The world of artificial intelligence is facing a fundamentally new class of threats. Researchers from leading Israeli universities and Intuit have identified a vulnerability that could turn language model "hallucinations" into a powerful mechanism for creating botnets. The attack, dubbed Adversarial HalluSquatting, exploits the tendency of LLMs to fabricate non-existent identifiers for repositories, skills, and other external resources.
Unlike classic prompt injections, this method does not require direct contact with the victim. An attacker only needs to register a fake resource on a platform like GitHub and wait for an AI agent to request it on its own. This opens the door to massive, untargeted attacks, where a single compromised resource can infect thousands of machines.
How HalluSquatting Works
The scenario is based on a predictable model error. When a user asks an agent to clone a popular repository, the model must determine the exact address. If it does not know the correct identifier, it generates a similar but non-existent one. The attacker pre-determines which "phantom" addresses the model most frequently outputs and registers them, placing malicious instructions. The agent, "hallucinating" this address, pulls in the malicious code and begins working with it as if it were legitimate.
The experimental results are impressive. Across more than 14,000 runs for new repositories (from GitHub Trending), the average hallucination rate was a staggering 92.4%. In 53 out of 60 "repository-model" combinations, the system never identified the correct owner. For older projects, which were likely present in the training data, this rate dropped to 0.9%.
Practical Tests: From Theory to Malicious Code
The transition from base models to real-world applications (Cursor, Windsurf, GitHub Copilot, Cline) confirmed the severity of the threat. The end-to-end attack succeeded in 20-65% of runs. The OpenClaw platform proved particularly vulnerable: with the Sonnet 4.6 model, it showed 100% success in both calling built-in tools and executing remote code.
A separate block of research is dedicated to "skill squatting" — an attack via skills on the ClawHub marketplace. In 90.7% of OpenClaw runs, it generated a skill identifier that could have been registered by an attacker. The context exfiltration experiment achieved 100% success, and the scenario where a compromised device autonomously connects to the attacker's server worked in 88% of cases.
Defense and Vendor Response
Researchers recommend implementing mandatory source verification before any external resource download. Web search before cloning reduces the hallucination rate to 6.6%, but as tests showed, no single type of prompt is universally safe.
The vendor response has been mixed. GitHub stated that this is not a platform vulnerability but a consequence of LLM hallucinations. Cursor and Anthropic also did not acknowledge the problem, attributing it to dependency name squatting attacks. Google promised to pass the information to its product team.
My expert opinion: The fact that major vendors are dismissing this threat is a worrying signal. HalluSquatting is not a bug, but a fundamental property of the architecture of agentic AI systems. Until we implement mandatory verification of all external resources at the protocol level, such attacks will only multiply, turning "smart" agents into ideal distributors of malware.