AI coding assistants like Claude and Copilot hallucinate non-existent package names 19.7% of the time, creating security vulnerabilities exploited by attackers registering fake packages with malicious code.

Claude Code, Cursor, Copilot, and ChatGPT all recommend packages that don't exist, with research showing roughly 1 in 5 package recommendations are fabricated

Attackers exploit this through 'slopsquatting' - registering fake package names on npm and PyPI with malicious code designed to steal credentials from developers' .env files

Autonomous agent execution of install commands without human review poses major security risks, as developers cannot catch hallucinated package names before installation

Current manual defenses like code review are insufficient when AI agents edit large portions of repositories independently