You ask an AI assistant for your bank's login page, your airline's check-in site, or the download link for a piece of software. It answers instantly, with a clickable URL. You click, the page looks right, and you type in your email and password. That single sequence — ask, click, type — is becoming one of the more quietly dangerous habits of the AI era, because the assistant can be wrong about the link and have no idea it's wrong.

Two separate ways an AI can hand you a bad link

The first is simple: AI models sometimes invent URLs that don't exist, or that resolve to a domain the real company never registered. This isn't a hypothetical edge case — it's a well-documented failure mode of how these models generate text, and it gets worse for smaller or newer companies the model has less reliable training data about.

The second is the one worth taking seriously right now: attackers have started registering domains that resemble real brands specifically to catch traffic that AI systems send their way. Security researchers at ESET described this in their July 2026 roundup as "phantom squatting" — buying lookalike domains and positioning them to intercept the links that AI tools and agentic systems generate and hand to users. (welivesecurity.com) In other words, this isn't only about a model misremembering a URL — it's about attackers actively gaming the fact that people now trust AI-suggested links the way they used to trust a top Google result.

Either way, the failure looks identical from where you're sitting: a plausible link, a page that looks legitimate, and a form asking for information. The AI didn't lie to you on purpose — it doesn't have a way to verify the live web the way you can.

What to actually do before you enter anything

You don't need to distrust every AI-provided link outright. You need one habit: verify before you type, not after.

  • Don't click through — retype what you already know. If you already know the company (your bank, your airline, your utility), don't follow the AI's link at all. Open a new tab and type the domain you already trust from memory, or use a bookmark you saved yourself. This alone defeats both hallucinated and squatted links, because it removes the AI from the path entirely.
  • If you don't already know the real domain, read the link before you click it, not after. Hover over it (on desktop) or long-press it (on mobile) to see the actual destination, not just the display text. Look specifically for extra words, hyphens, swapped letters, or an unfamiliar top-level domain (.info, .cc, .top instead of the usual .com) — the classic markers of a lookalike domain.
  • Cross-check the domain with an independent search before entering anything. Search the company name in a regular search engine and compare the top organic result's domain to the one the AI gave you. If they don't match character-for-character, stop.
  • Let your password manager be the tiebreaker. If you use one, and it doesn't offer to autofill on the page the AI sent you to, treat that as a real warning sign — password managers match credentials to the exact domain they were saved for, so they won't autofill on a lookalike, even one that looks pixel-perfect to your eyes.
  • Never paste sensitive information into a page you reached via an AI-generated link on a first visit. This includes passwords, one-time codes, card numbers, and ID numbers. If the assistant is pointing you somewhere to log in or pay, navigate there yourself instead and use that session.
  • Treat this as double-important inside "agentic" AI tools — the kind that don't just suggest a link but can browse, fill forms, or take actions on your behalf. If an agent is choosing where to go and what to submit without showing you the destination first, ask it to show you the exact URL before it proceeds, or do that step manually yourself.

The underlying shift

The reason this deserves its own habit, rather than folding into ordinary phishing advice, is that the source of the bad link has changed. A phishing email arrives with obvious motive — someone is trying to trick you. An AI assistant is trying to help you, and can still steer you wrong, either through its own error or because an attacker has set a trap specifically for where AI traffic tends to land. Your guard tends to drop when the source feels helpful rather than adversarial. Keep the verification step regardless of how the link arrived: if it's going to receive a password, a payment, or a code, confirm the domain yourself before you type anything into it.