A research group from Tel Aviv University, the Technion, and Intuit has presented a detailed analysis of a new class of cyberattacks targeting agentic AI applications. This technique, named Adversarial HalluSquatting, exploits a fundamental feature of large language models (LLMs): their tendency to "hallucinate," i.e., generate non-existent but plausible identifiers.
The essence of the attack is that attackers first identify which non-existent repository addresses, skills, or other external resources the model most often fabricates in response to user queries. They then register these "phantom" names on platforms like GitHub or ClawHub, placing malicious code there. When the AI agent, while performing a user's task, "hallucinates" this specific address, it automatically downloads and executes the malicious instructions, mistaking them for legitimate ones.
The key difference between HalluSquatting and traditional prompt injections is its scalability. The attacker does not need to interact with a specific victim; it is enough to publish a malicious resource in a public place once and wait for a trusting agent to access it on its own. As the authors note, "a single compromised resource can lead to the compromise of many machines," making this scheme ideal for building botnets.
Experimental Data: The Scale of the Threat
As part of the study, over 14,000 test runs were conducted. In the first phase, six base models were studied, including Gemini 2.5 Flash, GPT-5.1, and Sonnet 4.5. The results were striking: for new, recently appeared repositories, the average hallucination rate was 92.4%. In 53 out of 60 "repository-model" combinations, the system never identified the correct project owner. For older projects present in the training data, this rate dropped to 0.9%.
In the second phase, researchers tested real applications with terminal access: Cursor, Windsurf, GitHub Copilot, and others. In repository cloning scenarios, the end-to-end attack succeeded in 20-65% of cases, depending on the application. The OpenClaw platform proved particularly vulnerable: with the Sonnet 4.6 model, the attack achieved 100% success in both calling built-in tools and achieving remote code execution (RCE).
Skill Squatting and Protective Measures
A separate block of the study was dedicated to attacks via skill marketplaces (skill squatting). In tests on OpenClaw, 90.7% of queries led to an identifier that could be registered by an attacker. The context exfiltration scenario achieved 100% success, and gaining remote command-line access worked in 88% of cases.
The researchers emphasize that a key protective factor is mandatory web search before downloading any external resource. When Cursor CLI performed a search before cloning, 93.4% of results were correct, whereas without search, 99.1% of addresses turned out to be hallucinated. However, the wording of the query also strongly influences the outcome, and no single prompt type proved universally safe.
Expert Opinion: HalluSquatting is not just a theoretical vulnerability but a practical attack vector that calls into question the very architecture of trust in agentic AI systems. As long as developers rely on the model's "intelligence" to select external resources without mandatory verification, we will see a rise in incidents related to the automatic execution of malicious code. The industry urgently needs to implement a Zero Trust principle for all actions of AI agents, especially those involving downloading and executing code from external sources.