Analysis · curated 16 Jul 2026
Forget typosquatting; slopsquatting is the software supply chain threat created by AI coding tools | VentureBeat
First reported · updated · 8 reports venturebeat.com
Coverage timeline
Why it matters
Slopsquatting turns the predictable tendency of LLM coding agents to hallucinate dependency names into a reliable supply-chain infection vector, meaning auto-mode agents can silently install attacker-controlled malware before a human reviews the command.
VentureBeat and related sources describe "slopsquatting," a software supply-chain attack in which AI coding agents hallucinate non-existent package names and attackers preemptively register those names with malware. Research cited (Socket.dev, USENIX, and arXiv work including Ben Nassi et al.'s "adversarial hallucination squatting") finds hallucination rates as high as 19.7% of recommended packages, with hallucinated names repeated reliably (43-58%), enabling attackers to predict and register them; agentic "HalluSquatting" has been demonstrated to achieve remote tool and code execution and even botnet formation.
Summary
Slopsquatting is an emerging software supply-chain threat in which attackers register package names that AI coding agents hallucinate. When an agent operating in an auto-approval mode decides it needs a dependency and confidently invokes an install command for a non-existent (but attacker-registered) package, the malicious code is pulled in and executed before a human can review it.[0]
The threat is practical because hallucinations are repeatable and predictable: cited research reports that roughly one in five recommended packages do not exist and that a large share of hallucinated names recur consistently, letting attackers enumerate and pre-register the names most likely to be requested.[0]
Academic work extends this into 'adversarial hallucination squatting,' showing attackers can compute an LLM's hallucination distribution for trending resources, register those names to host adversarial prompts, and achieve remote tool execution and remote code execution against production LLM applications with integrated terminals — potentially at botnet scale. This lands against a backdrop of intentionally malicious packages already making up a large share of ecosystem vulnerability reports.[29][21]
How it works
AI coding assistants such as Claude or GPT, when generating code, sometimes hallucinate the name of a needed dependency and run an install command (e.g. 'composer require laravel-official/nightwatch'). If the hallucinated package name has been registered by an attacker, the agent installs and executes it automatically, especially when operating in an auto-approval mode without human review.[0]
The attack is reliable because hallucinations are consistent: cited research reports 19.7% of recommended packages do not exist, 43% of hallucinated names repeat every time, and 58% repeat across multiple runs, so attackers can enumerate likely hallucinations and pre-register matching packages.[0]
In the adversarial-hallucination-squatting variant, attackers select trending resources (popular repositories, skills), compute the LLM's distribution of hallucinated names for them, and preemptively register those names to host adversarial prompts. Because hallucinations transfer across foundational models and application layers, this scales into untargeted promptware and demonstrated remote tool execution and remote code execution against production LLM applications with integrated terminals.[29]
Key takeaways
- Slopsquatting turns the predictable, repeatable nature of AI package-name hallucinations into a reliable supply-chain attack vector against agentic development workflows.[0]
- Because hallucinations transfer across models and can yield remote code execution in production LLM applications, defenders should treat AI-driven dependency installation as an untrusted action requiring human verification and controls.[29][0]
- Malicious packages already make up a large share of ecosystem vulnerability reports (49% in NPM, 14% in PyPI) amid a 98% annual surge in OSS vulnerabilities, underscoring that package repositories are an actively targeted attack surface that AI hallucinations further amplify.[21]
Defensive actions
- Configure AI coding agents to require explicit human approval before running package-install commands such as composer or npm.: Auto-approval modes let agents install hallucinated (and attacker-registered) packages without any human check, so requiring approval blocks automatic execution of malicious dependencies.[0]
- Do not blindly approve installs; manually inspect each package's popularity, maintenance activity, and last update before allowing installation.: Slopsquatted packages are typically newly created and unpopular, so vetting these attributes helps distinguish legitimate dependencies from attacker-planted ones.[0]
- Enable a Minimum Release Age setting to block installation of packages created very recently.: Slopsquatting packages are commonly registered right after a hallucination is identified, so refusing freshly created packages defeats that timing.[0]
- Research and select dependencies before tasking the agent, then manually verify the package the agent selects.: Deciding on packages in advance removes reliance on the agent's hallucination-prone recommendations and gives time to properly vet options.[0]