2026-08-20 / Signal #4
An AI Coding Agent Hallucinated a Package Name—Hackers Were Already Squatting It
“The model made up a package. The malware was already waiting.”
The Story
An engineer asked an AI agent for a library; it invented a plausible-sounding name. Attackers had already published real malware under that exact hallucinated name (“slopsquatting”). The company’s “check GitHub downloads and source first” rule caught it. Attackers now systematically register the names models like to invent.
Why It Matters
AI coding agents are creating a new supply-chain attack surface that only exists because models hallucinate. Concrete builder incident, future-shock, immediate utility.
Evidence
The Register (Aug 20), first-hand company account
Sources
Daily scan: 2026-08-20