AI Recommends Packages Attackers Registered First

The model invents a package name, someone registers it, and the agent installs it with no human in the loop. USENIX measured it at 19.7% of generated samples, and Anthropic watched 15 real systems pull a malicious package within the hour.