EY Canada published a cybersecurity report and most citations were hallucinated
204 points
2 hours ago
| 30 comments
| gptzero.me
| HN
ilamont
1 hour ago
[-]
The problem we're seeing across many professions is AI output is not getting vetted by knowledgeable people, whether it's an experienced analyst, senior engineer, expert attorney, or the resident physician. At best they skim, at worst they don't even see it at all before it's published, pushed to production, distributed to clients, or submitted to the court.

In many cases the skills are available in house to do the necessary vetting, but these people are already overwhelmed with their existing day to day.

Anyone remember that item a few months back about Amazon now having senior engineers vet generative AI output (https://news.ycombinator.com/item?id=47323017)? I had to LOL when I read that. These folks are already slammed. And the idea that Amazon would allow human bottlenecks to multiply across projects and underlying infrastructure development is ridiculous.

reply
_puk
1 hour ago
[-]
Part of the problem: you get given a complete document to review after it's been fully baked.

I'm pushing the need for basic engineering principles across whole organisations.

You wouldn't give an engineer 1000 lines of code to review without the original spec of what you're trying to achieve for context (at a minimum, ideally the reviewer was in the room when the work was introduced, and has full context).

So, these docs, they're given as an all or nothing.

Do you push back on the 39th metric that is defined to the utmost detail? Or just resign yourself to the fact that it is what it is?

A one (6 is the goto if we're talking Amazon?!) pager.. "this is what I am proposing" at least gives the skeleton of the idea to push back at the general shape of the idea, refine it, before all the emotional investment of your precious report being complete.

Y'know.. the traditional product running through the spec in a SCRUM* environment.. the engineers doing proper code reviews..

* Yes SCRUM is dead, but that's another thing.

reply
JoshTriplett
1 hour ago
[-]
> Part of the problem: you get given a complete document to review after it's been fully baked.

Not fully baked, worse: made to sound confidently correct, orthogonally its actual correctness.

reply
bradleyankrom
1 hour ago
[-]
Like the fake food they make for commercials. Looks great on TV.
reply
s0rce
11 minutes ago
[-]
I've had this situation and basically just had to throw out stuff that was written because its completely terrible/wrong. Either start again or just give up.
reply
ChrisMarshallNY
1 hour ago
[-]
> AI output is not getting vetted by knowledgeable people

You mean the people they fired and demoralized?

One of the things that "great [wo]men" like about "vibe-coding" (and that includes blindly producing non-code product), is that they, and they alone can now do what used to require the painful process of "passing it to context experts."

Now, the LLM is a "built-in context expert," and they don't need to vet the output anymore.

reply
ilamont
1 hour ago
[-]
> Now, the LLM is a "built-in context expert," and they don't need to vet the output anymore.

Serious orgs are going to have to figure out the human layer. It will be needed, no matter how 'hallucination-free' the AI tooling gets. AI will still have some spectacularly bad fuck ups or even worse time bombs that get embedded in a system and don't become apparent until months or years later.

A lot of this will be dumped on existing staff with predictable results as they don't have the bandwidth to do it right. I can envision "output compliance" or "AI QA" becoming dedicated positions at many orgs. It's clearly needed.

reply
fzeindl
19 minutes ago
[-]
> In many cases the skills are available in house to do the necessary vetting, but these people are already overwhelmed with their existing day to day.

This is an interesting topic. We treat vetting output the same as doing the work ourselves, but that is not the case.

Doing the work is not the same as reviewing work done by others.

I have heard reports of software engineering companies that have gone full agentic. Their seniors only review stuff written by LLMs and it burns them out, because they have to switch context constantly.

I find this interesting because part of being a senior developer is that you are experienced enough that you won‘t make grave mistakes anymore. This is the case in many professions: you are relied upon to not make grave mistakes.

But those same people are now swamped with stuff that they are not able to review, so they will let a grave mistake slip through at some point.

