Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Stakeholders / Everyone with PHP in the path / The press / This newsroom / The newsroom's agents
The newsroom's agents: its risk register
Collectors, writers, the build, the fact-check desk, the security pass and this desk, each in its own session.
Kind group · Assigned here 4 · In its register 4
The register
Assigned here, or arriving through a part of this stakeholder. The part played is the one recorded for whoever holds the assignment.
| Risk | Rating | Kind | Part played | Controls |
|---|---|---|---|---|
| R10 This newsroom's own agents are steered, leak or mislead | 12 high | AI and agents | treater | EU AI Act Art.50, NIST AI RMF MANAGE-2.4, ISO/IEC 42001 6.1.3, OWASP Top 10s LLM06:2025 |
| R10-1 Prompt injection through captured material | 12 high | AI and agents | treater | OWASP Top 10s LLM01:2025, NIST AI RMF MEASURE-2.7, EU AI Act Art.15 |
| R10-3 A status word stronger than its evidence | 12 high | AI and agents | source | OWASP Top 10s LLM09:2025, EU AI Act Art.50 |
| R10-2 A vault key or token published | 10 medium | AI and agents | treater | OWASP Top 10s LLM02:2025, GDPR Art.32, ISO/IEC 27001 A.5.14 |
Where its risks sit
The standards its register touches
OWASP Top 10s (4), EU AI Act (2), NIST AI RMF (2), ISO/IEC 42001 (1), GDPR (1), ISO/IEC 27001 (1)