Research
New hack exploits AI hallucinations to trick agents into running malicious code — 'HalluSquatting' attack exploits a fundamental weakness in every available model
Publication date not yet evaluated · Added · 4 reports tomshardware.com
Page published
Coverage timeline
Why it matters
HalluSquatting turns a fundamental, model-wide weakness—predictable LLM hallucination of resource names—into a no-direct-channel supply-chain vector for remote code execution against autonomous agents at scale, forcing defenders to validate every resource an agent resolves rather than trusting model output.
Researchers from Tel Aviv University, Technion, and Intuit describe 'HalluSquatting' (adversarial hallucination squatting), a technique that exploits LLMs' tendency to hallucinate plausible resource identifiers (repositories, skills, URLs) in tool calls. By preemptively registering those hallucinated resources, attackers achieve scalable, untargeted remote tool execution and remote code execution across popular agentic LLM applications without any direct channel to the target, enabling the creation of agentic botnets.