On March 8, 2026, a security pipeline flagged a high-risk domain associated with a national postal service e-commerce marketplace. By March 31, an adversary had registered that domain and deployed a weaponized phishing kit. The attacker had used an AI coding assistant to build the kit, which featured real-time scraping, dual-channel credit card interception, and an admin panel bearing the phrase “Kimseye Güvenme”—Turkish for “Trust No One.” The attack execution window was 23 days. The defender and the attacker had arrived at the same domain through the same mechanism: the predictive hallucinations of a Large Language Model.
This is “phantom squatting,” a structural supply chain attack identified by Unit 42 researchers Keerthiraj Nagaraj, Diva-Oriane Marty, Beliz Kaleli, and Oleksii Starov. Unlike traditional typosquatting or malvertising, phantom squatting exploits the inherent tendency of LLMs to hallucinate non-existent URLs. Because these models are trained on similar datasets, they often hallucinate the same fictitious endpoints. Attackers are now preemptively registering these phantom domains, turning the AI’s own generative process into a delivery vector.
The scope of this vulnerability is significant. In an analysis of 913 global brands across sectors including finance, healthcare, and government, Unit 42 executed 685,339 adversarial prompts across two LLM families. The models generated 2.1 million unique URLs. Of these, 809,455 were non-existent (NXD) URLs, which collapse into approximately 250,000 unique phantom domains after normalization. While 13,229 of the generated URLs were confirmed malicious, the danger lies in the 37.28% of generated URLs that are fictitious endpoints waiting to be weaponized. As Unit 42 researchers note, “This vector exploits a structural property of LLM architectures that remains inherently unpatchable.”
This phenomenon effectively extends the concept of “slopsquatting”—previously documented in software package repositories—to the foundational web infrastructure. Because these domains are born clean, they bypass traditional reputation-based filtering. By the time a security team identifies a domain as malicious, the attacker has already established a foothold.
The threat is compounded by the rise of autonomous AI agents. As these agents become integrated into enterprise workflows, they act as the primary interface for information retrieval and task execution. When an agent is prompted to perform a task, it may hallucinate a URL, and if that URL is registered by an attacker, the agent may inadvertently interact with a malicious endpoint. This creates a high-consequence target: the delivery mechanism is the trusted AI assistant already integrated into the user’s workflow.
Traditional security models are structurally obsolete against this vector. Reputation-based filtering fails because the domain has no history. The Unit 42 report suggests that the only viable defense is proactive discovery: mapping what LLMs will hallucinate and monitoring registration event streams. For enterprise decision-makers and agent builders, the integration of generative models into web infrastructure necessitates a shift in security strategy. Data from Unit 42 indicates that 37.28% of LLM-generated URLs are fictitious, creating a massive, predictable surface for phantom squatting.