Quick Facts
- Nearly 20% of code samples generated by 16 popular AI coding models contained at least one hallucinated package name, per a USENIX Security 2025 study of 2.23 million samples.
- Real-world malicious packages exploiting this method have accumulated tens of thousands of downloads, including one proof-of-concept package pulled down more than 30,000 times in three months.
- A 2026 follow-up study found hallucination rates have narrowed but persist across all five frontier models tested, including GPT-5.4-mini, Gemini 2.5 Pro, and Claude Sonnet 4.6.
A new software supply chain threat called slopsquatting is moving from academic theory to confirmed attack vector. It works by exploiting a simple flaw: AI coding tools regularly suggest software packages that do not exist.
When a developer installs a hallucinated package name without verifying it, and an attacker has already registered that name in a public registry, the developer pulls malicious code directly into their codebase. No typo required. The AI assistant does the work.
Where the Term Comes From
Seth Larson, Security Developer-in-Residence at the Python Software Foundation, coined the term in April 2025. The name combines “AI slop” with “typosquatting,” a long-documented attack where bad actors register misspelled versions of legitimate domains or package names.
The key difference: slopsquatting does not require a developer to make a mistake. The AI model makes it for them, often repeatedly and predictably.
The Scale of the Hallucination Problem
Researchers at the University of Texas at San Antonio, the University of Oklahoma, and Virginia Tech quantified the problem in a paper presented at USENIX Security 2025. They generated 2.23 million code samples across 16 popular code-generating models in Python and JavaScript. Of those samples, 440,445 — 19.7% — contained at least one hallucinated package name. The researchers observed more than 205,000 unique hallucinated package names in total.
Open-source models hallucinated far more often than proprietary ones: 21.7% versus 5.2% on average. GPT-4 Turbo posted the lowest measured rate at 3.59%. CodeLlama 7B and CodeLlama 34B hallucinated in more than one-third of outputs.
The hallucinations are not random noise. When researchers reran identical prompts ten times, 43% of hallucinated package names appeared on every single run. Another 58% appeared on more than one run. That predictability is what makes the attack scalable. Attackers can probe models, identify names they consistently generate, and register those names before defenders notice.
Confirmed Real-World Damage
Three documented cases show the threat is no longer hypothetical.
The npm package unused-imports is a name AI models hallucinate instead of the legitimate eslint-plugin-unused-imports. As of early February 2026, the malicious package was recording roughly 233 weekly downloads despite being security-held by npm. Developers were not searching for it — their AI tools directed them there.
In 2024, researcher Bar Lanyado of Lasso Security registered huggingface-cli on PyPI as an empty proof-of-concept, no malicious payload included. LLMs consistently hallucinate that name instead of the correct install command. The package recorded more than 30,000 authentic downloads in three months. Alibaba referenced the fake install command in the README of one of its own research repositories.
In January 2026, researcher Charlie Eriksen registered an npm package called react-codeshift, a name no one had ever created. It was a hallucination-by-conflation, two real packages blended by an LLM into a fictional one. The name had already appeared in 47 LLM-generated agent skills and spread to 237 repositories before Eriksen claimed it. “The only reason it didn’t become an attack vector is because I got there first,” Eriksen said.
The 2026 Escalation
A July 2026 paper titled “Beware of Agentic Botnets” from researchers at Tel Aviv University, Technion, and Intuit describes a more targeted variant called HalluSquatting. Rather than waiting for a model to stumble onto a name an attacker already owns, HalluSquatting uses adversarial triggers to make AI agents hallucinate a specific attacker-chosen resource on demand.
A 2026 replication study tested five frontier models released between October 2025 and March 2026. The inter-model hallucination range compressed from 5.2%-21.7% to 4.62%-6.10%. The gap between best and worst performers has closed, but the floor has not reached zero across any model tested.
What This Means for Software Teams
Any team using AI-assisted coding tools to generate or suggest dependency installs faces exposure. The risk scales with how much autonomy developers grant to AI-generated code. Agentic coding workflows, where AI models write and execute code with minimal human review, face the highest risk.
Security teams should audit AI-generated dependency lists before installation, verify package names against official registries, and treat any package suggested by an AI tool as unverified until confirmed. The packages look real. The download counts prove developers are trusting them.
Read more: Forget typosquatting; slopsquatting is the software supply chain threat created by AI coding tools