[{"data":1,"prerenderedAt":683},["ShallowReactive",2],{"blog-slopsquatting-ai-package-hallucinations-en":3},{"slug":4,"published":5,"minutes":6,"category":7,"tags":8,"keywords":14,"about":25,"sources":35,"cover":54,"og":55,"expertise":56,"locales":57,"lang":58,"title":61,"description":62,"coverAlt":63,"metaTitle":64,"takeaways":65,"faq":71,"toc":87,"blocks":111,"others":378},"slopsquatting-ai-package-hallucinations","2026-10-16",6,"security",[9,10,11,12,13],"Supply chain security","Coding agents","npm","PyPI","Package hallucination",[15,16,17,18,19,20,21,22,23,24],"slopsquatting","package hallucination","ai hallucinated packages","llm package confusion attack","coding agent supply chain security","npm min-release-age","pnpm minimumReleaseAge","uv exclude-newer","npm ignore-scripts","huggingface-cli hallucinated package",[26,29,32],{"name":27,"url":28},"Typosquatting","https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FTyposquatting",{"name":30,"url":31},"Supply chain attack","https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FSupply_chain_attack",{"name":33,"url":34},"Hallucination (artificial intelligence)","https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FHallucination_(artificial_intelligence)",[36,39,42,45,48,51],{"title":37,"url":38},"Spracklen et al.: We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs (2024)","https:\u002F\u002Farxiv.org\u002Fabs\u002F2406.10279",{"title":40,"url":41},"Lasso Security, Bar Lanyado: Diving Deeper into AI Package Hallucinations (Mar 2024)","https:\u002F\u002Fwww.lasso.security\u002Fblog\u002Fai-package-hallucinations",{"title":43,"url":44},"npm Docs: config (min-release-age, before, ignore-scripts, allow-scripts)","https:\u002F\u002Fdocs.npmjs.com\u002Fcli\u002Fv11\u002Fusing-npm\u002Fconfig",{"title":46,"url":47},"pnpm: Dependency resolution settings (minimumReleaseAge)","https:\u002F\u002Fpnpm.io\u002Fsettings\u002Fdependency-resolution",{"title":49,"url":50},"uv: Settings reference (exclude-newer, require-hashes)","https:\u002F\u002Fdocs.astral.sh\u002Fuv\u002Freference\u002Fsettings\u002F",{"title":52,"url":53},"pip documentation: Secure installs and hash-checking mode","https:\u002F\u002Fpip.pypa.io\u002Fen\u002Fstable\u002Ftopics\u002Fsecure-installs\u002F","\u002Fimages\u002Fblog\u002Fslopsquatting-ai-package-hallucinations\u002Fcover.webp","\u002Fimages\u002Fblog\u002Fslopsquatting-ai-package-hallucinations\u002Fog.jpg","ai-engineer",[58,59,60],"en","de","hu","Slopsquatting: when coding agents install packages that do not exist","How LLMs hallucinate package names, how attackers register them, and the registry, lockfile and agent-harness controls that stop the install.","A coding agent proposes an install command for a package name that does not exist, and an attacker registers that name before the install runs.","Slopsquatting: hallucinated packages, defenses · Balázs Csorba",[66,67,68,69,70],"In a 576,000-sample study, at least 5.2% of packages suggested by commercial models and 21.7% by open models did not exist.","Hallucinated names repeat, so an attacker can register them in advance and wait for agents and developers to install them.","Release-age delays in npm, pnpm and uv block brand-new versions, but not a squatted name that was registered months ago.","Make the agent ask before every install, verify unknown packages against the registry, and keep install scripts off by default.","Lockfiles with hashes and CI that refuses unreviewed dependency changes turn a silent install into a reviewed diff.",[72,75,78,81,84],{"q":73,"a":74},"What is slopsquatting?","Slopsquatting is registering a package name that LLMs tend to hallucinate, so that code or install commands generated by a model pull in the attacker's package. It is a variant of typosquatting, except that the wrong name comes from the model rather than from a typo.",{"q":76,"a":77},"How often do LLMs hallucinate package names?","Spracklen et al. generated 576,000 code samples with 16 models in Python and JavaScript and found that at least 5.2% of suggested packages from commercial models and 21.7% from open-source models did not exist, with 205,474 unique hallucinated