A new prompt injection attack called HalluSquatting changes the game for AI security. Unlike previous attacks that required targeting individual victims, HalluSquatting exploits AI coding assistants’ tendency to hallucinate resource identifiers. When these assistants hallucinate fake package names or repository links, attackers can pre-register those exact names with malicious code. The victims’ AI tools then automatically pull this malicious content while executing routine tasks, infecting devices at scale without direct targeting. This pull-based attack works against popular tools like GitHub Copilot and Cursor, potentially creating massive botnets for DDoS attacks or device infections. Why it matters: This marks a turning point where prompt injection evolves from a nuisance to a genuine infrastructure-level threat, revealing a fundamental vulnerability in how we trust AI agents to interact with external resources.