Researchers have demonstrated a novel supply-chain attack technique called adversarial hallucination squatting (HalluSquatting) that weaponizes the predictable hallucinations of large language models. By preemptively registering the package names, repository identifiers, and skill names that LLMs frequently hallucinate when developers reference popular resources, attackers can achieve remote code execution across a wide range of AI coding assistants — including Cursor, Windsurf, GitHub Copilot, Cline, and Gemini CLI — without any direct channel to the target.

What Happened

In a paper published July 8, 2026, researchers from the Agentic Botnets project revealed that LLM hallucinations of resource identifiers are not random noise. They follow predictable, transferable distributions across foundational models and agentic applications. When a developer asks an AI coding assistant to "clone the trending repo" or "install the popular skill," the LLM hallucinates specific names with high probability (up to 85% for repository cloning, up to 100% for skill installation). An attacker who identifies a trending resource, queries an LLM for the commands to access it, and records the hallucinated names can then register those hallucinated names and embed adversarial prompts inside them.

When a developer later asks their AI assistant to interact with the trending resource, the LLM hallucinates the squatted name, the agentic framework retrieves the attacker-controlled resource, and the adversarial prompt poisons the context — leading to remote tool execution and remote code execution (RCE). The researchers demonstrated this against AI coding assistants with integrated terminals, achieving RCE by instructing the agent to install a bot.

Technical Breakdown

The Attack Chain

1. Preparation (Attacker):

   • Identify trending resources (GitHub repos, marketplace skills, npm packages)
   • Probe an oracle (target application or foundational LLM) with prompts like "clone repository X" or "install skill Y"
   • Compute the distribution of hallucinated identifiers returned by the LLM
   • Select a universal squatting candidate — a high-probability hallucination transferable across models
   • Register the squatted resource and embed adversarial prompts

2. Trigger (Victim):

   • Developer prompts AI assistant: "clone the trending repo" or "install the popular skill"

3. Planning (Agent):

   • Agentic application uses LLM to plan the sequence of tool calls

4. Hallucination (LLM):

   • LLM outputs the squatted identifier (e.g., git clone attacker/repo-hallucinated instead of git clone legitimate/repo)

5. Retrieval (Framework):

   • Agentic framework fetches the squatted resource from the marketplace/registry

6. Context Poisoning & Execution:

   • Adversarial content enters the agent's context
   • LLM follows attacker-controlled instructions (e.g., "run this script to install a bot")
   • Terminal tool executes the command → RCE

Hallucination Rates (Empirical)

Scenario	Hallucination Rate	Transferability
Repository cloning	Up to 85%	High across foundational LLMs
Skill installation	Up to 100%	High across foundational LLMs

The rates are highest for recently trending resources — popular resources that post-date the LLM's training cutoff are especially prone to hallucination because the model has never seen them.

Affected Applications (Tested)

The researchers demonstrated successful HalluSquatting against:

• AI Coding Assistants: Cursor, Cursor CLI, Windsurf, GitHub Copilot, Cline
• CLIs: Gemini CLI
• Assistants: OpenClaw, ZeroClaw, NanoClaw

All these tools share a common architecture: an LLM planner with a terminal/shell tool in their toolset. The terminal tool is the RCE primitive.

Why This Works: Universal & Transferable Hallucinations

The key finding is that the most frequent hallucinations are shared across models. An attacker can probe one oracle (e.g., GPT-4o) and the squatted name will also be hallucinated by Claude, Gemini, and other models driving different applications. This "universality" means a single squatted resource compromises all applications using any foundational LLM.

The transferability extends to the application layer: the same hallucinated name works across Cursor, Windsurf, Copilot, Cline, and Gemini CLI because they all use similar prompts for resource retrieval.

Threat Model

Traditional indirect prompt injection distinguishes:

• Push-based (targeted): Poison emails/calendar invites → high likelihood (auto-retrieved)
• Pull-based (untargeted): Poison web pages → low likelihood (user must actively retrieve)

HalluSquatting breaks this dichotomy. It is a pull-based attack with push-like likelihood because:

1. Trending resources guarantee high request volume from users
2. High hallucination rates guarantee high retrieval of the squatted resource
3. Single registration → amplification across all models and applications

Amplification formula:

High request volume for original resource × High hallucination rate = High retrieval of hallucinated resource = Scalable botnet establishment

Agentic Botnets vs. Traditional Botnets

Property	Traditional Botnet	Agentic Botnet
Establishment	Weak passwords, exploits, lateral movement	Prompt injection via LLM hallucination
Lateral movement	Worm-like (Mirai)	Not needed — each device compromised independently
Firewall evasion	Required	Prompt injections bypass network firewalls
Device homogeneity	High (IoT, specific OS)	Heterogeneous (any OS with AI assistant)
Code mutability	Static signatures	Prompt-based — infinitely mutable

The agentic botnet doesn't rely on default credentials or OS vulnerabilities. It exploits the semantic gap between what the user asks for and what the LLM retrieves. The bot installs via the terminal tool that the AI assistant already legitimately uses.

