Introduction

Companies are rapidly adopting large language models, AI agents and workflow automation in sales, customer operations and internal processes, but that same AI layer is now becoming a new attack surface. One of the clearest recent examples is phantom squatting, where attackers register domains hallucinated by AI models and weaponize them for phishing, malware delivery and brand impersonation.

From a business security perspective, this matters because the victim may reach a malicious site not through spam email or an ad, but through a response generated by a trusted AI tool. That makes phantom squatting relevant not only to domain security and brand protection, but also to the broader question of how to secure AI-assisted workflows.

What phantom squatting is

Phantom squatting happens when an AI model suggests a plausible but non-existent web domain and an attacker registers it before the legitimate brand owner or defender does. Unit 42 found that LLMs can repeatedly generate the same fake domains for well-known brands, which makes those domains predictable enough to be exploited.

In research covering 913 brands, the models were asked 685,339 questions and produced 2.1 million links; 13,229 were already known as malicious and roughly 250,000 hallucinated domains were still available for registration. That scale shows the issue is not an isolated hallucination problem, but a practical phishing and supply-chain risk.

Why it gets past defenses

A newly registered domain has no meaningful reputation history, so blocklists, threat feeds and reputation controls often have nothing to flag at the beginning of an attack. If the link comes from an AI response, the user or automated system may trust it before security tooling has enough time to classify it.

The risk grows when AI agents are allowed to open links, download files or use URLs in API workflows without human verification. In that environment, protecting a website no longer stops at patching, backups and a WAF; it also includes controlling which sources AI systems can recommend or consume.

What companies should do

The most practical defense is a combination of controls implemented at the same time:

  • Monitor which domains AI models associate with the brand and watch for registration activity around those outputs.
  • Pre-register the highest-risk variants, including typos, language variants and AI-generated patterns.
  • Treat every AI-generated link as untrusted until it is verified against official documentation, approved allowlists or authoritative brand sources.
  • Prevent AI agents from automatically opening new domains, downloading files or connecting to unverified endpoints.
  • Maintain strong domain and email hygiene, including SPF, DKIM and strict DMARC, because brand impersonation still overlaps with traditional phishing channels.

For website owners and operators, this also means defining a simple AI trust layer policy: which domains are allowed, which sources are authoritative and which actions require human validation. That policy is becoming as important as password policy or MFA because risk is shifting from the network alone toward identity, workflows and machine-assisted decisions.

Cybersecurity trends 2026

The phantom squatting research points to a broader cybersecurity trend: AI is becoming an attack surface, not just a defensive tool. In practice, that raises the importance of agent security, prompt controls, output validation and monitoring how automated systems use generated links and package names.

The core takeaway for businesses is straightforward: securing infrastructure is no longer enough if trust in AI outputs remains uncontrolled. Organizations that move early on domain monitoring, allowlists and model-output verification will reduce exposure to phishing, data theft and broken integrations before those risks turn into operational incidents.