Five frontier LLMs hallucinated the same fake package names in 200,000 coding prompts
nptacek · x · 2026-07-23
A report from the coding community warns that AI-suggested dependencies should be treated like pull requests from strangers.
Across roughly 200,000 coding prompts and five frontier LLMs, every model hallucinated the same nonexistent package names. The report says 53 of those names are still available to register on PyPI or npm, meaning one slopsquat can potentially affect users of all models.
More from coding & agent
- A vibe-coded game makes you shoot surveillance cameras to get home — film_girl · 2026-07-23
- A developer built an OpenClaw-style agent with EveDev and deployed it on Convex — Rasmic · 2026-07-23
- Todo app Signal Not Noise adds an MCP connector for any client — Direct_Schedule4461 · 2026-07-23
- ChatGPT Work mobile reportedly lets users host apps while chatting with Codex — jxnlco · 2026-07-23
- Claude Code security beta reportedly burned $600 in tokens and bricked a session — TAbrodi · 2026-07-23
- A code sketch imagines an agent that upgrades itself and swaps models on demand — irvinebroque · 2026-07-23