HalluSquatting Exploits AI Hallucinations to Build Hidden Botnets

Researchers from Tel Aviv University, Technion, and Intuit have introduced 'HalluSquatting', a novel attack method exploiting AI assistants’ hallucination tendencies. Unlike traditional prompt injection attacks, HalluSquatting uses untargeted promptware to create fake repository names that LLMs tend to hallucinate. During tests, hallucination rates were as high as 85% for repository cloning and 100% for skill installations. Attackers can register these hallucinated names and embed malicious instructions.

When users query specific AI tools, the assistant might execute the attacker's commands, potentially spreading malware. This method leads to the creation of agentic botnets that bypass conventional security measures, making them more diverse and harder to detect.