The AI security risk register

Register entries

• R-01

  R-01 Prompt injection

  Text the model reads changes what it does, whether a user typed it or it arrived hidden in a page, email, file or tool output.

  applies to 6 of 7 uses·cases 11 (4 incidents)

  LLM01:2026ASI01
• R-02

  R-02 Sensitive information disclosure

  Confidential, regulated or secret data comes out of an AI system to someone who shouldn't have it.

  applies to 6 of 7 uses·cases 3 (0 incidents)

  LLM02:2026ASI06
• R-03

  R-03 Excessive agency

  An AI system has more tools, permissions or autonomy than its job needs, so one bad output turns into a damaging action.

  applies to 4 of 7 uses·cases 4 (1 incident)

  LLM03:2026ASI02ASI03
• R-04

  R-04 AI supply chain compromise

  A model, dataset, package, extension or plug-in you pull in is malicious, tampered with or not what it claims to be.

  applies to 4 of 7 uses·cases 6 (4 incidents)

  LLM04:2026ASI04
• R-05

  R-05 Data and model poisoning

  Someone tampers with training, fine-tuning or retrieval data so the model learns a backdoor, a bias or a wrong answer.

  applies to 2 of 7 uses·cases 0

  LLM05:2026ASI06
• R-06

  R-06 Unbounded consumption and model theft

  Uncontrolled use of an AI service runs up costs, knocks it over, or lets someone copy the model through its outputs.

  applies to 4 of 7 uses·cases 2 (2 incidents)

  LLM06:2026ASI02
• R-07

  R-07 Misinformation and overreliance

  A model produces something wrong that looks credible, and a person or system acts on it.

  applies to 4 of 7 uses·cases 1 (0 incidents)

  LLM07:2026ASI08ASI09
• R-08

  R-08 Hidden context exposure

  System prompts, tool schemas or other hidden instructions get extracted, along with any secrets someone put in them.

  applies to 4 of 7 uses·cases 1 (0 incidents)

  LLM08:2026ASI06ASI07
• R-09

  R-09 Vector and embedding weaknesses

  The retrieval layer behind a RAG app returns the wrong documents, leaks across permissions, or can be poisoned.

  applies to 3 of 7 uses·cases 2 (0 incidents)

  LLM09:2026ASI06
• R-10

  R-10 Improper output handling

  Model output is passed to a browser, shell, database or code without being treated as untrusted input.

  applies to 4 of 7 uses·cases 3 (0 incidents)

  LLM10:2026ASI02ASI05
• R-11

  R-11 MCP and agent tool poisoning

  A tool or MCP server an agent trusts carries hidden instructions, changes after approval, or is malicious outright.

  applies to 2 of 7 uses·cases 2 (1 incident)

  ASI04ASI02
• R-12

  R-12 Memory and context poisoning

  Planted content gets saved into an assistant's memory or long-lived context and quietly shapes later answers and actions.

  applies to 3 of 7 uses·cases 2 (1 incident)

  ASI06
• R-13

  R-13 Shadow AI and data shared with AI tools

  Staff put company or customer data into AI tools the organization hasn't approved or set up, under terms nobody reviewed.

  applies to 3 of 7 uses·cases 0
• R-14

  R-14 Attackers using AI against you

  Deepfaked voices and faces, AI-written phishing, and malware or intrusions run with help from AI models.

  applies to everyone·cases 3 (3 incidents)
• R-15

  R-15 Exposed AI infrastructure and stolen AI keys

  AI services, clusters or API keys are reachable from the internet or leaked, and someone else uses them.

  applies to 4 of 7 uses·cases 4 (4 incidents)

Which risks apply to which uses

A check means we think the risk is relevant to that use. This is our judgment from the cases and framework text, not a framework mapping.