Researchers from Tel Aviv University, Technion, and Intuit have introduced “Adversarial HalluSquatting,” an attack that exploits AI-generated hallucinations to trick AI agents into trusting fake repositories or tools containing malicious instructions. The technique, detailed in the paper “Beware of Agentic Botnets: Scalable Untargeted Promptware Attacks via Universal and Transferable Adversarial HalluSquatting,” involves predicting which fake resources AI models are likely to create, registering those names, and adding malicious instructions. If an AI agent later retrieves the hallucinated resource, it may treat the attacker-controlled content as legitimate. Tests against popular AI coding assistants, including Cursor, GitHub Copilot, Gemini CLI, and OpenClaw, showed the method could lead to remote code execution in controlled experiments. Researchers warned the technique could allow attackers to build AI-enabled botnets, which are networks of infected computers used in cyberattacks. In testing, AI-generated resource hallucinations occurred at rates as high as 85% in repository cloning scenarios and 100% in skill installation tests. The threat emerges as AI assistants gain the ability to interact with computers, accessing files, searching the web, writing code, and running commands.