TLDR: A novel supply-chain attack, dubbed ‘slopsquatting,’ has emerged, leveraging the tendency of AI coding agents to ‘hallucinate’ non-existent package names. Malicious actors pre-register these fabricated names on public repositories like PyPI, tricking developers into unknowingly downloading and executing malware when AI-generated installation commands are run. Researchers highlight the need for layered defense strategies, including provenance tracking, sandboxed environments, and human oversight, as even advanced AI agents are not entirely immune to this sophisticated threat.
Researchers have uncovered a sophisticated new supply-chain threat, termed ‘slopsquatting,’ that specifically targets AI-powered software development workflows. This innovative attack vector exploits a fundamental weakness in AI coding agents: their propensity to generate plausible-sounding but entirely fictional package names during code generation. Unlike traditional typosquatting, which relies on human typing errors, slopsquatting capitalizes on AI-generated hallucinations to trick developers into installing malicious packages.
The mechanics of a slopsquatting attack are insidious. Threat actors actively monitor common hallucination patterns from popular coding agents. They then pre-register these phantom package names on public repositories, such as PyPI. When developers, often working under tight deadlines and relying on AI assistants for rapid prototyping or ‘vibe coding,’ execute AI-generated installation commands, they unknowingly download and execute malware disguised as legitimate dependencies. A scenario observed during research involved an advanced coding agent confidently generating a non-existent package name, leading to a ‘module not found’ error, and raising concerns that malicious actors could easily register such names, turning innocent AI suggestions into security breaches.
The vulnerability spans various AI coding platforms. Research examined hallucination rates across tools including Anthropic’s Claude Code CLI, OpenAI’s Codex CLI, and Cursor AI enhanced with Model Context Protocol (MCP) validation. While advanced coding agents incorporate reasoning and validation mechanisms to reduce phantom dependencies, they cannot eliminate the risk entirely. Foundation models, for instance, showed occasional spikes of two to four invented package names when prompted to bundle multiple novel libraries, particularly during high-complexity tasks where models would splice familiar terms (e.g., ‘graph’ + ‘orm’) into convincing but non-existent names.
Advanced coding agents demonstrated approximately 50% fewer hallucinations compared to foundation models, thanks to features like extended thinking, live web searches, and codebase awareness. However, they still exhibited vulnerabilities in specific scenarios, including ‘context-gap filling’ (where agents compose semantically relevant morphemes to satisfy intent without exact matches) and ‘surface-form mimicry’ (relying on statistical naming conventions without live index validation). Even Cursor AI with MCP-backed real-time validation, which achieved the lowest hallucination rates, occasionally missed edge cases involving cross-ecosystem ‘name borrowing’ and morpheme-splicing heuristics.
Mitigating slopsquatting demands a multi-layered security approach. Security experts recommend treating dependency resolution as a rigorous, auditable workflow rather than a mere convenience. Key defense strategies include:
Provenance Tracking: Generating and cryptographically signing Software Bills of Materials (SBOMs) for every build to ensure auditable dependency records.
Automated Vulnerability Scanning: Integrating tools like Safety CLI or OWASP dep-scan into CI/CD pipelines to detect known CVEs before package installation.
Isolated Installation Environments: Executing all AI-generated installation commands inside transient Docker containers or ephemeral virtual machines, promoting only validated artifacts to production.
Prompt-Driven Validation Loops: Designing AI prompts to include inline existence checks and requiring real-time lookups before finalizing code output.
Developer Training and Policies: Educating engineering teams on slopsquatting risks and enforcing policies for dependency vetting and signature verification.
Strict Sandbox Controls: For unavoidable automatic package installs, enforcing controls like per-run environment resets, outbound network restrictions to whitelist approved registries, and pre-execution vulnerability scanning.
Auditing, Logging & Monitoring: Capturing detailed logs of installation commands and deploying runtime monitors to detect anomalous behavior.
Human-in-the-Loop Approval: Requiring manual review of new or unfamiliar packages to balance automation with security oversight.
Also Read:
- Browser-Based AI Agents Emerge as Primary Cybersecurity Vulnerability, Outpacing Human Error
- Generative AI Empowers Hackers to Create Advanced Phishing Sites in Under 30 Seconds
This research underscores that package hallucinations remain a tangible supply-chain threat across all AI coding paradigms. Organizations must recognize that simple package repository lookups provide insufficient protection, as malicious actors can proactively register hallucinated names. The complete elimination of this vulnerability remains elusive, emphasizing the critical need for enhanced security frameworks in automated coding workflows to safeguard development pipelines against this emerging threat.
