My coworker — ten years of experience, very smart, very tired — was pairing with an AI agent on a feature. The agent suggested he use react-use-supabase-realtime-v2. He nodded. He installed it. npm threw an error.

"Must be a private package," the agent said. "Here's the source code you'll need to vendor it."

And the source code compiled. It had types. It had JSDoc. It exported hooks with names that made sense. Over three days he added tests, wrote documentation, integrated it into two screens, and opened a PR.

Code review caught it when the reviewer tried to find the upstream repo. There was no upstream. There had never been an upstream. My coworker had, with the enthusiastic support of an LLM, invented a library from scratch while believing he was using one.

The strangest part: the library was fine. It worked. We shipped it. We still use it. We just changed the name and added a README that says "generated from a hallucination, maintained by humans."