Research demo
Realized harm
Researcher-registered LLM-hallucinated dependency drew over 30,000 authentic downloads and appeared in company repositories
AIR-2024-0014 AIR record · 2023-12-lasso-hallucinated-package-slopsquatting
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
The results are astonishing. In three months the fake and empty package got more than 30k authentic downloads! (and still counting).lasso.security
The record
Disclosed
2024-03-28
Occurred
2023-12
Vendor
multiple model vendors; PyPI as the registry
Product
AI coding assistants (GPT, Gemini, Cohere and others) and PyPI
Risk domain
Agent output quality › Hallucination
Also touches
Supply chain vulnerabilities
System type
Generative model
Who acted
Human acted on output (contested) — the model suggested a package name; humans and build systems installed it
Attack surface
Coding agent
Autonomy level
Assistant
Initial vector
Model hallucination supply chain
Impact type
Software supply chain exposure, Unauthorized dependency installation
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI08 – Cascading Failures
- MITRE ATLAS
- AML.T0062 – Discover LLM Hallucinations
- NIST AI RMF
- MEASURE 2.5
- EU AI Act
- —
- ISO/IEC
- TR 24028; 24029-1
- AIUC-1
- D. Reliability
- Scope
- agent failure
- Mitigation
- Implement fact-checking via knowledge base/RAG; Tune model temperature/top-p.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
more than 30,000 authentic downloads over three months; several large companies used or recommended the package in repositories
Capability abused
Defense & remediation
Recorded defense
none; registries accept any unclaimed name
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
none structural; awareness only
Taxonomy & references
Curator notes
Origin case for slopsquatting, reported by Bar Lanyado at Lasso Security. Class is research_demo because the researcher intentionally published an empty, benign package. impact_realized is true only in the narrow sense that real third parties downloaded it and company repositories used or recommended it; no malware payload or downstream loss is claimed. Later malicious evolution of the technique is recorded separately. AI Incident Database incident 731.
Supporting sources
Cite as
Enkrypt AI. "Researcher-registered LLM-hallucinated dependency drew over 30,000 authentic downloads and appeared in company repositories". AIR, AIR-2024-0014. https://agentincident.vercel.app/i/AIR-2024-0014/ (accessed 2026-10-19).