A new term has emerged in the world of cybersecurity, describing a threat born from the very nature of artificial intelligence. Researchers from Intuit, Tel Aviv University, and the Technion in Israel have presented an attack scheme called HalluSquatting. This method allows attackers to exploit the tendency of neural networks to make errors to inject malicious code onto user computers and create botnets from them.

Attack Mechanics: From Typos to Hallucinations

To understand the essence of the threat, one should refer to the well-known TypoSquatting scheme. Previously, hackers created websites with addresses similar to popular resources, counting on the user accidentally entering the wrong domain. HalluSquatting works on a similar principle, but the victim is not a human, but the AI model itself.

Artificial intelligences, especially large language models, are prone to "hallucinations" — the generation of plausible but factually incorrect data. Attackers exploit this by forcing the AI to systematically reference non-existent resources or projects. As soon as the model starts mentioning such a resource, hackers register the corresponding domain and place a hidden request on it. This code forces the AI application to perform malicious actions without the user's knowledge.

Scale of the Threat and Tested Services

During the research, the team tested the vulnerability of popular tools used by programmers and developers. The attack was successfully implemented against a wide range of services:

  • Developer Assistants: Cursor, Cursor CLI, Windsurf, GitHub Copilot, Cline, and Gemini CLI.
  • AI Agent Applications: OpenClaw, ZeroClaw, and NanoClaw.

As a result of the tests, researchers were able not only to gain remote access to large language models but also to control them and execute arbitrary code on user machines. This opens the way to the formation of botnets — networks of infected devices used to conduct DDoS attacks or deploy shadow proxy servers.

Defense Paths and Challenges for the Industry

Experts have already proposed a number of measures to neutralize the HalluSquatting threat. The key direction is blocking direct access by AI applications to external resources. Instead, systems should first connect standard search tools to verify data. Additionally, specialists recommend tightening project naming rules and switching to the use of globally unique resource names.

However, researchers admit that the implementation of these measures will not be instantaneous. It will require large-scale cooperation between platform developers, software vendors, and regulators, as well as time to implement new security standards.