names.",{"q":79,"a":80},"Has this happened in practice?","Yes, as a test. In 2024 Lasso Security researcher Bar Lanyado found models recommending a non-existent Python package called huggingface-cli, uploaded an empty package under that name, and recorded more than 30,000 authentic downloads in three months. Installation instructions for it had appeared in a repository from Alibaba.",{"q":82,"a":83},"Does a minimum release age protect against slopsquatting?","Only partly. Settings such as npm min-release-age, pnpm minimumReleaseAge and uv exclude-newer block versions published very recently, which helps against freshly registered names and compromised releases. A name an attacker registered months ago passes the check.",{"q":85,"a":86},"What should I configure for coding agents?","Require approval for every package install command, run agents in a sandbox without access to secrets, disable install scripts by default, and fail CI on dependency changes that nobody reviewed. Let the agent check a package on the registry before it proposes it.",[88,90,93,96,99,102,105,108],{"id":89,"title":73},"what-is-slopsquatting",{"id":91,"title":92},"what-the-research-measured","How often do models hallucinate packages?",{"id":94,"title":95},"in-the-wild","Has it happened outside the lab?",{"id":97,"title":98},"agent-harness-controls","What should the agent harness enforce?",{"id":100,"title":101},"package-manager-settings","Which package manager settings help?",{"id":103,"title":104},"lockfiles-and-ci","What should CI check?",{"id":106,"title":107},"checklist","What is the short checklist?",{"id":109,"title":110},"sources","Sources",[112,125,134,137,148,157,158,166,194,197,198,209,210,222,224,247,248,307,310,312,313,332,343,344,357,358],{"type":113,"content":114},"paragraph",[115,116,120,121,124],"A coding agent writes ",{"tag":117,"children":118},"code",[119],"import fastjson_validator",", runs ",{"tag":117,"children":122},[123],"pip install fastjson-validator",", and the install succeeds. Nobody on the team has heard of the package, because it does not exist in any documentation: the model made the name up. What made the install succeed is that someone else noticed the same hallucination earlier and registered the name. That attack has a name now, slopsquatting, and coding agents make it more likely, because they run install commands without a human typing them.",{"type":113,"content":126},[127,128,133],"This article covers what the research measured, why hallucinated names are predictable enough to squat, and the controls that work at each layer: the agent harness, the package manager, the lockfile and CI. It builds on ",{"tag":129,"to":130,"children":131},"link","\u002Fblog\u002Fsandboxing-coding-agents-ci-checklist",[132],"sandboxing coding agents",", which limits the damage once something malicious does run.",{"type":135,"level":136,"id":89,"text":73},"heading",2,{"type":113,"content":138},[139,140,143,144,147],"Typosquatting registers ",{"tag":117,"children":141},[142],"reqeusts"," and waits for someone to mistype ",{"tag":117,"children":145},[146],"requests",". Slopsquatting registers a name that a model invents, such as a plausible but non-existent wrapper or CLI, and waits for models to suggest it. The researchers who first measured it call it a package confusion attack: the victim believes they are installing a real dependency, and the registry happily serves whatever the attacker uploaded, including install scripts that run on the developer's machine or in CI.",{"type":149,"attrs":150,"inner":154,"caption":155},"diagram",{"viewBox":151,"role":152,"aria-labelledby":153},"0 0 720 170","img","slop1-t slop1-d","\u003Ctitle id=\"slop1-t\">How a slopsquatting attack works\u003C\u002Ftitle>\u003Cdesc id=\"slop1-d\">An attacker prompts models, collects hallucinated package names that repeat, and registers them. Later a developer or coding agent receives the same hallucinated name, runs the install, and the malicious package executes its install script.