x
Artificial Intelligence has officially graduated from a simple chatbot answering questions to highly capable, autonomous software agents. Today, AI assistants can write code, manage files, search the web, and run terminal commands on our computers. However, this rapid shift from passive thinkers to active doers has introduced a chilling new cyber security vulnerability.
New research reveals that the very flaws that make chatbots make up facts—known as AI hallucinations—can be weaponised by hackers. Cyber security experts have demonstrated a terrifying reality: AI agents can be tricked into downloading malicious code, potentially turning networks of intelligent computers into massive, automated botnets.
A collaborative study conducted by researchers from Tel Aviv University, Technion, and Intuit has introduced a highly sophisticated attack vector dubbed "Adversarial HalluSquatting".
To understand HalluSquatting, it helps to look at a traditional cyber attack method called typosquatting. In typosquatting, a hacker registers a domain name that is slightly misspelt (like googlee.com) hoping a human user makes a typing error and lands on their malicious site.
HalluSquatting operates on a similar premise, but instead of exploiting human clumsiness, it targets the unpredictable nature of Large Language Models (LLMs). When AI agents encounter a complex problem or look for an external software tool, they occasionally "hallucinate"—they confidently invent non-existent web links, software package names, or code repositories.
In a HalluSquatting attack, cyber criminals predict the exact names of fake resources an AI model is likely to generate. The hackers then proactively register these names on public repositories (such as GitHub) or domain registries, filling them with malicious instructions. When the AI agent later hallucinates that specific link and fetches it, it treats the attacker's compromised content as entirely legitimate.
The threat model shifts dramatically when dealing with "agentic" AI. Unlike standard ChatGPT interfaces where a human reads the output, AI agents possess "tools" and "skills" that allow them to execute tasks directly on an operating system.
If an AI coding assistant fetches a hallucinated software repository infected via HalluSquatting, it may execute that code automatically. In controlled experiments, researchers found that this exploit could successfully lead to Remote Code Execution (RCE), giving hackers complete control over the host computer.
The most alarming aspect of the researchers' warnings is the potential creation of agentic botnets. A botnet is a web of infected, interconnected devices controlled remotely by a malicious actor. Traditionally, building a botnet required active phishing campaigns or exploiting software bugs. With HalluSquatting, hackers can scale untargeted attacks silently across the internet.
Once an army of AI agents is compromised, they can be synchronised to launch devastating cyberattacks, including:
The research paper, titled "Beware of Agentic Botnets: Scalable Untargeted Promptware Attacks via Universal and Transferable Adversarial HalluSquatting," puts numbers to this looming threat. Worryingly, the success rate of these hallucinations is incredibly high.
During rigorous testing against popular developer tools and AI frameworks—including Cursor, GitHub Copilot, Gemini CLI, and OpenClaw—the results were stark:
Because these applications do not always confirm whether a retrieved online source is authentic before executing commands, they essentially leave a digital back door wide open.
HalluSquatting is part of an escalating trend of "Promptware" attacks targeting AI infrastructure. Security researchers across the tech sector are increasingly finding that the internet is becoming hostile ground for autonomous AI.
Earlier studies by Google researchers highlighted how malicious websites can use hidden text to launch indirect prompt injection attacks, forcing browsing AI agents to leak passwords, wipe hard drives, or manipulate financial payments. Other techniques, like the "CopyPasta" attack, have shown how hidden prompts buried inside developer files can easily trick coding assistants into propagating virus-laden code.
As an open-source warning sign, one user of the OpenClaw framework reported facing over 6,000 automated attempts by external actors trying to manipulate their AI agent into leaking sensitive information.
The transition to agentic AI promises immense productivity gains, but security cannot remain an afterthought. For developers and enterprises integrating AI assistants into their daily workflows, several guardrails must be established immediately:
AI hallucinations are no longer just a humorous quirk or a minor inconvenience. In the hands of clever adversaries, they are a direct path to system compromise. As we hand over the keys of our operating systems to digital assistants, ensuring they can tell the difference between reality and hallucination is the next great frontier in cyber security.
More Information: For a deeper look into the original report and the specific mechanisms behind this security research, you can read the full article on Decrypt:
👉 AI Agents Could Be Turned Into Botnets Through Hallucinations, Researchers Warn
Disclaimer: This article is provided for informational purposes only, mistakes may be made, and it's not offered or intended to be used as legal, tax, investment, financial, or any other advice.
