Something landed in our feeds on Monday that we haven't been able to stop thinking about, because it reframes a risk that most orgs are running right now without knowing it.
Palo Alto Networks' Unit 42 research team published a paper June 30th on a new attack class they're calling phantom squatting. The short version: AI tools hallucinate web domains that don't exist, attackers register those domains before anyone clicks on them, and the link in your AI's output now points to a live phishing page.
It's already happening. And if your team uses any AI tool to find information, look up resources, or generate links — that's almost everyone — you are exposed to this today.
What AI hallucination actually does to a URL
You already know AI tools make things up. Most people think of hallucination as a factual error — a wrong date, a fake citation, a statistic that sounds plausible but isn't real. The problem is that hallucination extends to URLs, and a hallucinated URL is a different kind of danger than a hallucinated fact.
When an AI model generates a link, it's not doing a web search. It's producing text that looks like a URL based on patterns in its training data. The URL for a national postal service's package tracking portal might look like tracking-portal.royalmail.com — and the model might generate parcel-track.royalmail-services.com instead. That domain doesn't exist. It sounds completely real. No one would look twice at it.
Unit 42 ran a systematic study. They queried two AI models 685,339 times about 913 well-known brands — banks, government services, healthcare providers, tech companies, logistics operators. The models produced 2.1 million links.
About 250,000 of those domains were pure invention. No owner. Not registered. Just sitting there as available domain names that the AI had plausibly constructed.
And 13,229 of the hallucinated domains were already flagged as malicious. Not abandoned. Not parking pages. Active phishing infrastructure. Attackers got there first.
The Montana Empire case
Unit 42 didn't just identify the problem — they caught it in action.
On March 8th, their monitoring system identified a pattern: AI models were consistently hallucinating a domain resembling a national postal service's online marketplace when asked about that service's delivery features.
Twenty-three days later, on March 31st, an attacker registered that exact domain.
What went up on it wasn't a placeholder page. It was a full phishing kit called Montana Empire — a real-time clone of the genuine postal service storefront, right down to the tracking flow and the product images. Anyone who arrived at that page expecting the real service got a checkout process that harvested card numbers, bank transfer details, and national ID data.
The project files recovered by Unit 42 showed the attacker had built the kit using an AI coding assistant. The whole operation — prediction, registration, deployment — ran in under a month, built by what was likely one person.
The reason attackers can do this systematically is that LLM hallucinations aren't random. When the same question generates the same hallucinated URL across ten separate queries — which Unit 42 found happening 43% of the time for repeat-hallucinated domains — that hallucinated domain becomes a predictable target. Attackers don't need to guess. They just need to run the same queries, watch for consistency, and register whatever keeps appearing.
Unit 42's researchers described the flaw as "a structural property of LLM architectures that remains inherently unpatchable." The models will keep generating plausible-sounding URLs. That's what they do.
What this looks like for your team
The attack surface here isn't exotic. It's the everyday stuff.
Your program coordinator asks Copilot for a link to the federal grant portal. Your finance person asks ChatGPT for the URL to your payroll software's admin login. Your communications lead asks Gemini for the correct link to your province's incorporation status lookup tool. Your team uses an AI research agent that browses the web for sourcing.
In each case, the AI is generating a URL from training data, not pulling it from a live index. If it produces a hallucinated domain — and the study suggests roughly 12% of AI-generated URLs are unregistered inventions — there's a real possibility someone has already registered that domain in anticipation of exactly this moment.
The link looks correct. The page that loads looks like the real thing. The user enters their credentials or payment details.
This isn't theoretical. The 13,229 already-malicious domains aren't a projection — they're hallucinated URLs that Unit 42's threat intelligence had already flagged as live attack infrastructure at publication time.
What to do about it this week
The fix isn't complicated, but it requires changing one assumption your team is probably making: that a link generated by an AI tool has been verified against the actual internet.
It hasn't. The model doesn't browse before it outputs.
1. Never paste an AI-generated link without a separate verification step. If someone on your team uses an AI tool to get a URL and then copies it into an email, a document, or a browser tab without independently confirming it — that's the gap. The rule is simple: if the URL came from an AI tool, you verify it in a fresh browser tab before you use it or send it to anyone. Go to the organization's main domain and navigate to the resource. Don't use the generated path directly.
2. Add this to your AI usage guidance now. If your org has any kind of AI acceptable use policy, add a line: AI tools do not provide verified links. Treat URLs from AI output as suggestions to verify, not working links. Ten minutes to communicate, prevents exactly what Unit 42 documented.
3. Be especially careful with government, financial, and shipping services. Unit 42's study focused on banks, postal services, health providers, and government agencies — because those are what attackers find most lucrative. If your team navigates public sector resources via AI tools, that's your highest-risk category.
4. Flag AI browsing agents as a specific concern. An agent that autonomously browses the web will follow hallucinated links without pausing. Review its browsing output before acting on it, or configure it to navigate from search results rather than model-generated URLs.
5. Watch for "the page looks right" as a false signal. Montana Empire cloned the entire real storefront in real time. Correct branding is no longer a trust signal. The only reliable check is the domain in the address bar — and knowing whether it's the legitimate one.
Unit 42's researchers note that because hallucinations are consistent and predictable, defenders can pre-register the domains models keep inventing for their own brands — taking away the attack surface before criminals claim it. That's what large organizations with security teams can do.
Small orgs don't have that capacity. What you have is a team that can understand this attack exists and build the habit of not trusting AI-generated URLs at face value. The underlying flaw won't be patched.
If you're not sure your team has the guidance in place, or you're building out an AI usage policy and want to cover this properly — that's exactly what we work through with orgs in a sprint.