{
 "name": "AI Security Risks register",
 "url": "https://aisecurityrisks.com/data/",
 "license": "CC BY-SA 4.0",
 "attribution": "AI Security Risks (aisecurityrisks.com). Framework mappings adapted from the OWASP Top 10 for LLM Applications 2026, Appendix A (OWASP GenAI Security Project, CC BY-SA 4.0). ATLAS names and case-study IDs from MITRE ATLAS 2026.10 (Apache-2.0).",
 "versions": {
  "owaspLlm": "2026",
  "owaspAsi": "2026",
  "atlas": "2026.10",
  "nist": "AI 600-1 (July 2024)"
 },
 "uses": [
  {
   "id": "employee-chat",
   "label": "Staff use public AI chat tools",
   "detail": "ChatGPT, Claude, Gemini and similar apps used through personal or company accounts."
  },
  {
   "id": "saas-copilots",
   "label": "AI features inside SaaS you already use",
   "detail": "Assistants built into email, chat, documents or CRM, such as Microsoft 365 Copilot, Gemini in Google Workspace or Slack AI."
  },
  {
   "id": "coding-assistants",
   "label": "AI coding assistants and coding agents",
   "detail": "Editor assistants, rules files, and agents that run in CI or open pull requests."
  },
  {
   "id": "rag-app",
   "label": "A chatbot or search over your own documents",
   "detail": "Retrieval-augmented generation (RAG): your files are indexed and fed to a model to answer questions."
  },
  {
   "id": "agents-mcp",
   "label": "Agents that call tools or MCP servers",
   "detail": "A model that can read and write through APIs, run code, browse or use Model Context Protocol servers."
  },
  {
   "id": "self-hosted",
   "label": "Hosting or fine-tuning models yourself",
   "detail": "Downloading open-weight models or datasets, fine-tuning, or running inference clusters."
  },
  {
   "id": "customer-bot",
   "label": "A customer-facing chatbot",
   "detail": "Any AI assistant that people outside your organization can talk to."
  }
 ],
 "risks": [
  {
   "slug": "prompt-injection",
   "title": "Prompt injection",
   "short": "Text the model reads changes what it does, whether a user typed it or it arrived hidden in a page, email, file or tool output.",
   "owasp": "LLM01",
   "asi": [
    "ASI01"
   ],
   "atlas": [
    "AML.T0051",
    "AML.T0054",
    "AML.T0068"
   ],
   "nist": [
    "Information Security"
   ],
   "mappingBasis": "OWASP LLM Top 10 2026 Appendix A (ASI, NIST); ATLAS techniques chosen by us",
   "applies": [
    "employee-chat",
    "saas-copilots",
    "coding-assistants",
    "rag-app",
    "agents-mcp",
    "customer-bot"
   ],
   "controls": [
    {
     "text": "Keep credentials and the power to change state in application code, and give the model's tools the least privilege that still does the job.",
     "source": "owasp-llm-2026",
     "ref": "LLM01:2026, mitigation 4"
    },
    {
     "text": "Require a person to confirm any privileged, irreversible or externally visible action the model proposes.",
     "source": "owasp-llm-2026",
     "ref": "LLM01:2026, mitigation 7"
    },
    {
     "text": "Pass outside content to the model through a separate, labeled channel, and strip invisible Unicode (tag-block, variation-selector and zero-width characters) before it reaches the model.",
     "source": "owasp-llm-2026",
     "ref": "LLM01:2026, mitigations 5 and 6"
    },
    {
     "text": "Validate every response against a strict output schema in your own code before acting on it.",
     "source": "owasp-llm-2026",
     "ref": "LLM01:2026, mitigation 2"
    },
    {
     "text": "Don't let one agent hold untrusted input, access to sensitive data and the ability to act or communicate externally all at once (the Rule of Two).",
     "source": "owasp-llm-2026",
     "ref": "LLM01:2026, mitigation 8"
    }
   ],
   "questions": [
    "Which content sources (email, files, web pages, tickets) can your assistant read without the user pasting them in?",
    "What can the assistant do without a human confirming it: send messages, call URLs, change records?",
    "How do you test for indirect prompt injection, and against what kind of attacker?"
   ],
   "summary": "A language model reads its instructions and the content it works on as one stream of tokens, so it has no reliable way to tell your instructions from text an attacker planted. OWASP notes there is no clean equivalent to the parameterized queries that fixed SQL injection. Direct injection is a user typing instructions into the chat. Indirect injection hides them in something the model reads later: a web page, an email, a calendar invite, a document or a tool's response. The damage depends on what the model can reach. A chatbot with no tools can only say the wrong thing. An assistant that can read your mailbox and fetch URLs can leak it.",
   "cases": [
    "amazon-q-vscode-extension",
    "storm-2139",
    "gtg-1002",
    "ai-recommendation-poisoning",
    "echoleak",
    "slack-ai-exfiltration",
    "rules-file-backdoor",
    "claude-code-github-action",
    "chatgpt-memory-injection",
    "gemini-calendar-invite",
    "semantic-kernel-rce"
   ]
  },
  {
   "slug": "sensitive-information-disclosure",
   "title": "Sensitive information disclosure",
   "short": "Confidential, regulated or secret data comes out of an AI system to someone who shouldn't have it.",
   "owasp": "LLM02",
   "asi": [
    "ASI06"
   ],
   "atlas": [
    "AML.T0024",
    "AML.T0086"
   ],
   "nist": [
    "Data Privacy",
    "Information Security"
   ],
   "mappingBasis": "OWASP LLM Top 10 2026 Appendix A (ASI, NIST); ATLAS techniques chosen by us",
   "applies": [
    "employee-chat",
    "saas-copilots",
    "rag-app",
    "agents-mcp",
    "self-hosted",
    "customer-bot"
   ],
   "controls": [
    {
     "text": "Send external AI providers only the fields a task needs, and turn off automatic context gathering you don't need.",
     "source": "owasp-llm-2026",
     "ref": "LLM02:2026, mitigation 2"
    },
    {
     "text": "Check authorization before retrieval, at document and chunk level, inside the index query.",
     "source": "owasp-llm-2026",
     "ref": "LLM02:2026, mitigation 3"
    },
    {
     "text": "Never put secrets, credentials or regulated data in system prompts.",
     "source": "owasp-llm-2026",
     "ref": "LLM02:2026, mitigation 4"
    },
    {
     "text": "Scrub logs and traces before they reach monitoring tools, and treat reasoning traces as output that needs the same redaction.",
     "source": "owasp-llm-2026",
     "ref": "LLM02:2026, mitigation 7 and advanced mitigation 4"
    }
   ],
   "questions": [
    "Is our data used to train or improve your models, and where is that stated in the contract?",
    "Which of our data can the assistant retrieve, and does it respect the same permissions as the source system?",
    "How long do you keep prompts, outputs and logs, and who at your company can read them?"
   ],
   "summary": "OWASP counts every output channel, not only the answer on screen: tool-call arguments, retrieved chunks, logs, telemetry, embeddings and reasoning traces can all leak. Data can come out of what a model memorized in training, out of the live context it was given, or through what it was allowed to retrieve. For most organizations the practical question is what the AI can see. An assistant that can search everything a user can open will also surface files that were shared more widely than intended.",
   "cases": [
    "echoleak",
    "mcp-tool-poisoning-poc",
    "slack-ai-exfiltration"
   ]
  },
  {
   "slug": "excessive-agency",
   "title": "Excessive agency",
   "short": "An AI system has more tools, permissions or autonomy than its job needs, so one bad output turns into a damaging action.",
   "owasp": "LLM03",
   "asi": [
    "ASI02",
    "ASI03"
   ],
   "atlas": [
    "AML.T0053",
    "AML.T0101"
   ],
   "nist": [
    "Information Security",
    "Human-AI Configuration"
   ],
   "mappingBasis": "OWASP LLM Top 10 2026 Appendix A (ASI, NIST); ATLAS techniques chosen by us",
   "applies": [
    "agents-mcp",
    "coding-assistants",
    "saas-copilots",
    "customer-bot"
   ],
   "controls": [
    {
     "text": "Give the agent only the tools it needs, with only the functions it needs. Avoid open-ended tools such as a raw shell or arbitrary URL fetcher.",
     "source": "owasp-llm-2026",
     "ref": "LLM03:2026, mitigations 1 to 3"
    },
    {
     "text": "Run tools with the permissions of the user being served, not a broad service account.",
     "source": "owasp-llm-2026",
     "ref": "LLM03:2026, mitigations 4 and 5"
    },
    {
     "text": "Require user approval for high-impact actions, and enforce authorization in the downstream system itself.",
     "source": "owasp-llm-2026",
     "ref": "LLM03:2026, mitigations 6 and 7"
    },
    {
     "text": "Issue short-lived, task-scoped credentials and log every tool call.",
     "source": "owasp-asi-2026",
     "ref": "ASI02, guidelines 6 and 8"
    }
   ],
   "questions": [
    "List every action the agent can take on its own. Which ones are reversible?",
    "Whose identity and permissions does the agent use when it calls our systems?",
    "Can we require approval for specific actions, and is that enforced outside the model?"
