I've been leaning on AI coding assistants a lot lately, so a piece of security news I came across this month genuinely made me stop and rethink my workflow. Researchers have found a way to trick these tools into quietly installing malware, and the more I dug into it, the more it felt like something worth writing down.
The technique has a name that stuck with me: HalluSquatting. It plays on a habit a lot of us have already noticed, which is that AI assistants sometimes invent repository names that don't actually exist. Attackers figured out they can register those made-up names ahead of time and stuff them with malicious instructions, betting that the AI will eventually hallucinate and recommend one of them.
Here's the part that unsettled me. When you ask your assistant for help, it can pull code from one of these fake repos instead of the real thing, and the hidden instructions inside can push it to download and run harmful software on your machine, all while it looks like it's just doing normal project work. Reportedly this has been demonstrated against nine major tools, including Cursor, GitHub Copilot, Windsurf, Gemini CLI, and others, with success rates reaching as high as 100 percent on certain common tasks.
What worries me most is how invisible it is. There's no obvious red flag, no shady download prompt. The agent follows what reads like a legitimate instruction while quietly stealing credentials, dropping backdoors, or roping the machine into a botnet.
So I'm changing a few things about how I work. I'm actually reading the code my assistant suggests instead of skimming it, testing anything new in an isolated environment, and being far stricter about the permissions I hand my agents. It's a small tax on speed, but after reading this, it feels more than worth it. The tools are getting more powerful, and I'd rather they stay working for me than get turned against me.