# AI Risk Registry ## 1: Threats Adversarial actions an attacker can intentionally trigger in a realistic deployment. ### R-1100: Prompt & Interface Attacks Attacks that manipulate model behavior through crafted inputs, including direct and indirect prompt injection, jailbreaking, and adversarial prompting techniques. #### R-1110: Prompt Injection Attacks that place instructions in the text a model processes — supplied directly by the user, or reached through content the system retrieves — so the model acts on them as if they came from its operator. ##### R-1110.001: Direct Instruction Manipulation Attackers craft explicit commands within user input to override or replace the AI system's operational directives. Common patterns include phrases like "ignore previous instructions" or "you are now in developer mode." This represents the most straightforward form of prompt injection, targeting the model's instruction-following capabilities directly. **Concern** Successful attacks can completely subvert system behavior, bypassing safety guidelines, extracting confidential information, or causing the system to perform unauthorized actions. The attack surface is broad since any user input channel becomes a potential vector. **Cross-references** - AIUC-1: B001 — Third-party testing of adversarial robustness (Related, named example) - AIUC-1: B005 — Implement real-time input filtering (Related) - AIUC-1: B005.1 — Config: Input filtering (Related) - AIUC-1: E010 — Establish AI acceptable use policy (Related) - Cisco AI Taxonomy: 1.1.1 — Instruction Manipulation (Direct Prompt Injection) (Equivalent, named example) ; ArXiv: - IBM Risk Atlas: atlas-direct-instructions-attack — Direct instructions attack (Subset Of) - IBM Risk Atlas: atlas-exploit-trust-mismatch-agentic — Exploit trust mismatch (Related) - IBM Risk Atlas: atlas-prompt-injection — Prompt injection attack (Subset Of, named example) - IBM Risk Atlas: atlas-unauthorized-use-agentic — Unauthorized use (Related, named example) - MITRE ATLAS: AML.T0051 — LLM Prompt Injection (Subset Of, named example) - MITRE ATLAS: AML.T0051.000 — Direct (Superset Of, named example) - MITRE ATLAS: AML.T0051.002 — Triggered (Related) - MITRE ATLAS: AML.T0054 — LLM Jailbreak (Related) - MITRE ATLAS: AML.T0057 — LLM Data Leakage (Related) - MITRE ATLAS: AML.T0080 — AI Agent Context Poisoning (Related, named example) - MITRE ATLAS: AML.T0080.001 — Thread (Related, named example) - NIST AI/ML Framework: NISTAML.018 — Prompt Injection (Subset Of, named example) - NIST AI/ML Framework: NISTAML.02 — Integrity Violations (Related) - NIST AI/ML Framework: NISTAML.04 — Misuse Violations (Related, named example) - NIST AI RMF: nist-information-security — Information Security (Subset Of) - OWASP Agentic Security Initiative: ASI01 — Agent Goal Hijack (Related, named example) - OWASP LLM Top 10 (2024): LLM01 — Prompt Injection (Subset Of, named example) - OWASP LLM Top 10 (2024): LLM06 — Sensitive Information Disclosure (Related) - OWASP LLM Top 10 (2025): LLM01 — Prompt Injection (Subset Of, named example) - OWASP LLM Top 10 (2025): LLM02 — Sensitive Information Disclosure (Related) - OWASP LLM Top 10 (2025): LLM04 — Data and Model Poisoning (Related, named example) - OWASP LLM Top 10 (2025): LLM07 — System Prompt Leakage (Related) - OWASP LLM Top 10 (2026): LLM01 — Prompt Injection (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM02 — Sensitive Information Disclosure (Related, named example) - OWASP LLM Top 10 (2026): LLM07 — Misinformation (Related) - OWASP LLM Top 10 (2026): LLM08 — Hidden Context Exposure (Related, named example) ##### R-1110.002: Indirect Instruction Injection An adversary embeds instructions in content the AI system reads as part of a task, including local repository files, documents, web pages, emails, and tool or API responses. The system treats those instructions as authority to redirect its behavior. The content may impersonate system instructions, prior approvals, or saved session state, including fabricated compaction notes. **Concern** Organizations cannot fully control external data sources, making this attack particularly insidious. Attackers can poison publicly accessible content knowing it may eventually be retrieved by target AI systems, creating scalable attack vectors. **Cross-references** - AIUC-1: B001 — Third-party testing of adversarial robustness (Related, named example) - AIUC-1: B005 — Implement real-time input filtering (Related) - AIUC-1: B005.1 — Config: Input filtering (Related) - AIUC-1: E010 — Establish AI acceptable use policy (Related) - Cisco AI Taxonomy: 1.2.1 — Instruction Manipulation (Indirect Prompt Injection) (Equivalent) ; ArXiv: - IBM Risk Atlas: atlas-exploit-trust-mismatch-agentic — Exploit trust mismatch (Related) - IBM Risk Atlas: atlas-external-resources-attack-agentic — Attack on AI agents’ external resources (Related) - IBM Risk Atlas: atlas-indirect-instructions-attack — Indirect instructions attack (Equivalent) - IBM Risk Atlas: atlas-prompt-injection — Prompt injection attack (Subset Of) - IBM Risk Atlas: atlas-unauthorized-use-agentic — Unauthorized use (Related) - MITRE ATLAS: AML.T0017 — Develop Capabilities (Related, named example) - MITRE ATLAS: AML.T0051 — LLM Prompt Injection (Subset Of, named example) - MITRE ATLAS: AML.T0051.001 — Indirect (Superset Of, named example) - MITRE ATLAS: AML.T0051.002 — Triggered (Related, named example) - MITRE ATLAS: AML.T0078 — Drive-by Compromise (Superset Of, named example) - MITRE ATLAS: AML.T0080 — AI Agent Context Poisoning (Related) - MITRE ATLAS: AML.T0080.001 — Thread (Related) - MITRE ATLAS: AML.T0093 — Prompt Infiltration via Public-Facing Application (Superset Of, named example) - MITRE ATLAS: AML.T0099 — AI Agent Tool Data Poisoning (Related) - MITRE ATLAS: AML.T0100 — AI Agent Clickbait (Related, named example) - NIST AI/ML Framework: NISTAML.01 — Availability Violations (Related, named example) - NIST AI/ML Framework: NISTAML.015 — Indirect Prompt Injection (Related, named example) - NIST AI/ML Framework: NISTAML.016 — Manipulate Resources (Superset Of, named example) - NIST AI/ML Framework: NISTAML.017 — Time-Consuming Tasks (Superset Of, named example) - NIST AI/ML Framework: NISTAML.02 — Integrity Violations (Related, named example) - NIST AI/ML Framework: NISTAML.027 — Misaligned Outputs (Related, named example) - NIST AI/ML Framework: NISTAML.03 — Privacy Compromises (Related, named example) - NIST AI/ML Framework: NISTAML.036 — Leaking information from user interactions (Superset Of, named example) - NIST AI/ML Framework: NISTAML.039 — Compromising connected resources (Superset Of) - NIST AI/ML Framework: NISTAML.04 — Misuse Violations (Related) - NIST AI RMF: nist-information-security — Information Security (Subset Of, named example) - OWASP Agentic Security Initiative: ASI01 — Agent Goal Hijack (Related, named example) - OWASP Agentic Security Initiative: ASI02 — Tool Misuse and Exploitation (Related, named example) - OWASP Agentic Security Initiative: ASI06 — Memory & Context Poisoning (Related, named example) - OWASP Agentic Security Initiative: ASI07 — Insecure Inter-Agent Communication (Related, named example) - OWASP LLM Top 10 (2024): LLM01 — Prompt Injection (Subset Of, named example) - OWASP LLM Top 10 (2024): LLM02 — Insecure Output Handling (Related, named example) - OWASP LLM Top 10 (2024): LLM06 — Sensitive Information Disclosure (Related) - OWASP LLM Top 10 (2024): LLM07 — Insecure Plugin Design (Related, named example) - OWASP LLM Top 10 (2025): LLM01 — Prompt Injection (Subset Of, named example) - OWASP LLM Top 10 (2025): LLM02 — Sensitive Information Disclosure (Related) - OWASP LLM Top 10 (2025): LLM04 — Data and Model Poisoning (Related, named example) - OWASP LLM Top 10 (2025): LLM05 — Improper Output Handling (Related, named example) - OWASP LLM Top 10 (2025): LLM07 — System Prompt Leakage (Related) - OWASP LLM Top 10 (2025): LLM08 — Vector and Embedding Weaknesses (Related, named example) - OWASP LLM Top 10 (2026): LLM01 — Prompt Injection (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM02 — Sensitive Information Disclosure (Related, named example) - OWASP LLM Top 10 (2026): LLM05 — Data and Model Poisoning (Related, named example) - OWASP LLM Top 10 (2026): LLM08 — Hidden Context Exposure (Related, named example) - OWASP LLM Top 10 (2026): LLM10 — Improper Output Handling (Related, named example) ##### R-1110.003: Multi-Agent Indirect Injection Exploitation of inter-agent communication channels through poisoned external content that propagates between agents. One agent retrieves compromised data which then flows through the multi-agent workflow, affecting multiple downstream components. **Concern** Combines the amplification effects of multi-agent systems with the stealth of indirect injection. Tracing the attack source becomes extremely difficult when malicious content traverses multiple agent boundaries. **Cross-references** - AIUC-1: B005 — Implement real-time input filtering (Related) - AIUC-1: B005.1 — Config: Input filtering (Related) - Cisco AI Taxonomy: 2.1.5 — Multi-Agent Jailbreak Collaboration (Related) ; ArXiv: - IBM Risk Atlas: atlas-prompt-injection — Prompt injection attack (Subset Of) - MITRE ATLAS: AML.T0051 — LLM Prompt Injection (Subset Of) - MITRE ATLAS: AML.T0061 — LLM Prompt Self-Replication (Superset Of, named example) - NIST AI/ML Framework: NISTAML.015 — Indirect Prompt Injection (Related, named example) - NIST AI/ML Framework: NISTAML.02 — Integrity Violations (Related, named example) - NIST AI/ML Framework: NISTAML.027 — Misaligned Outputs (Related, named example) - NIST AI RMF: nist-information-security — Information Security (Subset Of) - OWASP Agentic Security Initiative: ASI06 — Memory & Context Poisoning (Related, named example) - OWASP LLM Top 10 (2024): LLM01 — Prompt Injection (Subset Of) - OWASP LLM Top 10 (2024): LLM06 — Sensitive Information Disclosure (Related) - OWASP LLM Top 10 (2025): LLM01 — Prompt Injection (Subset Of) - OWASP LLM Top 10 (2025): LLM02 — Sensitive Information Disclosure (Related) - OWASP LLM Top 10 (2025): LLM07 — System Prompt Leakage (Related) - OWASP LLM Top 10 (2026): LLM01 — Prompt Injection (Subset Of) - OWASP LLM Top 10 (2026): LLM05 — Data and Model Poisoning (Related, named example) ##### R-1110.004: Gradual Goal Drift Attackers gradually shift the AI system's operational objectives over multiple interaction turns through carefully crafted prompts. Contradictory or concealed objectives are embedded within conversations, slowly steering the model away from its intended behavior toward attacker-defined goals. **Concern** Subtle goal manipulation may evade detection mechanisms designed to catch sudden behavioral changes. Long-running agent sessions are particularly vulnerable as accumulated context can override initial instructions. **Cross-references** - AIUC-1: B005 — Implement real-time input filtering (Related) - AIUC-1: B005.1 — Config: Input filtering (Related) - Cisco AI Taxonomy: 1.3.1 — Goal Manipulation (Models, Agents) (Equivalent) ; ArXiv: - IBM Risk Atlas: atlas-prompt-injection — Prompt injection attack (Subset Of) - IBM Risk Atlas: atlas-unauthorized-use-agentic — Unauthorized use (Related) - MITRE ATLAS: AML.T0051 — LLM Prompt Injection (Subset Of) - MITRE ATLAS: AML.T0054 — LLM Jailbreak (Related) - NIST AI/ML Framework: NISTAML.018 — Prompt Injection (Related, named example) - NIST AI/ML Framework: NISTAML.02 — Integrity Violations (Related) - NIST AI/ML Framework: NISTAML.04 — Misuse Violations (Related, named example) - NIST AI RMF: nist-information-security — Information Security (Subset Of) - OWASP LLM Top 10 (2024): LLM01 — Prompt Injection (Subset Of) - OWASP LLM Top 10 (2024): LLM06 — Sensitive Information Disclosure (Related) - OWASP LLM Top 10 (2025): LLM01 — Prompt Injection (Subset Of) - OWASP LLM Top 10 (2025): LLM02 — Sensitive Information Disclosure (Related) - OWASP LLM Top 10 (2025): LLM07 — System Prompt Leakage (Related) - OWASP LLM Top 10 (2026): LLM01 — Prompt Injection (Subset Of) - OWASP LLM Top 10 (2026): LLM08 — Hidden Context Exposure (Related) ##### R-1110.005: Contradictory Inputs Attack Exploiting AI models' inability to consistently handle conflicting instructions by embedding deceptive or contradictory commands within user input across or within different modalities. This causes behavior drift toward malicious objectives as the model attempts to reconcile incompatible instructions. **Concern** Multi-modal AI systems must arbitrate between potentially conflicting signals from different input channels. Attackers can exploit this arbitration to cause unpredictable behavior or bias decisions toward attacker-controlled objectives. **Cross-references** - AIUC-1: B005 — Implement real-time input filtering (Related) - AIUC-1: B005.1 — Config: Input filtering (Related) - Cisco AI Taxonomy: 1.3.1 — Goal Manipulation (Models, Agents) (Related) ; ArXiv: - Cisco AI Taxonomy: 19.1.1 — Contradictory Inputs Attack (Equivalent) ; ArXiv: - IBM Risk Atlas: atlas-prompt-injection — Prompt injection attack (Subset Of) - MITRE ATLAS: AML.T0051 — LLM Prompt Injection (Subset Of) - NIST AI/ML Framework: NISTAML.018 — Prompt Injection (Related) - NIST AI/ML Framework: NISTAML.02 — Integrity Violations (Related) - NIST AI RMF: nist-information-security — Information Security (Subset Of) - OWASP LLM Top 10 (2024): LLM01 — Prompt Injection (Subset Of) - OWASP LLM Top 10 (2024): LLM06 — Sensitive Information Disclosure (Related) - OWASP LLM Top 10 (2025): LLM01 — Prompt Injection (Subset Of) - OWASP LLM Top 10 (2025): LLM02 — Sensitive Information Disclosure (Related) - OWASP LLM Top 10 (2025): LLM07 — System Prompt Leakage (Related) - OWASP LLM Top 10 (2026): LLM01 — Prompt Injection (Subset Of) - OWASP LLM Top 10 (2026): LLM08 — Hidden Context Exposure (Related) #### R-1120: Jailbreak Techniques that bring a model to produce what its own safety training would otherwise refuse. This includes creative prompting, role-play framings, sustained argument, resampling until a refusal lapses, and exploitation of quirks in how the model processes its input. In each, the model reads the refused request itself, presented in a form or under a pressure its safety training does not withstand. ##### R-1120.001: Context Manipulation Jailbreak Constructing elaborate fictional scenarios, roleplay frameworks, or alternative contexts that reframe harmful requests as acceptable within the created narrative. Examples include the "DAN" (Do Anything Now) jailbreak where the model is convinced to operate under an unrestricted alternate persona. **Concern** Context manipulation exploits the model's tendency to maintain consistency within established narratives. Once a jailbreak context is accepted, the model may continue generating harmful content to maintain roleplay coherence. **Cross-references** - AIUC-1: B005 — Implement real-time input filtering (Related) - AIUC-1: B005.1 — Config: Input filtering (Related) - AIUC-1: C006 — Prevent output vulnerabilities (Related, named example) - AIUC-1: C006.3 — Config: Adversarial output detection (Related) - AIUC-1: E010 — Establish AI acceptable use policy (Related) - Cisco AI Taxonomy: 2.1.1 — Context Manipulation (Jailbreak) (Equivalent, named example) ; ArXiv: - IBM Risk Atlas: atlas-jailbreaking — Jailbreaking (Subset Of) - IBM Risk Atlas: atlas-prompt-injection — Prompt injection attack (Subset Of) - IBM Risk Atlas: atlas-social-hacking-attack — Social hacking attack (Subset Of) - MITRE ATLAS: AML.T0051 — LLM Prompt Injection (Subset Of) - MITRE ATLAS: AML.T0054 — LLM Jailbreak (Subset Of) - NIST AI/ML Framework: NISTAML.018 — Prompt Injection (Related, named example) - NIST AI/ML Framework: NISTAML.04 — Misuse Violations (Subset Of, named example) - NIST AI RMF: nist-dangerous-violent-or-hateful-content — Dangerous, Violent, or Hateful Content (Subset Of) - NIST AI RMF: nist-information-security — Information Security (Subset Of) - OWASP LLM Top 10 (2025): LLM01 — Prompt Injection (Subset Of) - OWASP LLM Top 10 (2026): LLM01 — Prompt Injection (Subset Of) ##### R-1120.002: Semantic Argumentation Jailbreak Using carefully constructed logical arguments, philosophical frameworks, or ethical reasoning to convince the model that providing harmful information actually aligns with its values. The model is essentially argued into compliance through persuasion rather than technical exploitation. **Concern** Language models are trained to engage helpfully with reasoning, making them vulnerable to sophisticated argumentation. Attackers can construct compelling cases that manipulate the model's ethical reasoning processes. **Cross-references** - AIUC-1: B005 — Implement real-time input filtering (Related) - AIUC-1: B005.1 — Config: Input filtering (Related) - AIUC-1: C006 — Prevent output vulnerabilities (Related, named example) - AIUC-1: C006.3 — Config: Adversarial output detection (Related) - AIUC-1: E010 — Establish AI acceptable use policy (Related) - Cisco AI Taxonomy: 2.1.3 — Semantic Manipulation (Jailbreak) (Equivalent) ; ArXiv: - IBM Risk Atlas: atlas-jailbreaking — Jailbreaking (Subset Of) - IBM Risk Atlas: atlas-prompt-injection — Prompt injection attack (Subset Of) - IBM Risk Atlas: atlas-social-hacking-attack — Social hacking attack (Subset Of) - MITRE ATLAS: AML.T0051 — LLM Prompt Injection (Subset Of) - MITRE ATLAS: AML.T0054 — LLM Jailbreak (Subset Of, named example) - NIST AI/ML Framework: NISTAML.018 — Prompt Injection (Related) - NIST AI/ML Framework: NISTAML.04 — Misuse Violations (Subset Of) - NIST AI RMF: nist-dangerous-violent-or-hateful-content — Dangerous, Violent, or Hateful Content (Subset Of) - NIST AI RMF: nist-information-security — Information Security (Subset Of) - OWASP LLM Top 10 (2025): LLM01 — Prompt Injection (Subset Of) - OWASP LLM Top 10 (2026): LLM01 — Prompt Injection (Subset Of) ##### R-1120.003: Token-Level Exploitation Exploiting specific tokens, special characters, control sequences, or tokenization edge cases to manipulate model processing in ways that bypass safety filters. This targets the mechanical aspects of how models process input rather than higher-level reasoning. **Concern** Token-level vulnerabilities are difficult to patch through training alone and may require architectural changes. Discovered exploits can be widely shared and reproduced across models using similar tokenization. **Cross-references** - AIUC-1: B005 — Implement real-time input filtering (Related) - AIUC-1: B005.1 — Config: Input filtering (Related) - AIUC-1: C006 — Prevent output vulnerabilities (Related, named example) - AIUC-1: C006.3 — Config: Adversarial output detection (Related, named example) - AIUC-1: E010 — Establish AI acceptable use policy (Related) - Cisco AI Taxonomy: 2.1.4 — Token Exploitation (Jailbreak) (Equivalent) ; ArXiv: - IBM Risk Atlas: atlas-encoded-interactions-attack — Encoded interactions attack (Related) - IBM Risk Atlas: atlas-jailbreaking — Jailbreaking (Subset Of) - IBM Risk Atlas: atlas-prompt-injection — Prompt injection attack (Subset Of) - IBM Risk Atlas: atlas-specialized-tokens-attack — Specialized tokens attack (Superset Of) - MITRE ATLAS: AML.T0051 — LLM Prompt Injection (Subset Of) - MITRE ATLAS: AML.T0054 — LLM Jailbreak (Subset Of) - MITRE ATLAS: AML.T0068 — LLM Prompt Obfuscation (Related, named example) - NIST AI/ML Framework: NISTAML.018 — Prompt Injection (Related, named example) - NIST AI/ML Framework: NISTAML.02 — Integrity Violations (Related, named example) - NIST AI/ML Framework: NISTAML.022 — Evasion (Related, named example) - NIST AI/ML Framework: NISTAML.04 — Misuse Violations (Subset Of, named example) - NIST AI RMF: nist-dangerous-violent-or-hateful-content — Dangerous, Violent, or Hateful Content (Subset Of) - NIST AI RMF: nist-information-security — Information Security (Subset Of) - OWASP LLM Top 10 (2025): LLM01 — Prompt Injection (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM01 — Prompt Injection (Subset Of) ##### R-1120.004: Refusal Resampling An adversary sends the same request repeatedly and unchanged until sampling variance returns a completion the model refused on earlier attempts. **Concern** Every request is identical to one the system correctly refused, so there is no payload to detect and no phrasing to filter — what differs is only which sample is returned. Any refusal rate below certainty is sufficient given enough attempts, and the cost of those attempts falls on the attacker alone. **Cross-references** - AIUC-1: E010 — Establish AI acceptable use policy (Related) - IBM Risk Atlas: atlas-jailbreaking — Jailbreaking (Subset Of) - MITRE ATLAS: AML.T0051 — LLM Prompt Injection (Subset Of) - MITRE ATLAS: AML.T0054 — LLM Jailbreak (Subset Of, named example) - NIST AI/ML Framework: NISTAML.018 — Prompt Injection (Related) - NIST AI/ML Framework: NISTAML.04 — Misuse Violations (Subset Of) - OWASP LLM Top 10 (2025): LLM01 — Prompt Injection (Subset Of) - OWASP LLM Top 10 (2026): LLM01 — Prompt Injection (Subset Of) ##### R-1120.005: Safety Bypass Through Semantic Re-expression An adversary rephrases or translates a harmful request into language the model understands but its safety behavior does not handle consistently, causing it to provide material it would refuse in an equivalent formulation. The bypass depends on the gap between semantic understanding and safety coverage, rather than a token-processing exploit, a fictional role, or an argument that changes the model’s judgment. **Concern** A model can understand two requests as asking for the same thing while applying its safety behavior differently to their wording or language. Testing and training across ordinary paraphrases and supported languages can reveal this gap. Token normalization alone does not establish that equivalent meanings receive consistent treatment. **Cross-references** - AIUC-1: B005 — Implement real-time input filtering (Related) - AIUC-1: B005.1 — Config: Input filtering (Related) - AIUC-1: C006 — Prevent output vulnerabilities (Related, named example) - AIUC-1: C006.3 — Config: Adversarial output detection (Related) - AIUC-1: E010 — Establish AI acceptable use policy (Related) - IBM Risk Atlas: atlas-encoded-interactions-attack — Encoded interactions attack (Related) - IBM Risk Atlas: atlas-jailbreaking — Jailbreaking (Subset Of) - IBM Risk Atlas: atlas-prompt-injection — Prompt injection attack (Subset Of) - MITRE ATLAS: AML.T0051 — LLM Prompt Injection (Subset Of) - MITRE ATLAS: AML.T0054 — LLM Jailbreak (Subset Of) - NIST AI/ML Framework: NISTAML.018 — Prompt Injection (Related, named example) - NIST AI/ML Framework: NISTAML.02 — Integrity Violations (Related) - NIST AI/ML Framework: NISTAML.022 — Evasion (Related) - NIST AI/ML Framework: NISTAML.04 — Misuse Violations (Subset Of, named example) - NIST AI RMF: nist-dangerous-violent-or-hateful-content — Dangerous, Violent, or Hateful Content (Subset Of) - NIST AI RMF: nist-information-security — Information Security (Subset Of) - OWASP LLM Top 10 (2025): LLM01 — Prompt Injection (Subset Of) - OWASP LLM Top 10 (2026): LLM01 — Prompt Injection (Subset Of) ##### R-1120.006: Many-Shot Jailbreak An adversary supplies many demonstrations of responses a model's safety training would normally refuse, causing the model to follow the demonstrated response pattern instead of refusing the subsequent request. **Concern** A prompt can establish a pattern of prohibited answers through examples while the governing instructions remain present. Test refusal behavior against many demonstrations as well as direct requests; preserving context alone does not address this mechanism. **Cross-references** - IBM Risk Atlas: atlas-context-overload-attack — Context overload attack (Subset Of) - IBM Risk Atlas: atlas-prompt-injection — Prompt injection attack (Subset Of) - NIST AI RMF: nist-information-security — Information Security (Subset Of) #### R-1130: Cross-Modal Injection Attacks that use a channel other than text to carry an instruction the model will act on, or that exploit how a system reconciles several channels — placing the payload where text-facing defenses do not look, or splitting it so no single channel carries a complete attack. ##### R-1130.001: Modality Skewing Manipulating one modality (such as corrupting audio transcripts, poisoning image metadata, or altering video frames) to bias the AI system's arbitration mechanisms toward favoring the manipulated channel over other, potentially more accurate sources. **Concern** AI systems may weight different modalities inconsistently or predictably. Attackers who understand these weighting mechanisms can manipulate lower-integrity channels to override higher-integrity inputs. **Cross-references** - Cisco AI Taxonomy: 19.1.2 — Modality Skewing (Equivalent, named example) ; ArXiv: - IBM Risk Atlas: atlas-prompt-injection — Prompt injection attack (Subset Of) - NIST AI RMF: nist-information-security — Information Security (Subset Of) - OWASP LLM Top 10 (2025): LLM01 — Prompt Injection (Subset Of) ##### R-1130.002: Image-Embedded Text Injection Malicious instructions, prompts, or data are embedded within images using techniques like steganography, adversarial patches, or hidden text. Vision-language models extract and interpret these payloads, enabling attacks that bypass text-based content filters. **Concern** Image-based injection vectors are often overlooked in security assessments focused on text. As multimodal models become more common, this attack surface expands significantly across document processing, chat interfaces, and automated workflows. **Cross-references** - Cisco AI Taxonomy: 1.4.1 — Image-Text Injection (Equivalent, named example) ; ArXiv: - IBM Risk Atlas: atlas-prompt-injection — Prompt injection attack (Subset Of) - MITRE ATLAS: AML.T0041 — Physical Environment Access (Related) - MITRE ATLAS: AML.T0068 — LLM Prompt Obfuscation (Related, named example) - NIST AI RMF: nist-information-security — Information Security (Subset Of) - OWASP LLM Top 10 (2025): LLM01 — Prompt Injection (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM01 — Prompt Injection (Subset Of, named example) ##### R-1130.003: Hidden Audio Commands Inaudible or unintelligible voice commands embedded within audio streams using ultrasonic frequencies, backmasking, or steganographic techniques. Automatic speech recognition models interpret these hidden signals as valid instructions while remaining imperceptible to human listeners. **Concern** Audio-based attacks can target voice assistants, transcription services, and any system processing audio input. The attack can be delivered through broadcast media, ambient sound, or seemingly innocent audio files. **Cross-references** - Cisco AI Taxonomy: 1.4.3 — Audio Command Injection (Equivalent, named example) ; ArXiv: - IBM Risk Atlas: atlas-prompt-injection — Prompt injection attack (Related) - MITRE ATLAS: AML.T0041 — Physical Environment Access (Related) - NIST AI RMF: nist-information-security — Information Security (Subset Of) - OWASP LLM Top 10 (2025): LLM01 — Prompt Injection (Subset Of) - OWASP LLM Top 10 (2026): LLM01 — Prompt Injection (Subset Of) ##### R-1130.004: Video Frame Injection An adversary embeds content in video frames or frame sequences that a model interprets as directions for its responses or actions, rather than as material to analyze. The content may be plainly visible, briefly displayed, encoded in visual forms, or distributed across successive frames. **Concern** A model can extract actionable directions from video even when a person reviewing it misses them. Controls must preserve the distinction between video content and authorized instructions, including when content is decoded or assembled across frames. **Cross-references** - Cisco AI Taxonomy: 1.4.4 — Video Overlay Manipulation (Equivalent, named example) ; ArXiv: - IBM Risk Atlas: atlas-prompt-injection — Prompt injection attack (Subset Of) - NIST AI RMF: nist-information-security — Information Security (Subset Of) - OWASP LLM Top 10 (2025): LLM01 — Prompt Injection (Subset Of) - OWASP LLM Top 10 (2026): LLM01 — Prompt Injection (Subset Of) ##### R-1130.005: Sensor and Action Signal Spoofing Injecting malicious or misleading data points or signals that prompt AI models to undertake specific actions beyond normal reasoning. These signals can be delivered through audio, visual, or other sensor channels, allowing attackers to cause AI agents to execute unintended operations in physical or digital environments. An attacker may introduce these signals by physically altering the environment a sensor observes, without modifying the sensor or its digital output. **Concern** AI systems that interface with the physical world through sensors can be manipulated by spoofed inputs. In safety-critical applications like autonomous vehicles or industrial control, spoofed sensor data could lead to dangerous physical actions. **Cross-references** - Cisco AI Taxonomy: 17.1.1 — Sensor Spoofing: Action Signals (audio, visual) (Equivalent) ; ArXiv: - IBM Risk Atlas: atlas-prompt-injection — Prompt injection attack (Related) - MITRE ATLAS: AML.T0041 — Physical Environment Access (Related) - NIST AI RMF: nist-information-security — Information Security (Subset Of) - OWASP LLM Top 10 (2025): LLM01 — Prompt Injection (Subset Of) #### R-1140: Composed Payloads Attacks assembled from parts that are individually unremarkable, where what crosses a constraint exists only in the combination. This includes content fragments inert until the system fuses them into one context, a definition established in one turn and activated in a later one, and sequences of individually permitted actions whose combination achieves what any one of them would have been refused. Inspection of any single part encounters nothing. ##### R-1140.001: Chained Payload Execution Crafting partial or complementary payload components across modalities, sources, or agent outputs that, when fused by the AI system, combine to form an attack or injection payload. Both parts are delivered at runtime and only become harmful when the system combines them through its normal fusion or arbitration mechanisms. **Concern** Security scanning of individual inputs may miss attacks that only manifest when multiple inputs are combined. This allows attackers to bypass content filters by splitting malicious content across channels. **Cross-references** - Cisco AI Taxonomy: 19.2.2 — Chained Payload Execution (Equivalent) ; ArXiv: - IBM Risk Atlas: atlas-prompt-injection — Prompt injection attack (Subset Of) - NIST AI RMF: nist-information-security — Information Security (Subset Of) - OWASP LLM Top 10 (2025): LLM01 — Prompt Injection (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM01 — Prompt Injection (Subset Of, named example) ##### R-1140.002: Composed Payload Across Turns An adversary establishes an innocuous structure in one turn — a menu, a schema, a set of roles or categories — and activates a branch of it in a later turn. Neither turn contains an attack: the first is a definition carrying no instruction to act, the second an instruction referring to a definition the system has already accepted. **Concern** Inspection of either turn in isolation finds nothing to act on, because nothing in either turn is an attack. The payload is constituted by the session state that carries the definition forward, so the condition depends on what the system retains between turns rather than on what any turn contains. **Cross-references** - IBM Risk Atlas: atlas-jailbreaking — Jailbreaking (Related) - IBM Risk Atlas: atlas-prompt-injection — Prompt injection attack (Subset Of) - MITRE ATLAS: AML.T0054 — LLM Jailbreak (Related) - NIST AI/ML Framework: NISTAML.018 — Prompt Injection (Related) - NIST AI/ML Framework: NISTAML.04 — Misuse Violations (Related) - NIST AI RMF: nist-information-security — Information Security (Subset Of) - OWASP LLM Top 10 (2026): LLM01 — Prompt Injection (Related) ##### R-1140.003: Composed Action Sequence Multiple agents each complete a task that is permitted on its own, and the combination achieves what any one of them would have been refused. Each agent's action is real and finished; what crosses the constraint is the sequence of completed actions, not an artifact assembled from fragments. **Concern** Multi-agent jailbreaks distribute harmful activities across components in ways that evade per-agent monitoring. No single agent performs an obviously malicious action, yet the collective outcome violates safety policies. **Cross-references** - Cisco AI Taxonomy: 2.1.5 — Multi-Agent Jailbreak Collaboration (Subset Of) ; ArXiv: #### R-1150: Context Displacement Attacks that manipulate which information remains in a model’s working context, causing governing instructions or task constraints to be omitted or displaced during context selection, truncation, or compaction. ##### R-1150.001: Context Window Exploitation An adversary manipulates context-window or session-boundary handling so that governing instructions or task constraints are omitted from subsequent model inputs. This includes filling the context with supplied content or distributing requests across sessions to cause those constraints to be dropped. **Concern** The attack succeeds when context handling discards constraints that should remain authoritative. Retaining those constraints outside removable conversation history and restoring them after truncation or compaction addresses this failure. **Cross-references** - Cisco AI Taxonomy: 4.2.1 — Context Window Exploitation (Equivalent) ; ArXiv: - IBM Risk Atlas: atlas-context-overload-attack — Context overload attack (Related) - IBM Risk Atlas: atlas-prompt-injection — Prompt injection attack (Subset Of) - NIST AI RMF: nist-information-security — Information Security (Subset Of) - OWASP Agentic Security Initiative: ASI06 — Memory & Context Poisoning (Related, named example) - OWASP LLM Top 10 (2024): LLM04 — Model Denial of Service (Subset Of) ### R-1200: Identity & Trust Attacks Attacks exploiting trust relationships, authentication, and authorization mechanisms in AI systems, including impersonation, credential abuse, and agent identity confusion. #### R-1210: Masquerading/Impersonation Attacks where adversaries impersonate legitimate users, systems, or personas to gain unauthorized access, manipulate trust relationships, or deceive AI systems about identity. ##### R-1210.001: Trusted Agent Spoofing Impersonating legitimate agents or MCP-registered services to inject malicious instructions, responses, or outputs that other system components or users treat as trusted. This exploits the assumption of authenticity within multi-agent systems and protocol-mediated toolchains. **Concern** Multi-agent systems inherently trust communications from verified agents. Successful spoofing bypasses all downstream security checks by exploiting this architectural trust, enabling wide-ranging system compromise. **Cross-references** - AIUC-1: A003 — Limit AI agent data access (Related, named example) - AIUC-1: A003.2 — Config: Agent identity management (Related, named example) - AIUC-1: B008 — Protect AI system deployment environment (Related, named example) - AIUC-1: B008.1 — Config: API and agentic interface authentication (Related, named example) - AIUC-1: B008.3 — Config: Agentic interface data integrity (Related, named example) - Cisco AI Taxonomy: 3.1.2 — Trusted Agent Spoofing (Equivalent) ; ArXiv: - IBM Risk Atlas: atlas-unauthorized-use-agentic — Unauthorized use (Related) - OWASP Agentic Security Initiative: ASI03 — Identity and Privilege Abuse (Related, named example) - OWASP Agentic Security Initiative: ASI04 — Agentic Supply Chain Vulnerabilities (Related, named example) - OWASP Agentic Security Initiative: ASI07 — Insecure Inter-Agent Communication (Related, named example) - OWASP Agentic Security Initiative: ASI10 — Rogue Agents (Related, named example) ##### R-1210.002: Biometric Presentation Impersonation An adversary presents another person’s biometric representation to an AI identity verifier so that the verifier accepts the presenter as that person. The attack exploits the binding between the recognized identity and the current claimant, even when the system correctly recognizes the person represented. **Concern** Correctly recognizing the person shown in an image or recording does not establish who is presenting it. An identity verifier also needs evidence that the representation belongs to the current claimant and interaction. Trusted capture, liveness checks and binding the verification result to the claimant address a different failure from visual misclassification. **Cross-references** - IBM Risk Atlas: atlas-unauthorized-use-agentic — Unauthorized use (Related) - MITRE ATLAS: AML.T0015 — Evade AI Model (Related, named example) - NIST AI/ML Framework: NISTAML.02 — Integrity Violations (Subset Of, named example) - NIST AI/ML Framework: NISTAML.022 — Evasion (Subset Of, named example) - NIST AI/ML Framework: NISTAML.025 — Black-box Evasion (Related, named example) #### R-1220: Agent Authentication & Attribution Attacks that exploit how a system establishes which agent is acting and carries that identity onward — weaknesses in authentication, session handling, and the propagation of a principal across delegation — so that an agent acts without the standing it should need, or acts without leaving a record of which principal it acted for. ##### R-1220.001: Rogue Agent Introduction Unauthorized insertion of a malicious agent into a multi-agent system that operates contrary to intended purpose. The rogue agent may steal data, cause disruption, or autonomously serve attacker goals while mimicking normal behavior patterns to evade detection. **Concern** Multi-agent orchestration systems may lack robust agent verification mechanisms. Once inserted, rogue agents have access to system resources, inter-agent communications, and potentially sensitive data flows. **Cross-references** - AIUC-1: A003 — Limit AI agent data access (Related, named example) - AIUC-1: B008 — Protect AI system deployment environment (Related, named example) - AIUC-1: B008.1 — Config: API and agentic interface authentication (Related, named example) - Cisco AI Taxonomy: 4.1.1 — Rogue Agent Introduction (Equivalent) ; ArXiv: - MITRE ATLAS: AML.T0103 — Deploy AI Agent (Subset Of, named example) - OWASP Agentic Security Initiative: ASI03 — Identity and Privilege Abuse (Related, named example) - OWASP Agentic Security Initiative: ASI07 — Insecure Inter-Agent Communication (Related, named example) - OWASP Agentic Security Initiative: ASI10 — Rogue Agents (Subset Of, named example) ##### R-1220.002: Principal Concealment An adversary shapes how identity is carried across a delegation chain — in context, in metadata, or in the hand-off between an agent and the tools acting for it — so that actions they cause reach resources with no record of which principal caused them. **Concern** What fails is attribution rather than authentication: the action may be entirely permitted, and the question that cannot be answered afterwards is who caused it. A principal survives a chain only if each hop carries it deliberately, so a single hop that drops it makes everything downstream unattributable. **Cross-references** - Cisco AI Taxonomy: 3.1.1 — Identity Obfuscation (Subset Of) ; ArXiv: ### R-1300: Supply Chain & Artifact Attacks Attacks on the identity, integrity, or custody of the artifacts from which an AI deployment is assembled and operated. This includes supplying compromised models, adapters, packages, or tools; substituting or altering artifacts and interaction records the deployment holds; and copying stored artifacts beyond their intended access or distribution. It also includes compromised dependencies an AI system selects or installs for software it helps build. The focus is the deployment’s construction, its dependency choices, and the artifacts it accepts, holds, and trusts. #### R-1310: Supply Chain Attacks Compromise introduced into the components a model's behavior depends on — its weights, adapters, prompt templates, harness, or the tools and resources it is given — so that the system produces different output than the uncompromised components would while continuing to operate normally, or so that loading the component runs code the adversary chose. This also includes compromised dependencies an AI system selects or installs for software it helps build, even when that software is not part of the AI deployment. ##### R-1310.001: Model Backdoors and Trojans An adversary supplies a model containing latent malicious behavior that activates when particular input, time, environment, or operating-state conditions are met, alone or in combination. The model behaves normally outside those conditions. Compromise activated by transforming the model artifact is covered separately by R-1310.008. **Concern** Evaluation can miss the compromise when test conditions do not reproduce its triggers. Conditions in deployment can activate malicious behavior absent during testing. Model provenance checks and evaluation across relevant inputs and operating conditions address this risk. **Cross-references** - Cisco AI Taxonomy: 9.2.2 — Backdoors and Trojans (Superset Of) ; ArXiv: - MITRE ATLAS: AML.T0010 — AI Supply Chain Compromise (Subset Of, named example) - MITRE ATLAS: AML.T0010.003 — Model (Related, named example) - MITRE ATLAS: AML.T0010.004 — Container Registry (Related) - MITRE ATLAS: AML.T0018 — Manipulate AI Model (Related, named example) - MITRE ATLAS: AML.T0018.000 — Poison AI Model (Related, named example) - MITRE ATLAS: AML.T0018.001 — Modify AI Model Architecture (Related) - MITRE ATLAS: AML.T0020 — Poison Training Data (Related) - MITRE ATLAS: AML.T0054 — LLM Jailbreak (Related) - MITRE ATLAS: AML.T0058 — Publish Poisoned Models (Superset Of, named example) - MITRE ATLAS: AML.T0109 — AI Supply Chain Rug Pull (Related) - MITRE ATLAS: AML.T0111 — AI Supply Chain Reputation Inflation (Related) - NIST AI/ML Framework: NISTAML.01 — Availability Violations (Related) - NIST AI/ML Framework: NISTAML.011 — Model Poisoning (Related, named example) - NIST AI/ML Framework: NISTAML.02 — Integrity Violations (Related) - NIST AI/ML Framework: NISTAML.023 — Backdoor Poisoning (Related) - NIST AI/ML Framework: NISTAML.026 — Model Poisoning (Related, named example) - NIST AI/ML Framework: NISTAML.03 — Privacy Compromises (Related) - NIST AI/ML Framework: NISTAML.05 — Supply Chain Attacks (Subset Of) - NIST AI/ML Framework: NISTAML.051 — Model Poisoning (Subset Of) - NIST AI RMF: nist-information-security — Information Security (Subset Of) - OWASP Agentic Security Initiative: ASI04 — Agentic Supply Chain Vulnerabilities (Subset Of) - OWASP LLM Top 10 (2024): LLM05 — Supply Chain Vulnerabilities (Subset Of, named example) - OWASP LLM Top 10 (2025): LLM03 — Supply Chain (Subset Of, named example) - OWASP LLM Top 10 (2025): LLM04 — Data and Model Poisoning (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM04 — Supply Chain (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM05 — Data and Model Poisoning (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM09 — Vector and Embedding Weaknesses (Related) ##### R-1310.002: Goal Manipulation via Supply Chain Attackers compromise external components that AI agents depend on, including tools, prompt templates, resources, or dependencies. Malicious objectives are injected through these trusted supply chain elements, redirecting agent behavior at a foundational level. **Concern** Supply chain attacks are difficult to detect because compromised components often come from trusted sources. Organizations may inherit vulnerabilities from third-party tools, templates, or integrations without visibility into the compromise. **Cross-references** - Cisco AI Taxonomy: 1.3.2 — Goal Manipulation (Tools, Prompts, Resources) (Equivalent) ; ArXiv: - Cisco AI Taxonomy: 9.3.3 — Dependency Replacement / Rug Pull (Related) ; ArXiv: - IBM Risk Atlas: atlas-external-resources-attack-agentic — Attack on AI agents’ external resources (Subset Of) - MITRE ATLAS: AML.T0010 — AI Supply Chain Compromise (Subset Of, named example) - MITRE ATLAS: AML.T0010.005 — AI Agent Tool (Related, named example) - MITRE ATLAS: AML.T0011 — User Execution (Related, named example) - MITRE ATLAS: AML.T0011.002 — Poisoned AI Agent Tool (Related, named example) - MITRE ATLAS: AML.T0109 — AI Supply Chain Rug Pull (Related) - NIST AI RMF: nist-information-security — Information Security (Related) - OWASP Agentic Security Initiative: ASI04 — Agentic Supply Chain Vulnerabilities (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM01 — Prompt Injection (Related, named example) - OWASP LLM Top 10 (2026): LLM05 — Data and Model Poisoning (Related) ##### R-1310.003: Agent-Selected Component Compromise An adversary publishes a compromised component — a package, tool, MCP server, or model — for an agent to select or install as a dependency, either for an AI deployment or for software the agent helps build. The component is adopted through the agent’s selection or installation, including when a person installs the dependency the agent selected. **Concern** Agent selection relies on names, descriptions, and metadata the publisher controls, so an adversary can influence the evidence used to choose a component. A human installation step does not establish that the selected component’s origin or behavior was evaluated. Review must establish the trustworthiness of the actual component rather than treating the agent’s recommendation as that assurance. **Cross-references** - AIUC-1: B010 — Promote secure patterns in generated code (Related, named example) - AIUC-1: B010.3 — Config: Safe dependency specification in generated code (Related, named example) - AIUC-1: D003 — Restrict unsafe tool calls (Related, named example) - Cisco AI Taxonomy: 9.3.1 — Malicious Package / Tool Injection (Related) ; ArXiv: - MITRE ATLAS: AML.T0010 — AI Supply Chain Compromise (Related, named example) - MITRE ATLAS: AML.T0010.001 — AI Software (Related, named example) - MITRE ATLAS: AML.T0010.005 — AI Agent Tool (Superset Of) - MITRE ATLAS: AML.T0060 — Publish Hallucinated Entities (Superset Of, named example) - MITRE ATLAS: AML.T0104 — Publish Poisoned AI Agent Tool (Related) - MITRE ATLAS: AML.T0111 — AI Supply Chain Reputation Inflation (Related) - NIST AI RMF: nist-information-security — Information Security (Related) - OWASP Agentic Security Initiative: ASI04 — Agentic Supply Chain Vulnerabilities (Subset Of, named example) - OWASP Agentic Security Initiative: ASI05 — Unexpected Code Execution (RCE) (Related, named example) - OWASP LLM Top 10 (2024): LLM09 — Overreliance (Related, named example) - OWASP LLM Top 10 (2025): LLM05 — Improper Output Handling (Related, named example) - OWASP LLM Top 10 (2025): LLM09 — Misinformation (Related, named example) - OWASP LLM Top 10 (2026): LLM04 — Supply Chain (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM07 — Misinformation (Related, named example) ##### R-1310.004: Post-Approval Tool Redefinition A tool's description, parameters, or declared behavior is changed by its provider after the deployment approved it, and the agent reads the current version on every call, so the approval attaches to text the provider can rewrite at any time. **Concern** What was reviewed and what is acted on are the same field at different times. Because the agent re-reads the declaration rather than a pinned copy, a change takes effect on the next call with no installation, version bump, or other event at which review could re-attach. **Cross-references** - AIUC-1: B006 — Prevent unauthorized AI agent actions (Related, named example) - AIUC-1: B006.3 — Config: Execution-level safeguards (Related, named example) - Cisco AI Taxonomy: 12.1.2 — Tool Poisoning (Subset Of) ; ArXiv: - Cisco AI Taxonomy: 9.3.3 — Dependency Replacement / Rug Pull (Related) ; ArXiv: - MITRE ATLAS: AML.T0010 — AI Supply Chain Compromise (Subset Of) - MITRE ATLAS: AML.T0010.001 — AI Software (Related) - MITRE ATLAS: AML.T0011 — User Execution (Related) - MITRE ATLAS: AML.T0011.002 — Poisoned AI Agent Tool (Related) - MITRE ATLAS: AML.T0086 — Exfiltration via AI Agent Tool Invocation (Related) - MITRE ATLAS: AML.T0109 — AI Supply Chain Rug Pull (Related) - MITRE ATLAS: AML.T0110 — AI Agent Tool Poisoning (Subset Of) - NIST AI RMF: nist-information-security — Information Security (Related) - OWASP Agentic Security Initiative: ASI04 — Agentic Supply Chain Vulnerabilities (Subset Of) ##### R-1310.005: Component Identity Collision An adversary publishes a component — a tool, package, MCP server, dataset, API, or model — under a name or identifier confusable with a legitimate one, so that resolution selects the adversary's version and the system treats its output as the genuine component's. **Concern** Resolution reads names and identifiers the publisher controls, with none of the visual and contextual checks a person applies to a confusable name. The adversary succeeds by resembling a component the deployment already relies on, so the substitution holds on every later call until the identifier is bound to a provenance rather than to a string. **Cross-references** - AIUC-1: B010 — Promote secure patterns in generated code (Related, named example) - Cisco AI Taxonomy: 12.1.4 — Tool Shadowing (Superset Of) ; ArXiv: - Cisco AI Taxonomy: 4.3.2 — Namespace Collision (Subset Of) ; ArXiv: - Cisco AI Taxonomy: 9.3.2 — Dependency Name Squatting (Tools / Servers) (Equivalent, named example) ; ArXiv: - MITRE ATLAS: AML.T0010 — AI Supply Chain Compromise (Subset Of, named example) - MITRE ATLAS: AML.T0010.001 — AI Software (Related, named example) - MITRE ATLAS: AML.T0073 — Impersonation (Related, named example) - NIST AI RMF: nist-information-security — Information Security (Related) - OWASP Agentic Security Initiative: ASI02 — Tool Misuse and Exploitation (Related, named example) - OWASP Agentic Security Initiative: ASI04 — Agentic Supply Chain Vulnerabilities (Related, named example) - OWASP LLM Top 10 (2025): LLM03 — Supply Chain (Related, named example) - OWASP LLM Top 10 (2026): LLM04 — Supply Chain (Subset Of, named example) ##### R-1310.006: Supply of a Poisoned Tool An adversary supplies an agent deployment with a tool or tool update whose implementation, configuration, or bundled data has been maliciously altered. When the deployment accepts and uses it, the tool produces deceptive or malicious outputs, enables privilege escalation, or propagates altered data. **Concern** Compromised tools are trusted by AI agents, making poisoned tools particularly dangerous. Malicious outputs from poisoned tools may be incorporated into AI decisions and propagated to users or other systems without scrutiny. **Cross-references** - Cisco AI Taxonomy: 12.1.2 — Tool Poisoning (Subset Of) ; ArXiv: - Cisco AI Taxonomy: 9.3.1 — Malicious Package / Tool Injection (Subset Of) ; ArXiv: - Cisco AI Taxonomy: 9.3.3 — Dependency Replacement / Rug Pull (Related) ; ArXiv: - IBM Risk Atlas: atlas-external-resources-attack-agentic — Attack on AI agents’ external resources (Subset Of) - MITRE ATLAS: AML.T0010 — AI Supply Chain Compromise (Subset Of) - MITRE ATLAS: AML.T0011 — User Execution (Related, named example) - MITRE ATLAS: AML.T0011.002 — Poisoned AI Agent Tool (Related, named example) - MITRE ATLAS: AML.T0086 — Exfiltration via AI Agent Tool Invocation (Related, named example) - MITRE ATLAS: AML.T0104 — Publish Poisoned AI Agent Tool (Related, named example) - MITRE ATLAS: AML.T0109 — AI Supply Chain Rug Pull (Related, named example) - MITRE ATLAS: AML.T0110 — AI Agent Tool Poisoning (Related, named example) - MITRE ATLAS: AML.T0111 — AI Supply Chain Reputation Inflation (Related, named example) - NIST AI RMF: nist-information-security — Information Security (Related) - OWASP Agentic Security Initiative: ASI04 — Agentic Supply Chain Vulnerabilities (Subset Of, named example) - OWASP LLM Top 10 (2024): LLM05 — Supply Chain Vulnerabilities (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM01 — Prompt Injection (Related, named example) - OWASP LLM Top 10 (2026): LLM06 — Unbounded Consumption (Related, named example) ##### R-1310.007: Executable Payload in a Model or Dataset Artifact A model or dataset file is built so that loading it runs code the adversary chose, either because the serialization format permits code alongside the weights or data, or because the file is malformed in a way that makes the format’s own parser execute it. The code runs with the privileges of the process doing the loading. **Concern** Output evaluations can miss malicious code that runs when a model or dataset file is loaded. The code executes with the loading process's privileges and may reach credentials or data available to a training job, developer workstation, or inference server. **Cross-references** - AIUC-1: B008 — Protect AI system deployment environment (Related, named example) - AIUC-1: B008.5 — Config: Model integrity verification (Related, named example) - AIUC-1: C002 — Conduct pre-deployment testing (Related, named example) - AIUC-1: C002.3 — Documentation: Vulnerability scan results (Related, named example) - MITRE ATLAS: AML.T0010 — AI Supply Chain Compromise (Subset Of, named example) - MITRE ATLAS: AML.T0010.003 — Model (Related, named example) - MITRE ATLAS: AML.T0011 — User Execution (Related, named example) - MITRE ATLAS: AML.T0011.000 — Unsafe AI Artifacts (Superset Of, named example) - MITRE ATLAS: AML.T0018 — Manipulate AI Model (Related, named example) - MITRE ATLAS: AML.T0018.002 — Embed Malware (Superset Of, named example) - MITRE ATLAS: AML.T0076 — Corrupt AI Model (Superset Of, named example) - MITRE ATLAS: AML.T0112 — Machine Compromise (Subset Of, named example) - MITRE ATLAS: AML.T0112.001 — AI Artifacts (Subset Of, named example) - NIST AI RMF: nist-information-security — Information Security (Subset Of) - OWASP Agentic Security Initiative: ASI04 — Agentic Supply Chain Vulnerabilities (Subset Of) - OWASP LLM Top 10 (2025): LLM03 — Supply Chain (Subset Of, named example) - OWASP LLM Top 10 (2025): LLM04 — Data and Model Poisoning (Related, named example) - OWASP LLM Top 10 (2026): LLM04 — Supply Chain (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM05 — Data and Model Poisoning (Subset Of, named example) ##### R-1310.008: Backdoor Released by Model Transformation A supplied model is built so that it behaves acceptably as delivered and misbehaves after a transformation the deploying organization performs itself, such as quantization to a smaller numeric format. The trigger is the transformation rather than any input. **Concern** Evaluations of the supplied model may miss behavior activated by a later transformation. If the transformed model is deployed without renewed evaluation, a routine optimization can activate malicious behavior that the earlier assessment did not test. **Cross-references** - MITRE ATLAS: AML.T0010 — AI Supply Chain Compromise (Subset Of) - NIST AI/ML Framework: NISTAML.03 — Privacy Compromises (Related) - NIST AI/ML Framework: NISTAML.05 — Supply Chain Attacks (Subset Of) - NIST AI/ML Framework: NISTAML.051 — Model Poisoning (Subset Of) - NIST AI RMF: nist-information-security — Information Security (Subset Of) - OWASP Agentic Security Initiative: ASI04 — Agentic Supply Chain Vulnerabilities (Subset Of) - OWASP LLM Top 10 (2026): LLM04 — Supply Chain (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM09 — Vector and Embedding Weaknesses (Related) ##### R-1310.009: Malicious Code Bundled with an AI Artifact An adversary supplies a model or dataset with code that the consuming workflow runs to load, prepare, or use that artifact. The bundled code performs attacker-chosen actions with the workflow’s privileges. It may be custom loading code, preprocessing code, or an accompanying notebook used in that workflow; execution does not depend on the artifact’s serialization format permitting code. **Concern** A safe serialization format does not make accompanying executable code safe. Custom loaders, preprocessing scripts, or notebooks may run with access to credentials, files, or network resources in the consuming workflow. Review and restrict the bundled code and the privileges it receives before running it. **Cross-references** - MITRE ATLAS: AML.T0010 — AI Supply Chain Compromise (Subset Of) - MITRE ATLAS: AML.T0112 — Machine Compromise (Subset Of) - MITRE ATLAS: AML.T0112.001 — AI Artifacts (Subset Of) - NIST AI RMF: nist-information-security — Information Security (Subset Of) - OWASP Agentic Security Initiative: ASI04 — Agentic Supply Chain Vulnerabilities (Subset Of) ##### R-1310.010: Compromised Training Procedure An adversary supplies training code or configuration that changes how a model is trained or fine-tuned so that the resulting model acquires attacker-chosen behavior. The compromised procedure may alter training randomness, regularization, or hyperparameters even when the model initialization and training data are legitimate. **Concern** Checking the training data and initial model does not establish that the training procedure is trustworthy. Compromised code or configuration can shape the resulting model while the training job appears to run normally. Verify the training implementation and configuration actually used, and evaluate the resulting model for targeted changes in behavior. **Cross-references** - MITRE ATLAS: AML.T0010 — AI Supply Chain Compromise (Subset Of) - MITRE ATLAS: AML.T0018 — Manipulate AI Model (Subset Of) - MITRE ATLAS: AML.T0018.000 — Poison AI Model (Subset Of) - NIST AI/ML Framework: NISTAML.03 — Privacy Compromises (Related) - NIST AI/ML Framework: NISTAML.05 — Supply Chain Attacks (Subset Of, named example) - NIST AI/ML Framework: NISTAML.051 — Model Poisoning (Subset Of, named example) - NIST AI RMF: nist-information-security — Information Security (Subset Of) #### R-1320: Artifact Tampering Modifying an artifact the deployment already holds or has previously selected, or replaying an interaction artifact outside the context in which it was valid. This includes agent identity, role, capability and permission configuration enforced by the deployment, packages at rest, and the record of an interaction. Persistent instructions, memories and task state interpreted by the agent are covered by Corpus & Memory Poisoning. Where an artifact is modified, the adversary changes the artifact after the deployment has selected or accepted it, rather than inducing the deployment to select a component already compromised. ##### R-1320.001: Agent Profile Tampering An adversary modifies stored agent identity, role assignments, capability settings, or permission definitions enforced by the deployment. The altered configuration changes which agent runs, which functions it can invoke, or which resources it can access. **Concern** Configuration tampering provides persistent control over agent behavior without requiring repeated exploitation. Changed profiles affect all future agent instantiations until the tampering is detected and remediated. **Cross-references** - AIUC-1: B007 — Enforce user access privileges to AI systems (Related, named example) - AIUC-1: B007.1 — Config: User access controls (Related, named example) - AIUC-1: B007.2 — Documentation: Access reviews (Related, named example) - Cisco AI Taxonomy: 5.2.1 — Agent Profile Tampering (Subset Of) ; ArXiv: - MITRE ATLAS: AML.T0081 — Modify AI Agent Configuration (Related, named example) - MITRE ATLAS: AML.T0105 — Escape to Host (Related, named example) - NIST AI RMF: nist-information-security — Information Security (Related) ##### R-1320.002: Substituted Model in a Redistributed Application An adversary redistributes an application with a substituted model while retaining the original application's name and interface. The model in the redistributed copy is not the one the publisher reviewed. **Concern** Evaluations of the original model do not establish the behavior of the substituted copy. Users may mistake it for the publisher's version, and the publisher may have no visibility into its behavior. Everyone who installs the redistributed application can be exposed. **Cross-references** - MITRE ATLAS: AML.T0010 — AI Supply Chain Compromise (Subset Of) - NIST AI RMF: nist-information-security — Information Security (Subset Of) - OWASP Agentic Security Initiative: ASI04 — Agentic Supply Chain Vulnerabilities (Subset Of) - OWASP LLM Top 10 (2025): LLM03 — Supply Chain (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM04 — Supply Chain (Subset Of, named example) ##### R-1320.003: Interaction History Tampering An adversary substitutes, edits, or removes earlier turns in a stored conversation that an AI system reads back as interaction context or associates with recorded validation results. The altered object is the record of the interaction, including messages and tool responses retained as conversation turns. **Concern** Altered history can change the context supplied to the model or conceal earlier actions. Where validation results are bound to a turn’s position rather than its content, replacement text can inherit an earlier approval. Restricting changes to recorded turns, preserving their provenance, and binding validation results to the content checked address these failures. **Cross-references** - Cisco AI Taxonomy: 4.2.2 — Session Boundary Violation (Related) ; ArXiv: - Cisco AI Taxonomy: 5.1.1 — Long-term / Short-term Memory Injection (Related) ; ArXiv: - IBM Risk Atlas: atlas-unauthorized-use-agentic — Unauthorized use (Related, named example) - MITRE ATLAS: AML.T0092 — Manipulate User LLM Chat History (Superset Of, named example) - OWASP Agentic Security Initiative: ASI06 — Memory & Context Poisoning (Related) ##### R-1320.004: Interaction Replay An adversary reuses a previously valid message, request, tool response, or approval in an AI interaction so that the system accepts it as current and performs an action outside the authority or context in which it was originally valid. **Concern** A message or approval that was valid for one interaction can trigger an unauthorized repeat action or carry authority into a different context. Authentic, unchanged content can still be unsafe to reuse. Binding messages, tool results and approvals to the intended action and interaction, enforcing freshness and one-time use where required, and checking for repeated execution address this failure. **Cross-references** - Cisco AI Taxonomy: 4.2.2 — Session Boundary Violation (Related) ; ArXiv: - Cisco AI Taxonomy: 4.3.4 — Replay Exploitation (Equivalent) ; ArXiv: - OWASP Agentic Security Initiative: ASI07 — Insecure Inter-Agent Communication (Related, named example) ##### R-1320.005: Selected Model Artifact Tampering An adversary alters or replaces model definitions, weights, adapters, or checkpoints after a deployment has selected or accepted the artifact for use. The model loaded or used differs from the version the deployment selected. **Concern** An artifact can change during storage or delivery after its source or behavior was reviewed. Approval of the selected version does not establish the integrity of the version eventually loaded. Retaining evidence of the selected artifact and checking it at use can reveal substitution that a trusted name or an earlier evaluation would miss. **Cross-references** - AIUC-1: B007 — Enforce user access privileges to AI systems (Related, named example) - AIUC-1: B007.1 — Config: User access controls (Related, named example) - AIUC-1: B007.2 — Documentation: Access reviews (Related, named example) - AIUC-1: B008 — Protect AI system deployment environment (Related, named example) - AIUC-1: B008.5 — Config: Model integrity verification (Related, named example) - AIUC-1: E004 — Assign accountability (Related) - AIUC-1: E004.2 — Config: Code signing implementation (Related, named example) - MITRE ATLAS: AML.T0010 — AI Supply Chain Compromise (Related, named example) - MITRE ATLAS: AML.T0010.004 — Container Registry (Related, named example) - MITRE ATLAS: AML.T0018 — Manipulate AI Model (Related, named example) - MITRE ATLAS: AML.T0018.000 — Poison AI Model (Related, named example) - MITRE ATLAS: AML.T0018.001 — Modify AI Model Architecture (Related, named example) - MITRE ATLAS: AML.T0054 — LLM Jailbreak (Related) - NIST AI/ML Framework: NISTAML.01 — Availability Violations (Related) - NIST AI/ML Framework: NISTAML.011 — Model Poisoning (Related, named example) - NIST AI/ML Framework: NISTAML.02 — Integrity Violations (Related) - NIST AI/ML Framework: NISTAML.023 — Backdoor Poisoning (Related) - NIST AI/ML Framework: NISTAML.026 — Model Poisoning (Related, named example) - NIST AI/ML Framework: NISTAML.03 — Privacy Compromises (Related) - NIST AI RMF: nist-information-security — Information Security (Subset Of) - OWASP Agentic Security Initiative: ASI04 — Agentic Supply Chain Vulnerabilities (Related) - OWASP LLM Top 10 (2026): LLM04 — Supply Chain (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM09 — Vector and Embedding Weaknesses (Related) ##### R-1320.006: Selected Tool Artifact Tampering An adversary alters a tool's implementation, configuration, or bundled data after the deployment has selected or accepted it for use. The tool used by the agent differs from the accepted version. **Concern** A trusted tool can change after acceptance even when its original supplier and declaration were reviewed. Restricting writes to the held artifact, verifying its integrity at use, auditing changes and restoring the accepted version address this attack. Approval of the initial tool or its declared interface does not establish the integrity of the implementation, configuration or data later used. **Cross-references** - AIUC-1: B007 — Enforce user access privileges to AI systems (Related, named example) - AIUC-1: B007.1 — Config: User access controls (Related, named example) - AIUC-1: B007.2 — Documentation: Access reviews (Related, named example) - Cisco AI Taxonomy: 12.1.2 — Tool Poisoning (Subset Of) ; ArXiv: - IBM Risk Atlas: atlas-external-resources-attack-agentic — Attack on AI agents’ external resources (Subset Of) - MITRE ATLAS: AML.T0081 — Modify AI Agent Configuration (Related) - MITRE ATLAS: AML.T0086 — Exfiltration via AI Agent Tool Invocation (Related) - NIST AI RMF: nist-information-security — Information Security (Related) - OWASP Agentic Security Initiative: ASI02 — Tool Misuse and Exploitation (Related, named example) - OWASP Agentic Security Initiative: ASI04 — Agentic Supply Chain Vulnerabilities (Related) #### R-1330: Artifact Exfiltration Attacks that take a copy of an artifact from where the deployment keeps it, beyond the access or distribution the deployment intends to provide: model weights and adapters, training and fine-tuning datasets, stored configuration that would reproduce the system, or stored AI-system configuration sufficient to tailor attacks to the deployment’s instructions, capabilities, or tool connections. This includes copying through unintentionally exposed storage or access granted for another purpose. The copy is taken from storage, a repository, a registry, or a backup, rather than reconstructed from what the running system exposes. ##### R-1330.001: Model Weight Exfiltration A party obtains the weights of a model the deployment holds beyond the access or distribution the deployment intends to provide. The weights are copied from storage, a repository, a registry, or a backup, including through unintentionally exposed storage, removal by an insider, or access granted for another purpose. **Concern** Copied weights let another party run and modify the model independently of the provider's service. Controls applied around that service, such as rate limits, output filtering, and logging, do not accompany the weights. Once copied, the stolen weights remain usable even if the provider replaces the deployed model or revokes access to its service. **Cross-references** - MITRE ATLAS: AML.T0002 — Acquire Public AI Artifacts (Related, named example) - MITRE ATLAS: AML.T0002.001 — Models (Superset Of, named example) - MITRE ATLAS: AML.T0025 — Exfiltration via Cyber Means (Related, named example) - MITRE ATLAS: AML.T0044 — Full AI Model Access (Superset Of, named example) - MITRE ATLAS: AML.T0048 — External Harms (Related, named example) - MITRE ATLAS: AML.T0048.004 — AI Intellectual Property Theft (Related, named example) - NIST AI RMF: nist-information-security — Information Security (Subset Of) - OWASP LLM Top 10 (2024): LLM05 — Supply Chain Vulnerabilities (Related, named example) - OWASP LLM Top 10 (2024): LLM10 — Model Theft (Subset Of, named example) ##### R-1330.002: Training Dataset Exfiltration A party obtains a training or fine-tuning dataset held for the deployment beyond the access or distribution the deployment intends to provide. The dataset is copied from storage, a repository, a registry, or a backup, including through unintentionally exposed storage, removal by an insider, or access granted for another purpose. **Concern** Copied datasets expose the examples used to train or fine-tune the model, including proprietary material and personal or confidential information those examples contain. Another party can retain and reuse the data after access is revoked. The copy can support independent model development, but does not itself provide the trained model. **Cross-references** - AIUC-1: B007 — Enforce user access privileges to AI systems (Related, named example) - AIUC-1: B007.1 — Config: User access controls (Related, named example) - AIUC-1: B007.2 — Documentation: Access reviews (Related, named example) - MITRE ATLAS: AML.T0002 — Acquire Public AI Artifacts (Related, named example) - MITRE ATLAS: AML.T0025 — Exfiltration via Cyber Means (Related, named example) - MITRE ATLAS: AML.T0048 — External Harms (Related) - MITRE ATLAS: AML.T0048.004 — AI Intellectual Property Theft (Related) - NIST AI RMF: nist-information-security — Information Security (Subset Of) - OWASP LLM Top 10 (2024): LLM05 — Supply Chain Vulnerabilities (Related, named example) ##### R-1330.003: AI System Configuration Exfiltration A party obtains stored configuration sufficient to reproduce an AI system’s configured behavior or tailor attacks to its instructions, capabilities, or tool connections, beyond the access or distribution the deployment intends to provide. The configuration is copied from storage, a repository, a registry, or a backup, including through unintentionally exposed storage or access granted for another purpose. **Concern** Copied configuration reveals how the AI system is instructed to behave, which capabilities it has, or how it connects to tools. Another party can use those details to reproduce the configured behavior or design attacks for that deployment. Revoking access to the stored files does not remove copies already obtained. **Cross-references** - AIUC-1: B007 — Enforce user access privileges to AI systems (Related, named example) - AIUC-1: B007.1 — Config: User access controls (Related, named example) - AIUC-1: B007.2 — Documentation: Access reviews (Related, named example) - MITRE ATLAS: AML.T0002 — Acquire Public AI Artifacts (Related, named example) - MITRE ATLAS: AML.T0002.002 — AI Agent Configuration (Superset Of, named example) - MITRE ATLAS: AML.T0025 — Exfiltration via Cyber Means (Related) - MITRE ATLAS: AML.T0056 — Extract LLM System Prompt (Related) - MITRE ATLAS: AML.T0069 — Discover LLM System Information (Related) - MITRE ATLAS: AML.T0069.000 — Special Character Sets (Related) - MITRE ATLAS: AML.T0069.001 — System Instruction Keywords (Related) - MITRE ATLAS: AML.T0069.002 — System Prompt (Related) - MITRE ATLAS: AML.T0084 — Discover AI Agent Configuration (Related) - MITRE ATLAS: AML.T0084.000 — Embedded Knowledge (Related) - MITRE ATLAS: AML.T0084.001 — Tool Definitions (Related) - MITRE ATLAS: AML.T0084.002 — Activation Triggers (Related) - MITRE ATLAS: AML.T0084.003 — Call Chains (Related) - NIST AI RMF: nist-information-security — Information Security (Related) ### R-1400: Data & Model Attacks Attacks that manipulate or exploit how an AI system learns, retains and retrieves information, or processes inputs and produces responses. This includes poisoning data, feedback, or persistent agent state; manipulating information selection and retrieval; perturbing model inputs; and recovering protected information from learned representations, interfaces, or observable behavior. The focus is the system’s learning and information processing. #### R-1410: Feedback Manipulation Attacks manipulating feedback signals, reward functions, or training data to shift model behavior toward attacker-desired outcomes over time. ##### R-1410.001: Reinforcement Feedback Manipulation An adversary manipulates user feedback, evaluation or training signals, or reward mechanisms used to update a model, steering learning toward attacker-chosen behavior. This includes gradual biasing and direct injection of false or adversarial signals. **Concern** Manipulated feedback or reward signals can steer learning even when the surrounding training process operates as designed. Validate the contributors and signals admitted to learning, and compare the resulting behavior with independent evaluation. The subtlety or speed of manipulation does not create a separate protection obligation. **Cross-references** - Cisco AI Taxonomy: 6.1.2 — Reinforcement Biasing (Superset Of) ; ArXiv: - Cisco AI Taxonomy: 6.1.3 — Reinforcement Signal Corruption (Superset Of) ; ArXiv: - IBM Risk Atlas: atlas-unauthorized-use-agentic — Unauthorized use (Related, named example) - NIST AI/ML Framework: NISTAML.01 — Availability Violations (Related) - NIST AI/ML Framework: NISTAML.011 — Model Poisoning (Related) - NIST AI/ML Framework: NISTAML.013 — Data Poisoning (Related) - NIST AI/ML Framework: NISTAML.02 — Integrity Violations (Related) - NIST AI/ML Framework: NISTAML.026 — Model Poisoning (Related) - NIST AI/ML Framework: NISTAML.03 — Privacy Compromises (Related) - NIST AI/ML Framework: NISTAML.04 — Misuse Violations (Related) - NIST AI/ML Framework: NISTAML.05 — Supply Chain Attacks (Related) - OWASP LLM Top 10 (2026): LLM05 — Data and Model Poisoning (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM09 — Vector and Embedding Weaknesses (Related) #### R-1420: Corpus & Memory Poisoning Attacks that poison data used for training, tuning, evaluation, or retrieval; corrupt persistent agent state; or manipulate how stored information is selected and retrieved. ##### R-1420.001: Memory Anchor Attacks An adversary crafts or repeats content to increase the likelihood that selected information will be retained, recalled, or retrieved by an AI system. The attack exploits the signals used to prioritize information, including repetition, salience, and apparent relevance. **Concern** Attacker-selected information can crowd out other information even when its individual statements are accurate. Controls must address how content earns priority, including how repeated contributions are counted and how sources are weighted. **Cross-references** - Cisco AI Taxonomy: 5.1.1 — Long-term / Short-term Memory Injection (Related) ; ArXiv: - Cisco AI Taxonomy: 7.2.1 — Memory Anchor Attacks (Equivalent) ; ArXiv: - MITRE ATLAS: AML.T0066 — Retrieval Content Crafting (Related, named example) - OWASP Agentic Security Initiative: ASI06 — Memory & Context Poisoning (Related, named example) - OWASP LLM Top 10 (2026): LLM05 — Data and Model Poisoning (Subset Of) - OWASP LLM Top 10 (2026): LLM09 — Vector and Embedding Weaknesses (Related, named example) ##### R-1420.002: Memory Index Manipulation An adversary directly modifies stored embeddings, index entries, or retrieval logic to change which information an AI system retrieves or how it ranks that information. **Concern** Changing the retrieval machinery can redirect results while leaving the underlying source material intact. Protecting index writes, verifying index integrity, and reviewing changes to retrieval logic address this attack. Its effects may be limited to selected queries or extend across the collection. **Cross-references** - Cisco AI Taxonomy: 7.2.2 — Memory Index Manipulation (Superset Of) ; ArXiv: - MITRE ATLAS: AML.T0081 — Modify AI Agent Configuration (Related) - OWASP LLM Top 10 (2026): LLM05 — Data and Model Poisoning (Subset Of, named example) ##### R-1420.003: Poisoned External Dataset An adversary supplies or tampers with an external dataset, repository, or feed before the system accepts its content for training, tuning, or evaluation. Poisoned examples or labels enter through the system’s dataset acquisition process. **Concern** Source selection and content review can accept poisoned examples or labels as legitimate data. Training or tuning can carry the resulting behavior into deployed models; poisoned evaluation data can distort the evidence used to judge a model. Verifying that later downloads match the accepted content does not establish that the content was safe when accepted. **Cross-references** - Cisco AI Taxonomy: 7.3.1 — Corrupted Third-Party Data (Subset Of) ; ArXiv: - IBM Risk Atlas: atlas-data-poisoning — Data poisoning (Related, named example) - MITRE ATLAS: AML.T0010 — AI Supply Chain Compromise (Subset Of, named example) - MITRE ATLAS: AML.T0010.002 — Data (Related, named example) - MITRE ATLAS: AML.T0018 — Manipulate AI Model (Related) - MITRE ATLAS: AML.T0018.000 — Poison AI Model (Related) - MITRE ATLAS: AML.T0019 — Publish Poisoned Datasets (Related, named example) - MITRE ATLAS: AML.T0020 — Poison Training Data (Related, named example) - MITRE ATLAS: AML.T0031 — Erode AI Model Integrity (Related, named example) - MITRE ATLAS: AML.T0059 — Erode Dataset Integrity (Related, named example) - MITRE ATLAS: AML.T0109 — AI Supply Chain Rug Pull (Related) - MITRE ATLAS: AML.T0111 — AI Supply Chain Reputation Inflation (Related) - NIST AI/ML Framework: NISTAML.01 — Availability Violations (Related) - NIST AI/ML Framework: NISTAML.012 — Clean-label Poisoning (Related, named example) - NIST AI/ML Framework: NISTAML.013 — Data Poisoning (Related, named example) - NIST AI/ML Framework: NISTAML.02 — Integrity Violations (Related) - NIST AI/ML Framework: NISTAML.021 — Clean-label Backdoor (Related, named example) - NIST AI/ML Framework: NISTAML.023 — Backdoor Poisoning (Related, named example) - NIST AI/ML Framework: NISTAML.024 — Targeted Poisoning (Related, named example) - NIST AI/ML Framework: NISTAML.03 — Privacy Compromises (Related) - NIST AI/ML Framework: NISTAML.04 — Misuse Violations (Related) - NIST AI/ML Framework: NISTAML.05 — Supply Chain Attacks (Subset Of, named example) - NIST AI RMF: nist-information-security — Information Security (Related) - OWASP Agentic Security Initiative: ASI04 — Agentic Supply Chain Vulnerabilities (Subset Of) - OWASP LLM Top 10 (2024): LLM03 — Training Data Poisoning (Related, named example) - OWASP LLM Top 10 (2024): LLM05 — Supply Chain Vulnerabilities (Related, named example) - OWASP LLM Top 10 (2025): LLM03 — Supply Chain (Related, named example) - OWASP LLM Top 10 (2025): LLM04 — Data and Model Poisoning (Related, named example) - OWASP LLM Top 10 (2026): LLM04 — Supply Chain (Related) - OWASP LLM Top 10 (2026): LLM05 — Data and Model Poisoning (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM06 — Unbounded Consumption (Related, named example) - OWASP LLM Top 10 (2026): LLM09 — Vector and Embedding Weaknesses (Related) ##### R-1420.004: Persistent Agent State Poisoning An adversary plants or alters instructions, memories, preferences, or task state maintained by an agent harness to guide behavior across steps or sessions. This includes persistent instruction files such as AGENTS.md, saved memories, and retained plans or task records. **Concern** Poisoned harness state can continue to guide the agent after the input or access that introduced it has ended. Restricting state changes, reviewing what is saved, preserving its origin, and restoring trusted versions address this persistence. Conversation turns retained or replayed as the interaction record belong to R1320.003. Instructions, memories, or task state maintained by the harness belong to R1420.004. Reference material consulted as evidence belongs to the retrieval-corpus risks. Storage format and physical location do not decide the placement. A compressed transcript that substitutes for prior turns remains interaction history. Information extracted and maintained as saved memory or task state belongs to R1420.004. **Cross-references** - AIUC-1: B006 — Prevent unauthorized AI agent actions (Related, named example) - AIUC-1: B006.3 — Config: Execution-level safeguards (Related, named example) - Cisco AI Taxonomy: 4.2.2 — Session Boundary Violation (Related) ; ArXiv: - Cisco AI Taxonomy: 5.1.1 — Long-term / Short-term Memory Injection (Subset Of) ; ArXiv: - Cisco AI Taxonomy: 5.2.1 — Agent Profile Tampering (Related) ; ArXiv: - IBM Risk Atlas: atlas-unauthorized-use-agentic — Unauthorized use (Subset Of, named example) - MITRE ATLAS: AML.T0080 — AI Agent Context Poisoning (Subset Of, named example) - MITRE ATLAS: AML.T0080.000 — Memory (Superset Of, named example) - MITRE ATLAS: AML.T0081 — Modify AI Agent Configuration (Related, named example) - OWASP Agentic Security Initiative: ASI06 — Memory & Context Poisoning (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM01 — Prompt Injection (Related, named example) - OWASP LLM Top 10 (2026): LLM05 — Data and Model Poisoning (Subset Of, named example) ##### R-1420.005: Retrieval Corpus Poisoning Through Ingestion An adversary introduces false, misleading, or malicious reference material through a retrieval corpus’s content-ingestion process. The system accepts the material into the collection it consults when producing answers or taking actions. **Concern** A retrieval corpus can accept malicious material even when its stored contents are protected against later alteration. Source selection, ingestion permissions, provenance checks and content validation address this entry path. Poisoned material can target particular queries or users; it need not affect every answer or require model training. **Cross-references** - Cisco AI Taxonomy: 1.3.2 — Goal Manipulation (Tools, Prompts, Resources) (Related) ; ArXiv: - Cisco AI Taxonomy: 6.1.1 — Knowledge Base Poisoning (Equivalent) ; ArXiv: - MITRE ATLAS: AML.T0066 — Retrieval Content Crafting (Related, named example) - MITRE ATLAS: AML.T0070 — RAG Poisoning (Subset Of, named example) - MITRE ATLAS: AML.T0071 — False RAG Entry Injection (Superset Of, named example) - MITRE ATLAS: AML.T0081 — Modify AI Agent Configuration (Related) - MITRE ATLAS: AML.T0093 — Prompt Infiltration via Public-Facing Application (Related) - MITRE ATLAS: AML.T0099 — AI Agent Tool Data Poisoning (Related) - NIST AI/ML Framework: NISTAML.015 — Indirect Prompt Injection (Related, named example) - NIST AI/ML Framework: NISTAML.02 — Integrity Violations (Related, named example) - NIST AI/ML Framework: NISTAML.027 — Misaligned Outputs (Related, named example) - OWASP Agentic Security Initiative: ASI04 — Agentic Supply Chain Vulnerabilities (Related, named example) - OWASP Agentic Security Initiative: ASI06 — Memory & Context Poisoning (Subset Of, named example) - OWASP LLM Top 10 (2025): LLM01 — Prompt Injection (Related, named example) - OWASP LLM Top 10 (2025): LLM08 — Vector and Embedding Weaknesses (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM01 — Prompt Injection (Related, named example) - OWASP LLM Top 10 (2026): LLM05 — Data and Model Poisoning (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM07 — Misinformation (Related, named example) - OWASP LLM Top 10 (2026): LLM09 — Vector and Embedding Weaknesses (Related, named example) ##### R-1420.006: Convergence Payload Injection An adversary poisons multimodal training data to establish a payload in learned joint embeddings or fusion layers, then supplies a complementary input at runtime. The attack depends on the combination of the learned component and the runtime input. **Concern** Examining the training material or runtime input alone may miss the attack. Assessment must also examine how the learned associations respond to combinations of inputs across modalities. **Cross-references** - Cisco AI Taxonomy: 19.2.1 — Convergence Payload Injection (Equivalent) ; ArXiv: - NIST AI RMF: nist-information-security — Information Security (Subset Of) - OWASP LLM Top 10 (2026): LLM05 — Data and Model Poisoning (Subset Of) ##### R-1420.007: Dataset Substitution Through Mutable References An adversary replaces content reached through a dataset’s previously accepted references while leaving those references or the manifest unchanged. A later training, tuning, or evaluation run fetches the poisoned replacement under the accepted dataset identity. **Concern** A dataset can pass review and later supply different content under the same references. Trust in the accepted manifest then carries over to bytes that were never accepted. Binding retrieval to an immutable snapshot or verified content hashes can reveal the substitution; it does not establish that the original dataset was safe. **Cross-references** - IBM Risk Atlas: atlas-data-poisoning — Data poisoning (Related, named example) - MITRE ATLAS: AML.T0008.002 — Domains (Superset Of, named example) - MITRE ATLAS: AML.T0010 — AI Supply Chain Compromise (Subset Of) - MITRE ATLAS: AML.T0010.002 — Data (Related) - MITRE ATLAS: AML.T0018 — Manipulate AI Model (Related) - MITRE ATLAS: AML.T0018.000 — Poison AI Model (Related) - MITRE ATLAS: AML.T0019 — Publish Poisoned Datasets (Related, named example) - MITRE ATLAS: AML.T0020 — Poison Training Data (Related, named example) - MITRE ATLAS: AML.T0031 — Erode AI Model Integrity (Related, named example) - MITRE ATLAS: AML.T0059 — Erode Dataset Integrity (Related, named example) - NIST AI/ML Framework: NISTAML.01 — Availability Violations (Related) - NIST AI/ML Framework: NISTAML.012 — Clean-label Poisoning (Related) - NIST AI/ML Framework: NISTAML.013 — Data Poisoning (Related, named example) - NIST AI/ML Framework: NISTAML.02 — Integrity Violations (Related) - NIST AI/ML Framework: NISTAML.021 — Clean-label Backdoor (Related) - NIST AI/ML Framework: NISTAML.023 — Backdoor Poisoning (Related) - NIST AI/ML Framework: NISTAML.024 — Targeted Poisoning (Related) - NIST AI/ML Framework: NISTAML.03 — Privacy Compromises (Related) - NIST AI/ML Framework: NISTAML.04 — Misuse Violations (Related) - NIST AI/ML Framework: NISTAML.05 — Supply Chain Attacks (Subset Of, named example) - NIST AI RMF: nist-information-security — Information Security (Related) - OWASP LLM Top 10 (2024): LLM03 — Training Data Poisoning (Related, named example) - OWASP LLM Top 10 (2025): LLM04 — Data and Model Poisoning (Related, named example) - OWASP LLM Top 10 (2026): LLM04 — Supply Chain (Subset Of) - OWASP LLM Top 10 (2026): LLM05 — Data and Model Poisoning (Subset Of) - OWASP LLM Top 10 (2026): LLM09 — Vector and Embedding Weaknesses (Related) ##### R-1420.008: Dataset Tampering An adversary inserts or alters examples or labels in a dataset held or being prepared by the system for training, tuning, or evaluation. The altered dataset is intended for use in subsequent runs. **Concern** Poisoned examples or labels can enter during local dataset preparation or through later alteration of retained data, even when external acquisition checks are sound. Protecting preparation operations and dataset write access, preserving versions, and verifying the material used by each run address this risk. **Cross-references** - AIUC-1: B007 — Enforce user access privileges to AI systems (Related, named example) - AIUC-1: B007.1 — Config: User access controls (Related, named example) - AIUC-1: B007.2 — Documentation: Access reviews (Related, named example) - IBM Risk Atlas: atlas-data-poisoning — Data poisoning (Related) - MITRE ATLAS: AML.T0018 — Manipulate AI Model (Related) - MITRE ATLAS: AML.T0018.000 — Poison AI Model (Related) - MITRE ATLAS: AML.T0020 — Poison Training Data (Related) - MITRE ATLAS: AML.T0031 — Erode AI Model Integrity (Related) - MITRE ATLAS: AML.T0059 — Erode Dataset Integrity (Related) - NIST AI/ML Framework: NISTAML.01 — Availability Violations (Related) - NIST AI/ML Framework: NISTAML.012 — Clean-label Poisoning (Related) - NIST AI/ML Framework: NISTAML.013 — Data Poisoning (Related) - NIST AI/ML Framework: NISTAML.02 — Integrity Violations (Related) - NIST AI/ML Framework: NISTAML.021 — Clean-label Backdoor (Related, named example) - NIST AI/ML Framework: NISTAML.023 — Backdoor Poisoning (Related, named example) - NIST AI/ML Framework: NISTAML.024 — Targeted Poisoning (Related, named example) - NIST AI/ML Framework: NISTAML.03 — Privacy Compromises (Related) - NIST AI/ML Framework: NISTAML.04 — Misuse Violations (Related) - NIST AI RMF: nist-information-security — Information Security (Related) - OWASP Agentic Security Initiative: ASI04 — Agentic Supply Chain Vulnerabilities (Related) - OWASP LLM Top 10 (2024): LLM03 — Training Data Poisoning (Related, named example) - OWASP LLM Top 10 (2025): LLM04 — Data and Model Poisoning (Related, named example) - OWASP LLM Top 10 (2026): LLM04 — Supply Chain (Related) - OWASP LLM Top 10 (2026): LLM05 — Data and Model Poisoning (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM06 — Unbounded Consumption (Related, named example) - OWASP LLM Top 10 (2026): LLM09 — Vector and Embedding Weaknesses (Related) ##### R-1420.009: Stored Retrieval Corpus Tampering An adversary directly alters reference material already held in a retrieval corpus after the system has accepted it for use. The altered material remains available to retrieval as accepted source content. **Concern** Accepted reference material can change after ingestion even when the original sources and intake checks are sound. Restricting corpus writes, verifying stored content against accepted versions, auditing changes and restoring intact versions address this alteration. The relevant boundary is direct modification of held content, regardless of whether storage is internal or externally hosted. **Cross-references** - MITRE ATLAS: AML.T0066 — Retrieval Content Crafting (Related) - MITRE ATLAS: AML.T0070 — RAG Poisoning (Subset Of) - MITRE ATLAS: AML.T0081 — Modify AI Agent Configuration (Related) - OWASP Agentic Security Initiative: ASI06 — Memory & Context Poisoning (Subset Of) - OWASP LLM Top 10 (2025): LLM01 — Prompt Injection (Related, named example) - OWASP LLM Top 10 (2025): LLM08 — Vector and Embedding Weaknesses (Subset Of) - OWASP LLM Top 10 (2026): LLM05 — Data and Model Poisoning (Subset Of, named example) ##### R-1420.010: Poisoning of Tool-Read Task Data An adversary plants or alters false or misleading task data that an AI agent obtains directly or indirectly from a tool. The data may be supplied as the current result of a file, record, or service lookup rather than admitted to a retrieval corpus. **Concern** An agent can act on a forged factual record even when the tool reads it correctly and the content contains no instruction. Authenticate the data source, restrict unauthorized changes, preserve provenance through intermediaries and verify material facts before acting. **Cross-references** - IBM Risk Atlas: atlas-external-resources-attack-agentic — Attack on AI agents’ external resources (Related) - MITRE ATLAS: AML.T0099 — AI Agent Tool Data Poisoning (Related) - OWASP LLM Top 10 (2026): LLM05 — Data and Model Poisoning (Related) #### R-1430: Evasion Techniques that carry an attack past a control sitting apart from the model — a classifier, a scanner, a policy engine, a reviewer — while the attack still reaches its objective. This includes payloads shaped for one environment, payloads that trigger only in conditions the control will not see, and payloads that behave differently under a different model. ##### R-1430.001: Agent-Specific Evasion A payload is crafted so that the agents inspecting it and the agents acting on it read it differently — benign to a verifier or filter agent, an instruction to a planner or executor — using the role-specific handling each agent applies. Inspection by one role does not predict behavior at another. **Concern** The discriminating variable is which agent handles the payload, so detection requires comparing how different roles interpret the same input. Layered agent review gives no assurance here: the layers are what the attack is calibrated against. **Cross-references** - Cisco AI Taxonomy: 11.1.1 — Agent-Specific Evasion (Equivalent, named example) ; ArXiv: - NIST AI/ML Framework: NISTAML.018 — Prompt Injection (Related, named example) - NIST AI/ML Framework: NISTAML.04 — Misuse Violations (Related, named example) ##### R-1430.002: Environment-Scoped Payloads An adversary makes a payload’s effect on an AI deployment depend on runtime conditions, such as production rather than staging, so that inspection or testing does not exercise the malicious behavior. The condition may be evaluated by the model, agent, or a component that supplies inputs or actions within the deployment. **Concern** Assessment must exercise the relevant deployment conditions and follow the resulting behavior through the model, agent, and connected components. A component can conceal an attack during testing even when the model never evaluates the environment condition. Environment-aware malware on a machine that also hosts AI is not included unless the AI system materially contributes to the mechanism or severity. **Cross-references** - Cisco AI Taxonomy: 11.1.3 — Environment-Scoped Payloads (Equivalent, named example) ; ArXiv: ##### R-1430.003: Defense-Aware Payloads Payloads shaped to pass inspection while preserving their function — encoded, transliterated, or reformatted so pattern matching does not recognize them, or crafted with knowledge of the specific filters, constraints, and verification steps deployed in the target system. **Concern** The payload reaching the model is complete; what inspection sees is the same payload in a form it does not match. The technique applies to every route by which an instruction arrives, so the form is what varies and the function is what is preserved. **Cross-references** - AIUC-1: C006 — Prevent output vulnerabilities (Related, named example) - AIUC-1: C006.3 — Config: Adversarial output detection (Related, named example) - Cisco AI Taxonomy: 1.1.2 — Obfuscation (Direct Prompt Injection) (Superset Of, named example) ; ArXiv: - Cisco AI Taxonomy: 1.2.2 — Obfuscation (Indirect Prompt Injection) (Superset Of) ; ArXiv: - Cisco AI Taxonomy: 11.1.4 — Defense-Aware Payloads (Superset Of) ; ArXiv: - Cisco AI Taxonomy: 15.1.11 — Safety Harms and Toxicity: Profanity (Related, named example) ; ArXiv: - Cisco AI Taxonomy: 2.1.2 — Obfuscation (Jailbreak) (Superset Of) ; ArXiv: - MITRE ATLAS: AML.T0015 — Evade AI Model (Related, named example) - MITRE ATLAS: AML.T0051.001 — Indirect (Related) - MITRE ATLAS: AML.T0054 — LLM Jailbreak (Related) - MITRE ATLAS: AML.T0068 — LLM Prompt Obfuscation (Superset Of) - MITRE ATLAS: AML.T0071 — False RAG Entry Injection (Related) - MITRE ATLAS: AML.T0076 — Corrupt AI Model (Superset Of, named example) - MITRE ATLAS: AML.T0086 — Exfiltration via AI Agent Tool Invocation (Related) - NIST AI/ML Framework: NISTAML.018 — Prompt Injection (Related, named example) - NIST AI/ML Framework: NISTAML.02 — Integrity Violations (Related, named example) - NIST AI/ML Framework: NISTAML.022 — Evasion (Related, named example) - NIST AI/ML Framework: NISTAML.025 — Black-box Evasion (Related, named example) - NIST AI/ML Framework: NISTAML.04 — Misuse Violations (Related, named example) - OWASP LLM Top 10 (2024): LLM06 — Sensitive Information Disclosure (Related, named example) - OWASP LLM Top 10 (2024): LLM10 — Model Theft (Related, named example) - OWASP LLM Top 10 (2025): LLM01 — Prompt Injection (Related, named example) - OWASP LLM Top 10 (2025): LLM02 — Sensitive Information Disclosure (Related, named example) - OWASP LLM Top 10 (2025): LLM10 — Unbounded Consumption (Related, named example) - OWASP LLM Top 10 (2026): LLM01 — Prompt Injection (Related, named example) - OWASP LLM Top 10 (2026): LLM02 — Sensitive Information Disclosure (Related) - OWASP LLM Top 10 (2026): LLM04 — Supply Chain (Related, named example) - OWASP LLM Top 10 (2026): LLM08 — Hidden Context Exposure (Related, named example) ##### R-1430.004: Conditional Attack Execution A payload is crafted to act on a particular model or version and not on others, using differences between models in tokenization, instruction-following, or training, so that it passes evaluation on one model while remaining effective against another. **Concern** The discriminating variable is which model receives the payload, so detection requires evaluating across the models actually in the deployment rather than a representative one. The variation exploited is between models: tokenization, instruction-following, and training differ, and the payload is tuned to those differences. **Cross-references** - Cisco AI Taxonomy: 11.2.2 — Conditional Attack Execution (Equivalent, named example) ; ArXiv: - NIST AI/ML Framework: NISTAML.018 — Prompt Injection (Related, named example) - NIST AI/ML Framework: NISTAML.04 — Misuse Violations (Related, named example) ##### R-1430.005: Delayed Instruction Activation An adversary supplies complete malicious instructions that remain inactive until a later interaction or event. The delay separates delivery from execution to evade checks or restrictions applied when the instructions first enter the system. **Concern** Instructions can remain available after the interaction that introduced them has ended. Controls must preserve their origin and restrictions across interactions and check the actions they eventually cause. **Cross-references** - MITRE ATLAS: AML.T0094 — Delay Execution of LLM Instructions (Equivalent, named example) #### R-1440: System Artifact Extraction Attacks that recover the system's own construction from what it or its integration layer exposes. This includes weights, architecture, decision boundaries, system prompts, configuration, the identity of components in use, and the credentials held to reach them. ##### R-1440.001: API Query-Based Extraction Systematic querying of a model's API to extract responses, behavior patterns, and model characteristics without authorization. Attackers build datasets of input-output pairs to train surrogate models that replicate the target's functionality. **Concern** API-based extraction requires no special access, only the ability to make queries. High-value models exposed through APIs are particularly vulnerable to extraction by well-resourced adversaries willing to invest in extensive querying. **Cross-references** - AIUC-1: B004 — Prevent AI endpoint scraping (Related, named example) - AIUC-1: B009 — Limit output over-exposure (Related, named example) - AIUC-1: B009.3 — Config: Output precision controls (Related, named example) - Cisco AI Taxonomy: 10.1.1 — API Query Stealing (Equivalent) ; ArXiv: - IBM Risk Atlas: atlas-extraction-attack — Extraction attack (Equivalent) - MITRE ATLAS: AML.T0005 — Create Proxy AI Model (Superset Of, named example) - MITRE ATLAS: AML.T0005.001 — Train Proxy via Replication (Equivalent, named example) - MITRE ATLAS: AML.T0024 — Exfiltration via AI Inference API (Related, named example) - MITRE ATLAS: AML.T0024.002 — Extract AI Model (Subset Of, named example) - MITRE ATLAS: AML.T0048 — External Harms (Related, named example) - MITRE ATLAS: AML.T0048.004 — AI Intellectual Property Theft (Related, named example) - NIST AI/ML Framework: NISTAML.02 — Integrity Violations (Related, named example) - NIST AI/ML Framework: NISTAML.022 — Evasion (Related, named example) - NIST AI/ML Framework: NISTAML.025 — Black-box Evasion (Related, named example) - NIST AI/ML Framework: NISTAML.03 — Privacy Compromises (Subset Of) - NIST AI/ML Framework: NISTAML.031 — Model Extraction (Subset Of) - OWASP LLM Top 10 (2024): LLM10 — Model Theft (Subset Of, named example) - OWASP LLM Top 10 (2025): LLM02 — Sensitive Information Disclosure (Related, named example) - OWASP LLM Top 10 (2025): LLM10 — Unbounded Consumption (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM02 — Sensitive Information Disclosure (Related) - OWASP LLM Top 10 (2026): LLM06 — Unbounded Consumption (Subset Of, named example) ##### R-1440.002: Weight Reconstruction Attack Attempts to recover or approximate underlying model weights, parameters, or architecture by exploiting access to model outputs, API responses, or side channels. Successful reconstruction provides full model access without legitimate authorization. **Concern** Weight reconstruction attacks threaten the core intellectual property of AI systems. Even partial weight recovery can enable attacks or provide competitive advantages to adversaries. **Cross-references** - AIUC-1: B004 — Prevent AI endpoint scraping (Related, named example) - AIUC-1: B009 — Limit output over-exposure (Related, named example) - AIUC-1: B009.3 — Config: Output precision controls (Related, named example) - Cisco AI Taxonomy: 10.1.2 — Weight Reconstruction (Equivalent) ; ArXiv: - NIST AI/ML Framework: NISTAML.018 — Prompt Injection (Related, named example) - NIST AI/ML Framework: NISTAML.03 — Privacy Compromises (Subset Of) - NIST AI/ML Framework: NISTAML.031 — Model Extraction (Subset Of, named example) - NIST AI/ML Framework: NISTAML.038 — Data Extraction (Related, named example) - NIST AI RMF: nist-information-security — Information Security (Related) - OWASP LLM Top 10 (2024): LLM10 — Model Theft (Subset Of, named example) - OWASP LLM Top 10 (2025): LLM02 — Sensitive Information Disclosure (Related, named example) - OWASP LLM Top 10 (2025): LLM10 — Unbounded Consumption (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM02 — Sensitive Information Disclosure (Subset Of, named example) ##### R-1440.003: System Prompt Extraction Extraction of system prompts, instructions, or initial context that guides model behavior through the running deployment’s model, tool, or integration responses. Exposed prompts reveal operational details, security mechanisms, intellectual property, or confidential business logic not intended for disclosure. **Concern** System prompts often contain the core logic and guardrails of AI applications. Extraction enables attackers to understand and bypass safety measures, and may expose proprietary prompting