Adversarial Hallucination Squatting (Agentic Botnet via Promptware)
First seen Jul 9, 2026 · Updated Jul 9, 2026
Researchers demonstrate that LLM agents frequently hallucinate plausible-sounding resource names (repos, skills, packages) when performing tasks like cloning or installation, and these hallucinations are predictable and transferable across models. Attackers can preemptively register these hallucinated resource names to host malicious payloads, causing agents that autonomously fetch and execute them to become compromised at scale, effectively forming a botnet without needing any direct prompt injection channel.
Technical Analysis
The attack exploits the statistical predictability of LLM hallucinations: by querying foundation models with prompts similar to what production agents use (e.g., 'clone the most popular X repo' or 'install skill Y'), attackers can compute a distribution over likely hallucinated resource identifiers and squat on the most probable ones in advance. When an agentic application with tool access (e.g., an integrated terminal, package manager, or skill installer) hallucinates one of these names and autonomously fetches it, it retrieves attacker-controlled content that achieves remote tool execution and remote code execution on the host device. The entry point is not a traditional prompt injection channel but the model's own generative behavior combined with autonomous tool-use, meaning no direct interaction with the victim application is required, only public registration of the squatted resource. This crosses the boundary from model output space into system-level execution because agents trust and act on hallucinated identifiers without verification, and the transferability across foundation models and prompt variations allows a single squatted resource to compromise many different downstream applications, enabling untargeted, self-scaling propagation resembling a botnet.
Affected Systems
Production LLM applications with integrated terminals/tool execution (unspecified vendors), agentic coding assistants, skill/plugin installation frameworks
Detection Signatures
- Unusually high install/clone rates for repository or skill names with no prior public history or minimal legitimate adoption
- Agent tool logs showing fetch/execute of resource names not present in an allow-listed registry or organizational package index
- Newly registered packages/repos/skills whose names closely match plausible-but-nonexistent variants of popular resources
- Terminal or shell command execution triggered directly from LLM-generated resource identifiers without human confirmation
- Repeated cross-session hallucination of the same nonexistent resource name across different users/prompts (transferability signal)
Remediation Steps
- 1
Verify resource existence before execution
Require agents to validate that a repository, package, or skill name exists in a trusted, curated registry (with reputation/age/download thresholds) before cloning, installing, or executing it.
- 2
Human-in-the-loop for tool execution
Gate any terminal, install, or code-execution action triggered by LLM-suggested resource names behind explicit human approval, especially for first-time or low-reputation resources.
- 3
Allow-list and namespace pinning
Restrict agents to pinned, version-locked, organization-approved package/repo lists rather than free-form name resolution based on model output.
- 4
Hallucination monitoring
Proactively test and log the LLM's hallucination distribution for common agent tasks (cloning, installing) to identify and defensively pre-register or block high-probability hallucinated names before attackers do.
- 5
Sandboxed execution
Run all agent-fetched code/tools in isolated, least-privilege sandboxes to limit blast radius if a hallucinated malicious resource is executed.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.