If the address space wasn't assigned to you via a RIR, it won't take long for someone to notice though and get your announcement by enough relevant large tier 1 & tier 2 ISPs that your announcement won't reach most of the Internet.
At that point you can of course use the addresses locally, but you can't reach the rest of the internet.
This type of squatting was somewhat easier in the past when less of the IPv4 space was actually in use and when less strict filtering (or RPKI) was in place.
Still happens, but it's getting harder and harder.
