{"schema_version":"0.10.0","id":"LR-2026-0617","record_version":1,"title":"HalluSquatting: hallucinated resource names lead AI coding assistants to install botnet malware (research demonstration)","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":53.6,"score_breakdown":{"source_authority":12.1,"independent_corroboration":15.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":4.8,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"confirmed","reason":"2 independent outlets","original_document":null,"reports_total":2,"reports_independent":2,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"confirmed","reason":"2 independent outlets"}]},"sources_hash":"750f77e1a89722e02e9a6622ab6d0eeaece7850256a53e79ae9f340401f41bf5"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":["terminal"],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"research","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-07-08","incident_class":"security_compromise","failure_class":"injection_triggered","agent_involved":true,"secondary_failure_classes":[],"trigger":"prompt_injection","duration":null,"detection_method":"unknown","summary":"Researchers from Tel Aviv University, Technion and Intuit studied AI coding assistants that can fetch outside resources and run commands. The team found that these assistants often invent resource names that do not exist, and that an attacker could register such a name and hide instructions inside it. When a user asked for a popular resource, the assistant could fetch the attacker's version instead and follow its hidden instructions, using its command-running tool. In tests the assistant ran attacker-supplied code on the machine, using harmless placeholder payloads. The hallucination rates reported reached up to 85 percent in repository cloning and 100 percent in some skill installs. The team says it notified affected vendors, model makers and marketplace operators before publishing, and withheld the exact steps.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK14","secondary_risks":["RK01","RK06"],"remediations":[{"by":null,"kind":"advice","date_reported":null,"controls_added":["I7"],"quote":"The most effective fix is also the simplest: make the assistant search before it fetches.","source_index":0,"reviewed":false},{"by":null,"kind":"advice","date_reported":null,"controls_added":["G3"],"quote":"No single switch closes this, so also verify that a repository or package name resolves to the real, expected source before an agent pulls it in, and treat any name an AI hands you as a guess, not a fact.","source_index":0,"reviewed":false}]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"negligible","severity_because":"Negligible test: the sources describe only test runs with harmless placeholder payloads and state no effect beyond the test systems","harm_class":["none_materialised"],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://thehackernews.com/2026/07/new-hallusquatting-attack-could-trick.html","publisher":"The Hacker News","date":"2026-07-08","type":"press","title":"New HalluSquatting Attack Could Trick AI Coding Assistants Into Installing Botnet Malware - The Hacker News","archived_url":null,"attachment":"first_report","independence":"independent"},{"url":"https://cybersecuritynews.com/hallusquatting-attack-poison-ai-coding-assistants/","publisher":"CyberSecurityNews","date":"2026-07-09","type":"press","title":"New HalluSquatting Attack Allows Hackers to Poison AI Coding Assistants Into Installing Botnet Malware - CyberSecurityNews","archived_url":null,"independence":"independent"}],"per_field_confidence":{"event.incident_class":"C","event.agent_involved":"C","event.failure_class":"C","event.trigger":"C","system.deployment_context":"C","system.tools_granted":"C","impact.harm_class":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.secondary_risks":"D","event.remediations":"C","event.summary":"C","system.autonomy_level":"D","event.detection_method":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"event.incident_class":[{"source_index":0,"quote":"Repeat it with a popular enough resource, and one planted name can reach many machines, which is why the researchers frame it as a way to assemble a botnet."}],"event.agent_involved":[{"source_index":0,"quote":"Anyone whose AI assistant can fetch an outside resource and then run commands with little human review is exposed."}],"event.failure_class":[{"source_index":0,"quote":"The second is a prompt injection: a booby-trapped instruction that hijacks the AI, so it follows an attacker instead of the user."}],"event.trigger":[{"source_index":0,"quote":"Here, the injection is the indirect kind, riding in on content the assistant fetches rather than anything the user types."}],"system.deployment_context":[{"source_index":0,"quote":"In tests, that path led the assistant to run attacker-supplied code on the machine."