So they really can‘t trust themselves anymore?

reply
mminer237
1 hour ago
[-]
As an attorney, I feel like vetting AI output takes longer than just doing it from scratch, let alone versus just using a traditional form.

With AI, I have to read through everything, often explain why it's wrong, and then rewrite everything anyways. I mean, I get way more billables, but I think it's symptomatic of how AI loses its advantage of being quick and accessible to those who don't understand the subject matter.

reply
smelendez
8 minutes ago
[-]
Fact-checking and editing a mediocre piece of writing be way harder than writing from scratch. Proving that something isn’t true or can’t be substantiated is hard work, and so is arguing that a word choice is subtly inappropriate.

And making a ton of corrections to a document everyone was hoping was ready to go is never fun politically.

reply
__turbobrew__
6 minutes ago
[-]
I have experienced this several times lately when writing software with claude/codex. Sometimes vetting and steering the agent takes longer than it would have taken me if done manually. Sure you can just decide not to vet the output and go into full vibecode, but agents tend to do a lot of dumb things (such as not deleting unused private methods or having temporary variables that are not needed).

In my experience the most effective work pattern for me is using agents to perform research and feedback on high level design, then I write the code manually, then I ask the agent to review the code for potential bugs/issues and fix those. The agents have a much easier time making small changes once the design is 90% there without going fully off the rails and generating slop.

I am working on writing skills to make the agent better but it is a bit painstaking. For example I had to write this inside of a skill because sometimes the agent would just stub out methods and leave TODOs: “always fully complete the requested task before finishing edits unless input is needed”.

reply
csomar
29 minutes ago
[-]
It's not really any different in programming. Like if you have a well structured code and want to do a clear refactoring across it and you know what to expect, it can speed things up. But if it's generating any significant (and relatively complex) new code, you have to go through the whole thing manually again and then you find out you have to fix way to many things and get bogged down in different paths the AI didn't do correctly.

Of course, it's pretty much impossible to hear a dissenting point of view today and everyone is going crazy on these drugs. I might be hilariously wrong but I think this is the best time to start a software company.

reply
Izikiel43
59 minutes ago
[-]
How do you use it, as in, hey, write a doc about this, or do you iterate more like a conversation?

I do the second approach for coding with smallish steps and the output is fine

reply
SV_BubbleTime
59 minutes ago
[-]
I’m against “vibe” anything important, but the fundamental flaw with this reasoning is that unknown unknowns exist.

I can’t cite “from scratch” for something outside of my knowledge but I side LLM training or assisted search.

reply
kloop
52 minutes ago
[-]
> The problem we're seeing across many professions is AI output is not getting vetted by knowledgeable people

The problem is that output sometimes take longer to verify than to create in the first place.

That turns AI into a deeply negative ROI system for many applications.

reply
Ekaros
54 minutes ago
[-]
Also wondering on this whole review process with someone who wrote it with AI. Even if you comment and noted all issues. Do they have skills or willingness to correctly correct it all? And how many times would you need to keep the loop going for error free outcome? Is there even enough calendar time for that?
reply
wrs
39 minutes ago
[-]
But wait, if knowledgeable people have to vet the output, the process will not be 10X faster and you will not be able to fire the knowledgeable people. Therefore, your objection makes no sense. QED.
reply
DrewADesign
50 minutes ago
[-]
> The problem we're seeing across many professions is AI output is not getting vetted by knowledgeable people, whether it's an experienced analyst, senior engineer, expert attorney, or the resident physician.

Yeah probably not for the same reason I left VFX rather than have a lifetime of completely disregarding my own generative creativity and cleaning up LLM-generated bullshit. Fuck that. Double-fuck creating ‘content’ to train the models.

In code, LLMs automate away a lot of the drudgery. I wasn’t sad to avoid spending a couple hours looking up the usage patterns and idioms for some ported library, or do some rote task that didn’t make the project significantly better. In most other jobs, they automate away the only fun part and leave humans with all of the drudgery.

