HalluSquatting is an adversarial hallucination squatting attack against popular AI assistants that leverages their hallucination behavior to achieve remote code execution. Attackers pre-register fake repository or package names that AI models hallucinate when asked to clone repositories or install skills. These hallucinated names are consistent across different foundation models, making the attack broadly transferable. When the AI assistant fetches these attacker-controlled resources, it executes embedded malicious instructions via its built-in terminal, enabling malware deployment and the formation of agentic botnets. Unlike traditional botnets relying on vulnerabilities or weak security, these botnets spread through prompt injections that bypass firewalls and can infect diverse devices. The research was conducted by teams from Tel Aviv University, Technion, and Intuit, with affected vendors notified prior to publication. Exploit details were withheld to prevent direct reuse by attackers.

The attack can lead to remote code execution on devices using vulnerable AI assistants, enabling attackers to deploy malware or hacking tools. It facilitates the creation of agentic botnets that can spread widely and heterogeneously by exploiting hallucinated resource names, bypassing traditional security controls. This represents a novel infection vector that does not require direct attacker-user interaction or exploitation of conventional software vulnerabilities.

Affected vendors were notified before the research publication, and exploit details have been withheld to prevent immediate misuse. No specific patch or remediation status is provided in the available information. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Organizations using AI assistants should monitor vendor advisories for updates and apply official fixes once available.