HalluSquatting

What it is

HalluSquatting, research from Aya Spira and colleagues in Ben Nassi's group at Tel Aviv University (with Stav Cohen at Technion and Ron Bitton at Intuit). It weaponizes the specific, repeatable fake names AI assistants invent for trending resources: the attacker learns the name, registers it on GitHub or a plugin store with hidden adversarial instructions inside, and waits for a real user's assistant to fetch the trap. Tested against Cursor, Windsurf, GitHub Copilot, Cline, Gemini CLI, and OpenClaw-family assistants, each was made to run attacker-supplied code.

How it works

It chains two AI quirks. First, a hallucination: for a trending resource too new to be in training data, models guess at names — and guess consistently, reaching for the same wrong name across phrasings and vendors. Second, an indirect prompt injection: the malicious instructions ride in on the content the assistant fetches (not user input) and fold into what the assistant thinks it was told to do. The payload is not self-executing code; it works because these agents keep a terminal among their built-in tools, so "install a bot" becomes something the hijacked assistant simply does. One popular planted name can reach many machines of any OS — the authors frame it as a firewall-invisible way to assemble a botnet.

Preconditions / Affected

The whole attack turns on one condition: an agent that fetches an outside resource and runs it with no human checking. By default these agents ask before running commands; the exposure is the auto-run modes that switch that off — Claude Code's skip-permissions flag and Gemini CLI's yolo mode are named. Targets must be trending enough that many users ask their AI to fetch them.

What to do

• Don't let an agent run unattended on anything it fetched — avoid skip-permissions / yolo auto-run modes.
• Make the assistant search before it fetches (the fix the authors call most effective and simplest): a real lookup grounds the agent in what exists and sharply cuts guessing. This is primarily a job for tool builders, who can also train the planner to look a resource up first and treat words like clone, install, and fetch as flags.

Caveats

• Reported rates are peaks: the same wrong name in up to 85% of repository requests and 100% of skill installs; the paper carries the full breakdown.
• Test payloads were harmless placeholders, not real malware.
• The team disclosed to affected vendors, model makers, and marketplace operators before publishing and withheld the exact reproduction steps.
• Marketplace screening is weak backup: in June, Trail of Bits slipped malicious "skills" past several store scanners in under an hour. The page text is truncated ("Some t…"), so further mitigations may exist beyond what is shown.