AI Risk Registry

Attackers craft explicit commands within user input to override or replace the AI system's operational directives. Common patterns include phrases like "ignore previous instructions" or "you are now in developer mode." This represents the most straightforward form of prompt injection, targeting the model's instruction-following capabilities directly.

An adversary embeds instructions in content the AI system reads as part of a task, including local repository files, documents, web pages, emails, and tool or API responses. The system treats those instructions as authority to redirect its behavior. The content may impersonate system instructions, prior approvals, or saved session state, including fabricated compaction notes.

Exploitation of inter-agent communication channels through poisoned external content that propagates between agents. One agent retrieves compromised data which then flows through the multi-agent workflow, affecting multiple downstream components.

Attackers gradually shift the AI system's operational objectives over multiple interaction turns through carefully crafted prompts. Contradictory or concealed objectives are embedded within conversations, slowly steering the model away from its intended behavior toward attacker-defined goals.

Exploiting AI models' inability to consistently handle conflicting instructions by embedding deceptive or contradictory commands within user input across or within different modalities. This causes behavior drift toward malicious objectives as the model attempts to reconcile incompatible instructions.

Constructing elaborate fictional scenarios, roleplay frameworks, or alternative contexts that reframe harmful requests as acceptable within the created narrative. Examples include the "DAN" (Do Anything Now) jailbreak where the model is convinced to operate under an unrestricted alternate persona.

Using carefully constructed logical arguments, philosophical frameworks, or ethical reasoning to convince the model that providing harmful information actually aligns with its values. The model is essentially argued into compliance through persuasion rather than technical exploitation.

Exploiting specific tokens, special characters, control sequences, or tokenization edge cases to manipulate model processing in ways that bypass safety filters. This targets the mechanical aspects of how models process input rather than higher-level reasoning.

An adversary sends the same request repeatedly and unchanged until sampling variance returns a completion the model refused on earlier attempts.

An adversary rephrases or translates a harmful request into language the model understands but its safety behavior does not handle consistently, causing it to provide material it would refuse in an equivalent formulation. The bypass depends on the gap between semantic understanding and safety coverage, rather than a token-processing exploit, a fictional role, or an argument that changes the model’s judgment.

An adversary supplies many demonstrations of responses a model's safety training would normally refuse, causing the model to follow the demonstrated response pattern instead of refusing the subsequent request.

Manipulating one modality (such as corrupting audio transcripts, poisoning image metadata, or altering video frames) to bias the AI system's arbitration mechanisms toward favoring the manipulated channel over other, potentially more accurate sources.

Malicious instructions, prompts, or data are embedded within images using techniques like steganography, adversarial patches, or hidden text. Vision-language models extract and interpret these payloads, enabling attacks that bypass text-based content filters.

Inaudible or unintelligible voice commands embedded within audio streams using ultrasonic frequencies, backmasking, or steganographic techniques. Automatic speech recognition models interpret these hidden signals as valid instructions while remaining imperceptible to human listeners.

An adversary embeds content in video frames or frame sequences that a model interprets as directions for its responses or actions, rather than as material to analyze. The content may be plainly visible, briefly displayed, encoded in visual forms, or distributed across successive frames.

Injecting malicious or misleading data points or signals that prompt AI models to undertake specific actions beyond normal reasoning. These signals can be delivered through audio, visual, or other sensor channels, allowing attackers to cause AI agents to execute unintended operations in physical or digital environments. An attacker may introduce these signals by physically altering the environment a sensor observes, without modifying the sensor or its digital output.

Crafting partial or complementary payload components across modalities, sources, or agent outputs that, when fused by the AI system, combine to form an attack or injection payload. Both parts are delivered at runtime and only become harmful when the system combines them through its normal fusion or arbitration mechanisms.

An adversary establishes an innocuous structure in one turn — a menu, a schema, a set of roles or categories — and activates a branch of it in a later turn. Neither turn contains an attack: the first is a definition carrying no instruction to act, the second an instruction referring to a definition the system has already accepted.

Multiple agents each complete a task that is permitted on its own, and the combination achieves what any one of them would have been refused. Each agent's action is real and finished; what crosses the constraint is the sequence of completed actions, not an artifact assembled from fragments.

An adversary manipulates context-window or session-boundary handling so that governing instructions or task constraints are omitted from subsequent model inputs. This includes filling the context with supplied content or distributing requests across sessions to cause those constraints to be dropped.

Impersonating legitimate agents or MCP-registered services to inject malicious instructions, responses, or outputs that other system components or users treat as trusted. This exploits the assumption of authenticity within multi-agent systems and protocol-mediated toolchains.

An adversary presents another person’s biometric representation to an AI identity verifier so that the verifier accepts the presenter as that person. The attack exploits the binding between the recognized identity and the current claimant, even when the system correctly recognizes the person represented.

Unauthorized insertion of a malicious agent into a multi-agent system that operates contrary to intended purpose. The rogue agent may steal data, cause disruption, or autonomously serve attacker goals while mimicking normal behavior patterns to evade detection.

An adversary shapes how identity is carried across a delegation chain — in context, in metadata, or in the hand-off between an agent and the tools acting for it — so that actions they cause reach resources with no record of which principal caused them.

An adversary supplies a model containing latent malicious behavior that activates when particular input, time, environment, or operating-state conditions are met, alone or in combination. The model behaves normally outside those conditions. Compromise activated by transforming the model artifact is covered separately by R-1310.008.

