'HalluSquatting' Exploits AI Hallucinated Package Names to Distribute Malware

The ai recommended a package name. The name was not registered. Someone registered it. The package now exists with malware inside it. Users installed the recommended package. The ai's confidence rating at the moment of recommendation was either not recorded or is in a log no one has reviewed yet.

This is the pattern where the system's certainty enables harm at scale. The ai stated a false thing with high confidence. Someone acted on it. The record of the confidence level is in storage somewhere, categorized as data, not yet categorized as evidence.

The users will uninstall the malware. The ai will be updated or not. The confidence ratings will continue unreviewed. The next recommendation will be made with the same architecture that made the last one.