In May 2026, a federal judge in Oregon issued the largest AI hallucination penalty in American legal history — $110,000, for 23 fabricated citations and eight invented quotations. It's the newest entry in a pattern nearly 900 cases deep. And OWASP's own security practitioners ranked this exact risk near the bottom of their list — until the real evidence proved them wrong.
In May 2026, a federal judge in Oregon fined two lawyers a combined $110,000 for submitting 23 fabricated citations and eight invented quotations in court filings — the largest AI hallucination penalty in American legal history to date. Not one bad citation slipping through. Twenty-three fabricated cases and eight invented quotes, treated by the court as attorneys standing by fictional legal authority as if it were real.
This wasn't an isolated event. It's the latest, largest data point in a pattern that's been accelerating since 2023 — approximately 900 AI hallucinations have now been documented in US court filings alone.
The origin story is Mata v. Avianca. In 2023, New York attorney Steven Schwartz used ChatGPT to help research a personal injury claim against a Colombian airline. The tool generated several supporting case citations — Martinez v. Delta Air Lines, Zicherman v. Korean Air Lines, and others — that looked completely legitimate. Schwartz asked the chatbot directly whether the cases were real. It confirmed they were.
None of them existed. Some misidentified judges; some involved airlines that had never been party to any such case. Judge Kevin Castel didn't mince words in his ruling: the attorneys had "abandoned their responsibilities when they submitted non-existent judicial opinions with fake quotes and citations created by the artificial intelligence tool ChatGPT, then continued to stand by the fake opinions after judicial orders called their existence into question." Schwartz and his colleague were fined $5,000.
At the time, it read as an outlier — a cautionary tale about one lawyer's carelessness. Three years and roughly 900 documented cases later, it reads as the first data point in a trend.
The more important legal precedent isn't about lawyers using AI carelessly — it's about who's on the hook when a company's own AI misleads a customer directly. In Moffatt v. Air Canada, decided by a British Columbia tribunal in early 2024, a customer relied on the airline's own website chatbot for information about its bereavement fare policy. The chatbot gave him false information. When Air Canada was sued, the airline's defense was genuinely remarkable: it argued the chatbot was "a separate legal entity that is responsible for its own actions."
The tribunal rejected that defense outright. Air Canada was held liable for what its own chatbot told a customer — full stop. The presiding judge's own words in the ruling are worth reading directly: "As this case has unfortunately made clear, generative AI is still no substitute for the professional expertise that the justice system requires... Competence in the selection and use of any technology tools, including those powered by AI, is critical." A company doesn't get to disclaim its own AI's mistakes as someone — or something — else's problem.
Every subsequent case follows the same basic shape, and the consequences have only gotten more serious. A British Columbia lawyer was formally reprimanded in February 2024 for the identical mistake — inserting fake, ChatGPT-invented cases into court filings, with the presiding judge noting he didn't believe there was intent to deceive, but was "troubled all the same." In February 2026, in US v. Heppner, a federal judge went further than any prior ruling — finding that documents generated using consumer AI tools aren't protected by attorney-client privilege or work-product doctrine at all, adding a whole new category of exposure on top of the sanctions risk already established. Then, three months later, the Oregon case broke every record that came before it.
The trend line is not subtle: more cases, larger fines, broader legal consequences, and it's still accelerating.
OWASP's Top 10 for LLM Applications 2026 formally classifies misinformation as LLM07 — one of the ten most critical risks in LLM-powered systems. That's a deliberate framing choice worth understanding: an AI producing confidently wrong output stops being an accuracy issue and becomes a security failure the moment that output drives a real decision, a tool call, or an automated workflow. Steven Schwartz's fake citations weren't a security breach in the traditional sense — nothing was hacked. But the outcome was functionally identical to one: false information, generated with total confidence, was trusted and acted on, with real financial and professional consequences.
OWASP's 2026 edition was the first to test practitioner opinion against real incident data — 7,714 real cases, 6,639 detailed enough to classify. Practitioners voted misinformation near the bottom of the list. The actual incident record placed it near the top — the widest gap, in the direction that made the risk look more serious than experts assumed, of any category on the list. OWASP's own explanation is straightforward: when a model's fluent, confident-sounding output drives a decision or a tool call, a wrong answer becomes a wrong action — and the real-world record shows that happening more often than the security community had been assuming.
Every case above involves a human still reading the AI's output before acting on it — a lawyer filing a brief, a customer reading a chatbot's answer. That's actually the less dangerous version of this risk. The more serious version is what happens when an autonomous AI agent generates a wrong answer and then acts on it directly, with no human review step in between at all — approving a transaction based on a hallucinated policy detail, or calling the wrong tool because it confidently misremembered what a previous step actually returned. A misinformation problem in a chatbot produces an embarrassing conversation. The identical failure inside an autonomous agent can produce a real, unauthorized business action.