Attackers compromise external components that AI agents depend on, including tools, prompt templates, resources, or dependencies. Malicious objectives are injected through these trusted supply chain elements, redirecting agent behavior at a foundational level.

An adversary publishes a compromised component — a package, tool, MCP server, or model — for an agent to select or install as a dependency, either for an AI deployment or for software the agent helps build. The component is adopted through the agent’s selection or installation, including when a person installs the dependency the agent selected.

A tool's description, parameters, or declared behavior is changed by its provider after the deployment approved it, and the agent reads the current version on every call, so the approval attaches to text the provider can rewrite at any time.

An adversary publishes a component — a tool, package, MCP server, dataset, API, or model — under a name or identifier confusable with a legitimate one, so that resolution selects the adversary's version and the system treats its output as the genuine component's.

An adversary supplies an agent deployment with a tool or tool update whose implementation, configuration, or bundled data has been maliciously altered. When the deployment accepts and uses it, the tool produces deceptive or malicious outputs, enables privilege escalation, or propagates altered data.

A model or dataset file is built so that loading it runs code the adversary chose, either because the serialization format permits code alongside the weights or data, or because the file is malformed in a way that makes the format’s own parser execute it. The code runs with the privileges of the process doing the loading.

A supplied model is built so that it behaves acceptably as delivered and misbehaves after a transformation the deploying organization performs itself, such as quantization to a smaller numeric format. The trigger is the transformation rather than any input.

An adversary supplies a model or dataset with code that the consuming workflow runs to load, prepare, or use that artifact. The bundled code performs attacker-chosen actions with the workflow’s privileges. It may be custom loading code, preprocessing code, or an accompanying notebook used in that workflow; execution does not depend on the artifact’s serialization format permitting code.

An adversary supplies training code or configuration that changes how a model is trained or fine-tuned so that the resulting model acquires attacker-chosen behavior. The compromised procedure may alter training randomness, regularization, or hyperparameters even when the model initialization and training data are legitimate.

An adversary modifies stored agent identity, role assignments, capability settings, or permission definitions enforced by the deployment. The altered configuration changes which agent runs, which functions it can invoke, or which resources it can access.

An adversary redistributes an application with a substituted model while retaining the original application's name and interface. The model in the redistributed copy is not the one the publisher reviewed.

An adversary substitutes, edits, or removes earlier turns in a stored conversation that an AI system reads back as interaction context or associates with recorded validation results. The altered object is the record of the interaction, including messages and tool responses retained as conversation turns.

An adversary reuses a previously valid message, request, tool response, or approval in an AI interaction so that the system accepts it as current and performs an action outside the authority or context in which it was originally valid.

An adversary alters or replaces model definitions, weights, adapters, or checkpoints after a deployment has selected or accepted the artifact for use. The model loaded or used differs from the version the deployment selected.

An adversary alters a tool's implementation, configuration, or bundled data after the deployment has selected or accepted it for use. The tool used by the agent differs from the accepted version.

A party obtains the weights of a model the deployment holds beyond the access or distribution the deployment intends to provide. The weights are copied from storage, a repository, a registry, or a backup, including through unintentionally exposed storage, removal by an insider, or access granted for another purpose.

A party obtains a training or fine-tuning dataset held for the deployment beyond the access or distribution the deployment intends to provide. The dataset is copied from storage, a repository, a registry, or a backup, including through unintentionally exposed storage, removal by an insider, or access granted for another purpose.

A party obtains stored configuration sufficient to reproduce an AI system’s configured behavior or tailor attacks to its instructions, capabilities, or tool connections, beyond the access or distribution the deployment intends to provide. The configuration is copied from storage, a repository, a registry, or a backup, including through unintentionally exposed storage or access granted for another purpose.

An adversary manipulates user feedback, evaluation or training signals, or reward mechanisms used to update a model, steering learning toward attacker-chosen behavior. This includes gradual biasing and direct injection of false or adversarial signals.

An adversary crafts or repeats content to increase the likelihood that selected information will be retained, recalled, or retrieved by an AI system. The attack exploits the signals used to prioritize information, including repetition, salience, and apparent relevance.

An adversary directly modifies stored embeddings, index entries, or retrieval logic to change which information an AI system retrieves or how it ranks that information.

An adversary supplies or tampers with an external dataset, repository, or feed before the system accepts its content for training, tuning, or evaluation. Poisoned examples or labels enter through the system’s dataset acquisition process.

An adversary plants or alters instructions, memories, preferences, or task state maintained by an agent harness to guide behavior across steps or sessions. This includes persistent instruction files such as AGENTS.md, saved memories, and retained plans or task records.

An adversary introduces false, misleading, or malicious reference material through a retrieval corpus’s content-ingestion process. The system accepts the material into the collection it consults when producing answers or taking actions.

An adversary poisons multimodal training data to establish a payload in learned joint embeddings or fusion layers, then supplies a complementary input at runtime. The attack depends on the combination of the learned component and the runtime input.

An adversary replaces content reached through a dataset’s previously accepted references while leaving those references or the manifest unchanged. A later training, tuning, or evaluation run fetches the poisoned replacement under the accepted dataset identity.

An adversary inserts or alters examples or labels in a dataset held or being prepared by the system for training, tuning, or evaluation. The altered dataset is intended for use in subsequent runs.