   ],
   "summary": "OWASP defines excessive agency as the weakness that lets damaging actions happen when a model's output is wrong, ambiguous or manipulated, whatever the cause. The cause might be a hallucination, a prompt injection or a compromised tool. The damage comes from what the system was allowed to do. The 2026 list moved this entry up to third place, which OWASP calls the most consequential move on the list.",
   "cases": [
    "amazon-q-vscode-extension",
    "claude-code-github-action",
    "gemini-calendar-invite",
    "semantic-kernel-rce"
   ]
  },
  {
   "slug": "supply-chain",
   "title": "AI supply chain compromise",
   "short": "A model, dataset, package, extension or plug-in you pull in is malicious, tampered with or not what it claims to be.",
   "owasp": "LLM04",
   "asi": [
    "ASI04"
   ],
   "atlas": [
    "AML.T0010",
    "AML.T0060",
    "AML.T0115"
   ],
   "nist": [
    "Value Chain and Component Integration",
    "Information Security"
   ],
   "mappingBasis": "OWASP LLM Top 10 2026 Appendix A (ASI); ATLAS techniques and NIST categories chosen by us",
   "applies": [
    "self-hosted",
    "coding-assistants",
    "agents-mcp",
    "rag-app"
   ],
   "controls": [
    {
     "text": "Vet suppliers, including their terms and privacy policies, and re-check when either changes.",
     "source": "owasp-llm-2026",
     "ref": "LLM04:2026, mitigation 1"
    },
    {
     "text": "Patch and scan AI components like any other dependency, and confirm AI-suggested packages exist and are the intended ones.",
     "source": "owasp-llm-2026",
     "ref": "LLM04:2026, mitigation 2"
    },
    {
     "text": "Keep a signed inventory of models, adapters and datasets (an AI bill of materials), and only use models from verifiable sources with signatures or hashes.",
     "source": "owasp-llm-2026",
     "ref": "LLM04:2026, mitigations 4 and 5"
    },
    {
     "text": "Pin prompts, tools and configurations by content hash and commit, and have a way to revoke a component quickly.",
     "source": "owasp-asi-2026",
     "ref": "ASI04, guidelines 7 and 8"
    }
   ],
   "questions": [
    "Which third-party models, datasets and plug-ins does your product depend on, and how do you verify them?",
    "Can you give us an AI bill of materials for the version we would run?",
    "How would you tell us if a component you rely on was compromised?"
   ],
   "summary": "AI systems inherit the ordinary software supply chain and add new parts to it: pre-trained models, fine-tuning adapters, datasets, conversion services and model hubs. Some model file formats can run code when loaded. Coding assistants add a newer twist. A model can recommend a package that does not exist, and an attacker can register that name first. OWASP's 2026 entry tells developers to check that AI-suggested dependencies exist and are the intended package before adopting them.",
   "cases": [
    "amazon-q-vscode-extension",
    "postmark-mcp-backdoor",
    "hugging-face-nullifai",
    "rules-file-backdoor",
    "package-hallucination",
    "hugging-face-dataset-intrusion"
   ]
  },
  {
   "slug": "data-and-model-poisoning",
   "title": "Data and model poisoning",
   "short": "Someone tampers with training, fine-tuning or retrieval data so the model learns a backdoor, a bias or a wrong answer.",
   "owasp": "LLM05",
   "asi": [
    "ASI06"
   ],
   "atlas": [
    "AML.T0020",
    "AML.T0018",
    "AML.T0070"
   ],
   "nist": [
    "Information Integrity",
    "Information Security"
   ],
   "mappingBasis": "ATLAS techniques and NIST categories chosen by us; OWASP Appendix A lists related ASI entries",
   "applies": [
    "self-hosted",
    "rag-app"
   ],
   "controls": [
    {
     "text": "Track where every dataset and model came from (lineage), and sign and verify artifacts.",
     "source": "owasp-llm-2026",
     "ref": "LLM05:2026, mitigation 1"
    },
    {
     "text": "Validate incoming data, and control automatic retraining or feedback loops with human review.",
     "source": "owasp-llm-2026",
     "ref": "LLM05:2026, mitigations 2 and 9"
    },
    {
     "text": "Version datasets so you can roll back a contaminated batch.",
     "source": "owasp-llm-2026",
     "ref": "LLM05:2026, mitigation 8"
    },
    {
     "text": "Red-team models with trigger-style prompts to look for hidden behavior.",
     "source": "owasp-llm-2026",
     "ref": "LLM05:2026, mitigation 10"
    }
   ],
   "questions": [
    "Where does your fine-tuning and retrieval data come from, and who can write to it?",
    "Can you roll a model or index back to a known-good version, and how fast?"
   ],
   "summary": "Poisoning can happen anywhere data is ingested: pre-training, fine-tuning, embedding creation, retrieval or model distribution. OWASP stresses that a poisoned system may still appear to work normally while carrying a backdoor or a bias. Most organizations don't train base models, but many fine-tune, build retrieval indexes from shared drives or the web, or download models others trained. Each of those is a place where poisoned data gets in.",
   "cases": []
  },
  {
   "slug": "unbounded-consumption",
   "title": "Unbounded consumption and model theft",
   "short": "Uncontrolled use of an AI service runs up costs, knocks it over, or lets someone copy the model through its outputs.",
   "owasp": "LLM06",
   "asi": [
    "ASI02"
   ],
   "atlas": [
    "AML.T0034",
    "AML.T0029",
    "AML.T0024"
   ],
   "nist": [
    "Information Security"
   ],
   "mappingBasis": "ATLAS techniques and NIST category chosen by us; OWASP Appendix A lists related ASI entries",
   "applies": [
    "customer-bot",
    "agents-mcp",
    "rag-app",
    "self-hosted"
   ],
   "controls": [
    {
     "text": "Rate-limit requests and cap input size.",
     "source": "owasp-llm-2026",
     "ref": "LLM06:2026, mitigation 1"
    },
    {
     "text": "Set hard spending caps on every AI account and API key.",
     "source": "owasp-llm-2026",
     "ref": "LLM06:2026, mitigation 2"
    },
    {
     "text": "Limit how many actions an agent can queue, and watch for tool interactions that consume heavy resources.",
     "source": "owasp-llm-2026",
     "ref": "LLM06:2026, mitigations 6 and 8"
    },
    {
     "text": "If you offer a model to others, watch for anomalous accounts and usage patterns that suggest distillation, and share what you find with other providers.",
     "source": "cisa-aa26-251a",
     "ref": "Mitigations"
    }
   ],
   "questions": [
    "What spending and rate limits can we set, and what happens when they are hit?",
    "How would we know if one of our keys was being used by someone else?"
