Skip to main content
Incident intelligence/SS-IR-095CASE FILE OPEN
Symbolic editorial illustration for SS-IR-095SERVANTSTACK // INCIDENT INTELLIGENCEFORENSIC IMAGE // VERIFIED FRAME
SS-IR-095 // INCIDENT REPORTDocumented

KPMG

A Big Four Firm's Flagship Agentic-AI Report Is Pulled After Only 5 of Its 45 Citations Check Out

EXECUTIVE BRIEF

On June 12, 2026, AI-detection company GPTZero published an investigation into "Total Experience: Redefining Excellence in the Age of Agentic AI," a KPMG global study released in October 2025.

FAILURE CHAINTRACE COMPLETE
  1. 01TRIGGEROn June 12, 2026, AI-detection company GPTZero published an investigation into "Total Experience: Redefining…
  2. 02MACHINE ACTIONAutonomous actor
  3. 03MISSING GATEPredeployment and update validation
  4. 04IMPACTPublic trust
01 // INCIDENT SUMMARY

The short version

On June 12, 2026, AI-detection company GPTZero published an investigation into "Total Experience: Redefining Excellence in the Age of Agentic AI," a KPMG global study released in October 2025.

02 // KEY FACTS

Case telemetry

INCIDENT
SS-IR-095
DATE
June 12, 2026
SYSTEM
KPMG
LOCATION / SCOPE
Global (report published Oct 2025)
EVIDENCE
Documented
AI ROLE
Autonomous actor
HARM
Public trust
SOURCES
2 cited records
03ENTRY POINT // WHAT HAPPENED

The event

On June 12, 2026, AI-detection company GPTZero published an investigation into "Total Experience: Redefining Excellence in the Age of Agentic AI," a KPMG global study released in October 2025. The findings were brutal: of the report's 45 citations, only 5 accurately matched real sources - 40 of 45 cited titles were fake, with 28 sources paraphrased or partly fabricated and a dozen more too vague to trace. Marquee agentic-AI case studies unraveled on inspection: details about energy company Verbund were conflated with an unrelated startup, a claim about Japan's JR East rested on a 2019 press release that predates agentic AI, and an Emirates "flight-booking chatbot" turned out to be a 2023 robot assistant that books nothing. Per TechCrunch, four named organizations - UBS, the UK NHS, Swiss Federal Railways and Transport for London - said the report's claims about their AI use were untrue or misleading. KPMG pulled the report from its websites.

04CAUSAL TRACE // AI'S ACTUAL ROLE

What the machine did

The fingerprints are the familiar signature of LLM-assisted research published without verification: citations that sound right, name real organizations, and reference plausible studies that do not exist. KPMG did not say which tool produced the errors, but its response conceded the failure mode - the firm said it expects its people to follow guidelines on responsible AI use, "including human oversight to validate content and verify independent sources." The oversight existed as a guideline; the report shipped anyway, carrying fabricated evidence for the thesis that enterprises should trust agentic AI.

Autonomous actorAutomation was a causal participant—not a decorative label for the system around it.
05BLAST RADIUS // CONSEQUENCES

Where the failure landed

A Big Four firm - in the business of selling assurance - retracted its own flagship research after an external investigator did the source-checking its process skipped, with four named enterprises publicly disputing how their AI programs were described. The reputational irony wrote itself into headlines: a report urging confidence in agentic AI became a demonstration of why unverified AI output cannot be trusted. For every consultancy publishing AI-assisted thought leadership, the incident set the new baseline expectation: someone will check your citations, and it may not be you.

06 // EVIDENCE STATUS

Documented

Supported by a first-party disclosure, technical research, or corroborated reporting cited below.

SOURCE RECORD UPDATED 2026-07-09

07 // SOURCE LEDGER

2 cited records

  1. 01
  2. 02
08CONTROL FAILURE // MISSING GOVERNANCE

Predeployment and update validation

The failure pattern in this case: Change reached production without sufficient validation.

09INTERVENTION POINT // HUMAN IN THE MIDDLE

The moment the path could change

A change owner validates provenance, blast radius, rollback readiness, and release evidence before deployment.

AI PROPOSESHUMAN OWNS THE DECISIONSYSTEM EXECUTES
10CONTROL DEPLOYMENT // AUTHORITYGATE

Change validation · rollback readiness

AuthorityGate's framework draws a hard line between AI-drafted content and published content: every factual claim and citation in AI-assisted work product is unverified until a qualified human has traced it to a real source - and publication is gated on that sign-off, not on a policy document that hopes it happened. KPMG's own statement is the case study: the guideline requiring human oversight existed and was not followed, because nothing in the workflow enforced it. A checkpoint that cannot be skipped is the difference between a guideline and a control.

RELEVANT KEYSTONE CONTROLUpdate ValidationHow vendor, application, firmware, and automated updates are intercepted and proven safe before deployment.
12 // THE ALTERNATIVE

Autonomy is a design choice.

See the operating model that keeps AI useful while preserving human authority at consequential moments.

Compare AgenticAI and AugmentedAI →