An AI agent recommended to a developer the installation of a software package that turned out to be malware. The incident, reported by The Register and confirmed by Softjourn managing director Sergiy Fitsak, illustrates how language models can generate plausible but non-existent library names. Attackers exploit this vulnerability by registering malicious packages under those exact invented names, a technique known as slopsquatting.

Add AlexTech.ai asPreferred Source on Google

Manual verification as the last line of defense

Softjourn's team avoided compromise thanks to an internal policy requiring source code checks on GitHub before any installation. The developer noticed the recommended package had few downloads and was created only days prior, clear signs of suspicion. Fitsak emphasizes that this process takes just a few extra minutes but is crucial for distinguishing between legitimate libraries and malicious payloads designed to create backdoors or exfiltrate data.

The context of threats to AI agents

This case fits into a series of recent incidents highlighting supply chain risks in the era of autonomous agents. As previously documented in AI coding agent: the GitHub repo trick to inject malware and HalluSquatting: AI becomes the engine for massive botnets, attackers are systematically exploiting model hallucinations to distribute malicious code. Developer time pressure, combined with blind trust in automated suggestions, creates ideal conditions for these attacks.

The importance of human-in-the-loop control

The main lesson is not the deprecation of AI agents, but the integration of mandatory human oversight in the workflow. Every external recommendation must undergo a review verifying package origin, age, and reputation. Without this barrier, a single misjudgment can turn into a chain compromise that jeopardizes the entire corporate infrastructure.