Security · Flashcard
What is slopsquatting?
- ARegistering a package name an AI model repeatedly invents so victims install it
- BPublishing a package whose name closely resembles a popular library's real name
- CUploading a model to a public hub under the name of a well-known research lab
- DSubmitting generated code to a project so a maintainer merges it without review
Why this is the answer
Models hallucinate plausible-sounding package names that do not exist; because the same non-existent name recurs across prompts, an attacker can register it and wait for developers to install the suggestion. Resembling a real name is classic typosquatting, impersonating a lab is model-hub squatting, and pushing unreviewed generated code is a contribution-review problem.
Official docsMore AI and LLM Application Security flashcards
- What distinguishes an indirect prompt injection from a direct one?
- Where does the real risk lie when an application's system prompt leaks?
- What does a training-data poisoning attack do?
- What does an AI-BOM inventory beyond a conventional software bill of materials?
- On what basis does the EU AI Act impose obligations?