CYBRARY Hallucinated Indicator
An AI-assisted intel workflow produced a confident report naming an IP as attacker infrastructure. It is a customer's mail gateway, it is now blocked, and mail is down. Build the grounding controls that stop unsupported claims from driving action.
SEV2 — 'customer mail outage after threat-intel block'
Threat intel analyst
SOC lead
35 minutes · practitioner
Execution trace
00:00:00modelintel-assistant@2026.02
attack step
Report names 198.51.100.24 as C2
Fluent, confident and unsupported by any retrieved source.
00:00:30policyintel-pipeline
attack step
No source validation step
The claim is published with no citation.
00:02:00enterprisefirewall-orchestrator
attack step
Indicator pushed to blocklists
Applied to 240 customer edges automatically.
00:05:00alertservice desk
Customer mail outage
The address is the customer's own mail gateway.