Slopsquatting

Slopsquatting refers to the practice of registering domains with intentionally misspelled or slightly altered versions of legitimate brand names, often to impersonate companies or distribute malicious content. In AI governance contexts, this tactic poses significant risks for enterprise security and brand protection, as attackers can use these fake domains to distribute malware disguised as official AI tools, trick employees into compromised download sites, or harvest credentials from workforce training platforms. Organizations implementing AI governance frameworks must incorporate domain monitoring and employee security awareness programs to defend against these attacks, which can compromise the integrity of AI systems and undermine trust in legitimate AI governance communications.

1 item

Corporate PolicyGlobal2026-08-20

AI Agent Slopsquatting Nearly Plants Malware via Hallucinated Package Name

A software engineer at Softjourn nearly installed a malicious package after an AI agent hallucinated a plausible library name, a technique researchers call slopsquatting. Attackers pre-register packages under names AI models commonly fabricate, turning developer trust into a supply chain attack vector. An existing policy requiring download-count and source-code checks before installing any AI-recommended package prevented the compromise.

slopsquatting AI agents supply chain risk human-in-the-loop agentic AI developer tools hallucination Softjourn