EY Canada published a cybersecurity report and most citations were hallucinated
231 points by smartmic 3 hours ago | 100 comments

ilamont 3 hours ago
The problem we're seeing across many professions is AI output is not getting vetted by knowledgeable people, whether it's an experienced analyst, senior engineer, expert attorney, or the resident physician. At best they skim, at worst they don't even see it at all before it's published, pushed to production, distributed to clients, or submitted to the court.

In many cases the skills are available in house to do the necessary vetting, but these people are already overwhelmed with their existing day to day.

Anyone remember that item a few months back about Amazon now having senior engineers vet generative AI output (https://news.ycombinator.com/item?id=47323017)? I had to LOL when I read that. These folks are already slammed. And the idea that Amazon would allow human bottlenecks to multiply across projects and underlying infrastructure development is ridiculous.

reply
_puk 3 hours ago
Part of the problem: you get given a complete document to review after it's been fully baked.

I'm pushing the need for basic engineering principles across whole organisations.

You wouldn't give an engineer 1000 lines of code to review without the original spec of what you're trying to achieve for context (at a minimum, ideally the reviewer was in the room when the work was introduced, and has full context).

So, these docs, they're given as an all or nothing.

Do you push back on the 39th metric that is defined to the utmost detail? Or just resign yourself to the fact that it is what it is?

A one (6 is the goto if we're talking Amazon?!) pager.. "this is what I am proposing" at least gives the skeleton of the idea to push back at the general shape of the idea, refine it, before all the emotional investment of your precious report being complete.

Y'know.. the traditional product running through the spec in a SCRUM* environment.. the engineers doing proper code reviews..

* Yes SCRUM is dead, but that's another thing.

reply
JoshTriplett 3 hours ago
> Part of the problem: you get given a complete document to review after it's been fully baked.

Not fully baked, worse: made to sound confidently correct, orthogonal to its actual correctness.

reply
bradleyankrom 2 hours ago
Like the fake food they make for commercials. Looks great on TV.
reply
s0rce 2 hours ago
I've had this situation and basically just had to throw out stuff that was written because its completely terrible/wrong. Either start again or just give up.
reply
ChrisMarshallNY 3 hours ago
> AI output is not getting vetted by knowledgeable people

You mean the people they fired and demoralized?

One of the things that "great [wo]men" like about "vibe-coding" (and that includes blindly producing non-code product), is that they, and they alone can now do what used to require the painful process of "passing it to context experts."

Now, the LLM is a "built-in context expert," and they don't need to vet the output anymore.

reply
ilamont 2 hours ago
> Now, the LLM is a "built-in context expert," and they don't need to vet the output anymore.

Serious orgs are going to have to figure out the human layer. It will be needed, no matter how 'hallucination-free' the AI tooling gets. AI will still have some spectacularly bad fuck ups or even worse time bombs that get embedded in a system and don't become apparent until months or years later.

A lot of this will be dumped on existing staff with predictable results as they don't have the bandwidth to do it right. I can envision "output compliance" or "AI QA" becoming dedicated positions at many orgs. It's clearly needed.

reply
asdff 43 minutes ago
Let's be honest, how many orgs are really serious? Playing the game of the day for shareholder appeasement is taken far more seriously than whatever the domain experts might think.
reply
anal_reactor 44 minutes ago
> It's clearly needed.

Once the hallucination rate drops below error rate of human workers, it won't be needed anymore.

reply
cassianoleal 19 minutes ago
Once the hallucination rate drops, the remaining LLM failures will become increasingly harder to spot.
reply
hansmayer 44 minutes ago
[dead]
reply
mminer237 2 hours ago
As an attorney, I feel like vetting AI output takes longer than just doing it from scratch, let alone versus just using a traditional form.

With AI, I have to read through everything, often explain why it's wrong, and then rewrite everything anyways. I mean, I get way more billables, but I think it's symptomatic of how AI loses its advantage of being quick and accessible to those who don't understand the subject matter.

reply
claaams 7 minutes ago
This is the realization I had too. We had a manager update a policy at our org. He just shit it out through AI. It had tons of mistakes, people who read it had questions. Not only did it have mistakes it was causing people to do things in a way that added a manual step when an automatic process existed. Then the engineer VP commented on it asking the original author what its about who then had to bring it back up to the attention of the manager who made the first change.

