Forty-five citations, five real ones. That’s not an abstract governance gap.
That’s KPMG.
KPMG the letters come from the founding partners: Klynveld, Peat, Marwick, and Goerdeler. Four firms that merged over time into one. The name is a legacy of that history.
One of the four firms that governments, regulators, and corporate boards trust most when they need to understand what’s coming next in technology. One of the firms most likely to be cited when a Senate staffer is building a briefing, when a compliance officer is writing a policy, when a journalist is looking for an authoritative source to anchor a story.
That firm shipped a report on agentic AI. Forty-five citations. Five accurate. The rest were either fabricated outright or so distorted they pointed nowhere real.
GPTZero investigated it and named what they found. They called it vibe citing. The AI didn’t randomly fail. It did what it was built to do. It generated references that looked right. Plausible authors, plausible titles, plausible journals. The kind of thing that passes a quick scan because it has the shape of a real citation without the substance of one.
A human doesn’t consistently paraphrase titles. A human doesn’t mistake a topic for an author and repeat it across multiple footnotes. A human leaves fingerprints that look like human error. This left fingerprints that looked like a machine doing its best impression of scholarship.
That’s the tell. And nobody caught it before it shipped.
This is the part that matters more than the embarrassment.
KPMG’s reports don’t stay at KPMG. They travel. They get cited in news coverage. They get referenced in blog posts. They get pulled into other research. And now, critically, they get ingested by the large language models that are training on publicly available text.
One compromised source, seeded into the information ecosystem at KPMG’s level of institutional authority, doesn’t stay contained. It spreads. Other researchers cite it. Other models train on it. The false citations become part of the substrate that future AI systems draw from when they generate their own confident-sounding references.
GPTZero called this a clear and present danger. They’re right. But they named the symptom. The disease is older.
The disease is the assumption that capability is the same as reliability.
The firms advising on AI are using AI. That’s not a scandal. That’s the reality of where the tools are now. The scandal is using them without a floor under the output. Without a standard that says: before this leaves the building with our name on it, someone has verified that what it claims is true.
Forty-five citations. Someone could have checked forty-five citations. That’s an afternoon’s work for a junior analyst. It didn’t happen. The report shipped. KPMG’s name went on it. Governments and corporations will cite it.
The Faust Baseline has one rule that covers this entire failure in eight words. No claim without evidence present in the session. That’s CES-1. It doesn’t care how confident the output sounds. It doesn’t care how plausible the citation looks. It asks one question before anything leaves: what is this actually resting on?
That question wasn’t asked at KPMG. Or if it was, the answer was trusted to the same system that generated the problem.
This is what no floor looks like.
Not a student cutting corners on a term paper. Not a content farm churning out SEO filler. KPMG. A Big Four firm. A report specifically about agentic AI — the very category of AI system that is being positioned to take autonomous action in high-stakes environments.
The report advising on the risks of AI operating without sufficient oversight was itself operating without sufficient oversight. That’s not irony. That’s the pattern made visible.
The governance gap has been abstract for long enough. People who work in policy know it’s there. Researchers write about it. The Baseline has been naming it for eighteen months. But abstract gaps don’t move institutions. Concrete failures do.
KPMG is concrete. Forty-five citations, five real ones, on a report that will be cited globally, is concrete. The downstream contamination of research and model training data is concrete.
The question that follows is also concrete. If KPMG ships this without a floor under it, what else is moving through the advisory pipeline with the same problem and no GPTZero team looking at it?
The Faust Baseline was built for exactly this moment. Not to embarrass KPMG. To provide the standard that should have been operating before the report left the building.
Evidence floor. Verification before output. The distinction between what the system generated and what has actually been checked. Those aren’t complicated requirements. They’re the minimum a governance framework has to hold if the output is going to carry institutional weight.
KPMG has the resources to build that floor. So does every firm advising governments on AI right now. The question isn’t whether they can. The question is whether they will — before the next report ships, or after the next GPTZero investigation makes the pattern impossible to ignore again.
The gap has a face now. The next move belongs to the people whose names are on the reports.
“The Faust Baseline Codex 3.5”
micvicfaust@gmail.com
Post Library – Intelligent People Assume Nothing
”AI Baseline Governance”
Purchasing Page – Intelligent People Assume Nothing
Unauthorized commercial use prohibited. © 2026 The Faust Baseline LLC
