KPMG Pulls AI Report After Finding Fabricated Sources and Made-Up Case Studies

KPMG has withdrawn a report on corporate AI adoption after discovering it contained hallucinations — fabricated case studies and citations that did not exist. The Financial Times broke the story; UBS later verified the findings, according to analysis by Lynn Räbsamen, CFA.

The report was written substantially by generative AI, a fact that became unmistakable once the citations fell apart under scrutiny. A review using GPTZero found that only 5 of the report's 45 citations actually matched their stated sources, per The Register. That is an 89 percent failure rate on a document published by one of the world's largest consulting firms.

The underlying problem is well-known to anyone who tests large language models. These systems can produce references that sound plausible — real author names, credible journal titles, believable page numbers — but are entirely fabricated. The system does not verify what it writes; it generates statistically likely text based on its training data. When a research report relies on citations as its core evidence, human fact-checking before publication is not optional — it is the foundation of the entire document.

What sets this incident apart is institutional scale. KPMG advises governments, regulators, and major corporations on risk and compliance questions. A report on AI's business benefits, written largely by AI itself and filled with fake sources, creates a specific credibility problem: the subject matter and the failure point are the same thing.

The pattern emerging across the industry is that AI-written research is reaching publication without enough human review. This has happened in academic pre-prints, market research, and financial analysis over the past two years. The difference here is the reputational weight of the organization. When KPMG withdraws a report, it lands harder in boardrooms than when an unknown institution retracts a pre-print.

One note on methodology: the GPTZero finding of 5 matching citations out of 45 should be understood carefully. GPTZero's tools are designed primarily to detect AI-written content, not to verify citations in the technical sense, and the reporting does not spell out the exact methodology behind that count. The number is striking enough to suggest serious problems, but treat it as an indicator rather than a precisely audited measurement.

Set that aside, though — the withdrawal itself is the concrete fact. KPMG did not issue a correction or update the report. It pulled it entirely. For a firm whose publications carry real weight in corporate decision-making, that is a significant step, and it suggests internal review confirmed the problems were widespread, not minor or confined to a few passages.

For technology professionals deploying AI in organizations, the practical lesson is clear. Generative AI tends to fail predictably on citation-heavy tasks unless it is paired with retrieval-augmented generation — a technique where the model pulls information from a curated set of real documents before answering, grounding its output in verified sources. Writing a research report with a base language model and publishing it without human verification of every citation is not a workflow problem; it is a fundamental design failure. The output reads as authoritative. The hallucinations are grammatically smooth, stylistically consistent, and contextually convincing. That is exactly what makes them dangerous in a professional document.

On the positive side, detection worked and the correction was swift. The FT investigation and UBS confirmation stopped the fabricated case studies from embedding themselves in other reports and corporate presentations. The system that caught the error performed as it should. The system that should have prevented the error did not.

KPMG has not yet explained what review process the report underwent before publication, or what changes it will make to future AI-assisted research. Those answers matter more than the withdrawal itself.