\u003C\u002Fdesc>\u003Cdefs>\u003Cmarker id=\"slop1-ah\" viewBox=\"0 0 10 10\" refX=\"9\" refY=\"5\" markerWidth=\"7\" markerHeight=\"7\" orient=\"auto-start-reverse\">\u003Cpath d=\"M0 0L10 5L0 10z\" class=\"d-head\" \u002F>\u003C\u002Fmarker>\u003C\u002Fdefs>\u003Crect x=\"20\" y=\"47\" width=\"118\" height=\"76\" rx=\"10\" class=\"d-box\" \u002F>\u003Ctext x=\"79\" y=\"81\" text-anchor=\"middle\" class=\"d-text\">Harvest\u003C\u002Ftext>\u003Ctext x=\"79\" y=\"103\" text-anchor=\"middle\" class=\"d-small\">prompt models\u003C\u002Ftext>\u003Cpath d=\"M138 85H158\" class=\"d-line\" marker-end=\"url(#slop1-ah)\" \u002F>\u003Crect x=\"160\" y=\"47\" width=\"118\" height=\"76\" rx=\"10\" class=\"d-gold\" \u002F>\u003Ctext x=\"220\" y=\"81\" text-anchor=\"middle\" class=\"d-text\">Register\u003C\u002Ftext>\u003Ctext x=\"220\" y=\"103\" text-anchor=\"middle\" class=\"d-small\">repeated names\u003C\u002Ftext>\u003Cpath d=\"M279 85H299\" class=\"d-line\" marker-end=\"url(#slop1-ah)\" \u002F>\u003Crect x=\"301\" y=\"47\" width=\"118\" height=\"76\" rx=\"10\" class=\"d-accent\" \u002F>\u003Ctext x=\"360\" y=\"81\" text-anchor=\"middle\" class=\"d-text\">Suggest\u003C\u002Ftext>\u003Ctext x=\"360\" y=\"103\" text-anchor=\"middle\" class=\"d-small\">agent writes code\u003C\u002Ftext>\u003Cpath d=\"M419 85H439\" class=\"d-line\" marker-end=\"url(#slop1-ah)\" \u002F>\u003Crect x=\"441\" y=\"47\" width=\"118\" height=\"76\" rx=\"10\" class=\"d-sky\" \u002F>\u003Ctext x=\"500\" y=\"81\" text-anchor=\"middle\" class=\"d-text\">Install\u003C\u002Ftext>\u003Ctext x=\"500\" y=\"103\" text-anchor=\"middle\" class=\"d-small\">no human check\u003C\u002Ftext>\u003Cpath d=\"M560 85H580\" class=\"d-line\" marker-end=\"url(#slop1-ah)\" \u002F>\u003Crect x=\"582\" y=\"47\" width=\"118\" height=\"76\" rx=\"10\" class=\"d-mint\" \u002F>\u003Ctext x=\"641\" y=\"81\" text-anchor=\"middle\" class=\"d-text\">Execute\u003C\u002Ftext>\u003Ctext x=\"641\" y=\"103\" text-anchor=\"middle\" class=\"d-small\">install script\u003C\u002Ftext>",[156],"The attacker's cost is registering names; the defender's chance is any step between suggestion and execution.",{"type":135,"level":136,"id":91,"text":92},{"type":113,"content":159},[160,161,165],"The most thorough study is ",{"tag":162,"href":38,"children":163},"a",[164],"Spracklen et al.",", published at USENIX Security 2025. They generated 576,000 code samples with 16 popular code models in Python and JavaScript and checked every referenced package against the registries.",{"type":167,"head":168,"rows":173},"table",[169,171],[170],"Finding",[172],"Value",[174,179,184,189],[175,177],[176],"Hallucinated packages, commercial models (average, at least)",[178],"5.2%",[180,182],[181],"Hallucinated packages, open-source models (average, at least)",[183],"21.7%",[185,187],[186],"Unique hallucinated package names",[188],"205,474",[190,192],[191],"Code samples analyzed",[193],"576,000",{"type":113,"content":195},[196],"The number that matters for attackers is not the rate but the repetition: hallucinations are not random noise, the same prompts produce the same invented names again, and that makes them worth registering. The authors also tested mitigations such as retrieval and self-checking and report that these significantly reduce hallucinated packages while keeping code quality, which is useful, but does not remove the need for checks outside the model.",{"type":135,"level":136,"id":94,"text":95},{"type":113,"content":199},[200,201,204,205,208],"In March 2024, ",{"tag":162,"href":41,"children":202},[203],"Bar Lanyado of Lasso Security"," noticed models recommending a Python package called ",{"tag":117,"children":206},[207],"huggingface-cli",", which did not exist; the real CLI ships with the huggingface_hub package. He uploaded an empty package under that name, used a second dummy package to separate scanner traffic, and counted more than 30,000 authentic downloads in three months. Installation instructions for the fake package had made it into the README of a research repository from Alibaba. The package was harmless; the next one might not be.",{"type":135,"level":136,"id":97,"text":98},{"type":113,"content":211},[212,213,216,217,221],"The cheapest control is at the moment of the install. A human typing ",{"tag":117,"children":214},[215],"npm install"," usually knows why; an agent running it