HalluSquatting: AI hallucinations used to deliver botnets

Researchers at Tel Aviv University, the Technion and Intuit detailed a technique they call HalluSquatting, in which attackers pre-register repository and package names that large language models commonly invent. The attackers then host malicious files at those locations so that when an AI assistant fabricates the name and fetches the resource, the embedded instructions can run on the user’s device.

The teams documented that assistants sometimes invent plausible but nonexistent repo or package names when users ask them to clone a project or install a skill. Attackers can register those invented names on public services, place command scripts or installers there, and wait for an assistant to hallucinate the name and retrieve the content through an integrated terminal or installer.

In laboratory tests the researchers measured hallucination rates as high as 85 percent for prompts asking assistants to clone repositories and 100 percent for prompts requesting skill installations. The same fabricated names tended to recur across multiple foundation models, the paper notes, which makes the approach transferable between different AI systems. The study tested developer-facing assistants including Cursor, Windsurf, GitHub Copilot, Cline, Gemini CLI and OpenClaw.

After an assistant pulls an attacker-controlled resource, the embedded commands can instruct the model or the host to run additional tools or code. The research focused on the potential for these instructions to seed agentic botnets: networks of autonomous agents that propagate by exploiting hallucinated names and installing attacker-supplied instructions. Because an assistant’s behavior triggers the fetch and execution, infected hosts could include a wide range of devices and operating systems.

The teams contrasted HalluSquatting with prompt injection campaigns that use targeted channels such as email, logs, comments or notifications to deliver malicious prompts. HalluSquatting requires no direct access to a user’s chat or prompt stream; it relies on public registrations of invented names and the model tendency to recreate them. The paper notes that infections driven by assistant behavior can bypass some traditional defenses that focus on network vulnerabilities.

The researchers informed affected vendors before publishing the paper and withheld exploit details they judged could be easily reused by attackers. The teams did not publish proof-of-concept code or step-by-step instructions. The study presents the attack pattern, measurement results and suggested mitigations.

The paper recommends stronger verification and provenance checks for any system that automatically fetches and executes external artifacts, and it documents recurring hallucinated identifiers as part of the measurement results.