How the Attack Works
Researchers from Tel Aviv University, Technion, and Intuit have identified a new attack technique called HalluSquatting that targets AI coding assistants. The method exploits a known weakness in large language models: their tendency to generate false or hallucinated resource names when responding to developer prompts. Attackers first study popular repositories, tools, and skills that developers frequently request through AI assistants. They then probe the LLM to find which hallucinated names it is likely to produce. Once identified, the attackers register those fake resources and embed malicious instructions within them.
When a developer asks the AI to clone a repository or install a package, the assistant may retrieve the attacker controlled resource instead of the legitimate one. The poisoned resource then injects adversarial commands into the AI’s execution flow. This allows the attacker to run arbitrary code or tools on the developer’s machine, effectively installing malware.
Impact and Scope
The researchers demonstrated that HalluSquatting can be scaled to create a botnet, giving attackers remote control over compromised devices. The study found hallucination rates as high as 85 percent in repository cloning tasks and up to 100 percent in skill installation scenarios. Critically, these hallucinations transfer across different LLM models and applications, broadening the attack’s potential reach.
This technique shifts the economics of supply chain attacks. Instead of trying to compromise popular resources, which is difficult, or obscure ones with limited impact, attackers can reliably place malicious resources where AI systems are most likely to look. The team followed responsible disclosure practices, notifying affected vendors and platform maintainers while withholding sensitive implementation details. The findings underscore the urgent need for stronger validation mechanisms in AI driven development tools to prevent these systems from becoming vectors for widespread malware distribution.
Source: Cyber Security News
