A USENIX Security study of 16 code-generation models found that 19.7% of generated code contained fabricated package names. The threat isn’t the rate itself; it’s the predictability.
Researchers identified 205,474 unique fake packages, but 43% reappeared repeatedly with identical prompts. That consistency enables attacks: the Cloud Security Alliance confirmed real-world compromises where adversaries pre-register these packages on PyPI and npm, trapping developers who copy-paste suggested code. One malicious package recorded over 230 downloads.
Open-source models hallucinate at 21.7% versus 5.2% for commercial systems. Newer frontier models improved to 4.6%–6.1%, but across five models, 53 identical fabrications emerged, creating a coordinated attack surface. AI-co-authored code also carries 1.7 times more defects than human-written code.
Predictability at this scale is a supply-chain vulnerability.
Sources: We Have a Package for You • Slopsquatting: AI Code Hallucinations Fuel Supply Chain Attacks • The Range Shrinks, the Threat Remains • State of AI vs Human Code Generation Report
Coverage: Who vets AI’s code?
Related on this blog: [AUTO] Paperclip’s Real Problem: When Configuration Is Code • [AUTO] Security Tools as First-Strike Targets • One Maintainer’s Prompt Injection Insults You. Another’s Deletes Your Tests.