NTB Report on Telenor Security Findings Was Withdrawn After AI Tool Allegedly Introduced Fabricated Quotes

NTB allegedly published a news story about Telenor's annual security report that contained purportedly AI-generated errors, including five reportedly fabricated quotes and a nonexistent "security director." The article was reportedly created with an external AI tool and was withdrawn the same morning. Telenor alerted NTB to the inaccuracies, and NTB apologized, citing improper AI use and initiating internal review of its newsroom practices.

Risk classification

• Primary risk domain: 3 Misinformation
• Primary risk subdomain: 3.1 False or misleading information

The AI system generated fabricated quotes and false details about a corporate security report, leading to the publication of misleading information by a news agency.

Additional risk subdomains

• 7.3 Lack of capability or robustness: The AI system failed to perform reliably by hallucinating entirely false quotes and a nonexistent person, showing a lack of capability and robustness.

Causal factors

• Entity: AI
• Intent: Unintentional
• Timing: Post-deployment

The incident was caused by an AI system generating fabricated quotes and false information (hallucinations) during post-deployment use, which was an unintentional outcome of the user's goal to draft an article.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The system is used to generate text content. Under the EU AI Act, providers of AI systems that generate synthetic audio, image, video or text content must ensure that the outputs are marked as artificially generated, which aligns with Risk Level 3.

AI system and alleged parties

• AI system: external AI tool
• AI purpose: Writing Assistant; Automatic Copy-Editing
• Behaviour type: Assistant
• Alleged developer: Unspecified large language model developer
• Alleged deployer: NTB
• Alleged harmed parties: Truth, Telenor, Journalistic integrity, General public of Norway, General public, Epistemic integrity

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Negligible. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Negligible, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Minor
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Epistemic

Reported: Yes, the report explicitly describes epistemic harm in the form of AI-generated fabrication and misinformation published as a news article.

Directly caused: The AI system fabricated five direct quotes and a nonexistent security director, which were published by NTB and syndicated to other news outlets.

Indirectly caused: The publication of false quotes about critical telecommunications infrastructure risks could have misled readers and damaged the credibility of NTB and Telenor.

Inferred additional harm: It is likely that some readers believed the fabricated statements regarding climate risks to telecommunications infrastructure before the article was retracted.

People affected

• Occurrences reported: 1

Potential causes

Management

• Inadequate Policy Enforcement: Management failed to ensure the exclusive use of approved internal tools.
• Lack of Training on AI Risks: Journalists lacked adequate training on the risks of AI hallucination.

Technology

• AI Hallucination: AI generated five fake quotes and a non-existent director name.
• Unapproved AI Tool: The journalist used an external tool instead of NTB's internal tools.

Data Inputs

• Inaccurate Input Processing: AI failed to accurately parse Telenor's actual security report.

Human Factors

• Inadequate Verification: The journalist failed to verify the AI-generated quotes before publishing.
• Improper AI Usage: The journalist used AI in an incorrect and unapproved manner.

Process and Methods

• Flawed Editing Process: Editorial process allowed AI-generated text to be published without check.
• Violation of Press Ethics: The publication violated VVP ethics codes 3.2 and 3.7 regarding sources.

Regulatory Environment

• Ethical Code Non-Compliance: Failure to adhere to Norwegian press ethics guidelines (VVP 3.2 and 3.7).

Information quality

• Classification confidence: High
• Reason for confidence: The report is highly detailed and comes from a reputable journalism industry source (Journalisten.no). It clearly identifies the cause (improper use of AI), the specific errors (five fabricated quotes, fake name/title), the affected parties (NTB, Telenor), and the actions taken (retraction, internal review). There is little ambiguity about what transpired.
• Ambiguities identified: The specific external AI tool used by the journalist is not named.
• Alternative interpretations: None. The facts are clearly laid out and admitted to by NTB's news editor.

An NTB journalist improperly used an unapproved external AI tool, leading to the temporary publication of an article with fabricated quotes and a fake job title regarding Telenor's security report. The article was quickly retracted, resulting in negligible national security impact and representing an established issue of AI hallucination under human-controlled conditions.

• Overall national security impact: Negligible
• Scope: Single nation
• Primary target: Norway
• Alleged perpetrator: Individual

Threat characteristics

• Imminence: Long-term. The specific incident is resolved through retraction, representing an ongoing strategic concern regarding AI hallucinations in media rather than an active crisis.
• Autonomy: Human-controlled. The AI tool was used as a writing assistant by a journalist who retained final control over publication, despite failing to verify the output.
• Novelty: Established threat. AI hallucinations and the misuse of generative AI tools by journalists are well-documented and established issues.

Impact by dimension

• Physical security: Negligible. No physical kinetic attacks, critical infrastructure manipulation, or threats to human safety occurred.
• Information security: Negligible. The incident was an unintentional journalistic error using an AI tool, not a coordinated adversarial information warfare or espionage campaign.
• Sovereignty: Negligible. No threat to state authority, electoral systems, or core government decision-making processes was identified.
• Economic security: Negligible. While Telenor is a major telecommunications company, the temporary publication of a retracted article had negligible economic or technological security impact.
• Societal stability: Negligible. The incident did not lead to mass surveillance, systemic discrimination, or civil unrest, and the article was quickly retracted.