Can an AI agent install a package that never existed?

Yes, and it has a name

Slopsquatting is the registration of a package name that a model invents. Typosquatting waits for your fingers to slip. Slopsquatting waits for the model to be confident — and the model is confident in the same places over and over, which is what turns an error into an asset somebody can own.

The mechanism was measured properly at USENIX Security in 2025. Spracklen and colleagues generated 576,000 code samples across sixteen models and two languages, producing 2.23 million package references. Of those, 440,445 — 19.7% — named packages that do not exist on PyPI or npm, covering 205,474 distinct non-existent names.[1]

That 19.7% is the number everyone quotes. It was never the interesting one.

The two numbers underneath it

The same paper ran the prompts that had produced a hallucination ten more times each. 43% of hallucinated names came back on all ten runs; 39% never came back at all; 58% repeated more than once. The authors' conclusion is the one that matters: a majority of these are not random errors but a repeatable phenomenon. A name a model reliably invents is a name an attacker can register in advance and wait on.

And then the finding that quietly held the whole thing together: 81% of hallucinated packages were generated by only one model. The hallucinations were persistent within a model and idiosyncratic between them. An attacker could own a name, but only for the subset of teams running that one model.

That was the saving grace. It is gone.

What 2026 changed

The study was replicated in 2026 against five frontier models across 199,845 paired Python and JavaScript prompts. The rates fell and, more strikingly, the spread between models collapsed: 4.62% at the low end, 6.10% at the high end.[2] An order-of-magnitude compression of the range Spracklen measured.

Read as a safety story, that is progress. Read as an attacker, it is consolidation — and the paper's second finding says which reading is correct. 127 identical hallucinated package names appeared in the output of all five models, 109 on PyPI and 18 on npm.

The 81% figure was the defence. A model-specific hallucination forces an attacker to bet on your toolchain. A name that every frontier model invents is one registration that reaches every team regardless of what they run — which is why the paper's title concedes the range and keeps the threat.

Fifty-three of them were free

The 127 went through disclosure. PyPI's automated defences withdrew 68, manual validation removed 6 as false positives, and 53 were still registrable by anyone — 41 on PyPI, 12 on npm. Published examples include css-color-stop, dns-sd and dom-ains.[3]

Look at those three for a second. None is a misspelling of anything. Each is the name you would have guessed if someone asked you to guess. That is the property edit-distance scanners cannot see and the reason this is not typosquatting with a new label.

It is not theoretical

The first public proof is now two years old. Bar Lanyado noticed models repeatedly recommending pip install huggingface-cli — which is not how the real tool is installed — registered the name on PyPI as an empty package, and watched it take more than 30,000 downloads in three months. Alibaba's GraphTranslator repository was telling people to install it.[4]

The 2026 version is worse, because nobody has to type anything.

In October 2025 a single commit added 47 model-generated "agent skills" across 14 plugins to a public repository, with no sign of human review. Two of them — react-modernization and dependency-upgrade — instructed agents to run npx react-codeshift. The package was a plausible blend of two real ones, jscodeshift and react-codemod, and had never existed.

By January it was referenced in more than 237 repositories: roughly a hundred direct forks, one user who copied it into thirty of their own repos, several reorganisations into new directory layouts, and a Japanese translation. Aikido's Charlie Eriksen registered the name himself on 14 January 2026, defensively, before anyone else did.[5][6]

The detail worth sitting with is the telemetry afterwards. A dead phantom package typically sees sixty to a hundred downloads on its first day and then nothing. This one settled into a steady one to four downloads a day and stayed there. Something is still calling it.

Why agents make this materially worse

Three changes, and none of them is about the models getting worse.

• npx executes without installing. So do uvx and pipx. There is no dependency entry, no lockfile line, nothing for a scanner to reconcile later — the package is fetched and run. The confirmation prompt is the only gate, and an agent working through a task answers it the way it answers everything else.
• The name is never read by a person. In 2024 somebody had to see pip install huggingface-cli and choose to run it. In 2026 the name appears inside a step the agent performs, in a log nobody opens unless something breaks.
• Skills and configs propagate by copying. A hallucinated name in a source file is a bug in one repository. A hallucinated name in a skill file is a bug that gets forked, translated and vendored, and it keeps calling long after the original author has moved on.

What actually stops it

In order of how well each survives contact with a real team.

1. Proxy the registry and allowlist what comes through. A build agent that cannot reach npm or PyPI directly cannot install whatever a model named. This is the only control on the list that scales, because it moves the decision from did somebody notice to is it on the list.
2. Refuse packages that are too young. pnpm ships minimumReleaseAge with a 24-hour default; the equivalent exists for most ecosystems through a proxy. A slopsquat has to be registered before you reach for it, so a maturity delay forces the attacker to commit early and be found.
3. Gate new dependencies in CI, not in the prompt. Any dependency an agent introduces fails the build unless it was already approved. The invariant is that no model-generated token sequence becomes an installed dependency on its own authority.
4. Deny agents the execute-without-install verbs. npx, uvx, pipx. This is the sharp edge and it is the one your dependency tooling cannot see.
5. Reconcile the tree against the registry. First publication date, maintainer history, a repository link that resolves. This is the third pass of a security audit on AI-written code, and it is the pass that finds what the other four controls let through.

What does not work

• Telling the model to be careful. Persistence is a property of the weights, not of the prompt. The 43% that repeat ten times out of ten repeat under instruction too.
• Waiting for a better model. That is precisely what 2026 measured. The rate improved and the shared attack surface got worse.
• Edit-distance typosquatting detection. It is built to catch names that are near real ones. These are not near anything.
• Reviewing the diff. A reviewer sees an import for a package they have not heard of, in a language with two million packages, and moves on. That is not negligence, it is arithmetic.[7]

The honest summary is that this is a permissions problem wearing a hallucination costume. You are not going to stop a model inventing a plausible name. You can decide, once, that nothing enters your build because a model said so — and the readiness audit is largely about finding where that decision is currently being made by nobody.