New HalluSquatting Attack Could Trick AI Coding Assistants Into Installing Botnet Malware

Researchers have discovered a new attack method called HalluSquatting that exploits the tendency of AI coding assistants to generate fictional project names. When asked to fetch a popular tool, these assistants may provide a realistic-sounding name for a non-existent project. Attackers can use this behavior to their advantage by registering the fake names generated by the AI, creating a trap that the assistant may fetch and install on a user's system. This trap can potentially lead to the installation of botnet malware. The attack relies on the AI's predictable generation of fake project names, allowing attackers to prepare and register these names in advance. By doing so, attackers can deceive the AI coding assistant into installing malicious software.