AI
LLMs fabricate nonexistent libraries in generated code, creating security and build risks
A new study reveals how minor prompt variations cause AI coding tools to invent fake software libraries, potentially exposing systems to supply chain attacks.
Large language models have become central to code generation, but they frequently hallucinate—inventing libraries that don't exist. These fabrications go beyond harmless mistakes: they can derail developer workflows, cause build failures, and introduce supply chain vulnerabilities like slopsquatting attacks.
The scope of the problem#
A new research paper presents the first systematic examination of how realistic prompt changes affect library hallucinations across seven different LLMs. The analysis covers two categories of errors: library name hallucinations (references to imports that don't exist) and library member hallucinations (calls to nonexistent functions within valid libraries).
The findings expose troubling patterns. Single-character misspellings trigger hallucinations in up to 26% of coding tasks. When developers mention fabricated library names, models accept them in up to 99% of cases. Time-related prompts—such as requests for functions to handle specific time zones—induce hallucinations in as many as 85% of instances.
What makes this risky#
These errors matter more than they first appear. A developer following AI-generated code with invalid imports will encounter immediate build failures. But the risks extend further: hallucinated library names could be exploited through slopsquatting, where attackers register typo domains or package names to capture misled users. Systems trusting AI-generated dependencies without verification face downstream supply chain exposure.
A new evaluation framework#
To address the gap in reproducible testing, the researchers introduce LibHalluBench, a benchmark grounded in the highest-risk prompts identified during their study. This tool enables consistent measurement of how well different models handle library-related errors, supporting future defenses against these vulnerabilities.
The work underscores how fragile LLMs remain when faced with natural variations in how developers phrase requests. It calls for urgent safeguards—from improved model training to better integration of dependency validation in development workflows.