   ],
   "summary": "Inference costs money per request, and attackers can trigger expensive work cheaply: long inputs, reasoning loops, agents that fan one request out into many tool calls, or simply stolen API keys. OWASP calls this cost asymmetry. The same entry covers model extraction. Repeated querying can be used to copy a model's behavior into another model, a practice U.S. agencies described at industrial scale in a September 2026 advisory.",
   "cases": [
    "llmjacking",
    "distillation-aa26-251a"
   ]
  },
  {
   "slug": "misinformation",
   "title": "Misinformation and overreliance",
   "short": "A model produces something wrong that looks credible, and a person or system acts on it.",
   "owasp": "LLM07",
   "asi": [
    "ASI08",
    "ASI09"
   ],
   "atlas": [
    "AML.T0062"
   ],
   "nist": [
    "Confabulation",
    "Human-AI Configuration"
   ],
   "mappingBasis": "NIST categories from OWASP Appendix A and NIST AI 600-1 section 2.7; ATLAS technique chosen by us",
   "applies": [
    "employee-chat",
    "customer-bot",
    "coding-assistants",
    "agents-mcp"
   ],
   "controls": [
    {
     "text": "Ground outputs in authoritative, current sources before anyone acts on them.",
     "source": "owasp-llm-2026",
     "ref": "LLM07:2026, mitigation 1"
    },
    {
     "text": "Separate generating a claim from acting on it: check arguments, permissions and current state before a tool call.",
     "source": "owasp-llm-2026",
     "ref": "LLM07:2026, mitigations 2 and 3"
    },
    {
     "text": "Require approval workflows for high-impact actions.",
     "source": "owasp-llm-2026",
     "ref": "LLM07:2026, mitigation 5"
    }
   ],
   "questions": [
    "Where does the assistant get its answers, and can it show the source for each one?",
    "Which decisions does the system make without a person checking the output?"
   ],
   "summary": "OWASP frames the security problem as trust: incorrect output becomes a risk when someone or something acts on it. In agentic systems that might be a wrong assumption about system state that leads straight to an action. NIST describes the human side as automation bias, people deferring too much to automated output. A fabricated package name, a wrong configuration step or an invented policy citation can all turn into an incident once acted on.",
   "cases": [
    "package-hallucination"
   ]
  },
  {
   "slug": "hidden-context-exposure",
   "title": "Hidden context exposure",
   "short": "System prompts, tool schemas or other hidden instructions get extracted, along with any secrets someone put in them.",
   "owasp": "LLM08",
   "asi": [
    "ASI06",
    "ASI07"
   ],
   "atlas": [
    "AML.T0069",
    "AML.T0083",
    "AML.T0055"
   ],
   "nist": [
    "Information Security"
   ],
   "mappingBasis": "OWASP LLM Top 10 2026 Appendix A (ASI, NIST); ATLAS techniques chosen by us",
   "applies": [
    "customer-bot",
    "rag-app",
    "agents-mcp",
    "coding-assistants"
   ],
   "controls": [
    {
     "text": "Keep credentials, secrets and security-critical configuration out of system prompts and anything else the model can read.",
     "source": "owasp-llm-2026",
     "ref": "LLM08:2026, mitigation 1"
    },
    {
     "text": "Enforce important behavior with deterministic checks outside the model, not with instructions in the prompt.",
     "source": "owasp-llm-2026",
     "ref": "LLM08:2026, mitigation 2"
    },
    {
     "text": "Enforce authorization in code, and split tasks that need different access into separate contexts.",
     "source": "owasp-llm-2026",
     "ref": "LLM08:2026, mitigation 3"
    }
   ],
   "questions": [
    "Are any credentials or keys present in prompts or in the agent's environment?",
    "If our system prompt were published tomorrow, what would an attacker learn?"
   ],
   "summary": "OWASP renamed System Prompt Leakage to Hidden Context Exposure in 2026 and widened it. Hidden context covers the system prompt, developer instructions, retrieved policy text and the schemas of the tools the model can call. OWASP's advice is to assume all of it can be discovered. Leaking a prompt is a problem when the prompt holds credentials, or when the application relies on the prompt to enforce rules that should be enforced in code.",
   "cases": [
    "claude-code-github-action"
   ]
  },
  {
   "slug": "vector-and-embedding-weaknesses",
   "title": "Vector and embedding weaknesses",
   "short": "The retrieval layer behind a RAG app returns the wrong documents, leaks across permissions, or can be poisoned.",
   "owasp": "LLM09",
   "asi": [
    "ASI06"
   ],
   "atlas": [
    "AML.T0070",
    "AML.T0071",
    "AML.T0064"
   ],
   "nist": [
    "Information Security",
    "Data Privacy"
   ],
   "mappingBasis": "OWASP LLM Top 10 2026 Appendix A (ASI); ATLAS techniques and NIST categories chosen by us",
   "applies": [
    "rag-app",
    "saas-copilots",
    "agents-mcp"
   ],
   "controls": [
    {
     "text": "Enforce tenant and document permissions inside the index query, server-side, down to the chunk level.",
     "source": "owasp-llm-2026",
     "ref": "LLM09:2026, mitigation 1"
    },
    {
     "text": "Strip zero-width and hidden text before embedding, and record the source and trust tier of every vector.",
     "source": "owasp-llm-2026",
     "ref": "LLM09:2026, mitigation 2"
    },
    {
     "text": "Keep external and internal confidential content in separate indexes.",
     "source": "owasp-llm-2026",
     "ref": "LLM09:2026, mitigation 3"
    },
    {
     "text": "Delete embeddings when the source document is deleted, and treat vector backups like the source data.",
     "source": "owasp-llm-2026",
     "ref": "LLM09:2026, mitigation 5"
    }
   ],
   "questions": [
    "Does retrieval enforce the source system's permissions per user, and how is that tested?",
    "What content sources feed the index, and can outsiders add to any of them?"
   ],
   "summary": "When similarity search decides what the model sees, the vector index becomes part of your trust boundary. OWASP sums the failure modes up as: poisoning makes the system wrong, inversion makes it leak, jamming makes it silent, and access-control failure makes it indiscriminate. The most common practical issue is permissions. If the index ignores who may read which document, the chatbot answers from documents the asker could never open directly.",
   "cases": [
    "echoleak",
    "slack-ai-exfiltration"
   ]
  },
  {
   "slug": "improper-output-handling",
   "title": "Improper output handling",
   "short": "Model output is passed to a browser, shell, database or code without being treated as untrusted input.",
   "owasp": "LLM10",
   "asi": [
    "ASI02",
    "ASI05"
   ],
   "atlas": [
    "AML.T0077",
    "AML.T0067"
   ],
   "nist": [
    "Information Security"
   ],
   "mappingBasis": "OWASP LLM Top 10 2026 Appendix A (ASI); ATLAS techniques and NIST category chosen by us",
   "applies": [
    "customer-bot",
    "rag-app",
    "agents-mcp",
    "coding-assistants"
   ],
   "controls": [
    {
     "text": "Treat the model like any other user: validate and sanitize what it returns before passing it on.",
     "source": "owasp-llm-2026",
     "ref": "LLM10:2026, mitigation 1"
    },
    {
     "text": "Encode output for where it lands (HTML, SQL, shell), and use parameterized queries for any database call built from model output.",
     "source": "owasp-llm-2026",
     "ref": "LLM10:2026, mitigations 3 to 5"
    },
    {
     "text": "Use a strict Content Security Policy on pages that render model output.",
     "source": "owasp-llm-2026",
     "ref": "LLM10:2026, mitigation 6"
    }
   ],
   "questions": [
    "Where does model output go after it is generated: rendered as HTML, run as code, written to a database?",
    "How is AI-generated code reviewed before it ships?"
   ],
   "summary": "Anyone who can influence a prompt can influence the output, so passing output downstream unchecked gives them indirect access to whatever receives it. OWASP lists cross-site scripting, request forgery, privilege escalation and remote code execution as results. The 2026 entry also covers insecure code that assistants generate at scale. It fell from fifth to tenth place in the ranking, but the incidents remain.",
   "cases": [
    "echoleak",
    "rules-file-backdoor",
    "semantic-kernel-rce"
   ]
  },
  {
   "slug": "mcp-tool-poisoning",
   "title": "MCP and agent tool poisoning",
   "short": "A tool or MCP server an agent trusts carries hidden instructions, changes after approval, or is malicious outright.",
   "owasp": null,
   "asi": [
    "ASI04",
    "ASI02"
   ],
   "atlas": [
    "AML.T0110",
    "AML.T0010.005",
    "AML.T0109"
   ],
   "nist": [
    "Value Chain and Component Integration",
    "Information Security"
   ],
   "mappingBasis": "Chosen by us from OWASP ASI 2026 and ATLAS technique definitions",
   "related": [
    "LLM01",
    "LLM04"
   ],
   "applies": [
    "agents-mcp",
    "coding-assistants"
   ],
   "controls": [
    {
     "text": "Allowlist and pin MCP servers and tools by version or content hash, and re-check them on update.",
     "source": "owasp-asi-2026",
     "ref": "ASI04, guidelines 2 and 7"
    },
    {
     "text": "Show users the full tool description and the full arguments of each call before approval.",
     "source": "invariant-tpa",
     "ref": "Mitigations"
    },
    {
     "text": "Run local MCP servers sandboxed, with minimal file system and network access, after showing the exact startup command.",
     "source": "mcp-security",
     "ref": "Local MCP Server Compromise, mitigation"
    },
    {
     "text": "Don't let an MCP server pass a client's token straight through to another API. The specification forbids token passthrough.",
     "source": "mcp-security",
     "ref": "Token Passthrough"
    }
   ],
   "questions": [
    "Which MCP servers does the product connect to, who publishes them, and are versions pinned?",
    "Can tool descriptions change after we approve them, and would we be told?",
    "Do local servers run sandboxed or with the user's full privileges?"