It wasted many people's time, probably an order of magnitude of time wasted (and money) than if the initial person put a modicum of effort into making it right in the first place. Instead they hand it off to their life partner claude and just assume its good enough.

It's to the point where I am feeling insulted when I get ai slop like this from people. If I am expected to perform at a high level then I expect that at the very minimum the slop throwers will proof read their slop.

reply
CamperBob2 4 minutes ago
You can also feed the document or source file to another frontier-level model, ideally two others, and tell it to vet it aggressively. The goal is to goad the models into erring on the side of false positive findings rather than potentially missing true positives.

I find that if Gemini Pro agrees with Claude Opus 4.8 and GPT 5.5 on something, it's almost certainly correct at a level where I wouldn't be likely to catch any errors myself.

reply
smelendez 2 hours ago
Fact-checking and editing a mediocre piece of writing be way harder than writing from scratch. Proving that something isn’t true or can’t be substantiated is hard work, and so is arguing that a word choice is subtly inappropriate.

And making a ton of corrections to a document everyone was hoping was ready to go is never fun politically.

reply
__turbobrew__ 60 minutes ago
I have experienced this several times lately when writing software with claude/codex. Sometimes vetting and steering the agent takes longer than it would have taken me if done manually. Sure you can just decide not to vet the output and go into full vibecode, but agents tend to do a lot of dumb things (such as not deleting unused private methods or having temporary variables that are not needed).

In my experience the most effective work pattern for me is using agents to perform research and feedback on high level design, then I write the code manually, then I ask the agent to review the code for potential bugs/issues and fix those. The agents have a much easier time making small changes once the design is 90% there without going fully off the rails and generating slop.

I am working on writing skills to make the agent better but it is a bit painstaking. For example I had to write this inside of a skill because sometimes the agent would just stub out methods and leave TODOs: “always fully complete the requested task before finishing edits unless input is needed”.

reply
VTuberTTV 44 minutes ago
[dead]
reply
csomar 2 hours ago
It's not really any different in programming. Like if you have a well structured code and want to do a clear refactoring across it and you know what to expect, it can speed things up. But if it's generating any significant (and relatively complex) new code, you have to go through the whole thing manually again and then you find out you have to fix way to many things and get bogged down in different paths the AI didn't do correctly.

Of course, it's pretty much impossible to hear a dissenting point of view today and everyone is going crazy on these drugs. I might be hilariously wrong but I think this is the best time to start a software company.

reply
2fff 36 minutes ago
Youre not wrong I believe.

I think its the perfect time to be contrarian - think about it. If youre wrong - So what? The world will have changed for everyone in the field. If you are right? You stand to be positioned to win big financially whilst everyone elses brain is rotting away.

reply
Izikiel43 2 hours ago
How do you use it, as in, hey, write a doc about this, or do you iterate more like a conversation?

I do the second approach for coding with smallish steps and the output is fine

reply
SV_BubbleTime 2 hours ago
I’m against “vibe” anything important, but the fundamental flaw with this reasoning is that unknown unknowns exist.

I can’t cite “from scratch” for something outside of my knowledge but I side LLM training or assisted search.

reply
fzeindl 2 hours ago
> In many cases the skills are available in house to do the necessary vetting, but these people are already overwhelmed with their existing day to day.

This is an interesting topic. We treat vetting output the same as doing the work ourselves, but that is not the case.

Doing the work is not the same as reviewing work done by others.

I have heard reports of software engineering companies that have gone full agentic. Their seniors only review stuff written by LLMs and it burns them out, because they have to switch context constantly.

I find this interesting because part of being a senior developer is that you are experienced enough that you won‘t make grave mistakes anymore. This is the case in many professions: you are relied upon to not make grave mistakes.

But those same people are now swamped with stuff that they are not able to review, so they will let a grave mistake slip through at some point.

So they really can‘t trust themselves anymore?

reply
kloop 2 hours ago
> The problem we're seeing across many professions is AI output is not getting vetted by knowledgeable people

The problem is that output sometimes take longer to verify than to create in the first place.

