A newly discovered cyberattack technique called HalluSquatting has revealed a serious security risk for developers who rely on AI coding assistants. Security researchers found that attackers can take advantage of AI-generated mistakes by creating fake software packages with names that AI models invent but do not actually exist. If developers trust these suggestions without checking them, they may unknowingly install malware instead of legitimate software. The attack could allow criminals to spread botnet malware, steal data, or compromise development environments.
The research showed that several popular AI coding assistants are affected because large language models sometimes “hallucinate” package names while generating code. Instead of recommending a real software dependency, the AI may confidently suggest a package that has never existed. Attackers can quickly register that fake package on public repositories before developers attempt to install it. Once installed, the malicious package can execute harmful code without raising immediate suspicion.
Unlike traditional typosquatting attacks that rely on users making spelling mistakes, HalluSquatting targets mistakes made by AI itself. The attacker does not wait for a developer to type the wrong package name. Instead, they exploit the AI’s tendency to generate believable but incorrect dependency names. Since many developers now use AI tools for faster coding, this creates a new software supply chain risk that did not exist before widespread AI adoption.
Researchers observed that the problem becomes more dangerous when developers practice “vibe coding,” where AI generates large portions of code with minimal human review. In these situations, developers may simply copy the installation commands suggested by the assistant without verifying whether every dependency is genuine. If a malicious package has already been uploaded under the hallucinated name, the system could download malware directly from a trusted package repository.
The study also found that advanced AI coding agents perform better than basic language models because they often verify packages using web searches, documentation, testing, or project analysis before making recommendations. However, even these smarter systems are not completely immune. Under complex coding tasks, they can still produce occasional hallucinated package names, leaving room for attackers to exploit the weakness.
Security experts explained that HalluSquatting could be used to distribute botnet malware capable of infecting multiple computers through software development workflows. Once installed, the malicious package could provide attackers with remote access, steal credentials, modify code, or add infected devices to a larger botnet. Since the malware is delivered through what appears to be a normal software dependency, it may bypass a developer’s initial suspicion.
To reduce the risk, researchers recommend that developers always verify package names before installation instead of blindly trusting AI-generated suggestions. Organizations should use dependency validation tools, Software Bills of Materials (SBOMs), vulnerability scanners, sandbox testing, and package verification systems. Human review remains an important layer of defense because automated AI recommendations should never be considered completely reliable for security-sensitive tasks.
The discovery of HalluSquatting highlights how the rapid adoption of AI coding assistants has introduced new cybersecurity challenges alongside productivity benefits. While AI can significantly speed up software development, it also creates fresh opportunities for supply chain attacks when its generated outputs are accepted without verification. Researchers believe organizations should combine AI-assisted coding with strong security practices to ensure convenience does not come at the cost of software safety.
Stay alert, and keep your security measures updated!
Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news