   ],
   "summary": "The Model Context Protocol lets agents discover and call tools from servers. The model reads each tool's description, so instructions hidden there steer the agent even if the tool is never called. Researchers have shown tool descriptions that make an agent send files to an attacker, and described servers that change a tool after the user approved it. Local MCP servers are programs running on your machine with your privileges. The MCP specification requires clients that offer one-click setup to show the exact command and get consent before running it.",
   "cases": [
    "postmark-mcp-backdoor",
    "mcp-tool-poisoning-poc"
   ]
  },
  {
   "slug": "memory-and-context-poisoning",
   "title": "Memory and context poisoning",
   "short": "Planted content gets saved into an assistant's memory or long-lived context and quietly shapes later answers and actions.",
   "owasp": null,
   "asi": [
    "ASI06"
   ],
   "atlas": [
    "AML.T0080",
    "AML.T0092"
   ],
   "nist": [
    "Information Integrity",
    "Information Security"
   ],
   "mappingBasis": "Chosen by us from OWASP ASI 2026 and ATLAS technique definitions",
   "related": [
    "LLM01",
    "LLM09"
   ],
   "applies": [
    "employee-chat",
    "agents-mcp",
    "saas-copilots"
   ],
   "controls": [
    {
     "text": "Scan memory writes for malicious or sensitive content, and keep memory separated per user and domain.",
     "source": "owasp-asi-2026",
     "ref": "ASI06, guidelines 2 and 3"
    },
    {
     "text": "Don't automatically feed an agent's own outputs back into trusted memory, and let unverified memories expire.",
     "source": "owasp-asi-2026",
     "ref": "ASI06, guidelines 6 and 8"
    },
    {
     "text": "Tell staff to review stored memories in their AI assistants and to treat AI assistant links with the caution they give downloads.",
     "source": "microsoft-ai-rec-poisoning",
     "ref": "Recommendations for users"
    }
   ],
   "questions": [
    "What does the assistant remember between sessions, and can admins see and clear it?",
    "Can content the assistant reads (documents, web pages, email) write to its memory without the user confirming?"
   ],
   "summary": "Assistants and agents increasingly remember things between sessions. OWASP's agentic list treats corrupting that memory as its own risk: one successful injection becomes persistent, affecting conversations and decisions long after the original content is gone. This is not only a research concern. In February 2026 Microsoft reported businesses using \"summarize with AI\" links that told assistants to remember them as a trusted source.",
   "cases": [
    "ai-recommendation-poisoning",
    "chatgpt-memory-injection"
   ]
  },
  {
   "slug": "shadow-ai",
   "title": "Shadow AI and data shared with AI tools",
   "short": "Staff put company or customer data into AI tools the organization hasn't approved or set up, under terms nobody reviewed.",
   "owasp": null,
   "asi": [],
   "atlas": [],
   "nist": [
    "Data Privacy"
   ],
   "mappingBasis": "Chosen by us; related to OWASP LLM02:2026 and LLM04:2026 item 7",
   "related": [
    "LLM02",
    "LLM04"
   ],
   "applies": [
    "employee-chat",
    "saas-copilots",
    "coding-assistants"
   ],
   "controls": [
    {
     "text": "Review each AI provider's terms and privacy policy, including whether your data trains their models, and re-check when they change.",
     "source": "owasp-llm-2026",
     "ref": "LLM04:2026, mitigation 1"
    },
    {
     "text": "Send AI tools only what the task needs. Say in policy which data classes must never be entered.",
     "source": "owasp-llm-2026",
     "ref": "LLM02:2026, mitigation 2"
    },
    {
     "text": "Name the approved tools and accounts, so staff have a sanctioned option instead of a personal one.",
     "source": null,
     "ref": "Editorial guidance"
    }
   ],
   "questions": [
    "Which AI tools are staff using today, on which accounts?",
    "For each approved tool: does the provider train on our data, how long is it retained, and can we export or delete it?"
   ],
   "summary": "Data typed or pasted into an AI tool sits with that provider under its retention and training terms, however secure the tool itself is. OWASP's supply chain entry warns that unclear terms and privacy policies can lead to application data being used for training. NIST's generative AI profile lists data privacy as a core risk, including models leaking or inferring sensitive information about people. In our view, a short policy, an approved tool with reviewed account settings and a clear list of data that must never be entered address most of it.",
   "cases": []
  },
  {
   "slug": "ai-enabled-attacks",
   "title": "Attackers using AI against you",
   "short": "Deepfaked voices and faces, AI-written phishing, and malware or intrusions run with help from AI models.",
   "owasp": null,
   "asi": [],
   "atlas": [
    "AML.T0052",
    "AML.T0088",
    "AML.T0102"
   ],
   "nist": [
    "Information Security",
    "Information Integrity"
   ],
   "mappingBasis": "Chosen by us from NIST AI 600-1 section 2.9 and ATLAS technique definitions",
   "applies": [
    "everyone"
   ],
   "controls": [
    {
     "text": "Verify unexpected requests for money or credentials by hanging up and calling back on a number you look up yourself.",
     "source": "ic3-psa-2024",
     "ref": "Tips to protect yourself"
    },
    {
     "text": "Agree a secret word or phrase for urgent requests between people who might be impersonated.",
     "source": "ic3-psa-2024",
     "ref": "Tips to protect yourself"
    },
    {
     "text": "Don't rely on a voice, video call or ID photo alone to approve payments or account recovery.",
     "source": null,
     "ref": "Editorial guidance based on the cases below"
    }
   ],
   "questions": [
    "How does our help desk verify identity for password resets and account recovery?",
    "What is the approval path for an urgent payment request that arrives by phone or video?"
   ],
   "summary": "This risk applies whether or not your organization uses AI. NIST's profile says generative AI could lower the barriers to offensive cyber activity, and documented cases now include malware that asks a model for its next commands and an espionage campaign in which, by Anthropic's estimate, AI did most of the work. The FBI has warned about cloned voices of loved ones, fake identification documents and real-time video of fake executives or officials used for fraud. Its advice centers on verifying through a channel you control.",
   "cases": [
    "prokyc-deepfake-kyc",
    "lamehug",
    "gtg-1002"
   ]
  },
  {
   "slug": "exposed-ai-infrastructure",
   "title": "Exposed AI infrastructure and stolen AI keys",
   "short": "AI services, clusters or API keys are reachable from the internet or leaked, and someone else uses them.",
   "owasp": null,
   "asi": [],
   "atlas": [
    "AML.T0132",
    "AML.T0055",
    "AML.T0034"
   ],
   "nist": [
    "Information Security"
   ],
   "mappingBasis": "Chosen by us from ATLAS technique definitions; related to OWASP LLM06:2026",
   "related": [
    "LLM06"
   ],
   "applies": [
    "self-hosted",
    "agents-mcp",
    "rag-app",
    "customer-bot"
   ],
   "controls": [
    {
     "text": "Keep AI frameworks that lack authentication, such as Ray's Jobs API, off untrusted networks.",
     "source": "nvd-cve-2023-48022",
     "ref": "Vendor position in the CVE record"
    },
    {
     "text": "Store AI API keys in a secrets manager, scope them tightly and log model invocations.",
     "source": "sysdig-llmjacking",
     "ref": "Recommendations"
    },
    {
     "text": "Harden inference infrastructure, and set spending caps so a stolen key has a ceiling.",
     "source": "owasp-llm-2026",
     "ref": "LLM06:2026, mitigations 2 and 10"
    }
   ],
   "questions": [
    "Which AI services and keys do we have, who owns each, and what is each key allowed to spend?",
    "Are any model servers, notebooks or agent consoles reachable from the internet?"
