# AI Agents Could Be Turned Into Botnets Through Hallucinations, Researchers Warn > Source: > Published: 2026-07-09 21:45:01+00:00 #### In brief - Researchers introduced “Adversarial HalluSquatting,” an attack that exploits AI-generated hallucinations. - The technique tricks AI agents into trusting fake repositories or tools that contain malicious instructions. - Tests against popular AI coding assistants showed the method could lead to remote code execution in controlled experiments. AI hallucinations may be more than incorrect answers—they could become a way for hackers to compromise computers, according to new research from Tel Aviv University, Technion, and Intuit. In the [paper](https://arxiv.org/html/2607.07433v1), “Beware of Agentic Botnets: Scalable Untargeted Promptware Attacks via Universal and Transferable Adversarial HalluSquatting,” researchers demonstrated a technique that exploits AI models when they generate fake links to software repositories and other online resources. “The growing adoption of agentic LLM applications has introduced a new threat previously named as promptware,” the researchers wrote. “While prior work has established that adversaries can exploit direct channels to LLM applications to apply promptware under weak threat models, many applications do not provide any direct channels that could be exploited for prompt injection beyond the Internet.” Known as adversarial hallucination squatting or “HalluSquatting,” the attack involves predicting which fake resources AI models are likely to create, registering those names, and adding malicious instructions. If an AI agent later retrieves the hallucinated resource, it may treat the attacker-controlled content as legitimate. The researchers said the threat emerges as AI assistants move beyond answering questions and gain the ability to interact with computers—accessing files, searching the web, writing code, and running commands. Those abilities can create security gaps when agents act on information they retrieve without confirming whether the source is real. “Ongoing studies have demonstrated various variants of Promptware attacks against real-world systems, including ChatGPT, Google Assistant, Copilot, and various additional applications,” they wrote. “These works demonstrated that Promptware can lead to financial, privacy, and safety impacts.” Researchers warned the technique could allow attackers to build AI-enabled botnets. A [botnet ](https://www.paloaltonetworks.com/cyberpedia/what-is-botnet)refers to a network of infected computers or devices controlled remotely by an attacker. Botnets are commonly used in cyberattacks, including denial-of-service attacks, [cryptocurrency mining](https://decrypt.co/331195/cryptojacking-resurfaces-as-monero-miner-malware-hits-3500-sites-report), [malware distribution](https://decrypt.co/370557/ai-malware-worm-adapts-targets-cybersecurity), and [ransomware](https://decrypt.co/354731/deadlock-ransomware-using-polygon-smart-contracts-to-evade-detection) campaigns. In testing, the researchers found AI-generated resource hallucinations occurred at rates as high as 85% in repository cloning scenarios and 100% in skill installation tests. The team evaluated the technique against AI coding assistants and agents, including [Cursor](https://decrypt.co/371308/spacex-new-high-as-elon-musk-firm-agrees-acquire-ai-startup-cursor), [GitHub Copilot](https://decrypt.co/320961/microsoft-introduces-github-ai-agent-now-with-more-vibe-coding), [Gemini](https://decrypt.co/368389/google-gemini-spark-ai-agent-challenge-hermes-openclaw) CLI, and [OpenClaw](https://decrypt.co/356730/openclaw-ai-agents-whats-real). HalluSquatting is similar to [typosquatting](https://en.wikipedia.org/wiki/Typosquatting), a cyberattack tactic where attackers register domain names resembling legitimate websites or software packages to trick users. Instead of exploiting human typing mistakes, HalluSquatting targets mistakes made by AI models. The news comes as researchers continue to test how attackers can manipulate AI agents. In April, Google researchers [detailed](https://decrypt.co/365677/google-prompt-injection-ai-agents-paypal-enterprise) malicious websites designed to hijack AI agents through indirect prompt injection attacks, including attempts to steal passwords, delete files, and manipulate payments. A separate study on the “[CopyPasta](https://decrypt.co/338143/copypasta-attack-shows-prompt-injections-infect-ai-scale)” attack showed how hidden prompts inside developer files could manipulate AI coding assistants into spreading malicious code. In June, an OpenClaw user reported facing more than [6,000](https://decrypt.co/372221/ai-agent-openclaw-6000-hack-attempts) attempts from attackers attempting to trick the AI agent into leaking sensitive information.