Five frontier LLMs hallucinated the same fake package names in 200,000 coding prompts
nptacek · x · 2026-07-23
A report from the coding community warns that AI-suggested dependencies should be treated like pull requests from strangers.
Across roughly 200,000 coding prompts and five frontier LLMs, every model hallucinated the same nonexistent package names. The report says 53 of those names are still available to register on PyPI or npm, meaning one slopsquat can potentially affect users of all models.
More from coding & agent
- GPT-6 Astra beats Factorio with enemies in 44 in-game hours at ~$4,500 API cost — liminal_bardo · 2026-09-11
- 105 hidden bugs, 2 repos: DeepSeek V4.1 Flash fixes 24 at $1.80 vs Opus 5's 27 at $51.33 — ChartsJournalX · 2026-09-11
- Investment Analyst Asks How to Build a Claude-Based Diligence Agent Stack — Careless_Tie2286 · 2026-09-11
- Treating agents like 50 First Dates: a 3-layer context system so every conversation doesn't start from zero — evielync · 2026-09-11
- Running the Firefox MCP on Android via Termux, ngrok, and mcp-proxy — Nervous-Strain7544 · 2026-09-11
- SmolVM open-sources persistent computer infrastructure for agents that outlive chat sessions — aniketmaurya · 2026-09-11