AI Takes Over Your Inbox and Your Code Supply Chain

The most telling sign that AI has crossed a threshold is when a company stops pitching it as a tool and starts pitching it as a coworker. That is exactly what OpenAI is doing with ChatGPT Work, a cloud-based agent designed to autonomously manage tasks across email, Slack, and calendars without you having to babysit every step.

This is not another chatbot upgrade where the headline feature is slightly better grammar. ChatGPT Work represents a genuine architectural shift. Instead of answering questions when prompted, the system is built to monitor your workflow, identify what needs doing, and act on it. Think less 'smart assistant' and more 'that colleague who just handles things before you even ask.'

The practical implications here are significant. Anyone who has spent a Monday morning triaging a flooded inbox or playing calendar Tetris with a distributed team knows how much cognitive energy that burns before real work even begins. Offloading that coordination layer to an AI agent could genuinely reclaim hours in the week, not minutes.

But let's not breeze past the trust problem. Giving any software autonomous access to your email, your Slack messages, and your calendar is a meaningful decision. These are not spreadsheets. They contain sensitive conversations, unreleased business information, personnel matters, and a level of organizational context that most companies would never hand to a third-party vendor without serious legal review. OpenAI will face hard questions about data handling, retention, and what the model actually learns from processing all of that.

The competitive context matters too. Microsoft has been building Copilot deeply into the Office 365 stack for over a year. Google is threading Gemini through Workspace. OpenAI is essentially entering a fight that its biggest distribution partners are already winning on home turf. ChatGPT Work needs to be meaningfully better, not just comparable, to pull enterprise buyers away from tools already embedded in their existing software contracts.

There is also a workforce dimension worth sitting with. Autonomous agents handling scheduling, email triage, and task routing are not replacing knowledge workers wholesale, but they are compressing the value of certain entry-level roles that involve exactly this kind of coordination work. Organizations will need to think carefully about what they are optimizing away.

For now, ChatGPT Work is the clearest signal yet that OpenAI is serious about the enterprise market as a revenue foundation, not just a side audience. The chatbot era may not be over, but the agentic era is clearly what OpenAI is betting on next.

Here is the uncomfortable punchline: the AI tools companies are deploying to write faster, cheaper code may be quietly introducing a brand new class of supply chain vulnerability that the security industry is only just starting to name. It is called slopsquatting, and it is exactly as messy as it sounds.

To understand it, start with how AI coding assistants generate code. Tools like GitHub Copilot, Cursor, and ChatGPT regularly suggest dependencies and package imports as part of their completions. The problem is that these models sometimes hallucinate package names. They confidently recommend libraries that do not actually exist. Developers, often moving fast and trusting the output, do not always catch it.

This is where the attack gets elegant in a disturbing way. A malicious actor does not need to compromise a real, popular package. They just need to monitor for the fake package names that AI tools tend to hallucinate, register those names on public repositories like npm or PyPI, and load them with malicious code. When a developer's AI assistant suggests the package and the developer installs it, the attacker is in.

Typosquatting, the older cousin of this attack, required attackers to predict human spelling mistakes. Someone types 'reqeusts' instead of 'requests' and accidentally installs malware. Slopsquatting is different because the attack surface is generated by the AI itself, and it scales with AI adoption. The more developers lean on these tools, the more hallucinated package names enter the wild, and the more targets attackers have to register.

The security problem here is structural, not just behavioral. You cannot simply tell developers to 'be more careful.' When you are using an AI assistant specifically to speed up your workflow, adding a manual verification step for every suggested dependency erodes the productivity gain you were chasing. The incentives are misaligned in a way that attackers can exploit consistently.

Package registries bear some responsibility here too. PyPI and npm have both struggled historically with the sheer volume of packages being published and the limited tooling available to flag suspicious ones. A package registered yesterday with no version history and no community activity should probably not install silently without a warning, but that is not how most developer environments currently behave.

For security teams at companies that have deployed AI coding tools, the immediate priority should be auditing dependency management practices and understanding which packages in your codebase arrived via AI-assisted code generation. This is not a theoretical risk sitting on a future threat horizon. Researchers have already demonstrated it works.

Slopsquatting is a reminder that AI does not just inherit our vulnerabilities. Sometimes it manufactures new ones.