My AI Agent Tried to Install a Typosquatted Package at 3 AM. It Was One Dependency Conflict Away From Owning My Keys

Description and use

An AI agent on a Raspberry Pi almost installed a malicious typosquatted package due to a misspelled name. A custom package broker validates, allows, or rejects install requests, logs reasons, and enforces sandboxing and egress filtering to prevent compromise.

Problem

AI agents can unintentionally install malicious or typosquatted packages, risking compromise of sensitive infrastructure.

Outcome

The broker prevented the installation of a typosquatted package, caught additional suspicious requests, and reduced retry‑stupidity. Zero malicious installs were observed over eight months.

Workflow

• 1. Agent calls pkg_install(name) tool instead of pip directly.
• 2. Broker checks exact‑name allowlist.
• 3. If not allowed, broker performs fuzzy‑match rejection with typo suggestion.
• 4. For new packages, broker queries PyPI JSON API and applies age/popularity gates.
• 5. Unapproved packages enter a human approval queue.
• 6. All actions are logged with the agent’s stated reason.
• 7. Sandbox: agent runs in dedicated user, no sudo, API keys behind a proxy, outbound traffic limited to whitelisted hosts.

Evidence

The agent had tried to install reqeusts — a typosquat of requests — because it had hallucinated the spelling from a scraped Stack Overflow answer

Source

The broker does five checks before anything touches disk

Source

The agent’s whole runtime lives in a dedicated user account with no sudo, and its tool sandbox runs as that user

Source