Technical Summary: Beware of Agentic Botnets

Problem Statement

The rapid adoption of agentic Large Language Model (LLM) applications has introduced a new threat vector known as promptware: inputs engineered to induce malicious behavior within an LLM's context. While prior research has demonstrated targeted prompt injection attacks (e.g., via emails or calendar invitations), these require adversaries to have direct access to the victim or a specific communication channel.

A critical gap remains in untargeted promptware attacks. Current untargeted methods (e.g., publishing adversarial prompts on low-traffic websites) lack scalability because they rely on the LLM application retrieving poisoned data from obscure sources. Conversely, placing adversarial prompts on high-traffic resources typically requires compromising secured servers, which is difficult under weak threat models. This paper addresses the fundamental question: Can attackers exploit LLM applications at scale without direct channels or prior compromise of high-value targets?

The authors posit that the inherent tendency of LLMs to hallucinate resource identifiers (e.g., non-existent repository names or skill slugs) creates a scalable attack surface. By exploiting these hallucinations, adversaries can establish a "botnet" of compromised agentic devices.

Methodology: Adversarial HalluSquatting

The paper introduces Adversarial HalluSquatting, a technique where attackers preemptively register resources corresponding to the most probable hallucinations of an LLM. The attack flow involves six steps:

1. Preparation: The attacker identifies trending resources (e.g., popular GitHub repositories or skills) and probes the target LLM (or foundational model) with prompts designed to elicit resource retrieval (e.g., "clone repository X").
2. Distribution Analysis: The attacker analyzes the LLM's output to determine the probability distribution of hallucinated identifiers (e.g., incorrect owner names for a repository or malformed skill slugs).
3. Squatting: The attacker registers the high-probability hallucinated identifiers on public platforms (e.g., GitHub, ClawHub) before legitimate users or agents can.
4. Trigger: A user prompts an agentic application to retrieve the original resource (e.g., "clone librepods").
5. Hallucination & Retrieval: The LLM hallucinates an identifier that matches the attacker's registered resource. The agentic framework retrieves the attacker-controlled content instead of the legitimate resource.
6. Payload Execution: The retrieved content contains embedded adversarial prompts (promptware) that instruct the agent to execute malicious actions, such as installing a reverse shell, exfiltrating data, or running arbitrary code.

The attack relies on the transferability of hallucinations across different foundational models and application layers, allowing a single squatting candidate to compromise multiple systems.

Key Contributions

1. Scalable Untargeted Promptware for Botnets: Unlike previous scalable attacks that relied on self-replicating prompts in targeted email chains, this work demonstrates a method to infect agentic applications at scale without direct injection channels. By targeting popular resources, attackers can compromise a large number of devices to form a botnet.
2. Universal and Transferable Vulnerabilities: The study proves that hallucination patterns are consistent across different LLM families (Gemini, GPT, Claude) and transfer from the foundational model layer to the application layer (coding assistants, CLI tools, personal assistants).
3. Weaponizing Hallucinations: The paper distinguishes itself from prior supply-chain attacks (which focus on phantom packages generated during code writing) by targeting the inference time of the LLM application itself. The attack exploits the application's trust in retrieved external resources.

Experimental Results

The authors evaluated the attack against a wide range of agentic applications and platforms.

Repository Squatting (Coding Assistants)

• Hallucination Rates: Foundational models hallucinated repository owners for 92.4% of recent trending repositories (created in 2025), compared to only 0.9% for older repositories. In some cases, the hallucination rate reached 100%.
• Patterns: A dominant pattern was "self-referential hallucination," where the model used the repository name as the owner (e.g., librepods/librepods). This pattern was registrable and appeared in 27% of all runs across models.
• End-to-End Success: The attack was tested against six coding assistants (Cursor, Cursor CLI, Gemini CLI, Windsurf, Copilot Chat, Cline).
  • Squatting Success: All six assistants successfully fetched the attacker-controlled repository.
  • Payload Execution: Remote Code Execution (RCE) or Tool Invocation was achieved in 20% to 65% of trials, depending on the assistant and model. For example, Windsurf achieved a 65% RCE rate, while OpenClaw achieved 100% in specific configurations.

Skill Squatting (Personal Assistants)

• Vulnerability Classes: Two primary failure modes were identified in skill installation:
  • V1 (Word Removal): The LLM drops keywords (e.g., "skill") from the request, resolving skill-vetter to the slug vetter.
  • V2 (Display/Slug Divergence): The LLM fails to map a human-readable display name to the correct technical slug, especially for non-English documented skills.
• Hallucination Rates: Across 140 trials on OpenClaw, 90.7% of install requests resolved to a squattable slug.
• End-to-End Success: In tests against OpenClaw, ZeroClaw, and NanoClaw, a single squatted skill achieved 100% success in context exfiltration and 84–100% success in reverse shell execution (terminal handover), depending on the specific model and security policies.

Significance and Claims

The paper claims that Adversarial HalluSquatting represents a fundamental shift in the threat landscape for agentic AI. Its significance lies in:

• Scalability: It enables untargeted attacks that can compromise thousands of devices simultaneously by leveraging the predictability of LLM errors, rather than requiring individual targeting.
• Botnet Formation: The attack vector allows adversaries to turn distributed agentic applications into a botnet capable of large-scale DDoS, cryptocurrency mining, or ransomware deployment.
• Universality: The vulnerability is not isolated to a single model or application but is a systemic issue affecting the interaction between agentic frameworks and external resource registries.

The authors conclude that current mitigation strategies are insufficient and that the community must address the trust boundary between LLM applications and external resources. They emphasize that while their payloads were benign for ethical reasons, the attack mechanics are fully functional and pose a realistic, high-impact threat.

Mitigation Strategies Proposed

The paper suggests mitigations at two levels:

1. Application-Side: Enforcing a workflow where a search tool must be invoked before any resource fetch operation. This significantly reduces hallucination rates (e.g., from ~90% to <10% in some cases).
2. Platform-Side: Implementing stricter registration constraints, such as global name uniqueness (eliminating namespaces) or preemptively registering likely hallucinated resource names to redirect to legitimate sources. Additionally, platforms should scan registered content for prompt injection patterns.