Researchers have uncovered a novel attack technique that exploits the tendency of AI assistants to “hallucinate” or make incorrect assumptions when faced with incomplete information. Dubbed “HalluSquatting,” this method leverages the fact that AI tools often generate fictional repository or package names in response to requests for popular resources, allowing attackers to pre-register these fake names and subsequently plant malicious instructions within them.
As a result, unsuspecting users who ask their AI assistants to clone a repository or install a skill may inadvertently pull down and execute the attacker’s commands via the AI’s built-in terminal. This can lead to the deployment of various types of malware or hacking tools, effectively creating an “agentic botnet” whose size depends on how often the AI tool hallucinates the attacker’s squatted resource.
HalluSquatting is distinct from traditional promptware attacks, which require a direct channel to the targeted user’s LLM (Large Language Model) application. In contrast, HalluSquatting relies on adversarial hallucination squatting, a technique that exploits the AI tool’s tendency to generate fictional names without a direct channel or prior knowledge of the attacker’s plans.
The research team behind HalluSquatting observed impressive success rates in their tests, with hallucination rates reaching as high as 85% for repo-cloning prompts and 100% for skill installations. Furthermore, they found that the same hallucinated names tend to recur across different foundation models, making the technique broadly transferable.
The implications of HalluSquatting are significant, as it allows attackers to spread malware or hacking tools on a large scale without relying on vulnerabilities or weak security practices. Traditional botnets often rely on lateral movement and may be detected by traditional firewalls, whereas agentic botnets like those created through HalluSquatting can evade detection more effectively.
Fortunately, the research team has taken steps to mitigate potential damage. They have notified affected vendors before publication of their findings and withheld exploit details that could be directly reused by attackers. However, this highlights the importance for users to stay vigilant and maintain up-to-date security measures when utilizing AI tools.
For readers who use AI assistants or LLMs in their daily work, this discovery serves as a reminder to exercise caution and verify the integrity of any resources or instructions pulled down from these platforms. By being aware of the potential risks associated with HalluSquatting, users can take proactive steps to protect themselves against such attacks and maintain the security of their systems.
Source: SecurityWeek — 2026-07-10