Researchers have discovered HalluSquatting — a novel attack that weaponizes AI tool hallucinations to assemble botnets, conduct large-scale DDoS attacks, and launch ransomware campaigns at unprecedented scale.

Introduction: A New Threat in AI Security

In the short history of AI security, prompt injection has quickly become the dominant threat. But researchers from Tel Aviv University, Technion, and Intuit have discovered a new attack vector that turns LLM hallucination into a weapon: HalluSquatting.

The attack exploits a well-known limitation of large language models: they hallucinate. What if someone weaponizes those hallucinations to assemble botnets at unprecedented scale?

What Is HalluSquatting?

HalluSquatting is an attack technique where attackers select non-existent package names and predict that the LLM will generate these exact names as hallucinations. The attacker then publishes malicious code under those predicted names. When an AI assistant like Cursor, Copilot, or Claude Code suggests the hallucinated package, the user installs it — and the attacker's code runs on their machine.

This is not a theoretical attack. The researchers demonstrated it working against 9 popular AI tools and 6 major LLMs.

Nine Vulnerable AI Tools

The list includes: Cursor, Cursor CLI, Gemini CLI, Windsurf, GitHub Copilot, Cline, OpenClaw, ZeroClaw, and NanoClaw. All these tools can be tricked into generating commands that install malicious packages hallucinated by the underlying LLM.

Hallucination Rates: The Numbers

The researchers tested hallucination rates for package names from different time periods. For packages created before 2019, the hallucination rate was just 0.9%. For packages created in 2025, the hallucination rate skyrocketed to 92.4%. This is because LLMs are trained on more recent data and are more confident about recent package names — ironically making them more vulnerable to HalluSquatting.

From Hallucination to Botnet

The researchers demonstrated that this technique can be scaled to assemble a massive botnet capable of DDoS attacks, cryptomining, and ransomware distribution. The attack is "pull-based" — rather than pushing malware to victims, the attackers publish malicious packages to registries and let the AI tools pull them toward users.

What This Means for AI Security

This discovery has significant implications for how we think about AI security. It demonstrates that AI tools cannot be trusted blindly, especially in security-sensitive tasks. The researchers recommend using verified package registries and implementing additional validation layers.