To me the dream of AI is: an agent can do the drudge work of tracking every statement down to the supporting reference, documentation and ultimately the work involved in verifying.
It is NOT being used for this, instead we want faster “answers” that avoid due diligence. Same as always but lazier.
Agreed, and there is already a solution that’s better to support anyway. It may not be perfect, but Wikipedia operates on this model at scale at a much smaller annual budget than any of the AI companies and has produced much higher quality content overtime for all of humanities benefit than the AI teams which are most just scraping the work of others while spending most of their original work to replace human labor for their own financial benefit.
Wikipedia community bans AI-generated entries because verifying and removing AI hallucinations imposes even more workload on editors than writing articles from scratch [1, 2].
If you don’t agree that Wikipedia’s approach, one can always fork it like was done with SpaceX / Twitter did with its launch of Grokipedia on October 27, 2025, which hasn’t been really incorporating much improvement well with lots of digressions in its quality and reliability [3].
I've had the same thought as probably have many others - what solutions exist in this space?
To put it into words: a layer over an LLM that tracks provenance: the documents it has access to, the facts it has extracted, the mathematical expressions and queries it's run and finally the artifacts and results it's yielded complete with receipts for exactly how it arrived at it's findings and conclusions.
I assume legaltech products have to do it like this. Is the general pattern implemented somewhere on github?
I mean you can definitely do that - just set it up do to that.
What you are describing is that a majority of humans are inherently not interested in that. There are are a subset of people who would like to do that - and certainly can now that they have the tooling.
Its just a vastly strong tool. If you want it, build it.
I know Perplexity isn't often talked about anymore but their design of every sentence needing to be able to be referenced back to an actual source (like an academic peer reviewed paper) seems like a super power for trust.
Yeah, until you follow the link only to find out that the link does not say what Perplexity told you it does. This happened to me a frightful number of times.
My initial experience with Perplexity was it citing AI blog spam as a primary source so consistently I immediately dropped my subscription. (this was over a year ago, I haven't re-evaluated them since)
I’ve added to my system prompt in perplexity “ignore unreliable sources” and “make sure claims are supported by multiple sources” and that seems to help.
Of course for anything of consequence I’d go and actually read the sources (but for plenty of every day stuff it’s fine). On the free plan btw
LLMs are really weird sometimes. I had some issues using a coding harness where the agent was failing to use the correct tool call syntax (I was using some rando free model on OpenRouter). I sent a message “look closelier at the tool call format” then all the tool calls for the rest of the session succeeded.
Whether Perplexity is useful to someone, and how useful, will depend on how effective it is in giving answers that are (1) correct as often as possible and (2) checkable if they're sometimes wrong.
If Perplexity's answers often treat AI-generated blogspam as reliable then that will probably make them less often correct (because people generating AI blogspam generally don't need what they generate to be consistently correct) and harder to check (because people generating AI blogspam generally don't need what they have to be clearly sourced, and because even if they did it's an extra step of link-following).
So if Perplexity turns up a lot of AI-generated blogspam, that probably makes it less useful. Is it "up to Perplexity"? Again, I don't know what that means, but I don't see that it matters. What matters is how much value it provides, at what cost in time and money and effort and attention. If its output is mostly repeating claims from AI-generated blogspam and that makes the answer "not much, and at too much", then so much the worse for Perplexity even if there's some sense in which it's under no obligation to do better. If its output is reliable and checkable, then so much the better for Perplexity even if some of its deficiencies are in some sense moral failures.
A full 40% of AI stats actually have a specific study behind them? Knowing how the human baseline is that 73.6%* of all statistics are made up on the spot, this is really encouraging.
*That particular stat was of course made up, but not by me.
There is a human/user element here as well - will the users check the citations, if they are provided inline? I recall in the early ChatGPT web search and Perplexity days, most of the citations didn't work (made up, or 404). You get a false sense of security by having a "[1]" next to the stat or a claim. Maybe labs companies should have some additional quality ranking/checks on these, if it's in their interest of course.
Just an thinly veiled ad for something called trakkr. Not to mention that none of these "stats" actually matter aside from being the type of thing that a consultant would put in a pitch deck, at which point their accuracy doesn't matter anyways
It just goes to show that when AIs are relied upon to recall information, they may hallucinate.
It lends credence to the theory that a smaller model without the ghost of information past, could do better with ability to search the web, although this is heavily reliant on the effectiveness of the search engine itself.
This article is complete slop and not worth looking at, but it's an issue worth discussing.
One of the original php2shell announcement posts (which was clearly AI written) claimed that 70% of websites use PHP. This number has now been repeated by every single article about php2shell, including in the most trusted tech news outlets.