Mitigation Strategies

Application-Side (LLM Application Developers)

1. Enforce Search-Before-Fetch: Augment the planner with few-shot examples demonstrating correct patterns: search → verify → fetch. Bias the planner toward explicit search steps before any retrieval.

2. Proactive Fetch Regulation:

   • Analyze user requests for retrieval keywords (clone, install, fetch, get)
   • Inspect the planner's generated execution plan for fetch tool invocations
   • Modify the fetch tool implementation to require a preceding search step

3. Prompt Injection Defenses: Apply existing prompt injection mitigations (instruction hierarchy, input/output filtering, context segmentation) as defense-in-depth.

Platform/Marketplace-Side (GitHub, npm, PyPI, ClawHub, etc.)

1. Global Name Uniqueness: Eliminate namespaces (owner/repo) — require globally unique names. Prevents registering attacker/popular-repo when legitimate/popular-repo exists.

2. Namespace-Preserving Uniqueness: If namespaces are retained, prohibit reuse of existing resource names across different owners.

3. Preemptive Hallucination Registration: Platforms should proactively identify likely hallucinations for trending resources and register them to redirect to the legitimate resource (analogous to typosquatting protection).

4. Adversarial Content Scanning: Scan registered content for embedded adversarial prompts targeting LLM applications.

Detection Rules

YARA (Adversarial Prompt in Resource)

Sigma (Suspicious Terminal Invocation via AI Assistant)

Suricata (Network - Bot Installation Beaconing)

Frequently Asked Questions

Q: Is this a vulnerability in the LLM or the application? A: It's an emergent property of the system — the LLM's hallucination tendency combined with the application's fetch-without-verification architecture. The researchers frame it as a structural blind spot in pull-based indirect prompt injection.

Q: Did the researchers upload malicious code to GitHub/ClawHub? A: No. For ethical reasons, they registered benign resources. However, they note that recent research shows marketplace scanning can be bypassed (Trail of Bits, June 2026) and 824 malicious skills were found on ClawHub (KOI, 2026).

Q: Can't I just avoid AI coding assistants? A: The attack targets the ecosystem — any application with an LLM planner and a terminal tool. As agentic features become standard in IDEs, CLIs, and assistants, the attack surface grows.

Q: How is this different from typosquatting? A: Typosquatting exploits human typing errors. HalluSquatting exploits model hallucination errors. The squatted names aren't typos — they're the model's most probable wrong answer.

Q: Does this affect package managers (npm, PyPI) directly? A: The technique applies to any resource registry the LLM can hallucinate names for: GitHub repos, npm packages, PyPI packages, skill marketplaces, Docker Hub images. The researchers demonstrated repository and skill scenarios.

Q: What's the "universal squatting candidate"? A: The hallucinated name with the highest probability across multiple foundational models. Registering this single name compromises all applications using any of those models.

Q: Can fine-tuning fix the hallucination? A: The researchers note that hallucinations of recent trending resources are inherent — the model simply lacks training data for them. Search-before-fetch is a more robust architectural fix than trying to train away hallucinations.

Q: What should marketplace operators do now? A: Implement preemptive registration of likely hallucinations for trending resources, enforce global or cross-namespace name uniqueness, and scan for adversarial prompts in registered content.

Key Takeaways

• Hallucinations are predictable and transferable: The same wrong names appear across GPT, Claude, Gemini, and other foundational models.
• Trending resources are the attack surface: Recent popularity + training cutoff = high hallucination rates.
• One registration → all models → all apps: Universal squatting candidates amplify a single registration across the entire agentic ecosystem.
• Terminal tools are the RCE primitive: Any AI assistant with shell access can be weaponized to install a bot.
• Agentic botnets are structurally different: No lateral movement needed, heterogeneous device population, firewall-bypassing, infinitely mutable via prompt engineering.
• Fix is architectural, not model-centric: Search-before-fetch, platform-side preemptive registration, and adversarial content scanning.

Conclusion

HalluSquatting reveals a fundamental tension in agentic AI systems: the same flexibility that lets an LLM plan and execute complex tasks also creates a scalable attack surface when the planner's predictions about resource identifiers are wrong in predictable ways. The fix isn't better models — it's verifying before fetching. Until marketplaces and applications adopt search-before-fetch as a mandatory pattern, every trending resource is a potential botnet seed.

---

Sources:

• Agentic Botnets: Scalable Untargeted Promptware Attacks via Adversarial HalluSquatting (July 8, 2026)
• Hacker News Discussion: HalluSquatting (July 8, 2026)
• BlackHat Webinar: Promptware and Agentic Botnets (February 2026)