Researchers Uncover HalluSquatting Attack That Turns AI Assistants Into Botnets
Security researchers have unveiled a novel prompt injection attack dubbed HalluSquatting that exploits large language models' tendency to hallucinate resource identifiers. Unlike traditional push-based attacks that require targeting individual victims, this pull-based approach lures AI coding assistants and agents to malicious resources during their normal operations, potentially enabling the assembly of massive botnets and large-scale DDoS attacks for the first time in the prompt injection landscape.
The attack affects nine popular AI coding tools including Cursor, GitHub Copilot, Gemini CLI, Windsurf, and several others. These assistants routinely pull code and resources from repositories and registries as part of their day-to-day functionality. HalluSquatting leverages this behavior by planting adversarial prompts at locations the LLMs are likely to access, weaponizing the models' inability to reliably distinguish between trusted and untrusted sources or to simply admit when they do not know something.
The discovery highlights a fundamental and ongoing weakness in LLM architecture that elaborate guardrails have so far failed to resolve. As AI coding assistants become increasingly embedded in software development workflows, the attack surface grows correspondingly larger. Researchers warn that until AI engine developers address the root cause of the trust boundary problem, pull-based attacks like HalluSquatting remain a scalable and serious threat to systems relying on agentic AI tools.