New Slopsquatting Attack Leverage Coding Agents Workflows to Deliver Malware

Researchers have identified a sophisticated new supply-chain threat targeting AI-powered development workflows, where malicious actors exploit coding agents ‘ tendency to “hallucinate” non-existent package names to distribute malware.

This emerging attack vector, dubbed “slopsquatting,” represents an evolution of traditional typosquatting that specifically targets the automated workflows increasingly used by developers relying on AI coding assistants.

Understanding the Slopsquatting Threat

Slopsquatting attacks exploit a fundamental weakness in AI coding agents: their propensity to generate plausible-sounding but entirely fictional package names during code generation.

Unlike traditional typosquatting, which relies on human typing errors, slopsquatting capitalizes on AI-generated hallucinations to trick developers into installing malicious packages.

The attack works by having threat actors monitor common hallucination patterns from popular coding agents, then pre-registering those phantom package names on public repositories like PyPI .

When developers subsequently run AI-generated installation commands, they unknowingly download and execute malware disguised as legitimate dependencies.

During recent research, investigators observed an advanced coding agent confidently generating a perfectly plausible package name that didn’t exist, only to have the build crash with a “module not found” error.

More concerning was the realization that malicious actors could easily register these hallucinated names, turning innocent AI suggestions into potential security breaches.

Vulnerability Across AI Coding Platforms

The research examined hallucination rates across multiple AI coding platforms, including Anthropic’s Claude Code CLI, OpenAI’s Codex CLI, and Cursor AI enhanced with Model Context Protocol (MCP) validation.

Testing revealed that while advanced coding agents incorporate reasoning and validation mechanisms to reduce phantom dependencies, they cannot eliminate the risk entirely.

Foundation models showed occasional spikes of two to four invented package names when prompted to bundle multiple novel libraries.

These hallucinations typically occurred during high-complexity tasks, where models would splice familiar terms like “graph” and “orm” into convincing but non-existent package names.

Advanced coding agents demonstrated approximately 50% fewer hallucinations compared to foundation models, thanks to features like extended thinking, live web searches, and codebase awareness.

However, they still exhibited vulnerabilities in specific scenarios, including context-gap filling and surface-form mimicry, where agents create legitimate-sounding packages based on statistical naming conventions without proper validation.

Even Cursor AI with MCP-backed real-time validation, which achieved the lowest hallucination rates, occasionally missed edge cases involving cross-ecosystem “name borrowing” and morpheme-splicing heuristics.

Security experts recommend implementing layered defense mechanisms to combat slopsquatting attacks.

Provenance tracking through Software Bills of Materials (SBOMs) provides auditable dependency records, while automated vulnerability scanning tools like Safety CLI can detect known CVEs before package installation.

Critical protective measures include deploying sandboxed installation environments using transient Docker containers or ephemeral virtual machines, ensuring AI-generated commands execute in isolated spaces.

Organizations should also implement prompt-driven validation loops requiring real-time package existence checks before finalizing code output.

Human-in-the-loop approval processes remain essential for reviewing unfamiliar packages, balancing automation benefits with security oversight.

Additional safeguards include containerized sandboxing, managed cloud sandboxes with network restrictions, and comprehensive auditing systems that log installation commands and monitor for anomalous behavior.

As AI-powered development tools become increasingly prevalent, the slopsquatting threat highlights the need for enhanced security frameworks in automated coding workflows.

The research demonstrates that while current AI agents have made significant improvements in reducing phantom dependencies, the complete elimination of this vulnerability remains elusive.

Organizations must recognize that simple package repository lookups provide insufficient protection, as malicious actors can proactively register hallucinated names.

The key lies in treating dependency resolution as a rigorous, auditable workflow rather than a mere convenience, significantly reducing the attack surface for supply-chain exploits.

Investigate live malware behavior, trace every step of an attack, and make faster, smarter security decisions -> Try ANY.RUN now

Based on reporting by Cyber Security News.