In the short history of AI security, rapid injection has quickly become the top threat. Large language models are inherently unable to distinguish between legitimate instructions provided by users and malicious instructions introduced in emails, source code, and other third-party content that the models are processing. This makes it trivial to surreptitiously inject malicious commands that are easily followed by the LLM.
With no way to enforce this crucial boundary between trusted and untrusted sources, AI engine developers must erect elaborate guardrails designed to mitigate damage rather than resolve the root cause.
To date, most immediate injections fall into a class known as nudges, in which each potential victim is targeted. For example, the adversary injects malicious instructions into an individual email or calendar invite. Because the injection must be sent (or pushed) to each specific target, the scale of the attack is limited, making massive exploits that affect the Internet at large difficult.
Meanwhile, pull-based attacks, in which an LLM actively searches for adverse cues placed on websites, remain limited. Since there is no way to attract a large number of LLMs to a malicious site, these types of attacks do not scale either.
Enter HalluSquatting
Now, researchers have come up with an extraction-based attack that changes all that. A new attack that researchers have dubbed HalluSquatting has the potential to assemble massive botnets, conduct large-scale DDoS attacks, and infect devices at scale, a first for rapid injection attacks. The attack works against AI coding agents and assistants, including Cursor, Cursor CLI, Gemini CLI, Windsurf, GitHub Copilot, Cline, OpenClaw, ZeroClaw, and NanoClaw, all of which are susceptible. In the normal course of daily activities, these helpers and agents routinely extract code and other resources from repositories and registries.
The HalluSquatting threat model.
Credit: Spira et al.
The HalluSquatting threat model.
Credit: Spira et al.
HalluSquatting, short for adversarial hallucination squatting, is based on an LLM’s inherent tendency to hallucinate the identifiers of resources hosted in repositories and registries. It works against agents and coding assistants, which commonly access command lines with high privileges to execute code from third-party resources. By predicting the identifiers that LLMs are most likely to hallucinate and then recording and seeding them with instructions to install reverse shells or other malicious products, the attack can indiscriminately infect a large number of devices without having to target each one of them.
