Endor Labs Documents AI Dependency Hallucination Risk
Date: 2025-11
Affected: AI Coding Assistants (multiple)
Attack vector: supply-chain
Category: research
Severity: High

Endor Labs found ~34% of AI-suggested dependencies don't exist (hallucinations) and 44-49% of AI-imported dependency versions have known vulnerabilities. Only 20% of AI-recommended deps meet safety standards.


Mitigations:

Architectural layers (MAESTRO):