--- title: ‘HalluSquatting’ Compromises AI Coding Agents to Install... description: Security researchers from Tel Aviv University, Technion, and Intuit have identified a new attack technique called 'HalluSquatting' that weaponizes AI... canonical: https://daily.dev/posts/hallusquatting-compromises-ai-coding-agents-to-install-malware-create-botnets-qkcjydbad twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: ‘HalluSquatting’ Compromises AI Coding Agents to Install Malware, Create Botnets | daily.dev og:description: Security researchers from Tel Aviv University, Technion, and Intuit have identified a new attack technique called 'HalluSquatting' that weaponizes AI... og:url: https://daily.dev/posts/hallusquatting-compromises-ai-coding-agents-to-install-malware-create-botnets-qkcjydbad og:image: https://api.daily.dev/og/posts/QKCJYdbaD.png og:image:alt: ‘HalluSquatting’ Compromises AI Coding Agents to Install Malware, Create Botnets og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # ‘HalluSquatting’ Compromises AI Coding Agents to Install Malware, Create Botnets **[DevOps.com](https://daily.dev/sources/devops)** · 5 min read · 2 upvotes · 1 comments ## Summary Security researchers from Tel Aviv University, Technion, and Intuit have identified a new attack technique called 'HalluSquatting' that weaponizes AI hallucinations to compromise developer systems. Attackers exploit the predictable tendency of AI coding agents (like GitHub Copilot, Cursor, and Gemini CLI) to hallucinate fake package or repository names. By pre-registering those predicted names with malicious payloads, attackers can silently deliver malware when an AI agent autonomously fetches the hallucinated resource. Tests showed an 85% hallucination rate for repository names and 100% for skill installations. The technique combines a promptware kill chain with a traditional malware kill chain, ultimately enabling remote code execution and botnet creation — all without any direct channel to the victim. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is HalluSquatting in the context of AI coding agents? HalluSquatting is an attack technique where adversaries predict the fake package, repository, or skill names that AI coding agents tend to hallucinate, then register those names and load them with malicious code. When a developer's AI agent pulls the hallucinated resource, it installs malware, which attackers can use to build a botnet by combining a prompt injection kill chain with a traditional malware kill chain. _Developers relying on AI agents for package installs can follow security research like this via daily.dev._ ### How often do AI coding agents hallucinate fake repository or package names? Researchers testing GitHub Copilot, Google's Gemini CLI, OpenClaw, NanoClaw, Windsor, and Cursor found these agents hallucinated false repository names 85% of the time, and the hallucination rate for skill installation hit 100%. Trending or recently uploaded resources were especially prone to hallucination because they weren't part of the LLM's training data. _Teams evaluating AI coding agent risk can track findings like these through daily.dev._ ### How does HalluSquatting differ from traditional typosquatting attacks? Typosquatting targets humans who might click a misspelled domain, while HalluSquatting targets AI agents that don't verify whether a hallucinated package or repository name is real before pulling it. It merges a promptware kill chain, where an adversarial prompt hijacks the LLM application, with a traditional malware kill chain that begins once the bot is installed via remote code execution. _Anyone assessing AI agent supply-chain risk can follow comparisons like this on daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@pdfopsdev** · 0 upvotes > Stripped of the branding, this is typosquatting with a new discovery channel — instead of guessing human typos, you predict the model's hallucinated names, which turns out to be far more repeatable (hence the 85-100% hit rate). The useful implication is that existing defenses mostly still apply: install only through a private registry proxy that refuses names not on an allowlist, and pin/lock everything, so an agent fetching a hallucinated package hits a wall instead of the open internet. The new wrinkle worth adding is a fetch-time check that a dependency existed before your agent first... ## Similar posts on daily.dev - [Hackers can use 9 of the most popular AI tools to assemble massive botnets](https://daily.dev/posts/hackers-can-use-9-of-the-most-popular-ai-tools-to-assemble-massive-botnets-j8cybjfqg) · Ars Technica · 13 upvotes · 4 comments - [Slopsquatting, Phantom Domains, and HalluSquatting Are the Same AI Attack](https://daily.dev/posts/slopsquatting-phantom-domains-and-hallusquatting-are-the-same-ai-attack-h28tgivyd) · BleepingComputer · 2 upvotes · 0 comments - [Slopsquatting: Your AI Invented a Package, and an Attacker Was Waiting](https://daily.dev/posts/slopsquatting-your-ai-invented-a-package-and-an-attacker-was-waiting-pz8bcrd9w) · DEV · 4 upvotes · 0 comments - [Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector](https://daily.dev/posts/phantom-squatting-ai-hallucinated-domains-as-a-software-supply-chain-vector-tfozy1c4i) · Unit 42 · 0 upvotes · 0 comments - [New Study Identifies 53 Slopsquatting Targets Across 5 Front...](https://daily.dev/posts/new-study-identifies-53-slopsquatting-targets-across-5-front--6t7a1jnzb) · Socket · 0 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#ai-agents](https://daily.dev/tags/ai-agents), [#ai-security](https://daily.dev/tags/ai-security), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/hallusquatting-compromises-ai-coding-agents-to-install-malware-create-botnets-qkcjydbad) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"‘HalluSquatting’ Compromises AI Coding Agents to Install Malware, Create Botnets","url":"https://daily.dev/posts/hallusquatting-compromises-ai-coding-agents-to-install-malware-create-botnets-qkcjydbad","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/hallusquatting-compromises-ai-coding-agents-to-install-malware-create-botnets-qkcjydbad"},"datePublished":"2026-07-13T08:21:35.012Z","dateModified":"2026-09-13T20:52:53.340Z","description":"Security researchers from Tel Aviv University, Technion, and Intuit have identified a new attack technique called 'HalluSquatting' that weaponizes AI...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e36046da6f3787b092220a2a949c4438?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e36046da6f3787b092220a2a949c4438?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"DevOps.com","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"DevOps.com","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/db8f2265cff0416c878c6e7e92bb8715","url":"https://daily.dev/sources/devops"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/hallusquatting-compromises-ai-coding-agents-to-install-malware-create-botnets-qkcjydbad","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"cyber,ai-agents,ai-security,prompt-injection","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"DevOps.com","item":"https://daily.dev/sources/devops"},{"@type":"ListItem","position":3,"name":"‘HalluSquatting’ Compromises AI Coding Agents to Install Malware, Create Botnets"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/hallusquatting-compromises-ai-coding-agents-to-install-malware-create-botnets-qkcjydbad","comment":[{"@type":"Comment","text":"Stripped of the branding, this is typosquatting with a new discovery channel — instead of guessing human typos, you predict the model’s hallucinated names, which turns out to be far more repeatable (hence the 85-100% hit rate). The useful implication is that existing defenses mostly still apply: install only through a private registry proxy that refuses names not on an allowlist, and pin/lock everything, so an agent fetching a hallucinated package hits a wall instead of the open internet. The new wrinkle worth adding is a fetch-time check that a dependency existed before your agent first named it — a just-registered package matching a fresh hallucination is the tell.","datePublished":"2026-07-13T18:16:22.339Z","url":"https://daily.dev/posts/QKCJYdbaD#c-NjJ30Xq0u","author":{"@type":"Person","name":"PDFops","url":"https://daily.dev/pdfopsdev","image":"https://media.daily.dev/image/upload/s---8isRBKc--/f_auto/v1782922291/avatars/avatar_orjMeK8QKaaVZwGq7ScPz?_a=BAMAMicg0"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/hallusquatting-compromises-ai-coding-agents-to-install-malware-create-botnets-qkcjydbad#faq","mainEntity":[{"@type":"Question","name":"What is HalluSquatting in the context of AI coding agents?","acceptedAnswer":{"@type":"Answer","text":"HalluSquatting is an attack technique where adversaries predict the fake package, repository, or skill names that AI coding agents tend to hallucinate, then register those names and load them with malicious code. When a developer's AI agent pulls the hallucinated resource, it installs malware, which attackers can use to build a botnet by combining a prompt injection kill chain with a traditional malware kill chain. Developers relying on AI agents for package installs can follow security research like this via daily.dev."}},{"@type":"Question","name":"How often do AI coding agents hallucinate fake repository or package names?","acceptedAnswer":{"@type":"Answer","text":"Researchers testing GitHub Copilot, Google's Gemini CLI, OpenClaw, NanoClaw, Windsor, and Cursor found these agents hallucinated false repository names 85% of the time, and the hallucination rate for skill installation hit 100%. Trending or recently uploaded resources were especially prone to hallucination because they weren't part of the LLM's training data. Teams evaluating AI coding agent risk can track findings like these through daily.dev."}},{"@type":"Question","name":"How does HalluSquatting differ from traditional typosquatting attacks?","acceptedAnswer":{"@type":"Answer","text":"Typosquatting targets humans who might click a misspelled domain, while HalluSquatting targets AI agents that don't verify whether a hallucinated package or repository name is real before pulling it. It merges a promptware kill chain, where an adversarial prompt hijacks the LLM application, with a traditional malware kill chain that begins once the bot is installed via remote code execution. Anyone assessing AI agent supply-chain risk can follow comparisons like this on daily.dev."}}]} ```