The tech industry has always been arrogant to some extent, but assuming the world of talented professional knowledge workers and creatives would be content to professionally proofread, apply lipstick to pigs, and polish turds is a whole new level of out-of-touch. I’d rather live out of my car and dig through the garbage for bottles with deposits.

reply
watwut
14 minutes ago
[-]
It is harder to check everything then to create a thing without lying in the first place.
reply
ChrisLTD
1 hour ago
[-]
> the idea that Amazon would allow human bottlenecks to appear across projects and underlying infrastructure is ridiculous.

Why?

reply
SoftTalker
1 hour ago
[-]
Amazon is fairly well known to ruthlessly optimize every process.

So if they're having humans proofread what the AI produces, they must have found that to be necessary.

reply
fabian2k
1 hour ago
[-]
If the main job is putting out a report, starting with AI is wrong in any case. What's the value of an AI-generated report, even if experts fix the biggest issues with it? Maybe this kind of report didn't have all that much value before, I don't know. But starting with AI just makes sure it's generic drivel.
reply
xienze
1 hour ago
[-]
> In many cases the skills are available in house to do the necessary vetting, but these people are already overwhelmed with their existing day to day.

I think a lot of the time it's just pure laziness. AI gives people a magical "do all the work for me" button and it can bring out the worst in them.

reply
canyp
1 hour ago
[-]
I constantly battle this dichotomy where I care about the work I do but I also cannot possibly care about the corporate model, given 0 ownership of flawed processes across the org and the looming layoff that'll happen any day now.

Some people are given the button and really do not care.

reply
cwillu
1 hour ago
[-]
Is there any source with just the plain text? The css styling is headache inducing and reader mode doesn't work or has been defeated.
reply
_tk_
11 minutes ago
[-]
Same goes for lockdown mode on iOS.
reply
le-mark
1 hour ago
[-]
The real comedy is seeing this garbage come down from senior management, clumsy prompting, hallucinated garbage that’s all fluff and zero actionable information, zero real informed analysis. “See this analysis of our support issues from jira, we must fix these top three problems!!!” And it’s all the stuff everyone has known for years but management has refused to give anyone the authority to fix anything. I’ve seen this more than twice now; needs a name. Garbagemaxxing?
reply
raro11
1 hour ago
[-]
What a horrible page to navigate
reply
snailmailman
1 hour ago
[-]
On mobile, It’s hijacking my scroll in such a way that I literally cannot move further down the page. And “reader mode” is only showing me the first paragraph or so.

I’ll have to try again later on desktop. The content looks interesting but it’s literally impossible to read. I cannot get past the section that introduces Ernst and Young.

reply
1000100_1000101
1 hour ago
[-]
On desktop it keeps adding forced pauses to scrolling, of varying sizes, and you need to scroll down a between 1 and 10 pages worth to begin scrolling again.

It might "work" just fine on mobile (or not) but you may have stopped trying before reaching the point of re-scrolling, because it's insane.

reply
snailmailman
46 minutes ago
[-]
I eventually managed to get far enough into the article that I thought I saw the main stat - the stat that 26% of the citations were hallucinated. Then the scroll threw me back to the top again and I gave up entirely on reading from my phone.

Coming back later on desktop, I see that the percentage keeps climbing the further you manage to make it down the page. The real stat is 60% of the citations were hallucinated.

reply
lelandfe
1 hour ago
[-]
I recommend just clicking and dragging the actual scrollbar on desktop for this one. Wild
reply
bokkies
1 hour ago
[-]
Feels like my scroll is hallucinating
reply
nntwozz
1 hour ago
[-]
This is a whole 'nother level of user hostility, never before have I seen anything like it.
reply
umpalumpaaa
1 hour ago
[-]
My iPhone automatically enabled reader mode - I disabled it to see what you are referring to and I agree…
reply
canyp
1 hour ago
[-]
Non-linear feedback with literal stalls, yikes.

