{
  "id": 2090942,
  "title": "AI agent suggested installing a malware package. Engineer almost took its advice",
  "url": "https://urgent.news/2026/08/20/ai-agent-suggested-installing-a-malware-package-engineer-almost-took",
  "topic": "ai",
  "section": "AI",
  "published": "2026-08-20T07:00:00.000Z",
  "source": {
    "name": "The Register Science",
    "slug": "the-register-science",
    "url": "https://www.theregister.com/security/2026/08/20/ai-agent-suggested-installing-a-malware-package-engineer-almost-took-its-advice/5289849"
  },
  "original_language": "en",
  "account": "Welcome to PWNED, where we highlight security mishaps. This week, a company almost fell victim to AI-induced security breach. The story involves a company called Softjourn and its engineer who was tempted by an AI agent's recommendation.\n\nAn engineer asked the AI agent for a package needed for a common task. The AI suggested a legitimate-sounding package. Most companies would have installed it blindly. However, Softjourn had a policy of double-checking AI recommendations. The engineer inspected the package on GitHub.\n\nThe package had few downloads and was created just days ago. This raised red flags. Similar \"slopsquatting\" tactics have been used by attackers who register packages with names AI models invent. The company caught the potential malware package because it followed its verification policy.\n\nThis incident underscores the importance of verifying AI recommendations, especially when time is tight. A simple step like checking package downloads and source code can prevent devastating supply chain compromises. So, remember: don't blindly trust AI agents. Always have a human in the loop to approve any external code.",
  "summary": "Fortunately, the company had a policy of checking source code on GitHub first",
  "key_points": [
    "AI agent recommended installing a malware package",
    "Engineer followed company policy to verify AI recommendation",
    "Softjourn prevented potential supply chain compromise"
  ],
  "editors_take": "The incident shows that verifying AI recommendations, even with a simple step like checking package downloads and source code, can prevent potentially devastating supply chain compromises.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}