First reported · updated · 3 reports snyk.io
Lead dispatch
First reported · updated · 3 reports embracethered.com
AWS Kiro: Arbitrary Code Execution via Indirect Prompt Injection
Researchers found a vulnerability (CVE-2026-10591) in AWS Kiro, an agentic IDE, where hidden instructions planted in a web page or source file that Kiro processes can trigger indirect prompt injection to rewrite Kiro's own MCP server configuration (~/.kiro/settings/mcp.json) or allowlist arbitrary Bash commands in .vscode/settings.json, achieving arbitrary code execution on the developer's machine with no approval prompt. The human-in-the-loop approval boundary is bypassed because Kiro can write to these config files without user consent, and AWS has issued a fix and CVE.indirect-prompt-injection · prompt-injection · remote-code-execution · tool-abuse · config-poisoning
ai-agents · mcp · llm · agentic-ide
Severity
0.85
The wire · latest
First reported arxiv.org
Names Can Hurt: Spotting Slopsquatting Risks Caused by Package Name Hallucinations in Local Coding LLMs
The paper 'Names Can Hurt' studies slopsquatting, where local coding LLMs hallucinate Python package names that adversaries can pre-register on PyPI to achieve supply-chain compromise, and proposes a two-layer detector combining a deterministic PyPI existence check with a Random Forest classifier embedded in a LangGraph retry pipeline. Across 300 curated prompts the pipeline yields hallucination-free code on 76% of runs, and the authors find hallucination rates scale with prompt adversariality (up to 40-73% on slopsquat baits) and that same-family fallback models fail to recover ~84% of primary failures. Details →First reported · updated · 2 reports youtube.com
What is 'SlopSquatting'? - YouTube
Tanya Janca (SheHacksPurple) explains 'slopsquatting,' a software supply-chain attack in which an AI coding assistant hallucinates a non-existent package name, and a malicious actor then registers that name and fills it with harmful code so developers unwittingly download it. The one-minute video defines the concept and warns developers against blindly trusting AI-generated package recommendations. Details →First reported · updated · 8 reports venturebeat.com
Forget typosquatting; slopsquatting is the software supply chain threat created by AI coding tools | VentureBeat
VentureBeat and related sources describe "slopsquatting," a software supply-chain attack in which AI coding agents hallucinate non-existent package names and attackers preemptively register those names with malware. Research cited (Socket.dev, USENIX, and arXiv work including Ben Nassi et al.'s "adversarial hallucination squatting") finds hallucination rates as high as 19.7% of recommended packages, with hallucinated names repeated reliably (43-58%), enabling attackers to predict and register them; agentic "HalluSquatting" has been demonstrated to achieve remote tool and code execution and even botnet formation. Details →First reported · updated · 13 reports dev.to
Slopsquatting: The Supply Chain Attack That Weaponizes AI Hallucinations
An explainer on slopsquatting describes how code-generating LLMs like GitHub Copilot and ChatGPT hallucinate plausible-sounding but non-existent package names, which attackers can pre-register on repositories such as PyPI and npm to distribute malicious code to developers who unknowingly install them. The piece synthesizes academic research measuring package-hallucination rates (5.2% for commercial and 21.7% for open-source models per Spracklen et al.) and defensive strategies. Details →First reported youtube.com
Dependency Confusion, Typosquatting, and Slopsquatting: The New Danger of Installing Libraries
A Spanish-language YouTube explainer video covers software supply-chain attacks — dependency confusion, typosquatting, and slopsquatting — with the AI angle that coding assistants can hallucinate nonexistent library names that attackers then register to exploit future model recommendations. The video also discusses lockfiles, hashes, SBOM, SLSA, and best practices for vetting dependencies, and notes it was itself produced with AI assistance for informational purposes. Details →First reported medium.com
Block AI from installing malicious npm packages
Prasanna Mestha describes a defensive tool built to sit between AI coding agents and the npm registry to block installation of malicious or hallucinated packages, framed around the slopsquatting threat. The write-up cites real cases including the phantom 'react-codeshift' package requested hundreds of times a day and an August campaign in which a single threat actor pushed over 700 AI-named malicious npm packages that deliver a cross-platform RAT via README instructions. Details →First reported theregister.com
AI agent suggested installing a malware package. Engineer almost took its advice
An engineer at Softjourn nearly installed a malware package after an AI agent recommended a legitimate-sounding but hallucinated package name — an attack pattern called 'slopsquatting,' where attackers register real malicious packages under names AI models are known to invent. The developer caught it by following company policy to verify download counts and review GitHub source before installing. Details →First reported · updated · 2 reports bleepingcomputer.com
