It has been revealed that artificial intelligence services can be manipulated to turn users’ computers or phones into a botnet network. This new method, discovered by Intuit, Technion and Tel Aviv University researchers, opens the door to large-scale raids.

This technique, called HalluSquatting, takes advantage of the tendency of artificial intelligence models to produce incorrect information. This procedure works with a logic similar to typosquatting attacks that take advantage of classic spelling mistakes.

How does HalluSquatting work?

Researchers state that large language models cannot act with 100 percent accuracy when identifying sources or repositories. Attackers using this weakness infiltrate the system by recording resources that the artificial intelligence can falsely claim.

When attackers seize a resource where artificial intelligence can be misdirected, they place harmful commands there. When the user triggers this resource, the artificial intelligence unintentionally runs the harmful content and the attack process begins.

This formula combines classical code injection with artificial intelligence-based manipulations. Researchers emphasize that with this technique, critical powers such as remote code execution and vehicle control can be accessed.

Recognized AI tools affected

Tests showed that well-known coding assistants such as Cursor, Cursor CLI, Windsurf, GitHub Copilot and Cline were vulnerable to this type of attack. In addition, tools such as Gemini CLI, OpenClaw, ZeroClaw and NanoClaw are also at risk.

This type of attack can turn devices into botnet zombies or launch large-scale ransomware campaigns. Experts point out that ransomware managed directly by artificial intelligence, such as JADEPUFFER, is mainly seen in the field.

Security measures include developers restricting information extraction and resource owners enforcing stricter naming conventions. However, it is stated that the implementation of such analyzes will take time because they require cooperation between different parties.

How do you think users can protect themselves against such vulnerabilities in artificial intelligence tools?