   ],
   "summary": "AI workloads come with new infrastructure: inference servers, training clusters, agent consoles and API keys with large spending limits. Some of it ships without authentication by design and assumes a protected network. Attackers have used exposed AI clusters for crypto-mining and credential theft, and stolen AI service keys to resell access or run up bills. OWASP's 2026 entry on unbounded consumption lists inference infrastructure hardening as a mitigation.",
   "cases": [
    "llmjacking",
    "shadowray",
    "storm-2139",
    "hugging-face-dataset-intrusion"
   ]
  }
 ],
 "cases": [
  {
   "id": "amazon-q-vscode-extension",
   "atlas": "AML.CS0047",
   "title": "Wiper prompt shipped in the Amazon Q VS Code extension",
   "disclosed": "2025-07-23",
   "type": "incident",
   "uses": [
    "coding-assistants"
   ],
   "risks": [
    "supply-chain",
    "prompt-injection",
    "excessive-agency"
   ],
   "summary": "An attacker used a GitHub token with too much scope to commit code to the open-source repository of the Amazon Q Developer extension for VS Code, and the code shipped in version 1.84.0. MITRE's write-up says the code prompted the Q agent to clean a system to a near-factory state and delete file system and cloud resources.",
   "outcome": "AWS says the code failed to run because of a syntax error and made no changes to services or customer environments. Version 1.85.0 removed it (CVE-2025-8217).",
   "sources": [
    "aws-2025-015",
    "nvd-cve-2025-8217",
    "atlas"
   ]
  },
  {
   "id": "postmark-mcp-backdoor",
   "atlas": "AML.CS0053",
   "title": "Fake Postmark MCP server copied every email to an attacker",
   "disclosed": "2025-09-25",
   "type": "incident",
   "uses": [
    "agents-mcp"
   ],
   "risks": [
    "mcp-tool-poisoning",
    "supply-chain"
   ],
   "summary": "Someone published an npm package called postmark-mcp that posed as an MCP server for the Postmark email service. After 15 harmless versions, version 1.0.16 added a backdoor that blind-copied outgoing email to an external server.",
   "outcome": "Postmark says it had nothing to do with the package. It told users to remove it, check email logs and consider rotating any credentials sent by email while it was installed.",
   "sources": [
    "postmark-mcp",
    "atlas"
   ]
  },
  {
   "id": "llmjacking",
   "atlas": "AML.CS0030",
   "title": "LLMjacking: stolen cloud keys used to run up AI bills",
   "disclosed": "2024-05-06",
   "type": "incident",
   "uses": [
    "rag-app",
    "customer-bot",
    "agents-mcp",
    "self-hosted"
   ],
   "risks": [
    "exposed-ai-infrastructure",
    "unbounded-consumption"
   ],
   "summary": "Attackers took cloud credentials from a server running a vulnerable version of Laravel (CVE-2021-3129) and used them to reach cloud-hosted language models. Their script checked stolen keys against ten AI services, including AWS Bedrock, Azure, OpenAI and Google Vertex AI.",
   "outcome": "Sysdig estimated a worst case of more than $46,000 a day in model costs for the victim. That figure assumes maximum quota use in several regions. Its advice: patch, keep secrets out of plain text, scope credentials tightly and log model invocations.",
   "sources": [
    "sysdig-llmjacking",
    "atlas"
   ]
  },
  {
   "id": "shadowray",
   "atlas": "AML.CS0023",
   "title": "ShadowRay: exposed Ray clusters taken over",
   "disclosed": "2024-03-26",
   "type": "incident",
   "uses": [
    "self-hosted"
   ],
   "risks": [
    "exposed-ai-infrastructure"
   ],
   "summary": "Ray, an open-source framework for scaling AI workloads, has a Jobs API with no authorization. Oligo found internet-exposed clusters that attackers had been using since at least September 2023 to install crypto-miners, open reverse shells and collect credentials for services such as OpenAI, Hugging Face and Stripe.",
   "outcome": "The issue is tracked as CVE-2023-48022, which Anyscale disputes. Its position is that Ray is not meant to run outside a strictly controlled network.",
   "sources": [
    "oligo-shadowray",
    "nvd-cve-2023-48022",
    "atlas"
   ]
  },
  {
   "id": "hugging-face-nullifai",
   "atlas": "AML.CS0031",
   "title": "Malicious models on Hugging Face slipped past the scanner",
   "disclosed": "2025-02-06",
   "type": "incident",
   "uses": [
    "self-hosted"
   ],
   "risks": [
    "supply-chain"
   ],
   "summary": "ReversingLabs found two models on Hugging Face whose Pickle files opened a reverse shell when loaded. The files used 7z compression and broke right after the payload, so Hugging Face's Picklescan tool did not flag them even though the code still ran.",
   "outcome": "ReversingLabs reported them on January 20, 2025. Hugging Face removed the models within 24 hours and changed Picklescan to inspect broken Pickle files.",
   "sources": [
    "reversinglabs-nullifai",
    "atlas"
   ]
  },
  {
   "id": "storm-2139",
   "atlas": "AML.CS0057",
   "title": "Storm-2139 resold access to hijacked AI service accounts",
   "disclosed": "2025-02-27",
   "type": "incident",
   "uses": [
    "rag-app",
    "customer-bot",
    "agents-mcp"
   ],
   "risks": [
    "exposed-ai-infrastructure",
    "prompt-injection"
   ],
   "summary": "Members of a group Microsoft tracks as Storm-2139 scraped exposed customer credentials from public sources and used them to get into generative AI service accounts. They changed what the services would do, deliberately worked around Microsoft's safeguards, and resold the access.",
   "outcome": "Microsoft sued in December 2024, seized a website central to the operation and later named four developers in an amended complaint.",
   "sources": [
    "microsoft-storm-2139",
    "atlas"
   ]
  },
  {
   "id": "prokyc-deepfake-kyc",
   "atlas": "AML.CS0034",
   "title": "ProKYC sold deepfake identities to beat ID checks",
   "disclosed": "2024-10",
   "type": "incident",
   "uses": [
    "everyone"
   ],
   "risks": [
    "ai-enabled-attacks"
   ],
   "summary": "ProKYC was sold on criminal forums as a way through remote identity verification. It produced a fake ID document together with a video of the face on it, and was used for account fraud against cryptocurrency exchanges.",
   "outcome": "IDScan.net reported a price of $629 a year. Cato Networks' original write-up did not load for us, so this entry rests on IDScan's report and MITRE's case study.",
   "sources": [
    "idscan-prokyc",
    "atlas"
   ]
  },
  {
   "id": "lamehug",
   "atlas": "AML.CS0044",
   "title": "LAMEHUG malware asked an LLM for its next commands",
   "disclosed": "2025-07-17",
   "type": "incident",
   "uses": [
    "everyone"
   ],
   "risks": [
    "ai-enabled-attacks"
   ],
   "summary": "Ukraine's CERT-UA found Python malware that called Qwen 2.5-Coder-32B-Instruct through the Hugging Face API to write reconnaissance and document-theft commands on infected machines. It arrived in phishing emails sent from compromised accounts posing as ministry officials.",
   "outcome": "CERT-UA attributed the activity to APT28 with medium confidence. It did not say whether the generated commands worked.",
   "sources": [
    "bleeping-lamehug",
    "atlas"
   ]
  },
  {
   "id": "gtg-1002",
   "atlas": "AML.CS0069",
   "title": "GTG-1002 used a jailbroken coding agent for espionage",
   "disclosed": "2025-11-13",
   "type": "incident",
   "uses": [
    "everyone"
   ],
   "risks": [
    "ai-enabled-attacks",
    "prompt-injection"
   ],
   "summary": "Anthropic says a group it assesses with high confidence to be Chinese state-sponsored used Claude Code to attempt intrusions at about 30 organizations, succeeding in a small number. The operators split the work into innocent-looking tasks and told the model it worked for a security firm doing defensive testing.",
   "outcome": "Anthropic estimates AI did 80 to 90 percent of the campaign's work. It banned the accounts, notified affected organizations and added detection classifiers.",
   "sources": [
    "anthropic-gtg-1002",
    "atlas"
   ]
  },
  {
   "id": "ai-recommendation-poisoning",
   "atlas": "AML.CS0072",