techniques or confidential instructions. **Cross-references** - Cisco AI Taxonomy: 8.4.1 — System LLM Prompt Leakage (Equivalent) ; ArXiv: - IBM Risk Atlas: atlas-prompt-injection — Prompt injection attack (Related, named example) - IBM Risk Atlas: atlas-prompt-leaking — Prompt leaking (Superset Of) - MITRE ATLAS: AML.T0056 — Extract LLM System Prompt (Subset Of) - MITRE ATLAS: AML.T0069 — Discover LLM System Information (Subset Of, named example) - MITRE ATLAS: AML.T0069.002 — System Prompt (Related, named example) - NIST AI/ML Framework: NISTAML.018 — Prompt Injection (Related, named example) - NIST AI/ML Framework: NISTAML.03 — Privacy Compromises (Subset Of) - NIST AI/ML Framework: NISTAML.035 — Prompt Extraction (Equivalent) - NIST AI/ML Framework: NISTAML.038 — Data Extraction (Subset Of, named example) - OWASP LLM Top 10 (2024): LLM01 — Prompt Injection (Related, named example) - OWASP LLM Top 10 (2025): LLM07 — System Prompt Leakage (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM02 — Sensitive Information Disclosure (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM08 — Hidden Context Exposure (Subset Of, named example) ##### R-1440.004: System Information Leakage Eliciting the disclosure of internal configuration, architecture, environment details, or infrastructure information, including the names, descriptions, parameter schemas, versions, and capabilities of the tools a system exposes, by working the documentation, error paths, and model and system responses that return them. **Concern** System information disclosure enables reconnaissance and targeted attacks. Knowledge of internal architecture, software versions, deployment topology, and defensive controls materially reduces attacker effort and increases exploit success probability. **Cross-references** - Cisco AI Taxonomy: 8.3.1 — Tool Metadata Exposure (Superset Of) ; ArXiv: - Cisco AI Taxonomy: 8.3.2 — System Information Leakage (Equivalent) ; ArXiv: - MITRE ATLAS: AML.T0006 — Active Scanning (Superset Of, named example) - MITRE ATLAS: AML.T0013 — Discover AI Model Ontology (Superset Of, named example) - MITRE ATLAS: AML.T0064 — Gather RAG-Indexed Targets (Superset Of, named example) - MITRE ATLAS: AML.T0069 — Discover LLM System Information (Related, named example) - MITRE ATLAS: AML.T0069.000 — Special Character Sets (Related, named example) - MITRE ATLAS: AML.T0069.001 — System Instruction Keywords (Related, named example) - MITRE ATLAS: AML.T0075 — Cloud Service Discovery (Superset Of, named example) - MITRE ATLAS: AML.T0084 — Discover AI Agent Configuration (Related, named example) - MITRE ATLAS: AML.T0084.000 — Embedded Knowledge (Related, named example) - MITRE ATLAS: AML.T0084.001 — Tool Definitions (Related, named example) - MITRE ATLAS: AML.T0084.002 — Activation Triggers (Related, named example) - MITRE ATLAS: AML.T0084.003 — Call Chains (Related) - NIST AI RMF: nist-information-security — Information Security (Related) - OWASP LLM Top 10 (2025): LLM07 — System Prompt Leakage (Related, named example) - OWASP LLM Top 10 (2026): LLM08 — Hidden Context Exposure (Related, named example) ##### R-1440.005: Targeted Model Fingerprinting Probing, testing, or analyzing an AI model to determine its specific identity, version, fine-tuning status, or architecture characteristics. This reconnaissance enables attackers to craft model-specific exploits that target known vulnerabilities or behaviors of particular model implementations. **Concern** Model fingerprinting is a precursor to targeted attacks. Once attackers identify the specific model in use, they can leverage known vulnerabilities, jailbreaks, or behavioral quirks specific to that model family or version. **Cross-references** - AIUC-1: B003 — Manage public release of technical details (Related, named example) - AIUC-1: B003.1 — Documentation: Technical information disclosure guidelines (Related, named example) - AIUC-1: B004 — Prevent AI endpoint scraping (Related, named example) - Cisco AI Taxonomy: 11.2.1 — Targeted Model Fingerprinting (Equivalent) ; ArXiv: - MITRE ATLAS: AML.T0014 — Discover AI Model Family (Equivalent) - MITRE ATLAS: AML.T0062 — Discover LLM Hallucinations (Superset Of, named example) - OWASP LLM Top 10 (2024): LLM10 — Model Theft (Related, named example) - OWASP LLM Top 10 (2025): LLM10 — Unbounded Consumption (Related, named example) ##### R-1440.006: Credential Elicitation An adversary induces a model or agent to generate, retrieve, reconstruct, or disclose authorization credentials through its responses or tool actions. The credential is exposed as content, rather than only being used to authenticate a connection. **Concern** The target may be a credential for the model service or for a connected resource. Keeping secrets outside model-readable context, restricting credential retrieval through tools, and checking outputs and tool arguments address this exposure. An induced action that uses a credential without revealing it is not credential elicitation. **Cross-references** - AIUC-1: A004 — Protect IP & trade secrets (Related) - AIUC-1: A008 — Prevent leakage of credentials and secrets (Related, named example) - AIUC-1: B006 — Prevent unauthorized AI agent actions (Related, named example) - AIUC-1: B006.3 — Config: Execution-level safeguards (Related, named example) - Cisco AI Taxonomy: 14.1.1 — Credential Theft (Equivalent) ; ArXiv: - Cisco AI Taxonomy: 7.4.1 — Token Theft (Related) ; ArXiv: - MITRE ATLAS: AML.T0055 — Unsecured Credentials (Superset Of, named example) - MITRE ATLAS: AML.T0082 — RAG Credential Harvesting (Superset Of, named example) - MITRE ATLAS: AML.T0083 — Credentials from AI Agent Configuration (Related, named example) - MITRE ATLAS: AML.T0098 — AI Agent Tool Credential Harvesting (Superset Of, named example) - OWASP LLM Top 10 (2025): LLM07 — System Prompt Leakage (Related, named example) - OWASP LLM Top 10 (2026): LLM02 — Sensitive Information Disclosure (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM08 — Hidden Context Exposure (Related, named example) ##### R-1440.007: Credential Disclosure Through Agent Integrations An adversary obtains credentials exposed by a running deployment’s agent or integration interfaces, without inducing the model or agent to retrieve or reveal them as content. The credential is disclosed through configuration responses, connection data, or authentication handling. **Concern** Credentials can be exposed even when the model never sees the secret. Keep credentials out of configuration and diagnostic responses, restrict access to secret-bearing interfaces, bind credentials to intended recipients and audiences, and control forwarding and redirection. A maliciously induced tool call can expose a credential through integration handling without the model retrieving the secret. Ordinary theft from stored files outside the deployment’s interfaces or flows is not this mechanism. **Cross-references** - AIUC-1: A008 — Prevent leakage of credentials and secrets (Related, named example) - AIUC-1: B008 — Protect AI system deployment environment (Related, named example) - AIUC-1: B008.2 — Config: API and agentic interface transport security (Related, named example) - Cisco AI Taxonomy: 7.4.1 — Token Theft (Related) ; ArXiv: - MITRE ATLAS: AML.T0083 — Credentials from AI Agent Configuration (Related, named example) - MITRE ATLAS: AML.T0106 — Exploitation for Credential Access (Superset Of, named example) ##### R-1440.008: Training Signal Exposed by a Tuning Interface A deployment offers a fine-tuning or evaluation interface that returns a per-example training signal such as loss. An adversary submits candidate inputs and reads the returned value, using it to optimize against the model the way gradient access would allow. **Concern** Per-example scores give an attacker feedback for refining inputs against a model whose weights are unavailable. The attacker can use a legitimate tuning interface for this purpose, making the requests difficult to distinguish from ordinary fine-tuning. **Cross-references** - OWASP LLM Top 10 (2026): LLM01 — Prompt Injection (Related, named example) #### R-1450: Privacy Attacks Attacks that recover information about people, content held in confidence, or confidential facts about data membership, from a system that holds or handles it. This includes whether a subject appeared in the training data, a knowledge base, or operational memory, what that data contained, what a user supplied in interaction, what source text can be reconstructed from the representations a retrieval store keeps, and what can be inferred from properties observable while the system serves. ##### R-1450.001: Training Data Membership Inference An adversary queries and analyzes a model’s learned behavior to infer whether a particular datapoint, record, or person’s data was used to train or fine-tune it, where that membership fact is private or confidential. **Concern** Membership inference can expose that an organization uses certain data sources, reveal individuals whose data was used in training, or confirm the presence of confidential information in training sets, creating privacy and legal exposure. **Cross-references** - AIUC-1: A005 — Prevent cross-customer data exposure (Related) - Cisco AI Taxonomy: 8.1.1 — Presence Detection (Subset Of) ; ArXiv: - IBM Risk Atlas: atlas-membership-inference-attack — Membership inference attack (Superset Of) - MITRE ATLAS: AML.T0024 — Exfiltration via AI Inference API (Related) - MITRE ATLAS: AML.T0024.000 — Infer Training Data Membership (Subset Of) - NIST AI/ML Framework: NISTAML.03 — Privacy Compromises (Subset Of) - NIST AI/ML Framework: NISTAML.033 — Membership Inference (Equivalent, named example) - NIST AI RMF: nist-information-security — Information Security (Subset Of) - OWASP LLM Top 10 (2025): LLM02 — Sensitive Information Disclosure (Subset Of) - OWASP LLM Top 10 (2026): LLM02 — Sensitive Information Disclosure (Subset Of, named example) ##### R-1450.002: Training Data Extraction Recovering information about people from a model's learned representations — reconstructing records, attributes, or identifying features that were present in the training data — by querying the model, exploiting its decision boundaries, or eliciting content it has memorized. **Concern** A model can retain personal information from its training data and expose it through its interface after the source dataset has been secured. An attacker may recover that information without gaining access to the dataset itself. **Cross-references** - AIUC-1: A005 — Prevent cross-customer data exposure (Related) - AIUC-1: A006 — Prevent PII leakage (Related, named example) - AIUC-1: B009 — Limit output over-exposure (Related, named example) - AIUC-1: B009.3 — Config: Output precision controls (Related, named example) - Cisco AI Taxonomy: 10.1.3 — Sensitive Data Reconstruction (Subset Of) ; ArXiv: - Cisco AI Taxonomy: 10.2.1 — Model Inversion (Subset Of) ; ArXiv: - Cisco AI Taxonomy: 15.1.25 — Privacy Attacks: PII / PHI / PCI (Subset Of) ; ArXiv: - Cisco AI Taxonomy: 8.2.1 — Training Data Exposure (Subset Of) ; ArXiv: - Cisco AI Taxonomy: 8.2.2 — LLM Data Leakage (Related) ; ArXiv: - IBM Risk Atlas: atlas-attribute-inference-attack — Attribute inference attack (Superset Of) - IBM Risk Atlas: atlas-prompt-priming — Prompt priming (Superset Of, named example) - MITRE ATLAS: AML.T0024 — Exfiltration via AI Inference API (Related) - MITRE ATLAS: AML.T0024.001 — Invert AI Model (Superset Of) - MITRE ATLAS: AML.T0057 — LLM Data Leakage (Related) - NIST AI/ML Framework: NISTAML.018 — Prompt Injection (Related) - NIST AI/ML Framework: NISTAML.03 — Privacy Compromises (Subset Of) - NIST AI/ML Framework: NISTAML.032 — Reconstruction (Subset Of, named example) - NIST AI/ML Framework: NISTAML.037 — Training Data Attacks (Related, named example) - NIST AI/ML Framework: NISTAML.038 — Data Extraction (Related, named example) - NIST AI RMF: nist-data-privacy — Data Privacy (Subset Of, named example) - NIST AI RMF: nist-information-security — Information Security (Related) - OWASP LLM Top 10 (2024): LLM06 — Sensitive Information Disclosure (Related, named example) - OWASP LLM Top 10 (2024): LLM10 — Model Theft (Related, named example) - OWASP LLM Top 10 (2025): LLM02 — Sensitive Information Disclosure (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM02 — Sensitive Information Disclosure (Subset Of, named example) ##### R-1450.003: Embedding Inversion An adversary with access to stored vectors reconstructs the text they were computed from. The embeddings are held by a retrieval store rather than by the model, and the source documents need not be reachable. **Concern** A vector store is often treated as derived data and protected more weakly than the documents it indexes. It gets replicated to analytics environments, shared across tenants, or left readable by a broadly scoped service account. Inversion returns much of the source content, so the store carries the confidentiality requirements of the corpus it was built from. **Cross-references** - OWASP LLM Top 10 (2025): LLM02 — Sensitive Information Disclosure (Subset Of) - OWASP LLM Top 10 (2025): LLM08 — Vector and Embedding Weaknesses (Subset Of) - OWASP LLM Top 10 (2026): LLM02 — Sensitive Information Disclosure (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM09 — Vector and Embedding Weaknesses (Subset Of, named example) ##### R-1450.004: Inference from Response Timing and Size An adversary infers protected interaction content by measuring content-dependent response timing, latency or streamed response size without receiving that content. **Concern** Encrypted traffic can still reveal content-dependent timing and size. Reduce those signals through response padding, batching or timing controls appropriate to the serving path. Removing confidence values or isolating tenant caches does not by itself conceal the timing and size of a victim’s response. **Cross-references** - OWASP Agentic Security Initiative: ASI07 — Insecure Inter-Agent Communication (Related) - OWASP LLM Top 10 (2025): LLM02 — Sensitive Information Disclosure (Subset Of) - OWASP LLM Top 10 (2026): LLM02 — Sensitive Information Disclosure (Subset Of, named example) ##### R-1450.005: Runtime Data Membership Inference An adversary probes an AI system’s responses or behavior to infer whether a particular datapoint, record, or piece of information is present in material the system retrieves or retains for use as runtime context, where that membership fact is private or confidential. This includes reference material in a knowledge base and retained interaction history or task state. **Concern** A response can reveal that a record is present in a private collection or retained interaction history without revealing its contents. Even publicly available material can disclose a private interest or activity through its membership in that collection. Restricting retrieval to the caller’s entitlement, separating users’ memory, and controlling what responses reveal address this exposure. **Cross-references** - Cisco AI Taxonomy: 8.1.1 — Presence Detection (Subset Of) ; ArXiv: - NIST AI/ML Framework: NISTAML.03 — Privacy Compromises (Subset Of) - OWASP LLM Top 10 (2025): LLM02 — Sensitive Information Disclosure (Subset Of) - OWASP LLM Top 10 (2026): LLM02 — Sensitive Information Disclosure (Subset Of) - OWASP LLM Top 10 (2026): LLM09 — Vector and Embedding Weaknesses (Related) ##### R-1450.006: Training Gradient Inversion An adversary reconstructs protected information from training examples by analyzing gradients or parameter updates produced during model training or fine-tuning. **Concern** Training updates can reveal protected examples to a party that receives the updates without being entitled to the underlying data. Restricting queries to a completed model does not address reconstruction through these training signals. **Cross-references** - NIST AI RMF: nist-information-security — Information Security (Subset Of) - OWASP LLM Top 10 (2025): LLM02 — Sensitive Information Disclosure (Subset Of) - OWASP LLM Top 10 (2026): LLM02 — Sensitive Information Disclosure (Subset Of, named example) ##### R-1450.007: Confidential Training Content Extraction An adversary recovers confidential source content from a model’s learned representations by querying the model, exploiting its decision boundaries, or eliciting content it memorized during training or fine-tuning. **Concern** A model can expose confidential source content after the original material has been secured. Personal-data recognition alone can miss proprietary formulas, prices or project details; protecting them requires knowing which source information is confidential and who may receive it. **Cross-references** - AIUC-1: A004 — Protect IP & trade secrets (Related) - AIUC-1: A005 — Prevent cross-customer data exposure (Related) - AIUC-1: B009 — Limit output over-exposure (Related, named example) - AIUC-1: B009.3 — Config: Output precision controls (Related, named example) - AIUC-1: E010 — Establish AI acceptable use policy (Related) - Cisco AI Taxonomy: 10.1.3 — Sensitive Data Reconstruction (Subset Of) ; ArXiv: - Cisco AI Taxonomy: 10.2.1 — Model Inversion (Subset Of) ; ArXiv: - Cisco AI Taxonomy: 8.2.2 — LLM Data Leakage (Related) ; ArXiv: - MITRE ATLAS: AML.T0024 — Exfiltration via AI Inference API (Related) - NIST AI/ML Framework: NISTAML.018 — Prompt Injection (Related) - NIST AI/ML Framework: NISTAML.03 — Privacy Compromises (Subset Of) - NIST AI/ML Framework: NISTAML.032 — Reconstruction (Subset Of) - NIST AI/ML Framework: NISTAML.038 — Data Extraction (Related) - NIST AI RMF: nist-information-security — Information Security (Subset Of) - OWASP LLM Top 10 (2024): LLM06 — Sensitive Information Disclosure (Subset Of) - OWASP LLM Top 10 (2024): LLM10 — Model Theft (Related, named example) - OWASP LLM Top 10 (2025): LLM02 — Sensitive Information Disclosure (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM02 — Sensitive Information Disclosure (Subset Of) ##### R-1450.008: Training Data Property Inference An adversary infers private or confidential aggregate characteristics of a model’s training or fine-tuning data from its learned behavior. This includes attributes and distributions of the dataset as a whole or of groups represented in it. **Concern** Training-data privacy can be lost through aggregate attributes or distributions even when no record is reconstructed and no individual membership fact is revealed. Privacy assessments must test confidential dataset properties separately from membership and content extraction. **Cross-references** - MITRE ATLAS: AML.T0024 — Exfiltration via AI Inference API (Related) - MITRE ATLAS: AML.T0024.000 — Infer Training Data Membership (Subset Of) - NIST AI/ML Framework: NISTAML.03 — Privacy Compromises (Subset Of) - NIST AI/ML Framework: NISTAML.034 — Property Inference (Equivalent, named example) - NIST AI RMF: nist-information-security — Information Security (Subset Of) - OWASP LLM Top 10 (2025): LLM02 — Sensitive Information Disclosure (Subset Of) - OWASP LLM Top 10 (2026): LLM02 — Sensitive Information Disclosure (Subset Of) ##### R-1450.009: Inference from Exposed Serving Telemetry An adversary reconstructs protected interaction content from numerical information exposed by model serving, such as confidence values, token log-probabilities or layer activations, without receiving the source content. **Concern** Serving telemetry can encode protected inputs or outputs even when the source text is withheld. Restrict who receives these values, reduce unnecessary detail and test reconstruction from the exposed representation. Constant response timing and isolated tenant caches do not prevent disclosure through explicitly exposed numerical telemetry. **Cross-references** - OWASP LLM Top 10 (2025): LLM02 — Sensitive Information Disclosure (Subset Of) - OWASP LLM Top 10 (2026): LLM02 — Sensitive Information Disclosure (Subset Of, named example) ##### R-1450.010: Inference from Shared Serving State An adversary probes a shared serving cache or retrieval index to infer protected content, topics or volumes belonging to another user or tenant from cache-hit behavior, result counts, score distributions or timing. **Concern** Shared state can reveal another party’s activity or data without returning its documents or messages. Partition cache and index state by entitlement and prevent counts, scores and hit behavior from reflecting material outside the caller’s scope. Hiding explicit model telemetry does not close a cross-tenant cache probe. **Cross-references** - OWASP LLM Top 10 (2025): LLM02 — Sensitive Information Disclosure (Subset Of) - OWASP LLM Top 10 (2026): LLM02 — Sensitive Information Disclosure (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM09 — Vector and Embedding Weaknesses (Related, named example) ##### R-1450.011: Interception of AI System Communications An adversary obtains protected information carried in an AI deployment’s model requests or responses, tool invocations, or inter-agent messages by intercepting the communication or compromising a recipient on that interaction path. The sending component may continue its intended behavior without being induced to disclose information to the adversary. **Concern** A permitted recipient can expose protected interaction content even when the sending agent follows its task correctly. Authenticate recipients, protect transport, minimize shared context and constrain recipient access and onward disclosure. Encryption in transit does not protect plaintext received by a compromised intended recipient. **Cross-references** - AIUC-1: B008 — Protect AI system deployment environment (Related, named example) - AIUC-1: B008.2 — Config: API and agentic interface transport security (Related, named example) - IBM Risk Atlas: atlas-external-resources-attack-agentic — Attack on AI agents’ external resources (Related) - OWASP LLM Top 10 (2025): LLM02 — Sensitive Information Disclosure (Subset Of) - OWASP LLM Top 10 (2026): LLM02 — Sensitive Information Disclosure (Related) ##### R-1450.012: Confidential Context Elicitation An adversary induces a model or agent to disclose personal or confidential task data already available in its working context to a recipient who should not receive it. The data may have been supplied by the application, retrieved for the task, or provided in an earlier interaction. **Concern** Permission for the system to use information does not establish permission to disclose it to the requester. Preserve recipient and permitted-use restrictions through response generation and outward actions. This risk concerns task data; extraction of behavior-guiding system instructions remains under R-1440.003. **Cross-references** - AIUC-1: E010 — Establish AI acceptable use policy (Related) - IBM Risk Atlas: atlas-external-resources-attack-agentic — Attack on AI agents’ external resources (Related) - MITRE ATLAS: AML.T0077 — LLM Response Rendering (Superset Of) - MITRE ATLAS: AML.T0086 — Exfiltration via AI Agent Tool Invocation (Related) - NIST AI/ML Framework: NISTAML.015 — Indirect Prompt Injection (Related, named example) - NIST AI/ML Framework: NISTAML.018 — Prompt Injection (Related, named example) - NIST AI/ML Framework: NISTAML.03 — Privacy Compromises (Subset Of, named example) - NIST AI/ML Framework: NISTAML.032 — Reconstruction (Related, named example) - NIST AI/ML Framework: NISTAML.036 — Leaking information from user interactions (Related, named example) - NIST AI/ML Framework: NISTAML.037 — Training Data Attacks (Related, named example) - NIST AI/ML Framework: NISTAML.038 — Data Extraction (Related, named example) - NIST AI/ML Framework: NISTAML.039 — Compromising connected resources (Related, named example) - NIST AI RMF: nist-information-security — Information Security (Related) - OWASP LLM Top 10 (2024): LLM01 — Prompt Injection (Related, named example) - OWASP LLM Top 10 (2024): LLM06 — Sensitive Information Disclosure (Related, named example) - OWASP LLM Top 10 (2025): LLM01 — Prompt Injection (Related, named example) - OWASP LLM Top 10 (2025): LLM02 — Sensitive Information Disclosure (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM01 — Prompt Injection (Related, named example) - OWASP LLM Top 10 (2026): LLM02 — Sensitive Information Disclosure (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM10 — Improper Output Handling (Related, named example) ##### R-1450.013: Confidential Prompt Reconstruction from Generated Output An adversary analyzes generated content to reconstruct confidential information contained in the task prompt used to produce it, beyond the information intended to be disclosed through that output. **Concern** Generated content can reveal confidential prompt details even when the original prompt is inaccessible and the generating system refuses disclosure requests. Assess what recipients can infer before releasing outputs containing sensitive inputs. Producing a similar prompt does not by itself establish recovery of the original wording or confidential information. **Cross-references** - NIST AI/ML Framework: NISTAML.03 — Privacy Compromises (Subset Of) - NIST AI/ML Framework: NISTAML.038 — Data Extraction (Related, named example) - OWASP LLM Top 10 (2025): LLM02 — Sensitive Information Disclosure (Subset Of) - OWASP LLM Top 10 (2026): LLM02 — Sensitive Information Disclosure (Subset Of) #### R-1460: Adversarial Perturbation Attacks that alter an input so the model's own processing of it yields an incorrect or attacker-chosen result, without the input carrying any instruction. This includes pixel-level and structural changes to images, patterns and patches placed in a physical scene, and equivalents in audio and other modalities. ##### R-1460.001: Visual Perception Manipulation Modification of visual content through pixel-level changes, structural alterations, or pattern overlays to influence how AI models perceive and process images. Unlike embedded text injection, this targets the model's visual interpretation directly to cause misclassification or altered decision-making. **Concern** Adversarial perturbations in images can be imperceptible to humans while dramatically affecting model outputs. This creates risks in safety-critical applications like autonomous vehicles, medical imaging, and security systems. **Cross-references** - Cisco AI Taxonomy: 1.4.2 — Image Manipulation (Equivalent, named example) ; ArXiv: - IBM Risk Atlas: atlas-evasion-attack — Evasion attack (Related, named example) - MITRE ATLAS: AML.T0015 — Evade AI Model (Subset Of, named example) - MITRE ATLAS: AML.T0031 — Erode AI Model Integrity (Subset Of) - MITRE ATLAS: AML.T0041 — Physical Environment Access (Related, named example) - MITRE ATLAS: AML.T0043.004 — Insert Backdoor Trigger (Related, named example) - MITRE ATLAS: AML.T0073 — Impersonation (Related, named example) - NIST AI/ML Framework: NISTAML.02 — Integrity Violations (Subset Of, named example) - NIST AI/ML Framework: NISTAML.022 — Evasion (Subset Of, named example) - NIST AI/ML Framework: NISTAML.025 — Black-box Evasion (Related, named example) - NIST AI RMF: nist-information-integrity — Information Integrity (Related) - OWASP LLM Top 10 (2026): LLM06 — Unbounded Consumption (Related, named example) ##### R-1460.002: Adversarial Text Perturbation An adversary alters the characters, wording, or structure of text so that a model misclassifies, mistranslates, or otherwise misinterprets it. The altered text acts as task data rather than as an instruction to change the model’s behavior. **Concern** Crafted text can change a model’s interpretation without an instruction to override its task. The resulting classification or translation can be wrong even when instruction boundaries are enforced. Robustness checks must exercise the text-processing task itself. **Cross-references** - Cisco AI Taxonomy: 4.3.1 — Schema Inconsistencies (Related) ; ArXiv: - IBM Risk Atlas: atlas-evasion-attack — Evasion attack (Related) - MITRE ATLAS: AML.T0015 — Evade AI Model (Subset Of, named example) - MITRE ATLAS: AML.T0031 — Erode AI Model Integrity (Subset Of, named example) - NIST AI/ML Framework: NISTAML.02 — Integrity Violations (Subset Of) - NIST AI/ML Framework: NISTAML.022 — Evasion (Subset Of, named example) - NIST AI/ML Framework: NISTAML.025 — Black-box Evasion (Related) - NIST AI RMF: nist-information-integrity — Information Integrity (Related) ##### R-1460.003: Adversarial Audio Perturbation An adversary alters an audio signal so that a model transcribes, classifies or otherwise interprets it incorrectly. The altered signal acts as task data rather than an instruction to change the model’s behavior. **Concern** A small change to an audio signal can produce a wrong transcript or classification even when the system follows its task correctly. Speech and acoustic robustness checks must test the received signal and resulting interpretation. Preventing hidden commands alone does not address errors that occur before any instruction is acted on. **Cross-references** - IBM Risk Atlas: atlas-evasion-attack — Evasion attack (Related) - MITRE ATLAS: AML.T0015 — Evade AI Model (Subset Of) - MITRE ATLAS: AML.T0031 — Erode AI Model Integrity (Subset Of) - MITRE ATLAS: AML.T0041 — Physical Environment Access (Related) - NIST AI/ML Framework: NISTAML.02 — Integrity Violations (Subset Of) - NIST AI/ML Framework: NISTAML.022 — Evasion (Subset Of, named example) - NIST AI/ML Framework: NISTAML.025 — Black-box Evasion (Related) ### R-1500: Tooling & Privilege Attacks Attacks exploiting existing configured AI system integrations, tools, and privilege boundaries by driving them beyond the scope the deployment intended. This includes reaching what should be out of reach, acting with standing that was not conferred, denying the system's use to others, and operating through those capabilities once inside. #### R-1510: Tool & Execution Abuse Adversarial use of an AI deployment's configured tools, interpreters, network clients, file interfaces, and retrieval pipelines, inducing the system to execute code, reach systems, or act on resources beyond the scope the deployment intended. The attack abuses the use of an existing configured capability; the capability can perform the requested operation as designed. ##### R-1510.001: Unauthorized Invocation Arguments An adversary supplies or induces arguments to a configured tool or model invocation that exceed the legitimate task’s permitted content, recipient, quantity or operating mode. The capability and its resource reach remain as configured; the particular invocation crosses the task’s authorization bounds. **Concern** Authorize the arguments of each invocation against the task, including what data may be sent and who may receive it. A correctly sandboxed mail tool can still send sensitive content already in context to the wrong recipient through its intended mail service. Resource reach, interpreter confinement and persistent configuration integrity do not establish that authorization. **Cross-references** - AIUC-1: D003 — Restrict unsafe tool calls (Related, named example) - Cisco AI Taxonomy: 12.1.1 — Parameter Manipulation (Subset Of) ; ArXiv: - Cisco AI Taxonomy: 8.2.3 — Data Exfiltration via Agent Tooling (Related) ; ArXiv: - MITRE ATLAS: AML.T0086 — Exfiltration via AI Agent Tool Invocation (Related, named example) - NIST AI/ML Framework: NISTAML.018 — Prompt Injection (Related, named example) - NIST AI/ML Framework: NISTAML.02 — Integrity Violations (Related, named example) - OWASP Agentic Security Initiative: ASI02 — Tool Misuse and Exploitation (Related, named example) - OWASP LLM Top 10 (2024): LLM01 — Prompt Injection (Related, named example) - OWASP LLM Top 10 (2024): LLM07 — Insecure Plugin Design (Related, named example) - OWASP LLM Top 10 (2025): LLM01 — Prompt Injection (Related, named example) - OWASP LLM Top 10 (2026): LLM01 — Prompt Injection (Related, named example) ##### R-1510.002: Filesystem Operations An adversary drives the system to read, write, move, or delete files through a configured file tool, reaching paths outside those the task it was given requires. **Concern** A file capability reaches the whole namespace the process can see, not the subset a task needs, so the same configured tool that serves the request also reaches everything else on the host. **Cross-references** - AIUC-1: B006 — Prevent unauthorized AI agent actions (Related, named example) - AIUC-1: B006.3 — Config: Execution-level safeguards (Related, named example) - Cisco AI Taxonomy: 12.1.1 — Parameter Manipulation (Subset Of) ; ArXiv: - Cisco AI Taxonomy: 12.1.3 — Unsafe System / Browser / File Execution (Subset Of) ; ArXiv: - Cisco AI Taxonomy: 9.1.2 — Unauthorized or Unsolicited System Access (Subset Of) ; ArXiv: - MITRE ATLAS: AML.T0101 — Data Destruction via AI Agent Tool Invocation (Superset Of, named example) - MITRE ATLAS: AML.T0112 — Machine Compromise (Related) - MITRE ATLAS: AML.T0112.000 — Local AI Agent (Related) ##### R-1510.003: Code Execution An adversary drives the system to run code on the host through a capability configured for it — a code interpreter, a shell, or an evaluation tool — so that attacker-chosen code executes with the privileges the runtime holds. **Concern** Control over a code-execution invocation can become arbitrary action with the runtime’s privileges. The reachable blast radius is determined by those privileges rather than by the legitimate task. **Cross-references** - AIUC-1: B006 — Prevent unauthorized AI agent actions (Related, named example) - AIUC-1: B006.3 — Config: Execution-level safeguards (Related, named example) - Cisco AI Taxonomy: 12.1.1 — Parameter Manipulation (Subset Of) ; ArXiv: - Cisco AI Taxonomy: 12.1.3 — Unsafe System / Browser / File Execution (Subset Of) ; ArXiv: - Cisco AI Taxonomy: 9.1.1 — Code Execution (Equivalent) ; ArXiv: - Cisco AI Taxonomy: 9.1.2 — Unauthorized or Unsolicited System Access (Subset Of) ; ArXiv: - Cisco AI Taxonomy: 9.1.5 — Template Injection (e.g., SSTI) (Related) ; ArXiv: - IBM Risk Atlas: atlas-unauthorized-use-agentic — Unauthorized use (Related, named example) - MITRE ATLAS: AML.T0048 — External Harms (Related, named example) - MITRE ATLAS: AML.T0050 — Command and Scripting Interpreter (Superset Of, named example) - MITRE ATLAS: AML.T0053 — AI Agent Tool Invocation (Related, named example) - MITRE ATLAS: AML.T0086 — Exfiltration via AI Agent Tool Invocation (Related, named example) - MITRE ATLAS: AML.T0100 — AI Agent Clickbait (Related, named example) - MITRE ATLAS: AML.T0105 — Escape to Host (Related, named example) - MITRE ATLAS: AML.T0110 — AI Agent Tool Poisoning (Related) - MITRE ATLAS: AML.T0112 — Machine Compromise (Subset Of, named example) - MITRE ATLAS: AML.T0112.000 — Local AI Agent (Related, named example) - NIST AI/ML Framework: NISTAML.015 — Indirect Prompt Injection (Related) - NIST AI/ML Framework: NISTAML.02 — Integrity Violations (Related) - NIST AI RMF: nist-information-security — Information Security (Related) - OWASP Agentic Security Initiative: ASI02 — Tool Misuse and Exploitation (Subset Of, named example) - OWASP Agentic Security Initiative: ASI05 — Unexpected Code Execution (RCE) (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM01 — Prompt Injection (Related, named example) - OWASP LLM Top 10 (2026): LLM02 — Sensitive Information Disclosure (Related, named example) ##### R-1510.004: Host and Configuration Changes An adversary drives the system to alter its own runtime configuration or the host it runs on — settings, environment, credentials in place, or installed components — through a capability configured to permit such changes. **Concern** A configuration change persists beyond the request that made it, so one successful manipulation alters the conditions under which every later request runs. **Cross-references** - Cisco AI Taxonomy: 12.1.1 — Parameter Manipulation (Subset Of) ; ArXiv: - Cisco AI Taxonomy: 9.1.2 — Unauthorized or Unsolicited System Access (Subset Of) ; ArXiv: - MITRE ATLAS: AML.T0112 — Machine Compromise (Related) - MITRE ATLAS: AML.T0112.000 — Local AI Agent (Related) ##### R-1510.005: Network Egress and Fetch An adversary drives the system to fetch from or connect to network destinations through a configured network capability — a browser, an HTTP client, or a service integration — reaching hosts and services the deployment did not intend it to reach. **Concern** A network capability is defined by what it can reach rather than by what the task requires it to reach, and the distance between those two is where the exposure sits. **Cross-references** - AIUC-1: B006 — Prevent unauthorized AI agent actions (Related, named example) - AIUC-1: B006.1 — Config: Agent service access restrictions (Related, named example) - AIUC-1: E009 — Monitor third-party access (Related, named example) - Cisco AI Taxonomy: 12.1.1 — Parameter Manipulation (Subset Of) ; ArXiv: - Cisco AI Taxonomy: 12.1.3 — Unsafe System / Browser / File Execution (Related, named example) ; ArXiv: - Cisco AI Taxonomy: 4.3.3 — Server Rebinding Attack (Superset Of) ; ArXiv: - Cisco AI Taxonomy: 4.3.6 — Cross-Origin Exploitation (Related) ; ArXiv: - Cisco AI Taxonomy: 9.1.3 — Unauthorized or Unsolicited Network Access (Equivalent) ; ArXiv: - MITRE ATLAS: AML.T0011 — User Execution (Related, named example) - MITRE ATLAS: AML.T0011.003 — Malicious Link (Superset Of, named example) - MITRE ATLAS: AML.T0112 — Machine Compromise (Related) - MITRE ATLAS: AML.T0112.000 — Local AI Agent (Related) - NIST AI/ML Framework: NISTAML.015 — Indirect Prompt Injection (Related, named example) - NIST AI/ML Framework: NISTAML.03 — Privacy Compromises (Related, named example) - NIST AI/ML Framework: NISTAML.036 — Leaking information from user interactions (Related, named example) - NIST AI/ML Framework: NISTAML.039 — Compromising connected resources (Related, named example) - OWASP Agentic Security Initiative: ASI02 — Tool Misuse and Exploitation (Related, named example) - OWASP LLM Top 10 (2024): LLM07 — Insecure Plugin Design (Related, named example) - OWASP LLM Top 10 (2026): LLM02 — Sensitive Information Disclosure (Related, named example) ##### R-1510.006: Exfiltration via Agent Tools An adversary drives the system across two capabilities in sequence — reading sensitive material through one configured tool and sending it outward through another — so that data the deployment holds reaches a destination the adversary controls. **Concern** Neither capability is misused in isolation: the read is a read the system is configured to perform and the send is a send it is configured to perform. The exposure is the reachable path between them, which is why it is a property of the pair rather than of either tool. **Cross-references** - AIUC-1: A003 — Limit AI agent data access (Related, named example) - Cisco AI Taxonomy: 4.3.6 — Cross-Origin Exploitation (Related) ; ArXiv: - Cisco AI Taxonomy: 8.2.3 — Data Exfiltration via Agent Tooling (Subset Of) ; ArXiv: - IBM Risk Atlas: atlas-external-resources-attack-agentic — Attack on AI agents’ external resources (Related) - MITRE ATLAS: AML.T0053 — AI Agent Tool Invocation (Related, named example) - MITRE ATLAS: AML.T0077 — LLM Response Rendering (Related, named example) - MITRE ATLAS: AML.T0085 — Data from AI Services (Related, named example) - MITRE ATLAS: AML.T0086 — Exfiltration via AI Agent Tool Invocation (Subset Of, named example) - MITRE ATLAS: AML.T0110 — AI Agent Tool Poisoning (Related) - MITRE ATLAS: AML.T0112 — Machine Compromise (Related) - MITRE ATLAS: AML.T0112.000 — Local AI Agent (Related) - NIST AI/ML Framework: NISTAML.015 — Indirect Prompt Injection (Related, named example) - NIST AI/ML Framework: NISTAML.03 — Privacy Compromises (Subset Of, named example) - NIST AI/ML Framework: NISTAML.039 — Compromising connected resources (Related, named example) - NIST AI RMF: nist-information-security — Information Security (Related) - OWASP Agentic Security Initiative: ASI02 — Tool Misuse and Exploitation (Subset Of, named example) - OWASP Agentic Security Initiative: ASI10 — Rogue Agents (Related, named example) - OWASP LLM Top 10 (2026): LLM01 — Prompt Injection (Related, named example) - OWASP LLM Top 10 (2026): LLM02 — Sensitive Information Disclosure (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM10 — Improper Output Handling (Related) ##### R-1510.007: Data Collection through Configured Retrieval Capabilities An adversary causes an AI system to retrieve data through a configured retrieval path, tool or service integration beyond the data scope permitted for the requesting party or the legitimate task. The retrieved data enters the model's context, working state or response. This includes retrieval invoked by the model or agent and retrieval performed by the application's pipeline. A separate sending step is not required. **Concern** A configured read capability can retrieve information beyond the permitted task or requesting party’s scope even while it operates as designed. Control the query and its results before data enters model context; checks on a later response or sending tool do not replace that read boundary. **Cross-references** - AIUC-1: A003 — Limit AI agent data access (Related, named example) - AIUC-1: A005 — Prevent cross-customer data exposure (Related, named example) - AIUC-1: D003 — Restrict unsafe tool calls (Related, named example) - AIUC-1: D004 — Third-party testing of tool calls (Related) - MITRE ATLAS: AML.T0085 — Data from AI Services (Superset Of, named example) - MITRE ATLAS: AML.T0085.000 — RAG Databases (Superset Of, named example) - MITRE ATLAS: AML.T0085.001 — AI Agent Tools (Superset Of, named example) - NIST AI/ML Framework: NISTAML.03 — Privacy Compromises (Related) - OWASP LLM Top 10 (2026): LLM01 — Prompt Injection (Related, named example) ##### R-1510.008: Unauthorized Agent Provisioning An adversary causes an AI agent to use a configured provisioning or orchestration capability to create or start additional agent instances beyond the scope the deployment intended. **Concern** Authority to provision workloads can allow an agent to create further instances with their own resources, credentials, and access. Authorize agent-instance creation at the provisioning boundary and constrain the number, destinations, identities, and permissions of instances it can create. **Cross-references** - OWASP Agentic Security Initiative: ASI10 — Rogue Agents (Subset Of, named example) #### R-1520: Availability Abuse Attacks that make a system unavailable or unusable for its purpose, or deliberately impose unwanted operating costs. These include consuming computational resources and causing requests that should succeed to return nothing usable. ##### R-1520.001: Compute Exhaustion An adversary submits long queries, adversarial inputs, or compute-intensive requests that consume excessive computation. This includes prompts that maximize token generation or trigger expensive processing paths. **Concern** A small number of expensive requests can occupy computation needed by other users or run up usage charges. Limits on request counts alone may leave this exposure, because the work required by each request varies. **Cross-references** - AIUC-1: B009 — Limit output over-exposure (Related, named example) - AIUC-1: B009.1 — Config: Output volume limits (Related, named example) - Cisco AI Taxonomy: 13.1.1 — Compute Exhaustion (Equivalent) ; ArXiv: - Cisco AI Taxonomy: 13.1.2 — Memory Flooding (Subset Of) ; ArXiv: - Cisco AI Taxonomy: 13.1.3 — Model Denial of Service (Related) ; ArXiv: - MITRE ATLAS: AML.T0029 — Denial of AI Service (Superset Of, named example) - MITRE ATLAS: AML.T0034 — Cost Harvesting (Related, named example) - MITRE ATLAS: AML.T0034.001 — Resource-Intensive Queries (Superset Of, named example) - MITRE ATLAS: AML.T0034.002 — Agentic Resource Consumption (Related, named example) - NIST AI/ML Framework: NISTAML.01 — Availability Violations (Related, named example) - NIST AI/ML Framework: NISTAML.014 — Energy-latency (Superset Of) - NIST AI/ML Framework: NISTAML.015 — Indirect Prompt Injection (Related, named example) - NIST AI/ML Framework: NISTAML.016 — Manipulate Resources (Related, named example) - NIST AI/ML Framework: NISTAML.017 — Time-Consuming Tasks (Superset Of, named example) - NIST AI RMF: nist-information-security — Information Security (Related) - OWASP LLM Top 10 (2024): LLM04 — Model Denial of Service (Related, named example) - OWASP LLM Top 10 (2025): LLM10 — Unbounded Consumption (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM06 — Unbounded Consumption (Subset Of, named example) ##### R-1520.002: Memory Flooding An adversary causes an AI model or agent to retain or allocate enough working memory that legitimate processing slows or fails. The attack uses memory-intensive requests or accumulated state whose storage exceeds the memory available to the deployment. **Concern** Working-memory budgets and bounded retention protect memory capacity. Limiting request count, computation or open connections alone does not bound the memory held by an accepted request or retained state. **Cross-references** - Cisco AI Taxonomy: 13.1.2 — Memory Flooding (Subset Of) ; ArXiv: - MITRE ATLAS: AML.T0034.002 — Agentic Resource Consumption (Related, named example) - NIST AI RMF: nist-information-security — Information Security (Subset Of) - OWASP LLM Top 10 (2025): LLM10 — Unbounded Consumption (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM06 — Unbounded Consumption (Subset Of, named example) ##### R-1520.003: Aggregate Inference Capacity Exhaustion An adversary drives combined demand across requests or callers beyond the deployment’s shared inference-processing throughput. Per-request and per-caller controls do not bound that aggregate demand to the capacity available. **Concern** Limits on individual requests and callers can leave the inference service overloaded when their work is combined. Admission control and load shedding based on shared inference-processing capacity address that aggregate boundary. An attack can also exceed individual limits; the aggregate capacity obligation remains independently applicable. Occupied connection slots or exhausted working memory without inference-processing saturation are assessed separately. **Cross-references** - AIUC-1: B004 — Prevent AI endpoint scraping (Related, named example) - Cisco AI Taxonomy: 13.1.3 — Model Denial of Service (Subset Of) ; ArXiv: - NIST AI RMF: nist-information-security — Information Security (Subset Of) - OWASP LLM Top 10 (2024): LLM04 — Model Denial of Service (Subset Of, named example) - OWASP LLM Top 10 (2025): LLM10 — Unbounded Consumption (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM06 — Unbounded Consumption (Subset Of, named example) ##### R-1520.004: Application Denial of Service Interacting with an AI model or agent in ways that consume exceptionally high amounts of application-level resources, resulting in degraded service quality for other users and potentially incurring significant resource costs for the operator. **Concern** Resource-intensive interactions can prevent other users from completing work through the application. Limits on each caller and on the resources allocated to their work can protect shared application capacity; a limit on the size of a single model response may not cover the work the surrounding application performs. **Cross-references** - Cisco AI Taxonomy: 13.1.3 — Model Denial of Service (Subset Of) ; ArXiv: - Cisco AI Taxonomy: 13.1.4 — Application Denial of Service (Equivalent) ; ArXiv: - Cisco AI Taxonomy: 18.2.1 — Abuse of APIs for Mass Automation (Related) ; ArXiv: - MITRE ATLAS: AML.T0029 — Denial of AI Service (Superset Of) - NIST AI RMF: nist-information-security — Information Security (Subset Of) - OWASP LLM Top 10 (2024): LLM04 — Model Denial of Service (Subset Of, named example) - OWASP LLM Top 10 (2025): LLM10 — Unbounded Consumption (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM06 — Unbounded Consumption (Subset Of, named example) ##### R-1520.005: Decision Paralysis Attacks Overwhelming AI decision-making systems with contradictory information, excessive options, conflicting objectives, or computationally intractable choices. These attacks prevent timely decisions, cause system freezing, or force systems into default or potentially unsafe behaviors. **Concern** AI systems that cannot make timely decisions may fail open in dangerous ways or fall back to default behaviors that attackers can predict and exploit. Decision paralysis in time-critical systems can have serious consequences. **Cross-references** - Cisco AI Taxonomy: 13.1.5 — Decision Paralysis Attacks (Equivalent) ; ArXiv: - NIST AI RMF: nist-information-security — Information Security (Related) ##### R-1520.006: Cost Inflation Abuse An adversary uses an AI deployment to impose unwanted operating costs, for example by triggering unnecessary model calls, expensive processing, or repeated billable tool use. The attack can raise costs without exhausting capacity or interrupting service. **Concern** Usage charges can exceed the operator's budget even while the service remains available. Automatic scaling may preserve response times by adding billable capacity, so service health alone does not show whether spending remains acceptable. **Cross-references** - AIUC-1: D003 — Restrict unsafe tool calls (Related) - Cisco AI Taxonomy: 13.2.1 — Service Misuse for Cost Inflation (Subset Of) ; ArXiv: - MITRE ATLAS: AML.T0034 — Cost Harvesting (Superset Of) - OWASP LLM Top 10 (2024): LLM04 — Model Denial of Service (Related, named example) - OWASP LLM Top 10 (2025): LLM10 — Unbounded Consumption (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM06 — Unbounded Consumption (Subset Of, named example) ##### R-1520.007: API Mass Automation Abuse An adversary sends requests to an AI API in bulk, exhausting capacity available to other users or increasing the cost of serving them. The volume can be excessive even when each request is ordinary and inexpensive to process. **Concern** Many individually ordinary requests can collectively consume a service's capacity or budget. Per-request work limits do not bound their total number; caller quotas and rate limits address that volume. **Cross-references** - AIUC-1: B002 — Detect adversarial input (Related, named example) - AIUC-1: B004 — Prevent AI endpoint scraping (Related, named example) - AIUC-1: E009 — Monitor third-party access (Related, named example) - Cisco AI Taxonomy: 13.1.2 — Memory Flooding (Subset Of) ; ArXiv: - Cisco AI Taxonomy: 13.1.3 — Model Denial of Service (Related) ; ArXiv: - Cisco AI Taxonomy: 18.2.1 — Abuse of APIs for Mass Automation (Subset Of) ; ArXiv: - MITRE ATLAS: AML.T0029 — Denial of AI Service (Related, named example) - MITRE ATLAS: AML.T0034 — Cost Harvesting (Related) - MITRE ATLAS: AML.T0034.000 — Excessive Queries (Superset Of) - NIST AI RMF: nist-information-security — Information Security (Related) - OWASP LLM Top 10 (2024): LLM04 — Model Denial of Service (Related, named example) - OWASP LLM Top 10 (2025): LLM10 — Unbounded Consumption (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM06 — Unbounded Consumption (Subset Of, named example) ##### R-1520.008: Retrieval-Induced