Definition
HalluSquatting is a pull-based prompt-injection attack exploiting LLM hallucinations of nonexistent package, repository, or skill identifiers. Attackers pre-register predicted hallucinated names with malicious payloads; when coding-agents fetch them, reverse shells and botnet code execute via high-privilege terminals.
Key Points
- First pull-based prompt injection achieving botnet scale (vs push-based email/calendar injection)
- Researchers: Tel Aviv University, Technion, Intuit (July 2026)
- Affected tools: cursor, Gemini CLI, Windsurf, github-copilot, Cline, OpenClaw, ZeroClaw, NanoClaw
- Hallucination rates: 85–100% for trending resources; 92.4% mean for 2025 repos vs 0.9% pre-2019
- Outcomes: ransomware at scale, crypto mining (Smominru-style), DDoS botnets (Mirai-style)
Mitigation
- Verify package sources before install; pin dependencies
- Disable auto-install in agent configurations
- Treat agent terminal access as production security boundary