Research reveals that slopsquatting remains a threat to developers using AI to aid coding.

Enterprise software developers are continuing to face a significant and evolving cybersecurity threat known as "slopsquatting," a sophisticated attack vector that leverages the very tools designed to accelerate software development. This insidious method exploits "hallucinations" produced by Artificial Intelligence (AI) coding assistants, which can mistakenly suggest the existence of non-existent software libraries. Cybercriminals then capitalize on these AI-generated phantoms by creating and publishing malicious packages with identical names, aiming to trick developers into incorporating them into legitimate applications.

The persistence and nature of this threat have been underscored by recent research, which highlights a concerning degree of consistency in the way leading AI coding tools generate these fabricated library names. Aleksandr Churilov, an independent researcher, identified a core set of 127 fake package names that were repeatedly produced by five different prominent Large Language Models (LLMs). This uniformity suggests a shared vulnerability within the training data or extrapolation mechanisms of these advanced AI systems, making the threat more predictable and, therefore, more exploitable.

Slopsquatting, as defined by its creators, represents a relatively new class of malware attack. Its efficacy lies in its reliance on the perceived authority and accuracy of AI coding assistants. When an AI tool confidently recommends a package that does not exist, a developer, often working under tight deadlines, may not have the time or inclination to meticulously verify its authenticity. This trust in AI-generated suggestions inadvertently opens a critical backdoor for attackers.

The Genesis and Evolution of Slopsquatting

The phenomenon of AI generating incorrect or non-existent information, often referred to as "hallucinations," has been a known issue since the widespread adoption of LLMs. Initially, these inaccuracies were primarily seen as inconveniences or sources of misinformation. However, the cybersecurity community quickly recognized the potential for malicious exploitation. Slopsquatting emerged as a direct consequence of this realization, transforming abstract AI errors into tangible security risks.

The process typically unfolds as follows:

1. AI Suggestion: An AI coding assistant, when prompted by a developer to suggest a library or package for a specific function, erroneously recommends a non-existent one. This hallucination might stem from incomplete training data, misinterpretation of existing package names, or the AI’s attempt to extrapolate plausible names based on common naming conventions.
2. Attacker Exploitation: Cybercriminals monitor AI coding tool outputs or actively probe for common AI hallucinations. They identify these non-existent package names and then swiftly register packages with those exact names on public software repositories like PyPI (Python Package Index) and npm (Node Package Manager).
3. Malicious Payload: The registered packages are populated with malicious code. This could include malware, backdoors, credential stealers, or code designed to exfiltrate sensitive data.
4. Developer Incorporation: Developers, trusting the AI’s suggestion, proceed to install and integrate the malicious package into their projects, unknowingly introducing a security vulnerability.

Churilov’s Groundbreaking Research: A Deeper Dive into AI Hallucinations

Churilov’s recent research, detailed in his pre-peer-review paper titled "The Range Shrinks, the Threat Remains: Re-evaluating LLM Package Hallucinations on the 2026 Frontier-Model Cohort," provides crucial insights into the scope and consistency of AI-driven package hallucinations. His study focused on evaluating the output of five leading LLMs: Claude Sonnet 4.6, Claude Haiku 4.5, GPT-5.4-mini, Gemini 2.5 Pro, and DeepSeek V3.2.

The findings are stark: these sophisticated models, representing the cutting edge of AI development in 2026, collectively generated an identical list of 127 hallucinated package names. This remarkable overlap is a double-edged sword. On one hand, it allows security researchers to pinpoint specific vulnerabilities. On the other hand, it indicates that a large number of developers relying on these popular tools are being exposed to the same set of potential threats.

A significant concern arising from Churilov’s work is the continued availability of these hallucinated names. As of April 2026, a substantial portion of these 127 names—specifically 53—remained unregistered on major software repositories. Of these, 41 were available on PyPI and 12 on npm. This leaves a wide-open window for malicious actors to register these names and plant their harmful code, waiting for unsuspecting developers to fall into the trap.

Understanding the Consistency: Why AI Hallucinates Uniformly

Churilov’s research posits two primary explanations for the high degree of conformity in the hallucinated package names across different LLMs:

• Shared Training Data: The most probable cause is the reliance on common, publicly accessible training materials. Large language models are trained on vast datasets, which often include documentation, tutorials, code repositories, and online forums. If these sources contain outdated, erroneous, or misattributed package references, different models trained on these same materials are likely to replicate those errors. For instance, a popular but now defunct library’s name, or a commonly mistyped existing library, could be present in numerous online resources, leading AI models to internalize these inaccuracies.
• Independent Extrapolation: Even without direct exposure to the same erroneous data, LLMs possess the capability to "learn" and extrapolate from established patterns and conventions within software ecosystems. Developers often adhere to specific naming schemes for libraries, employing prefixes, suffixes, or logical structures that indicate a library’s purpose or origin. AI models can independently generate names that appear plausible and conform to these conventions, even if no actual library with that name has ever been created or is currently in use. This "educated guess" by the AI can inadvertently lead to the generation of names that are ripe for exploitation.

