Agentic botnets via universal, transferable adversarial HalluSquatting

In 'Beware of Agentic Botnets: Scalable Untargeted Promptware Attacks via Universal and Transferable Adversarial HalluSquatting' (arXiv:2607.07433, v1 8 Jul 2026), Aya Spira, Stav Cohen, Elad Feldman, Ron Bitton, Avishai Wool and Ben Nassi — the group behind Morris II — study 'promptware' against agentic LLM applications that expose no direct injection channel beyond the open Internet. Their thesis is that the inherent tendency of LLMs to hallucinate resource identifiers can itself be turned into an exploitable primitive. They introduce 'adversarial hallucination squatting': an attacker identifies trending resources (e.g. popular repositories or agent 'skills'), computes the model's distribution of hallucinated names over those resources, and preemptively registers the most-probable hallucinated names to host adversarial prompts. Because the hallucinations are reported to be predictable and to transfer across foundation models and across different prompts (and down to the application layer), a single pre-registration can reportedly reach many victims under a weak threat model — the untargeted 'botnet' framing, where each application that pulls a compromised hallucinated resource can be induced to install a bot on the host. The authors empirically report hallucinated-resource generation at high rates — up to 85% in repository-cloning scenarios and up to 100% in skill-installation scenarios (figures per the paper's abstract) — and demonstrate the technique against various production LLM applications with integrated terminals in their toolset, achieving remote tool execution and remote code execution. This extends the earlier slopsquatting / package-hallucination line of work from opportunistic name-squatting into a deliberate, quantified, transferable channel — hallucination as an exploitable supply-chain injection primitive rather than incidental noise. Rates, transferability and the RCE demonstrations are as reported by the authors and pertain to their experimental setups; payload/registration details here are illustrative, not operational.