EY Canada's Cybersecurity Report Found to Have Most Citations as AI Hallucinations

In the 44-page loyalty fraud report 'Points of Attack' published by EY Canada, large-scale instances of AI hallucination were discovered. According to GPTZero's analysis, 72% of the report's text was found to be AI-written.

A significant portion of the references included in the report were fabricated. The report cited well-known outlets and organizations such as BleepingComputer, Wired, Gartner, McKinsey, Forbes, and Cisco Talos, but most of the URLs returned 404 errors or led to documents that did not exist.

In particular, a market statistic of $200 billion was used with internally contradictory meanings, and the McKinsey report supposedly backing it up was also fake and did not exist. Investigation revealed that this fake citation had been 'laundered' as an error from a low-quality fintech blog flowed into a report from a major consulting firm like EY.

This case highlights the severity of the 'vibe citing' problem, in which incorrect information generated by LLMs gets embedded in professional reports, which are then in turn cited by AI tools like Claude, ChatGPT, and Perplexity, spreading the hallucinated information further.