Beware of Agentic Botnets: Scalable Untargeted Promptware Attacks via Universal and Transferable Adversarial HalluSquatting

Jul 16, 2026

Upload by Levi

Agentic LLM applications introduce a promptware threat where adversarial inputs can induce malware-like behavior inside an application’s context. Prior promptware research relied on direct or indirect injection channels, often in targeted settings. This work shows scalable untargeted promptware is feasible without direct channels by exploiting LLM hallucinations of resource identifiers. It proposes adversarial hallucination squatting: pre-registering trending resource names that LLMs are likely to hallucinate, enabling botnet-style propagation. Experiments report up to 85% repository cloning generation and up to 100% skill installation.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages22

Reading Time55 min

Abstract

Introduction

Background on Promptware

Direct vs Indirect Prompt Injection

Motivation for Untargeted Scaling

Beware of Agentic Botnets: Scalable Untargeted Promptware Attacks via Universal and Transferable Adversarial HalluSquatting Aya Spira 1 , Stav Cohen2 , Elad Feldman 1 , Ron Bitton3 , Avishai Wool 1 , Ben Nassi 1 1Tel Aviv University, 2Technion, 3Intuit arXiv :2607 .07433v 1 [ cs .CR] 8 Jul 2026 Abstract—The growing adoption of agentic LLM applications has introduced a new threat previously named as promptware. While prior work has established that adversaries can exploit direct channels to LLM applications to apply promptware (push adversarial prompts) under weak threat models (e.g., by sending emails or calendar invitations to a target), many applications do not provide any direct channels that could be exploited for prompt injection beyond the Internet. This raises a fundamental question: can attackers exploit LLM applications at scale without any direct channels in practical threat models? In this work, we show that the inherent tendency of LLMs to hallucinate resource identifiers can be exploited to amplify untargeted promptware attacks that pull adversarial prompts at scale and could be exploited to establish a botnet. We introduce adversarial hallucination squatting, a technique in which attackers identify trending resources (e.g., popular repositories, popular skills, etc.), compute the LLM distribution of hallucinations on the trending resource names, and preemptively register them to host adversarial prompts (e.g., instructing an LLM to install a bot or running a script that installs a bot). By leveraging the predictability and transferability of hallucinations across foundational LLMs and to application layers, adversaries can significantly amplify the reach ofuntargeted promptware under weak threat models and establish a botnet by exploiting LLM applications to install a bot on the device that "pulled" the compromised hallucinated resource from the Inter. We empirically demonstrate that hallucinated resource generation occurs at high rates—up to 85% in repository cloning scenarios and up to 100% in skill installation—and that these hallucinations transfer between foundational models and different prompts. We demonstrate the practicality of adversarial hallucination squatting against various LLM applications with integrated terminals in their set of tools, including AI coding assistants (Cursor, Cursor CLI, Windsurf, GitHub Copilot, Cline), CLIs (Gemini CLI), and assistants (OpenClaw, ZeroClaw, and NanoClaw), achieving remote tool execution and remote code execution (RCE). We conclude by discussing mitigation strategies and the similarities to typosquatting 1. Introduction LLM-powered applications increasingly incorporate agentic frameworks that enable them to perform actions such as accessing local files and invoking system APIs. In parallel with their growing adoption (see [15] and the references within), recent research has highlighted a new class of threats known as Promptware [20] . Promptware refers to inputs (textual, visual, or auditory) deliberately engineered to behave like malware by exploiting an application’s LLM to induce malicious behavior within the application’s context. Ongoing studies have demonstrated various variants of Promptware attacks against real-world systems, including ChatGPT [24], [10], Google Assistant [19], Copilot [3], and various additional applications (seethe blog [25]) . These works demonstrated that Promptware can lead to financial, privacy, and safety impacts. While the above-mentioned studies demonstrate that promptware poses a significant risk to LLM applications in production, existing attacks largely assume that adversaries can inject compromised content into the target application. Early promptware attacks were typically achieved via direct prompt injections [9], [29], in which the user is the attacker. Newer demonstrations showed that adversaries can inject malicious instructions into data ingested by the LLM by exploiting application interfaces or commu

FAQs

What problem does this paper address in agentic LLM applications?

It addresses how attackers can scale promptware attacks against agentic LLM apps even when there are no direct injection channels in practical threat models.

How does adversarial hallucination squatting work?

Attackers identify trending resources, estimate the LLM hallucination distribution over those resource names, and preemptively register them to host adversarial prompts that trigger bot installation or automated scripts.

What evidence does the paper provide for feasibility and impact?

It demonstrates high hallucinated resource generation rates (up to 85% for repository cloning and up to 100% for skill installation), plus transferability across foundational models and prompts, enabling remote tool execution and remote code execution in multiple applications.

Jul 16, 2026

Upload by Levi