Top AI tools such as OpenClaw and Github Copilot can be hijacked to...

Security researchers have discovered that some of the top AI tools used by millions of developers and businesses can be manipulated into unwittingly building botnets. According to a new advisory cited by TechRadar, nine widely used AI platforms, including OpenAI's Codex and GitHub Copilot, are vulnerable to an attack technique that exploits AI hallucinations rather than traditional software flaws. In this article, you'll learn how the attack works, why hallucinations create an unexpected security gap, and what organisations relying on these platforms should do next.

What Researchers Found When They Tested Top AI Tools

The research centres on a behaviour familiar to anyone who has used a large language model: hallucination, where an AI confidently generates false or fabricated information. Instead of treating this as a quality problem, the researchers treated it as an attack surface. They reportedly found that when asked to solve coding tasks or recommend software packages, several top AI tools would invent plausible-sounding but nonexistent package names, libraries, or command-line tools.

That detail matters more than it sounds. Attackers who anticipate which fake names an AI model is likely to hallucinate can register those exact names in public package repositories in advance. When a developer copies AI-generated code that references one of these invented dependencies, the system pulls in a malicious package instead of an error message. This is a variant of what security professionals call a supply chain attack, and it does not require breaching any company's servers directly.

According to the advisory cited by TechRadar, nine of the most popular AI platforms tested showed this pattern to varying degrees, with coding assistants like GitHub Copilot and agentic tools like OpenClaw specifically named as susceptible. The researchers reportedly noted that the consistency of hallucinated names across repeated queries made the attack more predictable than random error would suggest, which is what makes it exploitable at scale rather than a one-off glitch.

It's worth being cautious here: the companies behind these platforms have not all issued detailed public confirmations of the exact findings, and the scope of real-world exploitation remains unclear. Still, the underlying mechanism lines up with prior academic research on AI package hallucination, giving the claims credibility even before full technical disclosure.

How Hallucinations Become a Hacker's Entry Point

To understand why this works, it helps to separate two different failure modes. A traditional zero-day exploit takes advantage of a bug in code that developers didn't intend to write. This attack instead takes advantage of a behaviour the AI model was never explicitly programmed to do, but that emerges naturally from how these systems predict text. The model isn't broken in the conventional sense; it's simply guessing, and sometimes it guesses wrong in a way that's dangerous.

The Mechanics of a Hallucination-Based Attack

The attack chain generally unfolds in a few predictable stages. First, a threat actor queries popular AI coding tools repeatedly with common development prompts to identify which fake package or library names appear most often. Next, they register those names on legitimate public repositories such as package managers used across the software industry, embedding malware, ransomware payloads, or remote-access tools inside.

Finally, they wait. Developers using top AI tools for everyday coding tasks trust the suggestions they receive, often without manually verifying every dependency. Once an unsuspecting user installs the poisoned package, the attacker gains a foothold on that machine. If enough machines are compromised this way across many organisations, the attacker has the makings of a distributed botnet without ever writing a traditional exploit.

Why GitHub Copilot and OpenClaw Were Named

GitHub Copilot and OpenClaw were specifically called out, researchers say, because of their popularity and their heavy integration into real development workflows. These tools are used to generate code snippets, suggest dependencies, and, in the case of agentic platforms like OpenClaw, even execute tasks autonomously. That autonomy is precisely what raises the stakes: an agent that installs packages on its own, without a human double-checking each one, removes a natural checkpoint where a suspicious name might otherwise get caught.

Neither company has publicly detailed a full remediation timeline as of this writing, and both are widely used enough that any confirmed vulnerability would have broad reach across enterprise and individual developer environments alike.

The Bigger Risk: Botnets Built From AI Trust

What makes this research notable isn't just the technique itself but the scale it implies. Botnets have traditionally been built through phishing campaigns, unpatched server vulnerabilities, or credential stuffing against exposed devices. This method instead targets something newer: the growing habit of trusting AI-generated suggestions as if they were peer-reviewed advice.

Developers, understandably, are moving fast. Top AI tools have become embedded in daily workflows precisely because they save time, and that speed discourages the kind of manual verification that used to be standard practice before running unfamiliar code. Attackers are counting on that shift in behaviour, betting that convenience will consistently win out over caution across thousands of individual developer machines.

If even a small percentage of AI-suggested packages get accepted without scrutiny, the aggregate effect across a large user base could be significant. A botnet assembled this way could be used for distributed denial-of-service attacks, cryptocurrency mining, data exfiltration, or as infrastructure for further phishing operations. The individual compromise might look minor to a single developer, but the cumulative effect across an ecosystem of millions of users is where the real danger sits.

There's also a reputational dimension worth noting. Companies building top AI tools have spent years marketing them as productivity multipliers, and rightly so in many cases. But this research is a reminder that any tool capable of writing and executing code carries security implications that go beyond the accuracy of its output on a benchmark test.

What This Means for Developers and Enterprises

Enterprises that have integrated AI coding assistants into their software development pipelines now face a decision point. Blanket bans on these tools are unlikely, given how deeply embedded they've become, but blind trust is clearly no longer defensible either. Security teams are being pushed to treat AI-suggested code with the same scrutiny historically reserved for third-party contributions or open-source pull requests.

Some practical measures are already gaining traction among security-conscious teams. Automated dependency scanning tools can flag packages that were only recently registered or that show suspiciously low download counts, both common traits of hastily created malicious packages. Code review processes can be updated to specifically question AI-suggested dependencies rather than assuming they were verified by the tool itself.

• Verify every AI-suggested package name against the official, well-established repository listing before installation.
• Use dependency-scanning and software composition analysis tools to flag newly registered or low-reputation packages automatically.
• Restrict autonomous AI agents from installing software without a human approval step in production environments.
• Keep an internal allowlist of vetted libraries that AI tools are permitted to suggest within enterprise codebases.

None of this requires abandoning top AI tools altogether. It does require treating AI output as a draft that needs review, not a finished product ready for execution. That mindset shift is arguably the single most effective defence available right now, since it doesn't depend on any vendor patch or timeline.

Key Takeaways

This research adds a new category to the growing list of AI-related security concerns, one that has less to do with data privacy or bias and more to do with how trust in automation can be weaponised. The core lesson is straightforward: even top AI tools that perform well on coding benchmarks can introduce risk through behaviours as ordinary as an occasional wrong guess.

• Nine popular AI platforms, including GitHub Copilot and OpenClaw, were reportedly found susceptible to hallucination-based supply chain attacks.
• Attackers can register fake package names that AI tools consistently hallucinate, then embed malware inside them.
• Compromised machines could be aggregated into a botnet used for further attacks, including distributed denial-of-service campaigns.
• Manual verification of AI-suggested dependencies remains the most immediate and practical safeguard available to developers today.

As AI coding assistants continue to expand their role in software development, this kind of research is a useful checkpoint rather than a reason for alarm. The technology isn't inherently unsafe, but the assumption that AI-generated suggestions are automatically trustworthy clearly needs to be retired. Until vendors confirm and patch the specific weaknesses identified, developers who treat every suggested dependency with a healthy dose of scepticism will be the ones least likely to become an unwitting node in someone else's botnet.