Can a coding agent invent a package name that doesn't exist?

Yes, and often enough to matter. A paper from May 2026 tested five current frontier coding models (Claude Sonnet 4.6, Claude Haiku 4.5, GPT-5.4-mini, Gemini 2.5 Pro, and DeepSeek V3.2) on nearly 200,000 Python and JavaScript prompts and found each one invented a package name that doesn’t exist on PyPI or npm, between 4.62% and 6.10% of the time: the model guessing instead of saying it doesn’t know, the same way any other hallucination happens.

The risk isn’t just a broken import. An attacker who registers one of those invented names ahead of time turns the next agent’s hallucination into a real package landing in someone’s dependency tree, a pattern called slopsquatting. The same study found 127 package names that all five models invented identically, so an attacker doesn’t need to guess which model a target uses; after disclosing those to PyPI Security and Socket.dev, 53 were still registrable.

The earlier version of this finding, from 2024, measured a much wider spread across models, 5.2% to 21.7%. The gap has narrowed an order of magnitude since, not because the behavior went away, but because today’s models converge on roughly the same rate, and often the same invented names.