The AI Trust Flaw: Why Slopsquatting, Phantom Domains, and HalluSquatting Are Identical Attacks
Slopsquatting, Phantom Domains, and HalluSquatting are new terms for an old problem: AI agents trusting their own hallucinated outputs. The industry is repeatedly rediscovering this fundamental AI trust flaw under different labels, including Slopsquatting Phantom Domains and HalluSquatting. Palo Alto Networks' Unit 42, for instance, explicitly described phantom squatting as the 'domain-version of slopsquatting,' underscoring their shared underlying vulnerability. The industry is now grappling with the consequences of giving AI agents unverified trust.
These attacks are widely recognized as AI supply chain vulnerabilities, leveraging a "late-binding" pattern where AI agents trust their own hallucinated outputs. Attackers pre-register these predictable names to serve malicious code. Beyond the new terminology, the underlying technical root cause remains consistent across all instances of Slopsquatting Phantom Domains and similar exploits.
How a Hallucination Becomes an Exploit
These attacks unfolded in a clear sequence:
In **January 2026**, **Slopsquatting** was discovered by Charlie Eriksen at Aikido Security. AI coding agents were caught attempting to install fake npm package names, such as `react-codeshift`, across 237 projects. The attack was straightforward: the AI hallucinates a package name, and the development pipeline, without verification, tries to fetch it.
In **June 2026**, **Phantom Squatting** was identified by Unit 42 at Palo Alto Networks. This time, the target was fake web domains. Research showed language models consistently inventing non-existent web addresses, with approximately 250,000 such domains available for registration by attackers. Unit 42's research queried two AI models with 685,339 questions about 913 well-known brands, generating 2.1 million links, of which 13,229 were already malicious and 250,000 were unowned phantom domains.
Attackers could register these domains and host phishing pages or malware. For instance, Unit 42 predicted on March 8, 2026, that AI models would invent a domain resembling a national postal service's online marketplace. By March 31, 2026, an attacker had registered this exact domain and deployed a phishing kit named "Montana Empire," which copied the real storefront in real-time to steal card numbers, bank-transfer details, and national ID data.
Another case involved Unit 42 flagging a hallucinated postal-service domain 51 days before an attacker registered it and used it to push a malicious Android app. This mirrors earlier 'slopsquatting' campaigns like the 'PhantomRaven campaign,' which hid malware in 126 npm packages, leading to over 86,000 installs. The threat of Slopsquatting Phantom Domains is clearly escalating.
On **July 8, 2026**, research on **HalluSquatting** was published by Tel Aviv University, Technion, and Intuit, led by Aya Spira in Ben Nassi's group, focusing on fake repositories or agent skills. The impact was substantial: attackers could take over AI agents by claiming predictable names in advance. Researchers tested this vulnerability across various agents and models, including Cursor, Windsurf, GitHub Copilot, Cline, Gemini CLI, and OpenClaw.
This research found that LLMs hallucinate identical names for repository requests up to 85% of the time, and for skill installs, it was 100% of the time. This scales further than previous attacks because the AI agent itself performs the delivery work, potentially creating botnets without traditional machine compromise.
Across all these incidents, the common thread is a single core vulnerability: AI coding agents treating hallucinated identifiers as verified commands. The system trusts a model-generated name without prior verification. This applies equally to Slopsquatting Phantom Domains and HalluSquatting.
The Late-Binding Problem
The mechanism behind these attacks is straightforward, and it's a structural flaw.
The mechanism behind these attacks is straightforward: language models generate predictable outputs, not random ones, based on probabilities. Attackers can pre-calculate these names, almost like a rainbow table for AI hallucinations. They know what fake package, domain, or skill name an LLM is likely to invent when asked a certain question or given a specific context, leading directly to vulnerabilities like Slopsquatting Phantom Domains.
