LLM hallucination is a confident but false or unsupported answer produced by a large language model. The model may invent facts, misquote sources, or fill gaps with plausible-sounding guesses. In cyber security, that is dangerous because teams may rely on AI for triage, code review, threat research, policy drafting, or incident response summaries. A hallucinated command, IP address, control recommendation, or vulnerability detail can lead to bad remediation, wasted investigation time, or unsafe automation.
Hallucinations appear when prompts are ambiguous, the model lacks relevant context, or the system asks it to reason beyond its evidence. Attackers can also exploit this weakness by seeding misleading content into prompts, documents, or chat inputs so the model repeats it as if verified. Defenses include retrieval-augmented generation, source citations, schema validation, tight task boundaries, and human review for high-impact outputs. The goal is not to trust the model less in every case, but to verify it before its answer affects security decisions.