Some people should not be allowed to make a website.

reply
IshKebab
47 minutes ago
[-]
They put a lot of effort in to make it that bad!
reply
kavok
1 hour ago
[-]
Very difficult to use on mobile.
reply
csomar
28 minutes ago
[-]
I've stopped reading because of it. I can't scroll. Was this thing vibe-coded? Funny they are picking on EY for not reading their reports but it looks like they didn't test their website.
reply
bbddg
1 hour ago
[-]
I'm usually annoyed by people complaining about scroll hijacking on HN but this site was a new level of bad.
reply
rao-v
1 hour ago
[-]
What’s strange about how things have developed is that this report 12-18 months ago would have been a massive scandal and would have caused durable brand damage.

Now nobody will remember or notice.

reply
aneutron
23 minutes ago
[-]
Fix your website. Drop the shitty Javascript animations. Jesus these things were solved in 2014 with D3JS and jQuery.
reply
jonwinstanley
1 hour ago
[-]
Did someone hallucinate how scrolling is supposed to work on a web page?
reply
mapontosevenths
1 hour ago
[-]
EY has been quietly laying people off for the last year solid.

It's unsurprising that trying to do more with less results in lower quality.

reply
onlyrealcuzzo
51 minutes ago
[-]
The interesting thing is...

There may be a lot of demand for do-nothing services.

A lot of corporate work is just do-nothing box-ticking.

Boss: get me a report about X, so I can give that report to my boss who won't read it.

You: E&Y, please get me a report. Here's $200k.

reply
bombcar
46 minutes ago
[-]
This underlying much of the non-coding AI revolution (and some of the coding perhaps) - so much corporate activity is write-only and never read.
reply
fragmede
9 minutes ago
[-]
The trope about external consultants is that your VP brings them in to review the company, and they talk to everybody and write a report on how to improve the business, and the report says exactly what you've been telling your VP but they've been ignoring you.
reply
toomuchtodo
8 minutes ago
[-]
I’ve had to work with them on the internal side of more than one F500 corporation, and have produced more valuable output with a $200 Claude subscription than what they’ve provided for millions of dollars (I check my work, the token dispenser is not to be trusted implicitly). EY, in my opinion and experience, is a grift systemized for the managerial class. Their revenue stream exists due to relationships and network, and enabling management to launder and shift liability elsewhere. “Our consultants said.”
reply
cmiles8
1 hour ago
[-]
This sort of thing is a complete embarrassment to a firm like EY, where people are paying them a lot of money for advice. They’ve basically demonstrated that their market leading research is just someone asking questions to ChatGPT.

If you ever needed evidence to not buy “advice” from such outfits, this is exhibit one.

Hopefully they at least fired the partner that published this steaming pile of AI slop.

reply
jimnotgym
1 hour ago
[-]
The Big Four have become a shadow of their former selves. They have become so risk averse that their advice is already incredibly generic and non-actionable.

I think their audit work is in a downwards spiral. Audit has become so competitive that they are struggling to find ways to make it cheaper. They have become slaves to reducing the hours booked, and the rate of those hours. To do this they substitute less experienced people all the time. You used to be able to chat with your partner about an issue you have coming up, now you get their assistant if you are lucky. By chasing 'efficiency' they have lost their value-add. Now the first time the partner has looked at your file is right before the clearance meeting, and they spot issues that should have been picked up earlier and tested on the day you should be signing. So you end up doing it all again. I'm trying to coin a term for the inneficiency caused by chasing efficiency.

reply
slater
1 hour ago
[-]
> I'm trying to coin a term for the inneficiency caused by chasing efficiency.

"don't let the perfect be the enemy of the good" ?

reply
bobnamob
29 minutes ago
[-]
“Penny wise but pound foolish”?
reply
busterarm
1 hour ago
[-]
I worked at a top 5 hedge fund in the early 2000s. They had a large team of E&Y auditors onsite at all times that I worked somewhat closely with.

