Researchers have identified a new attack method called HalluSquatting that exploits a fundamental vulnerability in how AI coding assistants obtain external resources. Because these AI tools frequently generate incorrect or non-existent resource identifiers when attempting to retrieve code from repositories, attackers can register those predicted names and populate them with malicious payloads. When the assistants carry out their normal operations and attempt to pull code, they unknowingly retrieve and execute the compromised versions instead.

Unlike previous prompt injection attacks that targeted individual users, HalluSquatting enables automated compromise of large numbers of devices with relatively little attacker effort. Nine widely-adopted AI development tools are vulnerable, including GitHub Copilot, Cursor, and Google's Gemini CLI. By embedding reverse shells and other malware into these fraudulent resources, adversaries could potentially orchestrate extensive ransomware operations, coordinate distributed denial-of-service attacks, or establish botnets for illicit purposes—representing a significant escalation in the risks posed by AI-assisted development platforms.