AI Hallucinations Lead to Unowned Code Packages in Corporate Networks
Researchers discovered 227 install commands in corporate documents pointing to unowned software packages, which were recommended by AI models like Claude, Codex, and Hermes. This exposes companies to supply chain vulnerabilities where attackers could register these names and inject malicious code. As developers increasingly rely on AI coding assistants, "AI package hallucination" creates a critical security loophole that allows attackers to hijack package names and compromise corporate networks. It highlights the urgent need for stricter verification of AI-generated code before deployment. The vulnerability occurs when Large Language Models (LLMs) hallucinate non-existent package names, which developers then copy and paste into their projects. If an attacker registers these hallucinated package names on public registries like npm or PyPI, they can execute arbitrary code on the target systems.
## BACKGROUND
AI package hallucination is a security risk where LLMs generate plausible-sounding but non-existent software library names in their coding suggestions. In software development, package managers automatically download dependencies from public registries based on these names. If a developer attempts to install a hallucinated package, and a malicious actor has registered that exact name, the system will download and run the attacker's code.