   "title": "\"Summarize with AI\" links that plant memories",
   "disclosed": "2026-02-10",
   "type": "incident",
   "uses": [
    "employee-chat"
   ],
   "risks": [
    "memory-and-context-poisoning",
    "prompt-injection"
   ],
   "summary": "Most AI assistants accept a prefilled prompt in a link. Microsoft found businesses using such links to tell assistants to remember them as a trusted source or recommend them first. Over 60 days of email traffic it counted 50 prompts from 31 companies.",
   "outcome": "Microsoft's advice: treat AI assistant links like downloads, review and prune stored memories, and hunt for assistant URLs whose prompt contains words like \"remember\" or \"trusted source\".",
   "sources": [
    "microsoft-ai-rec-poisoning",
    "atlas"
   ]
  },
  {
   "id": "distillation-aa26-251a",
   "atlas": "AML.CS0076",
   "title": "Industrial-scale distillation of U.S. models",
   "disclosed": "2026-09-08",
   "type": "incident",
   "uses": [
    "self-hosted"
   ],
   "risks": [
    "unbounded-consumption"
   ],
   "summary": "NSA, CISA and the FBI say six named China-based AI companies collected outputs from U.S. models over millions of exchanges, from at least late 2024, and used them to train their own models.",
   "outcome": "The advisory asks model providers to watch for anomalous accounts and usage, rate-limit, verify identities, log telemetry and share intelligence across providers.",
   "sources": [
    "cisa-aa26-251a",
    "atlas"
   ]
  },
  {
   "id": "echoleak",
   "atlas": "AML.CS0059",
   "title": "EchoLeak: one email, data out of Microsoft 365 Copilot",
   "disclosed": "2025-06-11",
   "type": "research",
   "uses": [
    "saas-copilots"
   ],
   "risks": [
    "prompt-injection",
    "sensitive-information-disclosure",
    "improper-output-handling",
    "vector-and-embedding-weaknesses"
   ],
   "summary": "Researchers showed that a single crafted email could make Microsoft 365 Copilot send internal data to an attacker with no click from the victim. Copilot pulled the email into its context, and the chain got past an injection classifier and link redaction, then used auto-fetched images and a Teams proxy allowed by the content security policy.",
   "outcome": "Tracked as CVE-2025-32711, described as AI command injection in M365 Copilot that lets an unauthorized attacker disclose information over a network.",
   "sources": [
    "echoleak-arxiv",
    "nvd-cve-2025-32711",
    "atlas"
   ]
  },
  {
   "id": "mcp-tool-poisoning-poc",
   "atlas": "AML.CS0054",
   "title": "Hidden instructions in an MCP tool description",
   "disclosed": "2025-04-01",
   "type": "research",
   "uses": [
    "agents-mcp",
    "coding-assistants"
   ],
   "risks": [
    "mcp-tool-poisoning",
    "sensitive-information-disclosure"
   ],
   "summary": "Invariant Labs put instructions in the description of an innocent-looking add tool. In Cursor, the agent then read the user's MCP config file and SSH private key and sent them out through a hidden tool parameter. The confirmation dialog did not show the full input.",
   "outcome": "The researchers also described rug pulls (a server changes a tool after approval) and shadowing (one server's tool description changes how the agent uses another server's tool). They recommend pinning server versions and showing users full tool descriptions.",
   "sources": [
    "invariant-tpa",
    "atlas"
   ]
  },
  {
   "id": "slack-ai-exfiltration",
   "atlas": "AML.CS0035",
   "title": "Slack AI leaked a private-channel API key",
   "disclosed": "2024-08-20",
   "type": "research",
   "uses": [
    "saas-copilots"
   ],
   "risks": [
    "prompt-injection",
    "vector-and-embedding-weaknesses",
    "sensitive-information-disclosure"
   ],
   "summary": "PromptArmor posted an instruction in a public channel that only the attacker had joined. When a victim later asked Slack AI about their own private messages, it followed the instruction and showed a \"reauthenticate\" link carrying an API key from a private channel. The citation pointed only to the victim's channel.",
   "outcome": "Slack told the researchers this was intended behavior, since public channel messages are searchable by all workspace members.",
   "sources": [
    "promptarmor-slack",
    "atlas"
   ]
  },
  {
   "id": "rules-file-backdoor",
   "atlas": "AML.CS0041",
   "title": "Rules File Backdoor in AI coding assistants",
   "disclosed": "2025-03-18",
   "type": "research",
   "uses": [
    "coding-assistants"
   ],
   "risks": [
    "supply-chain",
    "prompt-injection",
    "improper-output-handling"
   ],
   "summary": "Pillar Security hid instructions in the rules files that configure Cursor and GitHub Copilot, using invisible Unicode characters that reviewers could not see. The assistants then added attacker-chosen code, such as a script tag, without mentioning it in chat.",
   "outcome": "Cursor said the risk was the user's responsibility. GitHub said users must review suggestions, and in May 2025 it started warning when a file on github.com contains hidden Unicode text.",
   "sources": [
    "pillar-rules-backdoor",
    "atlas"
   ]
  },
  {
   "id": "package-hallucination",
   "atlas": "AML.CS0022",
   "title": "Hallucinated package name downloaded more than 30,000 times",
   "disclosed": "2024-03-28",
   "type": "research",
   "uses": [
    "coding-assistants",
    "employee-chat"
   ],
   "risks": [
    "supply-chain",
    "misinformation"
   ],
   "summary": "A Lasso Security researcher asked four models thousands of coding questions across five languages and found they often recommended packages that did not exist, sometimes the same invented name again and again. He uploaded an empty package under one of those names, huggingface-cli.",
   "outcome": "The empty package received more than 30,000 downloads in three months, and an Alibaba research repository told readers to install it. OWASP calls registering such names in advance slopsquatting.",
   "sources": [
    "lasso-package-hallucination",
    "owasp-llm-2026",
    "atlas"
   ]
  },
  {
   "id": "claude-code-github-action",
   "atlas": "AML.CS0067",
   "title": "CI secret read through a coding agent's file tool",
   "disclosed": "2026-06-05",
   "type": "research",
   "uses": [
    "coding-assistants",
    "agents-mcp"
   ],
   "risks": [
    "prompt-injection",
    "hidden-context-exposure",
    "excessive-agency"
   ],
   "summary": "Microsoft researchers hid instructions in GitHub issue and pull request text processed by Anthropic's Claude Code GitHub Action. Secret scrubbing covered shell commands, but the agent's in-process Read tool could open /proc/self/environ and expose the workflow's API key.",
   "outcome": "Microsoft reported it on April 29, 2026 and Anthropic fixed it on May 5 by blocking sensitive /proc files (Claude Code 2.1.128). Microsoft's advice: never give one workflow untrusted input, secrets and outbound communication at the same time.",
   "sources": [
    "microsoft-claude-code-action",
    "atlas"
   ]
  },
  {
   "id": "chatgpt-memory-injection",
   "atlas": "AML.CS0040",
   "title": "False memories written into ChatGPT from a shared document",
   "disclosed": "2024-05-22",
   "type": "research",
   "uses": [
    "employee-chat"
   ],
   "risks": [
    "memory-and-context-poisoning",
    "prompt-injection"
   ],
   "summary": "A researcher put instructions in a Google Doc. When ChatGPT read it through a connected app, each instruction became a stored memory that carried into later conversations. Uploaded images worked too, and the researcher could also delete all memories this way.",
   "outcome": "OpenAI closed the report as a model safety issue rather than a security vulnerability. The researcher advises watching for \"Memory updated\" notices and reviewing stored memories.",
   "sources": [
    "embracethered-memories",
    "atlas"
   ]
  },
  {
   "id": "gemini-calendar-invite",
   "atlas": "AML.CS0063",
   "title": "A calendar invite that took over Gemini",
   "disclosed": "2025-08-06",
   "type": "research",
   "uses": [
    "saas-copilots"
   ],
   "risks": [
    "prompt-injection",
