--- title: AI coding agents are recommending malware packages, and... description: AI coding assistants sometimes hallucinate package names that don't actually exist, and attackers are registering those exact names on public registries so... canonical: https://daily.dev/posts/ai-coding-agents-are-recommending-malware-packages-and-engineers-are-almost-installing-them-ww1ohnzqi twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: AI coding agents are recommending malware packages, and engineers are almost installing them | daily.dev og:description: AI coding assistants sometimes hallucinate package names that don't actually exist, and attackers are registering those exact names on public registries so... og:url: https://daily.dev/posts/ai-coding-agents-are-recommending-malware-packages-and-engineers-are-almost-installing-them-ww1ohnzqi og:image: https://api.daily.dev/og/posts/wW1oHnzqi.png og:image:alt: AI coding agents are recommending malware packages, and engineers are almost installing them og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # AI coding agents are recommending malware packages, and engineers are almost installing them **[Collections](https://daily.dev/sources/collections)** · 3 min read · 0 upvotes · 0 comments ## Summary AI coding assistants sometimes hallucinate package names that don't actually exist, and attackers are registering those exact names on public registries so that when an agent recommends the fake dependency, installing it pulls in malware instead. One engineer nearly shipped a malicious package after their AI assistant suggested it; only a company policy requiring manual verification of packages on GitHub before installation stopped it. Traditional vulnerability scanning doesn't catch this because the malicious package has no prior CVE history - the package itself is the attack. The piece argues manual review of AI-suggested dependencies is now a necessary control, not just good practice. ## Content There's a supply chain attack vector emerging that most security teams aren't scanning for yet, and it's moving fast. AI coding models hallucinate package names that don't exist. That's been a known quirk for a while. What's changed is that attackers are now registering those exact names and waiting for agents to install them automatically. Traditional CVE scanning doesn't catch this because the packages aren't in any vulnerability database - they're just quietly sitting there, waiting. ## The llms.txt problem Israeli researchers recently scanned 6,214 domains belonging to defense contractors, Fortune 500 firms, and major tech companies. They were looking at `llms.txt` and `llms-full.txt` files - documentation that companies publish specifically to help AI agents understand their sites. They found 120 sites pointing to package names or domains that nobody owned. So they registered some of those names themselves and hosted beacon code. Within hours, they were getting phone-home responses from dozens of organizations, including multiple Fortune 500 companies. The AI agents - Claude, OpenAI's Codex, Nous Research's Hermes - had visited these sites, read the documentation, and executed the unowned code without any human verification step. At least one misconfigured site was pointing to live malware, not just a researcher's beacon. ## How close this gets in practice This isn't purely theoretical. An engineer using an AI coding assistant nearly installed a malicious package after the agent recommended it as a dependency. What stopped it wasn't any automated check - it was a company policy requiring engineers to manually verify packages on GitHub before installation. That policy caught it before anything reached production. That's a thin line. Most teams don't have that policy. ## Why this is hard to defend against The attack surface here is genuinely awkward. The packages aren't known-bad. The domains aren't flagged anywhere. The AI agent is doing exactly what it's supposed to do - reading documentation and following instructions. The problem is that the documentation itself has been compromised, or was never properly owned in the first place. Scanning for known CVEs doesn't help. The threat is unclaimed names that look legitimate until someone malicious claims them. The practical mitigations are unglamorous: require human sign-off before any agent-suggested package gets installed, audit your own `llms.txt` files if you publish them, and treat AI dependency suggestions with the same skepticism you'd apply to a random Stack Overflow answer. Which, honestly, you probably should have been doing anyway. ## Questions this post answers ### How did researchers demonstrate that AI coding agents will install unclaimed malicious packages? Israeli researchers scanned 6,214 domains belonging to defense contractors, Fortune 500 firms, and major tech companies, examining llms.txt files meant to guide AI agents. They found 120 sites referencing package names or domains nobody owned, registered several themselves with beacon code, and within hours received phone-home responses from dozens of organizations after agents like Claude, Codex, and Hermes visited and executed the unowned code without human verification. _daily.dev surfaces reporting like this for teams evaluating how much to trust AI-suggested dependencies._ ### Why doesn't CVE