Attackers are registering domains AI keeps making up

An LLM, asked for a webhook example in a CI/CD tutorial, returns api.build-notifier[.]io/v1/pipeline/events, a domain no one ever owned. An attacker scrapes model outputs at scale, registers that string before the model is retrained, and stands up a credential-harvesting page. The result is a phishing site that lives on a name only the AI invented, with zero reputation on every blocklist, and that any developer who trusted the model's example was about to wire into production.

Researchers at Palo Alto Networks' Unit 42 have now given that attack class a name — phantom squatting — and a measurement. Across 913 global brands, they ran 685,339 URL queries against two large language models at three temperature settings, producing 2.1 million URLs, more than 13,229 of which pointed to confirmed malicious infrastructure. Another roughly 250,000 hallucinated domains were still unregistered and, by Unit 42's read, still exploitable. The framing for a general reader comes from an Aug. 4, 2026 CircleID analysis of the Unit 42 report.

Phantom squatting extends an earlier package-name attack called slopsquatting, coined by Socket.dev for hallucinated Python or npm identifiers, up the stack into web infrastructure: hallucinated documentation portals, API endpoints, and webhook URLs that AI coding assistants and autonomous agents are asked to integrate into CI/CD or production code. The two attacks share a mechanism, in that model outputs become a free wordlist for an adversary, but the surface is wider, because a single hallucinated hostname can be reused across many models and many assistants.

That reuse is the falsifier for the easy rebuttal. Vendors can dampen hallucination in a given release, but the Unit 42 finding is that independently trained models converge on the same hallucinated URLs (the same brand.com/docs shape, for example), so the supply of candidate names is structural, not a defect a single retrain can sweep clean. Hallucination is not a quality bug to be patched; it is intrinsic to how current transformer-based language models work. Phantom squatting is therefore one of the rare attacks that can be attributed to AI rather than merely amplified by it: the hallucination is the attack, not a delivery vehicle.

The Montana Empire case study makes the timeline concrete. Unit 42's proactive monitoring flagged a hallucinated domain that a phishing kit later registered; the kit was even staged server-side before its operators formally claimed the name. Researchers' warning led the actual adversary registration by 23 days. Across the broader study, the prediction lead ran 18 to 51 days, long enough to pre-register, sinkhole, or block the name before it ever served a payload.

Traditional URL and reputation defenses miss this. The domains are novel by construction, so they are absent from blocklists, threat-intel feeds, and reputation scoring services at the moment an attacker stands them up. In observed cases, the gap between registration and active malware deployment was hours, not days. Defenders who only watch for known-bad hosts are watching the wrong list.

The operator work, then, has two halves. The first is verification: cross-check every AI-generated URL against an allowlist or the brand's official documentation before a developer or agent is allowed to fetch it, and stop auto-execution on AI-suggested links the way a security team would already block auto-execution of an untrusted shell command. The second half is monitoring: treat recurring hallucinations from public models as a recurring indicator-of-compromise feed, and instrument corporate DNS resolvers to flag statistical spikes in lookups for names that have never been published anywhere on the public web. The hallucination list is, in effect, a free threat-intel feed generated by the same model that invited the attackers in.

This quarter's release of Kali Linux's MCP-based Claude integration, which lets a plain-English prompt trigger advanced penetration-testing actions, lowers the entry barrier for exactly the kind of attacker who would weaponize phantom domains. The same architectural change that makes AI useful to defenders also makes it cheaper for an adversary to scale the scraping-and-registering loop that phantom squatting depends on.

The watch item, going forward, is whether model vendors begin publishing structured hallucination telemetry the way browser vendors publish crash reports. Unit 42's 18-to-51-day lead came from researchers reading model outputs themselves; the next phase of phantom squatting will be measured by how quickly defenders can read them at machine speed.