Dylan Anthony

@dbanty.bsky.social

They/them Rust software engineer https://github.com/dbanty https://dylananthony.com

1. LLM-generated code tries to run code from online software packages. Which is normal but 2. The packages don’t exist. Which would normally cause an error but 3. Nefarious people have made malware under the package names that LLMs make up most often. So 4. Now the LLM code points to malware.

David D. Levine@daviddlevine.com · last yr.

LLMs hallucinating nonexistent software packages with plausible names leads to a new malware vulnerability: "slopsquatting."