AI hallucinations in consulting reports have reached a threshold that the market has not yet priced. A new investigation by AI-detection firm GPTZero — shared exclusively with Sherwood News — found that 60% of the references in a December 2025 EY advisory report on loyalty program cybersecurity appear to be hallucinated. That includes broken links to nonexistent Forbes articles, fabricated WIRED stories, and a McKinsey report that GPTZero says does not exist.

The market narrative frames hallucinations as a product reliability problem — something to be solved by better models, tighter guardrails, or improved vendor benchmarks. That framing is wrong. The EY case reveals something structurally more dangerous: when a Big Four consulting firm publishes hallucinated research under its brand name, the contamination does not stop at the report. It gets syndicated to 60-plus news outlets, absorbed by AI platforms as authoritative data, and recycled into the enterprise intelligence stack that PE investors, SaaS buyers, and enterprise CTOs use to make decisions.

The due diligence gap is not just about AI tools inside the deal workflow. It is about the quality of the market intelligence feeding into your entire deal thesis — and whether the research you are relying on was built on facts that do not exist.

What GPTZero Found — And Why It Matters

Figure 1: The Hallucination Gap — Vendor benchmark claims (0.9%) vs. real-world hallucination rates in consulting deliverables and complex legal tasks. Sources: Vectara HHEM Leaderboard; GPTZero Investigation; Stanford Law AI Study; DevelopmentCorporate.com.

EY’s 44-page report, titled “Points of Attack: Uncovering Cyber Threats and Fraud in Loyalty Systems,” reads like a standard advisory document. It cites recognizable sources. It makes specific, quantified claims. On page 4, it describes the global loyalty program economy as a $200 billion business and states that 30–50% of loyalty points are never redeemed — a fact attributed to McKinsey and sourced to a “Loyalty Economics Report” that, according to GPTZero’s investigation, does not appear to exist.

The Forbes article linked as another source — purportedly titled “The $200 Billion Loyalty Economy” and attributed to customer experience writer Blake Morgan — returns a 404 error. The Wayback Machine shows no record of that URL ever being indexed. A linked WIRED article on “AI Voice Deepfakes Targeting Call Centers” also generates a 404. A CyberNews citation follows the same pattern.

In total, GPTZero’s investigation alleges that 60% of the references in the EY report are hallucinated. GPTZero CEO Edward Tian — a former Bellingcat journalist and Princeton researcher — called it “one of the most egregious reports” out of more than 3,000 consulting PDFs his firm has scraped and analyzed. EY did not respond to multiple requests for comment.

This is not an isolated incident. GPTZero has identified six consulting reports to date with significant hallucination problems. Deloitte Australia faced the same scrutiny — 19 hallucinations identified in a single report, first flagged by University of Sydney academic Christopher Rudge. Deloitte acknowledged the AI usage and offered a partial refund to the Australian government. Major law firm Sullivan & Cromwell acknowledged hallucinations in a filing submitted to a federal bankruptcy court, citing failures to follow the firm’s internal AI policies.

The pattern is consistent: AI is being used in high-stakes professional deliverables without the verification infrastructure to catch fabricated outputs before publication.

The Contamination Cascade Nobody Is Modeling

Figure 2: The Contamination Cascade — How hallucinated consulting reports propagate from Big Four publications through news syndication into AI platform training data and enterprise decision-making. Sources: GPTZero Investigation; Sherwood News; DevelopmentCorporate.com.

Here is the piece of this story that should concern every PE investor and enterprise buyer — and that no current due diligence framework addresses.

The EY loyalty report was referenced in a Canberra Times article. That article was syndicated to more than 60 newspapers across Australia. The hallucinated statistics — the $200 billion loyalty economy figure, the 30–50% unredeemed points claim — are now embedded in dozens of news articles treated by AI platforms as credible source material.

GPTZero found that the hallucinated data from the EY report has already been absorbed by AI tools including ChatGPT, Claude, and Perplexity, and is being cited back as a reputable source. This is not a theoretical contamination risk. It has already occurred.

