Only 5 of KPMG’s 45 citations check out, GPTZero says, after report goes missing

KPMG’s October 2025 agentic AI report is supposed to be a showcase. Instead, it is turning into an accidental stress test for one of AI’s most awkward failure modes: sounding certain while citing evidence that does not hold up. GPTZero says a forensic review found that only five of the report’s 45 citations correctly pointed to the cited source. The rest, according to GPTZero, ranged from mangled and misleading to partially fabricated or so vague that they were not verifiable.

That is not a minor proofreading hiccup. If the citations fail, the credibility of everything built on them gets shaky fast, including the report’s “case studies” and the specific claims used to sell the idea that agentic AI deployments are working in the real world. GPTZero goes further, alleging that roughly half of KPMG’s factual claims were false, unsupported, or attributed to the wrong source. In other words, the footnotes are not just messy. They are the mechanism that is supposed to prove the story.

The consulting industry has had to learn this lesson the hard way already. Last year, Deloitte ended up refunding the Australian government after AI-generated content slipped into a taxpayer-funded report. That matters here because it shows a familiar pattern: when generative AI is used in content creation without airtight validation, the “paper trail” can become the weak link, not the machine. GPTZero even coined a term for the citation failure mode: “vibe citing,” the citation equivalent of “vibe coding.” The concept is simple. AI can stitch together fragments of real sources, invent titles, or otherwise produce references that look convincing until someone actually checks them.

GPTZero’s specific allegations put names and pages behind the critique, which is where it stops being abstract. Among the examples GPTZero highlights are supposed agentic AI deployments at UBS, Swiss Federal Railways, and Transport for London. GPTZero claims the sources cited to support those case studies either did not substantiate KPMG’s claims or contained alterations and paraphrasing that undermined reliability. And it flags a more granular example on page 42 tied to Emirates: KPMG’s authors claimed Emirates had adopted a mobile chatbot named Sara that could converse directly with passengers, and even change flights. GPTZero says those claims were wrong in multiple ways: the “Sara” described by KPMG, according to GPTZero, is actually a robot assistant introduced by Emirates in 2023, not a chatbot, and it lacks the ability to alter flight bookings.

The report also may not be consistent with KPMG’s own research, which adds another layer of risk. GPTZero notes that KPMG’s agentic AI report appears to contradict the firm’s 2025 CEO Outlook, released the same month. In the agentic AI report, KPMG cites a figure of 55 percent of CEOs ranking AI as their top investment priority. But the 2025 CEO Outlook put the number at 71 percent. This kind of internal mismatch is exactly the sort of thing boards, risk committees, and audit teams are meant to catch before publication, especially when a report is positioned as a authoritative view of business priorities.

The immediate consequence is operational. KPMG has removed the report from some of its websites while it investigates how the publication made it into the wild, according to the Financial Times. In response to The Register, a spokesperson said KPMG takes accuracy and integrity seriously. The spokesperson added that the report has been removed and that KPMG is reviewing the circumstances surrounding its publication. The spokesperson also said KPMG expects all people to follow its guidelines on the responsible use of AI, including human oversight to validate content and verify independent sources.

For executives watching from the sidelines, the second-order issue is not “did AI hallucinate.” It is “what governance pattern failed.” GPTZero describes problems that include citations and also factual claims, plus internal inconsistencies between KPMG documents. That combination tends to happen when review processes focus on the surface output, but not on the evidentiary backbone. In practice, that means boards should treat citation verification as a control, not a courtesy, and treat AI-assisted drafting as a workflow that must be auditable.

Strategically, this lands in a moment when AI is becoming board-level spend and narrative-level strategy. If a Big Four report with credible branding can end up with citations that do not verify, that is a warning shot for every company commissioning similar research, benchmarking internal AI readiness, or using external studies to justify budgets. The market will not just punish wrong answers. It will punish unverifiable ones, because unverifiable becomes indistinguishable from false when someone clicks the link. And if KPMG’s experience is, as GPTZero alleges, a live demonstration of AI’s ability to “vibe cite,” then the real question for decision-makers is whether their own internal publication pipelines are designed to survive the click.