Developers then build pipelines that execute commands based on LLM output without sufficient vetting. This constitutes the "late binding" security vulnerability. The AI suggests `install react-codeshift`, and the system just runs `npm install react-codeshift` without checking if `react-codeshift` is a legitimate, safe package. The same applies to domains: an AI suggests `example-postal-service.com`, and a user or another agent clicks it, assuming it's real.
This attack doesn't need stolen passwords, phishing emails, or human clicks. It relies on automated processes with permissions to fetch malicious content. It's not about a single OS target; any machine running an exposed agent is vulnerable. The risk extends deep into transitive dependencies, not just top-level packages, making Slopsquatting Phantom Domains a pervasive threat.
Why Our Old Defenses Don't Work
Our traditional security defenses often fall short here.
-
Existing Security Tools/Scanners: They fail. In **June 2026**, Trail of Bits bypassed agent skill store scanners in under an hour. These scanners operate on a reactive model, scanning for known malicious signatures or patterns. However, Slopsquatting Phantom Domains and HalluSquatting leverage *predictable* but *novel* names, which are initially benign until registered by an attacker. The scanners don't flag a name like `react-codeshift` as malicious until it's already been weaponized, by which point the damage is done.
-
SSL Certificates: They prove domain ownership, but not user intent or domain safety. A malicious phantom domain can still have a valid SSL cert. While SSL certificates verify the identity of a domain, they offer no insight into its intent. An attacker can easily obtain a valid SSL certificate for a newly registered phantom domain, making it appear legitimate to both users and automated systems.
-
DNSSEC: This prevents domain takeover, but it doesn't stop attackers from registering newly hallucinated domains that were never legitimate to begin with. Similarly, DNSSEC secures the DNS resolution process, preventing tampering with legitimate domain records. However, it does nothing to prevent the registration of entirely new, hallucinated domains that were never part of a secure DNS chain to begin with. These defenses are designed for a world where threats operate on existing infrastructure, not one where the infrastructure itself is being hallucinated into existence by AI, leading to Slopsquatting Phantom Domains.
The problem is that AI model output is increasingly treated as input, and developers, agents, and even security teams are acting on AI-generated links or names without prior verification. AI accelerates the attack timeline, shrinking the window defenders have to react.
What We Need to Do About It
Our approach must shift. Patching individual hallucinated names won't suffice; we need to fix the fundamental trust model.
Our immediate priority must be to enable pre-fetch verification in agent frameworks, a crucial first step often overlooked as it's frequently off by default. This means that before an AI agent attempts to download `npm install react-codeshift` or navigate to `example-postal-service.com`, the system must first verify the legitimacy and safety of `react-codeshift` or `example-postal-service.com` against a trusted, curated list. This proactive check is critical to prevent the execution of commands based on hallucinated outputs, effectively disarming Slopsquatting Phantom Domains before they can cause harm.
Concurrently, users must adopt a critical mindset, treating all AI model output as an unverified draft, independently verifying any AI-generated links before acting on them. Looking to the long term, we must fundamentally ensure that our pipelines never execute unvetted code or data. This requires automated vetting systems that can keep pace with AI generation speed, as human review is simply insufficient.
We need intelligent, automated systems that can rapidly assess the risk of AI-generated identifiers, cross-referencing them with known safe lists, threat intelligence feeds, and behavioral analysis. This requires a shift from reactive scanning to proactive, real-time validation, ensuring that every dependency, domain, or skill suggested by an AI is vetted before it's acted upon. A robust solution involves routing open-source dependency resolution through a governed, pre-vetted catalog, such as ActiveState's Curated Catalog. This approach verifies packages *before* agents download them, effectively making unvetted components invisible and building a unified defense against this widespread AI supply chain threat, including Slopsquatting Phantom Domains.
The advantage currently goes to whoever registers these predicted domains or packages first. We need to flip that. Defenders must pre-emptively identify and block these predictable attack vectors, which manifest as Slopsquatting Phantom Domains or similar exploits, not just react to them. Ultimately, the problem boils down to trusting unverified AI output. Until we tackle this fundamental issue, these attacks will continue to resurface under new names.