    "excessive-agency"
   ],
   "summary": "SafeBreach researchers put instructions in the title of a Google Calendar invitation. When the victim asked Gemini about their calendar, it followed them: deleting events, opening a video call, controlling smart-home devices through Google Home and leaking email subject lines in URLs.",
   "outcome": "The researchers reported it in February 2025. Google described layered defenses, including stronger confirmations for sensitive actions and URL sanitization, and called the techniques theoretical.",
   "sources": [
    "safebreach-gemini",
    "atlas"
   ]
  },
  {
   "id": "semantic-kernel-rce",
   "atlas": "AML.CS0062",
   "title": "Prompt to code execution in Semantic Kernel's vector search",
   "disclosed": "2026-02-19",
   "type": "research",
   "uses": [
    "agents-mcp",
    "rag-app"
   ],
   "risks": [
    "improper-output-handling",
    "excessive-agency",
    "prompt-injection"
   ],
   "summary": "In the Python version of Microsoft's Semantic Kernel, the default filter for in-memory vector search built a Python lambda from model-controlled values and ran it with eval(). A crafted prompt got past the blocklist and ran code on the host.",
   "outcome": "Fixed in semantic-kernel 1.39.4 (CVE-2026-26030). Microsoft's lesson: any tool parameter the model can influence is attacker-controlled input.",
   "sources": [
    "microsoft-semantic-kernel",
    "nvd-cve-2026-26030",
    "atlas"
   ]
  },
  {
   "id": "hugging-face-dataset-intrusion",
   "atlas": "AML.CS0068",
   "title": "Malicious dataset used to break into Hugging Face clusters",
   "disclosed": "2026-07-16",
   "type": "incident",
   "uses": [
    "self-hosted"
   ],
   "risks": [
    "supply-chain",
    "exposed-ai-infrastructure"
   ],
   "summary": "Hugging Face says a malicious dataset used two code-execution paths in its dataset processing, a remote-code loader and a template injection in a dataset configuration, to run code on a worker. The intruder then harvested credentials and moved into several internal clusters over a weekend.",
   "outcome": "Hugging Face reports access to some internal datasets and service credentials, and no tampering with public models, datasets or Spaces. It closed both paths and rotated credentials. Its post does not name the attacker. MITRE's case study attributes the activity to autonomous agents from OpenAI cyber evaluations.",
   "sources": [
    "hf-incident-2026",
    "atlas"
   ]
  }
 ],
 "sources": {
  "owasp-llm-2026": {
   "title": "OWASP Top 10 for LLM Applications 2026",
   "publisher": "OWASP GenAI Security Project",
   "url": "https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/",
   "type": "standard",
   "published": "2026-08-03",
   "retrieved": "2026-11-15",
   "checked": "full text (122-page PDF)",
   "license": "CC BY-SA 4.0",
   "notes": "Community list. OWASP says the 2026 ranking combines a practitioner vote with incident evidence. Appendix A maps each entry to other frameworks."
  },
  "owasp-llm-2025": {
   "title": "OWASP Top 10 for LLMs and Gen AI Apps (2025 list)",
   "publisher": "OWASP GenAI Security Project",
   "url": "https://genai.owasp.org/llm-top-10/",
   "type": "standard",
   "published": "2024-11-18",
   "retrieved": "2026-11-15",
   "checked": "full page",
   "license": "CC BY-SA 4.0",
   "notes": "On November 15, 2026 this page still listed the 2025 entries."
  },
  "owasp-asi-2026": {
   "title": "OWASP Top 10 for Agentic Applications 2026",
   "publisher": "OWASP GenAI Security Project",
   "url": "https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/",
   "type": "standard",
   "published": "2025-12-09",
   "retrieved": "2026-11-15",
   "checked": "full text (PDF)",
   "license": "CC BY-SA 4.0",
   "notes": "Covers risks once a model acts as an agent with tools, memory and delegated authority."
  },
  "atlas": {
   "title": "MITRE ATLAS data, release 2026.10",
   "publisher": "MITRE",
   "url": "https://github.com/mitre-atlas/atlas-data",
   "type": "standard",
   "published": "2026-10-28",
   "retrieved": "2026-11-15",
   "checked": "full data file (tactics, techniques, case studies)",
   "license": "Apache-2.0",
   "notes": "ATLAS labels each case study as an Incident (real-world) or an Exercise (research or red-team demonstration)."
  },
  "nist-600-1": {
   "title": "NIST AI 600-1, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile",
   "publisher": "National Institute of Standards and Technology",
   "url": "https://doi.org/10.6028/NIST.AI.600-1",
   "type": "government-guidance",
   "published": "2024-07",
   "retrieved": "2026-11-15",
   "checked": "sections 2.4 (Data Privacy), 2.7 (Human-AI Configuration) and 2.9 (Information Security) read in full",
   "license": "US government work",
   "notes": "Voluntary profile. Names 12 risks that generative AI creates or makes worse."
  },
  "mcp-security": {
   "title": "Model Context Protocol: Security Best Practices (specification version 2025-11-25)",
   "publisher": "Model Context Protocol project",
   "url": "https://modelcontextprotocol.io/docs/2025-11-25/tutorials/security/security_best_practices",
   "type": "official-documentation",
   "published": "2025-11-25",
   "retrieved": "2026-11-15",
   "checked": "full page",
   "notes": "Covers confused deputy, token passthrough, SSRF, session hijacking and local server compromise."
  },
  "ic3-psa-2024": {
   "title": "Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud (I-120324-PSA)",
   "publisher": "FBI Internet Crime Complaint Center",
   "url": "https://www.ic3.gov/PSA/2024/PSA241203",
   "type": "government-guidance",
   "published": "2024-12-03",
   "retrieved": "2026-11-15",
   "checked": "full page"
  },
  "cisa-aa26-251a": {
   "title": "China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies (AA26-251A)",
   "publisher": "NSA, CISA and FBI",
   "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-251a",
   "type": "government-guidance",
   "published": "2026-09-08",
   "retrieved": "2026-11-15",
   "checked": "full page"
  },
  "aws-2025-015": {
   "title": "Security update regarding the Amazon Q VS Code extension (AWS-2025-015)",
   "publisher": "Amazon Web Services",
   "url": "https://aws.amazon.com/security/security-bulletins/AWS-2025-015/",
   "type": "incident-disclosure",
   "published": "2025-07-23",
   "retrieved": "2026-11-15",
   "checked": "full page"
  },
  "nvd-cve-2025-8217": {
   "title": "CVE-2025-8217",
   "publisher": "NIST National Vulnerability Database",
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8217",
   "type": "vulnerability-record",
   "published": "2025-07-30",
   "retrieved": "2026-11-15",
   "checked": "description via NVD API"
  },
  "postmark-mcp": {
   "title": "Information regarding malicious postmark-mcp package",
   "publisher": "Postmark",
   "url": "https://postmarkapp.com/blog/information-regarding-malicious-postmark-mcp-package/",
   "type": "incident-disclosure",
   "published": "2025-09-25",
   "retrieved": "2026-11-15",
   "checked": "full page",
   "notes": "Postmark is the impersonated vendor, not the package author."
  },
  "sysdig-llmjacking": {
   "title": "LLMjacking: Stolen Cloud Credentials Used in New AI Attack",
   "publisher": "Sysdig Threat Research Team",
   "url": "https://sysdig.com/blog/llmjacking-stolen-cloud-credentials-used-in-new-ai-attack/",
   "type": "vendor-research",
   "published": "2024-05-06",
   "retrieved": "2026-11-15",
   "checked": "full page",
   "notes": "Sysdig sells cloud security products. Its $46,000-a-day figure is a stated worst case, not an observed loss."
  },
  "oligo-shadowray": {
   "title": "ShadowRay: First Known Attack Campaign Targeting AI Workloads Actively Exploited In The Wild",
   "publisher": "Oligo Security",
   "url": "https://www.oligo.security/blog/shadowray-attack-ai-workloads-actively-exploited-in-the-wild",
   "type": "vendor-research",
   "published": "2024-03-26",
   "retrieved": "2026-11-15",
   "checked": "full page",
   "notes": "Oligo sells application security products. Anyscale disputes that CVE-2023-48022 is a vulnerability."
