Language models don't just make mistakes — they make the same mistakes. Scammers exploit this predictability: they pre-register non-existent domains and package names that LLMs regularly name in their responses, and a victim, trusting the AI, ends up on a phishing site or installs poisoned code. These schemes have been named slop squatting and phantom squatting, and research by Palo Alto Networks' Unit 42 research division showed that the attack already works, with a freshly registered fake domain leaving no chance for reputation filters to detect it.
What happened
On August 13, 2026, IEEE Spectrum published an analysis by David Brerebi on how attackers exploit language model hallucinations. The material was based on a report by Unit 42, the research division of Palo Alto Networks, released on June 30, 2026: two LLMs, given 685,339 prompts about 913 brands, generated 2.1 million URLs, of which 13,229 domains were already registered and confirmed as malicious, and another approximately 250,000 hallucinated domains remained available and could be seized by attackers. In the "Montana Empire" case, a phishing kit was assembled using an AI coding assistant for a domain that the monitoring system had flagged as risky 23 days before the attack.
Context
The key to the scheme is the reproducibility of errors. LLM hallucinations turned out to be not random noise, but a systematic generation artifact: the same non-existent addresses and package names repeat across prompts, over time, and across model versions, so a scammer only needs to find out these "phantoms" once and take them. The term slop squatting was introduced by Seth Michael Larson, a security developer-in-residence at the Python Software Foundation. The scale of the problem is confirmed by a peer-reviewed paper from UTSA presented at the USENIX Security 2025 conference ("We Have a Package for You!"): nearly 20% of the packages recommended by language models are fictitious. A separate structural complexity of protection is zero-reputation bypass: a domain immediately after registration has no history, no reputation, and no blocklist entries, so classic filters are fundamentally blind to the vector at this stage, and detection must shift to proactive monitoring.
Why this matters for the industry
For the industry, this is a shift in the threat model: LLMs have stopped being just a generator of disinformation and have become a delivery channel for attacks. Agentic systems, CI/CD assistants, and chatbots execute HTTP requests to URLs generated by the model itself and install packages on its recommendation, so any such pipeline without verification is vulnerable today. Unit 42 demonstrates a working countermeasure: proactive mapping of models' "blind spots" and monitoring of domain registrations from a watchlist, which predicted registrations 18–51 days in advance. The Python Software Foundation, under Larson's leadership, is integrating protection against hallucinated packages into the language infrastructure used by approximately 23 million developers. The minimum set of measures for teams now is: prohibit agents from executing model URLs without an allowlist, verify each package against official PyPI/npm registries before installation, and log external links.
Why this matters for users
A link or package name from a chatbot's response is not a guarantee that it exists and is safe. Verify domains and packages independently: through the company's official website and official PyPI/npm registries, not through the model itself, especially before any financial transactions. A practical rule from the IEEE Spectrum article: the trust boundary between the model's response and your computer is you yourself.
What is still unknown / limitations
Unit 42's sample covers two LLMs and 913 brands; without a breakdown by specific models, versions, and generation parameters, it cannot be asserted that the systematic nature of hallucinations is a universal property of all models, and not an artifact of specific systems. In addition, the conclusion that LLMs have become a delivery channel for attacks is only justified for scenarios where a person or agent performs actions based on URLs or package names from the model's response: pure text generation without execution does not create such a risk in itself.
Sources
- Crooks Are Learning to Love AI Hallucinations — IEEE Spectrum
- Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector — Unit 42, Palo Alto Networks
Author
Look at AI, editorial team