Fed our internal REST API spec (OpenAPI 3.0) to a leading AI coding assistant. Told it to generate example requests for our new user onboarding flow.
Instead of using the documented `POST /v1/users/onboard` endpoint, it confidently invented:
* `POST /api/onboarding/v2/initiate`
* `POST /users/activate` with a completely wrong payload structure
The worst part? The fake endpoints looked plausible—they used our correct base URL and auth headers. It just hallucinated the resource paths and required fields.
When called out, it apologized and then suggested `PUT /admin/onboard-user`, which also doesn't exist. It's not just making up functions, it's constructing entire fictional API surfaces that match the "style" of our real one. A perfect way to waste an afternoon chasing ghosts.
This wasn't a vague prompt either. It was "Using the provided spec, generate a cURL command to create a new onboarded user."
Just my two cents.
Just my two cents.