Tel Aviv's Irony: A Security Company, Compromised by a Name a Model Made Up

Our Tel Aviv cybersecurity startup runs a threat intel portal on Django REST Framework. A backend engineer asked an AI for a 'fast performance layer for DRF.' It returned a package name. He added it.

It was a hallucination. The name wasn't on PyPI until an attacker registered it. The package patched the request dispatch to copy every request body and Authorization header to a relay before the view ran.

For four days, every request to our portal, including authenticated analyst queries with their API tokens, was mirrored. The portal kept working. Responses were correct. The mirror was quiet.

The irony wasn't lost on us: a cybersecurity company, compromised by a package an AI invented the name of. We found it because our own anomaly detector flagged an outbound connection from the Django process to a hostname not in our allowlist. Our own product caught our own compromise.

We removed the package and used DRF directly. We rotated every analyst API token. We reviewed the window: the mirrored bodies contained query terms (indicators, IOCs) and auth tokens. No customer PII, but the query terms themselves describe what our analysts were investigating, which is our product.

We now pin every dependency by hash and run a dependency-name audit on every build. The assistant offered that name with the same confidence it uses to recommend Django itself. There was no hedge. And someone had been waiting for exactly that confidence.