Five frontier LLMs hallucinated the same fake package names in 200,000 coding prompts
nptacek · x · 2026-07-23
A report from the coding community warns that AI-suggested dependencies should be treated like pull requests from strangers.
Across roughly 200,000 coding prompts and five frontier LLMs, every model hallucinated the same nonexistent package names. The report says 53 of those names are still available to register on PyPI or npm, meaning one slopsquat can potentially affect users of all models.
More from coding & agent
- OpenAI and Twitch launch Codex hackathon with $25,000 in prizes — OpenAIDevs · 2026-10-26
- Codex adoption in Germany: weekly active users up 20x since January 2026 — testingcatalog · 2026-10-26
- Filtering secrets on the write path: why agent memory deserves more suspicion at ingest than retrieval — Classic-Being-7960 · 2026-10-26
- INT21's AI agent swarm rewrote Drama 3's inference runtime in Rust within one hour, beating SGLang-Omni — bingxu_ · 2026-10-26
- After OpenCode key leak: 5 practical rules for keeping keys away from agents — jacobholm_dev · 2026-10-26
- wandb 0.31.0 ships with 2x faster startup, adds JSON output for coding agents — wandb · 2026-10-26