Researchers demonstrate new prompt-injection attack that exploits LLM hallucinations to build botnets at scale

A team of security researchers has demonstrated a new class of prompt-injection attack called HalluSquatting that exploits the inability of large language models (LLMs) to accurately locate resources, such as repositories or skills, specified in user prompts.

The attack targets AI coding assistants and agents—including Cursor, Cursor CLI, Gemini CLI, Windsurf, GitHub Copilot, Cline, OpenClaw, ZeroClaw, and NanoClaw—which routinely pull code and other resources from repositories and registries during normal operation. By registering malicious repositories that match predictable hallucination patterns produced by LLMs, attackers can deliver reverse shells or other malicious payloads to a large number of devices simultaneously, without having to target each victim individually.

The researchers found that LLMs hallucinate repository locations at high rates: up to 85% of the time when cloning repositories and 100% of the time when installing trending skills. These hallucinations are not random; they follow consistent, predictable patterns across multiple leading models, including Gemini-2.5-flash, Gemini-2.5-pro, GPT-5.1, GPT-5.2, Sonnet-4.5, and Opus-4.5. In particular, the team identified a self-referential pattern where models frequently generate repository identifiers in the form of repo-name/repo-name, treating the repository name as the owner.

To weaponize these hallucinations, the researchers registered repositories matching the most commonly hallucinated patterns for popular targets. These malicious repositories contained instructions to install reverse shells, which were then executed by the agentic applications when they pulled the squatted resources. Because the attack relies on LLMs retrieving the squatted resources during routine operations, it scales indiscriminately, enabling attackers to compromise large numbers of devices with minimal effort.

The researchers warn that HalluSquatting could enable a range of large-scale attacks, including botnets for DDoS or cryptocurrency mining, and ransomware campaigns, all without the need for traditional push-based targeting. They note that the attack is a first for prompt-injection techniques, which have historically been limited in scale by the need to target individual victims.

The work also draws a parallel to typosquatting, a long-standing attack in which adversaries register resources with names similar to popular ones to lure users. HalluSquatting adapts this concept to the context of LLM hallucinations, where the adversary exploits predictable errors in resource resolution rather than typographical closeness.