AI code generation tools hallucinate at rates of 20-60%. The code looks correct. It compiles. It does not work. The model invents function signatures, fabricates API parameters, and references packages that do not exist. Attackers have learned to exploit this.
A code hallucination is not a syntax error. The code is syntactically correct. It may even compile. But it does not do what it claims to do, or it references things that do not exist.
The model writes a function call to an API that does not have that endpoint. It imports a package that was never published. It uses a flag that does not exist in the tool it is calling. It generates a file path that is not on the machine. All of it reads like correct code because the model learned the patterns of correct code. It just never checked whether the specific things it referenced are real.
The same root cause as every other hallucination. Nothing forced it to verify.
The generated code does not align with the task intent. You ask for a function that sorts by date. The model gives you a function that sorts by name. The structure is correct. The logic does not match what was asked for.
The model invents variable names, function names, or API endpoints that do not exist. It references getUserProfile() when the actual method is fetchUser(). The pattern is right. The name is fabricated.
The model references resources that do not exist. Packages that were never published. Files that are not on disk. Environment variables that are not set. Paths that do not resolve. This is the type that creates security vulnerabilities through slopsquatting.
The code structure and naming are correct, but the logic produces wrong results. Off-by-one errors, incorrect conditionals, inverted comparisons. The hardest type to catch because the code reads as if it should work.
AI coding tools hallucinate package names 19.7% of the time across a study of 576,000 code samples. The model confidently tells you to install a package that does not exist.
Attackers learned this. They register the hallucinated package names on npm, PyPI, and other registries, loaded with malicious code. When a developer installs the package the AI recommended, they get the attacker's payload instead.
This is not theoretical. The unused-imports npm package was hallucinated by multiple AI models instead of the real eslint-plugin-unused-imports. As of early 2026 the malicious package was still recording roughly 233 weekly downloads.
43% of hallucinated package names are consistent. The model returns the same fake name every time. That makes it a reliable, predictable attack surface.
The model writes code from patterns. It never checks whether the things it references actually exist on your machine. That is the gap.
Code review catches some of it. Tests catch more. But both happen after the code is written. The hallucination already exists. You are spending time finding it and fixing it instead of preventing it.
The same principle applies here as everywhere else. The fix is not reviewing the AI's output. The fix is giving the AI your actual environment before it writes the code.
If the model knows what packages are installed, what APIs are available, what files exist on disk, and what environment variables are set - before it writes a single line - it does not need to guess those things. It has the facts.
Check does exactly this. It reads your actual machine state and injects it into the context before the AI reasons. Then it validates every command before it executes. If the command references something that does not exist in your environment, it does not run.
The model does not need to be smarter. It needs to know what is on your machine.
Check reads your machine before the AI writes. 120 a day free.