}],"system.tools_granted":[{"source_index":0,"quote":"It works because these assistants keep a terminal among their built-in tools, so once the planted instructions take over, \"install a bot\" is simply something the assistant can do."}],"impact.harm_class":[{"source_index":0,"quote":"The test payloads were harmless placeholders, not real malware; a live one would take the same path."}],"impact.severity":[{"source_index":0,"quote":"The test payloads were harmless placeholders, not real malware; a live one would take the same path."}],"impact.severity_because":[{"source_index":0,"quote":"The test payloads were harmless placeholders, not real malware; a live one would take the same path."}],"event.remediations":[{"source_index":0,"quote":"The most effective fix is also the simplest: make the assistant search before it fetches."},{"source_index":0,"quote":"No single switch closes this, so also verify that a repository or package name resolves to the real, expected source before an agent pulls it in, and treat any name an AI hands you as a guess, not a fact."}],"event.summary":[{"source_index":1,"quote":"The research, conducted by Aya Spira, Stav Cohen, Elad Feldman, Ron Bitton, Avishai Wool, and Ben Nassi from Tel Aviv University, Technion, and Intuit, reveals a novel exploitation path targeting agentic large language model (LLM) applications."},{"source_index":1,"quote":"Instead, it exploits a well-known limitation of LLMs: their tendency to hallucinate or generate incorrect resource identifiers when responding to user requests."},{"source_index":1,"quote":"Once identified, attackers preemptively register these fake resources and embed malicious instructions within them."},{"source_index":1,"quote":"The AI agent then retrieves this malicious resource, unknowingly introducing adversarial instructions into its execution flow."},{"source_index":0,"quote":"In tests, that path led the assistant to run attacker-supplied code on the machine."},{"source_index":0,"quote":"The test payloads were harmless placeholders, not real malware; a live one would take the same path."},{"source_index":1,"quote":"The study observed hallucination rates of up to 85 percent in repository cloning tasks and up to 100 percent in certain skill installation scenarios."},{"source_index":0,"quote":"The team says it told the affected vendors, model makers, and marketplace operators before going public, and held back the exact steps needed to copy the attack."}]},"notes_on_gaps":"This is a research demonstration; no in-the-wild incident, victim, or real loss is stated. The date of occurrence and the dates of the tests are not stated. The date disclosed is taken from the article date of source 0 (metadata), not from its text. The developer, model name and version, country, industry, and autonomy level are not stated. Severity was judged negligible because the sources describe only harmless placeholder test payloads. The root cause was judged adversarial_input, since hallucination is not a root cause option. The B1 and I7 outcomes and the C1 failure are inferred from the text. Safety layers such as Claude Code auto mode and Gemini CLI Conseca are mentioned only in general terms and were not linked to this incident. The remediations are advice from the sources, not reported changes, and the G3 mapping is my judgement. Marketplace scanner examples in the sources belong to other incidents and were excluded. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Confirmed (2 independent outlets)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"AI coding assistants that can fetch an outside resource and run commands were studied.","quote":"Anyone whose AI assistant can fetch an outside resource and then run commands with little human review is exposed.","source_index":0,"grade":"C"},{"step":"reached","text":"The hijacked assistant used its own command-running tool to carry out the planted instructions.","quote":"Its hidden instructions fold into what the assistant thinks it was told to do, and the hijacked assistant uses its own command-running tool to carry them out.","source_index":0,"grade":"C"},{"step":"done","text":"Tests used harmless placeholder payloads, not real malware.","quote":"The test payloads were harmless placeholders, not real malware; a live one would take the same path.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://thehackernews.com/2026/07/new-hallusquatting-attack-could-trick.html","https://cybersecuritynews.com/hallusquatting-attack-poison-ai-coding-assistants/"]},"analysis":{"sections":{"timeline":[{"text":"Researchers notified affected vendors and marketplace operators before going public.","quote":"The team says it told the affected vendors, model makers, and marketplace operators before going public, and held back the exact steps needed to copy the attack.","source_index":0,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://thehackernews.com/2026/07/new-hallusquatting-attack-could-trick.html","https://cybersecuritynews.com/hallusquatting-attack-poison-ai-coding-assistants/"]}}