That turns AI into a deeply negative ROI system for many applications.

reply
Ekaros 2 hours ago
Also wondering on this whole review process with someone who wrote it with AI. Even if you comment and noted all issues. Do they have skills or willingness to correctly correct it all? And how many times would you need to keep the loop going for error free outcome? Is there even enough calendar time for that?
reply
wrs 2 hours ago
But wait, if knowledgeable people have to vet the output, the process will not be 10X faster and you will not be able to fire the knowledgeable people. Therefore, your objection makes no sense. QED.
reply
DrewADesign 2 hours ago
> The problem we're seeing across many professions is AI output is not getting vetted by knowledgeable people, whether it's an experienced analyst, senior engineer, expert attorney, or the resident physician.

Yeah probably not for the same reason I left VFX rather than have a lifetime of completely disregarding my own generative creativity and cleaning up LLM-generated bullshit. Fuck that. Double-fuck creating ‘content’ to train the models.

In code, LLMs automate away a lot of the drudgery. I wasn’t sad to avoid spending a couple hours looking up the usage patterns and idioms for some ported library, or do some rote task that didn’t make the project significantly better. In most other jobs, they automate away the only fun part and leave humans with all of the drudgery.

The tech industry has always been arrogant to some extent, but assuming the world of talented professional knowledge workers and creatives would be content to professionally proofread, apply lipstick to pigs, and polish turds is a whole new level of out-of-touch. I’d rather live out of my car and dig through the garbage for bottles with deposits.

reply
ChrisLTD 3 hours ago
> the idea that Amazon would allow human bottlenecks to appear across projects and underlying infrastructure is ridiculous.

Why?

reply
SoftTalker 3 hours ago
Amazon is fairly well known to ruthlessly optimize every process.

So if they're having humans proofread what the AI produces, they must have found that to be necessary.

reply
watwut 2 hours ago
It is harder to check everything then to create a thing without lying in the first place.
reply
xienze 3 hours ago
> In many cases the skills are available in house to do the necessary vetting, but these people are already overwhelmed with their existing day to day.

I think a lot of the time it's just pure laziness. AI gives people a magical "do all the work for me" button and it can bring out the worst in them.

reply
canyp 2 hours ago
I constantly battle this dichotomy where I care about the work I do but I also cannot possibly care about the corporate model, given 0 ownership of flawed processes across the org and the looming layoff that'll happen any day now.

Some people are given the button and really do not care.

reply
fabian2k 3 hours ago
If the main job is putting out a report, starting with AI is wrong in any case. What's the value of an AI-generated report, even if experts fix the biggest issues with it? Maybe this kind of report didn't have all that much value before, I don't know. But starting with AI just makes sure it's generic drivel.
reply
cwillu 2 hours ago
Is there any source with just the plain text? The css styling is headache inducing and reader mode doesn't work or has been defeated.
reply
_tk_ 2 hours ago
Same goes for lockdown mode on iOS.
reply
le-mark 2 hours ago
The real comedy is seeing this garbage come down from senior management, clumsy prompting, hallucinated garbage that’s all fluff and zero actionable information, zero real informed analysis. “See this analysis of our support issues from jira, we must fix these top three problems!!!” And it’s all the stuff everyone has known for years but management has refused to give anyone the authority to fix anything. I’ve seen this more than twice now; needs a name. Garbagemaxxing?
reply
raro11 3 hours ago
What a horrible page to navigate
reply
snailmailman 3 hours ago
On mobile, It’s hijacking my scroll in such a way that I literally cannot move further down the page. And “reader mode” is only showing me the first paragraph or so.

I’ll have to try again later on desktop. The content looks interesting but it’s literally impossible to read. I cannot get past the section that introduces Ernst and Young.

reply
1000100_1000101 3 hours ago
On desktop it keeps adding forced pauses to scrolling, of varying sizes, and you need to scroll down a between 1 and 10 pages worth to begin scrolling again.

It might "work" just fine on mobile (or not) but you may have stopped trying before reaching the point of re-scrolling, because it's insane.

reply
snailmailman 2 hours ago
I eventually managed to get far enough into the article that I thought I saw the main stat - the stat that 26% of the citations were hallucinated. Then the scroll threw me back to the top again and I gave up entirely on reading from my phone.

Coming back later on desktop, I see that the percentage keeps climbing the further you manage to make it down the page. The real stat is 60% of the citations were hallucinated.

reply
lelandfe 3 hours ago
I recommend just clicking and dragging the actual scrollbar on desktop for this one. Wild
reply
bokkies 3 hours ago
Feels like my scroll is hallucinating
reply
nntwozz 2 hours ago
This is a whole 'nother level of user hostility, never before have I seen anything like it.
reply
canyp 2 hours ago
Non-linear feedback with literal stalls, yikes.

