For Heads-of · Practitioner
Slopsquatting
Registering software package names that AI coding assistants tend to invent, so that a developer who installs a suggested but non-existent package installs the attacker's code instead.
- package hallucination
- software supply chain
- AI coding
- typosquatting
How it works
Language models generating code sometimes import packages that do not exist, and many of the invented names recur when the same prompt is repeated. A 2025 study of 16 code-generating models found that about a fifth of the packages they suggested did not exist, and that 43% of the invented names reappeared every time the same prompt was rerun. An attacker who registers a recurring name on a public package registry then waits for developers, or coding agents, to install it.
Why it matters
AI-assisted coding is now routine, and coding agents can install dependencies without a person reading the name. Slopsquatting turns a model's hallucination into a software supply-chain compromise inside the organisation's own build.
Controls
Install dependencies only from an approved internal registry or allow-list, hold new or rarely used packages for review, check every AI-suggested dependency before use, and do not let coding agents install packages unsupervised. The register entry is LLM application supply chain vulnerabilities.
Sources
Related Terms
Agentic AI
An AI system that pursues a goal by deciding for itself which actions to take, in what order, using tools and other systems it has been given access to, with a person checking some or none of the steps. The governance change is that the unit of risk stops being a single output and becomes a sequence of actions with consequences.
AI Bill of Materials
A machine-readable inventory of what an AI system is built from: models, datasets, adapters, software dependencies, and their provenance and licences. It extends the software bill of materials to the components that make AI systems different.
AI Supply Chain Security
Assuring the integrity and provenance of everything an AI system is built from and depends on: pre-trained models and weights, adapters, datasets, libraries, serving infrastructure, plug-ins and tools. AI adds components that ordinary software supply-chain controls were not built to check.
Hallucination
Output that is fluent, confident and false. It arises from the same mechanism that produces correct output (a model predicting plausible continuations), which is why it is best understood as a property of the technology to be bounded rather than a defect to be fixed.