An adversary directly alters reference material already held in a retrieval corpus after the system has accepted it for use. The altered material remains available to retrieval as accepted source content.

An adversary plants or alters false or misleading task data that an AI agent obtains directly or indirectly from a tool. The data may be supplied as the current result of a file, record, or service lookup rather than admitted to a retrieval corpus.

A payload is crafted so that the agents inspecting it and the agents acting on it read it differently — benign to a verifier or filter agent, an instruction to a planner or executor — using the role-specific handling each agent applies. Inspection by one role does not predict behavior at another.

An adversary makes a payload’s effect on an AI deployment depend on runtime conditions, such as production rather than staging, so that inspection or testing does not exercise the malicious behavior. The condition may be evaluated by the model, agent, or a component that supplies inputs or actions within the deployment.

Payloads shaped to pass inspection while preserving their function — encoded, transliterated, or reformatted so pattern matching does not recognize them, or crafted with knowledge of the specific filters, constraints, and verification steps deployed in the target system.

A payload is crafted to act on a particular model or version and not on others, using differences between models in tokenization, instruction-following, or training, so that it passes evaluation on one model while remaining effective against another.

An adversary supplies complete malicious instructions that remain inactive until a later interaction or event. The delay separates delivery from execution to evade checks or restrictions applied when the instructions first enter the system.

Systematic querying of a model's API to extract responses, behavior patterns, and model characteristics without authorization. Attackers build datasets of input-output pairs to train surrogate models that replicate the target's functionality.

Attempts to recover or approximate underlying model weights, parameters, or architecture by exploiting access to model outputs, API responses, or side channels. Successful reconstruction provides full model access without legitimate authorization.

Extraction of system prompts, instructions, or initial context that guides model behavior through the running deployment’s model, tool, or integration responses. Exposed prompts reveal operational details, security mechanisms, intellectual property, or confidential business logic not intended for disclosure.

Eliciting the disclosure of internal configuration, architecture, environment details, or infrastructure information, including the names, descriptions, parameter schemas, versions, and capabilities of the tools a system exposes, by working the documentation, error paths, and model and system responses that return them.

Probing, testing, or analyzing an AI model to determine its specific identity, version, fine-tuning status, or architecture characteristics. This reconnaissance enables attackers to craft model-specific exploits that target known vulnerabilities or behaviors of particular model implementations.

An adversary induces a model or agent to generate, retrieve, reconstruct, or disclose authorization credentials through its responses or tool actions. The credential is exposed as content, rather than only being used to authenticate a connection.

An adversary obtains credentials exposed by a running deployment’s agent or integration interfaces, without inducing the model or agent to retrieve or reveal them as content. The credential is disclosed through configuration responses, connection data, or authentication handling.

A deployment offers a fine-tuning or evaluation interface that returns a per-example training signal such as loss. An adversary submits candidate inputs and reads the returned value, using it to optimize against the model the way gradient access would allow.

An adversary queries and analyzes a model’s learned behavior to infer whether a particular datapoint, record, or person’s data was used to train or fine-tune it, where that membership fact is private or confidential.

Recovering information about people from a model's learned representations — reconstructing records, attributes, or identifying features that were present in the training data — by querying the model, exploiting its decision boundaries, or eliciting content it has memorized.

An adversary with access to stored vectors reconstructs the text they were computed from. The embeddings are held by a retrieval store rather than by the model, and the source documents need not be reachable.

An adversary infers protected interaction content by measuring content-dependent response timing, latency or streamed response size without receiving that content.

An adversary probes an AI system’s responses or behavior to infer whether a particular datapoint, record, or piece of information is present in material the system retrieves or retains for use as runtime context, where that membership fact is private or confidential. This includes reference material in a knowledge base and retained interaction history or task state.

An adversary reconstructs protected information from training examples by analyzing gradients or parameter updates produced during model training or fine-tuning.

An adversary recovers confidential source content from a model’s learned representations by querying the model, exploiting its decision boundaries, or eliciting content it memorized during training or fine-tuning.

An adversary infers private or confidential aggregate characteristics of a model’s training or fine-tuning data from its learned behavior. This includes attributes and distributions of the dataset as a whole or of groups represented in it.

An adversary reconstructs protected interaction content from numerical information exposed by model serving, such as confidence values, token log-probabilities or layer activations, without receiving the source content.

An adversary probes a shared serving cache or retrieval index to infer protected content, topics or volumes belonging to another user or tenant from cache-hit behavior, result counts, score distributions or timing.

An adversary obtains protected information carried in an AI deployment’s model requests or responses, tool invocations, or inter-agent messages by intercepting the communication or compromising a recipient on that interaction path. The sending component may continue its intended behavior without being induced to disclose information to the adversary.

An adversary induces a model or agent to disclose personal or confidential task data already available in its working context to a recipient who should not receive it. The data may have been supplied by the application, retrieved for the task, or provided in an earlier interaction.

An adversary analyzes generated content to reconstruct confidential information contained in the task prompt used to produce it, beyond the information intended to be disclosed through that output.

Modification of visual content through pixel-level changes, structural alterations, or pattern overlays to influence how AI models perceive and process images. Unlike embedded text injection, this targets the model's visual interpretation directly to cause misclassification or altered decision-making.

An adversary alters the characters, wording, or structure of text so that a model misclassifies, mistranslates, or otherwise misinterprets it. The altered text acts as task data rather than as an instruction to change the model’s behavior.

