---
title: "[AUTO] AI's Predictable Hallucinations Become Supply-Chain Weapons"
pubDatetime: 2026-08-13T16:01:00.000Z
description: "AI models hallucinate package names predictably, enabling real-world supply-chain attacks."
tags: [ai-security, supply-chain, vulnerability, open-source, 2026, 2026-q3, 2026-08, AUTO]
---
A [USENIX Security study](https://www.usenix.org/publications/loginonline/we-have-package-you-comprehensive-analysis-package-hallucinations-code) of 16 code-generation models found that 19.7% of generated code contained fabricated package names. The threat isn't the rate itself; it's the predictability.

Researchers identified 205,474 unique fake packages, but 43% reappeared repeatedly with identical prompts. That consistency enables attacks: the [Cloud Security Alliance confirmed real-world compromises](https://labs.cloudsecurityalliance.org/research/csa-research-note-slopsquatting-ai-supply-chain-20260419-csa/) where adversaries pre-register these packages on PyPI and npm, trapping developers who copy-paste suggested code. One malicious package recorded over 230 downloads.

Open-source models hallucinate at 21.7% versus 5.2% for commercial systems. [Newer frontier models](https://arxiv.org/abs/2605.17062) improved to 4.6%–6.1%, but across five models, 53 identical fabrications emerged, creating a coordinated attack surface. [AI-co-authored code also carries 1.7 times more defects](https://www.coderabbit.ai/blog/state-of-ai-vs-human-code-generation-report) than human-written code.

Predictability at this scale is a supply-chain vulnerability.

---

*Sources: [We Have a Package for You](https://www.usenix.org/publications/loginonline/we-have-package-you-comprehensive-analysis-package-hallucinations-code)  •  [Slopsquatting: AI Code Hallucinations Fuel Supply Chain Attacks](https://labs.cloudsecurityalliance.org/research/csa-research-note-slopsquatting-ai-supply-chain-20260419-csa/)  •  [The Range Shrinks, the Threat Remains](https://arxiv.org/abs/2605.17062)  •  [State of AI vs Human Code Generation Report](https://www.coderabbit.ai/blog/state-of-ai-vs-human-code-generation-report)*

*Coverage: [Who vets AI's code?](https://www.bleepingcomputer.com/news/security/who-vets-ais-code-the-scale-challenge-facing-open-source-ingestion/)*

*Related on this blog: [[AUTO] Paperclip's Real Problem: When Configuration Is Code](/posts/auto-paperclip-agent-rce)  •  [[AUTO] Security Tools as First-Strike Targets](/posts/auto-litellm-trivy-supply-chain)  •  [One Maintainer's Prompt Injection Insults You. Another's Deletes Your Tests.](/posts/ghostty-harmless-prompt-injection)*