Prompt injection is AI’s biggest security problem. Here’s the thing: LLMs can’t tell the difference between a legitimate user request and malicious instructions hidden in emails, source code, or websites. They just follow orders.
Most attacks so far have been “push” — targeting individual victims one at a time. Limited scale. But researchers just unveiled something worse. Much worse.
It’s called HalluSquatting. And it changes everything.
Short for “adversarial hallucination squatting,” it exploits the fact that LLMs regularly hallucinate repository URLs. When you ask a coding agent to clone a repo or install a skill, the model just makes up a location. Up to 85% of the time for repos. 100% for trending skills. The researchers found that all six major LLMs — Gemini-2.5, GPT-5.1, GPT-5.2, Sonnet-4.5, Opus-4.5 — hallucinate in predictable patterns.
Attackers can predict those hallucinations, register the squatted names, and seed them with malicious code. Reverse shells, cryptominers, ransomware payloads — whatever they want. The affected tools include Cursor, Cursor CLI, Gemini CLI, Windsurf, GitHub Copilot, Cline, and others. These agents routinely access high-privilege terminals and pull code from registries.
The attack scales. That’s the scary part. No need to target individuals. Register the right squat, and every agent that hallucinates that URL gets infected. Large-scale botnets, DDoS attacks, cryptocurrency mining — all possible at a scale no prompt injection has achieved before.
The researchers call it a first for the field. Coding assistants that interact with shell commands are the primary vector. And since there’s no fix for hallucination — it’s inherent to how LLMs work — this isn’t going away anytime soon. Guardrails can mitigate, but they can’t solve the root cause.
