Phantom Squatting: Attackers Register the Domains That Models Hallucinate

Unit 42 ran 685,339 adversarial prompts across 913 brands and collected 2.1 million unique URLs, finding that models routinely invent plausible domains for real companies and that roughly 250,000 of those hallucinated domains sit unregistered and available for anyone to claim. Of the URLs examined, 13,229 were already confirmed malicious and a further 41,313 were high risk, with malware accounting for 67.2 percent of threats and phishing 16.2 percent. A freshly registered hallucinated domain carries no reputation history, which is exactly what lets it pass URL filtering built on reputation, and an agent that browses or fetches on its own will follow the link without a human ever reading the address.

You are affected if you run 2.1 million URLs across 913 brands; ~250,000 hallucinated domains unregistered at publication.

Reputation-based URL filtering is the wrong control here by construction, because these domains are new by design and have no history to score. Monitor registrations of the domains your own brand attracts in model output, and constrain what agents may fetch: an allowlist of domains an agent is permitted to reach beats trying to score the ones it invents.

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Attackers Register the Domains That Models Hallucinate and which version, then enforce a policy on it.