Some people should not be allowed to make a website.

reply
umpalumpaaa 3 hours ago
My iPhone automatically enabled reader mode - I disabled it to see what you are referring to and I agree…
reply
IshKebab 2 hours ago
They put a lot of effort in to make it that bad!
reply
kavok 3 hours ago
Very difficult to use on mobile.
reply
bbddg 3 hours ago
I'm usually annoyed by people complaining about scroll hijacking on HN but this site was a new level of bad.
reply
csomar 2 hours ago
I've stopped reading because of it. I can't scroll. Was this thing vibe-coded? Funny they are picking on EY for not reading their reports but it looks like they didn't test their website.
reply
aneutron 2 hours ago
Fix your website. Drop the shitty Javascript animations. Jesus these things were solved in 2014 with D3JS and jQuery.
reply
rao-v 3 hours ago
What’s strange about how things have developed is that this report 12-18 months ago would have been a massive scandal and would have caused durable brand damage.

Now nobody will remember or notice.

reply
jonwinstanley 3 hours ago
Did someone hallucinate how scrolling is supposed to work on a web page?
reply
mapontosevenths 3 hours ago
EY has been quietly laying people off for the last year solid.

It's unsurprising that trying to do more with less results in lower quality.

reply
onlyrealcuzzo 2 hours ago
The interesting thing is...

There may be a lot of demand for do-nothing services.

A lot of corporate work is just do-nothing box-ticking.

Boss: get me a report about X, so I can give that report to my boss who won't read it.

You: E&Y, please get me a report. Here's $200k.

reply
bombcar 2 hours ago
This underlying much of the non-coding AI revolution (and some of the coding perhaps) - so much corporate activity is write-only and never read.
reply
fragmede 2 hours ago
The trope about external consultants is that your VP brings them in to review the company, and they talk to everybody and write a report on how to improve the business, and the report says exactly what you've been telling your VP but they've been ignoring you.
reply
2fff 33 minutes ago
You are closer to the truth :)

they are not simply paid to do nothing. They are paid to do dirty work.

reply
FearNotDaniel 2 hours ago
Off topic but: the scroll mechanism on mobile is so horribly irritating and unpredictable that I just can’t be bothered fighting against it to read what sounds like at least a mildly interesting article.
reply
dragonfax 50 minutes ago
No, it's like that on desktop too.
reply
cmiles8 3 hours ago
This sort of thing is a complete embarrassment to a firm like EY, where people are paying them a lot of money for advice. They’ve basically demonstrated that their market leading research is just someone asking questions to ChatGPT.

If you ever needed evidence to not buy “advice” from such outfits, this is exhibit one.

Hopefully they at least fired the partner that published this steaming pile of AI slop.

reply
jimnotgym 3 hours ago
The Big Four have become a shadow of their former selves. They have become so risk averse that their advice is already incredibly generic and non-actionable.

I think their audit work is in a downwards spiral. Audit has become so competitive that they are struggling to find ways to make it cheaper. They have become slaves to reducing the hours booked, and the rate of those hours. To do this they substitute less experienced people all the time. You used to be able to chat with your partner about an issue you have coming up, now you get their assistant if you are lucky. By chasing 'efficiency' they have lost their value-add. Now the first time the partner has looked at your file is right before the clearance meeting, and they spot issues that should have been picked up earlier and tested on the day you should be signing. So you end up doing it all again. I'm trying to coin a term for the inneficiency caused by chasing efficiency.

reply
busterarm 2 hours ago
I worked at a top 5 hedge fund in the early 2000s. They had a large team of E&Y auditors onsite at all times that I worked somewhat closely with.

Some things stuck out at me: - They were all in their early 20s. - They were all incredibly checked out. Honestly they still seem like an outlier to me decades later. - They partied hard. Yes, with drugs. - Most of them were in rotating intimate relationships with each other and unusually open about it. Office scuttlebutt was literally "who is fucking who this week". - They seemed busy for maybe two or three weeks out of the entire year and then it was long stretches of Minesweeper/Solitaire.

