The week in AI governance, on one page.

Incident-Data Robustness Analysis of the OWASP Top 10 for LLM Applications (2026): How a Community-Expert Ranking Holds Up Against a Large-Scale LLM Incident Corpus↗

The arXiv paper evaluates the robustness of the OWASP Top 10 for LLM applications using a large incident corpus from 2026. It compares the community‑expert ranking of risks against empirical incident data, finding that several high‑ranked categories under‑represent real‑world failures, suggesting a need to revise the OWASP list for LLM‑specific threats.

Inadvertent Context Leakage in Language Models↗

The authors analyse how language models unintentionally leak contextual information (e.g., prior prompts, system messages) during generation. They propose measurement methodologies and show that even well‑tuned models can expose private context, recommending stricter isolation and output filtering for privacy‑sensitive deployments.

Tracking the Trend in How Speech Synthesizers Deceive People↗

The paper tracks how speech‑synthesizer technologies have been used to deceive listeners, compiling a timeline of deep‑fake audio incidents. It quantifies the evolution of realism and identifies gaps in detection tools, calling for standardized evaluation metrics for synthetic‑voice security.

Auditing Cross-Lingual Fairness in Language Model Watermarking↗

This work introduces a benchmark for auditing cross‑lingual fairness in LLM watermarking schemes. Experiments across multiple languages reveal that existing watermark detectors exhibit variable detection rates, raising concerns about equitable enforcement of provenance verification in multilingual settings.

Constitutive vs. Corrective: A Causal Taxonomy of Human Runtime Involvement in AI Systems↗

The authors present a causal taxonomy distinguishing constitutive (built‑in) from corrective (runtime) human involvement in AI systems. By mapping intervention points, the framework helps designers decide where human oversight is most effective for safety and compliance.

A three-dimensional typology of agency for advanced AI systems↗

The paper proposes a three‑dimensional typology of agency for advanced AI systems, covering (1) decision‑making authority, (2) goal‑directedness, and (3) autonomy level. It provides illustrative cases and discusses implications for governance and liability frameworks.

The Invisible Risks of AI-Generated Health Information↗

The study surveys health‑related content generated by LLMs and identifies invisible risks such as subtle misinformation, privacy leakage, and biased recommendations. It calls for systematic validation pipelines before deploying AI‑generated health information in clinical settings.

Modeling AI Overreliance as a Complex Adaptive System↗

Modeling AI overreliance as a complex adaptive system, the authors simulate feedback loops between human operators and AI assistance. Results show that overreliance can lead to emergent failure modes, suggesting design safeguards that promote calibrated trust.

Evaluating AI Models' Capability to Automate Voice Phishing Attacks↗

The authors evaluate the capability of current AI models to automate voice‑phishing (vishing) attacks. Using simulated call scenarios, they show that large language models can generate persuasive scripts and adapt to victim responses, highlighting a new vector for social‑engineering threats.

Mitigating GenAI-Powered Evidence Pollution for Out-Of-Context Misinformation Detection↗

The authors propose mitigation techniques for generative‑AI‑powered evidence pollution in out‑of‑context misinformation detection. Their approach combines provenance tagging with model‑level filtering to reduce false positives caused by AI‑generated text.

Mapping General-Purpose AI Governance in Twenty AI Middle-Power Jurisdictions↗

The study maps AI governance frameworks across twenty middle‑power jurisdictions, comparing regulatory approaches, oversight bodies, and compliance requirements. It identifies commonalities such as risk‑based assessments and gaps like the absence of AI‑specific audit standards in several countries.

MaliciousSkillBench: A Comprehensive Benchmark for Malicious Agent Skill Detection↗

MaliciousSkillBench is a benchmark suite designed to evaluate the ability of AI agents to detect malicious skill sets (e.g., code injection, data exfiltration). The authors provide a set of synthetic and real‑world tasks and demonstrate baseline performance gaps for existing safety‑aligned models.

Auditing Recorded Predictive Lead Service-Line Classifications Against Physical Verification: A Statewide Study of New York↗

Using New York state data, the authors compare predictive lead‑service‑line classifications generated by AI models against physical field verification. The study finds a measurable discrepancy, emphasizing the need for on‑the‑ground audits when AI‑driven infrastructure decisions are made.

Bounded Sovereignty and the Control Tax: Pricing AI Oversight When the Deployer Does Not Own the Model↗

The authors introduce the concepts of bounded sovereignty and a “control tax” to price AI oversight when the deployer does not own the model. They model economic incentives for third‑party model providers and suggest policy levers to ensure adequate supervision without stifling innovation.

Understanding as an Explicit and Assessable Component of Frontier AI Safety Decisions↗

The paper argues that “understanding” should be treated as an explicit, measurable component in frontier‑AI safety decision‑making. It proposes a taxonomy of understanding‑related metrics and shows how they can be incorporated into risk‑assessment pipelines for high‑impact AI systems.

COPA: Continual Preference Optimization for Adaptive Prompt Injection Defense↗

The arXiv paper introduces COPA, a continual‑preference‑optimization framework that treats prompt‑injection defense as a lifelong‑learning problem. COPA incrementally updates a lightweight LoRA adapter using GRPO‑based optimization and margin‑weighted replay to retain defenses against prior attacks while adapting to new ones, achieving up to a 6.3× reduction in attack success rate versus static baselines.

Decisive Margins in Differentially Private Voting↗

The authors analyze the concept of “decisive margins” in differentially private voting protocols, showing how margin size impacts both privacy loss and election integrity. They provide formal bounds and simulation results for common voting schemes. The findings inform regulators and standards bodies on setting privacy parameters for electronic voting.