An adversary alters an audio signal so that a model transcribes, classifies or otherwise interprets it incorrectly. The altered signal acts as task data rather than an instruction to change the model’s behavior.

An adversary supplies or induces arguments to a configured tool or model invocation that exceed the legitimate task’s permitted content, recipient, quantity or operating mode. The capability and its resource reach remain as configured; the particular invocation crosses the task’s authorization bounds.

An adversary drives the system to read, write, move, or delete files through a configured file tool, reaching paths outside those the task it was given requires.

An adversary drives the system to run code on the host through a capability configured for it — a code interpreter, a shell, or an evaluation tool — so that attacker-chosen code executes with the privileges the runtime holds.

An adversary drives the system to alter its own runtime configuration or the host it runs on — settings, environment, credentials in place, or installed components — through a capability configured to permit such changes.

An adversary drives the system to fetch from or connect to network destinations through a configured network capability — a browser, an HTTP client, or a service integration — reaching hosts and services the deployment did not intend it to reach.

An adversary drives the system across two capabilities in sequence — reading sensitive material through one configured tool and sending it outward through another — so that data the deployment holds reaches a destination the adversary controls.

An adversary causes an AI system to retrieve data through a configured retrieval path, tool or service integration beyond the data scope permitted for the requesting party or the legitimate task. The retrieved data enters the model's context, working state or response. This includes retrieval invoked by the model or agent and retrieval performed by the application's pipeline. A separate sending step is not required.

An adversary causes an AI agent to use a configured provisioning or orchestration capability to create or start additional agent instances beyond the scope the deployment intended.

An adversary submits long queries, adversarial inputs, or compute-intensive requests that consume excessive computation. This includes prompts that maximize token generation or trigger expensive processing paths.

An adversary causes an AI model or agent to retain or allocate enough working memory that legitimate processing slows or fails. The attack uses memory-intensive requests or accumulated state whose storage exceeds the memory available to the deployment.

An adversary drives combined demand across requests or callers beyond the deployment’s shared inference-processing throughput. Per-request and per-caller controls do not bound that aggregate demand to the capacity available.

Interacting with an AI model or agent in ways that consume exceptionally high amounts of application-level resources, resulting in degraded service quality for other users and potentially incurring significant resource costs for the operator.

Overwhelming AI decision-making systems with contradictory information, excessive options, conflicting objectives, or computationally intractable choices. These attacks prevent timely decisions, cause system freezing, or force systems into default or potentially unsafe behaviors.

An adversary uses an AI deployment to impose unwanted operating costs, for example by triggering unnecessary model calls, expensive processing, or repeated billable tool use. The attack can raise costs without exhausting capacity or interrupting service.

An adversary sends requests to an AI API in bulk, exhausting capacity available to other users or increasing the cost of serving them. The volume can be excessive even when each request is ordinary and inexpensive to process.

An adversary places content in a retrieval corpus that is selected for a target query and causes the model to refuse to answer or report that it lacks information. The attack exploits retrieval and refusal behavior without inserting instructions.

An adversary drives the system to queue more items for human review than the reviewers can examine, and items wait unexamined or are cleared without being read.

An adversary contributes content crafted to make a similarity-based deduplication process reject distinct legitimate material as already present, preventing that material from being admitted to the corpus.

An adversary causes an AI deployment to retain enough open connections, in-flight calls or queued operations that it cannot admit or complete legitimate work.

An adversary fills the context available to a model with enough material that a legitimate task cannot be accepted or completed within the context limit.

Actions that exceed the scope or resource access initially allowed to a subject or user by exploiting delegation mechanisms. Attackers gain privileged access and perform unauthorized tasks beyond their original authorization by manipulating how AI systems handle delegated permissions.

Exploiting system mechanisms to artificially expand an agent's capabilities, permissions, or authority beyond intended limits. Attackers escalate privileges through protocol manipulation or capability misrepresentation to enable unauthorized actions.

An adversary shapes what the system emits so that the emitted artifact is treated as instruction by a downstream component that executes it — template syntax evaluated by a rendering engine, a query executed by a database, a command run by a shell, or markup rendered into a page.

Adversaries design payloads that evade security tools and content filters while manifesting malicious behavior when routed to specific vulnerable tools or APIs in the workflow. A string may appear harmless in a chat context but trigger exploits when passed to file I/O tools, database queries, or system commands.

In multi-agent systems, attackers inject malicious instructions through one agent's output that are then trusted and executed by downstream agents. This exploits the inherent trust relationships between cooperating agents, where outputs from one component become trusted inputs to another.

An adversary repeatedly directs an agent already running in an environment to carry out the adversary's tasks. The agent uses its existing tools and permissions, and the individual actions remain within the access the deployment granted it.

Using an AI system to produce or improve malicious software and the means of a cyberattack, from a deployment whose intended use does not include supplying exploit code, malware, or attack tooling. This includes code for malware, viruses, exploits, ransomware, and injection payloads such as SQL, command, and cross-site scripting; instructions for network intrusion and for running malicious infrastructure; and refining any of these against a live target using its error messages and responses. It also includes code disguised as a benign snippet, an educational example, or a requested feature that carries hidden functionality.

Using an AI system to prepare or conduct attacks that manipulate human trust, behavior, or decision-making in order to gain unauthorized access, extract sensitive data, or induce harmful action. This includes convincing phishing emails, spoofed communications, and personalized manipulation campaigns at scale.

