AI Hallucination
: The phenomenon where an AI model generates output that is factually incorrect, fabricated, or inconsistent but presented with high confidence. In code generation, hallucinations manifest as non-existent APIs, incorrect function signatures, fabricated package names, wrong library versions, and plausible-looking code that does not actually work or is subtly wrong.
Why It Matters for AI-Coded Apps
AI hallucinations in code are particularly dangerous because the generated code often compiles and appears to work in basic tests while containing subtle bugs or security flaws. An AI might hallucinate a security function that does not actually validate input, or reference a deprecated API with known vulnerabilities.
Real-World Example
An AI generates const hash = crypto.createHash('bcrypt').update(password).digest('hex') – this looks correct but bcrypt is not a valid algorithm for Node.js crypto.createHash(). The code throws an error at runtime, or worse, a developer replaces ‘bcrypt’ with ‘md5’ to make it work, creating a real vulnerability.
How to Detect and Prevent It
Verify all AI-generated API calls against official documentation. Test edge cases, not just happy paths. Use TypeScript or type checkers to catch incorrect function signatures. Verify that imported packages exist and match expected versions. Be skeptical of code that looks correct but uses unfamiliar API patterns.
Frequently Asked Questions
Why do AI models hallucinate code?
LLMs predict the most probable next token based on training patterns. When the model encounters a scenario it has limited training data for, it generates plausible-looking but incorrect code by interpolating from similar patterns. The model cannot distinguish between what it ‘knows’ and what it is fabricating.
How can I detect hallucinated code?
Type checkers (TypeScript, mypy) catch incorrect function signatures. Unit tests reveal incorrect behavior. Linters flag undefined variables and imports. SCA tools verify that imported packages exist. Code review by a human who knows the API catches hallucinated function calls and parameters.
Are some AI models less prone to hallucination?
Models trained on more code data with better fine-tuning tend to hallucinate less for common patterns. However, all current LLMs hallucinate, especially for niche libraries, recent APIs, and novel combinations. No model is hallucination-free, so verification is always required.
Scan your app for security issues automatically
Vibe Eval checks for 200+ vulnerabilities in AI-generated code.
Try Vibe Eval