Recent research conducted by cybersecurity expert Aleksandr Churilov has highlighted the persistence of this threat. In his latest study, "The Range Shrinks, the Threat Remains: Re-evaluating LLM Package Hallucinations on the 2026 Frontier-Model Cohort," Churilov identifies a disturbing level of consistency in the errors produced by the world’s most advanced AI coding assistants. Despite advancements in model architecture and training techniques, the study reveals that AI tools are frequently suggesting the same fictional packages, providing a roadmap for malicious actors to exploit.
Understanding the Mechanics of Slopsquatting
To understand the gravity of slopsquatting, one must first distinguish it from its predecessor, typosquatting. In a traditional typosquatting attack, a hacker registers a domain or a software package name that is a common misspelling of a popular one—for instance, "requesst" instead of "requests." The attacker relies on human error during manual entry to facilitate the installation of malicious code.
Slopsquatting, however, shifts the point of failure from human manual dexterity to algorithmic probability. When a developer asks an AI coding tool to solve a specific problem, the AI may suggest a solution that includes an import statement for a library that does not actually exist. This is a "hallucination." If a developer, trusting the AI’s output, attempts to install this non-existent package, they find it missing. A malicious actor, having anticipated this hallucination, can pre-emptively register that specific package name on repositories like PyPI (Python Package Index) or npm (Node Package Manager), filling it with malware. When the developer runs the install command, they unknowingly integrate the hacker’s code into their enterprise environment.
Consistency Across the Frontier Models
One of the most striking findings in Churilov’s research is the homogeneity of hallucinations across competing AI platforms. The study evaluated five of the most prominent models in the "2026 Frontier-Model Cohort": Claude Sonnet 4.6, Claude Haiku 4.5, GPT-5.4-mini, Gemini 2.5 Pro, and DeepSeek V3.2.
Remarkably, Churilov found 127 specific hallucinated package names that were shared across all five models. This suggests that the problem is not isolated to a single developer’s choice of tool but is a systemic issue inherent in the current generation of LLMs. The fact that different models from different companies—trained on different datasets and utilizing different architectures—converge on the same fictional names indicates a deep-seated pattern in how AI perceives the "logic" of software ecosystems.
According to the research, there are two primary drivers for this conformity:
- Shared Training Foundations: Most LLMs are trained on vast swaths of the public internet, including GitHub repositories, Stack Overflow discussions, and technical documentation. If these sources contain outdated information, "zombie" references to deleted projects, or even common developer "wish-lists" for features, the models learn these as factual entities.
- Extrapolated Conventions: Software ecosystems follow strict naming conventions. For example, a Python developer looking for an authentication wrapper for the "Requests" library might intuitively look for something named
requests-auth-helper. LLMs are designed to predict the most probable next token. If a model "thinks" a library with a certain name should exist because it follows logical naming patterns, it will confidently suggest it, regardless of its actual existence in the real world.
The State of the Repositories: A Waiting Threat
As of April 2026, Churilov’s investigation into the 127 identified hallucinated names revealed a significant window of opportunity for cybercriminals. Of those 127 names, 53 remain available for registration by any member of the public. Specifically, 41 of these names are available on the PyPI repository, and 12 are available on npm.
While the research notes that there is currently no evidence that these specific 53 names have been registered with malicious intent or used in an active exploit, the vacancy itself is the danger. In the world of cybersecurity, an unpatched vulnerability is a ticking clock. The fact that the "hallucination list" is now effectively public knowledge via research papers means that the race between security researchers and "black hat" hackers has intensified.
Chronology of the Slopsquatting Evolution
The rise of slopsquatting can be traced through the rapid evolution of AI integration in the developer workspace:
- 2022-2023: The initial surge of LLM adoption (GPT-3.5 and GPT-4) led to the first recorded instances of AI hallucinations in code. Security researchers began warning that AI-generated code could contain vulnerabilities or suggest non-existent libraries.
