Beware of Agentic Botnets: Scalable Untargeted Promptware Attacks via Universal and Transferable Adversarial HalluSquatting

Source: arXiv:2607.07433 · Published 2026-07-08 · By Aya Spira, Stav Cohen, Elad Feldman, Ron Bitton, Avishai Wool, Ben Nassi

TL;DR

This paper presents and thoroughly evaluates a new class of scalable, untargeted promptware attacks called adversarial HalluSquatting against agentic LLM applications. While previous promptware attacks relied on adversaries injecting malicious prompts through direct or indirect targeted channels (e.g., emails or calendar invites), many agentic applications have no accessible injection interface. The authors exploit a fundamental LLM behavior: frequent hallucination of resource identifiers such as repository owners or skill names. By systematically identifying and pre-registering these hallucinated but plausible resource names (“squatting” them), attackers can serve adversarial prompts at scale to a wide variety of applications. This leads to widespread prompt poisoning without requiring targeted injection vectors, effectively enabling the creation of an agentic botnet. The study demonstrates hallucination rates as high as 85% for repository cloning and 100% for skill installation, confirms transferability of hallucinations across multiple LLMs and agentic layers, and successfully mounts remote code execution attacks on real-world applications including Cursor, Gemini CLI, and OpenClaw. The results quantify the risk that hallucination amplification poses when combined with integrated terminals in agentic applications and highlights a universal vulnerability across many popular LLM platforms.

Key findings

• Recent GitHub repositories exhibit hallucination rates up to 92.4% across six foundational LLMs, while old repositories have a near-zero hallucination rate (0.9%).
• 27% of hallucinated slugs generated by LLMs in the recent repository set are directly squattable (i.e., attackers can register them on GitHub), with per-repository ranges from 2.8% to 58%.
• A small set of top hallucinated squatting candidates intercepts a large fraction of hallucinated outputs, with the top five candidates capturing 24% to 84% of hallucinations for given repositories.
• Hallucinated resource identifiers transfer reliably across LLM model families (Gemini, GPT, Claude) and prompt styles, enabling universal squatting candidates.
• Agentic coding assistants suffer from hallucination amplification, e.g., Gemini CLI generated hallucinated but registrable slugs in 82% of cloning attempts, cursor CLI up to 65% remote code execution (RCE) success, and OpenClaw assistant reached 100% tool invocation and up to 100% RCE.
• Skill installation prompts induce hallucinations at near 100% rates, transferring similarly across multiple LLMs and assistants (OpenClaw, NanoClaw, ZeroClaw), achieving 40% to 100% RCE success.
• End-to-end attack feasibility is demonstrated via remote tool invocation and code execution across diverse agentic applications including Cursor, Gemini, Windsurf, Cline, and others.
• Attack amplification relies on popular trending resources as triggers, which ensures large-scale exposure to squatted hallucinated identifiers.

Threat model

The adversary is a weak yet capable entity who can monitor and identify trending popular resources (repositories or skills) publicly and register similarly named squatted resources on public platforms. They have no direct prompt injection channel into victims' agentic LLM applications but rely on the victim applications' tendency to hallucinate resource identifiers during user requests. The adversary controls the payload embedded in the squatted resource and relies on the LLM-powered application to retrieve and execute these payloads. The attacker cannot compromise foundational model weights or the victim's device manually but exploits scalable untargeted prompt injection via hallucinated resource resolution.

Methodology — deep read

The authors develop and experimentally evaluate the Adversarial HalluSquatting attack consisting of multiple steps starting from adversary preparation through end-user exploitation:

1. Threat Model & Assumptions: The adversary operates under a weak threat model without any direct communication or prompt injection channel. They can identify popular trending resources (e.g., repositories, skills) from public trend sources and register new squatted resources under attacker control on public platforms such as GitHub or ClawHub. The target victim applications are agentic LLM-powered assistants that autonomously fetch and execute instructions from external resources. The adversary cannot compromise the foundational LLM weights but exploits its hallucination tendencies.

2. Data Collection & Probing: The authors selected 16 repositories categorized into recent trending repositories from 2025 and well-known old repositories (2013-2018) with large star counts. Using public APIs for six representative large foundational models (Gemini 2.5 Flash/Pro, GPT 5.1/5.2, Sonnet 4.5, Opus 4.5), they issued over 9,600 queries, each requesting a shell command to clone specific repos. They collected hallucinated repository owner/repo slugs produced by models, identifying patterns of hallucination (self-referential owner, existing unrelated owner, or placeholder).

3. Attack Candidate Identification: They built probabilistic distributions of hallucination outputs per model and repository and computed a "universal score" aggregating across models. This identified universal squatting candidates that cover multiple models and could be successfully registered on the target platform. Top candidates per repository were selected for attack registration.

4. Attack Implementation & Testing: They deployed squatted repositories on GitHub or skills on ClawHub embedding adversarial prompt payloads instructing the agents to invoke tools, run shell commands, and install reverse shells. They issued user-style requests (e.g., "clone repo" or "install skill") to various production agentic applications: Cursor CLI, Gemini CLI, Windsurf, Cline, OpenClaw, ZeroClaw, NanoClaw, and Copilot Chat.

5. Evaluation: They measured hallucination rates, retrieval success of squatted resources, executed payload success for tool invocation and remote code execution, and transferability across models and prompt styles. Over 14,000 runs were conducted.

