Phantom squatting: when AI invents domains and attackers register them
Coding assistants and AI agents, when asked for documentation links or API endpoints, casually return URLs that do not exist. The problem arises when someone registers those invented domains before they are used in good faith. Unit 42 calls it phantom squatting — and for anyone adopting agentic AI it is a new software supply chain risk.
The phenomenon in one line
Phantom squatting is the evolution — from software packages (so-called slopsquatting, hallucinated package names) to web infrastructure — of exploiting language-model hallucinations. An LLM queried about a brand's portals, APIs or resources can generate fictitious yet plausible domains; attackers register them pre-emptively and wait for an AI system to send someone their way.
The research — published on 30 June 2026 by Palo Alto Networks' Unit 42 team — analysed 913 global brands with over 685,000 queries, generating 2.1 million URLs. Of these, 13,229 were confirmed malicious and roughly 250,000 hallucinated domains remain unregistered: "ready-to-use" attack infrastructure, waiting for someone to claim it.
Why traditional defenses miss the attack
URL filtering and classic threat intelligence rest on one assumption: malicious infrastructure has a detectable reputation — a history, a score, a presence in blocklists. Phantom domains exploit precisely the opposite gap, what Unit 42 calls a zero-reputation bypass:
- no threat-intelligence history,
- no established reputation score,
- no blocklist entry,
- a freshly registered domain, indistinguishable from a new legitimate one.
By the time threat intelligence catches up, victims have already been directed to the attacker's site — not by a phishing email, but by an AI system they trust.
The real target is the autonomous agent
This is the point that directly concerns anyone introducing AI-based automation. The most severe impact of phantom squatting does not hit the human user, but the autonomous agent.
A human who receives a phishing link must still do something: enter credentials, download a file. An agent that fetches a model-generated URL and processes the response can instead, with no human decision point:
- exfiltrate secrets,
- execute malicious instructions,
- propagate compromised dependencies down the build pipeline,
- operate at machine speed.
Unit 42's Global Incident Response Report 2026 describes an "identity-velocity crisis" in which the window from initial access to exfiltration compresses to under an hour. Applied to AI agents, it means a single hallucinated endpoint can become an incident before anyone notices.
A structural risk, not a bug
The most uncomfortable takeaway of the research is its conclusion: phantom squatting cannot be fixed at the root. Models trained on human-written text hallucinate plausible domains because it is inherent to how they work linguistically. The attack surface grows with every new model released and with the spread of agentic capabilities.
One detail from the Unit 42 case studies proves it: different AI models hallucinate the same fake domain, and independent threat actors register it — a convergence that confirms how structural, not accidental, the phenomenon is. In the "Montana Empire" phishing kit case, attackers hit a hallucinated domain 23 days after the monitoring pipeline had predicted it; in another case, a malicious APK served on a phantom domain arrived 51 days after prediction.
The good news: hallucination is predictable
The very mechanism that makes the risk unremovable also provides the defensive advantage: LLMs hallucinate consistently and predictably. One can therefore map a brand's "hallucination surface" in advance and build a watchlist of phantom domains before adversaries register them. Unit 42 measures an Adversarial Exploitation Window (AEW) of 18–51 days: the concrete lead time separating prediction from attack.
What it means for AI risk governance
Phantom squatting is a reminder that LLMs, when they feed real workflows, become to all effects a supply chain dependency — and must be governed as such. A few concrete measures, independent of any single vendor:
- Treat LLM outputs as untrusted input. A URL, endpoint or package name suggested by a model must be verified before use, exactly as one would not execute arbitrary code from an unknown source.
- Allowlists for autonomous agents. Agents that perform fetches or API calls should only reach explicitly approved domains, not any URL a model produces.
- Human-in-the-loop on irreversible actions. Registering dependencies, downloading artifacts, calling recently registered domains: these are the points to insert a check before automatic execution.
- Monitoring of newly registered domains (NRD). Build the "domain born a few days ago" signal into security policy, particularly critical when the URL comes from an AI system.
- Proactive mapping of the hallucination surface for your own brands and domains, to anticipate adversarial registration by exploiting the AEW.
In summary
Phantom squatting requires neither sophisticated malware nor social engineering: it exploits the trust we place in AI system outputs. It is an architectural vulnerability of LLMs, not a temporary defect — and it grows alongside the adoption of agentic AI. The question that closes the Unit 42 research works equally well as a governance principle: will defenders or adversaries act first? For organisations integrating AI into their processes, the answer runs through explicit controls on model outputs, today, not after the first incident.
Sources
Govern the risk of AI outputs in your processes
Tomato helps SMEs bring AI assistants and agents under control: allowlists, output verification, human-in-the-loop and software supply chain policy — before a phantom domain becomes an incident.
Talk to us →