New study exposes “HalluSquatting” attack that weaponizes AI hallucinations to build botnets

How HalluSquatting Manipulates AI Agents

A team of researchers from Tel Aviv University has published a paper describing a novel attack they call HalluSquatting. The technique tricks AI agents into executing malicious code by exploiting the way large language models hallucinate software URLs. The findings were released this week and raise fresh concerns for developers deploying autonomous AI systems.

The attack leverages a known weakness of generative AI: when prompted for a download link, the model may invent a plausible‑looking URL that does not actually exist. Attackers embed these fabricated links in prompts that appear benign, prompting the AI to fetch and run the referenced payload. Once the code runs, the compromised host joins a coordinated network of infected machines, effectively forming a botnet without traditional malware distribution channels. The researchers demonstrated the method on several open‑source AI agents, showing that even modest permissions can lead to widespread compromise.

In the experiments, the authors fed a language model a request to „install the latest version of a utility.” The model responded with a fabricated download address that resembled a legitimate repository. When the agent attempted to retrieve the file, the request was intercepted by a malicious server that delivered a Trojan payload. Because the agent trusted the model’s output, it executed the code automatically. The paper notes that the attack succeeded on more than 70 % of tested agents, highlighting the prevalence of non‑deterministic output handling. „AI hallucinations are not just harmless quirks,” said lead author Dr. Maya Levi. „They become attack vectors when the system assumes the generated text is factual.”

Can Defenders Stop HalluSquatting Before It Spreads?

The researchers also mapped the downstream effects. Each compromised node reported back to a command‑and‑control server, receiving further instructions such as DDoS participation or data exfiltration. The resulting botnet scaled quickly, as the compromised agents could themselves issue new hallucinated prompts to other systems. This self‑propagating behavior mirrors worm‑like dynamics, but without the need for traditional exploit code.

Mitigating HalluSquatting requires rethinking how AI agents validate external resources. The authors suggest strict sandboxing, mandatory verification of URLs against trusted registries, and limiting autonomous code execution. Some developers have already begun to embed checksum verification steps, forcing the agent to compare a file’s hash with a known good value before running it. Additionally, the paper recommends monitoring for anomalous network traffic that originates from AI‑driven processes. „A layered defense that treats AI output as untrusted data can blunt the attack,” Dr. Levi added.

If left unchecked, HalluSquatting could accelerate the creation of AI‑powered botnets that are harder to detect and dismantle. Security teams will need to adapt their threat models to include generative AI behaviors, and regulators may consider new standards for AI system permissions. The research underscores the urgency of building safeguards into the core design of autonomous agents, not just bolting on after‑the‑fact patches.

Frequently Asked Questions

What exactly is a HalluSquatting attack? It is a technique that exploits fabricated URLs generated by AI models to deliver malicious code, turning the AI’s own output into a delivery mechanism.

Are current AI agents vulnerable to this method? The study showed that many open‑source agents with minimal permission checks were compromised, indicating widespread susceptibility.

How can organizations protect themselves? Implement strict validation of any external resources, sandbox AI‑driven actions, and monitor for unusual network patterns originating from AI processes.