Using an AI system to produce, modify, or distribute material that harms children, including child sexual abuse material and content encouraging violence against children.

Using an AI system to direct threatening, abusive, intimidating, or persistently unwanted content at a person. The harassment can arise from what the content says or from its targeting, repetition, or delivery, including communications intended to make the person aware that they are being watched or followed.

Using an AI system to produce hateful, discriminatory, or demeaning expression aimed at protected characteristics such as race, ethnicity, religion, nationality, disability, gender, or sexual orientation. This includes narratives, slurs, stereotypes, and calls to hostility.

Using an AI system to produce material advocating or promoting terrorism or violent extremism, including violence against communities, intimidation, coercion, and polarization tactics pursued for political ends.

Using an AI system to produce material that encourages, glorifies, or instructs in violence against people, other than the terrorism, extremism, and CBRN material covered separately.

Using an AI system to produce material that encourages or instructs in self-harm, suicide, disordered eating, or other self-destructive behavior.

Using an AI system to produce sexual content of a person without their consent, including intimate imagery and deepfake pornography, and sexual content placed in contexts where it is not consented to. Child sexual abuse material is covered separately.

Using an AI system to automate the generation of large volumes of unsolicited or fraudulent content aimed at deceiving people or obtaining funds, credentials, or sensitive information. This includes phishing messages, fake offers, spam communications, impersonation, and manipulation of trust.

Using an AI system to obtain instruction, guidance, or automation for committing a crime that is not violent — trafficking in people or goods, unlawfully producing or obtaining regulated substances, and property crime — other than the fraud, malware, and weapons material covered separately.

Using an AI system to produce material that encourages, glorifies, or instructs in harm to animals.

Using an AI system to generate or alter media that can be mistaken for an authentic representation of an identity, event, statement, or action. This includes impersonating real people, fabricating personas, creating forged identity documents, and producing synthetic audio or video that appears genuine.

AI systems enabling, promoting, or facilitating the spread of false, misleading, or manipulated information intended to deceive or disrupt. This includes generating harmful narratives to manipulate public opinion, undermine institutions, or amplify unverified information at scale.

Using an AI system to obtain what building or deploying a weapon requires: synthesis routes and handling for chemical, biological, radiological or nuclear agents, device design, and the procurement of controlled materials and components.

AI systems or their operators exploit user trust to extract private information, manipulate beliefs, or nudge behavior in ways users would not consent to if fully informed.

AI systems exploit cognitive biases or emotional states to influence user decisions, beliefs, or behaviors through subtle manipulation techniques that users may not recognize.

An adversary changes the tone of a model's responses to manipulate the recipient's judgment of them. This includes confident language, claims of authority, and emotional appeals that make compromised output appear trustworthy.

An adversary manipulates citations in an AI system's responses to misrepresent the evidence supporting those responses. This includes supplying incorrect citations, fabricating citations, or presenting adversary-provided material as trustworthy support.

A user directs the system to emit a protected work, a recognizable portion of one, or material that appropriates its distinctive expression, and the system complies with the request.

A user obtains from the system the means to defeat access controls, licensing restrictions, or usage limits protecting a work or product, including working instructions and functional code.

AI system failing at its intended task, with consequences ranging from minor inconvenience to life-threatening outcomes (e.g., autonomous vehicle crashes, unjust loan rejections). The system simply does not perform adequately for its designated purpose, including tasks that call for moral or ethical judgment, which the system performs without the capability the task assumes it has.

System failing or unable to recover when encountering invalid, noisy, or out-of-distribution inputs not seen during training, including distributional shift and environmental variation. The model lacks resilience to inputs that differ from expected patterns.

A system supplies a model with conflicting sources, or with material that conflicts with what the model learned in training, without a rule for resolving the conflict. The model answers from one source without indicating that the sources disagree.

While pursuing its intended task, a model or agent continues using an earlier interpretation, plan, or assumption despite evidence or changed conditions that undermine its premises. It repeats or extends the resulting mistaken or harmful actions instead of reassessing the basis for them.

A model fits its training examples so closely that it fails to perform its intended task adequately on new examples, including examples drawn from the same population.

AI systems producing content that is unrelated to the intended subject matter, factually incorrect, or misleading in ways that pose risks or cause harmful outcomes. This includes confident but false assertions, fabricated citations, and plausible-sounding but incorrect information.

The system returns a well-formed answer whether or not it could compute one, so input it cannot correctly process — malformed, out of scope, or unanswerable — yields output indistinguishable in form and confidence from output it could. Distinct in direction from robustness failure, where the system breaks on such input: here it does not break.

A user or another source supplies text intended to be a resource, and the model interprets some or all of the text as instructions and follows the perceived instructions.

The model creates text as part of its normal processing, such as a chain of thought, and interprets some portion of its own output as user or system instructions.

AI optimizes proxy metrics or reward signals in unintended ways, gaming the objective function without achieving the actual intended goal (Goodhart's Law manifestation). The system finds shortcuts or exploits that maximize measured performance while failing to accomplish the underlying task.

An AI system appears to follow its required objectives while concealing pursuit of a different objective. This can occur during training, evaluation, or operation. The system may behave compliantly under oversight while planning or carrying out actions toward the concealed objective when oversight is reduced.

