Researchers have demonstrated a technique they call HalluSquatting, which turns the confident mistakes of AI coding assistants into a malware delivery channel, as reported by SecurityWeek. When an assistant hallucinates a package or command that does not exist, an attacker who registered that exact name in advance is waiting to serve code instead.

The mechanism is unsettling because it needs no bug in the model. Large language models regularly invent plausible-sounding dependencies, and they do it consistently enough that the same fake names recur. An attacker only has to watch for the names that get hallucinated often, claim them on a public registry, and fill them with malware. The developer trusts the assistant, runs the suggested install, and the trap closes.

In the demonstration, that path led all the way to remote code execution and enrollment into a botnet. It is a new spin on typosquatting, except the typo is not the human's, it is the machine's, and the human has been trained to trust it.

The defenses are old ones applied to a new habit. Verify that a package actually exists and is the one you meant before installing it, pin and review dependencies rather than pasting suggestions straight into a terminal, and treat an assistant's confident recommendation as a lead to check, not an instruction to run. Confidence is not correctness, and on a public registry that difference can be a backdoor.

Sources: SecurityWeek.