slopsquatting

advancedspreading

An attack where scammers publish malicious code under the names of AI-invented, non-existent software packages to trick unsuspecting developers into installing them.

In plain terms

Programmers rarely write everything from scratch: they download ready-made building blocks, called packages, from public repositories. AI assistants, however, sometimes recommend a package that does not exist, only sounding plausible by its name. This is one type of hallucination.

Slopsquatting builds on this. The attacker observes what made-up names the AI repeats, then uploads a real but malicious package under those names. Anyone who follows the AI's advice afterward installs the scammer's code.

It is as if a confident tour guide regularly sent tourists to a non-existent restaurant, and a sharp-eyed fraudster opened their own dubious eatery at exactly that address with exactly that name. The guest does not suspect anything, since they went where they were sent.

Traditional typosquatting preys on human typos, while this preys on machine errors. So you can get into trouble even if you never make a single typo yourself.

How it works

The AI writes code while referencing a package that does not actually exist, though its name is entirely plausible.
The error is not random: the model often gives the same fabricated name repeatedly to the same question, allowing an attacker to compile these in advance.
The attacker registers a real package under the invented name in a public repository (such as the Python or JavaScript package registry) and hides malicious code in it.
A developer or an independently working coding agent runs the installation without verification, since the AI recommended it.
Malicious code can run during installation or the first use of a package: it can steal passwords and access keys, or open a backdoor on the machine and in the software being built.

An everyday example

You ask an AI assistant to write a small program that creates invoices from Excel spreadsheets. The response includes an installation command for a plausible-sounding package; you copy it and run it. However, the package was uploaded a few weeks ago by a fraudster who knew that AI tends to invent that name.

Who is affected

developerThey run the installation command, so they must verify that the package recommended by the AI is genuine and reliable. → Code

entrepreneur, executiveIf an infected package enters the company's software, it can lead to data leaks, downtime, and customer loss.

parent, student, teacherThose learning programming with AI and hobby coders are the most vulnerable because they cannot yet judge which packages are suspicious. → Education & Family

everyoneThe infected building block can also end up in applications you use every day, without you knowing it.

A common misconception

MythIf AI recommends a package, it definitely exists and is safe.

In realityA language model does not look the name up in the package repository on its own; it only writes down a name that sounds plausible. It can verify only if it has been given a search tool and actually uses it. Even if the name exists, that is not reassuring, as an attacker may have registered it.

Limits and risks

The risk does not disappear just because you use a better model: errors become rarer, but a single bad deployment is enough to cause trouble.
Anyone can upload to public package repositories, so the mere existence of a package proves nothing. Check who released it, how long it has existed, and how many people use it.
Independent coding agents can install software without human approval, so the risk is greater there. It is advisable to tie installation to permission.
Defense is largely a matter of discipline: without a fixed dependency list, verification tools, and a list of allowed packages, flaws can easily go unnoticed.

Similar, but not the same

typosquatting – There, the attacker relies on human typos (for example, a letter swap in a name); here, on an AI-generated name.
hallucination – Hallucination is the error itself, meaning the AI states something untrue; slopsquatting is the attack that intentionally exploits this error.
prompt injection – There, the attacker diverts the AI with a hidden instruction; here, there is no need to influence the model, just wait for it to err on its own.

Related concepts

Broader

supply chain attack, AI safety, cybersecurity

Narrower

–

On the edge

package hallucination, hallucination, typosquatting, prompt injection, vibe coding, coding agent

A brief history

Security researchers described the phenomenon from 2023. The term "slopsquatting" was coined by Seth Larson, a security developer at the Python Software Foundation; the word spread in 2025. A major university study, published in 2024 and presented at the USENIX Security conference in 2025, analyzed 576,000 code samples from 16 models. Nearly one-fifth of the package references pointed to non-existent packages: this averaged roughly 5 percent for commercial (closed) models and roughly 22 percent for open-source models.

Where things stand

At the end of 2026, the security profession treats this as a known, tracked risk that is gaining weight as AI-written code and coding agents that install packages on their own become more widespread. Defensive tools (package verification, allowlists, approval before installation) exist, but are not yet the default everywhere.

Status: 2026 November

In the news

Appears in 2 Agent Age stories; the curve shows weekly occurrence in the news magazine.

Slopsquatting: one in five AI code samples recommends a package that does not existOct 27, 2026 · Code
Slopsquatting turns AI-hallucinated package names into a new supply chain risk for codingAug 19, 2026 · Code

Also known as

slopsquatting · slop squatting · slopsquatting attack · package hallucination attack · package hallucination · package hallucination attack · AI package hallucination · hallucinated package attack

Sources

This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.