- 2024: The term "AI Package Hallucination" became a recognized threat vector. Early attacks were sporadic and often experimental.
- 2025: As AI tools became more integrated into Integrated Development Environments (IDEs) through plugins and "copilots," the volume of AI-generated code in production environments spiked. Researchers identified the first organized attempts to "squat" on common AI-hallucinated names.
- 2026: Churilov’s research represents the latest frontier, showing that even the most advanced "Frontier" models (GPT-5.4, Gemini 2.5) have not yet solved the hallucination problem. The "range" of hallucinations may be shrinking as models get smarter, but the remaining hallucinations are more consistent and thus more easily targeted by attackers.
Industry Reactions and Security Implications
The implications of Churilov’s findings have sent ripples through the cybersecurity community and enterprise IT departments. Chief Information Security Officers (CISOs) are facing a new reality where the "productivity gains" promised by AI must be weighed against the potential for catastrophic supply chain compromises.
"The consistency of these hallucinations is the most worrying aspect," says one industry analyst. "If every major AI tool is telling developers to install a library called fastapi-cloud-validator, then that name becomes high-value real estate for a hacker. It only takes one distracted developer at a major corporation to create a breach that could affect millions of end-users."
In response to these threats, several package repositories have begun discussing more stringent verification processes. However, the open-source nature of PyPI and npm makes "pre-approving" every package difficult. Some security firms are now advocating for "AI-aware" firewalls that scan developer environments for any attempt to install packages that do not have a verified history or a minimum number of downloads.
Broader Impact: The Developer’s Dilemma
The slopsquatting threat highlights a broader psychological phenomenon known as "automation bias," where humans tend to favor suggestions made by automated systems and ignore contradictory information. For developers under pressure to meet tight deadlines, the AI’s suggestion feels like a shortcut. The friction of stopping to verify if a package actually exists on a repository is often bypassed in favor of speed.
Furthermore, the "shrinking range" mentioned in Churilov’s paper title suggests a paradoxical danger. As AI models become more accurate, developers may lower their guard. When a model is wrong 50% of the time, the user is skeptical. When a model is wrong only 0.1% of the time, the user is much more likely to accept that 0.1% error as truth. This makes the remaining hallucinations even more dangerous because they occur in an environment of high trust.
Fact-Based Analysis and Recommendations
To mitigate the risk of slopsquatting, the research suggests a multi-layered approach to security that combines technical safeguards with cultural shifts in development teams.
For Organizations:
- Internal Mirrors: Large enterprises should use internal package mirrors (like Artifactory or ProGet) that only allow the installation of pre-vetted and approved libraries.
- Audit Logs: Security teams must monitor package manager logs for "404 Not Found" errors, which may indicate that a developer attempted to install a hallucinated (and potentially squat-ready) package.
- AI Policy: Companies should implement clear guidelines on the use of AI coding assistants, emphasizing that all generated code—especially dependency imports—must be manually verified.
For Developers:
- Verify Before Install: Before running a
pip installornpm installcommand suggested by an AI, developers should verify the package’s existence, its maintainer history, and its download statistics on the official repository website. - Use Linting Tools: Modern linting and security scanning tools can be configured to flag new or suspicious dependencies before they are committed to the codebase.
Conclusion: A Persistent Frontier
The research by Aleksandr Churilov serves as a sobering reminder that the "AI revolution" in software engineering is not without its costs. While AI models are becoming more sophisticated, they are still probabilistic engines, not truth engines. As long as they are trained on human-generated data and operate on the principle of "plausibility," hallucinations will persist.
The threat of slopsquatting is a testament to the adaptability of cybercriminals. By turning the "intelligence" of AI against its users, they have found a way to automate the discovery of vulnerabilities. As we move further into 2026 and beyond, the security of the software supply chain will depend not just on the strength of our code, but on the skepticism with which we treat our most advanced tools. The range of the threat may be shrinking, but for the unwary developer, the danger remains as potent as ever.
