During recent discussions at Black Hat, a critical question echoed among AppSec leads, platform engineers, and CISOs: "Who is actually vetting AI's code?" Developer adoption of AI coding tools is skyrocketing, driven by undeniable productivity gains. However, this rapid integration, coupled with the reliance on open-source software, has created a significant operational challenge: AI-driven code generation has completely outpaced legacy ingestion review. When an unvetted or hallucinated dependency enters a codebase at machine speed, post-commit Software Composition Analysis (**SCA**) scans often struggle to keep pace. Securing this pipeline doesn't mean throttling developer velocity or restricting open-source use; it necessitates governing what enters the environment at the point of selection, *before* an import triggers a build. ## The Mechanics of "Slopsquatting" and Machine Ingestion Large language models (**LLMs**) recommend software libraries based on statistical probability and historical code patterns, not real-time package registry verification. When an **LLM** suggests a package name that does not exist in **PyPI** or **npm**, it creates a supply-chain vulnerability known as **slopsquatting** (or AI package hallucination exploitation). A **USENIX Security** study analyzing sixteen popular code-generation models across over 500,000 code samples highlighted the scale of this vulnerability: * A measurable percentage of AI-suggested package names do not exist in public registries. * Of the suggested dependencies that *do* resolve to real packages, nearly half contain known **CVEs** or outdated releases. Attackers actively monitor public **LLM** output patterns and developer code repositories to identify these hallucinated package names. Once identified, an adversary registers the dummy name on **PyPI** or **npm**, uploads a malicious payload, and waits for automated developer environments or **CI/CD** builders to fetch it. This vector is already being observed in real-world deployments. In early 2026, security researchers tracked a single hallucinated **npm** package name (**react-codeshift**) originating from 47 AI-generated agent skills in a single commit. This hallucination spread organically through forks to over 230 repositories before an engineer noticed it had never been explicitly selected by a human. The issue stemmed not from malicious intent by the developer, but from a complete absence of ingestion controls. ## The Friction Multiplier on Open Source Review The enterprise's intake challenge directly impacts the broader open-source ecosystem. The same AI assistants generating unvetted dependency suggestions within corporate networks are also generating automated pull requests submitted to community-maintained repositories. This volume of automated contributions places unprecedented strain on human maintainers: * **Conflicting AI Policies:** Major projects, including **Kubernetes**, the **Linux kernel**, **LLVM**, and **Godot**, have published diverging policies on AI-assisted contributions. Some ban AI-generated code outright, while others permit it only if a human contributor takes full accountability for every line added. * **Higher Defect Density:** A **CodeRabbit** review of 470 open-source pull requests found that AI-co-authored contributions carried **70% more defects** than human-authored code, despite appearing clean on the surface. When hallucinated or vulnerable packages pass through corporate ingestion, they inevitably trickle down into upstream open-source PRs, forcing volunteer maintainers to spend hours validating dependencies that no human deliberately evaluated. ## Velocity vs. Verification: The Governance Gap Recent telemetry from **Kusari's** Application Security in Practice report illustrates how far tooling deployment has outrun ingestion controls: | Metric | Enterprise Adoption | | :-------------------------------------------- | :------------------ | | Organizations using AI coding assistants | **85%** | | Organizations using AI to assist PR-stage code review | **38%** | | Organizations with dedicated AI AppSec controls | **9%** | Traditional AppSec workflows rely on scanning code after it's written or after a pull request is opened. When code is generated at machine speed, late-stage alerts simply create backlog noise that engineers often ignore. ## Securing the Pipeline at the Point of Selection Waiting for **LLM** hallucination rates to drop to zero is not a viable AppSec strategy. The core issue is velocity, not model accuracy. To secure the development pipeline without sacrificing output, security and platform teams are moving defense left of the **IDE**: 1. **Restrict Direct Registry Fetching:** Block developer workstations and AI agents from querying unvetted public endpoints directly during code completion. 2. **Isolate AI-Suggested Dependencies:** Route newly introduced dependencies into an isolated sandbox for automated reachability and vulnerability analysis before allowing them into primary branches. 3. **Govern the Ingestion Gateway:** Shift from reactive **CVE** counting to proactive source curation, ensuring that every package an AI model recommends is pre-vetted against malicious typosquats and slopsquatting targets. This ingestion layer is precisely where **ActiveState's Secure Open Source Library and Curated Catalog** operates. Designed to function as an enterprise-grade ingestion gateway, **ActiveState** delivers pre-vetted, continuously remediated open-source packages directly to developer workstations, **CI/CD** pipelines, and AI agent environments. By sitting between public package registries and developer tools, a curated catalog ensures that hallucinated package risks are intercepted at the selection boundary. Enterprise teams running on a governed ingestion source eliminate slopsquatting vectors at the intake step, reducing overall **CVE** exposure by roughly 95% without forcing developers to turn off their AI assistants. ## Conclusion Disabling AI coding tools is neither practical nor competitive. However, treating AI integration purely as a developer productivity metric, without updating software supply chain ingestion rules, leaves production builds vulnerable to sophisticated, machine-speed attacks.