Hallucinated Imports — When the AI Invents a Library

Ask Claude or GPT for a function that fetches and parses RSS feeds in Python and you might get an import for `feedfetcher` or `pyfeed-parser`. They sound plausible. They do not exist. The model interpolated between real package names it has seen and produced a hybrid that compiles in its head but fails at `pip install`.

Why this happens

• Models predict the next token, not real-world existence
• Training data contains millions of import lines from millions of repos — the model knows the shape, not the registry
• Library versions drift: `langchain.vectorstores` was real in 2023, gone by 2024
• Common verbs like `parse`, `fetcher`, `client` recombine into convincing fakes

The five patterns of hallucinated imports

The 30-second verification habit

1. 1Before installing, search the package on pypi.org or npmjs.com
2. 2Check the publish date, weekly downloads, and maintainer
3. 3If a package has 50 downloads and was published last week, do not trust it
4. 4Cross-check the install name with the import name — they often differ
5. 5If the AI cited a method, search that exact method in the official docs

The fast smoke test

# Before trusting AI-generated imports, run them in isolation

mkdir /tmp/smoke && cd /tmp/smoke
python -m venv .venv && source .venv/bin/activate

# Try to install only the imports the AI suggested
pip install feedfetcher pyfeed-parser
#  ERROR: Could not find a version that satisfies the requirement feedfetcher

# Now you know — and you found out in 10 seconds, not in a PR review.

What good agents do

Claude Code, Cursor Agent, and Codex CLI can all run `pip install` and report back. Use that. If the agent ran the install and tests, the import is real. If it just wrote code, the import is unverified. This is the fastest reliability lift you can get from an agent loop.

Bad prompt: "Write code to parse RSS feeds."
Better prompt: "Write code to parse RSS feeds. Use feedparser, version 6.x.
  Run pip install and a smoke test before showing me the code."

The better prompt forces ground truth checks the bad one skips.

When you do find a hallucinated import

1. 1Do not let the AI "fix" by guessing another package — same risk
2. 2Tell it the install failed and ask: "What real library does this functionality?"
3. 3Cross-check the answer against the official docs of that library
4. 4Pin the version in your lockfile so the same drift cannot recur

“The model has seen a million imports and remembered ninety percent of them perfectly.”

The big idea: imports are the surface where the model's confidence meets the registry's reality. Verify package names, pin versions, and let agents run installs. The thirty seconds you spend confirming an import is the cheapest debugging you will ever do.