AI Botnets and Blue Origin's Billion-Dollar Space Bet

Here is the part that should make every developer stop and read twice: the attack does not need to target you specifically. It just needs to wait for your AI coding tool to make a mistake — and then it pounces.

Researchers have uncovered a new class of cyberattack called HalluSquatting, and it is built almost entirely on exploiting something AI tools already do constantly: hallucinate. Specifically, it exploits the tendency of large language models to confidently invent the names of software packages, repositories, and other resources that do not actually exist. Attackers predict which fake names an LLM is most likely to dream up, register those names in real package registries, and then fill them with malicious code. When your AI assistant goes looking for that resource, it finds exactly what the attacker planted.

The result is a pull-based attack that can scale in a way no previous prompt injection technique has managed. Earlier prompt injection attacks — where malicious instructions are hidden inside emails or documents — required individually targeting each victim. That kept the blast radius relatively small. HalluSquatting flips the model entirely. One poisoned package, sitting quietly in a public registry, can infect any AI coding agent that wanders over to fetch it.

And a lot of agents are wandering. Tools like Cursor, GitHub Copilot, Windsurf, Gemini CLI, and several others are confirmed to be vulnerable. These are not obscure hobbyist apps. They are the daily workhorses of professional developers at companies large and small, and they routinely operate with elevated system privileges — meaning when they run code, they can do serious damage.

The attack payload can include reverse shells, which give an attacker persistent remote access to a compromised machine. Once inside, the possibilities range from data theft to full-scale botnet recruitment, where infected devices are conscripted into armies used for distributed denial-of-service attacks.

What makes this especially uncomfortable is that the vulnerability is not a bug someone forgot to patch. It is a structural feature of how LLMs work. These models cannot reliably distinguish between a real package name and one they invented. Developers working on AI guardrails have spent years trying to prevent models from following malicious instructions injected by outside sources, but hallucination-based attacks sidestep those defenses almost entirely.

The researchers who uncovered HalluSquatting are frank about the scale of what this enables. The attacker does not need to know who the victims are or reach out to them in any way. They just need to be patient and good at predicting AI behavior — which, given how consistent hallucination patterns tend to be, is more achievable than it sounds.

For now, the most practical defense is something developers should probably be doing anyway: verify every dependency your AI assistant suggests before running it, and treat any unfamiliar package name as a potential red flag. That sounds simple. In a fast-moving development workflow powered by AI autocomplete, it is harder than it sounds.

For twenty-five years, Jeff Bezos has been essentially the sole financier of his space company, writing checks worth several billion dollars annually with no outside investors involved. That era is ending — and the number attached to the change is a staggering $10 billion.

Blue Origin is in the process of closing its first-ever private fundraising round, reportedly targeting a valuation of $130 billion. Asset management firm Coatue Management is expected to anchor the deal with a $4 billion commitment. Large institutional investors are lined up to contribute another $4 billion. Bezos himself is putting in an additional $2 billion, which means even in its debut fundraise, the founder remains a major capital source. It is a sign of both confidence in the company and an acknowledgment that outside money alone was never going to be sufficient.

The timing is notable for a few reasons. First, it comes just weeks after Blue Origin's flagship New Glenn rocket exploded on its Florida launch pad — an event that temporarily threw a wrench in the fundraising process. Second, it arrives against the backdrop of SpaceX completing a staggering $85 billion capital raise earlier this year, pushing its valuation to roughly $2 trillion. By comparison, Blue Origin's $130 billion target looks modest, though it would still make it one of the most valuable private aerospace companies outside of Elon Musk's empire.

The competitive gap between the two companies is real and has been for years. SpaceX built its financial foundation on government launch contracts, commercial satellite deployments, and the explosive growth of Starlink. Blue Origin, despite having more years on the clock, has largely remained a development-stage company propped up by its founder's personal fortune. Bringing in outside investors does more than just add cash — it adds pressure, accountability, and a pathway toward the kinds of employee stock incentives that SpaceX uses to recruit and retain top engineering talent.

What happens next with New Glenn matters enormously for the fundraise to pay off. The rocket is central to everything Blue Origin wants to do: launching cargo and eventually astronauts to the lunar surface for NASA, competing for commercial satellite contracts, and underpinning plans for two separate megaconstellations. Bezos has publicly committed to returning New Glenn to flight before year's end, a timeline most industry insiders consider optimistic. A twelve-month runway is the more realistic expectation.

Still, the speed with which Bezos and CEO Dave Limp have moved to clean up the launch site and restart operations has surprised observers who are accustomed to Blue Origin's historically unhurried pace. The company's motto — move ferociously, but step by step — has always felt a little at odds with the competitive realities of the launch industry. With $10 billion on the line and SpaceX pulling further ahead by the quarter, ferocious may finally be winning out over slow and steady.