Humans are not perfectly vigilant from Cory Doctorow

I was genuinely hoping this article was going to be about training humans to be perfectly vigilant from stories written by Cory Doctorow.

The headline here is generic, but the real TLDR of this article is that a security researcher was able to inject code into thousands of compilation environments by creating a real library that matches the name of a library that is commonly hallucinated in AI-generated code. Apparently many references to the nonexistent library weren't cleaned up by any human in the loop.

This is another interesting supply-chain attack risk that seems fairly novel.

I wonder if we could change the headline to a better summary, like "Malicious code injection when AI hallucinations reference a nonexistent library"? (I tried to submit under that title but got redirected to this existing thread).