AI hallucination is a false or fabricated output produced with high confidence by a model. Instead of proving facts, many generative systems predict the most likely next words, so they can produce convincing but incorrect names, dates, commands, citations, or explanations. The result may look polished and authoritative even when it has no grounding in real data.
In cyber security, hallucinations matter because teams may rely on AI for threat summaries, code review, incident response, or policy drafting. A hallucinated indicator, exploit detail, or configuration change can waste analyst time or trigger bad decisions. Attackers can also exploit this weakness through prompt injection or misleading context to steer a model toward unsafe or false output. Defenses include retrieval from trusted sources, strict verification of AI-generated claims, human review for high-risk actions, and logging that preserves provenance. The rule is simple: if the output will influence security work, it must be checked against primary evidence.