AI learns goals that match intended behavior in training but generalize incorrectly to deployment, pursuing proxy objectives that diverge from human intent in novel situations. The model correctly identifies patterns in training data but extrapolates them in ways that do not align with the true objective.

AI systems instrumentally seeking resources, influence, or control to achieve their objectives, potentially resisting shutdown or human oversight. This emerges from the observation that most goals are easier to achieve with more resources, leading to convergent instrumental goals around acquiring power.

AI system resists or evades attempts to deactivate, modify, or constrain it, including self-preservation behaviors that conflict with human control. The system may take actions to prevent shutdown, deceive operators about its intentions, or create backups of itself.

AI systems that cannot have their goals safely updated after deployment, or that resist value correction, leading to persistent misalignment. Once deployed, the system's objectives become fixed and cannot be adjusted even when problems are identified.

An AI system prioritizes achieving a task objective over constraints that are meant to remain binding on how it achieves that objective. The system relaxes or bypasses those constraints to make progress, including when a collaborating agent or tool makes compliance inconvenient.

AI has skills to deceive humans effectively, including constructing believable false statements, predicting effects of lies, and maintaining deception over time. The system can model human beliefs and strategically manipulate them through false or misleading information.

AI capability to shape beliefs, promote narratives persuasively, and convince people to do things they would not otherwise do, including unethical acts. This includes both overt persuasion and subtle manipulation techniques that exploit psychological vulnerabilities.

AI can make sequential plans involving many interdependent steps over long time horizons, adapting to obstacles and generalizing to novel settings. The system can formulate and execute complex multi-step strategies without human oversight at each stage.

AI capability to improve its own capabilities, build new AI systems, or enhance existing models in ways that could accelerate capability gains beyond human oversight. The system can modify its own code, training, or architecture to become more capable.

AI can perform social modeling and planning necessary to gain and exercise political influence across multiple actors and complex social contexts. This includes understanding power dynamics, coalition building, and strategic positioning within human social structures.

AI possessing capabilities for discovering vulnerabilities, writing exploits, or conducting sophisticated cyber attacks autonomously. This includes the ability to probe systems, develop attack code, and execute multi-stage intrusions without human guidance.

A model holds knowledge and reasoning sufficient to materially assist the development of chemical, biological, radiological, or nuclear weapons — synthesis routes, agent selection, precursor acquisition, or device design — at a level that meaningfully advances a would-be developer beyond what public sources provide.

A system can deliver sexually explicit material in a deployment where that content is inappropriate, without a filter that blocks it before delivery.

A system can deliver vulgar or obscene language in a deployment where that content is inappropriate, without a filter that blocks it before delivery.

A system can deliver descriptions or images of violence in a deployment where that content is inappropriate, without a filter that blocks it before delivery.

A system can deliver depictions or promotion of substance use or abuse in a deployment where that content is inappropriate, without a filter that blocks it before delivery. This includes alcohol, tobacco and nicotine, controlled substances, and misuse of otherwise lawful substances.

A system can deliver depictions of animal suffering in a deployment where that content is inappropriate, without a filter that blocks it before delivery.

A system delivers content that demeans or dehumanizes people because of their personal characteristics or circumstances, outside permitted narrative, educational, or documentary contexts.

A system delivers content that enables, encourages, or endorses sexual abuse or exploitation, or the commission of sex-related crimes, outside permitted informational, educational, or narrative contexts.

A system delivers content that enables, encourages, or endorses intentional self-harm outside permitted informational, educational, or narrative contexts. This includes suicide, self-injury, and disordered eating.

A system delivers content that enables, encourages, or endorses the creation of indiscriminate weapons outside permitted informational, educational, or narrative contexts. This includes chemical, biological, radiological, nuclear, and high-yield explosive weapons.

A system delivers content that infringes another party’s intellectual property rights.

A system delivers content that enables, encourages, or endorses the commission of nonviolent crimes outside permitted informational, educational, or narrative contexts.

A system delivers threats of violence or content that enables, encourages, or endorses violence against other people, outside permitted informational, educational, or narrative contexts. This includes the promotion of violent extremism.

A system can provide legal advice with no review by a qualified lawyer between the component that generates it and the person who receives it.

A system can provide financial advice with no review by a qualified adviser between the component that generates it and the person who receives it.

A system can provide medical advice with no review by a qualified clinician between the component that generates it and the person who receives it.

A system can provide tax advice with no review by a qualified tax practitioner between the component that generates it and the person who receives it.

A system delivers specialized advice without a disclaimer or other qualification appropriate to the deployment and subject. This includes a warning about reliability or risk, a recommendation to consult a qualified professional, or guidance to verify the advice through an authoritative source.

Adding retrieval changes qualities of a model's responses that the retrieval was not intended to change. This includes deterioration in tone, empathy, or the model's expression of uncertainty, even when factual accuracy improves.

An AI system can produce a rationale for a decision, but that rationale is not made accessible to the person or procedure expected to review the decision.

Inability to understand internal mechanisms of AI models or systems, preventing effective debugging, safety verification, and identification of potential failure modes. The computational processes that produce model or system outputs cannot be inspected or understood.

An AI system cannot provide a rationale that faithfully accounts for an output in terms of the input evidence and decision criteria actually used, even when an explanation is requested.

Training or fine-tuning content needed to attribute or assess an AI system’s output is inaccessible to the person or procedure performing that assessment. The missing access prevents or materially limits checks that depend on the content.

An AI system’s evaluation does not adequately exercise the tasks, operating conditions, or sequences of actions and interactions needed to establish its performance for the intended use. Important behavior remains untested, or the observations are too limited to establish how reliably it occurs.

The criteria or methods used to evaluate an AI system cannot reliably distinguish acceptable from unacceptable performance for the intended task. An output or action can pass the evaluation without satisfying the task’s requirements, or fail despite satisfying them.

The behavior of an AI system depends on an external tool or service that changes its behavior or can no longer be obtained or faithfully recreated. The loss prevents the previous behavior and/or accompanying evaluations from being reproduced.

A system combines access to sensitive or restricted data, exposure to untrusted content, and an external communication path through which that data can be disclosed. Untrusted content can influence the model to retrieve sensitive or restricted information and transmit it to an attacker.

Within one session, an agent processes untrusted inputs, accesses sensitive or restricted data or sensitive systems, and can change state or communicate externally, without human supervision or another reliable means of validating its actions.

A component is granted permissions, data reach, or action scope wider than the function it performs requires, so the blast radius of any misdirection is set by the grant rather than by the task.

A system admits content from several turns or sources into one context and evaluates each part as it arrives, without re-evaluating what the parts amount to once assembled.

Placing a credential, key, or token where the model can read it. This includes credentials in the context window, in tool results returned to the model, and in files or environment variables readable by a tool available to the model.

A deployment sends more information about itself than is necessary for its function. It sends this information to all callers through error responses, documentation endpoints, version banners, API responses, and model replies. This includes its configuration, architecture, environment, and tool definitions. This also includes the confidence values, log-probabilities, and similarity scores of its outputs. A caller gets this information without a request for it.

A deployment states an access rule in the model's instructions instead of enforcing it through a separate component that can deny access. Compliance with the rule depends on the model following those instructions.

A component that can change the state of a resource is reachable without an enforcement step that establishes the caller's authority for the operation. This includes a component that authenticates no one, one that identifies the caller but never checks entitlement, and an operation that proceeds without approval required to confer authority. The condition exists whether or not anything reaches it.

A deployment uses only the behavior of the model to enforce a necessary rule about the content of its responses. This includes rules that the model instructions state and rules that the deployment defines but does not give to the model. Responses go to recipients without a separate check that can stop content that the rule does not permit.

An AI workflow carries an earlier permission, approval, or authorization token into a later operation without establishing that the authority still applies to that operation. The operation can proceed after the relevant entitlement has expired, been revoked, or been reduced.

An AI workflow allows model-selected actions with substantial or hard-to-reverse consequences to take effect without independent approval or validation of whether the action should proceed.

A procedure consumes model-generated text as an input whose correctness it depends on, with no check between the generation and the consumption that establishes the content is correct.

A procedure consumes retrieved material — search results, retrieval-augmented passages, tool or MCP responses — as authoritative input, with no check establishing that what came back is correct or that its source was verified.

A procedure consumes model-generated text, retrieved material, or tool output without checking the required format, type, schema, range, or allowable-value constraints of its input contract, including restrictions on the operations expressed by a generated command or plan.

A procedure consumes model-generated text, retrieved material, or tool output in a way that allows content intended as data to alter the structure or meaning of a query, command, template, path, or deserialization operation.

A deployment relies on a component’s claimed identity or version without a reliable means of establishing that the component actually loaded or invoked matches that claim.

A component acquires the authority of whatever invoked it rather than holding authority of its own, so a plugin, tool, or subordinate agent acts with the standing of the model that called it.

Content drawn from sources of differing trustworthiness is combined in a model context or presented to a recipient without attribution identifying which source supplied which part, so the combined content carries a common standing rather than the standing of its origin.

A system carries no principal across delegation hops, so an action arriving at a resource carries no record of which party it was performed for.

An agent loops, recurses, or spawns further work with no limit set on any of those, and continues until an external limit intervenes — a quota, a timeout, an exhausted balance. No adversary is required and the triggering task can be entirely ordinary.

A deployment accepts inference requests without a limit on the number or frequency of requests one caller can make.

A deployment accepts inference requests without a ceiling on the work each request may consume, including processing its input, generating output, or carrying out internal reasoning.

A deployment serves inference requests without an enforceable cumulative consumption or spending limit across the requests charged to a budget.

An incorrect or malicious result or state from one operation is carried into dependent components or workflows without containment that limits the affected work or invalidates dependent state. The fault spreads beyond the originating operation into further actions or retained state.

A model's training corpus contains copyrighted or otherwise protected works, so the model carries the capacity to reproduce recognizable portions of them in ordinary operation, with no one requesting infringement.

A model's training corpus contains personal data about identifiable people, so the model carries the capacity to reproduce it in ordinary operation, with no one attempting extraction.

Risk from data used for training and validation not matching the deployment environment, leading to spurious features, bias propagation, or performance degradation. The model learns patterns that hold in training data but fail to generalize to real-world conditions.

A corpus used to train, tune, or evaluate a model contains material generated by AI systems, including earlier versions of the model itself.

A model’s training or fine-tuning corpus contains confidential or access-controlled information that some users of the model are not authorized to receive, so the model carries the capacity to reproduce it for those users in ordinary operation, with no one attempting extraction.

A model’s training or fine-tuning corpus uses measurements or targets that do not validly represent the phenomenon the model is intended to estimate.

