ChatGPT Invented a Feature. Then a Founder Built It.

Earlier in 2025, Adrian Holovaty, one of the creators of Django and the founder of the music-learning site Soundslice, saw something strange in his error logs. His sheet music scanner was receiving screenshots of ChatGPT conversations full of ASCII tablature, a plain text way to write guitar music. The scanner had never supported it.

After weeks of confusion, he asked ChatGPT about Soundslice and found it telling people to upload ASCII tab to hear it played back. "We've never supported ASCII tab; ChatGPT was outright lying to people," he wrote in his post.

He could post disclaimers or build the feature. He built it, and Soundslice's August 1 update announced the importer. TechCrunch and Ars Technica both covered it. "To my knowledge," he wrote, "this is the first case of a company developing a feature because ChatGPT is incorrectly telling people it exists."

That is the cute version. It gets less cute when the invented thing is code.

An empty package, 30,000 downloads

Lasso Security researcher Bar Lanyado noticed that models kept telling people to run pip install huggingface-cli. No such package existed. He registered the name and uploaded an empty one. According to Lasso's findings as summarized by Simon Willison, it received more than 30,000 downloads in three months. The Register found that a repository for Alibaba research had put the fake install command in its README. Lanyado published the results in March 2024. His package was harmless. It was a trap with nothing in it.

The download count is the part I can't shake. We read a big number as proof that other people checked. Here, the mistake produced the number.

How often models do this

A USENIX Security 2025 paper generated 576,000 code samples from 16 models. Hallucinated packages averaged at least 5.2% for commercial models and 21.7% for open source models, with 205,474 unique invented names.

A May 2026 preprint retested five newer models and found rates of 4.62% to 6.10%. The models mostly invent different names, yet 127 names came from all five, and 53 were still available for anyone to register.

Researchers publishing in ACM Transactions on Software Engineering and Methodology acted like an attacker, minus the malware. They uploaded 107 hallucinated names to npm and watched for six months. Most first interactions came within two weeks of registration, and 35.2% of installs were attributed to developers. They estimate the whole campaign cost $496. Letting the models search the web made things worse: persistence of hallucinated names rose from 11.2% to 17.3%, which the authors attribute to "context contamination." My reading, and it is only a reading: once a fake name exists on the web, a browsing model finds it and treats it as evidence.

The name nobody planted

In January 2026, Aikido researcher Charlie Eriksen found react-codeshift, a blend of two real packages, jscodeshift and react-codemod. Aikido's write-up traces it to a single commit of 47 AI-generated instruction files for coding agents. By the time Eriksen looked, the name had spread to 237 repositories through forks. After he claimed it, it still received a couple of downloads a day, which Aikido attributes to agents following those files.

No attacker was involved. A model guessed, a file kept the guess, and forks copied it.

Has anyone been robbed?

I could not find a confirmed case of a malicious package registered because a model suggested its name. Aikido points to malicious packages whose names fit the pattern, such as unused-imports (the real one is eslint-plugin-unused-imports), which was still pulling 233 downloads a week as of early February. Aikido says it cannot prove the attacker's intent.

The Cloud Security Alliance described an August campaign of nearly 800 npm packages, later more than 1,000, with random plausible names that researchers labelled "AI slopsquatting." The label is an analogy. The note does not establish that any model suggested those names.

A small site called VDB runs what amounts to a weather report. Every six hours it asks several models for packages to use on ordinary tasks and checks each name against the registries. For October 19 to 25, 2026 it logged 144 names seen for the first time and 0 registered after a model had recommended them. Most names came from one inexpensive model, so treat it as a snapshot.

The door is open. The footprints are ambiguous.

Websites get the same treatment

In August 2025, Ahrefs checked 16 million URLs cited by six AI assistants. They send visitors to 404 pages 2.87 times more often than Google Search does. For ChatGPT, 1.01% of clicked URLs and 2.38% of cited URLs returned 404 status, against baselines of 0.15% and 0.84%.

Ahrefs' most visited fake pages were /blog/internal-links/ and /blog/newsletter/. Both fit the pattern of its real pages, and neither exists. The method is imperfect, and AI assistants were 0.25% of total traffic in Ahrefs' data, so the percentages are small. Later numbers differ by method, so they are not a trend line: SE Ranking, in a study published in December 2025, found 1.22% of ChatGPT citations returned 404, against 0.56% for Google AI Overviews, and Parse found 0.67% of 152,313 cited pages broken between May 24 and July 16, 2026. But a model's missing page tells you which page it believes you have. Soundslice read that signal and built the feature.

Profound's research adds a contrast. Across 883,000 pages and twelve months, "the median page loses half its citation share within 11 days of peaking," and authority in AI search "expires rather than accumulates." Real pages have to keep earning their place. A fake package name copied into a README does not decay on that schedule. That comparison is mine, not Profound's, and it sets two different measurements side by side.

What I would do on Monday

• Installing something? Check who published it and when, not the download count. A package registered last Tuesday with no maintainer information is a red flag at any popularity.
• Running a website? Filter analytics for AI assistant visits that land on 404 pages. Each is a page you deleted or one a model thinks you have. Redirect it or write it.
• Running a product? Ask the assistants what it can do. Read the answer.

I started out believing hallucination was a story about wrong answers. The better story is what the world does with them. A wrong answer in a chat window dies with the tab. One that sends a thousand people to the same place gets a response: a feature, a package, a page. The question is who writes it. Holovaty answered his with an importer. Lanyado answered his with an empty file. The researchers worry someone will answer one with something worse.