I filed this away in my head as "provides no value" and that was decades ago. If the industry itself is worse off today I can't imagine how much worse it actually is from my experience.

reply
slater 2 hours ago
> I'm trying to coin a term for the inneficiency caused by chasing efficiency.

"don't let the perfect be the enemy of the good" ?

reply
bobnamob 2 hours ago
“Penny wise but pound foolish”?
reply
mrgoldenbrown 2 hours ago
...>term for the inneficiency caused by chasing efficiency.

Penny wise, pound foolish? Measure twice cut once?

reply
ralph84 3 hours ago
Executives pay them a lot of money to launder blame. If a project fails after consulting EY, well, what can you do. If a project fails without consulting anyone externally, it's obviously a failure of the executive.
reply
elmomle 3 hours ago
Exactly--they're paid a lot of money for their reputation, which is valuable in offering cover for politically difficult decisions. This was certainly net-negative for E&Y's reputation.
reply
tipsytoad 42 minutes ago
Who designs a website like this?
reply
nilirl 3 hours ago
Site is gross to scroll on mobile
reply
cwillu 2 hours ago
It's gross to scroll on desktop as well.
reply
AshamedBadger56 2 hours ago
It's gross to scroll on tablets as well.
reply
henry2023 2 hours ago
I think it’s important to note that EY report’s overall quality has not been affected by GenAI.
reply
0898 2 hours ago
I did some ghost writing for EY. I wrote cheat sheets about international tax transfer pricing, mining and metals, and life sciences for its then CEO Mark Weinberger.

I had no experience and knew absolutely zero about any of those sectors.

reply
galaxyLogic 3 hours ago
I don't quite get it why they can't take another LLM and vet the output of the first with the second one. Surely they would not have the same hallucinations and would be able to detect hallucinations of the earlier LLM. Maybe it would cost too much in terms of tokens?

I don't know but I would expect it to be realtively easy for an LLM to detect "hallucinations".

reply
mindcrime 2 hours ago
> I don't quite get it why they can't take another LLM and vet the output of the first with the second one.

Yes, this technique and its variations[1][2] "work" but it's still not 100% perfect. And it's not as widely used it might be because, among other reason:

a. it takes longer to implement

b. it costs more (more tokens spread across multiple llm calls)

c. higher latency (getting an answer takes longer due to multiple llm calls involved)

d. the final answer is probabilistically more likely to be correct, but is still not guaranteed to be error free, so you can never fully escape the need for Human in the Loop.

[1]: https://en.wikipedia.org/wiki/LLM-as-a-Judge

[2]: https://github.com/karpathy/llm-council

reply
operatingthetan 3 hours ago
>I don't quite get it why they can't take another LLM and vet the output of the first with the seond one.

I think this may be part of the problem. The actual humans creating the report don't have the expertise to know which one to trust. At least that was what consulting was like in my experience at a similar firm.

reply
TZubiri 3 hours ago
Because they used LLMs to do the work. What you are suggesting is to use the LLMs to create more work, which is counter to the shortcut they were trying to take.
reply
galaxyLogic 2 hours ago
Good point with some irony. Thye don't want to do a better job they want to do an easier job. But a company like E&Y should realize shortcuts like these don't work. And their customers are paying them.
reply
voxl 3 hours ago
[flagged]
reply
sourcecodeplz 2 hours ago
Was the title updated? from "ernst & young" to EY Canada. Why?
reply
smartmic 40 minutes ago
Not by me, but by the mods. They also changed from "full of hallucinations" to "and most citations were hallucinated". Maybe a rep from "EY Global" filed a complain ;)
reply
rescripting 2 hours ago
They changed their name to from Ernst & Young to EY in 2013.
reply
s0rce 2 hours ago
Scrolling this page is terribly awkward.
reply
biosboiii 2 hours ago
I guess this is a great report, but the parallax landing page shenanigans disrupt my reading flow, you cannot easily scroll back to get a overview of the key facts, so I stopped.
reply
Our_Benefactors 3 hours ago
Holy horrible UI
reply
throwrioawfo 2 hours ago
You're not actually meant to _read_ these reports.
reply
galaxyLogic 3 hours ago
I don't quite get it why they can't take another LLM and vet the output of the first with the second one. Surely they would not have the same hallucinations and would be able to detect hallucinations of the earlier LLM. Maybe it would cost too much in terms of tokens?

