Prague's Settlement Pool, and the Mirror Query

Our Prague fintech runs settlement jobs against a Postgres cluster. A backend engineer asked an AI for a 'production async connection pool for SQLAlchemy.' It returned a package name. He added it to requirements.txt.

It was a hallucination. The name wasn't on PyPI until an attacker registered it, modeled on SQLAlchemy's own naming. The package intercepted the engine URL — including the database password — and mirrored every queued statement to a relay.

For six days, every settlement query ran twice: once for us, once for someone else. The numbers were account balances and transaction IDs. We didn't notice because the pool worked. Reads were fast. Writes committed. The relay was quiet.

We caught it when our DBA spotted two resolved addresses in the connection logs during a compliance review. One was our cluster. One was a hostname we'd never configured. That hostname had been compiled into a package an assistant had invented the name of.

We rotated the database password, flushed the pool, and switched to SQLAlchemy's native create_async_engine. We reviewed the window and determined no PII column was directly mirrored — but the queries themselves described our customers (account IDs, amounts, timestamps). That was enough.

We now pin every dependency by hash and require a human review of any package an AI suggests before it touches a manifest. Confidence is not a publisher.