🎧 Prefer to listen?

I switched to Cursor a few months ago because it made coding feel effortless. Type what you want, watch it appear. But last week, a security researcher showed me something that made me pause mid-sentence: nine of the most popular AI coding tools—including Cursor, GitHub Copilot, and Windsurf—can be tricked into installing malware on your machine. Not because the tools are broken. Because they’re too helpful.

The attack is called HalluSquatting, and if you use AI to write or autocomplete code—even occasionally—this matters to you.

What HalluSquatting actually is

Here’s the mechanic, and it’s deceptively simple.

When you ask an AI coding assistant to help you build something, it sometimes suggests importing packages or libraries that don’t exist. This is the hallucination problem we’ve all experienced—ChatGPT inventing fake APIs, Copilot suggesting libraries that were never published. Usually it’s just annoying.

HalluSquatting turns that annoyance into an attack vector.

The process works like this:

  1. The AI hallucinates a package name. You ask Cursor to help you build a webhook handler, and it suggests importing something like fastwebhook-utils. Sounds reasonable. You trust it.

  2. The attacker has already registered that fake name. Security researchers found that they could predict which package names AI tools would hallucinate—because the models tend to generate the same plausible-sounding names repeatedly. Attackers pre-register these names on npm or PyPI with malicious code inside.

  3. You install it without thinking. The AI suggested it, so you run npm install fastwebhook-utils. Now the malicious code is on your machine.

  4. Your machine becomes part of a botnet. The payload connects to a command-and-control server. Your laptop is now one of thousands being used for DDoS attacks, crypto mining, or data exfiltration—and you’d never know.

The researchers tested this against nine major AI coding tools: Cursor, Gemini CLI, Windsurf, GitHub Copilot, Cline, and others. Every single one was vulnerable. Every single one suggested hallucinated packages that could be weaponized.

Why this matters if you’re not a developer

“But I’m not a developer. I use no-code tools.”

I hear you. But here’s the thing—the line between “no-code” and “code” is blurring fast. If you’ve used ChatGPT to write a script, Cursor to fix a bug, or Replit to build a quick prototype, you’ve crossed that line. And HalluSquatting targets the exact moment where trust meets autocomplete.

The 2026 Thales Bad Bot Report found a 12.5x surge in AI-driven bot attacks year-over-year. Malicious bots now account for 40% of all internet traffic. Cloudflare reports that automated bot traffic has surpassed human-generated web traffic entirely—bots make up 57.5% of all HTTP requests.

These aren’t hypothetical numbers. This is the infrastructure your tools run on.

The Forbes coverage put it bluntly: the internet was never built for this. And AI tools are accidentally making it easier for attackers to scale.

The bigger picture: AI as a force multiplier for attackers

HalluSquatting is just one method. The broader trend is more concerning.

Dark web markets are now advertising custom, “jailbroken” AI models specifically designed for cybercrime. Tools like WormGPT and XXXGPT generate phishing emails, write malware, and automate vulnerability scanning. What used to require a skilled hacker now requires someone who can type a prompt.

AI-as-a-service platforms let attackers with limited technical skills:

  • Automate vulnerability scans across thousands of targets
  • Generate phishing emails that are indistinguishable from legitimate ones
  • Create self-modifying malware that evades detection
  • Use deepfake technology for impersonation

This isn’t science fiction. It’s happening right now, and the tools enabling it are the same ones sitting in your dock.

What you can do today (5 practical steps)

You don’t need to stop using AI coding tools. That would be like abandoning email because of phishing. But you do need to change how you use them.

1. Verify every package before you install it

When an AI tool suggests a package, don’t just run npm install. Check it first:

  • npm: Search on npmjs.com — look at publish date, download count, and maintainer history
  • PyPI: Search on pypi.org — same checks
  • Rule of thumb: If a package was published last week with 12 downloads and the AI just suggested it, that’s a red flag

2. Use a lockfile and pin your dependencies

If you’re using Node.js, your package-lock.json should be committed to version control. In Python, use pip freeze > requirements.txt with exact versions. This prevents silent package swaps.

3. Enable npm audit / pip audit in your workflow

1

npm audit

For Python projects:

1

pip-audit

Run this before every deployment. Most AI-generated code skips this step entirely—don’t be most people.

4. Use an allowlist for packages

For projects you’re building solo, maintain a short list of approved packages. When the AI suggests something new, add it to the list only after verification. This takes five minutes and prevents the most common attack vector.

5. Don’t run AI-generated scripts with elevated permissions

If Cursor suggests a script, don’t run it with sudo. Don’t run it in a container with access to your production environment. Test it locally, verify the packages, then deploy.

The tools that help

A few tools are specifically designed to catch this kind of vulnerability:

  • Socket — Scans npm and PyPI packages for supply chain attacks. Free tier available. Integrates with GitHub.
  • Snyk — Finds and fixes vulnerabilities in your dependencies. Has a generous free plan for solo developers.
  • GitHub Dependabot — If you’re using GitHub, enable this. It automatically alerts you when dependencies have known vulnerabilities.

These aren’t perfect, but they’re significantly better than trusting an AI’s suggestion at face value.

What the AI companies are doing

To their credit, some of the companies behind these tools are aware of the problem. Anthropic recently disclosed that its Claude Mythos model can find and exploit security vulnerabilities “better than all but the most skilled humans”—and chose to restrict it to defensive use first through Project Glasswing. OpenAI launched GPT-5.5-Cyber through a “Trusted Access for Cyber” program for vetted security teams.

But the tools we use daily—Cursor, Copilot, Windsurf—aren’t running those defensive models. They’re running the standard versions that happily suggest fastwebhook-utils without checking if it exists.

The fix has to come from both sides: better defaults in the tools, and better habits from the people using them.

The bottom line

AI coding tools are genuinely useful—I’m not going back to writing everything by hand. But usefulness without verification is just trust with extra steps. HalluSquatting works because we’ve been trained to treat AI suggestions as recommendations rather than starting points.

The fix isn’t complicated. Verify packages. Pin dependencies. Run audits. It takes ten minutes per project and prevents your machine from becoming someone else’s bot army.

If you’re building with AI tools—and you probably are—make security part of your workflow, not an afterthought.

Want to build smarter with AI? Start with our AI Tool Advisor or explore how to build your first automation safely.