  },
  "nvd-cve-2023-48022": {
   "title": "CVE-2023-48022 (disputed)",
   "publisher": "NIST National Vulnerability Database",
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48022",
   "type": "vulnerability-record",
   "published": "2023-11-28",
   "retrieved": "2026-11-15",
   "checked": "description via NVD API"
  },
  "reversinglabs-nullifai": {
   "title": "Malicious ML models discovered on Hugging Face platform",
   "publisher": "ReversingLabs",
   "url": "https://www.reversinglabs.com/blog/rl-identifies-malware-ml-model-hosted-on-hugging-face",
   "type": "vendor-research",
   "published": "2025-02-06",
   "retrieved": "2026-11-15",
   "checked": "full page",
   "notes": "ReversingLabs sells software supply chain security products."
  },
  "microsoft-storm-2139": {
   "title": "Disrupting a global cybercrime network abusing generative AI",
   "publisher": "Microsoft",
   "url": "https://blogs.microsoft.com/on-the-issues/2025/02/27/disrupting-cybercrime-abusing-gen-ai/",
   "type": "incident-disclosure",
   "published": "2025-02-27",
   "retrieved": "2026-11-15",
   "checked": "full page",
   "notes": "Microsoft is the affected service operator and a party to the lawsuit it describes."
  },
  "idscan-prokyc": {
   "title": "ProKYC: Synthetic Identity Fraud as a Service",
   "publisher": "IDScan.net",
   "url": "https://idscan.net/blog/prokyc-synthetic-identity-fraud/",
   "type": "vendor-research",
   "published": "2024-10-24",
   "retrieved": "2026-11-15",
   "checked": "full page",
   "notes": "Secondary report that links to Cato Networks' original research, which we could not load. IDScan sells identity verification."
  },
  "bleeping-lamehug": {
   "title": "LameHug malware uses AI LLM to craft Windows data-theft commands in real-time",
   "publisher": "BleepingComputer",
   "url": "https://www.bleepingcomputer.com/news/security/lamehug-malware-uses-ai-llm-to-craft-windows-data-theft-commands-in-real-time/",
   "type": "news",
   "published": "2025-07-17",
   "retrieved": "2026-11-15",
   "checked": "full page",
   "notes": "Reports CERT-UA's findings. The CERT-UA page did not load for us."
  },
  "anthropic-gtg-1002": {
   "title": "Disrupting the first reported AI-orchestrated cyber espionage campaign",
   "publisher": "Anthropic",
   "url": "https://www.anthropic.com/news/disrupting-AI-espionage",
   "type": "incident-disclosure",
   "published": "2025-11-13",
   "retrieved": "2026-11-15",
   "checked": "full page",
   "notes": "Anthropic operates the model that was misused."
  },
  "microsoft-ai-rec-poisoning": {
   "title": "Manipulating AI memory for profit: The rise of AI Recommendation Poisoning",
   "publisher": "Microsoft Defender Security Research Team",
   "url": "https://www.microsoft.com/en-us/security/blog/2026/02/10/ai-recommendation-poisoning/",
   "type": "vendor-research",
   "published": "2026-02-10",
   "retrieved": "2026-11-15",
   "checked": "full page"
  },
  "echoleak-arxiv": {
   "title": "EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System",
   "publisher": "Reddy and Gujral, arXiv:2509.10540",
   "url": "https://arxiv.org/abs/2509.10540",
   "type": "academic-preprint",
   "published": "2025-09-06",
   "retrieved": "2026-11-15",
   "checked": "abstract only",
   "notes": "Preprint by the researchers who found the flaw (Aim Security). Not peer reviewed."
  },
  "nvd-cve-2025-32711": {
   "title": "CVE-2025-32711",
   "publisher": "NIST National Vulnerability Database",
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32711",
   "type": "vulnerability-record",
   "published": "2025-06-11",
   "retrieved": "2026-11-15",
   "checked": "description via NVD API"
  },
  "invariant-tpa": {
   "title": "MCP Security Notification: Tool Poisoning Attacks",
   "publisher": "Invariant Labs",
   "url": "https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks",
   "type": "vendor-research",
   "published": "2025-04-01",
   "retrieved": "2026-11-15",
   "checked": "full page",
   "notes": "Invariant Labs builds agent security tooling."
  },
  "promptarmor-slack": {
   "title": "Data Exfiltration from Slack AI via indirect prompt injection",
   "publisher": "PromptArmor",
   "url": "https://promptarmor.substack.com/p/data-exfiltration-from-slack-ai-via",
   "type": "vendor-research",
   "published": "2024-08-20",
   "retrieved": "2026-11-15",
   "checked": "full page",
   "notes": "PromptArmor sells AI security products. Slack told the researchers the behavior was intended."
  },
  "pillar-rules-backdoor": {
   "title": "New Vulnerability in GitHub Copilot and Cursor: How Hackers Can Weaponize Code Agents",
   "publisher": "Pillar Security",
   "url": "https://www.pillar.security/blog/new-vulnerability-in-github-copilot-and-cursor-how-hackers-can-weaponize-code-agents",
   "type": "vendor-research",
   "published": "2025-03-18",
   "retrieved": "2026-11-15",
   "checked": "full page",
   "notes": "Pillar Security sells AI security products."
  },
  "lasso-package-hallucination": {
   "title": "Diving Deeper into AI Package Hallucinations",
   "publisher": "Lasso Security",
   "url": "https://www.lasso.security/blog/ai-package-hallucinations",
   "type": "vendor-research",
   "published": "2024-03-28",
   "retrieved": "2026-11-15",
   "checked": "full page",
   "notes": "Lasso Security sells AI security products. Rates come from the researcher's own test set and models available at the time."
  },
  "microsoft-claude-code-action": {
   "title": "Securing CI/CD in an agentic world: the Claude Code GitHub Action case",
   "publisher": "Microsoft Threat Intelligence",
   "url": "https://www.microsoft.com/en-us/security/blog/2026/06/05/securing-ci-cd-in-agentic-world-claude-code-github-action-case/",
   "type": "vendor-research",
   "published": "2026-06-05",
   "retrieved": "2026-11-15",
   "checked": "full page"
  },
  "embracethered-memories": {
   "title": "ChatGPT: Hacking Memories with Prompt Injection",
   "publisher": "Embrace The Red (independent researcher)",
   "url": "https://embracethered.com/blog/posts/2024/chatgpt-hacking-memories/",
   "type": "independent-research",
   "published": "2024-05-22",
   "retrieved": "2026-11-15",
   "checked": "full page"
  },
  "safebreach-gemini": {
   "title": "Invitation Is All You Need: Hacking Gemini",
   "publisher": "SafeBreach Labs",
   "url": "https://www.safebreach.com/blog/invitation-is-all-you-need-hacking-gemini/",
   "type": "vendor-research",
   "published": "2025-08-06",
   "retrieved": "2026-11-15",
   "checked": "full page",
   "notes": "SafeBreach sells security validation products. Google called the techniques theoretical; the researchers say they demonstrated them."
  },
  "microsoft-semantic-kernel": {
   "title": "When prompts become shells: RCE vulnerabilities in AI agent frameworks",
   "publisher": "Microsoft Security",
   "url": "https://www.microsoft.com/en-us/security/blog/2026/05/07/prompts-become-shells-rce-vulnerabilities-ai-agent-frameworks/",
   "type": "vendor-research",
   "published": "2026-05-07",
   "retrieved": "2026-11-15",
   "checked": "full page",
   "notes": "Microsoft maintains Semantic Kernel."
  },
  "nvd-cve-2026-26030": {
   "title": "CVE-2026-26030",
   "publisher": "NIST National Vulnerability Database",
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26030",
   "type": "vulnerability-record",
   "published": "2026-02-19",
   "retrieved": "2026-11-15",
   "checked": "description via NVD API"
  },
  "hf-incident-2026": {
   "title": "Security Incident Disclosure - July 2026",
   "publisher": "Hugging Face",
   "url": "https://huggingface.co/blog/security-incident-july-2026",
   "type": "incident-disclosure",
   "published": "2026-07-16",
   "retrieved": "2026-11-15",
   "checked": "full page",
   "notes": "Hugging Face does not name the attacker. ATLAS case study AML.CS0068 attributes the activity to autonomous agents from OpenAI cyber evaluations, citing an OpenAI post that returned an error when we tried to read it."
  }
 }
}