How AI Hallucinations Fuel a New Wave of Supply Chain Attacks

Emily Davis · 2026-07-24

You've probably heard about AI writing poems or inventing facts. But did you know those same hallucinations are now being weaponized to sneak malicious code into your software supply chain? It's a new breed of attack, and it's happening under our noses. Security researchers have identified a troubling pattern: attackers are exploiting the very behavior that makes AI coding assistants so useful. When an AI tool suggests a package name, a repository, or a domain that doesn't actually exist, developers (or automated pipelines) can end up pulling in malicious code from a lookalike source. This isn't a theoretical risk. It's happening right now. ### The Same Trick, Different Names You might have heard terms like "slopsquatting," "phantom squatting," or "HalluSquatting." They sound like different things, but they're all variations of the same basic attack. The core idea is this: an AI model hallucinates a name for a software package, a code repository, or a web domain. That name doesn't exist yet. An attacker then registers that name and hosts malicious code there. When your AI agent or build pipeline tries to fetch that resource, it gets the attacker's version instead. It's a late-binding attack. The trust happens at the last possible moment, when the code is actually being fetched. And because the AI "suggested" it, there's a false sense of legitimacy. ### Why This Is So Dangerous Traditional supply chain attacks rely on typosquatting (like "requsts" instead of "requests") or dependency confusion. But this new approach is different. The AI isn't making a typo. It's inventing something entirely new. There's no legitimate package to compare against. There's no warning flag. The attacker simply waits for the AI to generate a phantom name, then snaps it up. Here's what makes it particularly nasty: - **No prior existence:** The package or domain never existed before, so there's no history to check. - **Automated trust:** CI/CD pipelines often blindly trust package registries. - **Scale:** AI can hallucinate thousands of plausible names per minute, giving attackers a huge surface area. - **Hard to detect:** Traditional security tools look for known malicious patterns, not phantom names. ### How ActiveState Is Fighting Back ActiveState has been at the forefront of this problem. Their approach isn't about detecting attacks after they happen. It's about preventing them from ever reaching your pipeline. They use two key strategies: pre-fetch verification and governed dependency management. **Pre-fetch verification** means that before any package is downloaded, the system checks whether the name actually corresponds to a legitimate, known resource. If the name was hallucinated, it won't match anything in the verified registry. The download is blocked automatically. **Governed dependency management** takes this a step further. Instead of letting developers or AI agents pull packages from the open internet, all dependencies are curated and approved in advance. Only packages from a trusted catalog are allowed. This eliminates the risk of accidentally pulling a phantom package. Think of it like this: instead of letting your team order ingredients from any random vendor on the internet, you stock your own pantry with pre-approved supplies. No one can accidentally order from a fake vendor because there is no ordering process for unapproved sources. ### What You Can Do Today You don't need to wait for a perfect solution. There are practical steps you can take right now: - **Pin your dependencies:** Always specify exact versions, not ranges. This prevents unexpected updates from pulling in malicious code. - **Use a private registry:** Host your own package registry with only approved packages. This is the single most effective control. - **Audit your AI tools:** Check which AI coding assistants your team uses. Understand how they suggest package names. - **Enable pre-fetch checks:** If your toolchain supports it, enable verification before any package download. - **Train your developers:** Make sure every developer understands that AI suggestions are not guaranteed to be safe. Treat them as starting points, not final answers. The rise of AI-generated code is a huge productivity boost. But it also opens the door to new attack vectors. The good news is that the defenses are straightforward. A little governance goes a long way. And with tools like ActiveState's pre-fetch verification, you can catch these attacks before they ever touch your codebase. Stay sharp. And remember: just because an AI said it, doesn't mean it's real.