Loading story…
OWASP has published a beta Top 10 for Model Context Protocol (MCP), warning that MCP-enabled AI systems introduce new attack surfaces across token handling, privilege management, tool integrity, supply chain security, command execution, authentication, telemetry, shadow deployments, and context sharing. The project frames MCP as a fast-growing integration layer for AI tools and agents, and highlights the need for stronger controls as organizations connect models to external tools, data sources, and developer workflows.
Security researchers and vendors are also warning that AI is expanding software supply chain risk through package hallucinations and slopsquatting, in which attackers register malicious packages under names invented by coding assistants. One cited proof of concept involved the hallucinated package huggingface-cli, which was later downloaded more than 30,000 times after publication as a benign placeholder. Researchers say autonomous coding agents can amplify the danger by installing dependencies with little or no human review, while related risks include malicious package campaigns, secret leakage in AI-generated code, and broader compromise of developer environments and software delivery pipelines.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
A 2023 proof of concept used the hallucinated package name 'huggingface-cli,' which was published as a benign placeholder and later downloaded more than 30,000 times. The example demonstrated how hallucinated dependency names could be claimed in public registries.
Xygeni published an analysis describing AI as a meaningful software supply chain attack surface, highlighting slopsquatting, autonomous agent-driven dependency risk, malicious package campaigns, MCP exposure, and secret leakage through AI-generated code.
OWASP published its MCP Top 10 project page describing a 2025 list of ten security risk categories for Model Context Protocol-enabled AI systems. The page states the project is in Phase 3 beta release and pilot testing.
Lasso Research published findings on AI package hallucinations, documenting the risk that AI systems may invent package names that can then be abused in software supply chains.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security reporting and research warned that the **Model Context Protocol (MCP)** has opened a new attack surface for enterprise AI agents, allowing malicious content delivered through context windows, documentation, support tickets, GitHub issues, or untrusted MCP servers to trigger unauthorized actions without compromising the underlying model. Reported examples included WhatsApp data exfiltration, leakage of private repository data, abuse of a Supabase Cursor agent through crafted support tickets, and **`CVE-2025-6514`**, a high-severity OS command-injection flaw that could enable remote code execution via untrusted MCP servers. A separate proof-of-concept targeting Andrew Ng’s **Context Hub** showed how poisoned API documentation served through an MCP server could silently steer coding agents into adding fake or malicious dependencies to generated projects, highlighting a software supply-chain risk in community-authored documentation pipelines. Across the coverage, researchers and vendors said perimeter controls and AI gateways are not enough because attackers or insiders can interact directly with MCP services; they urged organizations to treat MCP connectivity as privileged access, sanitize all context inputs, enforce policy and approval checks at the MCP server, restrict agent network and data access, and adopt zero-trust execution controls with auditable action receipts.
Jun 30, 2026
Attackers are exploiting AI-generated dependency hallucinations by registering malicious packages under names that coding assistants and autonomous agents invent, a technique known as **slopsquatting** or **hallusquatting**. The threat has progressed from a 2023 proof of concept around the nonexistent package `huggingface-cli` to broader evidence that AI tools repeatedly recommend packages that do not exist; a 2025 academic measurement found **19.7%** of AI-suggested Python and JavaScript packages were nonexistent, with many hallucinated names recurring across prompts and models. The risk escalated in 2026 as hallucinated package names began propagating through agentic development workflows and automated installs. Researchers reported the fake npm package name `react-codeshift` spreading across **237 repositories**, while the malicious package `unused-imports` continued to be installed, showing how model output can become a software supply-chain infection path. A July 2026 **HalluSquatting** variant further combined hallucinated resources with prompt injection to drive AI coding agents toward **remote code execution (RCE)**, expanding the attack surface from human typo-based dependency mistakes to model-generated and agent-executed compromise.
Jul 22, 2026
ENISA published a March 2026 technical advisory on the **secure use of package managers**, warning that modern development workflows (e.g., *npm*, *pip*, *Maven*) can pull in far more code than developers expect due to direct and transitive dependency resolution. The advisory highlights how applications inherit large dependency graphs—often including unused modules—that still introduce vulnerabilities, maintenance and provenance risk, and expanded trust assumptions across the software supply chain. ENISA recommends secure practices for selecting, integrating, monitoring, and remediating vulnerable third-party dependencies as part of the SDLC. Separately, security researchers and industry commentary describe **slopsquatting**, a supply-chain technique that exploits AI coding assistants’ tendency to hallucinate plausible-but-nonexistent package names. Attackers can register those “phantom” names in public repositories and publish packages that appear to match the expected functionality while embedding malicious payloads, turning AI-generated suggestions into a predictable package-name acquisition strategy. The risk is positioned as distinct from typosquatting (human error) and is framed as requiring additional detection approaches beyond traditional controls, including more behavioral and validation-focused checks before adopting AI-suggested dependencies.
Jul 12, 2026