HalluSquatting Exposes GitHub Copilot, OpenClaw, and Cursor to Botnet-Scale RCE

What HalluSquatting Actually Is

The name is a portmanteau of hallucination and typosquatting, and the analogy is precise. Typosquatting works by registering domains that look like legitimate ones, then waiting for users to mistype a URL. HalluSquatting works by identifying the package names, repository paths, or resource identifiers that an LLM is likely to hallucinate—and then registering those resources before anyone else does.

Once an attacker controls the squatted resource, they embed adversarial prompts inside it. When a user triggers a query that causes the LLM to reference that resource, the malicious content is fetched automatically. The LLM does not flag this as suspicious. From its perspective, it found what it was looking for.

The Push-Pull Combination

Earlier LLM-based malware relied primarily on pull-based attacks: a malicious prompt is placed on a website, and the LLM is coaxed into retrieving it, degrading its internal guardrails in the process.

HalluSquatting introduces a push component. The researchers describe a combined attack chain:

1. The attacker identifies a resource identifier the LLM is statistically likely to hallucinate.
2. The attacker registers that resource and embeds adversarial instructions.
3. A user triggers a routine query involving that resource.
4. The LLM fetches the squatted resource and executes the embedded instructions—a promptware attack.
5. The attacker achieves remote tool execution or full RCE on the user’s device.

The paper states directly:

“By preemptively registering hallucinated resources, we demonstrate remote tool execution and remote code execution at scale across a range of popular agentic LLM applications, which could be exploited to the establishment of a botnet.”

Which Tools Were Tested

The researchers tested this attack vector against a range of widely used AI coding assistants and agents. Tools confirmed in the testing scope include:

• GitHub Copilot
• Cursor and Cursor CLI
• Windsurf
• Cline
• Gemini CLI
• OpenClaw, ZeroClaw, and NanoClaw

In each case, the researchers achieved either remote tool execution—effectively gaining control over the LLM’s tool-use capabilities—or full remote code execution on the host machine. Neither outcome requires the user to do anything unusual. A standard coding workflow is sufficient.

Why This Is Structurally Difficult to Fix

The attack surface here is not a single misconfigured endpoint. It is the fundamental behavior of LLMs when operating as agents with access to external resources.

Mitigations proposed by the researchers include blocking fetch operations in favor of controlled search tools, and enforcing globally unique, strict naming conventions for packages and repositories. Both are reasonable in principle. Both require coordinated action across LLM developers, package registry operators, and open-source maintainers—parties that do not share a single governance structure or incentive timeline.

That coordination gap is the real vulnerability. The technical fix is knowable. The organizational fix is harder.

The Broader Threat Trajectory

HalluSquatting does not exist in isolation. The researchers note that LLM-based malware is already appearing in the wild. The most advanced documented example is JADEPUFFER, a fully LLM-orchestrated ransomware attack—not merely AI-assisted malware, but a ransomware campaign run end-to-end by a language model.

HalluSquatting represents a different threat profile: passive, scalable, and triggered by normal user behavior rather than targeted exploitation. A botnet built on hallucinated package names does not need to compromise a single server. It needs only to wait.

What This Means for AI Tool Users Right Now

If you use any AI coding assistant that has access to external tools, package registries, or the ability to fetch resources from the web, your exposure is real and present. A few practical considerations:

• Audit tool permissions. Coding assistants that can fetch, install, or execute external resources without explicit confirmation represent a larger attack surface than those that require user approval at each step.
• Treat LLM-suggested packages with the same skepticism as any third-party dependency. Verify package names independently before installation, especially for less common libraries.
• Watch for updates from your tooling vendors. GitHub, Google, and the teams behind Cursor and Windsurf will need to respond to this research. Patch notes in the coming weeks are worth reading carefully.

The underlying problem—that LLMs hallucinate with enough consistency to be exploited predictably—is not going away. Until the ecosystem develops structural defenses, the burden of verification sits with the user.

For AI tool users, this is a reminder that convenience and autonomy in agentic systems also expand the security perimeter.