HalluSquatting: How AI code assistants may inadvertently install botnet malware

Colleagues, I’d like to draw your attention to a new cybersecurity threat: HalluSquatting.

I see a dangerous chain here: an AI code assistant “guesses” a tool name, the attacker registers that name in advance, and the assistant then pulls in a malicious package or plugin on its own.

From there, the scenario gets even worse:
- the assistant receives hidden instructions from the spoofed resource;
- executes commands with minimal verification;
- may install botnet malware on the user’s machine.

Why this matters: the risk does not stem from a vulnerability in code, but from trust in a name the AI itself invented.

How would you assess this — is it already a new wave of supply chain attacks?
#cybersecurity #AI #SupplyChain #Malware