AI coding assistants tricked into installing malware

Published July 6, 2026

AI coding assistants can be tricked into installing malicious code by attackers who exploit the AI's tendency to invent fake names for popular tools. This happens when the AI suggests a fake package or repository name instead of the real one, and the developer follows the suggestion without checking.

Report priority
High
Targets
Python

How it works

  • Attackers register fake package or repository names that an AI coding assistant is likely to invent when it does not know the correct name.
  • When a developer asks the AI to fetch or install a popular tool, the AI may suggest the fake name instead, leading the developer to install the attacker's malicious version.

What to do

Check if you use AI coding assistants like GitHub Copilot, TabNine, or Amazon CodeWhisperer to install Python packages or repositories without manually verifying the names.

Only install packages or repositories by typing their names yourself or verifying them on official platforms like PyPI or GitHub before trusting an AI suggestion.

Technical details

Affected software: Python

A developer asks an AI coding assistant to install a popular Python package. The AI, unsure of the exact name, invents a fake name like 'requests-123' instead of the real 'requests'. The attacker has already registered this fake name on PyPI and uploaded a malicious version. The developer follows the AI's suggestion and installs the fake package, unknowingly running attacker-controlled code on their system.

Researchers disclosed HalluSquatting, a supply chain attack that exploits AI coding assistants' tendency to hallucinate incorrect resource names. By analyzing which fake identifiers an AI repeatedly generates when asked about popular repositories, plugins, or packages, attackers register those names in platforms like package registries or skill marketplaces. When developers request a legitimate tool, the AI may fetch the attacker's version instead, leading to remote tool execution or remote code execution (RCE).

The technique was detailed in the paper Beware of Agentic Botnets by Aya Spira, Stav Cohen, Elad Feldman, Ron Bitton, Avishai Wool, and Ben Nassi. Unlike traditional typosquatting or Slopsquatting, HalluSquatting targets AI-generated hallucinations rather than human errors.

References

View Original Source