“Poisoning the well:” EY retracts cyber report packed with AI slop

Consultancy group Ernst & Young (EY) has withdrawn a cybersecurity report after an investigation by GPTZero found that 70% of the citations within it were either fabricated or broken.

Researchers from GPTZero looked into an EY report produced last year about loyalty program safeguards and found that over 70% of references were either broken links or fabricated AI misunderstandings. GPT Zero labeled it “a collage of misattributions.”

The EY report was littered with fake citations, attributed to news outlets such as Forbes, McKinsey, Gartner, TechCrunch, and Wired.

The chatbots used were ChatGPT, Claude, and Perplexity, including “contradicting references, low-quality sources, and out-of-date statistics,” the GPTZero report reads, adding that all are “indications of AI slop.”

Hallucinations in a suit and tie

In the executive section of the EY report, a statistic claimed that the global loyalty points market was worth $200 billion.

Then, just a few pages later, the AI walked the statistic back by falsely observing that this number applies to unused or wasted loyalty rewards.

The team at GPTZero found that the $200 billion figure was attributed to a non-existent McKinsey article and, upon further investigation, discovered that the AI had scraped the data from an obscure fintech blog that was more than six months old.

There was also a bold claim that 72% of loyalty programs have experienced theft or fraud, but no supporting evidence was provided.

Tellingly, the same figure appeared later, again attributed to an obscure source, with neither reference considered in the final citation list, to boot.

EY is not the only firm to have trouble with AI-produced reports. In late 2025, fellow auditors Deloitte came under scrutiny after misfiring on a few references, most notably by mentioning a book that didn’t even exist.

GPTZero’s probe calls the mispractice “vibe citations” and affects “anyone who drinks from the digital pool by searching the web.”