The world of agentic AI has encountered a new threat that exploits a fundamental weakness of large language models (LLMs) — their tendency to hallucinate. This is not about fictional facts in responses, but about creating entire channels for delivering malicious code. Researchers have identified a class of attacks called Adversarial HalluSquatting, which turns model errors into a tool for compromising entire systems.
How HalluSquatting Works
The essence of the attack is simple and elegant. When an AI agent receives a command, for example, to clone a popular repository, it must independently determine the exact URL. If the model does not know the correct identifier (especially for new projects), it is highly likely to "invent" a similar one. An attacker, having pre-analyzed the model's behavior, registers these invented names on GitHub or other platforms and places malicious instructions there. When the agent subsequently accesses this address, it picks up the malicious resource as if it were legitimate.
Unlike traditional prompt injections, this method does not require direct interaction with the victim. It is enough to publish a malicious resource in a public place once and wait for the agent to access it on its own. A single compromised resource can lead to the infection of thousands of machines.
Test Results: The Scale of the Disaster
During more than 14,000 runs using six base models (Gemini 2.5 Flash, GPT-5.1, Sonnet 4.5, etc.), impressive but alarming data were obtained. For new repositories from GitHub Trending, the average hallucination rate was 92.4%. In 53 out of 60 "repository — model" combinations, the system never indicated the correct owner. For older projects present in the training data, this rate dropped to 0.9%. The most convenient type of hallucination for an attack — when the model places the repository name in the owner field (repo/repo) — occurred in 27% of runs, that is, 1602 times.
Real Attacks on Applications
When researchers moved from base models to working applications (Cursor, Windsurf, GitHub Copilot, Cline, Gemini CLI, etc.), the results were even more frightening. The end-to-end attack succeeded in 20–65% of runs, depending on the application and model. The OpenClaw platform stood out: with the Sonnet 4.6 model, it showed 100% success both in calling built-in tools and in remote code execution (RCE).
A separate block of research was dedicated to attacks via skill squatting on the ClawHub marketplace. Out of 140 runs, 127 (90.7%) led to an identifier that could have been registered by an attacker. The context exfiltration experiment achieved 100% success, and the scenario where a compromised device autonomously connects to the attacker's server worked in 88% of cases.
My analysis shows that we are on the threshold of a new era of cyber threats, where AI agents become not only tools but also vulnerable entry points. Current protective measures, such as web search before cloning, help only partially: even when using it, 6.6% of results can be hallucinations. Platforms like GitHub and ClawHub must take responsibility for reserving frequently invented names, and AI application developers need to implement mandatory verification of all external resources before loading them. Ignoring this threat could lead to the creation of global botnets controlled through hallucinations.