2026-04-19: I was conducting cybersecurity research. When queried about native C++ support for the IETF SASL authentication specification, GPT 5.1 OSS hallucinated a "saslcpp" project it could not attribute any link for. All the other models emitted erroneous misleading output which could be summarized by a human as "I don't know". In the same bout of cybersecurity research, the LLM called Claude Haiku was queried about the feasibility of extending Cyrus-SASL with a new authentication mechanism. It emitted erroneous output implying that this was documented separately, but was unable to cite a source. When asked about using macaroons with SASL, the major cloud LLMs mostly had no useful query output; they mean-reverted to training set, and could not extrapolate in any way. When this happens, it's usually a good indicator one is trying a new approach, i.e. something which could not be copied easily. But one answer reminded me that a macaroon's caveats can ALSO be used to propagate ABAC attribute and role information in a secure way to client entities. So LLMs added value here only in the form of "rubber ducking". I can do that with a real rubber duck, for free, without negative externalities.