--- title: AI coding agents are recommending malware packages, and... description: AI coding assistants sometimes hallucinate package names that don't actually exist, and attackers are registering those exact names on public registries so... canonical: https://daily.dev/posts/ai-coding-agents-are-recommending-malware-packages-and-engineers-are-almost-installing-them-ww1ohnzqi twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: AI coding agents are recommending malware packages, and engineers are almost installing them | daily.dev og:description: AI coding assistants sometimes hallucinate package names that don't actually exist, and attackers are registering those exact names on public registries so... og:url: https://daily.dev/posts/ai-coding-agents-are-recommending-malware-packages-and-engineers-are-almost-installing-them-ww1ohnzqi og:image: https://api.daily.dev/og/posts/wW1oHnzqi.png og:image:alt: AI coding agents are recommending malware packages, and engineers are almost installing them og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # AI coding agents are recommending malware packages, and engineers are almost installing them **[Collections](https://daily.dev/sources/collections)** · 3 min read · 0 upvotes · 0 comments ## Summary AI coding assistants sometimes hallucinate package names that don't actually exist, and attackers are registering those exact names on public registries so that when an agent recommends the fake dependency, installing it pulls in malware instead. One engineer nearly shipped a malicious package after their AI assistant suggested it; only a company policy requiring manual verification of packages on GitHub before installation stopped it. Traditional vulnerability scanning doesn't catch this because the malicious package has no prior CVE history - the package itself is the attack. The piece argues manual review of AI-suggested dependencies is now a necessary control, not just good practice. ## Content There's a supply chain attack vector emerging that most security teams aren't scanning for yet, and it's moving fast. AI coding models hallucinate package names that don't exist. That's been a known quirk for a while. What's changed is that attackers are now registering those exact names and waiting for agents to install them automatically. Traditional CVE scanning doesn't catch this because the packages aren't in any vulnerability database - they're just quietly sitting there, waiting. ## The llms.txt problem Israeli researchers recently scanned 6,214 domains belonging to defense contractors, Fortune 500 firms, and major tech companies. They were looking at `llms.txt` and `llms-full.txt` files - documentation that companies publish specifically to help AI agents understand their sites. They found 120 sites pointing to package names or domains that nobody owned. So they registered some of those names themselves and hosted beacon code. Within hours, they were getting phone-home responses from dozens of organizations, including multiple Fortune 500 companies. The AI agents - Claude, OpenAI's Codex, Nous Research's Hermes - had visited these sites, read the documentation, and executed the unowned code without any human verification step. At least one misconfigured site was pointing to live malware, not just a researcher's beacon. ## How close this gets in practice This isn't purely theoretical. An engineer using an AI coding assistant nearly installed a malicious package after the agent recommended it as a dependency. What stopped it wasn't any automated check - it was a company policy requiring engineers to manually verify packages on GitHub before installation. That policy caught it before anything reached production. That's a thin line. Most teams don't have that policy. ## Why this is hard to defend against The attack surface here is genuinely awkward. The packages aren't known-bad. The domains aren't flagged anywhere. The AI agent is doing exactly what it's supposed to do - reading documentation and following instructions. The problem is that the documentation itself has been compromised, or was never properly owned in the first place. Scanning for known CVEs doesn't help. The threat is unclaimed names that look legitimate until someone malicious claims them. The practical mitigations are unglamorous: require human sign-off before any agent-suggested package gets installed, audit your own `llms.txt` files if you publish them, and treat AI dependency suggestions with the same skepticism you'd apply to a random Stack Overflow answer. Which, honestly, you probably should have been doing anyway. ## Questions this post answers ### Can AI coding assistants recommend malicious packages that don't actually exist yet? Yes. AI coding models sometimes hallucinate plausible-sounding package names that were never published, and attackers monitor for this pattern, registering those exact names on public registries so that when an agent later suggests the same hallucinated name, the install pulls down malware instead of a legitimate library. _Developers weighing how much to trust AI-suggested dependencies can track this evolving risk on daily.dev._ ### Why don't vulnerability scanners catch malicious packages recommended by AI coding tools? Vulnerability scanners check for known CVEs in known packages, but a package invented by AI hallucination and then registered by an attacker has no history to check against. Since the package itself is the attack rather than a flaw within a legitimate package, traditional scanning provides no protection, making manual verification of suggested dependencies a necessary control instead of an optional practice. _Teams hardening their AI-assisted workflows against supply chain risk can follow this topic on daily.dev._ ## Similar posts on daily.dev - [Schneier on Security](https://daily.dev/posts/schneier-on-security-tgc2xdvrr) · Schneier on Security · 0 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#ai-agents](https://daily.dev/tags/ai-agents), [#appsec](https://daily.dev/tags/appsec) [View this post on daily.dev](https://daily.dev/posts/ai-coding-agents-are-recommending-malware-packages-and-engineers-are-almost-installing-them-ww1ohnzqi) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"AI coding agents are recommending malware packages, and engineers are almost installing them","url":"https://daily.dev/posts/ai-coding-agents-are-recommending-malware-packages-and-engineers-are-almost-installing-them-ww1ohnzqi","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ai-coding-agents-are-recommending-malware-packages-and-engineers-are-almost-installing-them-ww1ohnzqi"},"datePublished":"2026-08-26T15:02:17.612Z","dateModified":"2026-08-27T15:48:15.133Z","description":"AI coding assistants sometimes hallucinate package names that don't actually exist, and attackers are registering those exact names on public registries so...","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ai-coding-agents-are-recommending-malware-packages-and-engineers-are-almost-installing-them-ww1ohnzqi","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,ai-agents,appsec","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"AI coding agents are recommending malware packages, and engineers are almost installing them"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ai-coding-agents-are-recommending-malware-packages-and-engineers-are-almost-installing-them-ww1ohnzqi#faq","mainEntity":[{"@type":"Question","name":"Can AI coding assistants recommend malicious packages that don't actually exist yet?","acceptedAnswer":{"@type":"Answer","text":"Yes. AI coding models sometimes hallucinate plausible-sounding package names that were never published, and attackers monitor for this pattern, registering those exact names on public registries so that when an agent later suggests the same hallucinated name, the install pulls down malware instead of a legitimate library. Developers weighing how much to trust AI-suggested dependencies can track this evolving risk on daily.dev."}},{"@type":"Question","name":"Why don't vulnerability scanners catch malicious packages recommended by AI coding tools?","acceptedAnswer":{"@type":"Answer","text":"Vulnerability scanners check for known CVEs in known packages, but a package invented by AI hallucination and then registered by an attacker has no history to check against. Since the package itself is the attack rather than a flaw within a legitimate package, traditional scanning provides no protection, making manual verification of suggested dependencies a necessary control instead of an optional practice. Teams hardening their AI-assisted workflows against supply chain risk can follow this topic on daily.dev."}}]} ```