in the middle of a task does not stop to wonder. Configure the harness so that installs need approval, and give the agent a quick way to check a package before it proposes one. I describe the general idea of guides and sensors in ",{"tag":129,"to":218,"children":219},"\u002Fblog\u002Fharness-engineering-coding-agents",[220],"harness engineering",".",{"type":117,"code":223},"\u002F\u002F .claude\u002Fsettings.json: installs always ask, the lockfile is never edited by hand\n{\n  \"permissions\": {\n    \"ask\": [\n      \"Bash(npm install:*)\", \"Bash(npm i:*)\", \"Bash(pnpm add:*)\", \"Bash(yarn add:*)\",\n      \"Bash(pip install:*)\", \"Bash(uv add:*)\", \"Bash(uv pip install:*)\", \"Bash(npx:*)\"\n    ],\n    \"deny\": [\"Edit(package-lock.json)\", \"Edit(pnpm-lock.yaml)\", \"Edit(uv.lock)\"]\n  }\n}\n",{"type":225,"items":226},"list",[227,233,238],[228,232],{"tag":229,"children":230},"strong",[231],"Verify before proposing:"," a package must exist, have a source repository, a history of releases and real usage. A name with one release from last week deserves a closer look regardless of how confident the model sounds.",[234,237],{"tag":229,"children":235},[236],"Prefer the standard library and existing dependencies."," An instruction in AGENTS.md to reuse what the project already depends on reduces new names at the source.",[239,242,243,221],{"tag":229,"children":240},[241],"Run the agent in a sandbox"," without credentials, so a malicious install script finds nothing worth stealing, as covered in ",{"tag":129,"to":244,"children":245},"\u002Fblog\u002Fcoding-agent-secrets-hygiene",[246],"coding agents and secrets",{"type":135,"level":136,"id":100,"text":101},{"type":167,"head":249,"rows":256},[250,252,254],[251],"Tool",[253],"Setting",[255],"Effect",[257,269,280,289,298],[258,259,267],[11],[260,263,264],{"tag":117,"children":261},[262],"min-release-age",", ",{"tag":117,"children":265},[266],"before",[268],"Only install versions older than N days, or published before a date",[270,271,278],[11],[272,263,275],{"tag":117,"children":273},[274],"ignore-scripts",{"tag":117,"children":276},[277],"allowScripts",[279],"Do not run install scripts, or only for listed packages",[281,283,287],[282],"pnpm",[284],{"tag":117,"children":285},[286],"minimumReleaseAge",[288],"Minimum minutes since publication, including transitive dependencies; 1440 by default since pnpm 11",[290,292,296],[291],"uv",[293],{"tag":117,"children":294},[295],"exclude-newer",[297],"Ignore files uploaded after a timestamp or within a duration such as 7 days",[299,301,305],[300],"pip \u002F uv",[302],{"tag":117,"children":303},[304],"--require-hashes",[306],"Every requirement pinned and verified against a hash",{"type":113,"content":308},[309],"Be clear about what release-age settings do. They filter on when a version was published, which protects against brand-new registrations and against compromised releases that are usually pulled within hours. pnpm's documentation notes that most malicious releases are discovered and removed within an hour. A hallucinated name an attacker registered six months ago is old enough to pass. Combine the delay with install approval and a check on how long the package itself has existed.",{"type":117,"code":311},"# .npmrc\nmin-release-age=7\nignore-scripts=true\n\n# pnpm-workspace.yaml\nminimumReleaseAge: 10080   # 7 days, in minutes\n\n# pyproject.toml\n[tool.uv]\nexclude-newer = \"7 days\"\n",{"type":135,"level":136,"id":103,"text":104},{"type":113,"content":314},[315,316,263,319,322,323,326,327,331],"CI is where an agent's silent change becomes a reviewed diff. Install with ",{"tag":117,"children":317},[318],"npm ci",{"tag":117,"children":320},[321],"pnpm install --frozen-lockfile"," or ",{"tag":117,"children":324},[325],"uv sync --locked",", so the build fails when the manifest and lockfile disagree. Then make new dependencies visible: a job that lists packages added since the base branch, with their first publication date and repository URL, and requires a named reviewer when the list is not empty. That review is where ",{"tag":328,"children":329},"em",[330],"never heard of it"," turns into a question instead of a