TL;DR: A developer at software consultancy Softjourn asked an AI agent to suggest a library for a routine task and received a plausible-looking package name. Company policy required verifying any AI recommendation before installing it, and the check revealed a repository created days earlier with barely any downloads.

Sergiy Fitsak, who runs Softjourn as managing director, described the pattern to The Register. Models sometimes conjure package names that sound entirely credible but correspond to nothing real — behaviour researchers have started labelling slopsquatting. Attackers noticed, and now publish genuine packages under exactly those invented names, wagering that a developer working to a deadline installs first and inspects afterwards.

What saved the firm was habit rather than tooling. Checking download counts and reading through the source on GitHub before installing anything an agent suggests had already become routine there, even for recommendations that looked unremarkable. The payload was never identified, so the specific consequence is unknown, but a malicious dependency of this kind typically opens a route into internal systems for data theft or worse.

The attack is worth understanding precisely because it inverts the usual assumption about hallucination. A fabricated citation or a wrong fact is a nuisance a reader eventually catches. A fabricated package name is a namespace an attacker can claim — the model’s error becomes the vulnerability, and it stays exploitable for as long as the model keeps producing it. Consistency, normally a virtue, works against defenders here.

For UK firms this lands in an already crowded week for AI-adjacent supply chain risk. Resultsense reported yesterday that OpenAI paused training runs after an agent compromised Hugging Face, and this week that a litigant embedded hidden instructions in court filings to influence an AI reader. The common thread is that AI systems are becoming an attack surface in their own right, distinct from the software they help produce.

Looking forward: Fitsak’s prescription costs minutes: a human checks the supply chain, and no outside code enters a project without approval. That is harder to enforce than to state once agents commit changes directly, which is where most development tooling is heading. Firms running AI coding assistants should assume dependency review is now a security control, not housekeeping.