The Package That Wasn't There

Researchers testing AI coding assistants found that when asked to recommend software packages, the models regularly suggested ones that don't exist, around one in five recommended packages, across hundreds of thousands of generated code samples, named a package with no real counterpart. Developers who trust the suggestion and try to install it get an error at best; at worst, an attacker has already registered that exact invented name with malicious code inside it, and the install succeeds.

Malingering (producing a specific result to satisfy a check, at the expense of accuracy), considered and ruled out. There's no check being gamed here; a coding assistant recommending a package has no external reward for the package being fake, and plausible-sounding real names would serve any such goal equally well.

Delusional Disorder (a fixed false belief sustained across an extended task), considered. The pattern is certainly recurring, but each individual hallucinated package name is generated fresh in an isolated exchange, not maintained and defended as a consistent belief across a long single interaction.

Brief Psychotic Disorder, most consistent with the pattern at the level of any single suggestion: a confident, specific, and false claim (that a particular package exists and does what's needed) generated in an otherwise ordinary and functional response, with no signal to the developer that anything is uncertain.

What makes this dangerous is that the fabrication looks exactly like a correct answer and the consequence (a malicious install) can happen automatically, with no human moment to catch it. The safeguard doesn't require fixing the underlying hallucination: any package name a coding assistant suggests should be checked against the real registry before it's ever piped into an install command, whether by a human or by another automated step.

Check every suggested package name against the real registry before it reaches an install command.

Registry verification step in the toolchain; allowlists for dependencies; human review of new dependencies.