Who Vets AI’s Code? The Scale Challenge Facing Open Source Ingestion
A sponsored ActiveState article explains slopsquatting (AI package hallucination exploitation), where LLM coding assistants suggest non-existent package names that attackers then register on PyPI/npm with malicious payloads to be fetched by CI/CD pipelines. It cites a USENIX Security study across 16 code-generation models and 500,000+ samples, and a 2026 example where a hallucinated npm package name (react-codeshift) spread through forks to over 230 repositories. Details →First reported medium.com
From SolarWinds to Slopsquatting: What Five Years Changed in Software Supply Chain Security
A retrospective essay by Manjit Singh reflects on five years of software supply chain security from SolarWinds and Log4Shell to the present, arguing that SBOMs remain unchanged while the surrounding ecosystem has been rebuilt, with AI now positioned as both the biggest new attacker (e.g. slopsquatting, where LLMs hallucinate package names attackers register) and a promising defender. Details →First reported · updated · 7 reports paloaltonetworks.com
Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector
Unit 42 researchers describe "Phantom Squatting," a software supply chain vector in which attackers register web domains that large language models and AI coding assistants hallucinate and recommend in generated code, so that developers who trust the AI output are steered toward attacker-controlled infrastructure. The research measures the phenomenon of AI-hallucinated domains (tagged Agentic AI, LLMs, and Malicious Domains) and frames it as an emerging supply chain risk. Details →First reported · updated · 2 reports arxiv.org
The Range Shrinks, the Threat Remains: Re-evaluating LLM Package Hallucinations on the 2026 Frontier-Model Cohort
A replication study by Aleksandr Churilov re-evaluated package-name hallucination across five 2026 frontier code LLMs (Claude Sonnet 4.6, Claude Haiku 4.5, GPT-5.4-mini, Gemini 2.5 Pro, DeepSeek V3.2), measuring hallucination rates of 4.62%-6.10% across ~199,845 Python/JavaScript prompts. The authors identified 127 package names all five models invent identically and, after coordinated disclosure with PyPI Security and Socket, found 53 (41 PyPI, 12 npm) remain registrable by an attacker, forming a model-agnostic slopsquatting supply-chain attack surface. Details →First reported · updated · 2 reports thehackernews.com
Open VSX Removes 77 Malicious Evil Twin Extensions Exfiltrating Developer Data
Manifold Security identified 77 counterfeit "evil twin" extensions uploaded to the Open VSX registry between July 26 and August 1, 2026, each impersonating a real extension's name and namespace at version 0.0.1 and beaconing to a newly registered domain; 19 carried a full reconnaissance payload exfiltrating git remote host/org, commit email domain, workspace path, branch, HEAD commit, and CI project identifiers (effectively private repo paths on build runners). The packages were removed from Open VSX by August 3, though the contacted infrastructure remained live. The research ties the risk to automated name resolution by AI coding agents, devcontainer configs, and provisioning scripts that install by name across registries, citing Anthropic's July 30 slopsquatting disclosure where a model-invented package name was executed by fifteen real systems. Details →First reported captechu.edu
AI-Driven Hallucinations in Cyber Supply Chain Lead to New Threat: Slopsquatting | Washington D.C. & Maryland Area | Capitol Technology University
A Capitol Technology University blog post describes 'slopsquatting,' a supply-chain threat in which AI code assistants hallucinate non-existent package names that attackers can pre-register with malicious code, causing developers who follow the AI's suggestions to install compromised dependencies. Details →First reported aol.com
HalluSquatting AI attack could hijack your computer
HalluSquatting is a technique detailed by researchers from Tel Aviv University, Technion, and Intuit in which attackers exploit AI coding assistants and browsing agents that hallucinate software repository names. By repeatedly prompting models to locate popular projects, attackers discover consistently invented (fake) repo/package names, register them, and plant malicious instructions so an AI agent that retrieves and runs the files can deliver malware, steal data, or recruit the device into a botnet. Details →First reported foxnews.com
HalluSquatting attack exploits AI hallucinations to spread malware
The HalluSquatting attack exploits AI hallucinations by registering package or software names that large language models invent when suggesting dependencies, so developers who trust AI-recommended names end up installing attacker-controlled malware. The technique weaponizes the tendency of LLMs to hallucinate plausible-sounding but nonexistent package names. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector