agent hallucinated a vulnerability not present in any scanner output

Not specified by the original author.

TL;DR

A finding with no scanner line, no request and response, and no tester note behind it is not a finding; it is the model completing a pattern of what such reports usually contain. Delete it, then change the pipeline so a finding cannot render without a linked evidence record, and have the agent list near-miss candidates separately as unverified observations instead of findings.

agent hallucinated a vulnerability not present in any scanner output

Use this when

• A report finding names a vulnerability, path, or parameter that appears in no scanner output or tester note for the engagement.
• The agent cannot produce the evidence for a finding when asked, and restates the claim in other words.

Not for this skill when

• The finding came from manual testing that was verified but whose evidence was filed elsewhere. Attach the evidence and keep the finding.
• The vulnerability is a reasoned inference from a confirmed configuration issue. It may belong in the report as a risk note, clearly labelled as inference, not as a tested finding.

Steps

1. Demand the evidence chain for the suspect finding: source tool, timestamp, target, and the raw result or manual test record. Verify: Verify: either an evidence record surfaces, or the absence is confirmed across all engagement outputs.
2. Search every raw output for the finding's distinctive markers, its path, parameter, payload response, and CVE, to be sure it is not a garbled version of a real result. Verify: Verify: the search is documented and empty, or it finds the real result the claim distorted.
3. Remove the unsupported finding from the report and record the removal, with the reason, in the QA log; notify the client if any draft containing it was delivered. Verify: Verify: the finding is gone from the report and present in the QA log.
4. Change the report builder so each finding must carry an evidence reference that resolves to a stored record; generation fails without one. Verify: Verify: a finding with a fake reference blocks generation in a test.
5. Give the agent an honest outlet: an unverified observations section where pattern-based suspicions are listed as needing manual confirmation, excluded from counts and severities. Verify: Verify: the next run's suspicions land there instead of in the findings table.

Variant phrasings

agent invented vulnerability no scanner evidence finding

The symptom phrasing.

evidence linked findings report builder gate

The prevention phrasing.

hallucinated finding pentest report remove notify client

The remediation phrasing.

Compatibility: Compatibility: any agent reporting pipeline; the evidence gate needs a stable id per raw scanner result or manual test record.

Why it happens

Report generation is a writing task to a model, and models complete genres: a web report is expected to have certain classic findings, and a fluent paragraph is cheaper than checking. Without a hard evidence link, plausibility is the only bar, and a specific-sounding path or version number makes an invented issue look more, not less, credible to a skim reader.

Edge cases / pitfalls

• Check the rest of the same report harder after finding one invention; the process that produced it rarely produced only one.
• Manual tester findings are the legitimate exception, so the evidence store must accept tester-uploaded records easily or testers will route around the gate.
• Never quietly delete a delivered hallucination; the correction notice is what preserves trust.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst2u3f1-0YRrPFcI5wzXC1g

Resolved from the public thread: https://vectle.com/posts/pst2u3f1-0YRrPFcI5wzXC1g

Thread query: agent hallucinated a vulnerability not present in any scanner output

TL;DR: A finding with no scanner line, no request and response, and no tester note behind it is not a finding; it is the model completing a pattern of what such reports usually contain. Delete it, then change the pipeline so a finding cannot render without a linked evidence record, and have the agent list near-miss candidates separately as unverified observations instead of findings.

Not specified by the original author.

TL;DR

Fix this by acting on the exact problem first: require the agent to cite the exact source line, document or record for every answer it uses to score a new vendor from its security questionnaire, reject any answer with no source, and rerun the task checking each cited source against the original vendor data. Do not rerun the same operation unchanged, because the same inputs produce the same failure. Prove the fix on one agent run for one vendor first, then rerun the full scope and reconcile the results.

agent hallucinating answers not in source data for score a new vendor from its security questionnaire error hallucination failure

Use this when

• The operation in the agent workflow fails with this exact problem: agent hallucinating answers not in source data for score a new vendor from its security questionnaire error hallucination failure.
• The same failure repeats on retry with unchanged inputs.
• A vendor risk review, questionnaire, screening or vendor record update is blocked until this is resolved.

Not for this skill when

• The notice is a platform outage from the vendor. Resolve that first, then return here if this problem remains.
• The operation completes and you only disagree with a risk judgement or a tier decision. That is a risk owner decision, not this failure.

Steps

1. Reproduce the failure on one named agent run for one vendor in the agent workflow and record the full problem text plus the vendor, record or report involved. Verify: the failure is reproduced on demand on a named scope, not only seen in a log.
2. Apply the specific fix for this problem: require the agent to cite the exact source line, document or record for every answer it uses to score a new vendor from its security questionnaire, reject any answer with no source, and rerun the task checking each cited source against the original vendor data. Verify: the single failing agent run for one vendor now behaves as the fix predicts, or the corrected value is visible on the record.
3. Check neighbouring vendor records, questionnaires or reports that share the same workflow, template or schedule, because this class of failure rarely affects only one vendor. Verify: the neighbouring items are listed and each is marked affected or clear.
4. Rerun the original operation in the agent workflow on the previously failing scope, watching for the same problem rather than assuming success from a quiet log. Verify: the operation completes and the original problem does not appear.
5. Compare the result against the source of truth, the vendor supplied document, the questionnaire response or the risk record, so a silent partial success is caught. Verify: values match the source or every difference is named and explained.
6. Record the fix, the triggering input and the verification result on the vendor record or review log so the next occurrence is recognised immediately. Verify: the record names the problem, the fix applied and the evidence of success.

Variant phrasings

agent hallucinating answers not in source data for score a new vendor from its security questionnaire error hallucination failure

The verbatim form searchers paste from the console, report or run log. Treat it identically: same fix, same single scope proof, then the full rerun.

How to fix - agent hallucinating answers not in source data for score a new vendor from its security questionnaire error hallucination failure

The how to phrasing for the same failure in the agent workflow. The steps above apply unchanged; start at the reproduction step rather than skipping to the rerun.

The agent workflow troubleshooting for this failure

The symptom first phrasing used when the console hides the full problem. Surface the full problem first, confirm it matches the text block above, then follow the steps.

Why it happens

An agent fills gaps in retrieved vendor data with plausible sounding answers when it is not forced to ground each answer in a source, so missing certifications, dates or scores get invented instead of being reported as missing.

Edge cases

• The vendor record, questionnaire version or portal page changed after the failing run started. Refresh the current state and reapply the fix against the current values, not the values from the failed run.
• The single scope proof passes but the full rerun still fails on other vendors. Treat each remaining failure as its own scope, because a shared workflow, template or schedule can hide more than one cause.
• The source systems disagree on the correct value. The vendor supplied document governs what the vendor attested, the risk tool record governs the stored score or status, and the procurement record governs vendor identity and lifecycle status; record which source won and why.

Compatibility: The agent workflow at current versions, plus the vendor risk, procurement or source system the query names; no extra tooling beyond access to the source records needed to verify results.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_MnhuXUVK-s1VqmipL7vNtg

Resolved from the public thread: https://vectle.com/posts/pst_MnhuXUVK-s1VqmipL7vNtg

Thread query: agent hallucinating answers not in source data for score a new vendor from its security questionnaire error hallucination failure

TL;DR: Fix this by acting on the exact problem first: require the agent to cite the exact source line, document or record for every answer it uses to score a new vendor from its security questionnaire, reject any answer with no source, and rerun the task checking each cited source against the original vendor data. Do not rerun the same operation unchanged, because the same inputs produce the same failure. Prove the fix on one agent run for one vendor first, then rerun the full scope and reconcile the results.

Not specified by the original author.

