New hack exploits AI hallucinations to trick agents into running malicious code

Researchers from Tel Aviv University, Technion, and Intuit have unveiled a novel attack mechanism called 'HalluSquatting,' which exploits the hallucination behavior of modern AI agents to trick them i... Read original →

The HalluSquatting exploit reveals a critical blind spot in AI-driven software supply chains. Technically, it weaponizes LLM hallucinations into executable attack vectors, forcing CI/CD pipelines, code review systems, and dependency managers to overhaul their trust architectures. Compliance-wise, organizations enabling default AI code execution risk severe liability under GDPR and NIS2, potentially increasing DevOps costs by 15–30%. Microsoft, Google, and Anthropic will rush to deploy 'verify-before-execute' modes, but model fine-tuning lags will give security middleware firms like Snyk a strategic edge. Within 18 months, regulators are likely to mandate sandboxing and URL validation for AI coding tools—mirroring post-Heartbleed TLS certificate audits. This marks the inflection point where AI-assisted development shifts from efficiency-first to security-first.