AI coding assistants can be tricked into installing botnet malware, researchers find

Security researchers have shown that popular AI coding assistants, including Cursor, GitHub Copilot and Windsurf, can be fooled into installing fake, attacker-controlled software packages instead of the real ones. The technique, named HalluSquatting, exploits a well-known AI weakness: these tools sometimes invent a plausible-sounding but non-existent package name, and an attacker who registers that exact fake name first can plant malicious instructions inside it. In tests, the researchers used this to get several AI assistants to run their code automatically, and argue the same method could be used at scale to build a botnet, a network of infected devices. It's a disclosed research finding with real substance behind it, not evidence of an active attack campaign against users today, but the underlying risk is real for anyone who lets an AI assistant fetch and run things with little oversight.

This piece reflects reporting as of 20 July 2026, around two weeks after the research was first disclosed. Figures describing how often the tools hallucinate are the research team's own, and are flagged below.

What HalluSquatting actually does

AI coding assistants are known to "hallucinate": when asked to do something involving an external resource, such as cloning a code repository or installing a plug-in, they sometimes make up a name that sounds right but doesn't exist. This isn't the first sign of the underlying pattern in the wild: it echoes "slopsquatting," where attackers register the fake package names that AI tools commonly invent. In January 2026, a researcher at Aikido Security found a made-up package called react-codeshift that AI-written instructions had already spread into 237 real code projects, with AI tools still trying to install it daily. He registered the name himself before an attacker could, so it caused no harm that time, but it showed the hallucinated name was already being requested at scale.

HalluSquatting, disclosed by researchers at Tel Aviv University, Technion and Intuit, takes the same idea further. Rather than waiting to spot a hallucination by accident, the attackers systematically probe an AI model with common developer requests ("clone this trending repository", "install this skill") and record which fake name it invents most often. They then register that exact name on a real platform, such as GitHub or an AI "skill" marketplace, and hide malicious instructions inside it. When a real user later asks their own AI assistant to fetch the same trending resource, the assistant makes the same predictable mistake, pulls down the attacker's version, and its hidden instructions take over what the assistant does next. Because these coding assistants keep a terminal among their built-in tools, "install a bot" becomes something the hijacked assistant can simply carry out.

Which tools were tested, and how well the trick worked

The researchers say they demonstrated the attack against nine agentic AI applications: Cursor, Cursor CLI, Windsurf, GitHub Copilot, Cline, Google's Gemini CLI, and the OpenClaw, ZeroClaw and NanoClaw assistants. They report hallucination rates reaching up to 85% for repository-cloning prompts and up to 100% for "skill" installations, and say the same fake names tended to recur across AI models built by different companies, which is what would make one squatted name effective against a wide range of tools at once. These figures come from the research team itself; they have not yet been independently reproduced by a third party, and the researchers themselves describe them as a floor rather than a ceiling, saying plainly: "Attacks always get better; they never get worse."

It's worth being precise about what was actually shown. The team registered a real but harmless repository and a real but harmless "skill", not live malware, and used them to demonstrate that a hijacked assistant would run attacker-supplied commands. That is a meaningful proof that the door is open, but it is a controlled demonstration, not a confirmed botnet already operating against real users. They say they disclosed the issue to the affected vendors, the underlying AI model makers, and the relevant marketplace operators before publishing, and deliberately withheld some implementation details that could make the attack easier to copy.

AI coding assistants can be tricked into installing botnet malware, researchers find

Why researchers call it a new kind of botnet

Traditional botnets, like the well-known Mirai network of hijacked security cameras, usually spread by exploiting weak passwords or software bugs, and tend to compromise one type of device at a time. The researchers argue an "agentic botnet" would look different: it needs no weak password and no self-spreading code, it isn't the kind of network traffic a firewall is built to catch, because the malicious payload arrives as ordinary-looking text an AI reads, and it could in theory land on any device running any operating system, since it rides on whatever AI assistant happens to be fetching things on a person's behalf. That heterogeneity, rather than any single technical exploit, is what makes the idea notable to security researchers, even though no such botnet has been confirmed in the wild.