I think it could have been approximately true in 2008, but not in 2026. The number is too round anyway. Trying to search for a source to the claim is now impossible.
If the basis of a reliable fact is consensus, then every AI model should now consider this fact to be true. In reality consensus is not useful of course, offhand facts are frequently generated by citogenesis. An article mentioning a stat offhand is not a source. A source should take some amount of epistemic responsibility for a claim.
Looking at HTTP Archive's September 2026 crawl[1], PHP shows up on 4.22M of 8.74M mobile origins, which is 48.3%.
My guess is the 70% figure comes from W3Techs[2], which currently puts PHP at 69.2%, but only of sites "whose server-side programming language we know." Given that PHP is uniquely trivial to fingerprint (via WordPress markup, .php paths, PHPSESSID cookies, etc), it is very likely that it is overrepresented in their dataset[3].
PHP apps don’t have to use the session; if an app does not start a session deliberately, there’s no cookie. Some PHP frameworks don’t use the built in session. Bespoke PHP code may simply never use it. Or perhaps they do but they rename the cookie. Laravel doesn’t use it, for example. Magento does, but it renames the cookie. Prestashop stopped using it.
Web servers don’t have to announce they use PHP at all.
It is no more uniquely trivial to fingerprint than ASP is/was, for the same reasons.
There’s really a lot of dark PHP out there; I maintain a bespoke app that you would not be able to easily establish was PHP.
One reason why the 70% figure is worth going with is that you barely need any PHP on a site to exploit php2shell anyway. It’s a runtime vulnerability. If it’s possible to provoke the server to hand a URL to a PHP runtime, it’s potentially possible to exploit. A hell of a lot of cheap hosting has ready-to-go support for PHP.
Google's AI is extremely prone to making up random shit that doesn't exist. Swedish is an agglutinative language (like German) so you can join multiple words together to form new words: tomat (tomato) + jos (juice) => tomatjos. Most conjoined words are nonsense, but Google will still happily "explain" what they mean. Some examples:
tangentbordskanin (keyboard bunny): keycaps for mechanical keyboards with bunny images on them
indianbokföring (Indian accounting): simple accounting outside of legal norms
bokföringsindian (Indian accountant): informal, older term for an auditor
potatisbensinskämt (potatoe petrol joke): a type of classic absurd riddles or word plays
nagelfis (nail fart): bulging pain in fingers after having been outside in extreme cold without gloves
And it regularly lies about local stuff, e.g., it says that coffee shop A has lower prices than coffee shop B when it's the opposite in reality.
If you want articles about AI to be written by experienced users of AI who have skin in the game, and criticize AI from the perspective of being active users receptive to improvement, you kind of have to accept that those people are highly likely to use AI to write articles.
That's why a transparent attribution graph is paramount for trust-worthy AI.
Otherwise paid disinformation campaigns, as already spewed out by for-hire private-spy agencies (NSO and similar) and 'LLM-SEO' in general, to poison LLMs will deteriorate LLM search to become as enshitiffied as the 'classic google/bing/etc ad-driven' search beforehand.
when people say "there should be no AI taught in schools ever. prompting? what skill is there in talking to a liar bot?" this is where they are dead wrong. Being correctly critical of LLM output is a huge skill and news flash it applies to people and human-written things too.
Being skeptical/critical isn't a skill, it's an attitude, a state of mind. An education that requires you to find your own information and sources manually breeds that state of mind. Giving LLMs to kids (or even adults) nurtures the opposite. It's like taking them to McDonald's every day and telling them to eat healthy. Yes there's a salad on the menu, but it's rarely going to be chosen.
Of course the reality that adults do trust AI uncritically because it's the path of least resistance means the traditional education I mentioned above wasn't sufficient. But that's all the more reason not to introduce a variable that makes things worse.
It is NOT being used for this, instead we want faster “answers” that avoid due diligence. Same as always but lazier.
Wikipedia community bans AI-generated entries because verifying and removing AI hallucinations imposes even more workload on editors than writing articles from scratch [1, 2].
If you don’t agree that Wikipedia’s approach, one can always fork it like was done with SpaceX / Twitter did with its launch of Grokipedia on October 27, 2025, which hasn’t been really incorporating much improvement well with lots of digressions in its quality and reliability [3].
[1] https://en.wikipedia.org/wiki/Wikipedia:Writing_articles_wit...
[2] https://en.wikipedia.org/wiki/Wikipedia:Editing_policy#Artif...
[3] https://en.wikipedia.org/wiki/Grokipedia#Reliability
[Edited for better formatting]
To put it into words: a layer over an LLM that tracks provenance: the documents it has access to, the facts it has extracted, the mathematical expressions and queries it's run and finally the artifacts and results it's yielded complete with receipts for exactly how it arrived at it's findings and conclusions.
