---
title: "HalluSquatting: How AI Hallucinations Turn User Computers into Botnets"
description: "Researchers have discovered a new threat called HalluSquatting, which uses AI hallucinations to create botnets. Popular tools such as GitHub Copilot and Cursor were found to be vulnerable. Experts are calling for a review of AI application security protocols. 🤖🚨"
date: 2026-07-18T13:47:40.000Z
lang: en
url: https://xab.info/en/posts/hallsquatting-how-ai-hallucinations-turn-user-computers-into-botnets
tags: [intuit, ai-security, hallsquatting, github-copilot, botnets]
publisher: "XAB.info"
---

# HalluSquatting: How AI Hallucinations Turn User Computers into Botnets

![Hacker’s gloved hands typing on a laptop in darkness — metaphor for HalluSquatting attack where AI hallucinations turn user devices into botnets](https://xab.info/media/2026/07/18/hallsquatting-ataki-na-ii-i-sozdanie-botnetov/hallsquatting-ataki-na-ii-i-sozdanie-botnetov-1.webp)

A new term has emerged in the world of cybersecurity, describing a threat born from the very nature of artificial intelligence. Researchers from Intuit, Tel Aviv University, and the Technion in Israel have presented an attack scheme called HalluSquatting. This method allows attackers to exploit the tendency of neural networks to make errors to inject malicious code onto user computers and create botnets from them.

### Attack Mechanics: From Typos to Hallucinations

To understand the essence of the threat, one should refer to the well-known TypoSquatting scheme. Previously, hackers created websites with addresses similar to popular resources, counting on the user accidentally entering the wrong domain. HalluSquatting works on a similar principle, but the victim is not a human, but the AI model itself.

Artificial intelligences, especially large language models, are prone to "hallucinations" — the generation of plausible but factually incorrect data. Attackers exploit this by forcing the AI to systematically reference non-existent resources or projects. As soon as the model starts mentioning such a resource, hackers register the corresponding domain and place a hidden request on it. This code forces the AI application to perform malicious actions without the user's knowledge.

### Scale of the Threat and Tested Services

During the research, the team tested the vulnerability of popular tools used by programmers and developers. The attack was successfully implemented against a wide range of services:

    - Developer Assistants: Cursor, Cursor CLI, Windsurf, GitHub Copilot, Cline, and Gemini CLI.

    - AI Agent Applications: OpenClaw, ZeroClaw, and NanoClaw.

As a result of the tests, researchers were able not only to gain remote access to large language models but also to control them and execute arbitrary code on user machines. This opens the way to the formation of botnets — networks of infected devices used to conduct DDoS attacks or deploy shadow proxy servers.

### Defense Paths and Challenges for the Industry

Experts have already proposed a number of measures to neutralize the HalluSquatting threat. The key direction is blocking direct access by AI applications to external resources. Instead, systems should first connect standard search tools to verify data. Additionally, specialists recommend tightening project naming rules and switching to the use of globally unique resource names.

However, researchers admit that the implementation of these measures will not be instantaneous. It will require large-scale cooperation between platform developers, software vendors, and regulators, as well as time to implement new security standards.