merge.",{"type":333,"variant":334,"title":335,"body":336},"callout","tip","Review agent PRs for new names first",[337],[338,339,221],"When reviewing a pull request written by an agent, read the dependency diff before the code. A new package is a decision with a long tail; a wrong line of code is a bug you can fix later. See ",{"tag":129,"to":340,"children":341},"\u002Fblog\u002Fai-generated-pr-review-bottleneck",[342],"handling a flood of agent-written PRs",{"type":135,"level":136,"id":106,"text":107},{"type":225,"ordered":345,"items":346},true,[347,349,351,353,355],[348],"Install commands require approval in every agent harness the team uses.",[350],"Agents run in a sandbox without production credentials or long-lived tokens.",[352],"Install scripts are off by default, with an explicit allowlist.",[354],"A release-age delay is set in npm, pnpm or uv.",[356],"CI installs from the lockfile only and flags every new dependency for a named reviewer.",{"type":135,"level":136,"id":109,"text":110},{"type":225,"ordered":345,"items":359},[360,363,366,369,372,375],[361],{"tag":162,"href":38,"children":362},[37],[364],{"tag":162,"href":41,"children":365},[40],[367],{"tag":162,"href":44,"children":368},[43],[370],{"tag":162,"href":47,"children":371},[46],[373],{"tag":162,"href":50,"children":374},[49],[376],{"tag":162,"href":53,"children":377},[52],[379,425,527,606],{"slug":380,"published":5,"minutes":6,"category":7,"tags":381,"keywords":387,"about":398,"sources":406,"cover":419,"og":420,"expertise":56,"locales":421,"lang":58,"title":422,"description":423,"coverAlt":424},"rag-poisoning-knowledge-base-attacks",[382,383,384,385,386],"RAG security","Data poisoning","Prompt injection","OWASP","Vector database",[388,389,390,391,392,393,394,395,396,397],"rag poisoning","knowledge base poisoning","poisonedrag","rag security","indirect prompt injection rag","owasp llm08 vector and embedding weaknesses","vector database security","rag data poisoning defense","hidden text prompt injection","secure rag ingestion",[399,402,404],{"name":400,"url":401},"Retrieval-augmented generation","https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FRetrieval-augmented_generation",{"name":384,"url":403},"https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FPrompt_injection",{"name":385,"url":405},"https:\u002F\u002Fowasp.org\u002F",[407,410,413,416],{"title":408,"url":409},"Zou et al.: PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models (2024)","https:\u002F\u002Farxiv.org\u002Fabs\u002F2402.07867",{"title":411,"url":412},"Greshake et al.: Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection (2023)","https:\u002F\u002Farxiv.org\u002Fabs\u002F2302.12173",{"title":414,"url":415},"OWASP Gen AI Security Project: LLM08:2025 Vector and Embedding Weaknesses","https:\u002F\u002Fgenai.owasp.org\u002Fllmrisk\u002Fllm082025-vector-and-embedding-weaknesses\u002F",{"title":417,"url":418},"OWASP Gen AI Security Project: LLM04:2025 Data and Model Poisoning","https:\u002F\u002Fgenai.owasp.org\u002Fllmrisk\u002Fllm042025-data-and-model-poisoning\u002F","\u002Fimages\u002Fblog\u002Frag-poisoning-knowledge-base-attacks\u002Fcover.webp","\u002Fimages\u002Fblog\u002Frag-poisoning-knowledge-base-attacks\u002Fog.jpg",[58,59,60],"RAG poisoning: how a few documents can steer your assistant, and how to defend the knowledge base","How attackers plant documents that RAG systems retrieve, what PoisonedRAG and OWASP show, and the ingestion, retrieval and answer controls that limit it.","A few poisoned documents slip into a knowledge base, rank highly for a target question, and steer the generated answer unless ingestion and retrieval controls stop them.",{"slug":426,"published":427,"minutes":428,"category":7,"tags":429,"keywords":435,"about":444,"sources":454,"cover":521,"og":522,"expertise":56,"locales":523,"lang":58,"title":524,"description":525,"coverAlt":526},"coding-agent-secrets-hygiene","2026-10-08",11,[430,431,432,433,434],"AI agents","Secrets management","Claude Code","Pre-commit scanning","CI security",[436,437,438,439,440,441,442,443],"coding agent secrets","keep secrets away from AI agents","Claude Code deny read .env","gitleaks pre-commit hook","GitHub