New research on ‘HalluSquatting’ reveals a method to exploit AI coding assistants’ tendency to ‘hallucinate’ non-existent tools. Attackers can identify these fabricated project names, register them, and then wait for AI assistants to recommend and install their malicious versions on users’ machines. This technique turns AI’s generative errors into a vector for botnet malware distribution, posing a novel supply chain threat.