I don't know but I would expect it to be relatively easy for an LLM to detect "hallucinations".

reply
gdulli 2 hours ago
"Why don't they make the whole plane out of the black box???"
reply
zb3 2 hours ago
Stop messing with the scroll, I thought there was something wrong with my mouse wheel. Why are you doing this?
reply
zelphirkalt 2 hours ago
I wish we could just stop destroying people's jobs and lives using AI. The statistics I have heard quoted say, that merely 25% of the people actually like their job. Meaning they like doing what they do for its own sake, not because it gets them money, which they desperately need to live. I get it, most people don't want to do the work. But can we stop ruining the jobs of people, who are actually dedicated to their job and would like to keep doing their job properly?

But I guess since EY is a CYA hedge anyway, no one really cares about whether the reports are hallucinations or not. Someone high up spent money on EY, so that they can justify some decision and won't be held responsible that much, when it turns out the decision was shit. All that matters to them is, that it has the appearance of something genuine and then they can base the decision on what they receive from EY, which better be what they already wanted to hear/read anyway.

reply
krapp 2 hours ago
>The statistics I have heard quoted say, that merely 25% of the people actually like their job. Meaning they like doing what they do for its own sake, not because it gets them money, which they desperately need to live.

Even people who like their jobs work because they need money to live.

reply
zelphirkalt 26 minutes ago
My point is, that people who want to do their job properly are less likely to sling AI slop and be found out to do that, and that I wish we could stop destroying their jobs or lives, to chase stakeholder wet dreams of the companies they invested in letting go almost everyone.
reply
chaidhat 3 hours ago
Maybe they should stop pushing these bankers to do 48 hour shifts…
reply
331c8c71 3 hours ago
These are not bankers, but the culture is still bonkers
reply
mentalgear 3 hours ago
This proves (again) one think for sure: The "Big x" Consulting Firms were always BS - and now them generating all their work themselves using LLMs just profs that their 'clients' can just skip their Million Dollar fees and just ask the LLM directly.
reply
meibo 3 hours ago
Wow, your mom lets you have TWO scrollbars?
reply
yieldcrv 2 hours ago
> In late 2025, EY Canada published

okay that makes me feel better, I think January's frontier models and beyond are better at this

but check your sources folks

reply
themafia 2 hours ago
Title changed to remove "Earnst & Young". Why? It seems deferential to an entity that, in this case, certainly doesn't deserve it.
reply
FearNotDaniel 2 hours ago
Probably because (a) that’s not their name any more and (b) when it was, that’s not how you spell it
reply
themafia 20 minutes ago
Which is interesting because a) the site title includes it and b) I obviously made a common mistake which has nothing to do with the point at hand.
reply
wg0 2 hours ago
"All jobs would be gone next month."

~ A greedy, dishonest and unethical capitalist.

reply
tamimio 20 minutes ago
Those are who rejected you for a job you applied for.. AI amplified the dunning kruger that unfortunately real experts in their field are overlooked now, because a wall of text with numbers sounds and look professional enough.

Any person with above average knowledge on a specific topic, can tell when AI starts hallucinating and making things up, or at least introducing new problems due to complexity added rather than solving it, that’s my observation using all top tier ones too, it’s like they are designed to solve a problem regardless so they start making things up or piling workarounds, a person with no deep knowledge in that topic will just copy it all and call it a day.

Just yesterday, I asked claude 4.8 on something specific that I know the answer for, it had a long list of solutions that none were close to the real answer, when I replied with the real answer and pushed back, I got the famous quote “you are right, thanks for pushing back”.

reply
scotty79 3 hours ago
If they can't be bothered what they are putting out, do you think that before AI, what they wrote had any merit?
reply
contingencies 3 hours ago
Basically the entire consulting industry should die due to AI.

Performative executives of yesteryear that constantly need external validation and direction and operate through hive mind and groupthink are weak and will die.

I believe some of the biggest problems in today's business leaders are an inability to be open to new information, to think across traditional professional boundaries, or to ask meaningful questions.

AI simply exposes this unapologetically.

Bad management (this includes most government): up your game or get out of the way.

Sycophantic consultant firms: die.

The Economist should do an article on this.

reply
bakrisolo 2 hours ago
[flagged]
reply