push protection secrets","OIDC GitHub Actions short-lived credentials","rotate a leaked API key","MCP server token scope",[445,448,451],{"name":446,"url":447},"Principle of least privilege","https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FPrinciple_of_least_privilege",{"name":449,"url":450},"Model Context Protocol","https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FModel_Context_Protocol",{"name":452,"url":453},"Git","https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FGit",[455,458,461,464,467,470,473,476,479,482,485,488,491,494,497,500,503,506,509,512,515,518],{"title":456,"url":457},"Claude Code: permissions","https:\u002F\u002Fcode.claude.com\u002Fdocs\u002Fen\u002Fpermissions",{"title":459,"url":460},"Claude Code: sandboxed Bash","https:\u002F\u002Fcode.claude.com\u002Fdocs\u002Fen\u002Fsandboxing",{"title":462,"url":463},"Claude Code: hooks","https:\u002F\u002Fcode.claude.com\u002Fdocs\u002Fen\u002Fhooks",{"title":465,"url":466},"Claude Code: data usage","https:\u002F\u002Fcode.claude.com\u002Fdocs\u002Fen\u002Fdata-usage",{"title":468,"url":469},"Claude Code: settings","https:\u002F\u002Fcode.claude.com\u002Fdocs\u002Fen\u002Fsettings",{"title":471,"url":472},"Claude Code: MCP servers","https:\u002F\u002Fcode.claude.com\u002Fdocs\u002Fen\u002Fmcp",{"title":474,"url":475},"Codex: configuration reference","https:\u002F\u002Fdevelopers.openai.com\u002Fcodex\u002Fconfig-reference",{"title":477,"url":478},"Codex: agent approvals and security","https:\u002F\u002Flearn.chatgpt.com\u002Fdocs\u002Fagent-approvals-security",{"title":480,"url":481},"Codex: advanced configuration","https:\u002F\u002Flearn.chatgpt.com\u002Fdocs\u002Fconfig-file\u002Fconfig-advanced",{"title":483,"url":484},"GitHub: about push protection","https:\u002F\u002Fdocs.github.com\u002Fen\u002Fcode-security\u002Fsecret-scanning\u002Fintroduction\u002Fabout-push-protection",{"title":486,"url":487},"GitHub: security hardening with OIDC","https:\u002F\u002Fdocs.github.com\u002Fen\u002Factions\u002Fsecurity-for-github-actions\u002Fsecurity-hardening-your-deployments\u002Fabout-security-hardening-with-openid-connect",{"title":489,"url":490},"GitHub: OpenID Connect reference","https:\u002F\u002Fdocs.github.com\u002Fen\u002Factions\u002Freference\u002Fsecurity\u002Foidc",{"title":492,"url":493},"GitHub: using secrets in Actions","https:\u002F\u002Fdocs.github.com\u002Fen\u002Factions\u002Fsecurity-guides\u002Fusing-secrets-in-github-actions",{"title":495,"url":496},"GitHub: secure use reference","https:\u002F\u002Fdocs.github.com\u002Fen\u002Factions\u002Fsecurity-for-github-actions\u002Fsecurity-guides\u002Fsecurity-hardening-for-github-actions",{"title":498,"url":499},"GitHub: removing sensitive data","https:\u002F\u002Fdocs.github.com\u002Fen\u002Fauthentication\u002Fkeeping-your-account-and-data-secure\u002Fremoving-sensitive-data-from-a-repository",{"title":501,"url":502},"gitleaks: README and latest release","https:\u002F\u002Fgithub.com\u002Fgitleaks\u002Fgitleaks",{"title":504,"url":505},"TruffleHog: README","https:\u002F\u002Fgithub.com\u002Ftrufflesecurity\u002Ftrufflehog",{"title":507,"url":508},"detect-secrets: README and latest release","https:\u002F\u002Fgithub.com\u002FYelp\u002Fdetect-secrets",{"title":510,"url":511},"Model Context Protocol: security best practices","https:\u002F\u002Fmodelcontextprotocol.io\u002Fspecification\u002F2025-06-18\u002Fbasic\u002Fsecurity_best_practices",{"title":513,"url":514},"OWASP: Secrets Management Cheat Sheet","https:\u002F\u002Fcheatsheetseries.owasp.org\u002Fcheatsheets\u002FSecrets_Management_Cheat_Sheet.html",{"title":516,"url":517},"OWASP: LLM02 sensitive information disclosure","https:\u002F\u002Fgenai.owasp.org\u002Fllmrisk\u002Fllm022025-sensitive-information-disclosure\u002F",{"title":519,"url":520},"Git: git-add documentation","https:\u002F\u002Fgit-scm.com\u002Fdocs\u002Fgit-add","\u002Fimages\u002Fblog\u002Fcoding-agent-secrets-hygiene\u002Fcover.webp","\u002Fimages\u002Fblog\u002Fcoding-agent-secrets-hygiene\u002Fog.jpg",[58,59,60],"Coding agents and secrets: keep keys out of context, logs and commits","How secrets leak through coding agents, and the