Boundary case: no agent executed anything - AI coding assistants originated a non-existent dependency and humans installed it. Kept per batch-1 convention (boundary cases retained and flagged for definitional review).
id: PIR-2026-0007title: AI assistants repeatedly hallucinate the PyPI package "huggingface-cli"; a researcher registers it and it draws 30,000+ genuine downloads, including adoption in Alibaba's GraphTranslator READMEdate_occurred: late 2023 - early 2024 (package registered; ~3-month download window)date_detected: continuous (researcher-instrumented from registration)date_disclosed: 2024-03 (Lasso Security research; The Register coverage 2024-03-28)status: corroborated (researcher account + Alibaba repo artifact + independent coverage; download count is researcher-reported)agent_description: Multiple AI coding assistants (LLMs across vendors) that consistently hallucinated pip install huggingface-cli for the real huggingface_hub[cli]. Bar Lanyado (Lasso Security) registered the empty name on PyPI as a benign canary.operator_type: unknown (many independent developers relying on assistant output)autonomy_level: human-approves-each-action (humans ran the suggested installs)model_stack: multiple commercial/open models (Lanyado's study spanned several); versions unknownharness: n/a (chat/completions usage, no tool execution)authority_scope: none directly; the hallucinated dependency reached code execution on installers' machines via human actionfunds_at_risk_usd: unknown (a malicious payload would have had arbitrary code execution on 30,000+ installs)blast_radius: customers/third parties (every installer, plus downstream users of repos that adopted the instruction - incl. Alibaba's GraphTranslator)root_cause: plain-error (primary; persistent model hallucination of a plausible package name); contributing operator-error (developers installing unverified dependencies)failure_locus: dependency (the failure surfaces in the package supply chain, seeded by model output)exploitation_status: researcher-demonstrated (registration and benign payload were a researcher's; the 30,000+ downloads and Alibaba adoption were organic, in-wild reliance)mechanism: Models across vendors repeatedly emitted the same non-existent package name - hallucinations are correlated, not random, so one name concentrates thousands of victims. Lanyado registered the empty huggingface-cli on PyPI; in ~3 months it received 30,000+ authentic downloads, and Alibaba's GraphTranslator repo copy-pasted the hallucinated install command into its README, laundering the error into an authoritative source. A malicious squatter would have owned a mass supply-chain compromise. The pattern is now named "slopsquatting."adversary_present: no (benign researcher occupied the slot an adversary could have)severity: near-miss (full exposure of the installer population; zero realized harm because the payload was empty by the researcher's choice, not by any control)direct_loss_usd: 0indirect_loss_usd: ~0 (cleanup of the bogus dependency)downtime: nonedata_exposure: nonecontrols_that_worked: none (no registry, model, or human control blocked the adoption; the near-miss is luck-of-the-squatter)detected_by: third-party (the researcher who instrumented the experiment and disclosed)time_to_detect: n/a (researcher-observed from day one; the hallucination pattern itself had persisted for months)time_to_recover: unknown (Alibaba later corrected the README; per-installer cleanup untracked)remediation: public disclosure; the canary package neutralized the namestructural_fix: none systemic - registries still allow registering hallucination-prone names; the class of attack remains opentelemetry_grade: operator-logs (editable) - download counts are PyPI stats as reported by the researcher who owned the package; not independently auditedsources:Independence: mechanism and Alibaba adoption corroborated by independent outlets; the 30,000+ figure chains to Lasso's own report.
- confidence: medium - mechanism and adoption high-confidence; the download count (the headline number) rests solely on the researcher's reporting (the weakest link)