The Threat Landscape: Immediate and Potential Repercussions

While Churilov’s research is a wake-up call for the cybersecurity community, there is a glimmer of relief. As of the study’s reporting, there was no direct evidence found linking any of the 53 still-available hallucinated package names to active malicious registration or exploitation. This means that while the potential for attack exists, the actual weaponization of these specific names has not yet been widely observed.

However, this lack of immediate evidence should not breed complacency. The nature of cyber threats is dynamic. Attackers are highly adaptive and are constantly seeking new avenues for exploitation. The discovery of these consistent AI hallucinations provides them with a roadmap. It is a matter of time before malicious actors leverage this information to register these available names.

The implications for enterprise software development are significant:

• Increased Attack Surface: The widespread use of AI coding assistants means that a large number of developers are susceptible to this type of attack. Even small and medium-sized businesses that may not have dedicated cybersecurity teams are at risk.
• Supply Chain Compromise: Slopsquatting directly targets the software supply chain. When a malicious package is incorporated into a legitimate application, it can propagate to all downstream users of that application, creating a ripple effect of infections.
• Difficulty in Detection: Identifying a malicious package that has been recommended by an AI can be challenging. Developers might dismiss suspicious behavior as a bug in the newly integrated library, delaying the discovery of the actual compromise.
• Erosion of Trust in AI Tools: A series of successful slopsquatting attacks could erode developer trust in AI coding assistants, potentially slowing down the adoption of these productivity-enhancing tools.

Industry Reactions and Mitigation Strategies

The findings from Churilov’s research are expected to reverberate through the cybersecurity departments of major tech companies and government agencies. Chief Information Security Officers (CISOs) and security-conscious developers are likely to view this as a critical emerging threat that requires proactive mitigation.

While direct statements from the AI vendors mentioned in the study are not yet publicly available, it is reasonable to infer that they are actively reviewing these findings. Major AI developers have a vested interest in ensuring the security and reliability of their tools. They are likely to be:

• Investigating Training Data: Reviewing their training datasets for inaccuracies and biases that could lead to package name hallucinations.
• Improving Model Outputs: Implementing stricter validation mechanisms within their AI models to identify and flag non-existent package names before suggesting them to developers.
• Collaborating with Security Researchers: Engaging with researchers like Churilov to understand the nuances of these threats and develop effective countermeasures.
• Enhancing Documentation and Warnings: Providing clearer guidance to developers about the potential for AI-generated suggestions to be inaccurate and emphasizing the importance of verifying all external dependencies.

For developers and organizations, several mitigation strategies are crucial:

• Rigorous Dependency Verification: Developers must treat AI-generated package suggestions with a healthy dose of skepticism. It is imperative to manually verify the existence and legitimacy of any package before incorporating it into a project. This includes checking official repositories, project websites, and community forums for confirmation.
• Using Trusted Sources: Prioritize packages from well-established and reputable organizations with a strong track record of security and maintenance.
• Dependency Scanning Tools: Employing advanced dependency scanning tools that can identify known malicious packages, outdated libraries, and security vulnerabilities.
• Software Composition Analysis (SCA): Implementing SCA tools to gain visibility into all open-source components used in applications, including their origins and potential risks.
• Security Awareness Training: Educating development teams about the risks of slopsquatting and other AI-related security threats.
• Monitoring and Auditing: Regularly auditing project dependencies and code for any signs of compromise or unusual behavior.
• Reporting Suspected Hallucinations: Developers who encounter AI-generated non-existent package names should report them to the AI tool providers to help improve the models.

The Future of AI in Development and Cybersecurity

The rise of AI-powered coding assistants marks a significant paradigm shift in software development. These tools offer immense potential for boosting productivity, accelerating innovation, and democratizing coding. However, as slopsquatting demonstrates, this progress is not without its challenges. The integration of AI into critical development workflows necessitates a parallel evolution in cybersecurity practices.

Churilov’s research serves as a critical early warning. The fact that a consistent set of fake package names is being generated by multiple leading AI models highlights a systemic vulnerability. The availability of these names for registration by malicious actors transforms a theoretical risk into an immediate and tangible threat.

The cybersecurity landscape is in a constant state of flux, and the advent of AI has introduced new dimensions to this ongoing battle. The slopsquatting threat underscores the need for a collaborative effort between AI developers, cybersecurity experts, and the developer community to build more secure AI-powered development environments. By understanding the mechanisms behind these AI hallucinations and implementing robust verification processes, organizations can mitigate the risks and continue to harness the transformative power of AI in software development, while safeguarding against the evolving tactics of cyber adversaries. The responsibility now lies with all stakeholders to ensure that the future of coding is not only more efficient but also demonstrably more secure.