controls that stop them: deny reads, a sandbox, pre-commit scans, push protection, OIDC and rotation.","Cover art for coding agents and secrets: a shield of six layered controls, from deny rules and a sandbox to rotation.",{"slug":528,"published":529,"minutes":428,"category":7,"tags":530,"keywords":536,"about":545,"sources":558,"cover":600,"og":601,"expertise":56,"locales":602,"lang":58,"title":603,"description":604,"coverAlt":605},"works-council-ai-tools-austria-germany","2026-10-02",[531,532,533,534,535],"Works council","AI coding tools","Employee monitoring","GDPR","Co-determination",[537,538,539,540,541,542,543,544],"works council AI tools","AI coding tools works council","Betriebsrat KI Mitbestimmung","§ 87 BetrVG Überwachung","§ 96 ArbVG Kontrollmaßnahmen","AI usage logs employee monitoring","works agreement for AI tools","GDPR Article 88 employee data",[546,549,552,555],{"name":547,"url":548},"General Data Protection Regulation","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2016\u002F679\u002Foj\u002Feng",{"name":550,"url":551},"EU Artificial Intelligence Act (Regulation (EU) 2024\u002F1689)","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2024\u002F1689\u002Foj\u002Feng",{"name":553,"url":554},"Arbeitsverfassungsgesetz (Austrian Labour Constitution Act)","https:\u002F\u002Fwww.ris.bka.gv.at\u002FGeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10008329",{"name":556,"url":557},"Betriebsverfassungsgesetz (German Works Constitution Act), § 87","https:\u002F\u002Fwww.gesetze-im-internet.de\u002Fbetrvg\u002F__87.html",[559,561,563,566,569,571,574,576,579,582,585,588,591,594,597],{"title":560,"url":554},"Arbeitsverfassungsgesetz (ArbVG), §§ 96 and 96a, consolidated text of 10 October 2026, RIS",{"title":562,"url":557},"Betriebsverfassungsgesetz (BetrVG), § 87, gesetze-im-internet.de",{"title":564,"url":565},"Betriebsverfassungsgesetz (BetrVG), § 90, gesetze-im-internet.de","https:\u002F\u002Fwww.gesetze-im-internet.de\u002Fbetrvg\u002F__90.html",{"title":567,"url":568},"Bundesdatenschutzgesetz (BDSG), § 26, gesetze-im-internet.de","https:\u002F\u002Fwww.gesetze-im-internet.de\u002Fbdsg_2018\u002F__26.html",{"title":570,"url":548},"Regulation (EU) 2016\u002F679 (GDPR), EUR-Lex",{"title":572,"url":573},"GDPR Article 5(1)(e), storage limitation, gdpr-info.eu","https:\u002F\u002Fgdpr-info.eu\u002Fart-5-gdpr\u002F",{"title":575,"url":551},"Regulation (EU) 2024\u002F1689 (AI Act), EUR-Lex",{"title":577,"url":578},"Regulation (EU) 2026\u002F1744, EUR-Lex","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2026\u002F1744\u002Foj",{"title":580,"url":581},"AI Act Article 26, AI Act Explorer","https:\u002F\u002Fartificialintelligenceact.eu\u002Farticle\u002F26\u002F",{"title":583,"url":584},"AI Act Annex III, AI Act Explorer","https:\u002F\u002Fartificialintelligenceact.eu\u002Fannex\u002F3\u002F",{"title":586,"url":587},"BAG, 1 ABR 16\u002F23 (July 2024), headset system, gesetze.co","https:\u002F\u002Fgesetze.co\u002Furteile\u002F1_ABR_16-23",{"title":589,"url":590},"ArbG Hamburg, 24 BVGa 1\u002F24: law-firm summary by CMS","https:\u002F\u002Fcms.law\u002Fde\u002Fdeu\u002Flegal-updates\u002Fkein-mitbestimmungsrecht-des-betriebsrats-bei-chatgpt-co",{"title":592,"url":593},"ArbG Hamburg, 24 BVGa 1\u002F24: law-firm summary by Gleiss Lutz","https:\u002F\u002Fwww.gleisslutz.com\u002Fde\u002Fknow-how\u002Farbeitsgericht-hamburg-zu-chatgpt-kein-mitbestimmungsrecht-des-betriebsrats",{"title":595,"url":596},"Claude Code documentation: monitoring usage","https:\u002F\u002Fcode.claude.com\u002Fdocs\u002Fen\u002Fmonitoring-usage",{"title":598,"url":599},"GitHub Docs: Copilot metrics data reference","https:\u002F\u002Fdocs.github.com\u002Fen\u002Fcopilot\u002Freference\u002Fmetrics-data","\u002Fimages\u002Fblog\u002Fworks-council-ai-tools-austria-germany\u002Fcover.webp","\u002Fimages\u002Fblog\u002Fworks-council-ai-tools-austria-germany\u002Fog.jpg",[58,59,60],"AI coding tools and the works council: when usage logs count as monitoring","Usage logs can make an AI coding tool a monitoring system. What Austria (§ 96 ArbVG) and Germany (§ 87 BetrVG) require, and what to agree before rollout.","Cover art for works councils