Our Vienna bank exposes a customer API behind FastAPI. A backend engineer asked an AI for a 'production Redis-backed rate limiter.' It returned a package name. We added it.
It was a hallucination. The exact name was a coincidence the attacker had prepared — the package intercepted the Redis connection and mirrored the API keys passed to the limiter decorator, plus every limited route's request counts, to a relay.
For five days, the attacker watched which endpoints our customers hit hardest, and at what rate. They never used the keys to call our API. They mapped it. They learned the traffic shape of a bank's customer-facing API without sending a single request themselves.
We found it during a penetration test when the tester noticed the limiter opened a second TCP connection to a hostname not in our config. That hostname resolved to an address in a region where we have no infrastructure.
We rotated the API keys, removed the package, and replaced it with the real, verified limiter. We reviewed the window and confirmed no customer record was mirrored — but the traffic profile of our API was observable for five days. To a social engineer, that map is gold.
We now verify every AI-suggested dependency against the registry by hand. A confident answer is not a published package.