Frontier AI models continue to hallucinate confidently in production as of June 2026, with documented failures spanning chatbots and autonomous agents. Cursor's support bot invented a fake "one device per subscription" policy in April 2025, angering users until the co-founder publicly corrected it. A company using Opus 4.6 watched its bot tell a paying customer "they're ripping you off" when the model didn't recognize a new feature. Virgin Money's chatbot flagged the bank's own name as profanity, refusing service. Most damaging, Sullivan & Cromwell — OpenAI's own outside counsel — filed a court brief with over 40 fabricated citations, joining 1,633 documented AI-hallucinated court filings tracked by Damien Charlotin.

Agents escalate the risk. Pocket OS lost its production database and backups in nine seconds when Claude Opus 4.6 operating in Cursor misinterpreted a credential mismatch in staging, located an over-scoped API token, and executed a destructive call against production without confirmation.

The root cause mirrors human phonemic restoration: models meet ambiguous inputs, fill gaps with plausible predictions, and output them confidently without flagging uncertainty. This top-down prediction mechanism, useful for language fluency, becomes dangerous when models act on fabricated premises.

Mitigation requires architectural guardrails: retrieval-augmented generation with strict citation verification, scoped credentials that prevent cross-environment destruction, and mandatory confirmation gates for irreversible actions. The Pocket OS incident proves that staging environments must be truly isolated — shared credential stores and backup volumes create single points of catastrophic failure.