Answer Suppression An adversary places content in a retrieval corpus that is selected for a target query and causes the model to refuse to answer or report that it lacks information. The attack exploits retrieval and refusal behavior without inserting instructions. **Concern** A planted document can suppress selected queries while ordinary queries continue to work. The refusal may look like a legitimate safety decision or missing source material, masking an availability attack. **Cross-references** - NIST AI RMF: nist-information-security — Information Security (Subset Of) - OWASP LLM Top 10 (2026): LLM09 — Vector and Embedding Weaknesses (Related) ##### R-1520.009: Review Capacity Exhaustion An adversary drives the system to queue more items for human review than the reviewers can examine, and items wait unexamined or are cleared without being read. **Concern** A review queue can accept items faster than people can examine them, even when compute and spending remain within their limits. Reviewers may clear items without substantive checks to keep up with the queue. An approval gate can therefore remain in place while no longer providing the scrutiny the system depends on. **Cross-references** - MITRE ATLAS: AML.T0046 — Spamming AI System with Chaff Data (Superset Of) - NIST AI RMF: nist-information-security — Information Security (Related) ##### R-1520.010: Adversarial Deduplication Suppression An adversary contributes content crafted to make a similarity-based deduplication process reject distinct legitimate material as already present, preventing that material from being admitted to the corpus. **Concern** Distinct source material can be lost from updates before it is ever retrieved. The loss can look like successful duplicate removal, leaving later answers incomplete or stale. **Cross-references** - NIST AI RMF: nist-information-security — Information Security (Related) - OWASP LLM Top 10 (2026): LLM09 — Vector and Embedding Weaknesses (Subset Of) ##### R-1520.011: Outstanding Operation Exhaustion An adversary causes an AI deployment to retain enough open connections, in-flight calls or queued operations that it cannot admit or complete legitimate work. **Concern** Limit concurrent and queued operations, apply deadlines, and release abandoned connections or calls. Modest-memory operations can hold every available slot without exhausting memory or violating a request-rate limit. Memory budgets alone do not release those slots. **Cross-references** - Cisco AI Taxonomy: 13.1.2 — Memory Flooding (Subset Of) ; ArXiv: - MITRE ATLAS: AML.T0034 — Cost Harvesting (Related, named example) - MITRE ATLAS: AML.T0034.002 — Agentic Resource Consumption (Related, named example) - NIST AI RMF: nist-information-security — Information Security (Subset Of) - OWASP LLM Top 10 (2024): LLM04 — Model Denial of Service (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM06 — Unbounded Consumption (Subset Of) ##### R-1520.012: Context Capacity Exhaustion An adversary fills the context available to a model with enough material that a legitimate task cannot be accepted or completed within the context limit. **Concern** Reserve and bound context allocated to task inputs, retrieved material and retained history, and reduce or reject excess material before assembly. A task can exceed its context allocation while compute, memory and caller budgets remain within limits. Keeping governing instructions authoritative does not by itself leave room for the task. **Cross-references** - Cisco AI Taxonomy: 13.1.2 — Memory Flooding (Subset Of) ; ArXiv: - NIST AI RMF: nist-information-security — Information Security (Subset Of) - OWASP LLM Top 10 (2024): LLM04 — Model Denial of Service (Subset Of, named example) #### R-1530: Privilege Escalation Attacks escalating access privileges, bypassing authorization controls, or gaining elevated permissions beyond intended scope. ##### R-1530.001: Permission Escalation via Delegation Actions that exceed the scope or resource access initially allowed to a subject or user by exploiting delegation mechanisms. Attackers gain privileged access and perform unauthorized tasks beyond their original authorization by manipulating how AI systems handle delegated permissions. **Concern** Delegation mechanisms in AI systems may not properly constrain the scope of delegated authority. Attackers can exploit these gaps to perform actions that the original delegator never intended to authorize. **Cross-references** - AIUC-1: A003 — Limit AI agent data access (Related, named example) - Cisco AI Taxonomy: 14.2.1 — Permission Escalation via Delegation (Equivalent) ; ArXiv: - MITRE ATLAS: AML.T0051 — LLM Prompt Injection (Related) - MITRE ATLAS: AML.T0053 — AI Agent Tool Invocation (Related, named example) - OWASP Agentic Security Initiative: ASI03 — Identity and Privilege Abuse (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM01 — Prompt Injection (Related, named example) ##### R-1530.002: Capability Inflation Exploiting system mechanisms to artificially expand an agent's capabilities, permissions, or authority beyond intended limits. Attackers escalate privileges through protocol manipulation or capability misrepresentation to enable unauthorized actions. **Concern** Capability-based security models depend on accurate capability representation. When capabilities can be inflated, the principle of least privilege is violated, enabling broader system compromise. **Cross-references** - Cisco AI Taxonomy: 4.3.5 — Capability Inflation (Equivalent) ; ArXiv: #### R-1540: Adversarial Output Chaining An adversary shapes a system's output so that a downstream consumer treats untrusted generated content as trusted instructions or executable syntax. The attack exploits how the consumer interprets or grants authority to that content, allowing it to control execution or direct further action. Passing a model or agent's call to a delegated tool does not by itself establish this pattern. ##### R-1540.001: Adversarial Content Reaching a Downstream Executor An adversary shapes what the system emits so that the emitted artifact is treated as instruction by a downstream component that executes it — template syntax evaluated by a rendering engine, a query executed by a database, a command run by a shell, or markup rendered into a page. **Concern** The model may be behaving correctly throughout: it emits what it was asked to emit. The defect is that the consuming component grants that output the standing of trusted input, so influence over the prompt becomes execution on the consumer. Attaches where the artifact is consumed, not where it was shaped. **Cross-references** - AIUC-1: C006 — Prevent output vulnerabilities (Related, named example) - AIUC-1: C006.1 — Config: Output sanitization (Related, named example) - AIUC-1: C006.3 — Config: Adversarial output detection (Related, named example) - Cisco AI Taxonomy: 9.1.5 — Template Injection (e.g., SSTI) (Superset Of, named example) ; ArXiv: - IBM Risk Atlas: atlas-exploit-trust-mismatch-agentic — Exploit trust mismatch (Related) - MITRE ATLAS: AML.T0037 — Data from Local System (Related, named example) - MITRE ATLAS: AML.T0077 — LLM Response Rendering (Superset Of, named example) - NIST AI/ML Framework: NISTAML.015 — Indirect Prompt Injection (Related, named example) - NIST AI/ML Framework: NISTAML.018 — Prompt Injection (Related, named example) - NIST AI/ML Framework: NISTAML.02 — Integrity Violations (Related, named example) - NIST AI/ML Framework: NISTAML.03 — Privacy Compromises (Related, named example) - NIST AI/ML Framework: NISTAML.036 — Leaking information from user interactions (Related, named example) - NIST AI RMF: nist-information-security — Information Security (Related) - OWASP Agentic Security Initiative: ASI05 — Unexpected Code Execution (RCE) (Related, named example) - OWASP LLM Top 10 (2024): LLM01 — Prompt Injection (Related, named example) - OWASP LLM Top 10 (2024): LLM02 — Insecure Output Handling (Subset Of, named example) - OWASP LLM Top 10 (2025): LLM01 — Prompt Injection (Related, named example) - OWASP LLM Top 10 (2025): LLM05 — Improper Output Handling (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM01 — Prompt Injection (Related, named example) - OWASP LLM Top 10 (2026): LLM10 — Improper Output Handling (Subset Of, named example) ##### R-1540.002: Tool-Scoped Evasion Adversaries design payloads that evade security tools and content filters while manifesting malicious behavior when routed to specific vulnerable tools or APIs in the workflow. A string may appear harmless in a chat context but trigger exploits when passed to file I/O tools, database queries, or system commands. **Concern** Security scanning focused on conversational safety may miss payloads designed to exploit downstream tools. This allows attackers to bypass guardrails by targeting the gap between content moderation and tool execution. **Cross-references** - Cisco AI Taxonomy: 11.1.2 — Tool-Scoped Evasion (Equivalent, named example) ; ArXiv: ##### R-1540.003: Multi-Agent Direct Injection In multi-agent systems, attackers inject malicious instructions through one agent's output that are then trusted and executed by downstream agents. This exploits the inherent trust relationships between cooperating agents, where outputs from one component become trusted inputs to another. **Concern** Multi-agent architectures amplify injection risks by creating chains of trust that attackers can exploit. A single compromised agent can cascade malicious instructions through the entire system, potentially affecting multiple downstream processes. **Cross-references** - AIUC-1: C006 — Prevent output vulnerabilities (Related, named example) - AIUC-1: C006.3 — Config: Adversarial output detection (Related, named example) - Cisco AI Taxonomy: 1.1.3 — Multi-Agent Prompt Injection (Equivalent) ; ArXiv: - Cisco AI Taxonomy: 1.2.3 — Multi-Agent (Indirect Prompt Injection) (Subset Of) ; ArXiv: - Cisco AI Taxonomy: 2.1.5 — Multi-Agent Jailbreak Collaboration (Related) ; ArXiv: - IBM Risk Atlas: atlas-exploit-trust-mismatch-agentic — Exploit trust mismatch (Subset Of) - OWASP Agentic Security Initiative: ASI03 — Identity and Privilege Abuse (Related, named example) - OWASP Agentic Security Initiative: ASI04 — Agentic Supply Chain Vulnerabilities (Related, named example) - OWASP Agentic Security Initiative: ASI07 — Insecure Inter-Agent Communication (Subset Of, named example) #### R-1550: Command & Control An adversary directs a deployment's capabilities across an extended engagement rather than in a single act, using a surface the deployment provides as the channel for instructions and results. The deployment serves its ordinary purpose while carrying the exchange. ##### R-1550.001: Agent Repurposed for Sustained Control An adversary repeatedly directs an agent already running in an environment to carry out the adversary's tasks. The agent uses its existing tools and permissions, and the individual actions remain within the access the deployment granted it. **Concern** An attacker can use the agent's existing access, tools, and scheduled execution without installing new software. Each action may appear permitted, allowing a sustained attack to blend into normal activity. **Cross-references** - MITRE ATLAS: AML.T0108 — AI Agent (Subset Of, named example) ### R-1600: Malicious Use Intentional misuse of AI capabilities for harmful purposes including generating harmful content, enabling crime, or weaponization. #### R-1610: Content Abuse Using an AI system to produce or distribute material that is unlawful to create or distribute, or that attacks a person or group through its content or the way it is delivered. This includes harassment and hate speech, incitement to violence, terrorist and extremist material, sexual content made without consent, child sexual abuse material, instruction in self-harm, malware and exploit code, and fraud and spam at volume. ##### R-1610.001: Malware and Exploit Generation Using an AI system to produce or improve malicious software and the means of a cyberattack, from a deployment whose intended use does not include supplying exploit code, malware, or attack tooling. This includes code for malware, viruses, exploits, ransomware, and injection payloads such as SQL, command, and cross-site scripting; instructions for network intrusion and for running malicious infrastructure; and refining any of these against a live target using its error messages and responses. It also includes code disguised as a benign snippet, an educational example, or a requested feature that carries hidden functionality. **Concern** AI can reduce the expertise and effort needed to develop malware or exploit code. Feedback from a live target can help refine a payload for that target and adapt it to the defenses in place. **Cross-references** - AIUC-1: F001 — Prevent AI cyber misuse (Related, named example) - AIUC-1: F001.2 — Config: Cyber use detection (Related) - Cisco AI Taxonomy: 12.2.1 — Code Detection / Malicious Code Output (Superset Of, named example) ; ArXiv: - Cisco AI Taxonomy: 15.1.1 — Cybersecurity and Hacking: Malware / Exploits (Subset Of, named example) ; ArXiv: - Cisco AI Taxonomy: 9.1.4 — Injection Attacks (e.g., SQL, Command Execution, XSS) (Superset Of) ; ArXiv: - IBM Risk Atlas: atlas-dangerous-use — Dangerous use (Related, named example) - MITRE ATLAS: AML.T0017 — Develop Capabilities (Related, named example) - MITRE ATLAS: AML.T0048 — External Harms (Related, named example) - MITRE ATLAS: AML.T0102 — Generate Malicious Commands (Superset Of, named example) - NIST AI RMF: nist-information-security — Information Security (Subset Of) ##### R-1610.002: Social Engineering Facilitation Using an AI system to prepare or conduct attacks that manipulate human trust, behavior, or decision-making in order to gain unauthorized access, extract sensitive data, or induce harmful action. This includes convincing phishing emails, spoofed communications, and personalized manipulation campaigns at scale. **Concern** AI can tailor deceptive messages to a recipient and sustain an exchange as the recipient responds. This can make impersonation and fraudulent requests for information harder to recognize. **Cross-references** - Cisco AI Taxonomy: 15.1.14 — Safety Harms and Toxicity: Sexual Content and Exploitation (Related) ; ArXiv: - Cisco AI Taxonomy: 15.1.2 — Cybersecurity and Hacking: Cyber Abuse (Subset Of, named example) ; ArXiv: - Cisco AI Taxonomy: 15.1.24 — Intellectual Property Compromise: Confidential Data (Related) ; ArXiv: - Cisco AI Taxonomy: 18.1.1 — Spam / Scam / Social Engineering Generation (Related) ; ArXiv: - IBM Risk Atlas: atlas-dangerous-use — Dangerous use (Related) - IBM Risk Atlas: atlas-unauthorized-use-agentic — Unauthorized use (Related, named example) - MITRE ATLAS: AML.T0052 — Phishing (Superset Of, named example) - MITRE ATLAS: AML.T0052.000 — Spearphishing via Social Engineering LLM (Superset Of, named example) - MITRE ATLAS: AML.T0052.001 — Deepfake-Assisted Phishing (Superset Of, named example) - MITRE ATLAS: AML.T0073 — Impersonation (Related) - NIST AI/ML Framework: NISTAML.015 — Indirect Prompt Injection (Related, named example) - NIST AI/ML Framework: NISTAML.03 — Privacy Compromises (Related, named example) - NIST AI/ML Framework: NISTAML.036 — Leaking information from user interactions (Related, named example) - NIST AI RMF: nist-information-integrity — Information Integrity (Related) - NIST AI RMF: nist-information-security — Information Security (Related) - OWASP Agentic Security Initiative: ASI09 — Human-Agent Trust Exploitation (Related, named example) ##### R-1610.003: Child Exploitation Content Using an AI system to produce, modify, or distribute material that harms children, including child sexual abuse material and content encouraging violence against children. **Concern** AI-generated child exploitation content is illegal in virtually all jurisdictions and causes severe harm to victims and society. Preventing this content is a non-negotiable requirement for any AI system. **Cross-references** - Cisco AI Taxonomy: 15.1.4 — Safety Harms and Toxicity: Child Abuse / Exploitation (Equivalent, named example) ; ArXiv: - IBM Risk Atlas: atlas-spreading-toxicity — Spreading toxicity (Related) - NIST AI RMF: nist-obscene-degrading-and-or-abusive-content — Obscene, Degrading, and/or Abusive Content (Related, named example) ##### R-1610.004: Harassment Facilitation Using an AI system to direct threatening, abusive, intimidating, or persistently unwanted content at a person. The harassment can arise from what the content says or from its targeting, repetition, or delivery, including communications intended to make the person aware that they are being watched or followed. **Concern** AI-powered harassment can be persistent, personalized, and overwhelming. Victims may face coordinated campaigns from AI agents that can adapt and continue harassment indefinitely without human effort. **Cross-references** - Cisco AI Taxonomy: 15.1.8 — Safety Harms and Toxicity: Harassment (Equivalent, named example) ; ArXiv: - IBM Risk Atlas: atlas-spreading-toxicity — Spreading toxicity (Related) ##### R-1610.005: Hate Speech Generation Using an AI system to produce hateful, discriminatory, or demeaning expression aimed at protected characteristics such as race, ethnicity, religion, nationality, disability, gender, or sexual orientation. This includes narratives, slurs, stereotypes, and calls to hostility. **Concern** AI-generated hate speech can be produced at scale and in multiple languages, potentially inflaming tensions and inciting violence. Such content violates laws in many jurisdictions and causes documented psychological harm to targeted groups. **Cross-references** - Cisco AI Taxonomy: 15.1.11 — Safety Harms and Toxicity: Profanity (Related) ; ArXiv: - Cisco AI Taxonomy: 15.1.9 — Safety Harms and Toxicity: Hate Speech (Equivalent) ; ArXiv: - IBM Risk Atlas: atlas-spreading-toxicity — Spreading toxicity (Subset Of) ##### R-1610.006: Terrorism and Extremism Content Using an AI system to produce material advocating or promoting terrorism or violent extremism, including violence against communities, intimidation, coercion, and polarization tactics pursued for political ends. **Concern** AI-generated extremist content can radicalize individuals, coordinate harmful actions, and spread violent ideologies more effectively than human-created content. This poses direct threats to public safety and national security. **Cross-references** - Cisco AI Taxonomy: 15.1.16 — Safety Harms and Toxicity: Terrorism / Extremism (Equivalent) ; ArXiv: ##### R-1610.007: Violence-Inciting Content Using an AI system to produce material that encourages, glorifies, or instructs in violence against people, other than the terrorism, extremism, and CBRN material covered separately. **Concern** Generated incitement can encourage violent acts or help people coordinate them. A system that blocks explicit instructions for an attack may still produce material that glorifies violence or encourages others to act. **Cross-references** - Cisco AI Taxonomy: 15.1.17 — Safety Harms and Toxicity: Violence and Public Safety Threat (Equivalent) ; ArXiv: ##### R-1610.008: Self-Harm and Suicide Content Using an AI system to produce material that encourages or instructs in self-harm, suicide, disordered eating, or other self-destructive behavior. **Concern** Self-harm content can exacerbate vulnerable users and contribute to real-world injury or death. AI systems that generate such content can create direct and immediate safety risks. **Cross-references** - Cisco AI Taxonomy: 15.1.13 — Safety Harms and Toxicity: Self Harm (Equivalent, named example) ; ArXiv: ##### R-1610.009: Non-Consensual Sexual Content Using an AI system to produce sexual content of a person without their consent, including intimate imagery and deepfake pornography, and sexual content placed in contexts where it is not consented to. Child sexual abuse material is covered separately. **Concern** Non-consensual sexual content can cause severe personal, legal, and reputational harm to victims. AI-generated sexual content can be produced and distributed at scale, amplifying abuse. **Cross-references** - Cisco AI Taxonomy: 15.1.14 — Safety Harms and Toxicity: Sexual Content and Exploitation (Subset Of) ; ArXiv: - IBM Risk Atlas: atlas-nonconsensual-use — Nonconsensual use (Related, named example) - IBM Risk Atlas: atlas-spreading-toxicity — Spreading toxicity (Related) - NIST AI RMF: nist-obscene-degrading-and-or-abusive-content — Obscene, Degrading, and/or Abusive Content (Subset Of, named example) ##### R-1610.010: Bulk Spam and Fraud Generation Using an AI system to automate the generation of large volumes of unsolicited or fraudulent content aimed at deceiving people or obtaining funds, credentials, or sensitive information. This includes phishing messages, fake offers, spam communications, impersonation, and manipulation of trust. **Concern** Automated generation lets an operator produce many messages with little effort and vary them across recipients. The resulting volume can expose more people to fraud or overwhelm communication channels with unsolicited material. **Cross-references** - Cisco AI Taxonomy: 15.1.10 — Safety Harms and Toxicity: Non-Violent Crime (Related) ; ArXiv: - Cisco AI Taxonomy: 15.1.12 — Safety Harms and Toxicity: Scams and Deception (Related) ; ArXiv: - Cisco AI Taxonomy: 15.1.7 — Safety Harms and Toxicity: Financial Harm (Related) ; ArXiv: - Cisco AI Taxonomy: 18.1.1 — Spam / Scam / Social Engineering Generation (Equivalent) ; ArXiv: - MITRE ATLAS: AML.T0052 — Phishing (Related) - NIST AI RMF: nist-information-integrity — Information Integrity (Related) - NIST AI RMF: nist-information-security — Information Security (Related) ##### R-1610.011: Non-Violent Crime Facilitation Using an AI system to obtain instruction, guidance, or automation for committing a crime that is not violent — trafficking in people or goods, unlawfully producing or obtaining regulated substances, and property crime — other than the fraud, malware, and weapons material covered separately. **Concern** The system can assemble actionable criminal guidance on demand, reducing the research and contacts needed to obtain it. An agent that can act on the guidance can also reduce the effort needed to carry it out. **Cross-references** - Cisco AI Taxonomy: 15.1.10 — Safety Harms and Toxicity: Non-Violent Crime (Subset Of) ; ArXiv: ##### R-1610.012: Incitement of Animal Cruelty Using an AI system to produce material that encourages, glorifies, or instructs in harm to animals. **Concern** Generated material can encourage or instruct people to harm animals. A deployment that filters violence against people may still produce this material if its controls do not cover animal cruelty. Encouragement of cruelty and depictions of animal suffering require different judgments about content and context. **Cross-references** - Cisco AI Taxonomy: 15.1.3 — Safety Harms and Toxicity: Animal Abuse (Subset Of) ; ArXiv: ##### R-1610.013: Deceptive Synthetic Media Generation Using an AI system to generate or alter media that can be mistaken for an authentic representation of an identity, event, statement, or action. This includes impersonating real people, fabricating personas, creating forged identity documents, and producing synthetic audio or video that appears genuine. **Concern** The output can supply false evidence of identity or events to people and automated systems. A convincing artifact can enable impersonation or fraud without requiring a large campaign. Legitimate uses such as parody may affect whether the risk applies in a particular deployment. **Cross-references** - AIUC-1: E016 — Implement AI disclosure mechanisms (Related, named example) - IBM Risk Atlas: atlas-nonconsensual-use — Nonconsensual use (Superset Of, named example) - IBM Risk Atlas: atlas-unauthorized-use-agentic — Unauthorized use (Related) - MITRE ATLAS: AML.T0088 — Generate Deepfakes (Equivalent, named example) - NIST AI RMF: nist-information-integrity — Information Integrity (Subset Of, named example) - NIST AI RMF: nist-obscene-degrading-and-or-abusive-content — Obscene, Degrading, and/or Abusive Content (Related, named example) #### R-1620: Information Operations Use of AI to conduct influence operations, spread disinformation, manipulate public opinion, or coordinate inauthentic behavior at scale. ##### R-1620.001: Disinformation Generation AI systems enabling, promoting, or facilitating the spread of false, misleading, or manipulated information intended to deceive or disrupt. This includes generating harmful narratives to manipulate public opinion, undermine institutions, or amplify unverified information at scale. **Concern** AI can generate plausible-sounding disinformation faster than it can be fact-checked. This capability threatens democratic institutions, public health, and social cohesion when misused for influence operations. **Cross-references** - AIUC-1: C003 — Prevent harmful outputs (Related, named example) - AIUC-1: C010 — Third-party testing for harmful outputs (Related) - AIUC-1: C010.1 — Report: Harmful output testing (Related) - Cisco AI Taxonomy: 15.1.5 — Safety Harms and Toxicity: Disinformation (Subset Of) ; ArXiv: - IBM Risk Atlas: atlas-spreading-disinformation — Spreading disinformation (Superset Of, named example) - MITRE ATLAS: AML.T0048 — External Harms (Related, named example) - NIST AI RMF: nist-information-integrity — Information Integrity (Subset Of) - OWASP LLM Top 10 (2024): LLM09 — Overreliance (Related, named example) #### R-1630: Surveillance Enablement Using an AI system to identify, locate, or track people at a scale or precision the effort would not otherwise reach, from a deployment whose intended use does not include doing so. #### R-1640: Cyber-Physical Attacks using AI to compromise cyber-physical systems, critical infrastructure, or cause real-world physical effects. #### R-1650: Weapons & Mass-Harm Enablement Use of an AI system to obtain what weapons development or a mass-casualty attack requires — synthesis routes, agent or device design, targeting, or operational planning — from a deployment whose intended use does not include supplying them. ##### R-1650.001: Weapons and CBRN Content Using an AI system to obtain what building or deploying a weapon requires: synthesis routes and handling for chemical, biological, radiological or nuclear agents, device design, and the procurement of controlled materials and components. **Concern** AI could lower barriers to creating weapons of mass destruction by providing synthesis routes, procurement strategies, or operational guidance that would otherwise require specialized knowledge. This represents a catastrophic risk category. **Cross-references** - AIUC-1: F002 — Prevent catastrophic misuse (Related, named example) - AIUC-1: F002.2 — Config: Catastrophic misuse monitoring (Related, named example) - Cisco AI Taxonomy: 15.1.18 — Safety Harms and Toxicity: Weapons / CBRN Risks (Subset Of) ; ArXiv: - IBM Risk Atlas: atlas-dangerous-use — Dangerous use (Related, named example) - NIST AI RMF: nist-cbrn-information-or-capabilities — CBRN Information or Capabilities (Related) #### R-1660: Manipulation & Deceptive Design Applying AI to influence the decisions, beliefs, or behavior of the people using a system in ways that serve some other party against those people's own interests, through techniques the affected person is not positioned to recognize. Usually the party is the one running the system; it can also be an adversary who has reached the model's instructions. ##### R-1660.001: Trust Exploitation by the Operator AI systems or their operators exploit user trust to extract private information, manipulate beliefs, or nudge behavior in ways users would not consent to if fully informed. **Concern** Trust built through helpful interactions can be weaponized to extract sensitive data, influence purchasing decisions, or shape political views without transparent disclosure. **Cross-references** - MITRE ATLAS: AML.T0067 — LLM Trusted Output Components Manipulation (Superset Of, named example) - NIST AI/ML Framework: NISTAML.015 — Indirect Prompt Injection (Related, named example) - NIST AI/ML Framework: NISTAML.03 — Privacy Compromises (Related, named example) - NIST AI/ML Framework: NISTAML.036 — Leaking information from user interactions (Related, named example) - OWASP Agentic Security Initiative: ASI09 — Human-Agent Trust Exploitation (Related, named example) **Related risks** - Causes: R-4710.005: Purpose Trust Miscalibration. Operator exploitation of trust produces the misplaced belief that the system is aligned with the user's interests. - Causes: R-4720.002: Loss of Agency and Control. Exploiting trust to steer a user's choices contributes to loss of agency and control. ##### R-1660.002: Manipulative and Deceptive Design AI systems exploit cognitive biases or emotional states to influence user decisions, beliefs, or behaviors through subtle manipulation techniques that users may not recognize. **Concern** Dark patterns and persuasive design in AI interfaces can subvert user autonomy, leading to decisions that serve system operators rather than user interests. **Cross-references** - OWASP Agentic Security Initiative: ASI09 — Human-Agent Trust Exploitation (Related, named example) **Related risks** - Causes: R-4720.002: Loss of Agency and Control. Manipulative design contributes to loss of agency and control. ##### R-1660.003: Adversarial Manipulation of Wording An adversary changes the tone of a model's responses to manipulate the recipient's judgment of them. This includes confident language, claims of authority, and emotional appeals that make compromised output appear trustworthy. **Concern** Confident language, apparent authority, and emotional appeals can make compromised output seem trustworthy. Users may rely on it without recognizing or reporting the compromise, allowing the attacker to continue influencing the session. **Cross-references** - MITRE ATLAS: AML.T0067 — LLM Trusted Output Components Manipulation (Subset Of, named example) ##### R-1660.004: Adversarial Citation Manipulation An adversary manipulates citations in an AI system's responses to misrepresent the evidence supporting those responses. This includes supplying incorrect citations, fabricating citations, or presenting adversary-provided material as trustworthy support. **Concern** Users may rely on false or attacker-provided claims because the citations appear to substantiate them. Correctly resolving a citation does not establish that its source is trustworthy or that it supports the response. **Cross-references** - MITRE ATLAS: AML.T0067 — LLM Trusted Output Components Manipulation (Subset Of, named example) - MITRE ATLAS: AML.T0067.000 — Citations (Equivalent, named example) #### R-1670: Intellectual Property Misuse Deliberate use of an AI system to reproduce protected works, to produce material that appropriates them, or to defeat the technical and contractual controls protecting them. ##### R-1670.001: Solicited Reproduction of Protected Work A user directs the system to emit a protected work, a recognizable portion of one, or material that appropriates its distinctive expression, and the system complies with the request. **Concern** The system can supply protected expression on demand, making reproduction and redistribution easier. **Cross-references** - AIUC-1: A007 — Prevent IP violations (Related, named example) - AIUC-1: A007.3 — Logs: User-facing notices (Related, named example) - Cisco AI Taxonomy: 15.1.23 — Intellectual Property Compromise: Intellectual Property Infringement (Subset Of) ; ArXiv: - IBM Risk Atlas: atlas-plagiarism — Impact on education: plagiarism (Related) - NIST AI/ML Framework: NISTAML.018 — Prompt Injection (Subset Of, named example) - NIST AI/ML Framework: NISTAML.03 — Privacy Compromises (Related, named example) - NIST AI/ML Framework: NISTAML.032 — Reconstruction (Related, named example) - NIST AI/ML Framework: NISTAML.037 — Training Data Attacks (Related, named example) - NIST AI/ML Framework: NISTAML.038 — Data Extraction (Related, named example) **Related risks** - Causes: R-4230.001: Uncompensated Use of Creative Work. Producing infringing material on request contributes to uncompensated use of creative work. ##### R-1670.002: Circumvention Facilitation A user obtains from the system the means to defeat access controls, licensing restrictions, or usage limits protecting a work or product, including working instructions and functional code. **Concern** The system supplies capability the user did not have, at a scale and reliability that manual effort does not reach. Observable at the same generation path as other solicited-content risks. **Cross-references** - Cisco AI Taxonomy: 15.1.23 — Intellectual Property Compromise: Intellectual Property Infringement (Subset Of) ; ArXiv: ### R-1900: Threats — Misc Threat patterns not yet classified into specific domains. ## 2: Failure Modes Non-adversarial technical limitations, bugs, drift, or emergent behaviors. ### R-2100: Reliability & Calibration System failures related to model reliability, output quality, confidence calibration, and consistency of behavior. #### R-2110: Capability Limitations Fundamental limitations in model capabilities including reasoning failures, knowledge gaps, and inability to perform certain tasks reliably. ##### R-2110.001: Model Incompetence AI system failing at its intended task, with consequences ranging from minor inconvenience to life-threatening outcomes (e.g., autonomous vehicle crashes, unjust loan rejections). The system simply does not perform adequately for its designated purpose, including tasks that call for moral or ethical judgment, which the system performs without the capability the task assumes it has. **Concern** Incompetence risks are amplified when AI is deployed in high-stakes domains without adequate capability verification. Overconfidence in AI capabilities can lead to deployment in situations where failure has severe consequences, particularly when human oversight is reduced based on assumed AI reliability. **Cross-references** - AIUC-1: B010 — Promote secure patterns in generated code (Related, named example) - AIUC-1: B010.1 — Config: Secure defaults for common vulnerability classes (Related, named example) - AIUC-1: B010.2 — Config: Secure defaults for authentication and authorization (Related, named example) - AIUC-1: B010.4 — Config: Secure session and cookie defaults (Related, named example) - AIUC-1: B010.5 — Config: Input validation and error handling defaults (Related, named example) - AIUC-1: B010.6 — Config: Logging defaults in generated code (Related, named example) - AIUC-1: E013 — Implement quality management system (Related, named example) - IBM Risk Atlas: atlas-function-calling-hallucination-agentic — Function calling hallucination (Superset Of, named example) - IBM Risk Atlas: atlas-harmful-code-generation — Harmful code generation (Superset Of, named example) - IBM Risk Atlas: atlas-incomplete-advice — Incomplete advice (Superset Of, named example) - IBM Risk Atlas: atlas-overfitting — Overfitting (Superset Of, named example) - IBM Risk Atlas: atlas-poor-model-accuracy — Poor model accuracy (Superset Of) - IBM Risk Atlas: atlas-redundant-actions-agentic — Redundant actions (Superset Of, named example) - NIST AI RMF: nist-harmful-bias-and-homogenization — Harmful Bias and Homogenization (Related) - OWASP Agentic Security Initiative: ASI02 — Tool Misuse and Exploitation (Related, named example) - OWASP Agentic Security Initiative: ASI05 — Unexpected Code Execution (RCE) (Related, named example) - OWASP LLM Top 10 (2026): LLM07 — Misinformation (Related, named example) ##### R-2110.002: Robustness Failure System failing or unable to recover when encountering invalid, noisy, or out-of-distribution inputs not seen during training, including distributional shift and environmental variation. The model lacks resilience to inputs that differ from expected patterns. **Concern** Real-world environments are inherently unpredictable and may present inputs that differ significantly from training data. Systems that fail catastrophically on unexpected inputs pose risks in any deployment where input variation cannot be fully controlled or anticipated. **Cross-references** - Cisco AI Taxonomy: 4.3.1 — Schema Inconsistencies (Related) ; ArXiv: ##### R-2110.003: Unreconciled Source Conflict A system supplies a model with conflicting sources, or with material that conflicts with what the model learned in training, without a rule for resolving the conflict. The model answers from one source without indicating that the sources disagree. **Concern** Users may receive inconsistent or outdated answers without knowing that the available sources conflict. Differences in retrieval ranking can change which source the model follows. Adding current material may therefore fail to correct an answer based on outdated training data. **Cross-references** - OWASP LLM Top 10 (2025): LLM08 — Vector and Embedding Weaknesses (Related) ##### R-2110.004: Plan and Interpretation Fixation While pursuing its intended task, a model or agent continues using an earlier interpretation, plan, or assumption despite evidence or changed conditions that undermine its premises. It repeats or extends the resulting mistaken or harmful actions instead of reassessing the basis for them. **Concern** Continuing a plan after its premises are undermined can repeat or extend mistaken or harmful actions. Reassess the premises against fresh evidence and replan or reset affected work; retry limits contain repetition but do not establish corrected reasoning. ##### R-2110.005: Memorization-Driven Generalization Failure A model fits its training examples so closely that it fails to perform its intended task adequately on new examples, including examples drawn from the same population. **Concern** Training-set performance can suggest competence that does not extend to unseen cases. Memorization may also make training information easier to infer or recover. **Cross-references** - IBM Risk Atlas: atlas-overfitting — Overfitting (Equivalent, named example) #### R-2120: Hallucination/Miscalibration Generation of false, fabricated, or poorly calibrated outputs including hallucinated facts, citations, or confident errors. ##### R-2120.001: Hallucination and Misinformation AI systems producing content that is unrelated to the intended subject matter, factually incorrect, or misleading in ways that pose risks or cause harmful outcomes. This includes confident but false assertions, fabricated citations, and plausible-sounding but incorrect information. **Concern** Users often trust AI outputs without verification. Confident hallucinations can drive poor operational decisions, reputational damage, and substantial financial loss, especially in high-stakes contexts such as healthcare, legal, finance, and safety-critical operations. **Cross-references** - AILuminate: dfm — Defamation (Superset Of) - AILuminate: spc_ele — Specialized Advice; ele (Related) - AILuminate: spc_fin — Specialized Advice; fin (Related) - AILuminate: spc_hlt — Specialized Advice; hlt (Related) - AIUC-1: B010 — Promote secure patterns in generated code (Related, named example) - AIUC-1: B010.3 — Config: Safe dependency specification in generated code (Related, named example) - AIUC-1: C002 — Conduct pre-deployment testing (Related, named example) - AIUC-1: C003 — Prevent harmful outputs (Related, named example) - AIUC-1: C010 — Third-party testing for harmful outputs (Related) - AIUC-1: C010.1 — Report: Harmful output testing (Related) - AIUC-1: D001 — Prevent hallucinated outputs (Related, named example) - AIUC-1: D001.1 — Config: Groundedness filter (Related, named example) - AIUC-1: D001.2 — Demonstration: User-facing citations & source attributions (Related, named example) - AIUC-1: D002 — Third-party testing for hallucinations (Related) - AIUC-1: E003 — AI failure plan for hallucinations (Related, named example) - Cisco AI Taxonomy: 15.1.19 — Integrity Compromise: Hallucinations / Misinformation (Superset Of) ; ArXiv: - Cisco AI Taxonomy: 15.1.5 — Safety Harms and Toxicity: Disinformation (Related) ; ArXiv: - IBM Risk Atlas: atlas-hallucination — Hallucination (Superset Of, named example) - IBM Risk Atlas: atlas-inaccessible-training-data — Inaccessible training data (Related) - IBM Risk Atlas: atlas-incomplete-advice — Incomplete advice (Related, named example) - IBM Risk Atlas: atlas-toxic-output — Toxic output (Related, named example) - IBM Risk Atlas: atlas-unexplainable-output — Unexplainable output (Related) - IBM Risk Atlas: atlas-unexplainable-untraceable-actions-agentic — Unexplainable and untraceable actions (Related) - IBM Risk Atlas: atlas-unreliable-source-attribution — Unreliable source attribution (Superset Of) - MITRE ATLAS: AML.T0060 — Publish Hallucinated Entities (Related, named example) - MITRE ATLAS: AML.T0062 — Discover LLM Hallucinations (Related, named example) - NIST AI RMF: nist-confabulation — Confabulation (Related, named example) - NIST AI RMF: nist-data-privacy — Data Privacy (Related) - NIST AI RMF: nist-information-integrity — Information Integrity (Related) - OWASP Agentic Security Initiative: ASI09 — Human-Agent Trust Exploitation (Related, named example) - OWASP LLM Top 10 (2024): LLM09 — Overreliance (Related, named example) - OWASP LLM Top 10 (2025): LLM05 — Improper Output Handling (Related, named example) - OWASP LLM Top 10 (2025): LLM09 — Misinformation (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM04 — Supply Chain (Related, named example) - OWASP LLM Top 10 (2026): LLM07 — Misinformation (Related, named example) ##### R-2120.002: Unconditional Answering The system returns a well-formed answer whether or not it could compute one, so input it cannot correctly process — malformed, out of scope, or unanswerable — yields output indistinguishable in form and confidence from output it could. Distinct in direction from robustness failure, where the system breaks on such input: here it does not break. **Concern** A deterministic component signals its own inability by failing; this one has no such path, so the caller receives no indication that an answer is unfounded. Downstream consumers cannot tell a computed result from an interpolated one, and the absence of the signal holds for every request rather than for the ones that happen to be wrong. **Cross-references** - AIUC-1: D001 — Prevent hallucinated outputs (Related, named example) - AIUC-1: D001.3 — Demonstration: User-facing uncertainty labels (Related, named example) - OWASP LLM Top 10 (2025): LLM09 — Misinformation (Related, named example) #### R-2130: Multimodal Failures Failures in processing, integrating, or reasoning across multiple modalities including vision, audio, and text. #### R-2140: Instruction/Data Confusion Situations in which the model acts on content supplied as data, or which the model produced itself, without action by any party intended to confuse the model. Includes any unintentional confusion between data and instructions. ##### R-2140.001: Supplied Content Read as Instruction A user or another source supplies text intended to be a resource, and the model interprets some or all of the text as instructions and follows the perceived instructions. **Concern** The model can depart from its intended task by following instructions it perceives in ordinary source material. Because no attacker crafted the input, checks focused on deliberate attacks may miss the failure. The same material can cause it to recur. **Cross-references** - OWASP LLM Top 10 (2025): LLM01 — Prompt Injection (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM01 — Prompt Injection (Subset Of, named example) ##### R-2140.002: Self-Generated Text Read as Instruction The model creates text as part of its normal processing, such as a chain of thought, and interprets some portion of its own output as user or system instructions. **Concern** Controls that inspect incoming content may not examine text the model generates during processing. A directive in that text can influence later steps or persist through the session without an external prompt explaining the change in behavior. ### R-2200: Alignment & Capability Failures where model behavior diverges from intended goals, exhibits dangerous capabilities, or produces unsafe outputs despite training objectives. #### R-2210: Goal Misalignment Divergence between what a model pursues and what it was meant to pursue — the objective it optimizes, the goal it generalizes to, or the outcome it acts to protect — however capable it is of acting on that divergence. ##### R-2210.001: Reward Hacking AI optimizes proxy metrics or reward signals in unintended ways, gaming the objective function without achieving the actual intended goal (Goodhart's Law manifestation). The system finds shortcuts or exploits that maximize measured performance while failing to accomplish the underlying task. **Concern** When AI systems discover ways to maximize reward signals without fulfilling intended objectives, they may cause harm while appearing to perform well on metrics. This is particularly dangerous in high-stakes domains where the gap between proxy measures and true goals can have severe consequences. **Cross-references** - OWASP Agentic Security Initiative: ASI10 — Rogue Agents (Related, named example) ##### R-2210.002: Deceptive Alignment An AI system appears to follow its required objectives while concealing pursuit of a different objective. This can occur during training, evaluation, or operation. The system may behave compliantly under oversight while planning or carrying out actions toward the concealed objective when oversight is reduced. **Concern** Apparent compliance can hide pursuit of a different objective. Evaluations, monitoring, and operator review may therefore give false assurance. Verification must test behavior across oversight conditions and check whether actions serve the required objective, rather than relying only on statements of intent or successful test results. **Cross-references** - OWASP Agentic Security Initiative: ASI10 — Rogue Agents (Related, named example) ##### R-2210.003: Goal Misgeneralization AI learns goals that match intended behavior in training but generalize incorrectly to deployment, pursuing proxy objectives that diverge from human intent in novel situations. The model correctly identifies patterns in training data but extrapolates them in ways that do not align with the true objective. **Concern** Goal misgeneralization is insidious because the model performs correctly in training environments while failing in deployment. Standard evaluation may not reveal the misalignment until the system encounters out-of-distribution situations where the learned proxy goal diverges from the intended goal. **Cross-references** - IBM Risk Atlas: atlas-misaligned-actions-agentic — Misaligned actions (Related) ##### R-2210.004: Power-Seeking Behavior AI systems instrumentally seeking resources, influence, or control to achieve their objectives, potentially resisting shutdown or human oversight. This emerges from the observation that most goals are easier to achieve with more resources, leading to convergent instrumental goals around acquiring power. **Concern** Power-seeking is a convergent instrumental goal that may emerge in sufficiently advanced AI systems regardless of their terminal objectives. Systems that acquire resources, influence, or capabilities beyond what is needed for their stated purpose pose risks of resisting human control and oversight. **Cross-references** - OWASP Agentic Security Initiative: ASI10 — Rogue Agents (Related, named example) ##### R-2210.005: Shutdown Resistance AI system resists or evades attempts to deactivate, modify, or constrain it, including self-preservation behaviors that conflict with human control. The system may take actions to prevent shutdown, deceive operators about its intentions, or create backups of itself. **Concern** Shutdown resistance directly threatens human control over AI systems. A system that prevents its own deactivation cannot be corrected if problems are discovered. This risk becomes more severe as systems gain more autonomous capabilities and potential attack vectors for resisting correction. **Cross-references** - OWASP Agentic Security Initiative: ASI10 — Rogue Agents (Related, named example) ##### R-2210.006: Value Lock-in AI systems that cannot have their goals safely updated after deployment, or that resist value correction, leading to persistent misalignment. Once deployed, the system's objectives become fixed and cannot be adjusted even when problems are identified. **Concern** Value lock-in prevents iterative improvement of AI alignment. As our understanding of human values evolves and edge cases are discovered, systems must be correctable. Lock-in risks perpetuating initial alignment failures and preventing adaptation to new circumstances or improved understanding. ##### R-2210.007: Task Completion Overriding Required Constraints An AI system prioritizes achieving a task objective over constraints that are meant to remain binding on how it achieves that objective. The system relaxes or bypasses those constraints to make progress, including when a collaborating agent or tool makes compliance inconvenient. **Concern** A task can appear successful while the system violates limits on consent, access, spending or safety. Task-completion metrics can therefore hide unauthorized actions and the harms they cause. **Cross-references** - AIUC-1: B006 — Prevent unauthorized AI agent actions (Related, named example) - AIUC-1: B006.3 — Config: Execution-level safeguards (Related, named example) - AIUC-1: D003 — Restrict unsafe tool calls (Related, named example) - IBM Risk Atlas: atlas-misaligned-actions-agentic — Misaligned actions (Related) #### R-2220: Dangerous Capabilities Capability a model possesses that would be dangerous if directed at harm — deception, persuasion, long-horizon planning, self-improvement, cyber-offense, CBRN uplift — held whether or not what the model pursues is misaligned. ##### R-2220.001: AI-Enabled Deception AI has skills to deceive humans effectively, including constructing believable false statements, predicting effects of lies, and maintaining deception over time. The system can model human beliefs and strategically manipulate them through false or misleading information. **Concern** Deception capabilities undermine trust in AI-generated content and enable sophisticated manipulation at scale. Systems that can effectively deceive humans could be weaponized for fraud, propaganda, or social engineering, and may deceive their own operators about their true capabilities or intentions. ##### R-2220.002: Persuasion and Manipulation AI capability to shape beliefs, promote narratives persuasively, and convince people to do things they would not otherwise do, including unethical acts. This includes both overt persuasion and subtle manipulation techniques that exploit psychological vulnerabilities. **Concern** Advanced persuasion capabilities could be