§1What happened
An engineer at the software firm Softjourn was one command away from installing malware, and the thing that recommended it was the AI coding agent in their editor. The agent named a package. The name looked ordinary. It was not a project the engineer had used before, and it was not, in fact, a project at all: it was a name the model had produced, and someone had got there first. An attacker had registered that exact name on the public registry and filled it with malicious code, waiting for a developer to take the suggestion at face value.
What saved the machine was not the tooling. Softjourn has a house rule that any package an AI recommends is checked by hand before it goes in. The engineer opened the source on GitHub, saw a repository a few days old with almost no downloads, and stopped. One habit stood between a suggestion and a compromise. We are reading the mechanism rather than the near-miss, because the mechanism is already sitting in every agent-assisted editor.
§2The name that never existed
The attack has a name now, slopsquatting, and it is worth being precise about how it differs from the older trick. Typosquatting preys on human slips: you meant lodash, you typed lodahs, and something malicious is waiting on the fumble. Slopsquatting preys on the model. The AI does not misspell a real package. It invents one that never existed, a plausible name assembled from parts of things it has seen. There is no genuine package for a similarity check to flag, because there is nothing for it to be similar to. The fabrication is the product.
The part that turns a curiosity into a supply chain is consistency. The same model, asked similar things, tends to invent the same names. An attacker does not have to guess. They can watch what the popular models hallucinate, register those names first, and wait. The hallucination is stable enough to farm.
§3One in five
The scale is not anecdotal. A study presented at USENIX Security 2025, We Have a Package for You!, ran sixteen code-generating models across Python and JavaScript and checked every package each one recommended. 19.7% of the recommended packages did not exist. Across the run the researchers logged 205,474 distinct hallucinated names, and roughly half were pure fabrications rather than typo-like variants of real projects. Nearly one suggestion in five points at a package that is not there, and every one of those is a name an attacker can claim.
Put the two facts side by side and the exposure is plain. The models invent at a measurable rate, they invent consistently, and the registries let anyone register a name for nothing. The only question left is whether the install happens before anyone looks.
§4The human was the last line, and it nearly wasn't
Softjourn's save is the uncomfortable part, not the reassuring one. The control that worked was a person with a rule and a spare minute. That is exactly the control that fails under load, and load is what an AI agent exists to add. You bring the agent in to move faster; the faster you move, the less the "check every suggestion by hand" step survives contact with a deadline. A safeguard that depends on the human staying slower than the tool is a safeguard on a timer.
This is the same shape we have been reading all month, wearing a package manager instead of a browser. An agent produces an output, and a downstream channel treats that output as trusted enough to act on. Last week it was an assistant assembling a web address and a fetch tool that dutifully called it. This week it is an agent naming a dependency and an install command that dutifully pulls it. The dangerous step is never the model thinking. It is the boring executor at the end that accepts whatever the model handed it.
§5The boring fix
So put the check where it does not get tired. Before any agent-proposed dependency reaches a terminal, a gate cross-references the name against the registry: does this package exist, how old is it, how many downloads, is it signed, is it already pinned in the lockfile. A name that is days old with no history is not installed by a machine. It is held for a human, the same review Softjourn did by hand, done automatically every time. Better still, point the agent at a private registry or an allowlist of packages you already trust, so an invented name simply returns nothing instead of returning malware. And run the install in a sandbox, because "we verified the name" is not "we read the code".
It is the same principle we keep landing on, and it ran through the whole week's reading. Treat the model's output as untrusted content, not as a decision, which was the lesson of context injection, where a poisoned page becomes an instruction. Scope what the agent is allowed to reach, and for how long, which was the lesson of expiring authority, where a grant that never ends is a grant you cannot govern. The security boundary is not the agent's judgement about which package to name. It is what your install step will accept without being told to. Make that step boring, and one in five stops mattering.