# Web Hole: expired domains still rank in the results AI agents read

> AIR Security found expired domains still ranking in the search results AI agents read, and anyone can buy them.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Attack, Research
- **Published by:** AIR Security
- **Disclosed:** 2026-10-23
- **Affects:** Claude WebSearch, Claude WebFetch, Brave Search
- **Research by:** Eliad Mualem, Niv Hoffman, Dor Granat
- **Primary source:** https://air.security/blog-posts/web-hole
- **Page:** https://theinjection.dev/items/air-web-hole/

AIR Security reports that 36 sites still returned in AI agent search results sit on domains nobody owns, so anyone can buy one and serve instructions to the agents that fetch the page.

## What happened

AIR Security published Web Hole on October 23, 2026. Eliad Mualem, Niv Hoffman and Dor Granat sampled the sites that Claude's agent web tools return for common questions, then checked which of those domains were still registered. The counts are listed below. They name pyquestions.com and thestackoverflow.com as examples of results whose domains are free to buy.

## How it works

Search rank outlives the site that earned it. A domain can expire while the index keeps returning it for a query, so an attacker who registers it inherits a trusted position without doing any SEO work. When the agent calls WebFetch on that result, the page passes through an LLM summary into the agent's context, where text written for the agent can steer what it does next. AIR also found sites that address agents directly, sites that serve agents different content than browsers, and a GitHub repository returned as a result whose README contains malicious commands.

## Who is affected

Agents that search and fetch the open web on a user's behalf are in scope. AIR says unsupervised ones, such as personal assistants that browse on their own, are the most exposed. The post names no fixed product versions and reports no vendor response or fix.

## What to do

Vet untrusted web content before it reaches an agent's context, and treat the internet as hostile ground for agents, as AIR recommends. Where the task allows it, narrow the search surface: Anthropic's web search tool accepts allowed_domains and blocked_domains lists, and an administrator can restrict which domains it searches from the Claude Console.

## Quick facts

- **Attack type:** Search-result poisoning via expired domains
- **Queries tested:** About 2,000
- **Sites returned:** About 6,500
- **Domains free to buy:** 36, still returned as results
- **Found by:** Eliad Mualem, Niv Hoffman, Dor Granat
- **Status:** No vendor response or fix reported

## Sources

1. [AIR Research](https://air.security/blog-posts/web-hole)
2. [Web Search Tool Docs](https://platform.claude.com/docs/en/agents-and-tools/tool-use/web-search-tool)