Evidence · DiggingBeagle record
Diving Deeper into AI Package Hallucinations
Researcher Bar Lanyado documented repeated LLM package hallucinations and defensively registered the nonexistent Python package name huggingface-cli. Lasso reports that the empty package received more than 30,000 authentic downloads in three months and that public repositories, including an Alibaba research repository, had incorporated instructions using the hallucinated name. The experiment demonstrates adoption of a hallucinated registry identifier, not malicious compromise.
- Published
- Mar 28, 2024
- Publisher
- Lasso Security
Evidence record
Researcher Bar Lanyado documented repeated LLM package hallucinations and defensively registered the nonexistent Python package name huggingface-cli. Lasso reports that the empty package received more than 30,000 authentic downloads in three months and that public repositories, including an Alibaba research repository, had incorporated instructions using the hallucinated name. The experiment demonstrates adoption of a hallucinated registry identifier, not malicious compromise.