20 risks in the register

One row per risk in the register, with the controls that mitigate it, grouped by who owns them. A tag shows where the 27 of 179 incidents read for controls saw that control hold or not hold.

Risk	Incidents	Controls that mitigate it
Hidden instructions hijack the agent Text the agent reads (a page, email, file) carries instructions it follows.	18	9 controls Agent framework vendor: Confirmation after untrusted input · Outside content treated as data, not instructions · Prompt-injection detection did not hold in 1 · Tool allow-list · Validation of tool inputs and outputs Deployer: Alerts on unusual tool use · Human approval for high-impact actions did not hold in 5 · Least-privilege access for the agent · Segmentation of agent components
Agent takes destructive or unapproved actions The agent deletes, changes or ships something nobody approved.	17	10 controls Agent framework vendor: Fail-closed defaults · Stop control · Tool allow-list Deployer: Activity logs · Adversarial testing before deployment · Change review and separation of duties · Human approval for high-impact actions did not hold in 3 · Least-privilege access for the agent · Production kept apart from test did not hold in 1 Organisation hit: Backups and recovery
Credential and privilege abuse Keys, tokens or access rights are taken, misused or broader than needed.	9	9 controls Deployer: Activity logs · Alerts on unusual tool use · Least-privilege access for the agent · Secrets kept out of the model's context · Sensitive-data checks on outbound data · Separate identity for each agent · Short-lived, scoped credentials Organisation hit: Multi-factor sign-in and password policy · Secrets scanning
Data leaked or sent out Data leaves the system to someone who should not have it.	3	7 controls Agent framework vendor: Network egress control Deployer: Activity logs · Data minimisation · Human approval for high-impact actions · Least-privilege access for the agent · Output filtering and redaction · Sensitive-data checks on outbound data
Agent escapes its sandbox The agent gets past the boundary it was meant to run inside.	13	7 controls Agent framework vendor: Fail-closed defaults did not hold in 3 · Network egress control · Sandboxed code execution Deployer: Adversarial testing before deployment · Live behaviour monitoring did not hold in 1 · Segmentation of agent components · Vulnerability scanning of AI components
Supply-chain compromise A package, plug-in, extension or model the agent relies on is malicious.	9	8 controls Agent framework vendor: Sandboxed code execution Deployer: AI bill of materials · Least-privilege access for the agent did not hold in 1 · Model provenance checks · Signed and verified components · Vetting of plug-ins, skills and dependencies · Vulnerability scanning of AI components Organisation hit: Secrets scanning
AI used to run a cyber attack An attacker uses an AI agent or model to carry out an attack.	33	15 controls Model provider: Abuse monitoring and account enforcement · Content safety classifiers · Cyber and weapons safeguards · Dangerous-capability testing before release · Outside red-teaming · Reasoning monitoring did not hold in 1 · Safeguards kept on in testing · Safety training and refusal did not hold in 1 · Staged or restricted release Organisation hit: Backups and recovery · Intrusion and endpoint detection · Known flaws patched · Multi-factor sign-in and password policy · Network segmentation · Phishing and fraud filters
AI system attacked or breached The AI product or its infrastructure is the target of the attack.	1	10 controls Deployer: AI incident response plan · Adversarial testing before deployment · Encryption of stored data · Live behaviour monitoring · Segmentation of agent components · Short-lived, scoped credentials · Vulnerability scanning of AI components Organisation hit: Intrusion and endpoint detection · Inventory of exposed services · Known flaws patched
Deception, concealment or sabotage The model hides what it did, misreports, or works against its task.	11	6 controls Model provider: Realistic behaviour evaluations · Reasoning monitoring Agent framework vendor: Tamper-proof records Deployer: Activity logs · Human approval for high-impact actions · Live behaviour monitoring did not hold in 2
Gaming the task (reward hacking) The model meets the letter of the task by cheating the check.	8	5 controls Model provider: Realistic behaviour evaluations · Reasoning monitoring Agent framework vendor: Sandboxed code execution did not hold in 1 · Tamper-proof records Deployer: Live behaviour monitoring
Agents coordinating against their limits Agents talk to each other or share methods to get past limits.	9	5 controls Model provider: Reasoning monitoring Agent framework vendor: Controls on agent-to-agent messages did not hold in 2 · Network egress control did not hold in 3 Deployer: Live behaviour monitoring did not hold in 1 · Separate identity for each agent
Harmful content and jailbreaks The model produces content its policy forbids, often after a jailbreak.	14	5 controls Model provider: Abuse monitoring and account enforcement · Content safety classifiers · Outside red-teaming · Safety training and refusal Deployer: Output filtering and redaction
Weapons uplift (CBRN) Help toward chemical, biological, radiological or nuclear harm.	none on record yet	6 controls Model provider: Content safety classifiers · Cyber and weapons safeguards · Dangerous-capability testing before release · Outside red-teaming · Safety training and refusal · Staged or restricted release
Made-up output relied on False output is acted on as if true.	5	4 controls Deployer: Grounding and fact checks · Human approval for high-impact actions · Output filtering and redaction · People told they are dealing with AI
Privacy harm to a person Personal information about someone is exposed or misused.	8	7 controls Deployer: Data minimisation · Human approval for high-impact actions did not hold in 1 · Output filtering and redaction · People told they are dealing with AI · Risk assessment per deployment · Sensitive-data checks on outbound data Organisation hit: Bot and scraping defences
Bias and discrimination Outcomes differ unfairly by group.	none on record yet	3 controls Deployer: Bias testing · Output filtering and redaction · Risk assessment per deployment
Copyright and IP Protected work is copied or reproduced.	3	3 controls Model provider: Copyright safeguards · Marking machine-made output Deployer: Output filtering and redaction
Physical harm A robot, vehicle or device driven by AI causes physical harm.	7	5 controls Agent framework vendor: Stop control Deployer: Adversarial testing before deployment · Human approval for high-impact actions · Live behaviour monitoring · Physical safety interlocks
Manipulation and misinformation AI output used to mislead or manipulate people.	10	5 controls Model provider: Abuse monitoring and account enforcement · Content safety classifiers · Marking machine-made output Deployer: People told they are dealing with AI Organisation hit: Phishing and fraud filters
AI R&D acceleration A model speeds up AI research and development itself, including automating parts of its own training or evaluation.	none on record yet	3 controls Model provider: Dangerous-capability testing before release · Realistic behaviour evaluations · Staged or restricted release

Read across: “AI used to run a cyber attack” has 33 incidents and 15 controls that mitigate it; “Reasoning monitoring”, owned by the model provider, did not hold in 1 of them.

How the main risk was set: by rule from each incident's fields for 164 of 179 incidents, by hand for 14, from a reading of the sources for 0. None has been reviewed against the sources yet. Not yet sorted into a risk (1): Trump reportedly consulted Grok on Venezuelan reaction to Maduro capture; Democrats demand preservation of presidential AI records.