In cybersecurity, AI is playing a dual role. It’s a double-edged sword. While attackers are extensively leveraging AI tools to sophisticate their attacks, reaching an unprecedented level of speed, volume and versatility, defenders are trying to keep up with the increasing number of cyberattacks by leveraging AI as an unavoidable tool for detection and prediction.

AI is extensively used to personalize email phishing attacks, find system bugs and launch multiple targeted attacks simultaneously. AI has also lowered the barrier for beginner attackers by equipping them with tools that can be used without deep knowledge of networks and their security paradigms. For example, in the first quarter of 2026, Kali Linux - the standard penetration-testing OS - officially rolled out a workflow connecting Claude to its toolset via Anthropic’s Model Context Protocol (MCP). Using this system, the attacker—beginner or novice does not matter—is able to trigger advanced pentest applications with plain-English prompts instead of typing commands directly. Someone who couldn’t previously chain a full pentest workflow together can now get a rough version of it just by describing what they want…in plaintext!

On the other hand, AI has drastically improved threat detection and prediction.

In the field of anomaly or intrusion detection, AI has replaced static blocklists with behavioral pattern recognition. Traditional detection needed a known signature, a malware hash or a domain already reported as bad. It was always one step behind whatever hadn’t been seen yet. AI-based models instead learn what “normal” looks like for a network, and flag statistical deviations from that baseline. AI also has the ability to correlate patterns across millions of DNS queries and log events in real time, which was far from reach before the recent surge of AI.

Attackers and defenders are now in a racing competition on who will master the tool first.

In DNS security and DNS abuse particularly, Large Language Models (LLMs) have been used by attackers whether in phishing, pharming or spam attacks. However, attackers have recently exploited a persistent issue in LLMs to launch a “new” AI-based attack on the DNS: phantom squatting. Indeed, this might be one of the rare attacks that can be directly attributed to AI, not just amplified by AI.

To understand how it works, we should keep in mind that one of the common issues across all existing LLMs is, without a doubt, the hallucination problem. AI hallucination is when an AI system generates information that sounds plausible and confident but is false, fabricated, or unsupported by reliable evidence.

In a recent research paper published by Palo Alto’s Unit 42, the authors found that LLMs consistently hallucinate web domains for legitimate brands. Adversaries are currently taking full advantage of these AI-generated non-existent domain names by registering them automatically and thus inheriting all the trust a user or an AI agent places in an AI-suggested link, a phenomenon known as “phantom squatting”.

Phantom squatting is a serious DNS abuse attack that poses a “significant risk to the software supply chain,” as described in the report. This is because Phantom squatting is not related to a bug that security experts should fix. It’s rather an intrinsic architectural problem related to how LLMs generate text, where hallucination is always probable. So far, no technique has eliminated hallucination in any deployed LLM.

As the use of LLMs is spreading worldwide at an unprecedented rate, they often generate links as part of the answer to the user’s prompt. In many cases, such links are hallucinated and are not verified beforehand. The user often trusts the LLM’s output, including the generated URLs, without independent verification. This blind trust can easily lead to systematic exploitation.

Also, different LLMs are likely to generate the same hallucinated links. This is because they follow the same pattern. A model that generates the documentation link for a given brand name, such as “company.com”, might infer something like “company.com/docs”.

Another model trained independently may infer exactly the same link because it follows the same statistical pattern.

Since hallucinated links can be predicted, adversaries will register those domains before defenders react. This is no longer a theoretical risk. The PaltoAlto report confirms this vector is currently active in the wild.

A hallucinated fake domain is generally hard to catch using the traditional procedure. It does not have a reputation score. It was not deployed long enough to be flagged as bad!

The solution to this emerging issue is obviously not to tackle the hallucination problem, as this might take time and impact the entire field of generative AI. To combat phantom squatting, one should verify AI-generated URLs before using them. Any model output should be untrusted until confirmed against official sources or an allowlist. AI agents should be restricted from automatically accessing or downloading from model-generated links without independent validation. But monitoring recurring hallucinations seems to be the best approach right now, as user behavior cannot be guaranteed, nor can the AI agent!