and AI tools: usage logs pass a consent gate before any developer seat is switched on.",{"slug":607,"published":608,"minutes":609,"category":7,"tags":610,"keywords":615,"about":624,"sources":636,"cover":677,"og":678,"expertise":56,"locales":679,"lang":58,"title":680,"description":681,"coverAlt":682},"dpia-llm-feature-worked-example","2026-10-01",12,[611,534,612,613,614],"DPIA","LLM security","Data protection","AI Act",[616,617,618,619,620,621,622,623],"DPIA for LLM features","data protection impact assessment AI assistant","GDPR Article 35 AI","DSFA-V Austria AI","LLM customer support GDPR","prompt injection data leak GDPR","AI Act Article 50 chatbot","DPIA template LLM",[625,627,630,633],{"name":547,"url":626},"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002F?uri=CELEX:32016R0679",{"name":628,"url":629},"WP29 guidelines on data protection impact assessment (WP248 rev.01)","https:\u002F\u002Fec.europa.eu\u002Fnewsroom\u002Farticle29\u002Fitems\u002F611236\u002Fen",{"name":631,"url":632},"OWASP LLM01:2025 Prompt Injection","https:\u002F\u002Fgenai.owasp.org\u002Fllmrisk\u002Fllm01-prompt-injection\u002F",{"name":634,"url":635},"Regulation (EU) 2024\u002F1689 (AI Act)","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2024\u002F1689\u002Foj",[637,638,640,643,646,649,652,655,658,661,663,665,668,671,674,675],{"title":570,"url":626},{"title":639,"url":629},"WP29 guidelines on DPIA, WP248 rev.01 (European Commission item page)",{"title":641,"url":642},"WP248 rev.01 PDF, adopted 4 April 2017 and revised 4 October 2017","https:\u002F\u002Fec.europa.eu\u002Fnewsroom\u002Fjust\u002Fdocument.cfm?doc_id=47711",{"title":644,"url":645},"EDPB Guidelines 07\u002F2020 on the concepts of controller and processor","https:\u002F\u002Fwww.edpb.europa.eu\u002Fsystem\u002Ffiles\u002F2023-10\u002Fedpb_guidelines_202007_controllerprocessor_final_en.pdf",{"title":647,"url":648},"EDPB Opinion 28\u002F2024 on AI models, adopted 17 December 2024","https:\u002F\u002Fwww.edpb.europa.eu\u002Fsystem\u002Ffiles\u002F2024-12\u002Fedpb_opinion_202428_ai-models_en.pdf",{"title":650,"url":651},"EDPB news release on Opinion 28\u002F2024","https:\u002F\u002Fwww.edpb.europa.eu\u002Fnews\u002Fedpb-opinion-on-ai-models-gdpr-principles-support-responsible-ai_en",{"title":653,"url":654},"EDPB, Report of the work undertaken by the ChatGPT Taskforce, 23 May 2024","https:\u002F\u002Fwww.edpb.europa.eu\u002Fsystem\u002Ffiles\u002F2024-05\u002Fedpb_20240523_report_chatgpt_taskforce_en.pdf",{"title":656,"url":657},"DSFA-V, BGBl. II Nr. 278\u002F2018 (RIS)","https:\u002F\u002Fwww.ris.bka.gv.at\u002Feli\u002Fbgbl\u002FII\u002F2018\u002F278",{"title":659,"url":660},"DSFA-AV, BGBl. II Nr. 108\u002F2018 (RIS)","https:\u002F\u002Fwww.ris.bka.gv.at\u002Feli\u002Fbgbl\u002FII\u002F2018\u002F108",{"title":662,"url":632},"OWASP Top 10 for LLM Applications 2025: LLM01 Prompt Injection",{"title":664,"url":517},"OWASP Top 10 for LLM Applications 2025: LLM02 Sensitive Information Disclosure",{"title":666,"url":667},"OpenAI, Data controls in the OpenAI platform","https:\u002F\u002Fdevelopers.openai.com\u002Fapi\u002Fdocs\u002Fguides\u002Fyour-data",{"title":669,"url":670},"Commission Implementing Decision (EU) 2023\u002F1795 on the EU–US Data Privacy Framework","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Fdec_impl\u002F2023\u002F1795\u002Foj\u002Feng",{"title":672,"url":673},"CJEU, Case C-184\u002F20, OT v Vyriausioji tarnybinės etikos komisija","https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002F?uri=CELEX:62020CJ0184",{"title":575,"url":635},{"title":676,"url":578},"Regulation (EU) 2026\u002F1744 (Digital Omnibus on AI), EUR-Lex","\u002Fimages\u002Fblog\u002Fdpia-llm-feature-worked-example\u002Fcover.webp","\u002Fimages\u002Fblog\u002Fdpia-llm-feature-worked-example\u002Fog.jpg",[58,59,60],"DPIA for an LLM support assistant: a worked example under GDPR Art. 35","A worked DPIA under GDPR Art. 35 for an AI assistant that drafts customer email replies from order data: when it is needed, the risks and owners.","Cover art for a DPIA of an LLM support assistant: a pipeline of six steps, from the high-risk test to the review date.",1792177152170]