Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Frameworks / NIST AI RMF
NIST AI RMF: the php2shell risks it governs
For AI used to find flaws and AI used to report on them: who governs it, what it can reach, and how to switch it off.
Full name NIST AI Risk Management Framework 1.0 (AI 100-1) · Publisher US National Institute of Standards and Technology · Version 1.0, January 2023 · the official text
Clauses and controls
| Control | What it asks (paraphrased) | Risks mapped | Owned or regulated by |
|---|---|---|---|
| GOVERN-1.1 | Legal and regulatory requirements involving AI are understood, managed and documented | no risk mapped | |
| GOVERN-6.1 | Policies address AI risks from third-party entities | R08 Frontier AI finds critical flaws faster than maintainers can fix them 20 critical | OpenAI (Patch the Planet) |
| MEASURE-2.7 | AI system security and resilience are evaluated and documented | R08 Frontier AI finds critical flaws faster than maintainers can fix them 20 critical R10-1 Prompt injection through captured material 12 high | OpenAI (Patch the Planet), The editor |
| MANAGE-2.4 | Mechanisms exist, with assigned responsibility, to supersede, disengage or deactivate an AI system | R10 This newsroom's own agents are steered, leak or mislead 12 high | The editor |