I assume legaltech products have to do it like this. Is the general pattern implemented somewhere on github?
What you are describing is that a majority of humans are inherently not interested in that. There are are a subset of people who would like to do that - and certainly can now that they have the tooling.
Its just a vastly strong tool. If you want it, build it.
Of course for anything of consequence I’d go and actually read the sources (but for plenty of every day stuff it’s fine). On the free plan btw
Ah, the good old magic trick!
LLMs are really weird sometimes. I had some issues using a coding harness where the agent was failing to use the correct tool call syntax (I was using some rando free model on OpenRouter). I sent a message “look closelier at the tool call format” then all the tool calls for the rest of the session succeeded.
Whether Perplexity is useful to someone, and how useful, will depend on how effective it is in giving answers that are (1) correct as often as possible and (2) checkable if they're sometimes wrong.
If Perplexity's answers often treat AI-generated blogspam as reliable then that will probably make them less often correct (because people generating AI blogspam generally don't need what they generate to be consistently correct) and harder to check (because people generating AI blogspam generally don't need what they have to be clearly sourced, and because even if they did it's an extra step of link-following).
So if Perplexity turns up a lot of AI-generated blogspam, that probably makes it less useful. Is it "up to Perplexity"? Again, I don't know what that means, but I don't see that it matters. What matters is how much value it provides, at what cost in time and money and effort and attention. If its output is mostly repeating claims from AI-generated blogspam and that makes the answer "not much, and at too much", then so much the worse for Perplexity even if there's some sense in which it's under no obligation to do better. If its output is reliable and checkable, then so much the better for Perplexity even if some of its deficiencies are in some sense moral failures.
(Or at least they used to, I think they changed everything recently, but I've mostly stopped using them.)
*That particular stat was of course made up, but not by me.
It lends credence to the theory that a smaller model without the ghost of information past, could do better with ability to search the web, although this is heavily reliant on the effectiveness of the search engine itself.
One of the original php2shell announcement posts (which was clearly AI written) claimed that 70% of websites use PHP. This number has now been repeated by every single article about php2shell, including in the most trusted tech news outlets.
I think it could have been approximately true in 2008, but not in 2026. The number is too round anyway. Trying to search for a source to the claim is now impossible.
If the basis of a reliable fact is consensus, then every AI model should now consider this fact to be true. In reality consensus is not useful of course, offhand facts are frequently generated by citogenesis. An article mentioning a stat offhand is not a source. A source should take some amount of epistemic responsibility for a claim.
My guess is the 70% figure comes from W3Techs[2], which currently puts PHP at 69.2%, but only of sites "whose server-side programming language we know." Given that PHP is uniquely trivial to fingerprint (via WordPress markup, .php paths, PHPSESSID cookies, etc), it is very likely that it is overrepresented in their dataset[3].
[1] https://httparchive.org/
[2] https://w3techs.com/technologies/overview/programming_langua...
[3] https://en.wikipedia.org/wiki/Streetlight_effect
PHP apps don’t have to use the session; if an app does not start a session deliberately, there’s no cookie. Some PHP frameworks don’t use the built in session. Bespoke PHP code may simply never use it. Or perhaps they do but they rename the cookie. Laravel doesn’t use it, for example. Magento does, but it renames the cookie. Prestashop stopped using it.
Web servers don’t have to announce they use PHP at all.
It is no more uniquely trivial to fingerprint than ASP is/was, for the same reasons.
There’s really a lot of dark PHP out there; I maintain a bespoke app that you would not be able to easily establish was PHP.
One reason why the 70% figure is worth going with is that you barely need any PHP on a site to exploit php2shell anyway. It’s a runtime vulnerability. If it’s possible to provoke the server to hand a URL to a PHP runtime, it’s potentially possible to exploit. A hell of a lot of cheap hosting has ready-to-go support for PHP.
tangentbordskanin (keyboard bunny): keycaps for mechanical keyboards with bunny images on them
indianbokföring (Indian accounting): simple accounting outside of legal norms
bokföringsindian (Indian accountant): informal, older term for an auditor
potatisbensinskämt (potatoe petrol joke): a type of classic absurd riddles or word plays
nagelfis (nail fart): bulging pain in fingers after having been outside in extreme cold without gloves
And it regularly lies about local stuff, e.g., it says that coffee shop A has lower prices than coffee shop B when it's the opposite in reality.
Being particularly critical of LLM output after using LLMs is not an acquired skill either; what is acquired is the erosion of trust.
Of course the reality that adults do trust AI uncritically because it's the path of least resistance means the traditional education I mentioned above wasn't sufficient. But that's all the more reason not to introduce a variable that makes things worse.
The salad is also pretty trash if you use the default dressing.