New hack exploits AI hallucinations to trick agents into running malicious code — ‘HalluSquatting’ attack exploits a fundamental weakness in every available model

Ever since the advent of agentic AI, security researchers have been yelling from the top of their lungs about how it’s a bad idea to grant user-level permissions to an LLM — for all purposes, a program with non-deterministic outputs and inconsistent handling of inputs. A research paper on HalluSquatting from researchers at Tel Aviv University, Technion, and Intuit, shows how easily one can fool modern AI bots and harness them into a massive army of AI agents, with the research showing that agents can hallucinate potentially malicious code repositories up to 85% of the time.

The mechanism for HalluSquatting (aka “adversarial hallucination squatting”) is surprisingly simple, and takes advantage of the fact that when met with unfamiliar terms, bots will not know they’re incorrect and hallucinate a “correct” answer. Adding to that, the methods the bots use to come up with said answer are predictable, for example, owner/repository or toolname/toolname GitHub URLs. This is different than just standard typo-squatting, as it exploits the hallucination mechanism itself.

An attacker first identifies an application, code repository, programming library, or bot skill that’s gained popularity only in recent months or years — let’s say, a new GitHub repo with the URL OriginalOwner/WindowsTelemetryOff. As the bots’ training data is not recent enough to contain information about it, GitHub URLs owner/repo combinations SuperHacker/WindowsTelemetryOff , and WindowsTelemetryOff/WindowsTelemetryOff look just as peachy. Likewise, WindowsTelemetryOf and WindowTelemetryOff (note the typos) will be valid candidates.

The attacker then creates a malicious repository using those generated names. When Claude or another code agent is asked to “run the windowstelemetryoff scripts” or a similar instruction, chances are they’ll hallucinate the repo name (sometimes even having run a web search), run into the malicious version that looks like the original, and happily run whatever’s in there.

From that point, all bets are off now that the attacker’s code is running on the user’s machine. The most obvious outcome could be creating a reverse shell (the user’s machine opens a command line that’s controlled remotely). Now having access to the user’s account, the attacker can siphon off their data and passwords, install software, run crypto miners, or harness their AI agent for further malfeasance, all with the power of entire data centers at their disposal.

And here’s the kicker: just the one HalluSquatted piece of software has the potential to bait and reel in tens of thousands of bots, if not more, in a proverbial blink of an eye. A crafty attacker would be kind enough to include all the original code in their poisoned version, adding yet another layer of unawareness to the mix.

The research team found that an LLM will hallucinate the location of a recent code repository up to 85% of the time, a figure that can reach 100% for trending agentic skills. Every single model is widely affected, up to and including Anthropic’s mighty Claude Opus 4.5. At the application level, the figures are better, but still pretty bad.

The scientists are working on common LLM-backed programming applications, including Cursor, Windsurf, and OpenClaw, among others. In this scenario, the bots stand a better chance given they’re working with more context information, but even still, the success rates for hacking ranged from 20%-35% for Cursor, Gemini CLI, and Copilot, and increased massively to close to 80-100% on OpenClaw and its variants. The exploit mechanism doesn’t even need to be crafted specifically for any bot; the researchers’ results show it’s universal and transferable, too.

The mean hallucination rate for names of sample GitHub repositories published in 2025 is 92.4%, while predictably, bots get the URLs wrong 0.9% for those from 2019 or earlier, though that’s arguably still a concerning figure. The most effective mitigation is adjusting workflow: instructing bots to always run web searches before installing software, and providing them with additional context. Unfortunately, that’s not the default way most people appear to use them.

Cybersecurity professionals have long advocated for not blindly trusting a bot’s actions and severely restricting the access level granted to AI agents. And yet it’s not uncommon to see bots with wide-ranging permissions over users’ machines, API keys, access keys, and service accounts, to name a few — all in a bid to make it “easier” for the bot to vibe-code their pointy-haired-boss’ latest brilliant idea.