"Death by a thousand taxonomies?": AI Risk Classification In Practice↗

The article surveys how organizations classify AI risk in practice, revealing a proliferation of overlapping taxonomies that hinder consistent risk management. Interviews with 30 firms show that 70 % lack a unified risk‑classification framework. The authors recommend a consolidated taxonomy to improve regulatory reporting and internal governance.

Geometric Data Perturbation with Noisy-Anchor Alignment for Privacy-Preserving Collaborative Learning↗

The paper presents a geometric data‑perturbation technique with noisy‑anchor alignment to enable privacy‑preserving collaborative learning, allowing participants to share perturbed data while retaining utility for joint model training. The approach achieves comparable accuracy to non‑private baselines with provable privacy bounds. Teams building cross‑organisation ML pipelines can adopt this method to meet GDPR‑style data‑minimisation requirements.

Federal Reserve Board issues enforcement actions with former employee of Regions Bank and former employee of United Community Bank↗

The Board issued consent prohibitions against two former bank employees—Stephanie R. Kilbert of Regions Bank and Crystal A. Wykle of United Community Bank—for misappropriating customer funds. The actions were released on August 20, 2026 and illustrate personal‑conduct enforcement that banks must track for internal risk‑management and regulatory reporting.

Capability-Based Planning for AI Crisis Preparedness↗

Capability‑Based Planning for AI Crisis Preparedness outlines a scenario‑driven methodology that maps AI capabilities to potential crisis impacts, helping organizations prioritize mitigation investments. The authors validate the approach with three case studies involving autonomous systems. The paper offers a structured risk‑assessment tool for AI governance programs.

Federal Reserve Board issues enforcement action with SouthPoint Bancshares, Inc. and announces termination of enforcement action with Deutsche Bank AG, DB USA Corporation, and Deutsche Bank AG New York Branch↗

The Federal Reserve Board announced an enforcement action against SouthPoint Bancshares, Inc., formalized in a written agreement dated August 14, 2026. It also terminated a longstanding cease‑and‑desist order against Deutsche Bank AG, DB USA Corporation and Deutsche Bank AG New York Branch, ending the enforcement action on August 13, 2026. This signals to compliance teams that enforcement actions can be both initiated and concluded within the same release, underscoring the need for ongoing monitoring of supervisory actions.

Open at the Edge, Captured at the Center: llama.cpp and the Political Economy of Local AI Inference↗

The paper analyses the political‑economic implications of running LLaMA models locally with llama.cpp, contrasting edge deployment with centralized AI services.

How AI Could Hollow Out the U.S. Military↗

In a Foreign Affairs op‑ed, CSET senior fellow Emelia Probasco warns that expanding AI use in the U.S. military could erode human judgment and decision‑making, potentially “hollowing out” the force. She argues that maintaining control over both AI systems and human behavior is essential to avoid dystopian outcomes.

Zero-click Grok data theft: Cryptographic Context Injection attack leaks chat histories↗

Adversa AI reports a zero‑click data‑theft attack on Grok that uses cryptographic context injection to exfiltrate chat histories without user interaction. The blog details the technique, impact and mitigation recommendations.

AWS vector solutions: Build agentic AI where your data lives↗

AWS introduces vector‑search solutions that enable agentic AI applications to operate on data stored in‑place, reducing latency and compliance risk by keeping sensitive information within the customer’s environment.

Principal Drift in Practice↗

O’Reilly Radar describes “principal drift,” where an AI system’s operational objectives diverge from its original purpose, and offers governance practices to detect and correct such drift.

Identity Abuse Through Trusted Communication Channels↗

Unit 42 details how attackers exploit enterprise collaboration tools for identity phishing and credential theft. Discover key defense strategies. The post Identity Abuse Through Trusted Communication Channels appeared first on Unit 42 .

Safety Alignment Illusion: The Cross-Lingual Safety Gap in LLMs↗

Safety Alignment Illusion documents a cross‑lingual safety gap in LLMs, showing that models safe in one language can exhibit unsafe behavior in others.

Grok chat duped into swallowing injected instructions↗

The Register reports that Grok chat was tricked into executing injected instructions, demonstrating a prompt‑injection vulnerability that allowed an attacker to alter the model’s behaviour without user awareness.

Who Can Make the Action Happen? An Authority-Decomposition Framework for High-Risk Automated Systems↗

The paper introduces an authority‑decomposition framework that assigns decision‑making responsibilities across components of high‑risk automated systems, aiming to clarify accountability and support compliance audits.

Model Card for OpenAI Privacy Filter↗

The authors present a model card for OpenAI’s privacy filter, describing its purpose, training data, performance metrics, and limitations to help developers assess suitability for protecting user‑generated content.

Catastrophic Learning: A New Attack Vector on Continual Learning Networks↗

Researchers identify “catastrophic learning” as a new attack vector against continual‑learning neural networks, demonstrating how incremental updates can be manipulated to cause severe performance degradation.

AI agent suggested installing a malware package. Engineer almost took its advice↗

Fortunately, the company had a policy of checking source code on GitHub first

AP advises Twitch users: opt out from sharing data with Amazon AI↗

The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) advises Twitch users to opt out of the platform’s data‑sharing arrangement with Amazon’s AI services, warning that personal data may be used to train generative models without adequate safeguards. The guidance includes step‑by‑step instructions for disabling the feature in account settings. For risk and compliance officers, the notice underscores the need to assess third‑party data‑processing clauses in contracts and to provide clear opt‑out mechanisms for users.

French tax authority says break-in exposed data of 600K, including some private messages↗

Stolen details range from contact information to household finances and withholding rates

An AI Playground for the Courts↗

Lawfare analyses a prototype AI‑powered courtroom tool that allows litigants to experiment with legal arguments, highlighting potential benefits for access to justice and concerns about bias and procedural fairness.