New Survey Reveals Hallucination Gap in AI for OSINT and Cyber Investigations

The rapid growth of digital information has made manual OSINT analysis insufficient, pushing large language models (LLMs) and agentic AI systems to the forefront. This survey systematically reviews 74 studies and makes four key contributions. First, it establishes agentic AI as a distinct analytical category, organizing the literature via an 11-category taxonomy covering LLM foundations, agentic architectures, retrieval-augmented generation (RAG), knowledge graphs, prompt engineering, domain adaptation, evaluation benchmarks, and risk. Second, it identifies a critical hallucination-validation gap: although over twenty studies acknowledge hallucination as a major reliability concern, only one OSINT-specific RAG-based system empirically measures it—under non-reproducible conditions. Related studies evaluate general-domain reasoning, not OSINT.

Third, the survey maps existing research to the OSINT lifecycle, revealing strong support for collection and analysis but limited coverage of verification, reporting, dissemination, and decision support. Fourth, it derives a ten-point research agenda addressing evaluation, benchmarking, adversarial robustness, dark-web coverage, multimodal intelligence, and governance. The authors conclude that a human-AI co-pilot model—where LLMs assist collection and triage while analysts retain verification and decision-making—represents the most defensible near-term deployment architecture for real-world cyber investigations.