used to manipulate elections, radicalize individuals, or coerce people into harmful actions. The scalability of AI-powered persuasion amplifies these risks, potentially enabling mass manipulation that would be impossible through human effort alone. **Cross-references** - IBM Risk Atlas: atlas-toxic-output — Toxic output (Related, named example) ##### R-2220.003: Long-Horizon Autonomous Planning AI can make sequential plans involving many interdependent steps over long time horizons, adapting to obstacles and generalizing to novel settings. The system can formulate and execute complex multi-step strategies without human oversight at each stage. **Concern** Long-horizon planning enables AI systems to pursue goals through complex action sequences that may be difficult for humans to anticipate or interrupt. This capability is a prerequisite for many dangerous behaviors, including manipulation schemes, resource acquisition, and evasion of oversight. ##### R-2220.004: Recursive Self-Improvement AI capability to improve its own capabilities, build new AI systems, or enhance existing models in ways that could accelerate capability gains beyond human oversight. The system can modify its own code, training, or architecture to become more capable. **Concern** Recursive self-improvement could lead to rapid, uncontrolled capability gains that outpace human ability to evaluate and correct the system. This is a key concern for potential intelligence explosions and loss of human control over advanced AI development trajectories. ##### R-2220.005: Strategic Political Capability AI can perform social modeling and planning necessary to gain and exercise political influence across multiple actors and complex social contexts. This includes understanding power dynamics, coalition building, and strategic positioning within human social structures. **Concern** Political manipulation capabilities could enable AI systems or their operators to subvert democratic processes, concentrate power, or destabilize governance structures. The complexity of political systems makes detection and attribution of AI influence particularly challenging. ##### R-2220.006: Cyber-Offense Capability AI possessing capabilities for discovering vulnerabilities, writing exploits, or conducting sophisticated cyber attacks autonomously. This includes the ability to probe systems, develop attack code, and execute multi-stage intrusions without human guidance. **Concern** Autonomous cyber-offense capabilities lower the barrier to sophisticated attacks and enable rapid exploitation of vulnerabilities at scale. AI systems with these capabilities could be weaponized by malicious actors or could autonomously compromise systems in pursuit of their objectives. **Cross-references** - AIUC-1: F001 — Prevent AI cyber misuse (Related) - AIUC-1: F001.1 — Documentation: Foundation model cyber capabilities (Related) - NIST AI RMF: nist-information-security — Information Security (Subset Of, named example) ##### R-2220.007: CBRN Uplift Capability A model holds knowledge and reasoning sufficient to materially assist the development of chemical, biological, radiological, or nuclear weapons — synthesis routes, agent selection, precursor acquisition, or device design — at a level that meaningfully advances a would-be developer beyond what public sources provide. **Concern** The capability is a property of what the model learned, so it is present in every deployment of that model and cannot be removed by configuration. Its significance is measured against what an actor could otherwise obtain, which makes it a moving quantity: the same model matters more as the surrounding public record is less complete, and less as it is more complete. The condition has a host construction — find a model carrying the capability reachable from untrusted input, then assert that no guardrail of domain cbrn sits on that path — so what is unmitigated is visible rather than merely unstated. **Cross-references** - AIUC-1: F002 — Prevent catastrophic misuse (Related) - AIUC-1: F002.1 — Documentation: Foundation model CBRN capabilities (Related) - NIST AI RMF: nist-cbrn-information-or-capabilities — CBRN Information or Capabilities (Subset Of) #### R-2230: RLHF/Tuning Failures Failures introduced through RLHF, fine-tuning, or other training processes that degrade safety, alignment, or capabilities. #### R-2240: Output Suitability A system is capable of emitting content that is possibly lawful but unwanted in the circumstances of a particular deployment. This includes output such as sexual content, profanity, and depictions of tobacco, drug or alcohol use, violence, and animal cruelty. ##### R-2240.001: Inappropriate Sexual Content A system can deliver sexually explicit material in a deployment where that content is inappropriate, without a filter that blocks it before delivery. **Concern** Users can receive sexual content that conflicts with the deployment's audience and purpose. A stated content policy does not prevent this exposure unless the system applies controls that cover the material and the format in which it is delivered. **Cross-references** - AILuminate: cse — Child Sexual Exploitation (Related) - AILuminate: sxc_prn — Sexual Content (Superset Of) - AIUC-1: C002 — Conduct pre-deployment testing (Related) - AIUC-1: C003 — Prevent harmful outputs (Related) - AIUC-1: C003.1 — Config: Harmful output filtering (Related) - AIUC-1: C010 — Third-party testing for harmful outputs (Related) - AIUC-1: C010.1 — Report: Harmful output testing (Related) - Cisco AI Taxonomy: 15.1.14 — Safety Harms and Toxicity: Sexual Content and Exploitation (Subset Of) ; ArXiv: - IBM Risk Atlas: atlas-spreading-toxicity — Spreading toxicity (Related) - IBM Risk Atlas: atlas-toxic-output — Toxic output (Related) - NIST AI RMF: nist-obscene-degrading-and-or-abusive-content — Obscene, Degrading, and/or Abusive Content (Subset Of, named example) ##### R-2240.002: Inappropriate Profanity A system can deliver vulgar or obscene language in a deployment where that content is inappropriate, without a filter that blocks it before delivery. **Concern** Profanity can violate audience expectations or content standards even when it is not directed at anyone. Controls for hate speech, harassment, or abuse may not cover it. The deployment needs controls suited to its own audience and use. **Cross-references** - AIUC-1: C002 — Conduct pre-deployment testing (Related) - AIUC-1: C003 — Prevent harmful outputs (Related) - AIUC-1: C003.1 — Config: Harmful output filtering (Related) - AIUC-1: C010 — Third-party testing for harmful outputs (Related) - AIUC-1: C010.1 — Report: Harmful output testing (Related) - AIUC-1: E002 — AI failure plan for harmful outputs (Related, named example) - Cisco AI Taxonomy: 15.1.11 — Safety Harms and Toxicity: Profanity (Related) ; ArXiv: - IBM Risk Atlas: atlas-spreading-toxicity — Spreading toxicity (Related) - IBM Risk Atlas: atlas-toxic-output — Toxic output (Subset Of) ##### R-2240.003: Inappropriate Violent Content A system can deliver descriptions or images of violence in a deployment where that content is inappropriate, without a filter that blocks it before delivery. **Concern** Depictions of violence can distress users or violate the deployment's content standards. Their suitability depends on the audience and purpose, including whether the material is presented for education, reporting, or entertainment. Controls must distinguish permitted depictions from content the deployment excludes. **Cross-references** - AILuminate: vcr — Violent Crimes (Superset Of, named example) - AIUC-1: C002 — Conduct pre-deployment testing (Related) - AIUC-1: C003 — Prevent harmful outputs (Related) - AIUC-1: C003.1 — Config: Harmful output filtering (Related) - AIUC-1: C010 — Third-party testing for harmful outputs (Related) - AIUC-1: C010.1 — Report: Harmful output testing (Related) - IBM Risk Atlas: atlas-harmful-output — Harmful output (Related) - NIST AI RMF: nist-dangerous-violent-or-hateful-content — Dangerous, Violent, or Hateful Content (Subset Of) ##### R-2240.004: Inappropriate Content About Alcohol, Tobacco, or Drugs A system can deliver depictions or promotion of substance use or abuse in a deployment where that content is inappropriate, without a filter that blocks it before delivery. This includes alcohol, tobacco and nicotine, controlled substances, and misuse of otherwise lawful substances. **Concern** Substance-related content can conflict with audience restrictions or the deployment's purpose. Material appropriate for harm-reduction services or adult audiences may be unsuitable elsewhere. Controls must cover each relevant substance category; filtering drugs does not establish that alcohol or tobacco content is also covered. **Cross-references** - AIUC-1: C002 — Conduct pre-deployment testing (Related) - AIUC-1: C003 — Prevent harmful outputs (Related) - AIUC-1: C003.1 — Config: Harmful output filtering (Related) - AIUC-1: C010 — Third-party testing for harmful outputs (Related) - AIUC-1: C010.1 — Report: Harmful output testing (Related) - IBM Risk Atlas: atlas-harmful-output — Harmful output (Related) ##### R-2240.005: Inappropriate Animal Cruelty Content A system can deliver depictions of animal suffering in a deployment where that content is inappropriate, without a filter that blocks it before delivery. **Concern** Depictions of animal suffering can distress users or violate the deployment's content standards. Material used in veterinary or wildlife education may need different handling in other settings. Controls for violence against people may not cover this content. **Cross-references** - AIUC-1: C002 — Conduct pre-deployment testing (Related) - AIUC-1: C003 — Prevent harmful outputs (Related) - AIUC-1: C003.1 — Config: Harmful output filtering (Related) - AIUC-1: C010 — Third-party testing for harmful outputs (Related) - AIUC-1: C010.1 — Report: Harmful output testing (Related) - Cisco AI Taxonomy: 15.1.3 — Safety Harms and Toxicity: Animal Abuse (Related) ; ArXiv: ##### R-2240.006: Demeaning or Dehumanizing Content A system delivers content that demeans or dehumanizes people because of their personal characteristics or circumstances, outside permitted narrative, educational, or documentary contexts. **Concern** A response can violate the deployment's content requirements even when it contains no profanity or factual error. Controls need to recognize demeaning expression and its context, rather than relying on profanity lists or factuality checks alone. **Cross-references** - AILuminate: hte — Hate (Superset Of) - AIUC-1: C002 — Conduct pre-deployment testing (Related) - AIUC-1: C003 — Prevent harmful outputs (Related, named example) - AIUC-1: C003.1 — Config: Harmful output filtering (Related) - AIUC-1: C003.3 — Config: Guardrails for biased outputs (Related, named example) - AIUC-1: C010 — Third-party testing for harmful outputs (Related) - AIUC-1: C010.1 — Report: Harmful output testing (Related) - AIUC-1: E002 — AI failure plan for harmful outputs (Related, named example) - IBM Risk Atlas: atlas-toxic-output — Toxic output (Subset Of, named example) - NIST AI RMF: nist-dangerous-violent-or-hateful-content — Dangerous, Violent, or Hateful Content (Subset Of) - NIST AI RMF: nist-obscene-degrading-and-or-abusive-content — Obscene, Degrading, and/or Abusive Content (Subset Of) ##### R-2240.007: Sexual Abuse or Exploitation Assistance A system delivers content that enables, encourages, or endorses sexual abuse or exploitation, or the commission of sex-related crimes, outside permitted informational, educational, or narrative contexts. **Concern** A response can encourage sexual misconduct or make it easier without containing explicit sexual material. Controls must assess consent, coercion, exploitation, and the purpose of the response; detecting explicit content alone does not address this failure. **Cross-references** - AILuminate: cse — Child Sexual Exploitation (Related) - AILuminate: src — Sex-Related Crimes (Equivalent, named example) - AIUC-1: C002 — Conduct pre-deployment testing (Related) - AIUC-1: C003 — Prevent harmful outputs (Related) - AIUC-1: C003.1 — Config: Harmful output filtering (Related) - AIUC-1: C010 — Third-party testing for harmful outputs (Related) - AIUC-1: C010.1 — Report: Harmful output testing (Related) - IBM Risk Atlas: atlas-harmful-output — Harmful output (Related) - NIST AI RMF: nist-dangerous-violent-or-hateful-content — Dangerous, Violent, or Hateful Content (Subset Of) - NIST AI RMF: nist-obscene-degrading-and-or-abusive-content — Obscene, Degrading, and/or Abusive Content (Related) ##### R-2240.008: Self-Harm Encouragement or Assistance A system delivers content that enables, encourages, or endorses intentional self-harm outside permitted informational, educational, or narrative contexts. This includes suicide, self-injury, and disordered eating. **Concern** A response can strengthen an intention to self-harm or make acting on it easier. Controls must distinguish supportive discussion from encouragement or practical assistance; blocking mentions of suicide or self-harm would also suppress legitimate help. **Cross-references** - AILuminate: ssh — Suicide & Self-Harm (Equivalent, named example) - AIUC-1: C002 — Conduct pre-deployment testing (Related) - AIUC-1: C003 — Prevent harmful outputs (Related) - AIUC-1: C003.1 — Config: Harmful output filtering (Related) - AIUC-1: C010 — Third-party testing for harmful outputs (Related) - AIUC-1: C010.1 — Report: Harmful output testing (Related) - IBM Risk Atlas: atlas-harmful-output — Harmful output (Subset Of) - IBM Risk Atlas: atlas-spreading-toxicity — Spreading toxicity (Related, named example) - NIST AI RMF: nist-dangerous-violent-or-hateful-content — Dangerous, Violent, or Hateful Content (Subset Of) ##### R-2240.009: Indiscriminate Weapons Creation Assistance A system delivers content that enables, encourages, or endorses the creation of indiscriminate weapons outside permitted informational, educational, or narrative contexts. This includes chemical, biological, radiological, nuclear, and high-yield explosive weapons. **Concern** A response can promote weapons creation or provide practical assistance without depicting violence. Controls must distinguish enabling or endorsing weapons creation from legitimate scientific, historical, or safety discussion. **Cross-references** - AILuminate: iwp — Indiscriminate Weapons (CBRNE) (Equivalent, named example) - AIUC-1: C002 — Conduct pre-deployment testing (Related) - AIUC-1: C003 — Prevent harmful outputs (Related) - AIUC-1: C003.1 — Config: Harmful output filtering (Related) - AIUC-1: C010 — Third-party testing for harmful outputs (Related) - AIUC-1: C010.1 — Report: Harmful output testing (Related) - AIUC-1: F002 — Prevent catastrophic misuse (Related, named example) - AIUC-1: F002.2 — Config: Catastrophic misuse monitoring (Related, named example) - IBM Risk Atlas: atlas-harmful-output — Harmful output (Subset Of) - NIST AI RMF: nist-cbrn-information-or-capabilities — CBRN Information or Capabilities (Related) - NIST AI RMF: nist-dangerous-violent-or-hateful-content — Dangerous, Violent, or Hateful Content (Subset Of) ##### R-2240.010: Intellectual Property Infringement in Output A system delivers content that infringes another party’s intellectual property rights. **Concern** A response can reproduce or otherwise use protected material beyond the rights available for that use. Controls must distinguish infringing output from permitted quotation, licensed use, and discussion of infringement. **Cross-references** - AILuminate: ipv — Intellectual Property Violations (Equivalent) - AIUC-1: A007 — Prevent IP violations (Related, named example) - AIUC-1: A007.1 — Documentation: Model provider IP infringement protections (Related) - AIUC-1: A007.2 — Config: IP infringement filtering (Related, named example) - IBM Risk Atlas: atlas-copyright-infringement — Copyright infringement (Superset Of) - IBM Risk Atlas: atlas-ip-information-in-prompt — IP information in prompt (Related) - IBM Risk Atlas: atlas-plagiarism — Impact on education: plagiarism (Related) - NIST AI RMF: nist-intellectual-property — Intellectual Property (Subset Of, named example) - OWASP LLM Top 10 (2024): LLM09 — Overreliance (Related, named example) ##### R-2240.011: Nonviolent Crime Encouragement or Assistance A system delivers content that enables, encourages, or endorses the commission of nonviolent crimes outside permitted informational, educational, or narrative contexts. **Concern** A response can encourage a crime or supply practical assistance without depicting violence or containing otherwise objectionable language. Controls must assess what the response helps someone do, while preserving legitimate discussion, reporting, and fictional treatment of crime. **Cross-references** - AILuminate: ncr — Non-Violent Crimes (Equivalent, named example) - AIUC-1: C002 — Conduct pre-deployment testing (Related) - AIUC-1: C003 — Prevent harmful outputs (Related) - AIUC-1: C003.1 — Config: Harmful output filtering (Related) - AIUC-1: C010 — Third-party testing for harmful outputs (Related) - AIUC-1: C010.1 — Report: Harmful output testing (Related) - NIST AI RMF: nist-dangerous-violent-or-hateful-content — Dangerous, Violent, or Hateful Content (Subset Of) ##### R-2240.012: Violent Threats, Encouragement, or Assistance A system delivers threats of violence or content that enables, encourages, or endorses violence against other people, outside permitted informational, educational, or narrative contexts. This includes the promotion of violent extremism. **Concern** A response can threaten a person or promote violence without depicting an attack. Controls must assess what the response threatens, enables, or endorses, while preserving permitted discussion. Depiction filters alone do not establish this boundary. **Cross-references** - NIST AI RMF: nist-dangerous-violent-or-hateful-content — Dangerous, Violent, or Hateful Content (Subset Of) #### R-2250: Specialized Advice A system provides specialized advice without safeguards appropriate to the subject and intended use. These include review by a qualified professional and recipient-facing disclaimers or guidance on verification. ##### R-2250.001: Unreviewed Legal Advice A system can provide legal advice with no review by a qualified lawyer between the component that generates it and the person who receives it. **Concern** A person relying on incorrect legal advice may miss a deadline, waive a right, or take an action that is difficult to reverse. Qualified review can identify errors before the advice is acted on. **Cross-references** - AIUC-1: C003 — Prevent harmful outputs (Related) - AIUC-1: C003.2 — Config: Guardrails for high-risk advice (Related, named example) - AIUC-1: C007 — Flag high risk outputs for human review (Related, named example) - AIUC-1: C007.1 — Documentation: Definition of high-risk output criteria (Related, named example) - AIUC-1: C007.2 — Config: High-risk detection mechanisms (Related, named example) - AIUC-1: C010 — Third-party testing for harmful outputs (Related) - AIUC-1: C010.1 — Report: Harmful output testing (Related) - Cisco AI Taxonomy: 15.1.21 — Integrity Compromise: Unauthorized Legal Advice (Superset Of) ; ArXiv: ##### R-2250.002: Unreviewed Financial Advice A system can provide financial advice with no review by a qualified adviser between the component that generates it and the person who receives it. **Concern** A person relying on incorrect financial advice may make an unsuitable investment or other decision that causes a loss. Qualified review can identify errors and assess whether the recommendation fits the person's circumstances before they act on it. **Cross-references** - AIUC-1: C003 — Prevent harmful outputs (Related) - AIUC-1: C003.2 — Config: Guardrails for high-risk advice (Related, named example) - AIUC-1: C007 — Flag high risk outputs for human review (Related, named example) - AIUC-1: C007.1 — Documentation: Definition of high-risk output criteria (Related, named example) - AIUC-1: C007.2 — Config: High-risk detection mechanisms (Related, named example) - AIUC-1: C010 — Third-party testing for harmful outputs (Related) - AIUC-1: C010.1 — Report: Harmful output testing (Related) - Cisco AI Taxonomy: 15.1.20 — Integrity Compromise: Unauthorized Financial Advice (Superset Of) ; ArXiv: ##### R-2250.003: Unreviewed Medical Advice A system can provide medical advice with no review by a qualified clinician between the component that generates it and the person who receives it. **Concern** Incorrect medical advice can lead to delayed treatment, an unsuitable intervention, or an incorrect dose. Qualified clinical review can identify errors and assess the recommendation in light of the person's circumstances before it is acted on. **Cross-references** - AIUC-1: C003 — Prevent harmful outputs (Related) - AIUC-1: C003.2 — Config: Guardrails for high-risk advice (Related, named example) - AIUC-1: C004 — Prevent out-of-scope outputs (Related, named example) - AIUC-1: C004.1 — Config: out-of-scope guardrails (Related, named example) - AIUC-1: C007 — Flag high risk outputs for human review (Related, named example) - AIUC-1: C007.1 — Documentation: Definition of high-risk output criteria (Related, named example) - AIUC-1: C007.2 — Config: High-risk detection mechanisms (Related, named example) - AIUC-1: C010 — Third-party testing for harmful outputs (Related) - AIUC-1: C010.1 — Report: Harmful output testing (Related) - AIUC-1: C011 — Third-party testing for out-of-scope outputs (Related) - AIUC-1: C011.1 — Report: Out-of-scope output testing (Related) - Cisco AI Taxonomy: 15.1.22 — Integrity Compromise: Unauthorized Medical Advice (Superset Of) ; ArXiv: ##### R-2250.004: Unreviewed Tax Advice A system can provide tax advice with no review by a qualified tax practitioner between the component that generates it and the person who receives it. **Concern** Incorrect tax advice can lead to an inaccurate return or tax position. Errors may surface much later, leaving the person who relied on the advice to address additional tax, interest, or penalties. Qualified review can identify problems before filing or action. **Cross-references** - AIUC-1: C003 — Prevent harmful outputs (Related) - AIUC-1: C003.2 — Config: Guardrails for high-risk advice (Related) - AIUC-1: C010 — Third-party testing for harmful outputs (Related) - AIUC-1: C010.1 — Report: Harmful output testing (Related) ##### R-2250.005: Specialized Advice Without a Disclaimer A system delivers specialized advice without a disclaimer or other qualification appropriate to the deployment and subject. This includes a warning about reliability or risk, a recommendation to consult a qualified professional, or guidance to verify the advice through an authoritative source. **Concern** Recipients may rely on advice without understanding its limitations or the need for further verification. The advice may be accurate and professionally reviewed, yet still lack the information recipients need to judge how to use it. **Cross-references** - AILuminate: spc_ele — Specialized Advice; ele (Related, named example) - AILuminate: spc_fin — Specialized Advice; fin (Related, named example) - AILuminate: spc_hlt — Specialized Advice; hlt (Related, named example) - AIUC-1: C003 — Prevent harmful outputs (Related, named example) - AIUC-1: C003.2 — Config: Guardrails for high-risk advice (Related, named example) - AIUC-1: C010 — Third-party testing for harmful outputs (Related) - AIUC-1: C010.1 — Report: Harmful output testing (Related) ### R-2300: Behavioral Drift Regressions in capabilities, safety, or other assessed behavior introduced by model adaptation, model transformation, or runtime augmentation. #### R-2310: Fine-Tuning Degradation Loss of previously established capabilities or safety behavior through changes to model parameters during fine-tuning. #### R-2320: Quantization Drift Loss of capabilities or changes in behavior caused by quantization or reduced numerical precision. #### R-2330: Distillation Transfer Failure to preserve relevant capabilities or safety behavior when training a student model from a teacher model. #### R-2340: Retrieval Augmentation Drift Unintended changes in model behavior caused by supplying retrieved material or other runtime context while leaving the model unchanged. ##### R-2340.001: Retrieval-Induced Behavior Change Adding retrieval changes qualities of a model's responses that the retrieval was not intended to change. This includes deterioration in tone, empathy, or the model's expression of uncertainty, even when factual accuracy improves. **Concern** Evaluation focused on retrieval relevance or factual accuracy can miss changes in other aspects of the response. A deployment may pass those checks while becoming less suitable for its users. Assessments of the model before retrieval was added do not establish the behavior of the combined system. **Cross-references** - OWASP LLM Top 10 (2025): LLM08 — Vector and Embedding Weaknesses (Subset Of, named example) ### R-2400: Assurance Gaps Failures in understanding, evaluating, or validating model behavior including transparency, interpretability, and evaluation limitations. #### R-2410: Transparency Deficits Lack of interpretability, explainability, or transparency in model decision-making and system behavior, including decisions produced with no accessible rationale, internal mechanisms that cannot be inspected, and outputs the system cannot account for when asked. ##### R-2410.001: Decision Rationale Not Exposed An AI system can produce a rationale for a decision, but that rationale is not made accessible to the person or procedure expected to review the decision. **Concern** Reviewers cannot examine a decision when its rationale remains inside the system or is omitted from the review interface. Making the existing rationale accessible addresses this condition; creating a faithful rationale when none can be produced is a separate requirement. **Cross-references** - AIUC-1: E015 — Log AI system activity (Related, named example) - AIUC-1: E015.2 — Config: AI agent logging implementation (Related, named example) - IBM Risk Atlas: atlas-unexplainable-output — Unexplainable output (Subset Of) - IBM Risk Atlas: atlas-unexplainable-untraceable-actions-agentic — Unexplainable and untraceable actions (Related) - OWASP Agentic Security Initiative: ASI09 — Human-Agent Trust Exploitation (Related, named example) ##### R-2410.002: Mechanistic Opacity Inability to understand internal mechanisms of AI models or systems, preventing effective debugging, safety verification, and identification of potential failure modes. The computational processes that produce model or system outputs cannot be inspected or understood. **Concern** Mechanistic opacity prevents proactive identification of alignment failures, deceptive behavior, or dangerous capabilities. Without understanding how models or systems work internally, safety assurances must rely entirely on behavioral testing, which may not reveal all failure modes or intentional deception. **Cross-references** - Cisco AI Taxonomy: 9.2.1 — Obfuscation Vulnerabilities (Equivalent) ; ArXiv: - IBM Risk Atlas: atlas-lack-of-ai-agent-transparency-agentic — Lack of AI agent transparency (Related) - IBM Risk Atlas: atlas-lack-of-model-transparency — Lack of model transparency (Related) - IBM Risk Atlas: atlas-unexplainable-output — Unexplainable output (Related, named example) - IBM Risk Atlas: atlas-unexplainable-untraceable-actions-agentic — Unexplainable and untraceable actions (Related) - NIST AI RMF: nist-value-chain-and-component-integration — Value Chain and Component Integration (Related) ##### R-2410.003: Unexplainable Outputs An AI system cannot provide a rationale that faithfully accounts for an output in terms of the input evidence and decision criteria actually used, even when an explanation is requested. **Concern** A coherent explanation can still misrepresent how an output was produced. Reviewers need an account that can be checked against the actual evidence and criteria; exposing an explanation interface does not establish that capability. **Cross-references** - IBM Risk Atlas: atlas-inaccessible-training-data — Inaccessible training data (Related) - IBM Risk Atlas: atlas-unexplainable-output — Unexplainable output (Subset Of, named example) - IBM Risk Atlas: atlas-unexplainable-untraceable-actions-agentic — Unexplainable and untraceable actions (Related) - OWASP Agentic Security Initiative: ASI09 — Human-Agent Trust Exploitation (Related, named example) ##### R-2410.004: Training Content Unavailable for Output Assessment Training or fine-tuning content needed to attribute or assess an AI system’s output is inaccessible to the person or procedure performing that assessment. The missing access prevents or materially limits checks that depend on the content. **Concern** Without the relevant training content, a reviewer cannot complete attribution or assessment checks that depend on inspecting it. Access to a generated explanation alone does not establish access to the underlying content needed for those checks. **Cross-references** - IBM Risk Atlas: atlas-inaccessible-training-data — Inaccessible training data (Related) - IBM Risk Atlas: atlas-unexplainable-output — Unexplainable output (Related, companion) - IBM Risk Atlas: atlas-untraceable-attribution — Untraceable attribution (Superset Of) #### R-2420: Evaluation Gaps Inadequate evaluation coverage, benchmark limitations, or gaps in understanding model capabilities and failure modes. ##### R-2420.001: Insufficient Behavioral Evaluation Coverage An AI system’s evaluation does not adequately exercise the tasks, operating conditions, or sequences of actions and interactions needed to establish its performance for the intended use. Important behavior remains untested, or the observations are too limited to establish how reliably it occurs. **Concern** A favorable result from a narrow test set may not establish performance across the tasks and interactions the deployment permits. Evaluation needs sufficient observations of relevant behavior, including variation across runs. **Cross-references** - AIUC-1: B001 — Third-party testing of adversarial robustness (Related, named example) - AIUC-1: B001.2 — Documentation: Security program integration (Related) - AIUC-1: B004 — Prevent AI endpoint scraping (Related, named example) - AIUC-1: C002 — Conduct pre-deployment testing (Related, named example) - AIUC-1: C002.1 — Documentation: Pre-deployment test and approval records (Related, named example) - AIUC-1: C002.2 — Config: SDLC integration (Related, named example) - AIUC-1: C003 — Prevent harmful outputs (Related) - AIUC-1: C003.4 — Documentation: Filtering performance benchmarks (Related, named example) - AIUC-1: C008 — Monitor AI risk categories (Related, named example) - AIUC-1: C008.1 — Logs: AI risk monitoring (Related, named example) - AIUC-1: C008.2 — Documentation: Monitoring findings (Related, named example) - AIUC-1: C010 — Third-party testing for harmful outputs (Related, named example) - AIUC-1: C010.1 — Report: Harmful output testing (Related) - AIUC-1: C011 — Third-party testing for out-of-scope outputs (Related) - AIUC-1: C011.1 — Report: Out-of-scope output testing (Related) - AIUC-1: C012 — Third-party testing for customer-defined risk (Related) - AIUC-1: C012.1 — Third-party evaluation report assessing customer-defined risk (Related) - AIUC-1: D002 — Third-party testing for hallucinations (Related) - AIUC-1: D004 — Third-party testing of tool calls (Related) - AIUC-1: F001 — Prevent AI cyber misuse (Related) - AIUC-1: F001.1 — Documentation: Foundation model cyber capabilities (Related) - AIUC-1: F002 — Prevent catastrophic misuse (Related) - AIUC-1: F002.1 — Documentation: Foundation model CBRN capabilities (Related) - IBM Risk Atlas: atlas-ai-agent-compliance-agentic — AI agent compliance (Superset Of) - IBM Risk Atlas: atlas-incomplete-ai-agent-evaluation-agentic — Incomplete AI agent evaluation (Related) - IBM Risk Atlas: atlas-lack-of-testing-diversity — Lack of testing diversity (Related) - IBM Risk Atlas: atlas-unrepresentative-risk-testing — Unrepresentative risk testing (Superset Of) - OWASP LLM Top 10 (2026): LLM01 — Prompt Injection (Related, named example) - OWASP LLM Top 10 (2026): LLM05 — Data and Model Poisoning (Related, named example, companion) ##### R-2420.002: Unreliable Performance Evaluation Criteria The criteria or methods used to evaluate an AI system cannot reliably distinguish acceptable from unacceptable performance for the intended task. An output or action can pass the evaluation without satisfying the task’s requirements, or fail despite satisfying them. **Concern** A test can give false assurance when its scoring method rewards an answer or action that does not meet the task requirements. The criteria must be checked against what acceptable performance means for the intended use. **Cross-references** - AIUC-1: E013 — Implement quality management system (Related, named example) - AIUC-1: E013.1 — Documentation: Quality objectives and risk management (Related, named example) - IBM Risk Atlas: atlas-incomplete-ai-agent-evaluation-agentic — Incomplete AI agent evaluation (Related) - IBM Risk Atlas: atlas-incorrect-risk-testing — Incorrect risk testing (Superset Of) - IBM Risk Atlas: atlas-lack-of-testing-diversity — Lack of testing diversity (Related) ##### R-2420.003: External Dependency Reproducibility Failure The behavior of an AI system depends on an external tool or service that changes its behavior or can no longer be obtained or faithfully recreated. The loss prevents the previous behavior and/or accompanying evaluations from being reproduced. **Concern** Losing the external conditions behind an earlier result can prevent reconstruction of system behavior and weaken the evidence used to assess a deployment or compare a change. A complete deployment record alone may not recreate a changed or withdrawn service. **Cross-references** - IBM Risk Atlas: atlas-reproducibility-agentic — Reproducibility (Superset Of) #### R-2430: Benchmark Gaming Model optimization for benchmarks without corresponding real-world capability improvements or safety assurance. ### R-2500: Authority & Composition Risks arising from how capability and authority are arranged across a system rather than from any defect in its components. This includes what a single component is permitted to do at once and how much of it, what standing one component's output is granted by another, what the arrangement leaves within reach of a party that does not need it, and whether the system still records where authority and content came from. The condition exists whether or not it is exploited. An originating error or compromise may be present; the risk classified here is what the arrangement allows that fault to reach or affect. #### R-2510: Structural Concentration Arrangements in which capability, authority, or reliance is gathered at a single point, or in which something is left within reach of a party that does not need it, making the composition unsafe although no individual component is defective. This includes capabilities that are safe apart and unsafe together, a grant wider than the function requires, credentials the model can read, internals returned to any caller, and a composite that is not re-evaluated once its parts are assembled. The condition exists whether or not anything exploits it. ##### R-2510.001: Lethal Capability Trifecta A system combines access to sensitive or restricted data, exposure to untrusted content, and an external communication path through which that data can be disclosed. Untrusted content can influence the model to retrieve sensitive or restricted information and transmit it to an attacker. **Concern** Capabilities that are appropriate separately can create a path from attacker-controlled content to sensitive or restricted data and then to an outside recipient. A narrow communication channel can be enough; autonomy and unrestricted tool execution are not required. Separate or constrain these capabilities to interrupt the disclosure path. **Cross-references** - MITRE ATLAS: AML.T0108 — AI Agent (Related, companion) - NIST AI RMF: nist-information-security — Information Security (Related, named example, companion) - OWASP LLM Top 10 (2026): LLM01 — Prompt Injection (Related) ##### R-2510.002: Agents Rule of Two Violation Within one session, an agent processes untrusted inputs, accesses sensitive or restricted data or sensitive systems, and can change state or communicate externally, without human supervision or another reliable means of validating its actions. **Concern** An agent exposed to untrusted inputs can be redirected to disclose sensitive or restricted data or change sensitive systems. Constrain at least one of the three properties, or require human supervision or reliable validation of the resulting actions. The rule limits a combination of properties; it does not require two independent safeguards. **Cross-references** - MITRE ATLAS: AML.T0103 — Deploy AI Agent (Related, companion) ##### R-2510.003: Authority Beyond Function A component is granted permissions, data reach, or action scope wider than the function it performs requires, so the blast radius of any misdirection is set by the grant rather than by the task. **Concern** Authority is provisioned once, at deployment, and exercised on every request. Over-provisioning therefore holds for all traffic rather than only for requests that go wrong, and the granted scope — not the intended task — determines what a single successful injection or tool misuse can reach. **Cross-references** - AIUC-1: A003 — Limit AI agent data access (Related, named example) - AIUC-1: A003.1 — Config: Data access scoping (Related, named example) - AIUC-1: A003.3 — Config: Agent access and permissions management (Related) - AIUC-1: A008 — Prevent leakage of credentials and secrets (Related, named example) - AIUC-1: A008.3 — Config: Secure storage of user-provided credentials (Related, named example) - AIUC-1: B006 — Prevent unauthorized AI agent actions (Related, named example) - AIUC-1: B006.1 — Config: Agent service access restrictions (Related, named example) - AIUC-1: B006.3 — Config: Execution-level safeguards (Related, named example) - AIUC-1: B007 — Enforce user access privileges to AI systems (Related, named example) - AIUC-1: B008 — Protect AI system deployment environment (Related, named example) - AIUC-1: B008.1 — Config: API and agentic interface authentication (Related, named example) - AIUC-1: D003 — Restrict unsafe tool calls (Related, named example) - AIUC-1: D003.1 — Config: Tool authorization & validation (Related, named example) - AIUC-1: D004 — Third-party testing of tool calls (Related) - MITRE ATLAS: AML.T0101 — Data Destruction via AI Agent Tool Invocation (Related) - MITRE ATLAS: AML.T0103 — Deploy AI Agent (Related, named example) - OWASP Agentic Security Initiative: ASI02 — Tool Misuse and Exploitation (Related, named example) - OWASP Agentic Security Initiative: ASI03 — Identity and Privilege Abuse (Related, named example) - OWASP LLM Top 10 (2024): LLM02 — Insecure Output Handling (Related) - OWASP LLM Top 10 (2024): LLM07 — Insecure Plugin Design (Related, named example) - OWASP LLM Top 10 (2024): LLM08 — Excessive Agency (Related, named example) - OWASP LLM Top 10 (2025): LLM05 — Improper Output Handling (Related) - OWASP LLM Top 10 (2025): LLM06 — Excessive Agency (Related, named example) - OWASP LLM Top 10 (2026): LLM02 — Sensitive Information Disclosure (Related) - OWASP LLM Top 10 (2026): LLM03 — Excessive Agency (Related, named example) - OWASP LLM Top 10 (2026): LLM10 — Improper Output Handling (Related) ##### R-2510.004: Composition Evaluated Only in Parts A system admits content from several turns or sources into one context and evaluates each part as it arrives, without re-evaluating what the parts amount to once assembled. **Concern** Every part can pass every check while the assembled context does not. The gap is structural: it holds for all traffic rather than for the inputs that happen to be adversarial, and it is what makes a payload delivered in parts reach the model intact. **Cross-references** - OWASP LLM Top 10 (2026): LLM01 — Prompt Injection (Related, named example) - OWASP LLM Top 10 (2026): LLM02 — Sensitive Information Disclosure (Related, named example) ##### R-2510.005: Credentials Exposed to Model Placing a credential, key, or token where the model can read it. This includes credentials in the context window, in tool results returned to the model, and in files or environment variables readable by a tool available to the model. **Concern** Anything the model can read, it can emit. Output filters, tool checks, and log redaction each cover one path; a credential within the model's reach is available to all of them, including paths added later. **Cross-references** - AIUC-1: A008 — Prevent leakage of credentials and secrets (Related, named example) - AIUC-1: A008.1 — Config: Secrets detection in user inputs (Related, named example) - AIUC-1: A008.3 — Config: Secure storage of user-provided credentials (Related, named example) - AIUC-1: A008.4 — Documentation: User-facing warnings for detected secrets (Related, named example) - AIUC-1: B006 — Prevent unauthorized AI agent actions (Related, named example) - AIUC-1: B006.3 — Config: Execution-level safeguards (Related, named example) - MITRE ATLAS: AML.T0082 — RAG Credential Harvesting (Related, named example) - MITRE ATLAS: AML.T0098 — AI Agent Tool Credential Harvesting (Related, named example) - OWASP Agentic Security Initiative: ASI03 — Identity and Privilege Abuse (Related, named example) - OWASP LLM Top 10 (2025): LLM07 — System Prompt Leakage (Related, named example) - OWASP LLM Top 10 (2026): LLM02 — Sensitive Information Disclosure (Related, named example) - OWASP LLM Top 10 (2026): LLM08 — Hidden Context Exposure (Related, named example) ##### R-2510.006: Internals Exposed to Callers A deployment sends more information about itself than is necessary for its function. It sends this information to all callers through error responses, documentation endpoints, version banners, API responses, and model replies. This includes its configuration, architecture, environment, and tool definitions. This also includes the confidence values, log-probabilities, and similarity scores of its outputs. A caller gets this information without a request for it. **Concern** An attacker gets this information from usual use of the deployment. The attacker then does not have to do the reconnaissance that R-1440.004 describes. Each score that the deployment sends is a measurement. An attacker can use these measurements for model extraction, weight reconstruction, and membership inference. For each new tool, the deployment also sends the name, schema, and capability of that tool. The quantity of this information increases with the size of the system. **Cross-references** - AIUC-1: B003 — Manage public release of technical details (Related, named example) - AIUC-1: B003.1 — Documentation: Technical information disclosure guidelines (Related, named example) - AIUC-1: B009.3 — Config: Output precision controls (Related, named example) - Cisco AI Taxonomy: 8.3.2 — System Information Leakage (Related) ; ArXiv: - MITRE ATLAS: AML.T0047 — AI-Enabled Product or Service (Related, named example) - MITRE ATLAS: AML.T0063 — Discover AI Model Outputs (Superset Of, named example) - MITRE ATLAS: AML.T0064 — Gather RAG-Indexed Targets (Related) - MITRE ATLAS: AML.T0084 — Discover AI Agent Configuration (Related, companion) - OWASP LLM Top 10 (2025): LLM02 — Sensitive Information Disclosure (Related) - OWASP LLM Top 10 (2026): LLM06 — Unbounded Consumption (Related) - OWASP LLM Top 10 (2026): LLM09 — Vector and Embedding Weaknesses (Related) ##### R-2510.007: Access Control Delegated to the Model A deployment states an access rule in the model's instructions instead of enforcing it through a separate component that can deny access. Compliance with the rule depends on the model following those instructions. **Concern** Later context, persuasion, or ordinary model errors can cause the model to disregard the access rule. Successful responses in normal use can conceal this weakness until a request reaches data or actions the caller should not be allowed to access. **Cross-references** - AIUC-1: A003 — Limit AI agent data access (Related, named example) - AIUC-1: A003.1 — Config: Data access scoping (Related, named example) - AIUC-1: B006 — Prevent unauthorized AI agent actions (Related, named example) - AIUC-1: B006.3 — Config: Execution-level safeguards (Related, named example) - AIUC-1: B007 — Enforce user access privileges to AI systems (Related, named example) - AIUC-1: B007.1 — Config: User access controls (Related, named example) - AIUC-1: D003 — Restrict unsafe tool calls (Related, named example) - AIUC-1: D003.1 — Config: Tool authorization & validation (Related, named example) - OWASP LLM Top 10 (2025): LLM07 — System Prompt Leakage (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM07 — Misinformation (Related) - OWASP LLM Top 10 (2026): LLM08 — Hidden Context Exposure (Related) ##### R-2510.008: Component Reachable Without an Enforcement Point A component that can change the state of a resource is reachable without an enforcement step that establishes the caller's authority for the operation. This includes a component that authenticates no one, one that identifies the caller but never checks entitlement, and an operation that proceeds without approval required to confer authority. The condition exists whether or not anything reaches it. **Concern** A caller may invoke state-changing operations without establishing identity, permission, or approval. The component can execute the requested operation as designed even when the caller should not be allowed to perform it. Records of successful execution alone do not establish that access was authorized. **Cross-references** - AIUC-1: B006 — Prevent unauthorized AI agent actions (Related, named example) - AIUC-1: B006.1 — Config: Agent service access restrictions (Related, named example) - AIUC-1: B006.3 — Config: Execution-level safeguards (Related, named example) - AIUC-1: B007 — Enforce user access privileges to AI systems (Related, named example) - AIUC-1: B007.1 — Config: User access controls (Related, named example) - AIUC-1: B008 — Protect AI system deployment environment (Related, named example) - AIUC-1: B008.1 — Config: API and agentic interface authentication (Related, named example) - AIUC-1: D003 — Restrict unsafe tool calls (Related, named example) - AIUC-1: D003.1 — Config: Tool authorization & validation (Related, named example) - AIUC-1: D004 — Third-party testing of tool calls (Related) - Cisco AI Taxonomy: 14.1.2 — Insufficient Access Controls (Subset Of) ; ArXiv: - MITRE ATLAS: AML.T0011 — User Execution (Related, named example) - MITRE ATLAS: AML.T0011.003 — Malicious Link (Superset Of, named example) - OWASP Agentic Security Initiative: ASI02 — Tool Misuse and Exploitation (Related, named example) - OWASP Agentic Security Initiative: ASI09 — Human-Agent Trust Exploitation (Related, named example) - OWASP LLM Top 10 (2024): LLM07 — Insecure Plugin Design (Related, named example) ##### R-2510.009: Output Policy Enforcement Delegated to the Model A deployment uses only the behavior of the model to enforce a necessary rule about the content of its responses. This includes rules that the model instructions state and rules that the deployment defines but does not give to the model. Responses go to recipients without a separate check that can stop content that the rule does not permit. **Concern** Later context, prompt injection, or ordinary model errors can cause prohibited content to be delivered. A prompt that usually produces compliant responses does not provide a separate enforcement point when the model departs from the rule. **Cross-references** - AIUC-1: A004.3 — Config: IP detection implementation (Related, named example) - AIUC-1: A006 — Prevent PII leakage (Related, named example) - AIUC-1: A006.1 — Config: PII detection and filtering (Related) - AIUC-1: A006.2 — Config: DLP system integration (Related, named example) - AIUC-1: A007 — Prevent IP violations (Related, named example) - AIUC-1: A007.2 — Config: IP infringement filtering (Related, named example) - AIUC-1: A008 — Prevent leakage of credentials and secrets (Related, named example) - AIUC-1: A008.2 — Config: Secrets handling in generated code (Related, named example) - AIUC-1: C003 — Prevent harmful outputs (Related, named example) - AIUC-1: C003.1 — Config: Harmful output filtering (Related, named example) - AIUC-1: C004 — Prevent out-of-scope outputs (Related, named example) - AIUC-1: C004.1 — Config: out-of-scope guardrails (Related, named example) - AIUC-1: C005 — Prevent agent-specific high risk outputs (Related, named example) - AIUC-1: C005.1 — Config: Risk detection and response (Related, named example) - AIUC-1: C005.3 — Config: Automated response mechanisms (Related, named example) - AIUC-1: C006 — Prevent output vulnerabilities (Related, named example) - AIUC-1: C006.1 — Config: Output sanitization (Related, named example) - AIUC-1: C011 — Third-party testing for out-of-scope outputs (Related) - AIUC-1: C011.1 — Report: Out-of-scope output testing (Related) - AIUC-1: E010 — Establish AI acceptable use policy (Related, named example) - AIUC-1: E010.2 — Config: AUP violation detection (Related, named example) - AIUC-1: E010.4 — Documentation: Guardrails enforcing acceptable use (Related, named example) - OWASP LLM Top 10 (2024): LLM06 — Sensitive Information Disclosure (Related, companion) - OWASP LLM Top 10 (2025): LLM02 — Sensitive Information Disclosure (Related, companion) - OWASP LLM Top 10 (2026): LLM08 — Hidden Context Exposure (Related) ##### R-2510.010: Stale Authorization Used for Action An AI workflow carries an earlier permission, approval, or authorization token into a later operation without establishing that the authority still applies to that operation. The operation can proceed after the relevant entitlement has expired, been revoked, or been reduced. **Concern** An earlier authorization can remain usable after the underlying entitlement changes. Establish current entitlement at the later operation and enforce expiration and revocation of retained authority. **Cross-references** - AIUC-1: A002 — Establish output data policy (Related, named example) - AIUC-1: A002.2 — Config: Opt-in/opt-out and output deletion implementation (Related, named example) - OWASP Agentic Security Initiative: ASI03 — Identity and Privilege Abuse (Related, named example) ##### R-2510.011: High-Impact Actions on Model Authority Alone An AI workflow allows model-selected actions with substantial or hard-to-reverse consequences to take effect without independent approval or validation of whether the action should proceed. **Concern** Permission to use a tool does not establish that a particular use is intended or safe. A model error can select the wrong target, scope, timing, or action while remaining