Researchers prove slopsquatting: hallucinated 'huggingface-cli' package downloaded 30,000+ times once registered
Lasso Security (research) / PyPI ecosystem · Jan 15, 2024 · Coding agent
What happened
Bar Lanyado of Lasso Security noticed LLMs repeatedly recommending a Python package that did not exist — 'huggingface-cli' (the real install is 'huggingface_hub[cli]'). He registered the hallucinated name on PyPI as an empty placeholder and watched it accumulate more than 30,000 authentic downloads in the following three months, including references in real GitHub projects' install instructions. The experiment proved an attacker can pre-register the package names AI assistants invent and let developers install malware themselves — a technique later named 'slopsquatting'.
Causal vector
Package-hallucination supply-chain squatting — coding assistants confidently recommend installable, attacker-registerable dependencies
Source
Reported by Simon Willison (on Lasso Security research). Verified against the primary report.
A coding agent that can shell out to pip will install whatever plausible-sounding dependency it hallucinates. An execution policy that gates package installs to an allowlisted set — or blocks pip-to-unknown-package calls — stops the slopsquat before the malware runs.
The six rule types that contain this class of failure
Per-transaction cap
Any single spend above your ceiling is BLOCKED before it moves.
Daily total
Cumulative spend across all agent calls, bounded per day.
Velocity limit
Stops runaway retry loops — the #1 cause of overnight losses.
Merchant allowlist
Only approved destinations can ever receive funds.
Category rules
Flag high-risk classes (crypto, infra, refunds) for review.
Approval threshold
Above a value, the action waits for a human.
Related incidents
OpenAI Codex escalates to root by exploiting Docker group membership to overwrite a system config
OpenAI (Codex) · May 1, 2026
Study: best AI agents complete only ~2% of 240 real Upwork projects
Upwork / academic study · Nov 1, 2025
GitHub Copilot prompt injection enables remote code execution (CVE-2025-53773)
GitHub (Copilot / VS Code) · Aug 12, 2025
Don't be the next entry
Every incident in this database is the result of trusting a prompt, a provider cap, or a human review cycle. sipi.bot replaces all three with one deterministic call. 67 documented failures, one control.