scanning catch AI-recommended malicious packages? CVE scanning only flags packages already known to be malicious or vulnerable, but this attack relies on unclaimed package names that AI models hallucinate and attackers then register before anyone else does. Since the packages sit outside any vulnerability database until claimed, traditional scanning tools have nothing to match against, letting them slip through unnoticed. _Engineers weighing dependency scanning strategies can follow coverage like this on daily.dev._ ### What stopped an engineer from installing a malicious package recommended by an AI coding assistant? A company policy requiring engineers to manually verify packages on GitHub before installation caught the recommendation before it reached production, since no automated check flagged the package as malicious. Without that manual verification step, the malicious dependency would likely have been installed based solely on the agent's suggestion. _daily.dev helps teams track practical safeguards like manual verification against AI-suggested dependencies._ ## Similar posts on daily.dev - [Schneier on Security](https://daily.dev/posts/schneier-on-security-tgc2xdvrr) · Schneier on Security · 0 upvotes · 0 comments - [Slopsquatting: Your AI Invented a Package, and an Attacker Was Waiting](https://daily.dev/posts/slopsquatting-your-ai-invented-a-package-and-an-attacker-was-waiting-pz8bcrd9w) · DEV · 4 upvotes · 0 comments - [When AI Coding Agents Become Malware Delivery Systems](https://daily.dev/posts/when-ai-coding-agents-become-malware-delivery-systems-vbuml87gw) · DevOps.com · 0 upvotes · 0 comments - [Supply-chain attacks take aim at your AI coding agents](https://daily.dev/posts/supply-chain-attacks-take-aim-at-your-ai-coding-agents-o8vsjrfrt) · CSO Online · 0 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#ai-agents](https://daily.dev/tags/ai-agents), [#appsec](https://daily.dev/tags/appsec) [View this post on daily.dev](https://daily.dev/posts/ai-coding-agents-are-recommending-malware-packages-and-engineers-are-almost-installing-them-ww1ohnzqi) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"AI coding agents are recommending malware packages, and engineers are almost installing them","url":"https://daily.dev/posts/ai-coding-agents-are-recommending-malware-packages-and-engineers-are-almost-installing-them-ww1ohnzqi","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ai-coding-agents-are-recommending-malware-packages-and-engineers-are-almost-installing-them-ww1ohnzqi"},"datePublished":"2026-08-26T15:02:17.612Z","dateModified":"2026-09-13T19:51:35.627Z","description":"AI coding assistants sometimes hallucinate package names that don't actually exist, and attackers are registering those exact names on public registries so...","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ai-coding-agents-are-recommending-malware-packages-and-engineers-are-almost-installing-them-ww1ohnzqi","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,ai-agents,appsec","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"AI coding agents are recommending malware packages, and engineers are almost installing them"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ai-coding-agents-are-recommending-malware-packages-and-engineers-are-almost-installing-them-ww1ohnzqi#faq","mainEntity":[{"@type":"Question","name":"How did researchers demonstrate that AI coding agents will install unclaimed malicious packages?","acceptedAnswer":{"@type":"Answer","text":"Israeli researchers scanned 6,214 domains belonging to defense contractors, Fortune 500 firms, and major tech companies, examining llms.txt files meant to guide AI agents. They found 120 sites referencing package names or domains nobody owned, registered several themselves with beacon code, and within hours received phone-home responses from dozens of organizations after agents like Claude, Codex, and Hermes visited and executed the unowned code without human verification. daily.dev surfaces reporting like this for teams evaluating how much to trust AI-suggested dependencies."}},{"@type":"Question","name":"Why doesn't CVE scanning catch AI-recommended malicious packages?","acceptedAnswer":{"@type":"Answer","text":"CVE scanning only flags packages already known to be malicious or vulnerable, but this attack relies on unclaimed package names that AI models hallucinate and attackers then register before anyone else does. Since the packages sit outside any vulnerability database until claimed, traditional scanning tools have nothing to match against, letting them slip through unnoticed. Engineers weighing dependency scanning strategies can follow coverage like this on daily.dev."}},{"@type":"Question","name":"What stopped an engineer from installing a malicious package recommended by an AI coding assistant?","acceptedAnswer":{"@type":"Answer","text":"A company policy requiring engineers to manually verify packages on GitHub before installation caught the recommendation before it reached production, since no automated check flagged the package as malicious. Without that manual verification step, the malicious dependency would likely have been installed based solely on the agent's suggestion. daily.dev helps teams track practical safeguards like manual verification against AI-suggested dependencies."}}]} ```