Sandra Wachter, professor of technology and regulation at the Oxford Internet Institute, frames the structural problem clearly: AI does not go back to a well-curated library to help you find an answer to your question. It generates outputs that are designed to be persuasive — not verified. When a Big Four brand name is attached to a document full of fabricated citations, the brand authority does the work that verification never performed.

Tian calls one mechanism “secondhand hallucinations” — where an AI tool hallucinating research actually picks up a fictional reference that already appeared on a third-party website, compounding the original error. The EY report appears to have sourced at least one McKinsey attribution from a FinancialIT.net blog post that itself cited a report that does not exist.

The cascade has a self-reinforcing structure: hallucinated consulting report → branded publication → news syndication → AI platform ingestion → enterprise decision-making → new AI-assisted research citing the hallucinated source. As DevelopmentCorporate has documented in our analysis of AI hallucinated citations as a 110,000-publication problem, the consulting channel is now among the highest-volume vectors for contamination, precisely because Big Four brand authority suppresses the skepticism that would otherwise trigger a citation check.

Why This Keeps Happening — And Why It Won’t Self-Correct

The conventional explanation is that consulting firms need better QA processes. That is true, but it misses the deeper structural problem. A recent preprint from researchers at the University of Singapore found that hallucinations are not a configuration error — they are an architectural property of large language models. Even with perfect training data and robust guardrails, LLMs will fabricate information because of how they generate outputs. The model is not retrieving facts from a verified database. It is constructing plausible language sequences — and plausible is not the same as accurate.

As Wachter put it: “It’s not like a calculator you can trust where the rules are clear and where the answer is always correct. It’s more like a broken clock that is correct twice a day, but very often, is just not.”

The consulting sector faces a specific vulnerability that amplifies this architectural limitation. As DevelopmentCorporate’s analysis of the Expert Trap documents, expertise amplifies rather than reduces hallucination risk in high-stakes workflows. Senior consultants reviewing AI-generated research apply pattern recognition rather than source verification. When an output sounds right — when the $200 billion loyalty market figure aligns with prior industry intuitions — the cognitive cost of checking whether the Forbes article actually exists is perceived as low.

MIT research published in 2025 adds a critical data point: when AI models hallucinate, they are 34% more likely to use confident, definitive language. The model’s confidence is inversely correlated with its accuracy. A senior consultant trained to recognize confident expert language as a signal of reliability is exactly the professional most likely to approve a hallucinated output without checking its sources.

Tian is explicit about where this trajectory leads: “The use of this technology is getting ahead of processes like hallucination detection and quality checks.” As DevelopmentCorporate’s analysis of court-documented AI hallucinations found, incident rates are accelerating, not stabilizing, even as awareness increases.

The M&A Due Diligence Blind Spot

Figure 3: The Business Cost of AI Hallucinations in Enterprise Settings. Sources: AllAboutAI Hallucination Statistics 2025–2026; Deloitte Global AI Survey 2025; Forrester Research; Charlotin AI Hallucination Database; DevelopmentCorporate.com.

Standard M&A due diligence treats third-party research as authoritative unless it contains obvious red flags. A hallucinated citation does not announce itself. It appears in a footnote with a credible-sounding title and a URL that returns a 404 — something no one checks during a compressed deal timeline.

DevelopmentCorporate’s AI Hallucination Due Diligence Framework identifies two distinct risk channels. The first is process risk — hallucinations introduced by AI tools used in the deal workflow itself. The second is product risk — targets whose AI-enabled products carry embedded hallucination liabilities that suppress NRR and create customer trust exposure. The EY case adds a third channel that current frameworks do not address: market intelligence contamination.

Consider the downstream implications. A PE firm sizing the travel loyalty market to evaluate a cybersecurity SaaS target might cite EY’s $200 billion figure without knowing it is hallucinated. That figure shapes the total addressable market calculation, which influences the revenue multiple paid, which anchors the exit thesis. The hallucination is not in the deal workflow. It is in the foundations under the deal thesis.