Some things stuck out at me: - They were all in their early 20s. - They were all incredibly checked out. Honestly they still seem like an outlier to me decades later. - They partied hard. Yes, with drugs. - Most of them were in rotating intimate relationships with each other and unusually open about it. Office scuttlebutt was literally "who is fucking who this week". - They seemed busy for maybe two or three weeks out of the entire year and then it was long stretches of Minesweeper/Solitaire.

I filed this away in my head as "provides no value" and that was decades ago. If the industry itself is worse off today I can't imagine how much worse it actually is from my experience.

reply
mrgoldenbrown
1 hour ago
[-]
...>term for the inneficiency caused by chasing efficiency.

Penny wise, pound foolish? Measure twice cut once?

reply
ralph84
1 hour ago
[-]
Executives pay them a lot of money to launder blame. If a project fails after consulting EY, well, what can you do. If a project fails without consulting anyone externally, it's obviously a failure of the executive.
reply
elmomle
1 hour ago
[-]
Exactly--they're paid a lot of money for their reputation, which is valuable in offering cover for politically difficult decisions. This was certainly net-negative for E&Y's reputation.
reply
FearNotDaniel
32 minutes ago
[-]
Off topic but: the scroll mechanism on mobile is so horribly irritating and unpredictable that I just can’t be bothered fighting against it to read what sounds like at least a mildly interesting article.
reply
nilirl
1 hour ago
[-]
Site is gross to scroll on mobile
reply
cwillu
1 hour ago
[-]
It's gross to scroll on desktop as well.
reply
AshamedBadger56
8 minutes ago
[-]
It's gross to scroll on tablets as well.
reply
0898
34 minutes ago
[-]
I did some ghost writing for EY. I wrote cheat sheets about international tax transfer pricing, mining and metals, and life sciences for its then CEO Mark Weinberger.

I had no experience and knew absolutely zero about any of those sectors.

reply
s0rce
13 minutes ago
[-]
Scrolling this page is terribly awkward.
reply
henry2023
32 minutes ago
[-]
I think it’s important to note that EY report’s overall quality has not been affected by GenAI.
reply
galaxyLogic
1 hour ago
[-]
I don't quite get it why they can't take another LLM and vet the output of the first with the second one. Surely they would not have the same hallucinations and would be able to detect hallucinations of the earlier LLM. Maybe it would cost too much in terms of tokens?

I don't know but I would expect it to be realtively easy for an LLM to detect "hallucinations".

reply
mindcrime
1 hour ago
[-]
> I don't quite get it why they can't take another LLM and vet the output of the first with the second one.

Yes, this technique and its variations[1][2] "work" but it's still not 100% perfect. And it's not as widely used it might be because, among other reason:

a. it takes longer to implement

b. it costs more (more tokens spread across multiple llm calls)

c. higher latency (getting an answer takes longer due to multiple llm calls involved)

d. the final answer is probabilistically more likely to be correct, but is still not guaranteed to be error free, so you can never fully escape the need for Human in the Loop.

[1]: https://en.wikipedia.org/wiki/LLM-as-a-Judge

[2]: https://github.com/karpathy/llm-council

reply
operatingthetan
1 hour ago
[-]
>I don't quite get it why they can't take another LLM and vet the output of the first with the seond one.

I think this may be part of the problem. The actual humans creating the report don't have the expertise to know which one to trust. At least that was what consulting was like in my experience at a similar firm.

