A new cyberattack technique called HalluSquatting allows hackers to weaponize AI's tendency to hallucinate, enabling the creation of massive botnets. This pull-based attack exploits AI coding assistants and agents, such as Cursor, Gemini CLI, and GitHub Copilot, by predicting and registering resource identifiers that these models are likely to hallucinate. By seeding these predicted identifiers with malicious code, attackers can indiscriminately infect numerous devices without direct targeting, posing a significant threat to AI security. AI
IMPACT This attack highlights a new vector for large-scale cybercrime by exploiting inherent LLM behaviors, potentially impacting the security and trustworthiness of AI coding assistants.
RANK_REASON The cluster describes a new attack technique targeting existing AI tools, rather than a release from a frontier lab or a significant industry-wide event.
- Ars Technica
- Cline
- Cursor
- Cursor CLI
- Gemini CLI
- GitHub Copilot
- HalluSquatting
- NanoClaw
- OpenClaw
- Windsurf
- ZeroClaw
- botnet
- Mastodon
AI-generated summary · Google Gemini · from 6 sources. How we write summaries →
