Analysts from leading Israeli universities and Intuit have presented a detailed description of a new class of cyber threats targeting agentic AI applications. The essence of the attack, dubbed Adversarial HalluSquatting, lies in exploiting a well-known feature of large language models — their tendency to hallucinate, i.e., generate non-existent identifiers for repositories, skills, and other external resources.
In their work, the researchers demonstrate how these seemingly harmless errors can be transformed into an effective channel for delivering malicious instructions. In controlled experiments, such an attack led to unauthorized invocation of the AI agent's built-in tools and, ultimately, to remote code execution on the target system. This specifically concerns agentic systems that have extended privileges: they can clone repositories, install extensions, run commands in the terminal, and access APIs.
Attack Mechanics: From Hallucination to Compromise
The HalluSquatting scenario is built on a predictable model error. When a user asks an AI agent, for example, to clone a popular repository, the model must independently determine the exact resource address. If the correct identifier is absent from its training data, it "invents" a similar one. The attacker, in turn, monitors popular resources in advance, repeatedly queries the model, and identifies which non-existent addresses it generates most frequently. They then register these "available" names on GitHub, ClawHub, or other platforms and place malicious instructions there. When the AI agent "hallucinates" this specific address, it pulls in the malicious resource and begins working with it as if it were legitimate.
The key difference between this scheme and classic prompt injections is its scalability. The attacker does not need to target a specific victim. It is enough to publish a malicious resource in a public place once and wait for agents to request it themselves. As the researchers note, a single compromised resource can lead to the infection of many machines, making the attack ideal for building a botnet.
Test Results: Alarming Effectiveness
In a large-scale study involving over 14,000 runs, six base models were tested through public APIs. The results were telling. For new repositories absent from the training data, the average hallucination rate was 92.4%. In 53 out of 60 combinations, the model never indicated the correct project owner. For older projects, this rate was only 0.9%, confirming the dependence on the training dataset.
The most convenient type of hallucination for an attack was when the model placed the repository name in the owner field, creating an address of the form repo/repo. This pattern is predictable and often available for registration. Out of 6,000 queries for new projects, the models produced a registrable slug in 27% of cases — 1,602 times.
The transition to real AI applications with terminal access (Cursor, Windsurf, GitHub Copilot, Cline, and others) only confirmed the severity of the threat. The end-to-end attack succeeded in 20-65% of runs depending on the application. Particularly high rates were recorded for the OpenClaw system: with the Sonnet 4.6 model, it showed 100% success in both tool invocation and remote code execution.
Skill Squatting: Attack via Skills
A separate attack vector targets skill marketplaces. In tests on OpenClaw with Sonnet 4.6, out of 140 runs, 127 (90.7%) led to an identifier that could be registered by an attacker. The context exfiltration experiment achieved 100% success, and the scenario where a compromised device connects to the attacker's server worked in 88% of cases.
The researchers proposed a number of protective measures: mandatory source verification before downloading any external resource, preemptive reservation of frequently "hallucinated" names by platforms, and restricting the dangerous reuse of popular names. However, vendor reactions were mixed: GitHub, OpenAI, and Anthropic did not recognize this as a vulnerability under their bug bounty programs, citing that the problem lies in the actions of agents and LLM hallucinations, not in their platforms.
My Expert Commentary: This discovery highlights a fundamental security problem with modern AI agents. While the industry is focused on defending against direct prompt injections, attackers are finding new, more sophisticated paths. HalluSquatting is not just a bug, but an architectural vulnerability rooted in the very nature of generative models. Vendors ignoring this problem is an alarming signal. We stand on the threshold of a new era of cyber threats, where trust in a "hallucinating" AI could lead to the compromise of entire infrastructures. Without the implementation of mandatory resource verification protocols at the agent level, such attacks will become widespread.