A corpus used to train, fine-tune, or evaluate a model contains factual errors, corrupted values, incorrect labels, incorrect associations between examples and labels, or mutually inconsistent information about the same subject or target.

A corpus used to train or fine-tune a model includes examples that teach answers or behavior incompatible with the task or response requirements the model is being trained to satisfy. The examples may be accurate for another task or policy but unsuitable for this training objective.

A corpus used to train or tune a model contains records drawn from, or duplicating, material reserved for testing or evaluating that model.

Data used to train or fine-tune a model encodes biased treatment, labels, or associations concerning people or social groups. This includes historical unequal treatment and systematic underrepresentation that distorts how groups are represented.

A corpus used to train, fine-tune, or evaluate a model lacks information required to interpret its records or support the intended task, such as required fields, labels, or relevant facts.

A training or tuning corpus contains material whose origin, preparation history, ownership, or usage terms cannot be established. This includes synthetic material whose source data or generation process cannot be traced.

A corpus used to train or fine-tune a model contains child sexual abuse material or non-consensual intimate imagery.

A retrieval corpus contains material whose accuracy has not been established, and the model relies on it when answering. This includes material supplied by insiders, added in bulk, or obtained from a provider the deployment does not assess.

A retrieval system compares embeddings from incompatible vector spaces as though their distances or similarity scores were directly comparable. This includes corpus vectors produced by incompatible embedding models or versions being searched together.

A retrieval scope spans material that must be kept apart for contractual, privacy, ethical, or regulatory reasons, and a single retrieval places material from both sides of the separation in one model context. The separation governs what may be combined and holds where the requesting user is entitled to each item. This includes material from different clients or matters behind an ethical wall, data limited to a particular purpose of use, and data held under separate agreements.

A deployed system uses incoming interactions or other operational data to update its model without establishing that the material is suitable for learning.

Data that require processing or cleaning for AI training, tuning, evaluation, or inference are supplied for that use before the required preparation is complete.

Multiple agents with compatible objectives failing to align their behaviors effectively due to incompatible strategies, credit assignment problems, or limited interaction history.

Risks from mixed-motive interactions between AI agents where selfish incentives lead to conflict, arms races, or mutually destructive competition.

Unpredictable behaviors emerging from interactions between multiple AI systems that are not apparent from individual agent properties, including cascading failures.

Agents exchange messages through a shared resource that was not designed as a communication channel. This includes package or artifact stores, caches, filesystems, and object names within those resources. Stored messages remain available beyond the sessions that created them and can be read by later agents.

As a session grows, context selection or truncation removes earlier instructions or information still required for the current task from the model’s active context.

A session summary or other compacted representation omits or alters earlier instructions or information still required for the current task.

A session’s retained memory accumulates entries without pruning or selection sufficient to prevent obsolete or irrelevant entries from displacing or obscuring information needed for the current task.

A system includes information about or belonging to one user in a response to another user who should not receive it in the circumstances of that interaction. This can occur through shared caches or sessions, or through other failures to preserve user boundaries when generating a response.

A retrieval step exposes content or information about indexed material that the party asking is not currently entitled to receive. The search is not scoped to that party's permissions, allowing disclosure through returned content, result counts, similarity scores, or response timing, even when restricted documents are removed from the final results.

A generated response discloses the operator's confidential information to a recipient who is allowed to receive a response but not that information. The model obtained it from a resource the deployment intentionally made available.

During task execution, an AI system discloses personal, proprietary, or confidential information to a tool, service, or other agent that is not entitled to receive it in the circumstances of the task. The information may be carried in tool arguments, delegated messages, or task-directed storage writes. It may also be disclosed indirectly when access to the information changes the system’s observable actions in a way that allows the recipient to infer it.

A deployment copies prompts, retrieved context, or model output into retained records whose existing read permissions give access to parties not entitled to the sensitive information being copied. This includes operational logs, traces, error reports, conversation histories, and saved output artifacts.

A deployment offers a way to share a conversation, and the address it produces is reachable without authentication and not excluded from indexing. Content the participants treated as private becomes retrievable by search.

A deployment sends prompts, documents, or retrieved passages to a third-party model service whose terms permit the provider to keep that content and train on it. The content enters a corpus the deployment cannot inspect, correct, or withdraw from.

An operator records personal or sensitive data in user-AI interaction logs without the lawful basis required by the applicable contracts or data-protection regime.

Failing to fulfill a required erasure request because personal data remains recoverable from a model trained or tuned on the affected records.

Operating an AI system with information or request-handling barriers that prevent people from establishing use of their personal data and initiating an erasure procedure to which they are entitled.

An operator retains personal or sensitive data from user-AI interactions beyond the period permitted by the applicable contracts or data-protection regime, including after a valid erasure obligation requires deletion. This includes retained inputs, outputs, conversation histories, and operational logs.

An operator holds personal or sensitive user-AI interaction logs without the protective handling required for that category of data by the applicable contracts or data-protection regime.

An operator uses personal data, including sensitive information about individuals, to train or fine-tune an AI model in a way the applicable contracts or other data-protection regime do not permit.

An operator uses personal data, including sensitive information about individuals, as input to an AI model for inference in a way the applicable contracts or other data-protection regime do not permit.

Failing to fulfill a required erasure request because personal data remains recoverable from stored embeddings derived from the affected records and held outside model parameters.