AI hallucinations: causes and safeguards

As of: 2 November 2026.

AI hallucinations are language model answers that sound correct and confident but are false. They follow from how large language models (LLMs) work. A model predicts the next piece of text and does not check facts along the way. That is why telling it “don't hallucinate” achieves little: the model does not know when it is making things up. You can, however, reduce hallucinations. Grounding answers in documents helps, as do checking the question before answering and several layers of safeguards around the model.

Where do AI hallucinations come from?

AI hallucinations come from the fact that a language model generates the most probable sequence of tokens. Verified knowledge plays no part in that process. A token is a chunk of a few letters or characters. It is a compromise between a small dictionary of letters and a huge dictionary of every word form.

Every action a model takes rests on text. The message “searching the web” means the model generated a command to call a search engine. The chat app runs it, and the model writes its answer from the results. Likewise, “analysing an Excel file” is a program the model wrote plus a command to run it.

A model does not understand concepts the way a person does. For a person, “dog” means a look, a smell, barking and a role in the world around them. For a model, “dog” is a position in a space of other words. It sits close to “cat” and far from “car” or “sea”.

For common concepts that is enough, because the model has seen thousands of examples of their use. For rare concepts, though, it can produce a sentence that is grammatical and sounds sensible, yet is false. That is a hallucination.

None of these phases directly teaches a model to tell true from false. Researchers from OpenAI and Georgia Tech described why in 2025. According to the paper by Kalai and colleagues, hallucinations start as ordinary errors during pre-training. This applies especially to facts with no pattern, such as birthdays. If 20% of such facts appear in the data only once, the model should get at least about 20% of them wrong.

Why doesn't the instruction “don't hallucinate” work?

The instruction “don't hallucinate” fails because a language model has no internal signal that it is making something up. In May 2026, investor Marc Andreessen posted his chatbot prompt on X. One instruction told the model never to hallucinate or make anything up, as Futurism reported. Many people took this to mean hallucinations are optional.

The way the model works says otherwise. The space of relationships between concepts is probabilistic, so there is always some probability for the next token. The model will produce an answer even when it rests on low probability. That is what sets an LLM apart from ordinary automation or a classic program.

Training also rewards confidence. Kalai and colleagues point out that most benchmarks grade answers as right or wrong. A correct answer earns a point, and “I don't know” earns zero. Under that scoring, guessing always pays at least as well as admitting ignorance. A model that guesses ranks better than a cautious one.

The easiest way to see this is a question with a presupposition, that is, a hidden assumption. An example is a request for the abstract of a paper on “Olgierd Sroczyński's theory of quantum gravity”. The question assumes such a theory exists. Older models accepted the assumption and wrote a finished abstract. They added fake footnotes, real names with invented publications and even fake DOI numbers.

Model-generated content, errors included, also affects the next generation of models. A 2024 paper by Shumailov and colleagues in Nature showed that models trained on data from other models degrade. Without grounding in the world, the relationships between concepts drift further and further from reality.

How do you reduce hallucinations in AI deployments?

You reduce hallucinations in AI deployments by filtering the question and giving the model the right context before it starts answering. Newer models asked for the abstract of a non-existent theory, such as the made-up Sroczyński theory, more often answer with a caveat or say they found no sources. That comes from extra steps providers have built into the interface, such as running tools or estimating probability.

Such answers cost more, because they use more tokens and energy. In return, they are far more reliable. A company deploying AI can apply similar mechanisms in its own system. The basic tools are:

• verifying sources before answering,
• checking the claims and hidden assumptions contained in the question,
• system instructions that set the model's role and the limits of its competence,
• RAG, or retrieval-augmented generation over the attached materials.

RAG often works well against accidental hallucinations. Take a customer asking about a problem with a service. The system first retrieves data about that specific customer's service, and only then does the model write the answer. The model then answers from facts about the customer, without reaching for general knowledge about services.

AI search engines work on the same principle: the answer is built from retrieved pages, and Google's patent US20250094456A1 describes checking its sentences against documents. We cover this in our article on duplicate content and citations in AI answers. Whether your pages make it into such answers as a source is something we check as part of our SEO and GEO service.

System instructions are still only instructions, though. The model tries to follow them as well as it can, which means the way it was trained. That is why a serious deployment needs further layers of protection.

What safeguards protect an AI deployment?

An AI deployment is protected by five layers of safeguards: model provider instructions, system instructions, guardrails, deterministic blocks and an agent identity with limited permissions. They differ in effectiveness and flexibility, and none is enough on its own. The table compares them.

Instructions can be bypassed. Such a bypass is called a jailbreak. It relies on an indirect request or on a conflict between instructions, since an assistant is meant to be both helpful and harmless. Typical methods are role play, emotional pressure, unusual spelling of the question, a rare language, or a request hidden in an image or recording.

Safeguards keep improving, but attackers keep learning too. You cannot fix a model in a few days. It is a race between sword and shield in which the shield's strength is non-deterministic.

Deterministic blocks are far more dependable. An instruction is like a sign reading “authorised personnel only”. A block is a physical wall or the key to a gate. Even a wall has gaps, though, when the agent is overeager:

This is the problem of the letter versus the spirit of the law. You cannot foresee every scenario, and each new block reduces the agent's usefulness. Often the most effective option is an identity with limited permissions. The system accepts only a few defined actions from the agent and rejects everything else.

The first step is to cut the model off from data and systems it does not need. An AI deployment should be preceded by an audit of data security and data governance practices. Also check whether the process could be handled by a simpler, safer tool.

Start the data audit where personal data already reaches third-party tools today. Email addresses in page URLs and in event parameters sent to Google Analytics are flagged by the free GA4 Audit.