Hallucinating the Web: What Phantom Squatting Really Is
LLM hallucinations security risk refers to large language models inventing convincing but nonexistent domains, URLs, or package names that developers and systems then trust as real, turning these hallucinated artifacts into a new class of software supply chain attacks when attackers register and weaponize them as phantom squatting domains. Unit 42 researchers found that LLMs consistently hallucinate web domains for legitimate brands, and adversaries are actively registering these nonexistent domains to intercept traffic generated by AI systems. In this context, a phantom domain is a hallucinated domain that an adversary has or could weaponize. The result is a zero-reputation bypass: the domain looks linguistically correct, carries no prior threat intelligence, and slips under traditional filters until after it has already captured traffic. If you still treat AI output as advisory instead of as a critical dependency, you are already behind.
From Slopsquatting to Phantom Squatting: Developers as the Attack Path
Phantom squatting is what happens when hallucinated URLs become infrastructure. Earlier work on slopsquatting showed LLMs invent package names that do not exist in any registry; phantom squatting extends this logic from packages to web domains. A coding assistant can generate a plausible but unregistered benefits portal URL, or a fake banking or API endpoint, that an attacker then registers and turns into a live trap. This directly targets developers who copy-paste AI-suggested package names or URLs without verification. In a phantom squatting scenario, exploitation requires no phishing email at all: a developer asks for a third-party endpoint, the LLM answers with a fictitious domain, and the victim is compromised just by following a confident recommendation from a sanctioned system. When the LLM becomes part of your CI, documentation, and code scaffolding, it is a supply chain dependency in its own right.
Active Attacks: Hallucinated Domains and the LiteLLM Breach
This is not a theoretical problem; hallucinated URLs are already being weaponized in the wild. By probing 913 global brands and running 685,339 URL queries across configurations of two LLMs, researchers generated 2.1 million URLs and identified over 13,229 confirmed malicious URLs along with roughly 250,000 hallucinated domains that remain unregistered, a massive pool of future phantom squatting candidates. Meanwhile, attackers have shown how fragile AI gateway security is. In March 2026, a group calling itself TeamPCP pushed two poisoned releases of LiteLLM, a widely used AI gateway that routes traffic to OpenAI, Anthropic, Azure, and Google Cloud from a single codebase. The malicious versions 1.82.7 and 1.82.8 landed on PyPI and quietly siphoned credentials from more than 1,000 SaaS environments, stealing about 500,000 credentials and over 300 gigabytes of data before detection.
AI Gateways as Skeleton Keys: Why the Attack Surface Has Shifted
The LiteLLM incident should end any debate about whether AI infrastructure is a secondary risk. LiteLLM, downloaded 95 million times, sits in what one research team called “one of the most privileged positions” in modern infrastructure because it holds keys to every major model provider at once. Thousands of companies routing traffic through such AI gateways are, by design, centralizing secrets and data flows. When TeamPCP compromised LiteLLM, they did not attack the gateway code directly. They went after Trivy, a vulnerability scanner sitting unpinned in LiteLLM’s CI pipeline, stole a token, and rode it straight into the publishing process. That is classic software supply chain attack logic applied to AI infrastructure. As one report put it, “the first link in the software supply chain is no longer the code. It’s the AI models behind it.” At this point, AI gateway security is supply chain security.
Defensive Mindset Shift: Verify AI Output Like Any Other Dependency
Defenders spent years building protections for familiar software supply chain attacks using package integrity checks, signed binaries, and dependency auditing tools. Those controls assumed developers chose dependencies consciously and URLs existed before attackers moved in. Phantom squatting and AI gateway compromises break those assumptions. LLMs now generate URLs, pick services, and even orchestrate HTTP calls on their own, and downstream systems often trust that output without independent checks. At the same time, the LiteLLM breach shows that unpinned tools inside CI pipelines can become the stepping stones for poisoning AI infrastructure itself. If you rely on AI coding assistants or gateways, you need to treat their suggestions as untrusted input, not gospel. That means building verification workflows and supply chain scanning around hallucinated dependencies before deployment, not after an incident response call. We wanted AI to write our glue code; attackers heard “please design my next attack surface.”
