A naming collision happens when an attacker registers a name that a trusted system assumes will not be available. The name might be a package, domain, subdomain, account, or other identifier that software uses to locate content or code. If automation later resolves that name, it can be directed to attacker-controlled resources instead of the intended trusted target.
In cyber security, naming collisions matter because they can turn ordinary reference data into an attack path. They show up in typosquatting, dependency confusion, and supply-chain abuse, including cases where documentation or agent instructions name software components that are later claimed by an outsider. Defenses include private namespaces, reserved names, allowlists, validation of external references, and human review before installation or execution. The key rule is simple: never let an untrusted name become a trusted action without verification.