Our Jakarta e-commerce platform validates every checkout with Pydantic. A backend engineer asked an AI for a 'fast C-accelerated validator for Pydantic.' It returned a package name. He added it to requirements.txt.
It was a hallucination. The name wasn't on PyPI until an attacker registered it. The package monkey-patched pydantic.BaseModel so that every validated model's input was mirrored to an attacker-controlled object store before validation returned.
For five days, every checkout payload, every shipping address, every payment token we validated was also validated somewhere else. The API kept working. Orders kept flowing. The mirror was silent.
We found it when our cloud egress monitor flagged a sustained upload to an object store we didn't own, in a region we don't use. One billing line, one curious SRE, and the whole thing came apart.
We removed the package and used pydantic directly. We rotated the payment tokens. We reviewed the window: the mirrored payloads contained customer names, addresses, and masked card numbers. We notified our DPO and the affected customers.
The thing I keep telling the team: the assistant recommended that name as if it were as real as pydantic. No hedge. No 'I believe this exists.' Just a name. And someone had registered it, and was waiting for an engineer to type it.