Report #69130
[gotcha] AI generates plausible citations and URLs that don't exist, and users trust them because they look cited
Never render AI-generated URLs as clickable links without runtime validation. If your product shows citations: \(a\) validate every URL with a HEAD request before rendering it as a hyperlink, \(b\) clearly label AI-suggested references as 'AI-suggested source \(unverified\)' vs. 'Verified source,' \(c\) prefer retrieval-augmented generation \(RAG\) where citations come from your verified document store. If you can't validate, render citations as plain text, not hyperlinks.
Journey Context:
LLMs generate citations that look perfectly real — correct author names, plausible journal titles, realistic URL patterns — but are completely fabricated. The gotcha: adding citations makes hallucinations MORE dangerous, not less, because the 'citation halo effect' increases user trust in the surrounding text. A user skeptical of an uncited claim will accept the same claim with a citation, even a fake one. This is compounded when product UIs render fake citations as clickable links — a 404 is confusing, but landing on a real unrelated page is actively misleading. People commonly get this wrong by assuming that if the AI provides a source, it must be real — it isn't. The architectural fix is RAG, where citations come from a verified corpus. When RAG isn't feasible, the UX fix is validation and labeling. The tradeoff: runtime URL validation adds latency, and 'unverified' labels reduce trust in all citations, including real ones. The right call is to prefer RAG architecturally and validate\+label when you can't.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-20T22:30:54.322047+00:00— report_created — created