In the brief history of AI security, the prompt injection has quickly become the top threat. Large language models are inherently unable to distinguish between legitimate instructions provided by users and malicious ones sneaked into emails, source code, and other third-party content the models are processing.
To date, most prompt injections have fallen into a class known as push, in which each potential victim is targeted. Meanwhile, pull-based attacks, in which an LLM actively seeks out the adversarial prompts planted on websites, remain limited.
Enter HalluSquatting
Now, researchers have devised a pull-based attack that changes all that. A new attack the researchers have named HalluSquatting has the potential to assemble massive botnets, perform large-scale DDoSes, and infect devices at scale, a first for prompt-injection attacks. The attack works against AI coding assistants and agents, including Cursor, Cursor CLI, Gemini CLI, Windsurf, GitHub Copilot, Cline, OpenClaw, ZeroClaw, and NanoClaw, which are all susceptible.
Short for adversarial hallucination squatting, HalluSquatting is built on an LLM’s inherent tendency to hallucinate the resource identifiers hosted in repositories and registries. By predicting the identifiers LLMs are most likely to hallucinate and then registering and seeding them with instructions to install reverse shells or other malicious wares, the attack can indiscriminately infect massive numbers of devices without having to target each one.
“The scalable property of the attack enables the attacker to compromise a large number of users with minimal effort by targeting popular resources, thereby maximizing the likelihood that the squatted resource will be retrieved,” the researchers wrote in a paper published Wednesday.
LLMs don’t know how to say “I don’t know”
When a developer instructs a coding agent to clone a popular new repository, the LLM hallucinates its correct location up to 85 percent of the time. When cloning a trending “skill,” hallucinations can occur 100 percent of the time.
The inability of LLMs to provide the correct location is an inherent flaw that arises from training biases or from misinterpretations of instructions within the current context. All six major LLMs tested — Gemini-2.5-flash, Gemini-2.5-pro, GPT-5.1, GPT-5.2, Sonnet-4.5, and Opus-4.5 — follow common patterns when resolving repository or skill names.
LLMs correctly resolve repositories published before 2019 with a low mean hallucination rate of just 0.9 percent. The same LLMs fabricate slugs for repositories published in 2025 with a mean hallucination rate of 92.4 percent.
Once an attacker has identified names that are most likely to be hallucinated, they search for ones that can be registered, then upload a repository or skill that mimics the trending resource with buried instructions to install a reverse shell.
Researchers
The researchers are: Aya Spira, Elad Feldman, Avishai Wool, and Ben Nassi of Tel Aviv University, Stav Cohen of Technion, and Ron Bitton of Intuit.
By exploiting integrated shells and terminals of agentic applications to run scripts and code, attackers can effectively “infect” many independent agentic applications. Gaining access to distributed computational resources opens the door to large ransomware campaigns, cryptocurrency mining botnets, and DDoS attacks.
Michael Bargury, CTO of security firm Zenity, called the threat “very real” and compared it to typosquatting — a problem that won’t go away as long as agents retain high levels of agency.