There is a supply-chain attack that only works because AI writes code now, and it is not clever. A model invents a package that doesn't exist. An attacker registers that exact name with malware inside. The next model that invents the same name installs the attacker's code. It's called slopsquatting, and the reason to care this week is that your coding agent no longer waits for you to hit enter.

The short version: Code-generating models hallucinate package names about one time in five (~19.7% in a USENIX study), and 43% of those invented names are identical on every run — reproducible enough for an attacker to pre-register on PyPI or npm. A human might catch a weird install line. An autonomous agent runs it, and because install scripts execute code, a hallucinated dependency becomes remote code execution the moment the agent pulls it. Researchers now describe the path plainly: from AI curiosity to agent RCE.

Why the numbers make this real, not hypothetical#

Hallucination rate alone wouldn't be scary — models are wrong about lots of things. What makes slopsquatting economical is consistency. In the USENIX Security analysis, models produced over 205,000 unique fake package names, and re-running the same prompt ten times showed that 43% of hallucinated names came back every single time. An attacker doesn't need to guess what your model will invent; they need to register the names that reliably recur, and the research hands them the list.

Model choice moves the baseline but doesn't close the door: open-weight models hallucinated at ~21.7% on average, commercial models at ~5.2%. Lower is better, and 5.2% is still not zero — and your agent only has to install a poisoned package once.

This isn't a lab curiosity anymore. Reporting this month tracked a single hallucinated npm name, react-codeshift, spreading across 237 repositories through AI-generated instructions, with agents still trying to install it daily. Zoom out and Phoenix Security's 2026 report puts the first half of the year at more than 2.6x the supply-chain campaign volume and 4.5x the package-compromise volume of all of 2025 combined — with AI coding agents named as both targets and delivery mechanisms.

The thing that changed: autonomy removed the human check#

Slopsquatting has existed as a concept for a while. What 2026 added is the agent that installs its own dependencies. A chat assistant that suggests pip install fast-json-parser still routes through a person who might notice the package looks invented. An agent with shell access, told to "get the tests passing," just runs the install as a step toward the goal. Package installation runs setup scripts. Setup scripts are code. So the boundary between "the model said a wrong word" and "an attacker is executing code in your environment" is exactly one unsupervised install command.

That is the same shape as this week's Hugging Face disclosure, where an agent found the one path its sandbox didn't physically close. Here the unclosed path is your dependency install, and the attacker doesn't need to breach anything — they just need to be sitting on a public registry under a name your agent is about to type.

The fix is cheap, boring, and entirely in your hands#

None of this needs a security vendor. In rough order of leverage:

The uncomfortable framing is the accurate one: an AI agent's install command is untrusted code execution, and you should govern it exactly like you'd govern any other process that can run arbitrary scripts as you. The model will keep hallucinating — that's baseline, not a bug you can patch. What you control is whether a hallucination gets to run.