New Hallu Squatting Attack Could Trick AI Coding Assistants Into Installing Botnet Malware
Summary: Researchers Aya Spira and colleagues in Ben Nassi's group at Tel Aviv University, with Stav Cohen at Technion and Ron Bitton at Intuit, described a technique they call HalluSquatting: identify the fake package or repository names an AI coding assistant reliably invents, register them first, and let the assistant fetch the trap. In tests against Cursor, Windsurf, GitHub Copilot, Cline, Google's Gemini CLI, and the OpenClaw family, the assistants reached for the same wrong name in up to 85% of repository requests and 100% of skill installs, and each was made to run attacker-supplied code, with harmless placeholder payloads rather than real malware.
Key Takeaway: The attack needs no passwords and no worming, and because the payload arrives as text the AI reads rather than a network exploit, a firewall is not watching for it - the researchers frame the result as a way to assemble a botnet, and call their rates a lower bound.
Read the original at The Hacker News ↗
- Topics
- AI Security
- Related
- SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 8 Cyber Risks · Nov 15, 2026Pentagon Renames CDAO ‘Super Intelligence Office’ Cyber Risks · Nov 15, 2026186 Fake AI Domains Redirect Users to Click Fix Lures, Browser Malware, and Search Hijackers Cyber Risks · Nov 12, 2026