NewsPublished 13 Aug 2026

Who Vets AI’s Code? The Scale Challenge Facing Open Source Ingestion

Source Bleeping Computer

Description

AI coding tools can introduce unvetted or hallucinated open source dependencies into development pipelines faster than traditional security reviews can handle. This creates a supply chain risk known as slopsquatting, where attackers register malicious packages with names hallucinated by AI models to compromise builds. The rapid adoption of AI coding assistants has outpaced legacy ingestion controls, causing vulnerabilities to propagate through automated dependency suggestions. Securing the pipeline requires governing package selection before build time, using curated and pre-vetted repositories to block malicious or outdated dependencies. This threat highlights the operational challenge of balancing developer productivity with supply chain security in AI-assisted software development.

Impact

The threat enables attackers to compromise software supply chains by exploiting AI-generated hallucinated package names, leading to malicious code inclusion in builds without explicit human selection. This can result in compromised CI/CD pipelines and downstream propagation of vulnerable or malicious dependencies across multiple repositories. The velocity of AI code generation outpaces traditional security reviews, increasing the risk of supply chain attacks and elevating defect density in open source contributions. Organizations without proper ingestion governance face heightened exposure to slopsquatting attacks and associated CVEs, potentially undermining software integrity and security.

Defensive guidance

Mitigation focuses on proactive governance at the point of package selection rather than post-commit scanning. Recommended actions include blocking direct queries from developer workstations and AI agents to unvetted public package registries, isolating AI-suggested dependencies in sandbox environments for automated vulnerability and reachability analysis, and employing curated ingestion gateways that pre-vet packages against known malicious typosquats and slopsquatting targets. Using solutions like ActiveState’s Secure Open Source Library can reduce exposure to slopsquatting vectors by approximately 95% without hindering developer productivity. Organizations should update supply chain ingestion policies to govern AI-assisted code generation effectively.

Summary

AI coding assistants generate code and suggest dependencies at machine speed, often recommending package names that do not exist or are outdated and vulnerable. This phenomenon, called slopsquatting or AI package hallucination exploitation, allows attackers to pre-register these hallucinated package names on public registries like PyPI or npm and upload malicious payloads. When automated developer environments or CI/CD pipelines fetch these packages, builds become compromised. A USENIX Security study showed a measurable percentage of AI-suggested packages are hallucinated or vulnerable. Early 2026 incidents tracked a hallucinated npm package spreading across hundreds of repositories before detection. Traditional post-commit scanning tools struggle to keep pace with this velocity, necessitating governance at the point of package selection. Mitigations include blocking direct registry queries by AI agents, sandboxing new dependencies for automated analysis, and using curated ingestion gateways to pre-vet packages. ActiveState’s Secure Open Source Library exemplifies such a solution, reducing exposure to slopsquatting by about 95%. The challenge extends to open source maintainers who face increased defect density and policy conflicts due to AI-generated contributions. Overall, securing AI-assisted development pipelines requires updated supply chain ingestion rules and proactive governance to prevent automated compromise.

References

bleepingcomputer.com/news/security/who-vets-ais-code-the-scale-challenge-facing-open-source-ingestion/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 13 Aug 2026, 14:11 UTC

References

Community reviews