endorlabs.comarticleWhen AI Imports Vulnerable Dependencies: Securing AI-Generated Code | Blog | Endor Labs
Endor Labs blog post arguing that AI coding agents introduce supply-chain risk by suggesting outdated, vulnerable, or hallucinated (slopsquatted) open source packages without developer review. It cites Endor Labs research finding AI agents pull in ~40% more dependencies than human-written code and that 49% of AI-suggested dependency versions carried known vulnerabilities, and advocates IDE/pre-commit scanning plus function-level reachability analysis to cut alert noise by up to 95%.
TL;DR Endor Labs research shows AI coding agents often suggest outdated or hallucinated (slopsquatted) dependencies, and recommends IDE-level scanning plus reachability analysis to filter the noise.
Organisations named here
- slopsquatting
Technologies named here
- Endor Labs
Techniques named here
- Slopsquatting
- Typosquatting
- Compromised library suggestion
- Function-level reachability analysis
Related in Supply Chain
