As AI coding assistants become increasingly prevalent in software development, a growing concern has emerged about who is responsible for vetting the code generated by these tools. The issue is particularly pressing when it comes to open-source ingestion, where the sheer scale of code generation has outpaced traditional review processes. In other words, developers are adopting AI-assisted coding at an alarming rate, but security teams and maintainers are struggling to keep up with the volume of unvetted dependencies entering their environments.
This challenge was a common topic of discussion among AppSec leads, platform engineers, and CISOs at this year’s Black Hat conference. The question on everyone’s mind was: who is actually ensuring that AI-generated code is secure and trustworthy? The answer, unfortunately, is not always clear-cut. Large language models (LLMs) recommend software libraries based on statistical probability and historical code patterns, but these suggestions are often not verified against real-time package registry data.
As a result, developers may unwittingly introduce vulnerabilities into their codebases through a phenomenon known as “slopsquatting” or AI package hallucination exploitation. When an LLM suggests a package name that does not exist in public registries like PyPI or npm, it creates a supply-chain vulnerability that can be exploited by attackers. In fact, research has shown that nearly half of the dependencies suggested by popular code-generation models contain known CVEs or outdated releases.
Attackers are actively monitoring public LLM output patterns and developer code repositories to identify these hallucinated package names. Once identified, an adversary can register a dummy name on PyPI or npm, upload a malicious payload, and wait for automated developer environments or CI/CD builders to fetch it. This vector is not theoretical; security researchers have already tracked the spread of a single hallucinated npm package name through over 230 repositories.
The issue is not necessarily about malicious intent by developers but rather a lack of ingestion controls. As AI coding assistants generate software at machine speed, organizations need to prioritize secure repository management and build-level attestation to eliminate slopsquatting vectors at the intake step. By doing so, they can ensure that their pipeline remains secure and trustworthy.
The consequences of ignoring this challenge are far-reaching. The same AI assistants generating unvetted dependency suggestions inside enterprise networks are also contributing to automated pull requests submitted to community-maintained repositories. This volume of automated contributions puts unprecedented strain on human maintainers, who must contend with conflicting AI policies, higher defect density, and the need for increased validation efforts.
In conclusion, the scale challenge facing open-source ingestion is a pressing concern that requires immediate attention from security teams, developers, and maintainers alike. By prioritizing secure repository management and build-level attestation, organizations can mitigate the risks associated with slopsquatting and ensure the integrity of their codebases. It’s time to take control of AI-generated code and prove software provenance before it hits your build.
Source: Bleeping Computer — 2026-08-13