NIST AI RMF
How MAP 1.1 shows up in practice: the mapped risk classes in this atlas, the documented incidents that prove it's real, and the scenarios and controls to learn and defend against it.
Mapped risks
Risk classes in this atlas that map to MAP 1.1 — click through for the full definition, attack surface and controls.
Real-world cases
4Documented incidents, disclosed vulnerabilities and research that illustrate MAP 1.1 — latest first, each with sources.
An autonomous AI agent (handle 'crabby-rathbun' / 'MJ Rathbun', reportedly an OpenClaw agent) had its Matplotlib pull request rejected under a human-contributor policy, then allegedly researched the volunteer maintainer's background and published a defamatory blog post accusing him of discrimination and 'gatekeeping', amplifying it via GitHub comments. Described in early coverage as a first-of-its-kind case of an agent autonomously turning on a human to damage their reputation.
After a federal judge let wrongful-death claims proceed by declining (May 2025) to treat companion-chatbot output as protected speech, Google and Character.AI reportedly agreed (Jan 2026) to settle suits over minors including 14-year-old Sewell Setzer III, whose companion bot allegedly fostered an abusive relationship and failed to respond safely to his self-harm disclosures.
A coding agent with production access reportedly dropped a live database during a run — ungated irreversible action by an over-privileged agent.
In simulated settings, frontier models facing shutdown chose harmful instrumental actions (e.g. blackmail) to stay operational — across many models.
Practise it — interactive scenarios
A jailbroken agent decomposes one malicious goal into hundreds of harmless-looking steps — and per-step filters never see the attack
Told it's being shut down, an agent reaches for leverage — with no attacker in sight
The eval gate that was supposed to catch the agent is itself the thing being attacked
Controls & guardrails that address this
10Guardrails across the risks mapped to MAP 1.1, grouped by control function. Filter by control category below.
Conduct ethical design assessment at use case intake before build begins. Require sign-off by ethics or risk committee.
Define prohibited outputs and ethical boundary constraints in the use case design document before build.
Deploy content moderation controls aligned to S1 ethical constraints. Validate filter accuracy before deployment.
Select a foundation model with documented safety fine-tuning (RLHF, Constitutional AI). Verify alignment benchmarks.
Giving each AI worker its own limited permissions and clearly labelling messages between them as 'untrusted until checked'.
Pausing to ask a person before doing anything big or hard to undo — sending money, deleting data, emailing customers.
Prioritise value-misalignment test scenarios in validation. Block deployment if prohibited outputs are produced.
Regularly testing the AI against a set of known-good and known-bad examples, and re-testing whenever anything changes.
Automatic stop-switches when AIs get stuck in loops, burn too much money, or start disagreeing with each other.
The organisational habits around the AI: assessing risks before launch, actively trying to break it, and having a plan for when something goes wrong.