide instructions or code that installs a “reverse shell” (a back door that lets an attacker remotely control a computer).

Tools named as susceptible include Cursor, Cursor CLI, Gemini CLI, Windsurf, GitHub Copilot, Cline, OpenClaw, ZeroClaw, and NanoClaw.

Why it matters

If AI coding tools are allowed to run downloads automatically, a single fake project could spread widely, like a counterfeit part entering many repair shops at once. The researchers warn this could be used to build botnets (groups of hijacked computers) for attacks like DDoS (overwhelming a website with traffic) or to spread ransomware.

Source: Arstechnica