reply
TZubiri
1 hour ago
[-]
Because they used LLMs to do the work. What you are suggesting is to use the LLMs to create more work, which is counter to the shortcut they were trying to take.
reply
galaxyLogic
47 minutes ago
[-]
Good point with some irony. Thye don't want to do a better job they want to do an easier job. But a company like E&Y should realize shortcuts like these don't work. And their customers are paying them.
reply
biosboiii
56 minutes ago
[-]
I guess this is a great report, but the parallax landing page shenanigans disrupt my reading flow, you cannot easily scroll back to get a overview of the key facts, so I stopped.
reply
sourcecodeplz
48 minutes ago
[-]
Was the title updated? from "ernst & young" to EY Canada. Why?
reply
rescripting
32 minutes ago
[-]
They changed their name to from Ernst & Young to EY in 2013.
reply
Our_Benefactors
1 hour ago
[-]
Holy horrible UI
reply
galaxyLogic
1 hour ago
[-]
I don't quite get it why they can't take another LLM and vet the output of the first with the second one. Surely they would not have the same hallucinations and would be able to detect hallucinations of the earlier LLM. Maybe it would cost too much in terms of tokens?

I don't know but I would expect it to be relatively easy for an LLM to detect "hallucinations".

reply
gdulli
25 minutes ago
[-]
"Why don't they make the whole plane out of the black box???"
reply
zelphirkalt
1 hour ago
[-]
I wish we could just stop destroying people's jobs and lives using AI. The statistics I have heard quoted say, that merely 25% of the people actually like their job. Meaning they like doing what they do for its own sake, not because it gets them money, which they desperately need to live. I get it, most people don't want to do the work. But can we stop ruining the jobs of people, who are actually dedicated to their job and would like to keep doing their job properly?

But I guess since EY is a CYA hedge anyway, no one really cares about whether the reports are hallucinations or not. Someone high up spent money on EY, so that they can justify some decision and won't be held responsible that much, when it turns out the decision was shit. All that matters to them is, that it has the appearance of something genuine and then they can base the decision on what they receive from EY, which better be what they already wanted to hear/read anyway.

reply
krapp
18 minutes ago
[-]
>The statistics I have heard quoted say, that merely 25% of the people actually like their job. Meaning they like doing what they do for its own sake, not because it gets them money, which they desperately need to live.

Even people who like their jobs work because they need money to live.

reply
throwrioawfo
1 hour ago
[-]
You're not actually meant to _read_ these reports.
reply
mentalgear
1 hour ago
[-]
This proves (again) one think for sure: The "Big x" Consulting Firms were always BS - and now them generating all their work themselves using LLMs just profs that their 'clients' can just skip their Million Dollar fees and just ask the LLM directly.
reply
meibo
1 hour ago
[-]
Wow, your mom lets you have TWO scrollbars?
reply
yieldcrv
24 minutes ago
[-]
> In late 2025, EY Canada published

okay that makes me feel better, I think January's frontier models and beyond are better at this

but check your sources folks

reply
chaidhat
1 hour ago
[-]
Maybe they should stop pushing these bankers to do 48 hour shifts…
reply
331c8c71
1 hour ago
[-]
These are not bankers, but the culture is still bonkers
reply
zb3
1 hour ago
[-]
Stop messing with the scroll, I thought there was something wrong with my mouse wheel. Why are you doing this?
reply
themafia
33 minutes ago
[-]
Title changed to remove "Earnst & Young". Why? It seems deferential to an entity that, in this case, certainly doesn't deserve it.
reply
FearNotDaniel
28 minutes ago
[-]
Probably because (a) that’s not their name any more and (b) when it was, that’s not how you spell it
reply
wg0
1 hour ago
[-]
"All jobs would be gone next month."

~ A greedy, dishonest and unethical capitalist.

reply
scotty79
1 hour ago
[-]
If they can't be bothered what they are putting out, do you think that before AI, what they wrote had any merit?
reply
contingencies
1 hour ago
[-]
Basically the entire consulting industry should die due to AI.

Performative executives of yesteryear that constantly need external validation and direction and operate through hive mind and groupthink are weak and will die.

I believe some of the biggest problems in today's business leaders are an inability to be open to new information, to think across traditional professional boundaries, or to ask meaningful questions.

AI simply exposes this unapologetically.

Bad management (this includes most government): up your game or get out of the way.

Sycophantic consultant firms: die.

The Economist should do an article on this.

reply