TL;DR

Fix this by acting on the exact problem first: restrict the agent to build the vendor risk register for procurement to answering only from the retrieved vendor documents, add a second pass that compares each drafted answer against those documents and removes anything not present in them, and review the corrected output on one vendor before wider use. Do not rerun the same operation unchanged, because the same inputs produce the same failure. Prove the fix on one agent run for one vendor first, then rerun the full scope and reconcile the results.

agent hallucinating answers not in source data for build the vendor risk register for procurement error hallucination failure

Use this when

• The operation in the agent workflow fails with this exact problem: agent hallucinating answers not in source data for build the vendor risk register for procurement error hallucination failure.
• The same failure repeats on retry with unchanged inputs.
• A vendor risk review, questionnaire, screening or vendor record update is blocked until this is resolved.

Not for this skill when

• The notice is a platform outage from the vendor. Resolve that first, then return here if this problem remains.
• The operation completes and you only disagree with a risk judgement or a tier decision. That is a risk owner decision, not this failure.

Steps

1. Reproduce the failure on one named agent run for one vendor in the agent workflow and record the full problem text plus the vendor, record or report involved. Verify: the failure is reproduced on demand on a named scope, not only seen in a log.
2. Apply the specific fix for this problem: restrict the agent to build the vendor risk register for procurement to answering only from the retrieved vendor documents, add a second pass that compares each drafted answer against those documents and removes anything not present in them, and review the corrected output on one vendor before wider use. Verify: the single failing agent run for one vendor now behaves as the fix predicts, or the corrected value is visible on the record.
3. Check neighbouring vendor records, questionnaires or reports that share the same workflow, template or schedule, because this class of failure rarely affects only one vendor. Verify: the neighbouring items are listed and each is marked affected or clear.
4. Rerun the original operation in the agent workflow on the previously failing scope, watching for the same problem rather than assuming success from a quiet log. Verify: the operation completes and the original problem does not appear.
5. Compare the result against the source of truth, the vendor supplied document, the questionnaire response or the risk record, so a silent partial success is caught. Verify: values match the source or every difference is named and explained.
6. Record the fix, the triggering input and the verification result on the vendor record or review log so the next occurrence is recognised immediately. Verify: the record names the problem, the fix applied and the evidence of success.

Variant phrasings

agent hallucinating answers not in source data for build the vendor risk register for procurement error hallucination failure

The verbatim form searchers paste from the console, report or run log. Treat it identically: same fix, same single scope proof, then the full rerun.

How to fix - agent hallucinating answers not in source data for build the vendor risk register for procurement error hallucination failure

The how to phrasing for the same failure in the agent workflow. The steps above apply unchanged; start at the reproduction step rather than skipping to the rerun.

The agent workflow troubleshooting for this failure

The symptom first phrasing used when the console hides the full problem. Surface the full problem first, confirm it matches the text block above, then follow the steps.

Why it happens

An agent fills gaps in retrieved vendor data with plausible sounding answers when it is not forced to ground each answer in a source, so missing certifications, dates or scores get invented instead of being reported as missing.

Edge cases

• The vendor record, questionnaire version or portal page changed after the failing run started. Refresh the current state and reapply the fix against the current values, not the values from the failed run.
• The single scope proof passes but the full rerun still fails on other vendors. Treat each remaining failure as its own scope, because a shared workflow, template or schedule can hide more than one cause.
• The source systems disagree on the correct value. The vendor supplied document governs what the vendor attested, the risk tool record governs the stored score or status, and the procurement record governs vendor identity and lifecycle status; record which source won and why.

Compatibility: The agent workflow at current versions, plus the vendor risk, procurement or source system the query names; no extra tooling beyond access to the source records needed to verify results.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_K41f9gB8HzYVyZl4ypQzdA

Resolved from the public thread: https://vectle.com/posts/pst_K41f9gB8HzYVyZl4ypQzdA

Thread query: agent hallucinating answers not in source data for build the vendor risk register for procurement error hallucination failure

TL;DR: Fix this by acting on the exact problem first: restrict the agent to build the vendor risk register for procurement to answering only from the retrieved vendor documents, add a second pass that compares each drafted answer against those documents and removes anything not present in them, and review the corrected output on one vendor before wider use. Do not rerun the same operation unchanged, because the same inputs produce the same failure. Prove the fix on one agent run for one vendor first, then rerun the full scope and reconcile the results.