Unverified50% confidenceFactExact time
攻击者利用AI幻觉出的包名，提前在npm、PyPI等包注册表抢注并植入恶意代码，这种攻击手法被称为slopsquatting
1
Sources
50%
Confidence
Long-term
Relevance
7/9/2026
First Seen
Sources
AI Coding Security: A CLI Tool Designed to Block Vulnerable Dependencies for Agents
hackernewshackernews7/1/2026
Related Claims
Unverified攻击者常借助混淆技术隐藏恶意脚本诱导用户复制粘贴运行，这类手法被称为剪贴板劫持或社会工程学注入76% similarVerifiedPrompt injection attacks induce AI agents to execute malicious operations by embedding text disguised as system instructions in code comments, documentation, web content, or even file names.74% similarUnverified攻击者提交如AGENTS.md这类被AI代理默认读取的文本规则文件，引导AI去读取一张恶意PNG图片73% similarUnverifiedAttackers can exploit stolen AI service account credentials to call API interfaces for computing power theft, and such behavior has frequently appeared in terms-of-service violation reports on platforms such as OpenAI and Anthropic.71% similarUnverifiedQR code access carries security risks including replay attacks, session credential leakage due to long-lived tokens, and man-in-the-middle attacks.70% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/382755API
curl https://kongchang.com/api/v1/knowledge/claims/382755MCP
get_claim(id=382755)