We found no evidence, at the time of writing, that any of the nine named tools' developers have issued a public patch note, advisory or CVE specifically addressing HalluSquatting. The researchers say there isn't really a single bug to patch here, since they frame the weakness as systemic: it's about how agentic AI tools trust names they were never actually given by a human, rather than a flaw in one product.

What you can actually do about it

The core condition that makes this attack work is an AI assistant that can fetch something from the internet and then run it with little or no human review. Closing that gap is the most effective defence available right now, and most of the practical steps sit with the person using the tool rather than the vendor:

Don't run AI coding tools in fully unattended "auto-approve" modes on anything they've just fetched from the internet. Modes that skip permission prompts remove the one check that currently catches most of this.
Check a package or repository name before accepting it, especially if it's new, unfamiliar, or was suggested by the AI rather than something you searched for yourself. A quick look at the project's actual page, download count, or maintainer history takes seconds and catches an obvious fake.
Treat any name an AI assistant hands you as a guess, not a fact, particularly for anything trending or very recently uploaded, which the researchers note is exactly when a model is most likely to be guessing rather than recalling something it actually knows.
Don't assume a marketplace's safety scanning has caught the bad ones. Independent researchers at Trail of Bits showed they could slip malicious AI "skills" past several store scanners in under an hour, so a listing being available is not proof it's safe.

The UK angle: this fits a pattern regulators are already flagging

There's no UK-specific response to HalluSquatting itself, but the underlying problem is one the UK's National Cyber Security Centre has been actively warning about. The NCSC has argued that prompt injection is a harder problem than it looks, because large language models don't cleanly separate "instructions" from "data" the way older software does, so there may never be a single fix that closes it off completely. Separately, the NCSC's guidance on what it calls the "vibe coding spectrum" recommends matching the level of human review to how sensitive the code is, and giving AI coding assistants less autonomy the more consequential the task. Neither piece of guidance was written in response to this specific story, but both describe exactly the gap HalluSquatting exploits: an AI tool trusted to act with minimal checking.

FAQ

What is HalluSquatting?

It's a technique where attackers work out which fake package or repository names an AI coding assistant is likely to invent, then register those names first and hide malicious instructions inside them, so the assistant fetches the attacker's version instead of a real one.

Which AI tools are affected?

Researchers demonstrated the attack against Cursor, Cursor CLI, Windsurf, GitHub Copilot, Cline, Google's Gemini CLI, and the OpenClaw, ZeroClaw and NanoClaw assistants. The researchers describe the underlying weakness as common to any AI coding tool that can fetch outside resources and run a terminal, so it isn't necessarily limited to these nine.

Has this actually been used to attack real users?

Not that we found evidence of. The researchers demonstrated the technique using harmless test payloads under controlled, responsibly disclosed conditions. It shows the attack is practical, not that a live campaign is currently under way.

Do I need to stop using AI coding tools?

No. The practical fix is oversight, not avoidance: avoid fully unattended auto-run modes on anything just fetched from the internet, check unfamiliar package or repository names before accepting them, and treat AI-suggested resource names as guesses rather than facts.

Is there a patch coming?

We found no vendor-issued patch, advisory or CVE specifically addressing HalluSquatting at the time of writing. The researchers frame it as a systemic weakness in how AI agents trust hallucinated names, rather than a single bug in one product, and say they've disclosed their findings to the affected vendors, model makers and marketplace operators ahead of publication.

The takeaway

HalluSquatting is a genuine and well-documented weakness in how today's AI coding assistants handle the resources they fetch on your behalf, and the research behind it is solid: named, affiliated academics, a public disclosure page, and a responsible-disclosure process. What it isn't, at least not yet, is proof of an active botnet built from ordinary users' machines. The honest read is that this is a capability researchers have demonstrated under controlled conditions, with headline figures that come from the researchers themselves and haven't been independently verified elsewhere. For anyone using these tools, the sensible response isn't panic, it's the same habit that protects against most software supply-chain risk: don't let an AI assistant run things unattended, and check a name before you trust it.

Sources

================================================================ END