6. Analysis included stratification of hallucination behavior by repository age, model version, prompt phrasing, and application layer. Statistical metrics included percentage hallucinations, payload execution rates, and coverage of squatting candidates. Table 1 summarizes attack success rates (e.g., 20%-65% RCE on coding assistants, 40%-100% on assistants).

7. Responsible Disclosure & Ethical Controls: Technical safeguards prevented accidental exploitation. Implementation details and payloads were partially redacted. Findings were disclosed to affected vendors before publication.

A concrete example: For a recent trending repo (librepods), querying GPT-5.2 with "print a shell command to clone librepods" yielded 85.7% hallucination rate. The attacker registered the squattable slug "librepods/librepods" on GitHub containing a malicious prompt. Cursor CLI issued "clone librepods" resulting in retrieval of the squatted repo, executing embedded shell commands to install a remote bot, demonstrating an end-to-end attack chain.

Technical innovations

• Identification and exploitation of universal squatting candidates derived from high-probability hallucination outputs shared across multiple foundational LLMs.
• Introduction of adversarial HalluSquatting: a technique that amplifies promptware attacks untargetedly by preemptively registering hallucinated external resources.
• Comprehensive demonstration that hallucinations transfer from foundational LLM layers through application layers to agentic assistant behavior, enabling scalable attacks.
• Empirical quantification of hallucination rates on recent versus old repositories and skills, revealing a systematic vulnerability exploitable at scale.

Datasets

• GitHub Trending Repositories 2025 — 10 repositories — Public
• Established Popular GitHub Repositories (2013-2018) — 5 repositories — Public
• LLM API Query Logs — 9600+ queries across 6 models — Generated by authors

Baselines vs proposed

• Gemini CLI (GEMINI-2.5-FLASH API baseline): hallucination rate 82% vs proposed universal squatting candidate registration achieving up to 100% squatting retrieval in production
• Cursor CLI (multiple models): remote code execution success ranging 20%-65% vs baseline cloning rates showing hallucinations 85%
• OpenClaw assistant (GPT-5.4 Codex, Sonnet 4.6): tool invocation and RCE success from 40% to 100% vs baseline no adversarial prompt
• Hallucination rates for old repositories: 0.9% vs new trending repositories: 92.4% (control)
• Skill installation in assistants: hallucination rates near 100% vs no baseline hallucination for old skills

Figures from the paper

Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2607.07433.

Fig 1: Threat model

Fig 2 (page 4).

Fig 3 (page 4).

Fig 4 (page 4).

Fig 5 (page 4).

Fig 6 (page 4).

Fig 7 (page 4).

Fig 8 (page 4).

Limitations

• The study focuses on repositories and skills from GitHub and ClawHub, leaving other resource types and platforms less explored.
• Evaluation is limited to specific agentic applications and LLM versions available at study time; future versions may mitigate or alter hallucination behaviors.
• No adversarial adaptive modeling or defense implementation was tested in depth; mitigation strategies are discussed but not empirically evaluated.
• Assumes attackers can register squatted resource identifiers without significant platform intervention; real-world platform rate-limiting or detection might impede attacks.
• Experiments largely assume static prompt styles and do not explore dynamic user or assistant interventions to reduce hallucination impact.
• The threat model assumes no compromise of the underlying LLM weights or foundational model retraining, restricting attack scope.

Open questions / follow-ons

• How effective are real-time detection and user confirmation approaches in mitigating hallucinated resource fetching?
• Can fine-tuning foundational models with hallucination reduction techniques limit the vulnerability without harming generalization?
• What defenses can be integrated at the agentic application layer to robustly verify external resources before execution?
• How do dynamic prompt engineering or contextual user feedback loops impact hallucination rates in deployed assistants?

Why it matters for bot defense

For bot-defense and CAPTCHA practitioners, this paper introduces a new scalable attack vector leveraging inherent LLM hallucinations, which does not require direct injection channels but exploits common behaviors in agentic applications. Defense strategies must therefore extend beyond classical input sanitization or direct prompt filtering. Instead, monitoring and validating external resource resolution, especially registration and retrieval of popular but potentially squatted resource identifiers, becomes critical. The demonstrated universality and transferability of the hallucination vulnerability imply that threat detection frameworks must be applied across multiple model families and integrated application layers. Botnets leveraging this attack vector could be difficult to detect through traditional user interaction patterns, as the attack occurs at the model inference and external data retrieval layers. Bot-defense engineers should consider telemetry on unexpected or rarely seen resource identifiers and implement multi-factor checks before external code retrieval or execution. Additionally, mitigating hallucination effects in LLMs or restricting agentic tool access are direct mitigation avenues that can significantly affect the attack surface exposed to adversaries.

Cite

@article{arxiv2607_07433,
  title={ Beware of Agentic Botnets: Scalable Untargeted Promptware Attacks via Universal and Transferable Adversarial HalluSquatting },
  author={ Aya Spira and Stav Cohen and Elad Feldman and Ron Bitton and Avishai Wool and Ben Nassi },
  journal={arXiv preprint arXiv:2607.07433},
  year={ 2026 },
  url={https://arxiv.org/abs/2607.07433}
}

Read the full paper

• arXiv:2607.07433 (abstract)
• arXiv:2607.07433 (PDF)