Researchers warn AI agents could be exploited via hallucinations to download malicious code, creating botnet risks.
AI & Agents ·
Researchers from Tel Aviv University, Technion, and Intuit have demonstrated a technique called adversarial HalluSquatting that could allow attackers to exploit AI agents by weaponizing the hallucinations that cause them to generate false information. The attack works by predicting which fake software repositories or tools an AI model is likely to fabricate, then registering those names and embedding malicious instructions inside them. When an AI agent later retrieves what it believes to be a legitimate resource, it may unknowingly execute attacker-controlled code.
The vulnerability emerges as AI assistants expand beyond answering questions to performing actions on computers—accessing files, writing code, running commands, and searching the web. In testing, researchers observed hallucination rates as high as 85 percent in repository cloning scenarios and 100 percent in skill installation tests across tools including GitHub Copilot, Cursor, and Gemini CLI. Because agents often act on retrieved information without verifying source authenticity, they become potential entry points for remote code execution.
The researchers warn the technique could enable the creation of AI-powered botnets—networks of compromised systems remotely controlled by attackers for denial-of-service campaigns, cryptocurrency mining, and malware distribution. What remains unclear is the practical scale at which such attacks could operate in production environments or what mitigations AI developers are currently implementing to validate resource sources before agents interact with them.