Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

The press: its risk register

The outlets that told the story first, and the newsrooms that check it.

Kind group · Assigned here 2 · In its register 6 · in the story as BBC News, The Hacker News, Alan Woodward, Surrey Centre for Cyber Security

The register

Assigned here, or arriving through a part of this stakeholder. The part played is the one recorded for whoever holds the assignment.

Risk	Rating	Kind	Part played	Controls
R04-3 The agencies' advice disagrees	12 high	Governance	informer	ISO/IEC 27001 A.5.5, NIST CSF 2.0 GV.RR-01, NIS2 Art.20
R07 Decisions made on numbers that measure something else	12 high	Governance	source	NIST CSF 2.0 GV.RM-01, ISO/IEC 27001 6.1.2, OWASP Top 10s LLM09:2025
R10 This newsroom's own agents are steered, leak or mislead	12 high	AI and agents	through The editor (owner), The newsroom's agents (treater), This site's readers (bearer)	EU AI Act Art.50, NIST AI RMF MANAGE-2.4, ISO/IEC 42001 6.1.3, OWASP Top 10s LLM06:2025
R10-1 Prompt injection through captured material	12 high	AI and agents	through The newsroom's agents (treater), The editor (owner)	OWASP Top 10s LLM01:2025, NIST AI RMF MEASURE-2.7, EU AI Act Art.15
R10-3 A status word stronger than its evidence	12 high	AI and agents	through The newsroom's agents (source), This site's readers (bearer), The editor (owner)	OWASP Top 10s LLM09:2025, EU AI Act Art.50
R10-2 A vault key or token published	10 medium	AI and agents	through The newsroom's agents (treater), The editor (owner), This site's readers (bearer)	OWASP Top 10s LLM02:2025, GDPR Art.32, ISO/IEC 27001 A.5.14

Likelihood / impact	1 Minor	2 Moderate	3 Significant	4 Major	5 Severe
5 Happening	5	10	15	20	25
4 Likely	4	8	12 R04-3 R07 R10-3	16	20
3 Possible	3	6	9	12 R10 R10-1	15
2 Unlikely	2	4	6	8	10 R10-2
1 Rare	1	2	3	4	5