As DevelopmentCorporate’s coverage of AI hallucinations as an M&A time bomb documents, the gap between vendor benchmark claims (sub-1% hallucination rates) and production-environment reality (69–88% on complex multi-document tasks) is the defining risk variable in enterprise AI deployment. That gap now extends to the consulting research that deal teams treat as ground truth.

What Each Stakeholder Should Do Now

🔵 For PE/VC Investors

• Add citation verification to diligence checklists — audit primary quantitative claims in any consulting research used to support market sizing or competitive positioning.

• Ask acquisition targets which AI tools were used to prepare investor materials, CIMs, and market analysis — and whether source verification workflows are documented.

• Treat consulting brand authority as a starting point, not an endpoint. A Big Four logo does not guarantee that the underlying citations were human-verified.

• Model market intelligence contamination as a third hallucination risk channel, separate from deal workflow risk and product risk.

🟡 For SaaS Founders Preparing for Exit

• Run a citation audit on your investor deck, sales collateral, and market analysis before your exit process begins. Verify that every TAM figure and competitive claim links to a source that exists and says what you claim.

• Use tools like GPTZero or Grounded AI to automate citation verification on AI-assisted deliverables before publication.

• The Deloitte Australia case is instructive: a partial refund to a government client is a small cost compared to the reputational impact of a hallucination disclosure during an M&A process.

• If your team produces customer-facing research or thought leadership with AI assistance, implement a verification checkpoint as a required workflow step.

🟢 For Enterprise CTOs and CPOs

• Treat third-party consulting research the way you would treat a vendor security audit: as a claim requiring independent verification of methodology and sources.

• Build a verification layer into how your organization consumes external research. The EY report contamination into ChatGPT, Claude, and Perplexity means that AI-assisted research may already be citing hallucinated consulting data as fact.

• For internal AI deployments producing analysis or market research, make citation verification a mandatory workflow step before finalization.

• Evaluate vendors of AI-assisted research and analysis tools on their hallucination detection and citation verification capabilities — not just their claimed accuracy benchmarks.

Truth Verification Is Becoming a Competitive Moat

Wachter offered the clearest framing of where this is heading: “I think we have to say goodbye to the idea that we can quickly decide if something is truthful or not. If you want to figure out what is truthful, you probably need more time than you used to, and there are no perfect or completely trustworthy sources anymore, because everything can be fake now.”

That is not a counsel of despair. It is a competitive moat specification.

Organizations that build systematic verification infrastructure — citation auditing, source integrity workflows, hallucination detection in published deliverables — will operate from a higher-quality intelligence base than those that treat AI-generated outputs as authoritative. In M&A, where deal thesis quality is the primary competitive variable, that gap compounds directly into returns.

The EY case is a signal, not an outlier. GPTZero has identified six reports with significant problems from a sample of 3,000 consulting PDFs — and explicitly states this represents the tip of the iceberg. Tian: “We certainly do not think it is an isolated case. And there is no evidence yet this problem is self-correcting or getting better.”

The firms that move first on verification infrastructure — in their own deliverables and in how they consume others’ — will hold a material intelligence advantage within 18 months. The firms that continue treating consulting brand authority as a proxy for factual accuracy will discover, probably during a diligence process, that the gap between a Big Four logo and a verified citation is wider than they assumed.

For a deeper analysis of how AI hallucination risk maps to your specific transaction, portfolio company, or enterprise AI deployment, contact DevelopmentCorporate LLC.

Sources

Sherwood News / GPTZero Investigation (May 2026) · EY “Points of Attack” Report (December 2025) · GPTZero Deloitte Australia Analysis · Financial Times — Sullivan & Cromwell Hallucination Disclosure · University of Singapore LLM Hallucination Preprint (arXiv:2401.11817) · Vectara HHEM Leaderboard · AllAboutAI Hallucination Statistics 2025–2026 · Deloitte Global AI Survey 2025 · Forrester Research · MIT Confidence Paradox Study (January 2025) · Charlotin AI Hallucination Database · DevelopmentCorporate.com analysis