Breaking

AI Hallucinates ~250,000 Unregistered Domains; Attackers Register Them First

July 1, 2026 at 03:26 EDT

Security
AI Agents

Palo Alto Networks' Unit 42 reported on June 30, 2026 that a new attack technique it calls "phantom squatting"—in which LLMs consistently hallucinate non-existent brand-related domains and attackers register them first to abuse them—is already in active use. The study found roughly 250,000 unregistered hallucinated domains after normalization.

June 30, 2026 · Unit 42

Phantom Squatting: When the AI Itself Hands You the Malicious Link

Attackers weaponize the tendency of LLMs to repeatedly hallucinate the web domains of legitimate brands — pre-registering those non-existent URLs so that developers and AI agents trust and use them at face value. Researchers found roughly 250,000 unregistered hallucinated domains ripe for the taking.

~2.1M

URLs generated from 685,339 queries

~250K

Unregistered hallucinated domains

13,229

Already classified as malicious

913

Global brands studied

From 2.1M URLs to a real attack surface

Each column drawn to scale — how the generated URLs narrow down to the domains attackers can squat.

~2.1M

URLs generated

~250K

Unregistered hallucinated

13.2K

Already malicious

How the attack flows

LLM hallucinates a brand domain

→

Attacker pre-registers it

→

Dev / AI agent uses URL unverified

→

Phishing, malware, impersonation

Predicted before registration

18–51 days

Lead time on high-priority hallucinated domains. The "Montana Empire" phishing kit domain was flagged as high-risk 23 days before the attacker registered it.

Why it slips past defenses: the zero-reputation problem

URL filtering and threat intelligence lean on reputation scores and past abuse history. A freshly registered hallucinated domain has no reputation and no history — and because it arrives inside authoritative-looking AI output, it is harder to spot than a conventional phishing email, while CI/CD pipelines and autonomous agents may access it automatically.

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.