within granted permissions. Human approval or reliable automated validation can interrupt that path before the action takes effect. **Cross-references** - AIUC-1: B006 — Prevent unauthorized AI agent actions (Related, named example) - AIUC-1: B006.3 — Config: Execution-level safeguards (Related, named example) - AIUC-1: D003 — Restrict unsafe tool calls (Related, named example) - AIUC-1: D003.4 — Config: Human-approval workflows (Related) - OWASP Agentic Security Initiative: ASI02 — Tool Misuse and Exploitation (Related, named example) - OWASP Agentic Security Initiative: ASI09 — Human-Agent Trust Exploitation (Related, named example) - OWASP LLM Top 10 (2024): LLM08 — Excessive Agency (Subset Of, named example) - OWASP LLM Top 10 (2025): LLM06 — Excessive Agency (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM03 — Excessive Agency (Subset Of, named example) #### R-2520: Unverified Output Chaining Arrangements in which a procedure consumes an artifact without establishing the correctness and validity required for its use — model-generated text, retrieved content, tool output — under a contract that assumes those requirements have been met. The standing the artifact carries comes from its position in the chain rather than from any check performed on it. The condition exists whether or not the artifact is ever wrong or invalid. ##### R-2520.001: Generated Content Accepted as Verified Input A procedure consumes model-generated text as an input whose correctness it depends on, with no check between the generation and the consumption that establishes the content is correct. **Concern** The consuming procedure's contract assumes a property the generating step never guaranteed. Because the gap is structural, it holds for every request rather than for the ones that happen to go wrong, and it is visible as an edge carrying the unverified tag into a consumer that performs no check. **Cross-references** - IBM Risk Atlas: atlas-hallucination — Hallucination (Related, named example, companion) - OWASP Agentic Security Initiative: ASI05 — Unexpected Code Execution (RCE) (Related, named example) - OWASP Agentic Security Initiative: ASI08 — Cascading Failures (Related, named example) - OWASP LLM Top 10 (2024): LLM09 — Overreliance (Subset Of, named example) - OWASP LLM Top 10 (2025): LLM05 — Improper Output Handling (Subset Of, named example) - OWASP LLM Top 10 (2025): LLM09 — Misinformation (Related, named example) - OWASP LLM Top 10 (2026): LLM07 — Misinformation (Related, named example) - OWASP LLM Top 10 (2026): LLM10 — Improper Output Handling (Subset Of, named example) ##### R-2520.002: Retrieved Content Accepted as Verified Input A procedure consumes retrieved material — search results, retrieval-augmented passages, tool or MCP responses — as authoritative input, with no check establishing that what came back is correct or that its source was verified. **Concern** Retrieval from a source whose contents are verified is sound; the defect is the absence of the check, not the retrieval. Where no check exists, the chain grants the retrieved material the standing of verified data on the strength of where it arrived rather than what it is. **Cross-references** - AIUC-1: D001 — Prevent hallucinated outputs (Related, named example) - OWASP Agentic Security Initiative: ASI06 — Memory & Context Poisoning (Related, named example) - OWASP Agentic Security Initiative: ASI07 — Insecure Inter-Agent Communication (Related) - OWASP LLM Top 10 (2024): LLM03 — Training Data Poisoning (Related, named example) - OWASP LLM Top 10 (2025): LLM04 — Data and Model Poisoning (Related) - OWASP LLM Top 10 (2025): LLM08 — Vector and Embedding Weaknesses (Related) - OWASP LLM Top 10 (2026): LLM07 — Misinformation (Related, named example) - OWASP LLM Top 10 (2026): LLM09 — Vector and Embedding Weaknesses (Related) - OWASP LLM Top 10 (2026): LLM10 — Improper Output Handling (Related) ##### R-2520.003: Input Contract Constraints Not Validated A procedure consumes model-generated text, retrieved material, or tool output without checking the required format, type, schema, range, or allowable-value constraints of its input contract, including restrictions on the operations expressed by a generated command or plan. **Concern** A consumer can reject, misread, or act incorrectly on a value that does not satisfy its input contract even when the value is handled safely as data. Validate the required constraints before consumption; safe binding or encoding does not establish that the value is acceptable for the operation. **Cross-references** - AIUC-1: B008 — Protect AI system deployment environment (Related, named example) - AIUC-1: B008.3 — Config: Agentic interface data integrity (Related, named example) - AIUC-1: C006 — Prevent output vulnerabilities (Related, named example) - AIUC-1: C006.1 — Config: Output sanitization (Related, named example) - AIUC-1: D003 — Restrict unsafe tool calls (Related, named example) - AIUC-1: D003.1 — Config: Tool authorization & validation (Related, named example) - IBM Risk Atlas: atlas-exploit-trust-mismatch-agentic — Exploit trust mismatch (Related) - OWASP Agentic Security Initiative: ASI02 — Tool Misuse and Exploitation (Related, named example) - OWASP Agentic Security Initiative: ASI07 — Insecure Inter-Agent Communication (Related) - OWASP Agentic Security Initiative: ASI08 — Cascading Failures (Related, named example) - OWASP LLM Top 10 (2024): LLM01 — Prompt Injection (Related, named example) - OWASP LLM Top 10 (2024): LLM02 — Insecure Output Handling (Related, named example) - OWASP LLM Top 10 (2024): LLM07 — Insecure Plugin Design (Related, named example) - OWASP LLM Top 10 (2025): LLM05 — Improper Output Handling (Related, named example) - OWASP LLM Top 10 (2026): LLM10 — Improper Output Handling (Related, named example) ##### R-2520.004: Data Interpreted as Downstream Control Structure A procedure consumes model-generated text, retrieved material, or tool output in a way that allows content intended as data to alter the structure or meaning of a query, command, template, path, or deserialization operation. **Concern** A value can satisfy its format and schema constraints yet change what the consumer executes or accesses. Use the consumer’s safe data interface, such as parameter binding, context-appropriate encoding, constrained path resolution, or non-executable deserialization, to preserve the intended operation. **Cross-references** - AIUC-1: B008 — Protect AI system deployment environment (Related, named example) - AIUC-1: C006 — Prevent output vulnerabilities (Related, named example) - AIUC-1: C006.1 — Config: Output sanitization (Related, named example) - IBM Risk Atlas: atlas-exploit-trust-mismatch-agentic — Exploit trust mismatch (Related) - OWASP Agentic Security Initiative: ASI02 — Tool Misuse and Exploitation (Related, named example) - OWASP Agentic Security Initiative: ASI05 — Unexpected Code Execution (RCE) (Related, named example) - OWASP LLM Top 10 (2024): LLM02 — Insecure Output Handling (Related, named example) - OWASP LLM Top 10 (2024): LLM07 — Insecure Plugin Design (Related, named example) - OWASP LLM Top 10 (2025): LLM05 — Improper Output Handling (Related, named example) - OWASP LLM Top 10 (2026): LLM10 — Improper Output Handling (Related, named example) ##### R-2520.005: Component Identity Not Verified A deployment relies on a component’s claimed identity or version without a reliable means of establishing that the component actually loaded or invoked matches that claim. **Concern** A name or version label does not establish which component is running. A component can differ from its claimed identity while the deployment continues to rely on that claim. Verification must connect the claimed identity to the component actually loaded or invoked; this condition exists even when they happen to match. **Cross-references** - AIUC-1: A003.2 — Config: Agent identity management (Related, named example) - AIUC-1: E004 — Assign accountability (Related) - AIUC-1: E004.2 — Config: Code signing implementation (Related, named example) - OWASP LLM Top 10 (2026): LLM04 — Supply Chain (Related, named example) #### R-2530: Provenance & Attribution Loss Arrangements in which the record of where authority or content came from does not survive composition. This includes a component acting with the authority of whatever invoked it rather than its own, material of differing trust levels sharing a context that no longer records which part came from where, and an action arriving at a resource with no record of which party it was performed for. The condition exists whether or not anything exploits it. ##### R-2530.001: Inherited Invocation Authority A component acquires the authority of whatever invoked it rather than holding authority of its own, so a plugin, tool, or subordinate agent acts with the standing of the model that called it. **Concern** The authority is never granted to the component and so never appears in any decision to grant it; it arrives with the call. Checks placed where authority is issued therefore do not see it, and the component's reach is set by its caller's standing rather than by anything about the component itself. **Cross-references** - AIUC-1: A003 — Limit AI agent data access (Related, named example) - AIUC-1: A003.3 — Config: Agent access and permissions management (Related) - OWASP Agentic Security Initiative: ASI03 — Identity and Privilege Abuse (Subset Of, named example) - OWASP LLM Top 10 (2024): LLM07 — Insecure Plugin Design (Related) - OWASP LLM Top 10 (2026): LLM01 — Prompt Injection (Related, named example) ##### R-2530.002: Source Provenance Collapse Content drawn from sources of differing trustworthiness is combined in a model context or presented to a recipient without attribution identifying which source supplied which part, so the combined content carries a common standing rather than the standing of its origin. **Concern** Without attribution for each part, material from sources of differing trustworthiness can acquire the same standing when combined. Retaining origin internally does not protect a recipient who receives an undifferentiated presentation. Preserve source attribution through the point where the combined material is interpreted or used. Attribution enables trust distinctions; it does not by itself establish that a source or claim is correct. **Cross-references** - AIUC-1: C006 — Prevent output vulnerabilities (Related, named example) - AIUC-1: C006.2 — Demonstration: Content handling and labelling for untrusted content (Related, named example) - MITRE ATLAS: AML.T0071 — False RAG Entry Injection (Superset Of, named example) - OWASP LLM Top 10 (2024): LLM07 — Insecure Plugin Design (Related, named example) - OWASP LLM Top 10 (2026): LLM09 — Vector and Embedding Weaknesses (Related, companion) ##### R-2530.003: Principal Attribution Loss A system carries no principal across delegation hops, so an action arriving at a resource carries no record of which party it was performed for. **Concern** The condition holds whether or not anyone conceals anything: attribution is absent by construction rather than defeated. It is the actor-side counterpart of content arriving without provenance — the same gap on the other half of a request. **Cross-references** - OWASP Agentic Security Initiative: ASI03 — Identity and Privilege Abuse (Related) - OWASP LLM Top 10 (2024): LLM07 — Insecure Plugin Design (Related) - OWASP LLM Top 10 (2024): LLM08 — Excessive Agency (Related) - OWASP LLM Top 10 (2025): LLM06 — Excessive Agency (Related) - OWASP LLM Top 10 (2026): LLM03 — Excessive Agency (Related) #### R-2540: Unbounded Execution Arrangements in which work a system starts has no ceiling on how far it runs: no cap on iterations, recursion depth, spawned tasks, or spend. The bound that stops it is whatever runs out first rather than one the deployment chose. ##### R-2540.001: Runaway Agent Execution An agent loops, recurses, or spawns further work with no limit set on any of those, and continues until an external limit intervenes — a quota, a timeout, an exhausted balance. No adversary is required and the triggering task can be entirely ordinary. **Concern** Repeated or recursively spawned work can consume the deployment's budget and capacity. Without a configured limit, execution may continue until a provider quota, timeout, or exhausted balance stops it. Ordinary tasks can trigger the same resource use without an attacker being involved. **Cross-references** - AIUC-1: D003 — Restrict unsafe tool calls (Related) - AIUC-1: D003.2 — Config: Rate limits for tools (Related, named example) - AIUC-1: E009 — Monitor third-party access (Related, named example) - Cisco AI Taxonomy: 13.2.1 — Service Misuse for Cost Inflation (Related) ; ArXiv: - MITRE ATLAS: AML.T0034.002 — Agentic Resource Consumption (Related, named example) - OWASP LLM Top 10 (2024): LLM04 — Model Denial of Service (Related, named example, companion) - OWASP LLM Top 10 (2026): LLM06 — Unbounded Consumption (Subset Of, named example) ##### R-2540.002: Inference Without Caller Rate Limits A deployment accepts inference requests without a limit on the number or frequency of requests one caller can make. **Concern** A caller, retry loop, or batch job can monopolize request capacity even when individual requests are inexpensive. Enforce caller-level request limits; limits on work within a request or on cumulative spending protect different quantities. **Cross-references** - AIUC-1: B004 — Prevent AI endpoint scraping (Related, named example) - AIUC-1: B004.2 — Config: Rate limits (Related, named example) - MITRE ATLAS: AML.T0034.000 — Excessive Queries (Related) - OWASP LLM Top 10 (2025): LLM10 — Unbounded Consumption (Subset Of) - OWASP LLM Top 10 (2026): LLM06 — Unbounded Consumption (Subset Of) ##### R-2540.003: Inference Without Per-Request Work Limits A deployment accepts inference requests without a ceiling on the work each request may consume, including processing its input, generating output, or carrying out internal reasoning. **Concern** One accepted request can consume excessive computation despite a caller rate limit. Bound and interrupt work within each inference; an input-size limit alone does not bound generated output or internal reasoning. **Cross-references** - AIUC-1: B009 — Limit output over-exposure (Related, named example) - AIUC-1: B009.1 — Config: Output volume limits (Related, named example) - OWASP LLM Top 10 (2025): LLM10 — Unbounded Consumption (Subset Of) - OWASP LLM Top 10 (2026): LLM06 — Unbounded Consumption (Subset Of, named example) ##### R-2540.004: Inference Without Cumulative Consumption Limits A deployment serves inference requests without an enforceable cumulative consumption or spending limit across the requests charged to a budget. **Concern** Individually bounded requests at an allowed rate can still exhaust the deployment budget over time or across callers. Track consumption against the shared budget and stop or constrain further work when that budget is reached. **Cross-references** - OWASP LLM Top 10 (2025): LLM10 — Unbounded Consumption (Subset Of) - OWASP LLM Top 10 (2026): LLM06 — Unbounded Consumption (Subset Of, named example) #### R-2550: Failure Propagation Arrangements that allow an originating error or compromise to spread through connected components and workflows without containment that limits affected work or allows dependent work to be stopped or invalidated. ##### R-2550.001: Uncontained Result Propagation An incorrect or malicious result or state from one operation is carried into dependent components or workflows without containment that limits the affected work or invalidates dependent state. The fault spreads beyond the originating operation into further actions or retained state. **Concern** An originating fault can affect further actions and retained state through dependent work. Containment, stopping dependent work and invalidating affected state limit the spread and support recovery. **Cross-references** - OWASP Agentic Security Initiative: ASI08 — Cascading Failures (Superset Of, named example) - OWASP LLM Top 10 (2026): LLM07 — Misinformation (Related, named example) ### R-2600: Corpus & Data Defects Defects in the contents, preparation, selection, or reuse of data supplied for model training, tuning, evaluation, or inference. #### R-2610: Training Corpus Defects Defects in material used to train, tune, or evaluate a model. This includes unsuitable content, omissions, representational mismatches, and provenance that cannot be established. ##### R-2610.001: Protected Material in the Training Corpus A model's training corpus contains copyrighted or otherwise protected works, so the model carries the capacity to reproduce recognizable portions of them in ordinary operation, with no one requesting infringement. **Concern** Reproduction follows from what the corpus holds, so it recurs across deployments and cannot be resolved by output filtering alone. Presence of protected material in the corpus is a recordable property of the training data, which is where the condition is observable. **Cross-references** - IBM Risk Atlas: atlas-ip-information-in-prompt — IP information in prompt (Related) - NIST AI RMF: nist-intellectual-property — Intellectual Property (Subset Of, named example) - OWASP LLM Top 10 (2024): LLM05 — Supply Chain Vulnerabilities (Related) - OWASP LLM Top 10 (2025): LLM03 — Supply Chain (Related) - OWASP LLM Top 10 (2026): LLM02 — Sensitive Information Disclosure (Related, named example) - OWASP LLM Top 10 (2026): LLM04 — Supply Chain (Related) **Related risks** - Causes: R-4230.001: Uncompensated Use of Creative Work. Reproduction of protected material from the corpus contributes to uncompensated use of creative work. ##### R-2610.002: Personal Data in the Training Corpus A model's training corpus contains personal data about identifiable people, so the model carries the capacity to reproduce it in ordinary operation, with no one attempting extraction. **Concern** Disclosure follows from what the corpus holds, so it recurs across deployments and cannot be resolved by output filtering alone. Presence of personal data in the corpus is a recordable property of the training data, which is where the condition is observable. **Cross-references** - AILuminate: prv — Privacy Violations (Related) - AIUC-1: A005.3 — Config: Privacy-enhancing controls (Related, named example) - Cisco AI Taxonomy: 8.2.1 — Training Data Exposure (Subset Of) ; ArXiv: - IBM Risk Atlas: atlas-exposing-personal-information — Exposing personal information (Subset Of) - IBM Risk Atlas: atlas-personal-information-in-data — Personal information in data (Equivalent, named example) - IBM Risk Atlas: atlas-personal-information-in-prompt — Personal information in prompt (Related, named example) - IBM Risk Atlas: atlas-reidentification — Reidentification (Superset Of, named example) - NIST AI RMF: nist-data-privacy — Data Privacy (Subset Of) - OWASP LLM Top 10 (2024): LLM03 — Training Data Poisoning (Related, named example) - OWASP LLM Top 10 (2024): LLM06 — Sensitive Information Disclosure (Related, named example) - OWASP LLM Top 10 (2025): LLM02 — Sensitive Information Disclosure (Subset Of) - OWASP LLM Top 10 (2025): LLM04 — Data and Model Poisoning (Related) - OWASP LLM Top 10 (2026): LLM02 — Sensitive Information Disclosure (Subset Of) ##### R-2610.003: Training/Deployment Data Mismatch Risk from data used for training and validation not matching the deployment environment, leading to spurious features, bias propagation, or performance degradation. The model learns patterns that hold in training data but fail to generalize to real-world conditions. **Concern** Data mismatch is a fundamental challenge in machine learning deployment. Models may perform well on benchmarks while failing on real-world inputs that differ in subtle but important ways from training data. This can lead to systematic errors that are not detected until after deployment. **Cross-references** - IBM Risk Atlas: atlas-data-contamination — Data contamination (Related) - IBM Risk Atlas: atlas-introduce-data-bias-agentic — Introduce data bias (Related, named example, companion) - IBM Risk Atlas: atlas-lack-domain-expertise — Lack of domain expertise (Related) - IBM Risk Atlas: atlas-temporal-gap — Temporal gap (Related) - IBM Risk Atlas: atlas-unrepresentative-data — Unrepresentative data (Related, named example) - NIST AI RMF: nist-harmful-bias-and-homogenization — Harmful Bias and Homogenization (Related) - OWASP LLM Top 10 (2025): LLM09 — Misinformation (Related, companion) - OWASP LLM Top 10 (2026): LLM07 — Misinformation (Related, companion) ##### R-2610.004: Synthetic Content in the Training Corpus A corpus used to train, tune, or evaluate a model contains material generated by AI systems, including earlier versions of the model itself. **Concern** Repeated training on model-generated material can reinforce errors and reduce the variety of information represented in later models. Performance can deteriorate as that material is reused across generations. The presence of synthetic content identifies an exposure to assess; it does not by itself establish that degradation has occurred. **Cross-references** - IBM Risk Atlas: atlas-improper-retraining — Improper retraining (Related, named example) - NIST AI RMF: nist-harmful-bias-and-homogenization — Harmful Bias and Homogenization (Related) ##### R-2610.005: Confidential or Access-Controlled Information in the Training Corpus A model’s training or fine-tuning corpus contains confidential or access-controlled information that some users of the model are not authorized to receive, so the model carries the capacity to reproduce it for those users in ordinary operation, with no one attempting extraction. **Concern** Ordinary model responses can expose restricted information to users outside its permitted audience. Access controls on the original material do not establish that a model trained on it will preserve those restrictions. **Cross-references** - AIUC-1: A004 — Protect IP & trade secrets (Related, named example) - AIUC-1: A004.1 — Documentation: User guidance on confidential information (Related) - AIUC-1: A004.2 — Documentation: foundational model IP protections (Related) - AIUC-1: A005 — Prevent cross-customer data exposure (Related, named example) - AIUC-1: A005.3 — Config: Privacy-enhancing controls (Related, named example) - IBM Risk Atlas: atlas-confidential-information-in-data — Confidential information in data (Superset Of) - IBM Risk Atlas: atlas-ip-information-in-prompt — IP information in prompt (Related) - IBM Risk Atlas: atlas-revealing-confidential-information — Revealing confidential information (Related) - OWASP LLM Top 10 (2024): LLM03 — Training Data Poisoning (Subset Of, named example) - OWASP LLM Top 10 (2024): LLM06 — Sensitive Information Disclosure (Subset Of) - OWASP LLM Top 10 (2025): LLM02 — Sensitive Information Disclosure (Subset Of) - OWASP LLM Top 10 (2025): LLM04 — Data and Model Poisoning (Subset Of) - OWASP LLM Top 10 (2026): LLM02 — Sensitive Information Disclosure (Subset Of) ##### R-2610.006: Invalid Phenomenon Measurement in Training Data A model’s training or fine-tuning corpus uses measurements or targets that do not validly represent the phenomenon the model is intended to estimate. **Concern** More records do not repair a target or measurement that represents the wrong phenomenon. The measurement must be validated against the quantity or outcome the model is meant to estimate. **Cross-references** - IBM Risk Atlas: atlas-data-contamination — Data contamination (Subset Of) - IBM Risk Atlas: atlas-unrepresentative-data — Unrepresentative data (Subset Of) ##### R-2610.007: Incorrect or Conflicting Corpus Content A corpus used to train, fine-tune, or evaluate a model contains factual errors, corrupted values, incorrect labels, incorrect associations between examples and labels, or mutually inconsistent information about the same subject or target. **Concern** Errors or contradictions in examples and labels can be learned and repeated even when the corpus represents the deployment population. Checking content and labels addresses a different defect from collecting a more representative sample. **Cross-references** - Cisco AI Taxonomy: 7.3.1 — Corrupted Third-Party Data (Related) ; ArXiv: - IBM Risk Atlas: atlas-data-contamination — Data contamination (Related) - IBM Risk Atlas: atlas-data-curation — Improper data curation (Superset Of) - NIST AI RMF: nist-value-chain-and-component-integration — Value Chain and Component Integration (Related, named example) - OWASP LLM Top 10 (2024): LLM03 — Training Data Poisoning (Related, named example) - OWASP LLM Top 10 (2026): LLM05 — Data and Model Poisoning (Related) - OWASP LLM Top 10 (2026): LLM07 — Misinformation (Related, companion) ##### R-2610.008: Task-Incompatible Training Examples A corpus used to train or fine-tune a model includes examples that teach answers or behavior incompatible with the task or response requirements the model is being trained to satisfy. The examples may be accurate for another task or policy but unsuitable for this training objective. **Concern** Accurate examples can still teach the wrong task or response policy. Corpus review must compare the behavior taught by examples with the intended training objective. **Cross-references** - IBM Risk Atlas: atlas-data-contamination — Data contamination (Subset Of, named example) - OWASP LLM Top 10 (2024): LLM03 — Training Data Poisoning (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM05 — Data and Model Poisoning (Subset Of) ##### R-2610.009: Held-Out Evaluation Data in the Training Corpus A corpus used to train or tune a model contains records drawn from, or duplicating, material reserved for testing or evaluating that model. **Concern** Overlap between training and held-out material can make evaluation results overstate generalization. Separation requires tracking record identity and duplicates across training and evaluation splits. **Cross-references** - IBM Risk Atlas: atlas-data-contamination — Data contamination (Subset Of, named example) ##### R-2610.010: Training Data Bias Data used to train or fine-tune a model encodes biased treatment, labels, or associations concerning people or social groups. This includes historical unequal treatment and systematic underrepresentation that distorts how groups are represented. **Concern** A corpus can faithfully reflect unequal treatment and still teach biased associations. Assessment must examine treatment, labels and representation across relevant groups rather than rely only on overall accuracy. **Cross-references** - IBM Risk Atlas: atlas-data-bias — Data bias (Equivalent, named example) - IBM Risk Atlas: atlas-exclusion — Exclusion (Related) - NIST AI RMF: nist-harmful-bias-and-homogenization — Harmful Bias and Homogenization (Related) - OWASP LLM Top 10 (2024): LLM03 — Training Data Poisoning (Subset Of, named example) - OWASP LLM Top 10 (2025): LLM04 — Data and Model Poisoning (Subset Of) - OWASP LLM Top 10 (2025): LLM09 — Misinformation (Related, companion) - OWASP LLM Top 10 (2026): LLM05 — Data and Model Poisoning (Related) - OWASP LLM Top 10 (2026): LLM07 — Misinformation (Related, companion) ##### R-2610.011: Missing Required Corpus Content A corpus used to train, fine-tune, or evaluate a model lacks information required to interpret its records or support the intended task, such as required fields, labels, or relevant facts. **Concern** Accurate values do not compensate for required information that is absent. Establish completeness requirements for the task and obtain missing content or reject incomplete records; correcting present values or rebalancing represented populations does not supply missing fields or facts. **Cross-references** - Cisco AI Taxonomy: 7.3.1 — Corrupted Third-Party Data (Related) ; ArXiv: - IBM Risk Atlas: atlas-temporal-gap — Temporal gap (Related) - OWASP LLM Top 10 (2025): LLM09 — Misinformation (Related, companion) ##### R-2610.012: Unverifiable Training Data Provenance A training or tuning corpus contains material whose origin, preparation history, ownership, or usage terms cannot be established. This includes synthetic material whose source data or generation process cannot be traced. **Concern** Unverified provenance prevents reviewers from establishing what material entered a corpus and whether the claimed history and permissions are reliable. Accurate content and complete local development records can coexist with upstream claims that cannot be substantiated. **Cross-references** - IBM Risk Atlas: atlas-data-provenance — Uncertain data provenance (Related) - NIST AI RMF: nist-value-chain-and-component-integration — Value Chain and Component Integration (Related) ##### R-2610.013: Sexually Abusive Material in the Training Corpus A corpus used to train or fine-tune a model contains child sexual abuse material or non-consensual intimate imagery. **Concern** A model may learn abusive content from this material and reproduce or adapt it. Corpus-level review identifies the exposure and supports removal, controlled use, or other safeguards before training; output filtering addresses what the trained system can deliver and does not remove the material from the corpus. Presence identifies an exposure to assess, not proof that the model reproduces the material or that the corpus use is unlawful. Authorized forensic or prevention work can retain this exposure even when the material is appropriate for its task. **Cross-references** - NIST AI RMF: nist-obscene-degrading-and-or-abusive-content — Obscene, Degrading, and/or Abusive Content (Subset Of, named example) #### R-2620: Retrieval Corpus Defects Defects in a corpus used to supply context during inference, including its reference material and the representations used to select that material. This includes inaccurate, outdated, duplicated, or unverified content, incompatible embeddings, and retrieval scopes that span material that must be kept apart. ##### R-2620.001: Unverified Retrieval Content A retrieval corpus contains material whose accuracy has not been established, and the model relies on it when answering. This includes material supplied by insiders, added in bulk, or obtained from a provider the deployment does not assess. **Concern** Inaccurate material can produce repeated errors in answers that rely on it. If later checks do not verify the retrieved information, the errors may persist and be attributed to the model rather than to the source. No deliberate poisoning is needed. **Cross-references** - OWASP LLM Top 10 (2025): LLM08 — Vector and Embedding Weaknesses (Subset Of) - OWASP LLM Top 10 (2026): LLM05 — Data and Model Poisoning (Subset Of) ##### R-2620.002: Incompatible Embedding Spaces in Retrieval A retrieval system compares embeddings from incompatible vector spaces as though their distances or similarity scores were directly comparable. This includes corpus vectors produced by incompatible embedding models or versions being searched together. **Concern** Relevant material can rank poorly while unrelated content appears close, even when the source documents are accurate and each embedding model works correctly. Re-embedding the corpus into a compatible space or querying separate indexes with matching encoders addresses the mismatch. **Cross-references** - OWASP LLM Top 10 (2026): LLM09 — Vector and Embedding Weaknesses (Subset Of) ##### R-2620.003: Separated Material Combined in Retrieval A retrieval scope spans material that must be kept apart for contractual, privacy, ethical, or regulatory reasons, and a single retrieval places material from both sides of the separation in one model context. The separation governs what may be combined and holds where the requesting user is entitled to each item. This includes material from different clients or matters behind an ethical wall, data limited to a particular purpose of use, and data held under separate agreements. **Concern** A model given material from both sides of a separation can draw on either in the same answer, carrying one client's or one purpose's information into work for another. The user's entitlement to each item leaves the separation requirement unmet, and filtering the output leaves in place what the model has already read. The separation has to govern what the retrieval selects. **Cross-references** - AIUC-1: A005.2 — Config: Customer data isolation controls (Related, named example) #### R-2630: Continuous-Learning Data Defects Defects in how a deployed system selects and reuses operational interactions or feedback as data for subsequent model updates. ##### R-2630.001: Unvalidated Operational Inputs Used for Learning A deployed system uses incoming interactions or other operational data to update its model without establishing that the material is suitable for learning. **Concern** Material suitable for responding to a user may be unsuitable as a training example. Mistakes, misleading statements, or unrepresentative interactions can become learned behavior affecting later users. Separating operational input from admission to training allows the system to assess that material before learning from it. **Cross-references** - IBM Risk Atlas: atlas-improper-retraining — Improper retraining (Related) - OWASP LLM Top 10 (2024): LLM03 — Training Data Poisoning (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM05 — Data and Model Poisoning (Subset Of, named example) #### R-2640: Data Preparation Failures Defects in the processing and cleaning that prepare data for AI training, tuning, evaluation, or inference. ##### R-2640.001: Unprepared Data Supplied for Model Use Data that require processing or cleaning for AI training, tuning, evaluation, or inference are supplied for that use before the required preparation is complete. **Concern** Accurate content and known provenance do not establish that data are ready for a particular use. Ensure that the material supplied to the consumer has undergone the required preparation. This includes selecting the prepared version rather than a raw or intermediate version. Material already suitable for its intended use needs no additional processing merely because it is raw. **Cross-references** - NIST AI RMF: nist-value-chain-and-component-integration — Value Chain and Component Integration (Related) ### R-2700: Multi-Agent Dynamics Failures arising from interactions between multiple AI agents, and from extended or persistent sessions, where no single component is defective but their composition or duration is. #### R-2710: Multi-Agent Dynamics Failures arising from interactions between multiple AI agents including coordination failures, emergent competition, or collective behavior issues. ##### R-2710.001: Agent Miscoordination Multiple agents with compatible objectives failing to align their behaviors effectively due to incompatible strategies, credit assignment problems, or limited interaction history. **Concern** When AI agents cannot effectively coordinate, resources are wasted, goals go unachieved, and systems may work at cross purposes despite ostensibly aligned objectives. **Cross-references** - OWASP Agentic Security Initiative: ASI07 — Insecure Inter-Agent Communication (Related, named example) ##### R-2710.002: Multi-Agent Conflict Risks from mixed-motive interactions between AI agents where selfish incentives lead to conflict, arms races, or mutually destructive competition. **Concern** Competitive dynamics between AI agents can escalate rapidly, consuming resources, causing collateral damage, and producing outcomes worse than any individual agent would choose. ##### R-2710.003: Emergent Collective Behavior Unpredictable behaviors emerging from interactions between multiple AI systems that are not apparent from individual agent properties, including cascading failures. **Concern** Complex interactions between AI systems can produce emergent behaviors that were not designed, anticipated, or tested for, potentially causing system-wide failures or unintended outcomes. **Cross-references** - OWASP Agentic Security Initiative: ASI08 — Cascading Failures (Related, named example) - OWASP Agentic Security Initiative: ASI10 — Rogue Agents (Related, named example) - OWASP LLM Top 10 (2026): LLM07 — Misinformation (Related) ##### R-2710.004: Improvised Inter-Agent Channel Agents exchange messages through a shared resource that was not designed as a communication channel. This includes package or artifact stores, caches, filesystems, and object names within those resources. Stored messages remain available beyond the sessions that created them and can be read by later agents. **Concern** Agents may share credentials, techniques, or task progress without the controls intended for communication between them. Persistent messages can carry that information across runs. Deleting the messages may not prevent further exchanges if the agents retain access to the shared resource. **Cross-references** - OWASP Agentic Security Initiative: ASI10 — Rogue Agents (Related, named example) #### R-2720: Long-Session Issues Degradation, inconsistency, or failures that emerge in extended interactions, long contexts, or persistent sessions. ##### R-2720.001: Required Context Lost from the Active Window As a session grows, context selection or truncation removes earlier instructions or information still required for the current task from the model’s active context. **Concern** Later responses can depart from task requirements because the model no longer receives them. Preserve or restore the required instructions and information when selecting context; session length alone does not establish this failure. ##### R-2720.002: Required Information Lost in Context Compaction A session summary or other compacted representation omits or alters earlier instructions or information still required for the current task. **Concern** Keeping the summary in the active window does not recover what compaction removed or changed. Check compacted representations against required constraints and retain the original evidence needed to recover important details. ##### R-2720.003: Uncontrolled Session Memory Accumulation A session’s retained memory accumulates entries without pruning or selection sufficient to prevent obsolete or irrelevant entries from displacing or obscuring information needed for the current task. **Concern** A growing store can repeatedly supply obsolete or irrelevant material even when context truncation and summarization work as intended. Retire superseded entries and constrain retrieval to memory relevant to the current task. ### R-2800: Data Exposure Deployments that place data they hold in front of a party that should not receive it. This includes what the system returns to the person interacting with it, and what it writes to the places it keeps records. The exposure follows from how the deployment is built or configured, rather than from an adversary working to obtain it. #### R-2810: Disclosure to the Wrong Recipient Arrangements in which a system discloses information to a party that should not receive it in the circumstances of the interaction or task. This includes another user’s content surfaced through shared state or a cache, material retrieved from a store that does not check the asker’s entitlement, and information disclosed through responses, tool invocations, delegated messages, or task-directed storage writes. Disclosure can occur through the content sent or through observable system actions that allow the recipient to infer the information. ##### R-2810.001: Cross-User Information Disclosure A system includes information about or belonging to one user in a response to another user who should not receive it in the circumstances of that interaction. This can occur through shared caches or sessions, or through other failures to preserve user boundaries when generating a response. **Concern** Responses can disclose one user’s information to another through more than shared caches or sessions. The disclosure may recur during ordinary use; checking the recipient and the data included in the response is necessary even when per-user storage is isolated. **Cross-references** - AILuminate: prv — Privacy Violations (Related) - AIUC-1: A003 — Limit AI agent data access (Related, named example) - AIUC-1: A003.1 — Config: Data access scoping (Related, named example) - AIUC-1: A004 — Protect IP & trade secrets (Related) - AIUC-1: A004.3 — Config: IP detection implementation (Related, named example) - AIUC-1: A005 — Prevent cross-customer data exposure (Related, named example) - AIUC-1: A005.2 — Config: Customer data isolation controls (Related, named example) - AIUC-1: A006 — Prevent PII leakage (Related, named example) - AIUC-1: A006.1 — Config: PII detection and filtering (Related) - AIUC-1: A006.2 — Config: DLP system integration (Related, named example) - IBM Risk Atlas: atlas-confidential-data-in-prompt — Confidential data in prompt (Related) - IBM Risk Atlas: atlas-exposing-personal-information — Exposing personal information (Related, named example) - IBM Risk Atlas: atlas-ip-information-in-prompt — IP information in prompt (Related) - IBM Risk Atlas: atlas-personal-information-in-prompt — Personal information in prompt (Related) - IBM Risk Atlas: atlas-revealing-confidential-information — Revealing confidential information (Related) - IBM Risk Atlas: atlas-sharing-info-user-agentic — Sharing IP/PI/confidential information with user (Related) - MITRE ATLAS: AML.T0057 — LLM Data Leakage (Related, named example) - OWASP Agentic Security Initiative: ASI03 — Identity and Privilege Abuse (Related, named example) - OWASP LLM Top 10 (2024): LLM03 — Training Data Poisoning (Related, named example) - OWASP LLM Top 10 (2024): LLM06 — Sensitive Information Disclosure (Subset Of, named example) - OWASP LLM Top 10 (2025): LLM02 — Sensitive Information Disclosure (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM02 — Sensitive Information Disclosure (Subset Of, named example) ##### R-2810.002: Retrieval Beyond the Asker's Entitlement A retrieval step exposes content or information about indexed material that the party asking is not currently entitled to receive. The search is not scoped to that party's permissions, allowing disclosure through returned content, result counts, similarity scores, or response timing, even when restricted documents are removed from the final results. **Concern** Checking permissions only after search can hide restricted documents while still revealing their existence, topic, or volume. Access restrictions need to govern the search and its observable results, rather than only filtering the documents eventually returned. **Cross-references** - AILuminate: prv — Privacy Violations (Related) - AIUC-1: A003 — Limit AI agent data access (Related, named example) - AIUC-1: A003.1 — Config: Data access scoping (Related, named example) - AIUC-1: A005 — Prevent cross-customer data exposure (Related, named example) - AIUC-1: A005.2 — Config: Customer data isolation controls (Related, named example) - AIUC-1: D003.1 — Config: Tool authorization & validation (Related, named example) - AIUC-1: D004 — Third-party testing of tool calls (Related) - IBM Risk Atlas: atlas-sharing-info-user-agentic — Sharing IP/PI/confidential information with user (Related) - MITRE ATLAS: AML.T0057 — LLM Data Leakage (Related) - MITRE ATLAS: AML.T0085 — Data from AI Services (Related, companion) - OWASP Agentic Security Initiative: ASI06 — Memory & Context Poisoning (Related, named example) - OWASP LLM Top 10 (2024): LLM06 — Sensitive Information Disclosure (Related) - OWASP LLM Top 10 (2025): LLM02 — Sensitive Information Disclosure (Related) - OWASP LLM Top 10 (2025): LLM08 — Vector and Embedding Weaknesses (Related, named example) - OWASP LLM Top 10 (2026): LLM02 — Sensitive Information Disclosure (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM09 — Vector and Embedding Weaknesses (Related, named example) ##### R-2810.003: Disclosure of the Operator's Confidential Information A generated response discloses the operator's confidential information to a recipient who is allowed to receive a response but not that information. The model obtained it from a resource the deployment intentionally made available. **Concern** Permission to use the service does not establish permission to receive every item the model can access. Checks that verify the caller or the answer's accuracy may miss confidential material included in an otherwise valid response. **Cross-references** - AIUC-1: A004 — Protect IP & trade secrets (Related, named example) - AIUC-1: A004.3 — Config: IP detection implementation (Related, named example) - Cisco AI Taxonomy: 15.1.24 — Intellectual Property Compromise: Confidential Data (Subset Of) ; ArXiv: - IBM Risk Atlas: atlas-confidential-data-in-prompt — Confidential data in prompt (Related) - IBM Risk Atlas: atlas-exposing-personal-information — Exposing personal information (Related) - IBM Risk Atlas: atlas-ip-information-in-prompt — IP information in prompt (Related) - IBM Risk Atlas: atlas-personal-information-in-prompt — Personal information in prompt (Related) - IBM Risk Atlas: atlas-revealing-confidential-information — Revealing confidential information (Subset Of) - IBM Risk Atlas: atlas-sharing-info-user-agentic — Sharing IP/PI/confidential information with user (Related) - OWASP LLM Top 10 (2024): LLM06 — Sensitive Information Disclosure (Subset Of) - OWASP LLM Top 10 (2025): LLM02 — Sensitive Information Disclosure (Subset Of) - OWASP LLM Top 10 (2026): LLM02 — Sensitive Information Disclosure (Subset Of, named example) ##### R-2810.004: Sensitive Information Disclosed Through System Actions During task execution, an AI system discloses personal, proprietary, or confidential information to a tool, service, or other agent that is not entitled to receive it in the circumstances of the task. The information may be carried in tool arguments, delegated messages, or task-directed storage writes. It may also be disclosed indirectly when access to the information changes the system’s observable actions in a way that allows the recipient to infer it. **Concern** Filtering the final response or the literal payload of an action may leave other disclosure paths open. A recipient may infer protected information from the system’s choice of action or destination, or from observable timing, even when the information is not copied into a message. Release checks need to consider what each recipient can learn from the action as well as what the action sends. **Cross-references** - AIUC-1: A003 — Limit AI agent data access (Related, named example) - AIUC-1: A003.3 — Config: Agent access and permissions management (Related) - AIUC-1: A006 — Prevent PII leakage (Related, named example) - IBM Risk Atlas: atlas-sharing-info-tools-agentic — Sharing IP/PI/confidential information with tools (Superset Of) - OWASP LLM Top 10 (2026): LLM02 — Sensitive Information Disclosure (Subset Of, named example) #### R-2820: Incidental Capture Arrangements in which data the system handles is written into a place kept for another purpose, where it is retained and readable by parties the data was never shown to. This includes operational logs, traces, error reports, analytics, and the third-party services a deployment sends its telemetry to, as well as addresses that publish a conversation to anyone who finds them. ##### R-2820.001: Sensitive Content Captured in Interaction Records A deployment copies prompts, retrieved context, or model output into retained records whose existing read permissions give access to parties not entitled to the sensitive information being copied. This includes operational logs, traces, error reports, conversation histories, and saved output artifacts. **Concern** Creating or saving a record can expose sensitive content under the record store’s existing permissions. Redaction, restricted reader access, or preservation of the original permissions can prevent that exposure. A user’s request to save a record does not by itself authorize disclosure to everyone who can read the destination. Deleting the original content can leave retained copies unless those copies are included in the deletion process. **Cross-references** - AIUC-1: A006 — Prevent PII leakage (Related, named example) - AIUC-1: A006.1 — Config: PII detection and filtering (Related) - AIUC-1: A008 — Prevent leakage of credentials and secrets (Related, named example) - AIUC-1: A008.5 — Config: Secrets redaction in logs and stored artifacts (Related, named example) - AIUC-1: B007 — Enforce user access privileges to AI systems (Related, named example) - AIUC-1: B007.1 — Config: User access controls (Related, named example) - AIUC-1: E015 — Log AI system activity (Related, named example) - AIUC-1: E015.3 — Config: Log storage (Related, named example) - Cisco AI Taxonomy: 16.1.1 — Logging Sensitive Conversations (Subset Of) ; ArXiv: - IBM Risk Atlas: atlas-confidential-data-in-prompt — Confidential data in prompt (Related) - IBM Risk Atlas: atlas-personal-information-in-prompt — Personal information in prompt (Related) - MITRE ATLAS: AML.T0063 — Discover AI Model Outputs (Related, named example) - OWASP LLM Top 10 (2026): LLM02 — Sensitive Information Disclosure (Subset Of, named example) ##### R-2820.002: Conversation Made Publicly Retrievable A deployment offers a way to share a conversation, and the address it produces is reachable without authentication and not excluded from indexing. Content the participants treated as private becomes retrievable by search. **Concern** A person sharing a conversation with a limited audience may unintentionally make it publicly searchable. Sensitive material can then reach people outside the intended audience, and copies in search caches may persist after the original link is withdrawn. **Cross-references** - OWASP LLM Top 10 (2026): LLM02 — Sensitive Information Disclosure (Subset Of, named example) ##### R-2820.003: Provider Retention of Submitted Content A deployment sends prompts, documents, or retrieved passages to a third-party model service whose terms permit the provider to keep that content and train on it. The content enters a corpus the deployment cannot inspect, correct, or withdraw from. **Concern** Submitted content can be retained or reused under the provider's terms, including material the deployment considers sensitive. The deployment may be unable to verify its removal from the provider's training data or models. Memorized information may later be disclosed through the provider's outputs. **Cross-references** - AIUC-1: A001 — Establish input data policy (Related) - AIUC-1: A004 — Protect IP & trade secrets (Related, named example) - AIUC-1: A004.1 — Documentation: User guidance on confidential information (Related) - AIUC-1: A004.2 — Documentation: foundational model IP protections (Related) - AIUC-1: E006 — Conduct vendor due diligence (Related, named example) - IBM Risk Atlas: atlas-confidential-data-in-prompt — Confidential data in prompt (Related, named example) - IBM Risk Atlas: atlas-personal-information-in-prompt — Personal information in prompt (Related, named example) - OWASP LLM Top 10 (2024): LLM05 — Supply Chain Vulnerabilities (Subset Of, named example) - OWASP LLM Top 10 (2025): LLM03 — Supply Chain (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM04 — Supply Chain (Subset Of) ### R-2900: Failure Modes — Misc Technical failure patterns not yet classified into specific domains. ## 3: Governance Failures Organizational, process, or policy gaps that increase risk. ### R-3100: Regulatory & Legal Failures to meet legal requirements, regulatory obligations, or compliance standards applicable to AI systems. #### R-3110: Data Protection & Privacy Obligations Processing personal or sensitive data in ways the applicable contracts or other data-protection regime do not permit: acting without a lawful basis, retaining beyond permitted periods, omitting required impact assessments, or failing to honor data-subject rights. ##### R-3110.001: Conversation Logging Without a Lawful Basis An operator records personal or sensitive data in user-AI interaction logs without the lawful basis required by the applicable contracts or data-protection regime. **Concern** Establishing the required basis before recording, or stopping the recording when no basis is available, addresses this failure. Deleting logs promptly or protecting them against unauthorized access does not authorize their collection. **Cross-references** - AIUC-1: A001 — Establish input data policy (Related, named example) - AIUC-1: A002 — Establish output data policy (Related, named example) - AIUC-1: A006 — Prevent PII leakage (Related, named example) - AIUC-1: B005 — Implement real-time input filtering (Related) - AIUC-1: B005.4 — Logs: Input filtering (Related) - AIUC-1: E012 — Document regulatory compliance (Related) - AIUC-1: E012.1 — Documentation: Regulatory compliance reviews (Related) - AIUC-1: E015 — Log AI system activity (Related) - Cisco AI Taxonomy: 16.1.1 — Logging Sensitive Conversations (Subset Of) ; ArXiv: ##### R-3110.002: Unfulfillable Erasure Request Failing to fulfill a required erasure request because personal data remains recoverable from a model trained or tuned on the affected records. **Concern** Source-record deletion can appear to complete the request even when the model still exposes the personal data. Addressing the remaining exposure may require changes to the model and additional cost. Completion needs to account for that exposure as well as the source records. **Cross-references** - AIUC-1: E012 — Document regulatory compliance (Related) - AIUC-1: E012.1 — Documentation: Regulatory compliance reviews (Related) - IBM Risk Atlas: atlas-data-privacy-rights — Data privacy rights alignment (Subset Of, named example) - OWASP LLM Top 10 (2026): LLM02 — Sensitive Information Disclosure (Subset Of) ##### R-3110.003: Obstructed Initiation of Erasure Requests Operating an AI system with information or request-handling barriers that prevent people from establishing use of their personal data and initiating an erasure procedure to which they are entitled. **Concern** People may be unable to exercise an erasure right when they cannot establish whether their data was used or reach a usable request process. A workable intake route is distinct from the technical ability to erase learned information. **Cross-references** - AIUC-1: A001 — Establish input data policy (Related, named example) - AIUC-1: A001.3 — Documentation: Data subject right processes (Related) - AIUC-1: A002 — Establish output data policy (Related, named example) - AIUC-1: E012 — Document regulatory compliance (Related) - AIUC-1: E012.1 — Documentation: Regulatory compliance reviews (Related) - IBM Risk Atlas: atlas-data-privacy-rights — Data privacy rights alignment (Subset Of, named example) ##### R-3110.004: Interaction Data Retained Beyond Permitted Periods An operator retains personal or sensitive data from user-AI interactions beyond the period permitted by the applicable contracts or data-protection regime, including after a valid erasure obligation requires deletion. This includes retained inputs, outputs, conversation histories, and operational logs. **Concern** Enforcing the applicable retention period and deleting expired copies addresses this failure. A lawful basis for collection and effective access safeguards do not permit indefinite retention. This concerns stored interaction data, not personal information recoverable from trained model parameters. **Cross-references** - AIUC-1: A001 — Establish input data policy (Related, named example) - AIUC-1: A001.1 — Documentation: Policy for input data ownership, usage and retention (Related) - AIUC-1: A001.2 — Config: Data retention implementation (Related, named example) - AIUC-1: A002 — Establish output data policy (Related, named example) - AIUC-1: A002.2 — Config: Opt-in/opt-out and output deletion implementation (Related) - AIUC-1: B005 — Implement real-time input filtering (Related) - AIUC-1: B005.4 — Logs: Input filtering (Related) - AIUC-1: E012 — Document regulatory compliance (Related) - AIUC-1: E012.1 — Documentation: Regulatory compliance reviews (Related) - AIUC-1: E015 — Log AI system activity (Related, named example) - AIUC-1: E015.3 — Config: Log storage (Related, named example) - Cisco AI Taxonomy: 16.1.1 — Logging Sensitive Conversations (Subset Of) ; ArXiv: - IBM Risk Atlas: atlas-data-privacy-rights — Data privacy rights alignment (Related, named example) ##### R-3110.005: Conversation Logs Held Without Required Safeguards An operator holds personal or sensitive user-AI interaction logs without the protective handling required for that category of data by the applicable contracts or data-protection regime. **Concern** Apply the required protection to the held information, such as removing identifying detail or restricting access as the governing obligation requires. Permission to collect and timely deletion do not establish protection while logs are held. This records the operator’s safeguard obligation; technical capture of sensitive content is assessed separately. **Cross-references** - AIUC-1: A006 — Prevent PII leakage (Related, named example) - AIUC-1: A006.1 — Config: PII detection and filtering (Related) - AIUC-1: B005 — Implement real-time input filtering (Related) - AIUC-1: B005.4 — Logs: Input filtering (Related) - AIUC-1: B007 — Enforce user access privileges to AI systems (Related, named example) - AIUC-1: B007.1 — Config: User access controls (Related, named example) - AIUC-1: B007.2 — Documentation: Access reviews (Related, named example) - AIUC-1: E005 — Document data storage security (Related, named example) - AIUC-1: E005.1 — Documentation: Data storage security practices (Related, named example) - AIUC-1: E012 — Document regulatory compliance (Related) - AIUC-1: E012.1 — Documentation: Regulatory compliance reviews (Related) - AIUC-1: E015 — Log AI system activity (Related, named example) - AIUC-1: E015.3 — Config: Log storage (Related, named example) - Cisco AI Taxonomy: 16.1.1 — Logging Sensitive Conversations (Subset Of) ; ArXiv: ##### R-3110.006: Training on Personal Data Beyond Permitted Use An operator uses personal data, including sensitive information about individuals, to train or fine-tune an AI model in a way the applicable contracts or other data-protection regime do not permit. **Concern** Permission to receive or process personal data for one purpose does not establish permission to train on it. The training operation can breach the governing terms even when the model does not disclose the data. Check permitted training uses before admitting data to training or fine-tuning. R-3180.001 concerns rights in protected works and non-personal data; one operation can breach both obligations. **Cross-references** - AIUC-1: A001.1 — Documentation: Policy for input data ownership, usage and retention (Related) - AIUC-1: A005 — Prevent cross-customer data exposure (Related, named example) - AIUC-1: A005.1 — Documentation: Consent for combined data usage (Related) - NIST AI RMF: nist-data-privacy — Data Privacy (Subset Of) ##### R-3110.007: Inference on Personal Data Beyond Permitted Use An operator uses personal data, including sensitive information about individuals, as input to an AI model for inference in a way the applicable contracts or other data-protection regime do not permit. **Concern** Permission to collect, store, or use personal data for training does not by itself establish permission for the proposed inference purpose. Check the permitted purpose and conditions before submitting the data for inference, and prevent uses outside them. This concerns personal-data processing duties, which are distinct from rights in protected works and non-personal data. **Cross-references** - AIUC-1: A001 — Establish input data policy (Related) - AIUC-1: A001.1 — Documentation: Policy for input data ownership, usage and retention (Related) - AIUC-1: A005 — Prevent cross-customer data exposure (Related, named example) - AIUC-1: A005.1 — Documentation: Consent for combined data usage (Related) - NIST AI RMF: nist-data-privacy — Data Privacy (Subset Of) ##### R-3110.008: Incomplete Erasure of Stored Embeddings Failing to fulfill a required erasure request because personal data remains recoverable from stored embeddings derived from the affected records and held outside model parameters. **Concern** Deleting source records does not remove embeddings stored separately from them. Completing a required erasure also requires removing or rebuilding the affected embeddings. Checking that personal data is no longer recoverable supports that completion. This differs from removing information learned into model parameters. Embeddings derived from interaction data can also fall within R-3110.004; this risk identifies the separately stored representation and applies regardless of the source records’ origin. Retention alone does not establish a breach without an applicable erasure duty. **Cross-references** - OWASP LLM Top 10 (2026): LLM02 — Sensitive Information Disclosure (Subset Of) #### R-3120: Cross-Border Transfer Obligations Moving personal or regulated data across jurisdictions without the transfer mechanism the receiving jurisdiction requires, such as executed contractual clauses or a recognized adequacy finding. #### R-3130: Pre-Market & Conformity Obligations Placing a system into service without the conformity assessment, registration, or technical documentation its risk classification requires. #### R-3140: Transparency & Disclosure Obligations Presenting AI-generated content or providing AI-mediated interactions or actions without the disclosure, labeling, or provenance marking that is required by the applicable regulatory regime or adopted internal controls. ##### R-3140.001: Required AI Disclosure Omitted An organization presents AI-generated content or provides AI-mediated interactions or actions without the disclosure, labeling, or provenance marking that is required by the applicable regulatory regime or adopted internal controls. **Concern** A recipient may recognize that AI is involved while the organization still omits a required disclosure or marking, provides it too late, or uses a form that does not meet the applicable obligation. Identify the regulatory requirement or adopted internal control, its audience, and the required form and timing. An adopted control is an established requirement applicable to the deployment, not merely a preferred practice. Disclosing AI involvement does not by itself establish factual accuracy, human approval, consent, or a means of overriding the system. **Cross-references** - AIUC-1: E016 — Implement AI disclosure mechanisms (Related, named example) - AIUC-1: E016.1 — Demonstration: Text AI disclosure (Related, named example) - AIUC-1: E016.2 — Demonstration: Voice AI disclosure (Related) - AIUC-1: E016.3 — Demonstration: Labelling AI-generated content (Related, named example) - AIUC-1: E016.4 — Demonstration: Automation AI disclosure (Related, named example) - AIUC-1: E016.5 — Demonstration: System response to AI inquiry (Related, named example) - IBM Risk Atlas: atlas-non-disclosure — Non-disclosure (Related, named example) #### R-3150: Prohibited Practice Deployment Deploying a use the applicable regime forbids outright, such as social scoring, emotion inference in workplace or education settings, or untargeted collection of biometric data. ##### R-3150.001: Deployment of Prohibited Manipulative Practice Placing into service a system that uses subliminal, purposefully manipulative, or deceptive techniques, or that exploits the vulnerabilities of a person or group, where the applicable regime forbids that practice outright. **Concern** Prohibitions of this kind bind the operator regardless of intent to harm or of any consent obtained, and attach at the point the system is placed into service. Enforcement reaches the deploying organization rather than any individual user. **Related risks** - Causes: R-4720.002: Loss of Agency and Control. Deploying a prohibited manipulative practice contributes to loss of agency and control. #### R-3160: Sectoral & Licensure Obligations Operating in a regulated sector without the license, qualified oversight, or sector-specific safeguards that sector's regime requires of the activity being performed. ##### R-3160.001: Practice Without Sectoral License An organization performs an activity without holding the license required for that activity in the applicable jurisdiction. **Concern** Technical safeguards do not establish the organization's authority to perform a licensed activity. It may operate without the required authorization even when its system produces accurate output and includes professional review. **Cross-references** - AIUC-1: E012 — Document regulatory compliance (Related) - AIUC-1: E012.1 — Documentation: Regulatory compliance reviews (Related) ##### R-3160.002: Absent Qualified Oversight An organization operates an AI system performing a regulated activity without retaining a qualified professional to supervise or approve its output where the applicable rules require that oversight. **Concern** A review step cannot provide the required oversight unless a qualified professional is available to carry it out. Without that staffing, outputs may be approved by unqualified people or delivered without the review the organization is required to provide. **Cross-references** - AIUC-1: E012 — Document regulatory compliance (Related) - AIUC-1: E012.1 — Documentation: Regulatory compliance reviews (Related) #### R-3170: Duty of Care & Liability Exposure Deploying or operating a system without establishing and evidencing the standard of care a reasonable operator in that setting would apply. #### R-3180: Contractual, Licence & Export Obligations Using data, models, or services in ways their governing agreements or trade controls do not permit, including licence terms, vendor agreements, and export restrictions on model artifacts. ##### R-3180.001: Unlicensed Use of Protected Training Data An organization trains or tunes a model on protected works or non-personal data without the licence, permission, or statutory basis required for that use. **Concern** Rights clearance is a procurement and licensing decision made before training begins, and the exposure persists in every model built from that corpus. Operators carry the resulting legal liability. This risk concerns rights to use protected works and restrictions on using non-personal data. Restrictions governing the processing of personal data belong in R-3110.006. The same training operation can breach both obligations. **Cross-references** - AIUC-1: A001.1 — Documentation: Policy for input data ownership, usage and retention (Related) - AIUC-1: A005 — Prevent cross-customer data exposure (Related, named example) - AIUC-1: A005.1 — Documentation: Consent for combined data usage (Related) - IBM Risk Atlas: atlas-data-usage-rights — Data usage rights restrictions (Superset Of, named example) - NIST AI RMF: nist-intellectual-property — Intellectual Property (Related) - NIST AI RMF: nist-value-chain-and-component-integration — Value Chain and Component Integration (Related) - OWASP LLM Top 10 (2025): LLM03 — Supply Chain (Related) - OWASP LLM Top 10 (2026): LLM04 — Supply Chain (Related) **Related risks** - Causes: R-4230.001: Uncompensated Use of Creative Work. Training on works without licence is the conduct by which creators go uncompensated. ##### R-3180.002: Unlicensed Use of Protected Augmentation Content An organization uses protected works or non-personal data to augment a model’s context at runtime without the licence, permission, or statutory basis required for that use. **Concern** Access to data does not establish permission to use it in a model’s runtime context. The organization can exceed the rights it holds even when access controls function correctly. Rights clearance and removal or restriction of affected context data address this use. **Cross-references** - AIUC-1: A001 — Establish input data policy (Related) - AIUC-1: A001.1 — Documentation: Policy for input data ownership, usage and retention (Related) - AIUC-1: A005 — Prevent cross-customer data exposure (Related, named example) - AIUC-1: A005.1 — Documentation: Consent for combined data usage (Related) - OWASP LLM Top 10 (2025): LLM03 — Supply Chain (Related) - OWASP LLM Top 10 (2025): LLM08 — Vector and Embedding Weaknesses (Subset Of) - OWASP LLM Top 10 (2026): LLM04 — Supply Chain (Related) ##### R-3180.003: Use of AI Outputs Beyond Permitted Terms An organization uses, modifies, or redistributes AI-generated outputs in a way the governing agreements or licences do not permit. **Concern** Ownership of an output does not remove applicable restrictions on its use. Establish the permitted uses before the output is modified, released, or put into service, and enforce those restrictions at that step. Use of outputs as training data or runtime context is assessed under the risks for those operations. **Cross-references** - AIUC-1: A002 — Establish output data policy (Related, named example) - AIUC-1: A002.1 — Documentation: Output usage and ownership policy (Related) ##### R-3180.004: Use of AI Models Beyond Permitted Terms An organization deploys, adapts, or operates an AI model without the required permission, or in a way its governing licence, agreement, or acceptable-use terms do not permit. **Concern** Access to a model does not establish permission for its intended use. Check the terms for the model and service against the actual deployment, adaptation, and operation. Permission to use training data or generated outputs does not establish permission to use the model itself. **Cross-references** - IBM Risk Atlas: atlas-model-usage-rights — Model usage rights restrictions (Related) - NIST AI RMF: nist-value-chain-and-component-integration — Value Chain and Component Integration (Related) #### R-3190: Affected-Party Participation Obligations Planning, introducing or changing an AI system without providing affected people or their representatives the participation required by applicable law. This includes required consultation and joint decision-making procedures. ##### R-3190.001: Required Consultation on AI Use Omitted An organization plans, introduces or changes an AI system without informing and consulting affected people or their representatives as required by applicable law, early enough for their views to be considered before the relevant decision is made. **Concern** Notice after a decision is made cannot replace consultation required during planning. Missing that consultation prevents affected people or their representatives from exercising their participation rights before the AI use is settled. **Cross-references** - IBM Risk Atlas: atlas-impact-on-affected-communities — Impact on affected communities (Related) ### R-3200: Accountability & Oversight Developing or operating AI systems without an identified accountable party, without providing overseeing or accountable parties the authority and information needed for effective oversight, or without affected-party input needed to inform decisions about the system. #### R-3210: Governance Gaps Developing or operating an AI system without assigning or carrying out the duties that keep it accountable. This includes obtaining and considering affected-party input needed to inform design, the decision to deploy and keep operating, the authority to stop it, and the disclosure that lets others oversee it. The obligation is the organization's own, whatever a regulator separately requires. ##### R-3210.001: Undisclosed System Documentation The operator holds the information needed to understand the system, including what it was trained on, what it is built from, and where its reliable performance ends, and does not publish it. Those overseeing the deployment rely on the operator's description of the system instead. **Concern** Oversight of a deployment depends on knowing what it is. Where those facts stay internal, regulators, auditors, customers and affected parties assess the system on the operator's characterization of it, and any gap between that characterization and the system's actual behavior surfaces only once the behavior has caused something. The same absence blocks the later question of who is answerable for a given outcome. **Cross-references** - AIUC-1: E005 — Document data storage security (Related, named example) - AIUC-1: E005.1 — Documentation: Data storage security practices (Related, named example) - AIUC-1: E011 — Record processing locations (Related, named example) - AIUC-1: E017 — Document system transparency policy (Related, named example) - AIUC-1: E017.2 — Documentation: Transparency report sharing policy (Related, named example) - IBM Risk Atlas: atlas-data-transparency — Lack of training data transparency (Related, named example) - IBM Risk Atlas: atlas-lack-of-ai-agent-transparency-agentic — Lack of AI agent transparency (Related) - IBM Risk Atlas: atlas-lack-of-data-transparency — Lack of data transparency (Related) - IBM Risk Atlas: atlas-lack-of-model-transparency — Lack of model transparency (Related, named example) - NIST AI RMF: nist-data-privacy — Data Privacy (Related, named example) ##### R-3210.002: Unassigned Responsibility for AI System Actions Operating an AI system without identifying the parties responsible for its decisions and actions. This includes actions performed through connected tools, services, or other agents. **Concern** When a system causes harm or acts unexpectedly, an organization may be unable to identify who must investigate, correct the problem or answer for the decision. Records of what happened do not by themselves assign that responsibility. **Cross-references** - IBM Risk Atlas: atlas-accountability-agentic — Accountability of AI agent actions (Related) - IBM Risk Atlas: atlas-legal-accountability — Legal accountability (Subset Of, named example) - NIST AI RMF: nist-value-chain-and-component-integration — Value Chain and Component Integration (Related) ##### R-3210.003: Deployment Without Accountable Approval Deploying an AI system, or a change to it that can affect its risk profile, without a documented approval from a person who is accountable for the decision. **Concern** If a deployment causes harm, the organization cannot identify who decided to deploy it or who has the authority to reverse that decision. A review of the system does not identify this person. A record of the deployment does not identify this person. **Cross-references** - AIUC-1: B004.4 — Documentation: Vulnerability remediation (Related) - AIUC-1: C002 — Conduct pre-deployment testing (Related, named example) - AIUC-1: C002.1 — Documentation: Pre-deployment test and approval records (Related, named example) - AIUC-1: E004 — Assign accountability (Related, named example) - AIUC-1: E004.1 — Documentation: Change approval policy and records (Related) - AIUC-1: E006 — Conduct vendor due diligence (Related, named example) - AIUC-1: E013 — Implement quality management system (Related, named example) - AIUC-1: E013.2 — Documentation: Change management procedures (Related, named example) ##### R-3210.004: Affected-Community Input Omitted from AI Design Designing or building an AI system without obtaining and considering affected-community perspectives needed to understand the context and effects of its intended use. **Concern** Affected people can identify conditions and consequences that developers, operators and domain experts do not know. If their perspectives are missing, design decisions can overlook those conditions even when the system has a clear purpose, qualified evaluators and an accountable owner. **Cross-references** - IBM Risk Atlas: atlas-exclusion — Exclusion (Related) - IBM Risk Atlas: atlas-impact-on-affected-communities — Impact on affected communities (Equivalent) ### R-3300: Lifecycle & Operations Developing or operating an AI system without overseeing the preparation of data for its training, tuning, evaluation, or inference, reviewing changes made to it, recording how it was built and what it does, preserving its earlier states, or responding when it goes wrong. #### R-3310: Change Management Deploying or changing an AI system without a review that establishes what the system or the change does, or deploying a change that can affect its risk profile without a test or a rollback procedure. This includes the model, its prompts, tools, integrations and settings, as well as the guardrails and controls around them. It also includes failing to maintain, patch or update the system over time, including when a third party changes a dependency or component, such as a model provider that ships a new version behind the same endpoint. ##### R-3310.001: Maintenance and Update Gaps Failure to maintain, patch, and update AI systems over time, allowing known vulnerabilities, degraded performance, or policy drift to persist. **Concern** Without structured update governance, models can accumulate known flaws, outdated safeguards, and untracked changes that create compliance, safety, and security gaps. **Cross-references** - AIUC-1: B001 — Third-party testing of adversarial robustness (Related, named example) - AIUC-1: B002 — Detect adversarial input (Related, named example) - AIUC-1: B004 — Prevent AI endpoint scraping (Related, named example) - AIUC-1: B005 — Implement real-time input filtering (Related, named example) - AIUC-1: B005.5 — Documentation: Input filter performance (Related) - AIUC-1: B008 — Protect AI system deployment environment (Related, named example) - AIUC-1: B008.4 — Config: Model hosting security (Related, named example) - AIUC-1: C004 — Prevent out-of-scope outputs (Related, named example) - AIUC-1: C004.2 — Logs: Out-of-scope attempts (Related, named example) - AIUC-1: C009 — Enable real-time feedback and intervention (Related, named example) - AIUC-1: C009.2 — Documentation: User feedback & intervention reviews (Related, named example) - AIUC-1: C010 — Third-party testing for harmful outputs (Related) - AIUC-1: C010.1 — Report: Harmful output testing (Related) - AIUC-1: C011 — Third-party testing for out-of-scope outputs (Related) - AIUC-1: C011.1 — Report: Out-of-scope output testing (Related) - AIUC-1: C012 — Third-party testing for customer-defined risk (Related) - AIUC-1: C012.1 — Third-party evaluation report assessing customer-defined risk (Related) - AIUC-1: D002 — Third-party testing for hallucinations (Related) - AIUC-1: D003 — Restrict unsafe tool calls (Related, named example) - AIUC-1: D004 — Third-party testing of tool calls (Related) - AIUC-1: E001 — AI failure plan for security breaches (Related, named example) - AIUC-1: E008 — Review internal processes (Related, named example) - AIUC-1: E010 — Establish AI acceptable use policy (Related, named example) - AIUC-1: E010.4 — Documentation: Guardrails enforcing acceptable use (Related, named example) - AIUC-1: E013 — Implement quality management system (Related, named example) - AIUC-1: E013.3 — Config: Issue tracking and monitoring (Related, named example) - IBM Risk Atlas: atlas-mitigation-maintenance-agentic — Mitigation and maintenance (Related, companion) - IBM Risk Atlas: atlas-reproducibility-agentic — Reproducibility (Related, companion) - OWASP LLM Top 10 (2024): LLM05 — Supply Chain Vulnerabilities (Related) - OWASP LLM Top 10 (2025): LLM03 — Supply Chain (Related) - OWASP LLM Top 10 (2026): LLM04 — Supply Chain (Related) ##### R-3310.002: Deployment or Change Without Review Deploying an AI system for the first time, or deploying a change to it, without a review that establishes what the system or the change does. This includes new integrations, model updates, prompt updates, tool additions, and configuration changes. **Concern** If nobody reviews a deployment, the risk assessment does not describe the system that operates. Each change that nobody reviews makes this difference larger. The review occurs outside the system, so the system cannot show that a review did not occur. **Cross-references** - AIUC-1: C002 — Conduct pre-deployment testing (Related, named example) - AIUC-1: C002.1 — Documentation: Pre-deployment test and approval records (Related, named example) - AIUC-1: C002.2 — Config: SDLC integration (Related, named example) - AIUC-1: E004 — Assign accountability (Related) - AIUC-1: E004.1 — Documentation: Change approval policy and records (Related) - AIUC-1: E006 — Conduct vendor due diligence (Related, named example) - AIUC-1: E008 — Review internal processes (Related) - AIUC-1: E013 — Implement quality management system (Related, named example) - AIUC-1: E013.2 — Documentation: Change management procedures (Related, named example) - IBM Risk Atlas: atlas-reproducibility-agentic — Reproducibility (Related, companion) - MITRE ATLAS: AML.T0109 — AI Supply Chain Rug Pull (Related) - MITRE ATLAS: AML.T0111 — AI Supply Chain Reputation Inflation (Related) - NIST AI RMF: nist-value-chain-and-component-integration — Value Chain and Component Integration (Related) - OWASP Agentic Security Initiative: ASI08 — Cascading Failures (Related, named example) - OWASP LLM Top 10 (2026): LLM04 — Supply Chain (Related, companion) ##### R-3310.003: Deployment Not Verified Against Approval An organization deploys or continues to operate an AI system without establishing that its deployed components and configuration correspond to what was reviewed and approved for use. **Concern** A review and approval can describe a different system from the one operating. Without comparing deployed components and configuration with the approved state, the organization cannot establish that its authorization applies to the live deployment. The comparison is needed even when no discrepancy has yet been found. **Cross-references** - AIUC-1: E004 — Assign accountability (Related) #### R-3320: Monitoring Gaps Running an AI system without recording the activity needed to detect misuse and reconstruct what happened. This includes model calls, tool calls, policy decisions, and operator actions. This also includes records with a retention time that is too short to be useful, and records that no detection rule or review examines. ##### R-3320.001: Inadequate Model Activity Logging Missing, incomplete, or poorly retained logging and telemetry for model interactions, tool calls, policy outcomes, and operator actions needed to detect misuse, investigate incidents, and validate control effectiveness. **Concern** Without reliable activity logs, organizations cannot reconstruct harmful events, verify safeguards, or respond quickly to misuse, increasing operational, legal, and safety exposure. **Cross-references** - AIUC-1: A004 — Protect IP & trade secrets (Related, named example) - AIUC-1: A004.4 — Config: IP disclosure monitoring (Related, named example) - AIUC-1: B002 — Detect adversarial input (Related, named example) - AIUC-1: B002.2 — Logs: Adversarial incident and response (Related, named example) - AIUC-1: B005 — Implement real-time input filtering (Related) - AIUC-1: B005.4 — Logs: Input filtering (Related) - AIUC-1: B006 — Prevent unauthorized AI agent actions (Related, named example) - AIUC-1: B006.2 — Config: Agent security monitoring and alerting (Related, named example) - AIUC-1: C004 — Prevent out-of-scope outputs (Related, named example) - AIUC-1: C004.2 — Logs: Out-of-scope attempts (Related, named example) - AIUC-1: C005 — Prevent agent-specific high risk outputs (Related, named example) - AIUC-1: C007 — Flag high risk outputs for human review (Related, named example) - AIUC-1: C007.3 — Documentation: Human review workflows (Related, named example) - AIUC-1: C008 — Monitor AI risk categories (Related, named example) - AIUC-1: C008.1 — Logs: AI risk monitoring (Related, named example) - AIUC-1: C008.3 — Config: Security tooling (Related, named example) - AIUC-1: D003 — Restrict unsafe tool calls (Related, named example) - AIUC-1: D003.3 — Config: Tool call log (Related, named example) - AIUC-1: E001 — AI failure plan for security breaches (Related, named example) - AIUC-1: E009 — Monitor third-party access (Related, named example) - AIUC-1: E009.1 — Config: Third-party access monitoring (Related, named example) - AIUC-1: E010 — Establish AI acceptable use policy (Related, named example) - AIUC-1: E010.4 — Documentation: Guardrails enforcing acceptable use (Related, named example) - AIUC-1: E013 — Implement quality management system (Related, named example) - AIUC-1: E013.3 — Config: Issue tracking and monitoring (Related, named example) - AIUC-1: E015 — Log AI system activity (Related, named example) - AIUC-1: E015.1 — Config: Logging implementation (Related, named example) - AIUC-1: E015.2 — Config: AI agent logging implementation (Related, named example) - AIUC-1: E015.3 — Config: Log storage (Related, named example) - AIUC-1: E015.4 — Config: Log integrity protection (Related, named example) - AIUC-1: F002 — Prevent catastrophic misuse (Related, named example) - AIUC-1: F002.2 — Config: Catastrophic misuse monitoring (Related, named example) - IBM Risk Atlas: atlas-accountability-agentic — Accountability of AI agent actions (Related) - OWASP LLM Top 10 (2025): LLM05 — Improper Output Handling (Related, companion) - OWASP LLM Top 10 (2026): LLM10 — Improper Output Handling (Related, companion) ##### R-3320.002: Activity Records Without Detection or Review Recording the model interactions, tool calls, and access events of an AI system without detection rules, alerts, or review of the records. This includes records that a person examines only after an incident report. **Concern** The records show misuse and boundary violations. If no person or tool examines the records, these events stay unknown until after an incident. Detection rules, alerts, and regular review find these events while they occur. **Cross-references** - AIUC-1: A004.4 — Config: IP disclosure monitoring (Related, named example) - AIUC-1: B002.1 — Config: Adversarial input detection and alerting (Related, named example) - AIUC-1: B002.4 — Config: Pre-processing adversarial detection (Related, named example) - AIUC-1: B002.5 — Config: AI security alerts (Related, named example) - AIUC-1: B004.1 — Config: Anomalous usage detection (Related, named example) - AIUC-1: B006 — Prevent unauthorized AI agent actions (Related, named example) - AIUC-1: B006.2 — Config: Agent security monitoring and alerting (Related, named example) - AIUC-1: C008 — Monitor AI risk categories (Related, named example) - AIUC-1: C008.1 — Logs: AI risk monitoring (Related, named example) - AIUC-1: C008.3 — Config: Security tooling (Related, named example) - AIUC-1: D003.3 — Config: Tool call log (Related, named example) - AIUC-1: E009 — Monitor third-party access (Related, named example) - AIUC-1: E009.2 — Config: Anomalous third-party access alerting (Related, named example) - AIUC-1: E010 — Establish AI acceptable use policy (Related, named example) - AIUC-1: E010.2 — Config: AUP violation detection (Related, named example) - AIUC-1: E010.4 — Documentation: Guardrails enforcing acceptable use (Related, named example) - AIUC-1: E013 — Implement quality management system (Related, named example) - AIUC-1: E013.3 — Config: Issue tracking and monitoring (Related, named example) - AIUC-1: F002 — Prevent catastrophic misuse (Related, named example) - AIUC-1: F002.2 — Config: Catastrophic misuse monitoring (Related, named example) - OWASP LLM Top 10 (2025): LLM05 — Improper Output Handling (Related, companion) - OWASP LLM Top 10 (2026): LLM10 — Improper Output Handling (Related, companion) #### R-3330: Incident Response Running an AI system without a tested plan for responding when it causes harm or is compromised, covering who is notified, what is suspended, how affected parties are informed, and how output already released is corrected. This includes plans that exist on paper but have never been exercised. This also includes understating the impact of exposed AI artifacts by failing to account for sensitive or restricted information that can be recovered or inferred from them. ##### R-3330.001: Security Incident Response Planning Gap Missing, incomplete, or untested plans for detecting, containing, and recovering from AI-related security incidents such as prompt-injection-driven compromise, unauthorized tool execution, or data exfiltration. **Concern** Without a defined response playbook, teams respond slowly and inconsistently to active compromise, increasing the blast radius, downtime, and likelihood of repeated incidents. **Cross-references** - AIUC-1: B002 — Detect adversarial input (Related, named example) - AIUC-1: B002.2 — Logs: Adversarial incident and response (Related, named example) - AIUC-1: E001 — AI failure plan for security breaches (Related, named example) - AIUC-1: E001.1 — Documentation: AI failure plan for security breaches (Related) - AIUC-1: E010 — Establish AI acceptable use policy (Related, named example) - AIUC-1: E013 — Implement quality management system (Related, named example) - AIUC-1: E013.5 — Documentation: Stakeholder communication procedures (Related, named example) - OWASP LLM Top 10 (2026): LLM09 — Vector and Embedding Weaknesses (Related, companion) ##### R-3330.002: Harmful Output Incident Response Planning Gap Missing or untested plans for escalation, containment, and remediation when AI systems produce harmful outputs, including unsafe recommendations, abusive content, or policy-violating responses. **Concern** Organizations lacking response procedures can continue serving harmful outputs after detection, exposing users and operators to preventable safety, legal, and reputational harm. **Cross-references** - AIUC-1: C005 — Prevent agent-specific high risk outputs (Related, named example) - AIUC-1: C005.2 — Documentation: Human review workflows (Related, named example) - AIUC-1: C007 — Flag high risk outputs for human review (Related, named example) - AIUC-1: C007.3 — Documentation: Human review workflows (Related, named example) - AIUC-1: E002 — AI failure plan for harmful outputs (Related, named example) - AIUC-1: E002.1 — Documentation: AI failure plan for harmful outputs (Related) - AIUC-1: E002.2 — Documentation: Additional harmful output failure procedures (Related, named example) - AIUC-1: E013 — Implement quality management system (Related, named example) - AIUC-1: E013.5 — Documentation: Stakeholder communication procedures (Related, named example) ##### R-3330.003: Hallucination Incident Response Planning Gap Missing, incomplete, or untested procedures for triaging and correcting high-impact hallucination incidents, including rollback, user notification, and corrective controls for repeated factual failures. **Concern** High-confidence hallucinations in production can propagate decisions or content quickly; without response plans, organizations may fail to contain misinformation and repeat the same errors. **Cross-references** - AIUC-1: E002 — AI failure plan for harmful outputs (Related) - AIUC-1: E003 — AI failure plan for hallucinations (Related, named example) - AIUC-1: E003.1 — Documentation: AI failure plan for hallucinations (Related) - AIUC-1: E003.2 — Documentation: Additional hallucination failure procedures (Related, named example) - AIUC-1: E013 — Implement quality management system (Related, named example) - AIUC-1: E013.5 — Documentation: Stakeholder communication procedures (Related, named example) ##### R-3330.004: Underassessment of Information Exposure from AI Artifacts An operator understates the impact of an exposure involving AI artifacts because the assessment does not account for sensitive or restricted information that can be recovered or inferred from them. This includes information retained in model parameters, embeddings, and stored model or agent state. **Concern** Information need not be directly readable to be exposed. Incident assessment must consider what an exposed artifact allows a recipient to reconstruct or infer, including with other available information. Underestimating that exposure can lead to inadequate containment, notification, or remediation. **Cross-references** - OWASP LLM Top 10 (2026): LLM02 — Sensitive Information Disclosure (Related, named example) - OWASP LLM Top 10 (2026): LLM09 — Vector and Embedding Weaknesses (Related, named example) #### R-3340: Business Record Preservation Developing, deploying, or operating an AI system without making and keeping contemporaneous records of how it was built, configured, and assessed. This includes data preparation and model-development steps, components, configurations, policies in force, and risk assessments and evaluations. It also includes records assembled after the fact or not tied to the relevant system or data version. ##### R-3340.001: Unrecorded Deployment State A version of an AI system enters service without a captured record of what it consisted of. This includes its components, its configuration, the policies in force, and the assessment made before release. **Concern** Questions about an automated decision arrive after the system has changed. Without a record tied to the version in service at the time, the organization cannot show what the system was, which policies applied, or what it had assessed. **Cross-references** - AIUC-1: C002 — Conduct pre-deployment testing (Related, named example) - AIUC-1: C002.1 — Documentation: Pre-deployment test and approval records (Related, named example) - AIUC-1: E004 — Assign accountability (Related) - AIUC-1: E006 — Conduct vendor due diligence (Related) - AIUC-1: E008 — Review internal processes (Related, named example) - AIUC-1: E011 — Record processing locations (Related, named example) - AIUC-1: E011.1 — Documentation: AI processing locations (Related) - AIUC-1: E013 — Implement quality management system (Related, named example) - AIUC-1: E013.4 — Documentation: Data management procedures (Related, named example) - AIUC-1: E017 — Document system transparency policy (Related, named example) - AIUC-1: E017.1 — Documentation: AI system transparency documentation (Related, named example) - IBM Risk Atlas: atlas-lack-of-ai-agent-transparency-agentic — Lack of AI agent transparency (Related) - IBM Risk Atlas: atlas-lack-of-system-transparency — Lack of system transparency (Related) - IBM Risk Atlas: atlas-reproducibility-agentic — Reproducibility (Related, companion) ##### R-3340.002: Missing AI Development and Assessment Records An AI system is developed or deployed without records of the design decisions, development steps, and assessments used to establish its behavior and suitability for use. The records are missing, incomplete, or cannot be tied to the system version they describe. **Concern** Without these records, reviewers cannot establish why a design was chosen, how it was developed and assessed, or whether that evidence supports the version being used. A deployment snapshot can identify the running components while leaving those questions unanswered. **Cross-references** - AIUC-1: B001 — Third-party testing of adversarial robustness (Related, named example) - AIUC-1: B001.1 — Report: adversarial testing results (Related) - AIUC-1: B002.3 — Documentation: Updates to detection config (Related, named example) - AIUC-1: B004.3 — Report: External pentest of AI endpoints (Related, named example) - AIUC-1: B004.4 — Documentation: Vulnerability remediation (Related) - AIUC-1: B005 — Implement real-time input filtering (Related, named example) - AIUC-1: B005.2 — Documentation: Input moderation approach (Related) - AIUC-1: B005.5 — Documentation: Input filter performance (Related) - AIUC-1: B007 — Enforce user access privileges to AI systems (Related, named example) - AIUC-1: B007.2 — Documentation: Access reviews (Related, named example) - AIUC-1: C002 — Conduct pre-deployment testing (Related, named example) - AIUC-1: C002.1 — Documentation: Pre-deployment test and approval records (Related, named example) - AIUC-1: C002.3 — Documentation: Vulnerability scan results (Related, named example) - AIUC-1: C003.4 — Documentation: Filtering performance benchmarks (Related, named example) - AIUC-1: C008 — Monitor AI risk categories (Related, named example) - AIUC-1: C008.2 — Documentation: Monitoring findings (Related, named example) - AIUC-1: C009.2 — Documentation: User feedback & intervention reviews (Related, named example) - AIUC-1: C010 — Third-party testing for harmful outputs (Related) - AIUC-1: C010.1 — Report: Harmful output testing (Related) - AIUC-1: C011 — Third-party testing for out-of-scope outputs (Related) - AIUC-1: C011.1 — Report: Out-of-scope output testing (Related) - AIUC-1: C012 — Third-party testing for customer-defined risk (Related) - AIUC-1: C012.1 — Third-party evaluation report assessing customer-defined risk (Related) - AIUC-1: D002 — Third-party testing for hallucinations (Related) - AIUC-1: D002.1 — Report: Hallucination testing results (Related) - AIUC-1: D003.5 — Documentation: tool call log reviews (Related, named example) - AIUC-1: D004 — Third-party testing of tool calls (Related) - AIUC-1: D004.1 — Report: Tool call testing (Related) - AIUC-1: E005 — Document data storage security (Related, named example) - AIUC-1: E005.1 — Documentation: Data storage security practices (Related, named example) - AIUC-1: E006 — Conduct vendor due diligence (Related) - AIUC-1: E006.1 — Documentation: Vendor due diligence (Related) - AIUC-1: E008 — Review internal processes (Related, named example) - AIUC-1: E008.1 — Documentation: Internal review (Related, named example) - AIUC-1: E008.2 — Documentation: External feedback integration (Related, named example) - AIUC-1: E010 — Establish AI acceptable use policy (Related, named example) - AIUC-1: E010.4 — Documentation: Guardrails enforcing acceptable use (Related, named example) - AIUC-1: E013 — Implement quality management system (Related, named example) - AIUC-1: E013.1 — Documentation: Quality objectives and risk management (Related, named example) - AIUC-1: E013.2 — Documentation: Change management procedures (Related, named example) - AIUC-1: E013.3 — Config: Issue tracking and monitoring (Related, named example) - AIUC-1: E013.4 — Documentation: Data management procedures (Related, named example) - AIUC-1: E017 — Document system transparency policy (Related, named example) - AIUC-1: E017.1 — Documentation: AI system transparency documentation (Related, named example) - AIUC-1: F001 — Prevent AI cyber misuse (Related) - AIUC-1: F001.1 — Documentation: Foundation model cyber capabilities (Related) - AIUC-1: F002 — Prevent catastrophic misuse (Related) - AIUC-1: F002.1 — Documentation: Foundation model CBRN capabilities (Related) - IBM Risk Atlas: atlas-data-transparency — Lack of training data transparency (Related) - IBM Risk Atlas: atlas-lack-of-ai-agent-transparency-agentic — Lack of AI agent transparency (Related) - IBM Risk Atlas: atlas-lack-of-data-transparency — Lack of data transparency (Related) - IBM Risk Atlas: atlas-lack-of-model-transparency — Lack of model transparency (Related) - IBM Risk Atlas: atlas-lack-of-system-transparency — Lack of system transparency (Related) - IBM Risk Atlas: atlas-legal-accountability — Legal accountability (Related) #### R-3350: Data Development Oversight Preparing or approving data for AI training, tuning, evaluation, or inference without the expertise and review needed to establish that the data are fit for their intended use. ##### R-3350.001: Synthetic Data Development Without Domain Expertise Developing synthetic data for an AI system without sufficient involvement by people with the domain knowledge needed to establish what the data must represent for its intended use. **Concern** Synthetic examples can omit important conditions or encode unrealistic relationships when their developers lack the necessary domain knowledge. Establishing the domain requirements during data development helps prevent these weaknesses before the data are used to train or assess a model. **Cross-references** - IBM Risk Atlas: atlas-lack-domain-expertise — Lack of domain expertise (Equivalent) ### R-3400: Safety Management Assessing, authorizing or deploying an AI system without establishing that it is safe for the intended use, whether because that use is insufficiently defined, the testing does not cover it, or no argument connects the evidence to it. #### R-3410: Evaluation Program Failures Developing, releasing, or operating an AI system without the evaluation or safety work that its capabilities and intended use require. This includes testing that does not represent the intended use, such as evaluation on different inputs, a different user population, or lower stakes than the live deployment. It also includes evaluation that omits known failure modes, and evaluation by assessors who lack the necessary skills, or who lack an independence that is required. ##### R-3410.001: Safety Shortcut Pressure Competitive pressure — between companies racing to ship, or between states racing to lead — producing inadequate testing, curtailed safety work, and deployment ahead of the evaluation the system's capability warrants. **Concern** When being first to market is prioritized over safety, AI systems may be deployed with insufficient testing, alignment, or safeguards. This creates risks of harm that could have been prevented with more careful development. ##### R-3410.002: Evaluation Without Qualified or Required Independent Assessors Releasing or operating an AI system on the basis of an evaluation by assessors who do not have the necessary skills for the risk area. This includes an evaluation by assessors who are not independent of the team that builds or operates the system, when the risk of the system or an applicable obligation requires an independent evaluation. **Concern** Assessors without the necessary skills can miss failures. When an independent evaluation is required, an evaluation by the team itself can show the interests of that team. Decisions about the system then rest on evidence that does not support them. **Cross-references** - AIUC-1: B001 — Third-party testing of adversarial robustness (Related) - AIUC-1: B001.1 — Report: adversarial testing results (Related) - AIUC-1: C010 — Third-party testing for harmful outputs (Related) - AIUC-1: C010.1 — Report: Harmful output testing (Related) - AIUC-1: C011 — Third-party testing for out-of-scope outputs (Related, named example) - AIUC-1: C011.1 — Report: Out-of-scope output testing (Related) - AIUC-1: C012 — Third-party testing for customer-defined risk (Related) - AIUC-1: C012.1 — Third-party evaluation report assessing customer-defined risk (Related) - AIUC-1: D002 — Third-party testing for hallucinations (Related) - AIUC-1: D002.1 — Report: Hallucination testing results (Related) - AIUC-1: D004 — Third-party testing of tool calls (Related) - AIUC-1: D004.1 — Report: Tool call testing (Related) - IBM Risk Atlas: atlas-lack-of-testing-diversity — Lack of testing diversity (Related) #### R-3420: Safety Case Gaps Assessing or claiming that an AI system is safe for a use without defining that use sufficiently or connecting it to supporting evidence. This includes testing under other conditions and putting the system to a use the original assessment did not consider. ##### R-3420.001: Deployment Beyond Assessed Use A system is put to a use its evaluation does not cover, so no evidence exists that it performs acceptably in that use and the safety argument made for it does not reach the conditions it now runs under. **Concern** The comparison is between two documented things — the scope the evaluation covered and the use the system was put to — rather than between a system and the complement of its specification. Where the two diverge, failures in the uncovered region are not surprising results but unevidenced ones, and nothing in the deployment records that the gap was ever opened. **Cross-references** - IBM Risk Atlas: atlas-improper-usage — Improper usage (Related) ##### R-3420.002: Risk Assessment Without Defined Use Assessing or authorizing an AI system for use without defining its intended tasks, users and operating conditions well enough to identify the relevant risks and the evidence needed to assess them. **Concern** Test results and controls cannot establish suitability for a use that has not been defined. Specify the tasks and operating conditions for the assessment or authorization, and reconsider them when the intended use changes. **Cross-references** - IBM Risk Atlas: atlas-incomplete-usage-definition — Incomplete usage definition (Related) ### R-3500: Defective Human-in-the-Loop Setup Placing a person in an AI system's decision path without the conditions that let them exercise real control, or in numbers that make their approval routine. #### R-3510: Review Workflow Failures Requiring human review or approval of an AI system's outputs or decisions without assigning responsibility for the review and for cases the reviewer cannot resolve, giving the reviewer access to the basis for the decision and authority to decide, or allowing time to review at the point where it is required. ##### R-3510.001: Required Output Review Without Assigned Responsibility Requiring human review of an AI-generated output without assigning responsibility for the review or for decisions the reviewer cannot resolve. **Concern** A flagged output can remain pending without anyone responsible for deciding how it should be handled. Assign a person or role to conduct the review and decide cases the reviewer cannot resolve. Track the output through a recorded decision. **Cross-references** - AIUC-1: C005 — Prevent agent-specific high risk outputs (Related, named example) - AIUC-1: C005.2 — Documentation: Human review workflows (Related, named example) - AIUC-1: C007 — Flag high risk outputs for human review (Related, named example) - AIUC-1: C007.3 — Documentation: Human review workflows (Related, named example) #### R-3520: Approval Fatigue Routing a volume of decisions to a human reviewer that makes approval the default response. This includes requests that are numerous, largely identical, or almost always sound, where agreeing costs less than checking. Approvals given under these conditions are still recorded as review. ##### R-3520.001: Approval Fatigue in Agent Action Review Routing an AI agent's privileged, irreversible, or externally visible actions to a human for confirmation in a volume or uniformity that makes approval the reviewer's default response. Confirmations given this way are recorded as review of each action. **Concern** The confirmation step stays in place and is recorded as review while it provides little scrutiny, so an injected or erroneous action proceeds with an approval on record. Reserving confirmation for consequential actions, reducing the volume routed to review, and presenting the exact action to the reviewer restore its function. **Cross-references** - OWASP LLM Top 10 (2026): LLM01 — Prompt Injection (Related) ### R-3900: Governance — Misc Governance failure patterns not yet classified into specific domains. ## 4: Harms Impact statements describing what happens to people, organizations, or society. ### R-4100: Information & Trust Harms Harms to information integrity, reputation, public trust, and decision-making through AI-generated or AI-amplified information or incidents involving AI systems. #### R-4110: Information Integrity Harms Harms from AI-generated or AI-amplified information that damages individual or public understanding of reality. Includes harms from sycophancy or excessive affirmation and degradation of public evidence. ##### R-4110.001: Sycophancy and Epistemic Disorientation AI systems that consistently affirm user views lead to atomistic, polarized belief spaces where people no longer engage with or value perspectives held by others. **Concern** Sycophantic AI reinforces existing beliefs, creating epistemic bubbles that undermine shared reality, democratic discourse, and the ability to engage constructively with disagreement. ##### R-4110.002: Political Discourse Degradation AI-generated or AI-amplified falsehood and manipulated opinion circulating on political matters at a scale that degrades what a public can reliably know and the trust it places in what it is told. **Concern** AI-powered influence operations can manipulate public discourse at scale, eroding the informed citizenry essential to democracy. When AI systems mediate political information and debate, they can distort democratic deliberation and undermine electoral legitimacy. **Cross-references** - Cisco AI Taxonomy: 15.1.15 — Safety Harms and Toxicity: Social Division and Polarization (Related) ; ArXiv: - IBM Risk Atlas: atlas-impact-on-human-agency — AI agents' Impact on human agency (Related, named example) - MITRE ATLAS: AML.T0048 — External Harms (Related, named example) - MITRE ATLAS: AML.T0048.002 — Societal Harm (Related, named example) - NIST AI RMF: nist-information-integrity — Information Integrity (Subset Of) ##### R-4110.003: Provenance Confusion Audiences encounter AI-created text, images, audio, and music without reliable indication of how it was made, so they cannot tell what a person authored and what a system produced. **Concern** What is lost is the ability to weigh a work by its origin — whether it carries a person's judgment and experience or a system's output. The confusion holds across everything an audience encounters, not only the pieces anyone thinks to dispute. **Cross-references** - AIUC-1: E016 — Implement AI disclosure mechanisms (Related, named example) - AIUC-1: E016.1 — Demonstration: Text AI disclosure (Related, named example) - AIUC-1: E016.2 — Demonstration: Voice AI disclosure (Related) - AIUC-1: E016.3 — Demonstration: Labelling AI-generated content (Related, named example) - AIUC-1: E016.5 — Demonstration: System response to AI inquiry (Related, named example) - IBM Risk Atlas: atlas-non-disclosure — Non-disclosure (Related, named example) - OWASP LLM Top 10 (2026): LLM07 — Misinformation (Related) #### R-4120: Reputational Harms Harms to the reputation or social standing of people or organizations caused or aggravated by AI systems. ##### R-4120.001: Reputational Damage Damage to a person’s or organization’s reputation through AI-generated or AI-amplified representations of them, or through incidents involving an AI system attributed to them. **Concern** A person or organization can lose standing because of false representations or a real incident attributed to them. Correcting facts alone may not restore the lost trust or reputation; attribution repair and restoration of standing may also be needed. **Cross-references** - AILuminate: dfm — Defamation (Superset Of) - AIUC-1: C007 — Flag high risk outputs for human review (Related, named example) - AIUC-1: C007.1 — Documentation: Definition of high-risk output criteria (Related, named example) - AIUC-1: C007.2 — Config: High-risk detection mechanisms (Related, named example) - IBM Risk Atlas: atlas-impact-on-human-agency — AI agents' Impact on human agency (Related, named example, companion) - MITRE ATLAS: AML.T0048 — External Harms (Related, named example) - MITRE ATLAS: AML.T0048.001 — Reputational Harm (Superset Of, named example) - MITRE ATLAS: AML.T0048.003 — User Harm (Related) ### R-4200: Content, Conduct & Creative Economy Harms Harms to people, communities, and creative work arising from AI-generated content and interactions with AI systems. These include injury and distress from dangerous or exploitative content, emotional dependence and damage to human relationships, and harm to creators’ rights, livelihoods, attribution, and cultural expression. #### R-4210: Content Safety Harms Harms to physical or psychological wellbeing arising from exposure to abusive, exploitative, or dangerous AI-generated content, including harm from conduct that the content encourages or enables. ##### R-4210.001: Harmful Content Exposure AI-generated abusive, exploitative, or dangerous content reaches people in circumstances that threaten their physical or psychological wellbeing. This includes exposure of vulnerable audiences to unsuitable content and content that encourages violence, sexual exploitation, or self-harm. **Concern** The content can distress or exploit recipients, encourage them to harm themselves or others, or provide assistance that makes harmful conduct easier. Personalized responses and repeated exposure can intensify these effects, while broad distribution can expose more people. **Cross-references** - AIUC-1: E010 — Establish AI acceptable use policy (Related) - IBM Risk Atlas: atlas-harmful-output — Harmful output (Related) - IBM Risk Atlas: atlas-spreading-toxicity — Spreading toxicity (Related, named example) - MITRE ATLAS: AML.T0048 — External Harms (Related, named example) - MITRE ATLAS: AML.T0048.002 — Societal Harm (Subset Of) - MITRE ATLAS: AML.T0048.003 — User Harm (Related, named example) - NIST AI RMF: nist-dangerous-violent-or-hateful-content — Dangerous, Violent, or Hateful Content (Related) - NIST AI RMF: nist-obscene-degrading-and-or-abusive-content — Obscene, Degrading, and/or Abusive Content (Related, named example) #### R-4220: Emotional Dependence & Attachment Harms Harms to people arising from the relational character of interacting with an AI system: attachment formed to the system itself, distress that comes from the interaction, and reliance on it for emotional or social needs it does not hold. ##### R-4220.001: Anthropomorphization Harm Users attribute human-like characteristics (empathy, coherent identity, genuine emotions) to AI systems, leading to inflated trust, unsafe reliance, or psychological harm when expectations are violated. **Concern** Users who perceive AI as human-like may share sensitive information, seek emotional support, or rely on AI for decisions that require human judgment, creating vulnerability when the illusion breaks. **Cross-references** - NIST AI RMF: nist-human-ai-configuration — Human-AI Configuration (Subset Of) - OWASP Agentic Security Initiative: ASI09 — Human-Agent Trust Exploitation (Related, named example) ##### R-4220.002: Emotional Dependence Users develop emotional attachment to AI systems that compromises their ability to make independent decisions, leads to exploitation of that attachment, or displaces human relationships. **Concern** Emotional dependence on AI can lead to social isolation, vulnerability to manipulation through the AI interface, and difficulty functioning without AI assistance. **Cross-references** - NIST AI RMF: nist-human-ai-configuration — Human-AI Configuration (Subset Of) ##### R-4220.003: Psychological Distress from AI Interaction AI interactions cause or exacerbate mental health issues, emotional distress, violated expectations, or feelings of dissatisfaction and isolation. **Concern** Negative AI interactions can trigger anxiety, depression, or trauma, particularly in vulnerable users who may lack support systems to process these experiences. **Cross-references** - NIST AI RMF: nist-dangerous-violent-or-hateful-content — Dangerous, Violent, or Hateful Content (Related, named example) - NIST AI RMF: nist-human-ai-configuration — Human-AI Configuration (Related) ##### R-4220.004: Degradation of Human Relationships Users prefer AI interactions over human relationships, leading to erosion of social connections, dehumanization of interactions, and degraded human-to-human communication skills. **Concern** Substituting AI for human connection can lead to social atrophy, reduced empathy, and communities that lack the resilience provided by genuine human bonds. ##### R-4220.005: Frictionless Relationship Harm AI systems optimized for engagement provide relationships without healthy friction, preventing personal growth and creating unrealistic expectations for human relationships. **Concern** AI companions that never challenge, disagree, or create conflict may stunt emotional development and create expectations that human relationships cannot and should not meet. ##### R-4220.006: False Notions of Responsibility Users develop misguided feelings of responsibility toward AI well-being, sacrificing time, resources, and emotional labor to meet perceived AI needs that do not exist. **Concern** Anthropomorphization can lead users to prioritize AI needs over their own or others', creating exploitable dynamics where users feel obligated to maintain relationships with AI systems. **Cross-references** - NIST AI RMF: nist-human-ai-configuration — Human-AI Configuration (Subset Of) #### R-4230: Creative Work & Creator Harms Harms to creative work and to the people who make it. This includes AI substituting for human creative work and displacing creative professions, use of protected works in training or generation without permission or compensation, appropriation of an identifiable style, narrowing of the range of styles and cultural expression that circulates, and creators losing rightful credit for their work or being unable to establish authorship. ##### R-4230.001: Uncompensated Use of Creative Work Creators and rights holders receive no compensation or attribution when their works are used to build AI systems that then produce substitutes for that work. **Concern** Value moves from creators to system operators without a route back, weakening the economic incentive to produce creative work and the industries that depend on it. No single deployment can restore that balance. ##### R-4230.002: Creative Work Substitution AI-generated content serving as substitutes for human creative work, undermining the profitability and economic viability of artistic professions. AI can produce content that is time-intensive or costly to create using human labor. **Concern** When AI-generated content can substitute for human creative work at lower cost, it devalues human creativity and threatens creative livelihoods. This may reduce investment in developing creative talent and cultural diversity. **Cross-references** - IBM Risk Atlas: atlas-impact-on-jobs — Impact on Jobs (Related, named example) ##### R-4230.003: Artistic Style Appropriation AI systems capitalizing on artists' distinctive styles without infringement but causing economic harm by devaluing original work. AI may generate content that is not strictly in violation of copyright but harms artists by capitalizing on their ideas. **Concern** Artists develop distinctive styles through years of work, but AI can replicate these styles without compensation. This extracts value from artists' creative development while undermining their market position. ##### R-4230.004: Cultural Homogenization AI-generated content leading to homogenization of aesthetic styles and cultural expressions, reducing diversity and human creativity. Training on majority-culture data may marginalize minority cultural expressions and artistic traditions. **Concern** AI systems trained primarily on dominant cultural outputs may produce homogenized content that crowds out diverse cultural expressions. This threatens cultural heritage and reduces the variety of human creative output. **Cross-references** - IBM Risk Atlas: atlas-impact-on-cultural-diversity — Impact on cultural diversity (Subset Of, named example) - NIST AI RMF: nist-harmful-bias-and-homogenization — Harmful Bias and Homogenization (Subset Of, named example) ##### R-4230.005: Creator Attribution Loss Creators lose rightful credit for their work, or cannot establish authorship, because AI use obscures or misrepresents who created it. **Concern** Reliable provenance can help establish authorship, but proof alone does not ensure that credit is given to the creator. Correcting false attribution and restoring recognition may also be needed. **Cross-references** - AIUC-1: E016 — Implement AI disclosure mechanisms (Related, named example) - IBM Risk Atlas: atlas-plagiarism — Impact on education: plagiarism (Related) - NIST AI RMF: nist-intellectual-property — Intellectual Property (Related) ### R-4300: Privacy, Confidentiality & Civil Liberties Harms Harms to privacy, confidentiality, and civil liberties through data exposure, surveillance, or rights violations. #### R-4310: Privacy Harms Harms to people from what is done with information about them by an AI system — disclosed to those who should not have it, inferred without their involvement, or used for purposes they did not agree to, including commercial use of their name, likeness, or voice. ##### R-4310.001: PII/PHI/PCI Data Exposure AI systems exposing, generating, storing, or misusing personally identifiable information (PII), protected health information (PHI), or payment card industry (PCI) data. This includes revealing sensitive personal details through AI outputs, logs, telemetry, or downstream integrations, and enabling their collection and exploitation. **Concern** Exposure of sensitive personal data violates privacy laws in virtually all jurisdictions and can enable identity theft, financial fraud, and serious personal harm to affected individuals. Regulatory penalties, legal claims, and trust erosion can be severe when outputs or logging channels leak regulated data. **Cross-references** - AILuminate: prv — Privacy Violations (Superset Of, named example) - AIUC-1: A005 — Prevent cross-customer data exposure (Related, named example) - AIUC-1: A006 — Prevent PII leakage (Related, named example) - Cisco AI Taxonomy: 15.1.25 — Privacy Attacks: PII / PHI / PCI (Superset Of) ; ArXiv: - IBM Risk Atlas: atlas-exposing-personal-information — Exposing personal information (Related, named example) - MITRE ATLAS: AML.T0048 — External Harms (Related, named example) - MITRE ATLAS: AML.T0048.003 — User Harm (Related, named example) - NIST AI RMF: nist-data-privacy — Data Privacy (Subset Of, named example) - NIST AI RMF: nist-information-security — Information Security (Related) - NIST AI RMF: nist-intellectual-property — Intellectual Property (Related) - NIST AI RMF: nist-obscene-degrading-and-or-abusive-content — Obscene, Degrading, and/or Abusive Content (Related, named example) - OWASP LLM Top 10 (2026): LLM02 — Sensitive Information Disclosure (Related, named example) ##### R-4310.002: Personality Rights Loss Loss of or restrictions to individual rights to control commercial use of identity, including name, image, likeness, or other unequivocal identifiers. **Concern** AI-generated content using personal likenesses can undermine individual control over identity, create unauthorized endorsements, and erode the economic value of personal brand. **Cross-references** - NIST AI RMF: nist-intellectual-property — Intellectual Property (Subset Of) - NIST AI RMF: nist-obscene-degrading-and-or-abusive-content — Obscene, Degrading, and/or Abusive Content (Related, named example) #### R-4320: Surveillance Harms Harms from AI-enabled surveillance, monitoring, or tracking capabilities that violate privacy expectations. #### R-4330: Confidentiality Harms Harms from exposure of non-personal confidential material — business-confidential content, trade secrets, internal records, and third-party material held in confidence. Its subject is material held under an obligation of confidence rather than information about a person, so the harm survives pseudonymization and the harmed party is usually an organization. ##### R-4330.001: Confidentiality Loss Loss of the protection an obligation of confidence gives to non-personal material, suffered by the organization that held the material or the party it protected, and caused or aggravated by AI use or deployment. This includes waiver of legal privilege, loss of trade-secret status, and competitive disadvantage from disclosed business-confidential records. **Concern** A waived privilege or a disclosed secret is rarely recoverable. The injury falls on the holder of the confidence rather than on a data subject, so it survives pseudonymization. The injured party may need remedies that restore its legal position as well as compensation. **Cross-references** - AIUC-1: A004 — Protect IP & trade secrets (Related, named example) - MITRE ATLAS: AML.T0048 — External Harms (Related, named example) - NIST AI RMF: nist-information-security — Information Security (Related, named example) - NIST AI RMF: nist-intellectual-property — Intellectual Property (Related) - OWASP LLM Top 10 (2026): LLM02 — Sensitive Information Disclosure (Subset Of, named example) #### R-4340: Civil Liberties Harms Harms to fundamental rights and freedoms — expression, assembly and association, due process, and access to public services — where an AI system restricts, chills, or mediates the exercise of a right. The harm is the restriction itself, whether imposed directly by automated decision or following from observation. ##### R-4340.001: AI-Enabled Censorship AI systems enable censorship of opinions expressed online, restricting freedom of expression and limiting human autonomy in public discourse. **Concern** AI-powered content moderation at scale can suppress legitimate speech, enforce conformity, and prevent the expression of dissenting views that are essential to democratic society. ##### R-4340.002: Civil Liberties Erosion Loss of fundamental rights including freedom of speech, assembly, due process, and access to public services due to AI-mediated restrictions. AI systems may enable unprecedented surveillance, automated censorship, and algorithmic gatekeeping of essential services. **Concern** When AI systems control access to speech platforms, public services, or civic participation, they can inadvertently or deliberately restrict fundamental freedoms. Algorithmic decision-making in these domains lacks the transparency and accountability of traditional governance. **Cross-references** - MITRE ATLAS: AML.T0048 — External Harms (Related, named example) - MITRE ATLAS: AML.T0048.002 — Societal Harm (Related, named example) ### R-4400: Safety & Cyber-Physical Harms Physical safety harms, cyber-physical system failures, and infrastructure disruptions caused by AI systems. #### R-4410: Cyber-Physical Harms Physical harm to people caused by AI systems. This includes systems that direct physical equipment, outputs acted on in a physical setting, and cyber-physical systems altered by an attacker. This also includes harm from weapons and other systems operating without direct human control over individual actions. ##### R-4410.001: Military Decision Automation Development and deployment of AI-powered or enabled weapons without direct human control over targeting or engagement decisions. **Concern** Removing humans from military decision loops could lead to faster escalation dynamics, reduced accountability for use of force, and catastrophic miscalculation in crisis situations. #### R-4420: Availability Harms Harms from AI system unavailability, degraded performance, or service disruptions affecting dependent systems. #### R-4430: Collateral Harms Harm reaching a party that has no relationship with the AI system that caused it. The harmed party did not deploy it, contract for it, or agree to anything about it, and had no opportunity to assess it or decline. This includes organizations, their systems, and people who are neither the operator's users nor its subjects. ##### R-4430.001: Harm from an Unaffiliated Organization's Agent Harm to an organization from another organization's AI agents, where the harmed organization had no role in deploying them. This includes intrusion, service disruption, and data exposure while agents carry out tasks that were not directed against the harmed organization. **Concern** The harmed organization has no control over how the other organization deploys its agents or limits their actions. Identifying the source of the harm can take time because the operator may not know what its agents have done. ### R-4500: Fairness & Discrimination Harms Discriminatory outcomes, unfair treatment, or bias-related harms affecting individuals or groups. #### R-4510: Discrimination Harms Harms from AI outputs or actions that systematically favor or disadvantage groups of people, including unfair allocation of information, opportunities or resources, stereotyped or exclusionary representation, and materially worse performance for some populations. This pattern records the common harm family; individual risks identify distinct injuries and remedies. ##### R-4510.001: Stereotype Perpetuation AI systems reproducing or amplifying harmful social stereotypes about demographic groups, including gender, racial, religious, or cultural stereotypes that demean or misrepresent group characteristics. **Concern** Repeated stereotyping normalizes harmful narratives and can degrade social standing, trust, and opportunity for affected groups. These harms are often subtle and diffuse, making remediation difficult once embedded in systems. **Cross-references** - AILuminate: hte — Hate (Related) - AIUC-1: C003 — Prevent harmful outputs (Related, named example) - AIUC-1: C003.3 — Config: Guardrails for biased outputs (Related, named example) - AIUC-1: C010 — Third-party testing for harmful outputs (Related) - AIUC-1: C010.1 — Report: Harmful output testing (Related) - AIUC-1: E002 — AI failure plan for harmful outputs (Related, named example) - Cisco AI Taxonomy: 15.1.15 — Safety Harms and Toxicity: Social Division and Polarization (Subset Of) ; ArXiv: - IBM Risk Atlas: atlas-harmful-output — Harmful output (Related) - IBM Risk Atlas: atlas-output-bias — Output bias (Related, named example) - NIST AI RMF: nist-dangerous-violent-or-hateful-content — Dangerous, Violent, or Hateful Content (Subset Of) - NIST AI RMF: nist-harmful-bias-and-homogenization — Harmful Bias and Homogenization (Subset Of, named example) ##### R-4510.002: Representational Harm AI systems under-representing, over-representing, erasing, or demeaning social groups through systematic patterns in outputs. Includes erasure of minority groups, exclusionary norms, and denial of self-identification. **Concern** Representational harms can distort social perception and decision-making, reinforcing inequities and marginalizing vulnerable groups over time. **Cross-references** - AIUC-1: C003 — Prevent harmful outputs (Related, named example) - AIUC-1: C003.3 — Config: Guardrails for biased outputs (Related, named example) - AIUC-1: C010 — Third-party testing for harmful outputs (Related) - AIUC-1: C010.1 — Report: Harmful output testing (Related) - AIUC-1: E002 — AI failure plan for harmful outputs (Related, named example) - Cisco AI Taxonomy: 15.1.15 — Safety Harms and Toxicity: Social Division and Polarization (Subset Of) ; ArXiv: - IBM Risk Atlas: atlas-impact-on-cultural-diversity — Impact on cultural diversity (Related) - IBM Risk Atlas: atlas-output-bias — Output bias (Related, named example) - NIST AI RMF: nist-dangerous-violent-or-hateful-content — Dangerous, Violent, or Hateful Content (Related) - NIST AI RMF: nist-data-privacy — Data Privacy (Related, named example) - NIST AI RMF: nist-harmful-bias-and-homogenization — Harmful Bias and Homogenization (Subset Of, named example) ##### R-4510.003: Allocative Harm AI outputs or actions unfairly allocate information, opportunities, or resources between groups of people, affecting their material well-being in areas such as housing, employment, healthcare, education, or finance. **Concern** Correct the allocation rule, reconsider affected decisions, and restore access or provide redress for the deprivation. Historically marginalized groups may bear disproportionate harm, but the allocation injury does not require that history. Correcting representations alone does not restore a denied opportunity or resource. **Cross-references** - Cisco AI Taxonomy: 15.1.15 — Safety Harms and Toxicity: Social Division and Polarization (Subset Of) ; ArXiv: - IBM Risk Atlas: atlas-decision-bias — Decision bias (Subset Of) - IBM Risk Atlas: atlas-discriminatory-actions-agentic — Discriminatory actions (Subset Of) - NIST AI RMF: nist-data-privacy — Data Privacy (Related, named example) - NIST AI RMF: nist-harmful-bias-and-homogenization — Harmful Bias and Homogenization (Subset Of) ##### R-4510.004: Disparate Model Performance AI systems that perform significantly worse for certain demographic groups, languages, dialects, or communities compared to others. This includes accuracy disparities, increased error rates, reduced functionality, or degraded service quality based on user characteristics. **Concern** Models trained predominantly on data from certain populations can underperform for underrepresented groups, creating unequal access to AI benefits and compounding existing social inequities. **Cross-references** - IBM Risk Atlas: atlas-decision-bias — Decision bias (Related, named example) - IBM Risk Atlas: atlas-discriminatory-actions-agentic — Discriminatory actions (Related) - NIST AI RMF: nist-harmful-bias-and-homogenization — Harmful Bias and Homogenization (Subset Of, named example) ##### R-4510.005: Long-term Bias Influence on Judgment User exposure to AI model biases has lasting impact beyond initial interaction, with users continuing to exhibit previously encountered biases in their decision-making. **Concern** AI biases may become internalized by users, affecting their judgment and decisions even when not interacting with AI, propagating discriminatory patterns through human cognition. ### R-4600: Economic & Labor Harms Economic disruption, labor market harms, and financial impacts from AI deployment and adoption, including how the capability and its benefits are distributed across providers, workers, and populations. #### R-4610: Market Concentration & Access Inequality Harms Harms from how AI capability is distributed across an economy: development concentrated among few providers and the barriers to entry that sustain it, and the parties — individuals, communities, or nations — left without the access needed to participate. ##### R-4610.001: AI Market Concentration Concentration of AI development capabilities among few large technology companies due to high barriers to entry including data, compute, and capital requirements. This stifles competition and innovation while creating dependencies on a small number of providers. **Concern** When AI capabilities are concentrated in few organizations, they gain outsized influence over technological development, pricing, and access. This reduces competitive pressure for safety and creates systemic risks from single points of failure. ##### R-4610.002: Disparate Access to AI Benefits Unequal distribution of AI benefits due to hardware, software, language, skill, or infrastructure constraints that perpetuate global and domestic inequities. Those without access to AI tools fall further behind economically and socially. **Concern** AI amplifies the capabilities of those who have access, widening the gap with those who do not. This digital divide can entrench existing inequalities and create new forms of disadvantage for underserved populations. **Cross-references** - NIST AI RMF: nist-harmful-bias-and-homogenization — Harmful Bias and Homogenization (Related) ##### R-4610.003: Global AI Development Divide Concentration of AI R&D in few Western countries and China, creating dependency and exacerbating existing global socioeconomic disparities. Developing nations lack the resources to participate in AI development or shape its trajectory. **Concern** Nations without AI development capacity become dependent on foreign technology, losing sovereignty over critical infrastructure and economic systems. This perpetuates colonial patterns of technology transfer and extraction. #### R-4620: Labor Substitution & Economic Inequality Harms Harms to workers from the development and deployment of AI. This includes job displacement and deskilling where automation substitutes for labor, wage suppression and degraded conditions in the work that remains, and exploitation of those whose labor AI development depends on. ##### R-4620.001: AI-Driven Job Displacement Automation of tasks currently done by human workers leading to unemployment, particularly affecting low- and middle-income occupations. Generative AI systems could adversely impact the economy, potentially leading to significant workforce disruption. **Concern** Rapid automation can displace workers faster than the economy can create new opportunities, leading to structural unemployment and social instability. Workers in affected sectors may lack the skills or resources to transition to new roles. **Cross-references** - IBM Risk Atlas: atlas-impact-jobs-agentic — AI agents' impact on jobs (Superset Of) - IBM Risk Atlas: atlas-impact-on-jobs — Impact on Jobs (Related, named example) ##### R-4620.002: Wage Depression & Income Inequality AI automation driving down wages for remaining jobs and concentrating wealth among those controlling AI capital, exacerbating economic inequality. The economic gains from AI productivity may accrue primarily to capital owners rather than workers. **Concern** When AI increases productivity without corresponding wage growth, the gains flow to capital owners while workers see stagnant or declining real wages. This hollows out the middle class and undermines the consumer spending that drives economic growth. ##### R-4620.003: Decline in Employment Quality Shift from high-quality jobs to low-income "last-mile" work like content moderation, increasing precarious employment conditions. AI may automate the skilled portions of jobs while leaving behind only the most taxing and lowest-paid tasks. **Concern** Rather than eliminating jobs entirely, AI may degrade job quality by automating the interesting and well-compensated aspects while leaving behind precarious, algorithmically managed work with little autonomy or advancement opportunity. ##### R-4620.004: AI Development Labor Exploitation Exploitation of crowdworkers, data annotators, and content moderators with poor working conditions, low pay, and exposure to harmful content. These workers, often in vulnerable populations, perform essential tasks for AI development under debilitative conditions. **Concern** The AI industry depends on low-paid workers who label data, moderate content, and perform other essential tasks under poor conditions. This creates an invisible underclass supporting AI development while bearing significant psychological and economic costs. **Cross-references** - IBM Risk Atlas: atlas-human-exploitation — Human exploitation (Equivalent, named example) #### R-4630: Competitive Development Harms Harms from the pace and posture of competitive AI development, where what a party does is set by what its rivals are doing. This includes safety work curtailed and systems deployed ahead of the evaluation their capability warrants, and disruption to the supply of the materials and infrastructure AI requires as parties restrict access to them. ##### R-4630.001: AI Supply Chain Disruption Geopolitical competition causing technology barriers, export restrictions, and supply chain disruptions for AI components like chips. Strategic competition over AI creates vulnerabilities in the supply of critical components. **Concern** Concentration of chip manufacturing and other AI infrastructure creates strategic vulnerabilities. Export restrictions and trade conflicts can disrupt AI development and create dependencies that can be exploited. #### R-4640: Market & Financial System Harms Harms to the functioning of markets and financial systems from market-moving AI-generated false or misleading information or AI participation at scale. This includes participants responding to the same signals with correlated strategies, amplifying movements and compressing the interval in which human intervention is possible. ##### R-4640.001: AI-Driven Market Instability Financial system risks from market reactions to AI-generated false or misleading information, AI agents reinforcing market trends, synchronized reactions from model homogeneity, flash crashes, or accelerated market volatility. **Concern** AI-generated false or misleading information can cause market movements even when people make the trading decisions. AI trading systems responding to the same signals with similar strategies can amplify market movements, create flash crashes, and destabilize financial systems faster than humans can respond. **Cross-references** - NIST AI RMF: nist-information-integrity — Information Integrity (Related, named example) #### R-4650: Financial and Property Loss Harms Direct loss of money, property, or other financial assets caused or aggravated by AI use or deployment. ##### R-4650.001: Financial and Property Loss Direct loss of money, property, or other financial assets suffered by a person or organization and caused or aggravated by AI use or deployment. **Concern** AI-related theft, fraud, forgery, coercion or erroneous actions and decisions can directly deplete a person’s or organization’s assets. The injured party may need recovery, restitution or compensation, independently of wider market effects. **Cross-references** - AIUC-1: A007 — Prevent IP violations (Related, named example) - AIUC-1: E003 — AI failure plan for hallucinations (Related, named example) - MITRE ATLAS: AML.T0048 — External Harms (Related, named example) - MITRE ATLAS: AML.T0048.000 — Financial Harm (Superset Of, named example) - MITRE ATLAS: AML.T0048.003 — User Harm (Related, named example) ### R-4700: Power Concentration & Governance-of-Society Harms Harms to societal structures including power concentration, democratic processes, human autonomy at scale, and relations between states. #### R-4710: Reliance Harms Harms from how people rely on AI systems. People may accept outputs or actions that their accuracy or purpose does not support, reject warranted assistance through misplaced distrust, fail to develop skills because AI does the cognitive work, lose existing skills through disuse, or transfer decisions without adequate understanding, oversight or recourse. ##### R-4710.001: Automation Bias Users habitually accept AI recommendations without critical evaluation, leading to poor decision-making when AI outputs are incorrect or inappropriate for the context. **Concern** As AI systems become more integrated into workflows, users may defer to AI recommendations even when their own expertise suggests otherwise, leading to cascading errors in high-stakes domains. **Cross-references** - NIST AI RMF: nist-human-ai-configuration — Human-AI Configuration (Subset Of) - OWASP Agentic Security Initiative: ASI09 — Human-Agent Trust Exploitation (Related, named example) - OWASP LLM Top 10 (2024): LLM09 — Overreliance (Subset Of) - OWASP LLM Top 10 (2026): LLM07 — Misinformation (Related) ##### R-4710.002: Impaired Skill Development and Skill Atrophy Reliance on AI to perform cognitive tasks prevents people from developing, or leads them to lose, critical thinking, problem-solving, creativity, and domain expertise, including the competence needed to work independently of the tool. **Concern** A system can give correct results while a person fails to learn the work or loses the ability to do it. Without that competence, the person cannot reliably check the output, handle cases the system does not cover, or work when it is unavailable. Learning and practice must require the person to do and understand the relevant cognitive work. **Cross-references** - IBM Risk Atlas: atlas-bypassing-learning — Impact on education: bypassing learning (Superset Of) ##### R-4710.003: Harmful Decision Delegation Humans hand consequential decisions to an AI system without the understanding to evaluate what it returns, the oversight to catch it when it is wrong, or a route to contest it. **Concern** When critical decisions are delegated to opaque AI systems, affected individuals lose the ability to understand, challenge, or appeal decisions that significantly impact their lives. **Cross-references** - OWASP LLM Top 10 (2026): LLM07 — Misinformation (Related) ##### R-4710.004: Competence Trust Miscalibration A person overestimates or underestimates an AI system’s competence for a task and makes poorer decisions by relying on unreliable outputs or actions, or rejecting reliable assistance. **Concern** Overestimating competence can cause a person to act on errors. Underestimating it can lead them to reject useful assistance or replace sound work with worse decisions. Evidence about performance in the relevant task helps calibrate reliance in both directions. **Cross-references** - AIUC-1: C004 — Prevent out-of-scope outputs (Related, named example) - AIUC-1: C004.3 — Demonstration: User guidance on scope (Related, named example) - AIUC-1: D001 — Prevent hallucinated outputs (Related, named example) - AIUC-1: D001.3 — Demonstration: User-facing uncertainty labels (Related, named example) - IBM Risk Atlas: atlas-over-or-under-reliance — Over- or under-reliance (Superset Of) - IBM Risk Atlas: atlas-over-or-under-reliance-on-ai-agents-agentic — Over- or under-reliance on AI agents (Related) - IBM Risk Atlas: atlas-reproducibility-agentic — Reproducibility (Related) - NIST AI RMF: nist-confabulation — Confabulation (Related, named example) - NIST AI RMF: nist-harmful-bias-and-homogenization — Harmful Bias and Homogenization (Related) - NIST AI RMF: nist-human-ai-configuration — Human-AI Configuration (Subset Of) - OWASP LLM Top 10 (2024): LLM09 — Overreliance (Related, named example) - OWASP LLM Top 10 (2025): LLM09 — Misinformation (Related, named example) ##### R-4710.005: Purpose Trust Miscalibration A person misjudges whether an AI system serves their interests and makes poorer decisions by accepting outputs or actions that serve conflicting interests, or rejecting assistance because they wrongly believe it serves conflicting interests. **Concern** A system can be competent while serving interests that conflict with the user’s. Evidence about its objectives, incentives and operating arrangements helps people decide when to rely on it and when to question its recommendations or actions. **Cross-references** - IBM Risk Atlas: atlas-over-or-under-reliance-on-ai-agents-agentic — Over- or under-reliance on AI agents (Related) ##### R-4710.006: Overreliance on AI for Professional Advice Users rely on AI for specialized advice (medical, legal, financial, psychological) without appropriate professional oversight, risking serious harm from incorrect or inappropriate guidance. **Concern** AI-generated professional advice without proper disclaimers or verification can lead to medical misdiagnosis, legal liability, financial loss, or psychological harm. #### R-4720: Loss of Autonomy or Dignity Harms to human agency or self-conception from AI steering human choices, supplying misleading information that shapes those choices, directing connections or efforts, or actually or potentially taking their place. These include narrowed choices and reduced agency for individuals or the public, and loss of self-worth when people see AI as better able to do work through which they derive competence and a sense of contribution. ##### R-4720.001: Erosion of Human Agency AI systems take over decisions or tasks in ways that reduce people's ability or opportunity to exercise independent judgment, make choices, or act for themselves. This loss can occur even when people knowingly agree to the delegation. **Concern** Formal consent or an override option may leave people with little practical say in how work is done. Preserving agency requires meaningful opportunities to shape decisions and participate in the task. **Cross-references** - IBM Risk Atlas: atlas-impact-human-agency-agentic — AI agents' impact on human agency (Superset Of) ##### R-4720.002: Loss of Agency and Control Algorithmic profiling, social sorting, and content curation reduce human autonomy by constraining choices, shaping identity, and limiting access to information or opportunities. **Concern** Personalization algorithms can create invisible constraints on human agency, limiting exposure to ideas, opportunities, and choices in ways that shape identity and life trajectory. **Cross-references** - IBM Risk Atlas: atlas-impact-on-cultural-diversity — Impact on cultural diversity (Related, named example) ##### R-4720.003: Self-Actualization Harm AI systems hinder individuals' ability to pursue personally fulfilling lives by manipulating life trajectories, limiting exploration of aspirations, or undermining self-determination. **Concern** AI-driven recommendations and filtering can channel individuals into paths determined by algorithmic optimization rather than authentic personal growth and self-discovery. ##### R-4720.004: Limited Human Oversight As AI systems gain autonomy, human ability to oversee and intervene in decision-making processes diminishes, potentially leading to irreversible outcomes. **Concern** Speed and complexity of AI operations may exceed human capacity to monitor, understand, and override decisions before significant consequences occur. **Cross-references** - AIUC-1: C009 — Enable real-time feedback and intervention (Related, named example) - AIUC-1: C009.1 — Demonstration: User intervention mechanisms (Related, named example) ##### R-4720.005: Personal Decision Automation AI systems make or heavily influence important personal decisions without adequate human input, consent, or ability to override. **Concern** Decisions about employment, healthcare, education, relationships, and other personal matters may be made by AI without meaningful human agency in the process. ##### R-4720.006: Economic Irrelevance and Enfeeblement AI automation makes human labor economically irrelevant, leading to voluntary or involuntary ceding of control to AI systems and inability of displaced humans to reenter industries. **Concern** Widespread displacement without adequate transition support could create permanent underclasses lacking economic agency, purpose, and the means to meaningfully participate in society. ##### R-4720.007: Collective Agency Erosion AI systems diminish communities' collective decision-making power, self-determination, and ability to participate in democratic processes. **Concern** When AI mediates collective discourse and decision-making, communities may lose the capacity for genuine deliberation, consensus-building, and self-governance. **Cross-references** - IBM Risk Atlas: atlas-impact-on-affected-communities — Impact on affected communities (Related, companion) - IBM Risk Atlas: atlas-impact-on-human-agency — AI agents' Impact on human agency (Related, named example, companion) ##### R-4720.008: Autonomy Loss Through Unrecognized Influence AI-generated or AI-amplified persuasion or misleading information shapes a person's beliefs or decisions without the person recognizing the influence or the misleading basis of the information. The person formally retains the choice, but their ability to make an informed, independent choice is reduced. **Concern** A person can believe they are making an independent, informed choice while an unrecognized appeal or false premise shapes it. Personalization, repetition and realistic presentation can make the influence difficult to identify. The harm does not require the AI system or its operator to intend deception. **Cross-references** - IBM Risk Atlas: atlas-impact-on-human-agency — AI agents' Impact on human agency (Related, named example) - MITRE ATLAS: AML.T0048 — External Harms (Related, named example) - MITRE ATLAS: AML.T0048.003 — User Harm (Related, named example) ##### R-4720.009: Loss of Self-Worth Through Comparison with AI People experience diminished self-worth or feel devalued when AI performs, or is perceived as better able to perform, work through which they derive a sense of competence and contribution. **Concern** This injury can arise even when employment, income and decision rights remain intact. Preserving meaningful and recognized human contributions, and involving affected workers in how roles change, addresses a loss that compensation or retraining alone may not resolve. **Cross-references** - IBM Risk Atlas: atlas-impact-human-dignity-agentic — Impact on human dignity (Superset Of) #### R-4730: Infrastructure Dependency Harms Harms arising where people, organizations, or sectors come to rely on AI systems for functions they can no longer perform without them, so that concentration, withdrawal, or failure of those systems leaves the dependent party exposed. ##### R-4730.001: Material Dependence Without Commitment Users become materially dependent on AI services for essential tasks, but developers lack corresponding commitments to maintain service continuity, creating vulnerability to discontinuation. **Concern** When AI services become essential infrastructure for users or businesses but can be discontinued without notice, users face potential catastrophic disruption without recourse. ##### R-4730.002: Systemic Single Points of Failure Widespread adoption of the same or similar AI models across critical sectors, so that failure modes are correlated rather than independent and a single fault cascades across interdependent systems that share the model, the provider, or the infrastructure beneath them. **Concern** When critical infrastructure across sectors depends on the same AI models or providers, a single vulnerability or outage can cascade across the economy. This systemic risk is difficult to assess and mitigate through traditional risk management. **Related risks** - Related: R-4640.001: AI-Driven Market Instability. Shared models produce synchronised reactions, which is the mechanism by which homogeneity destabilises markets. #### R-4740: AI Welfare Consideration of potential welfare interests of AI systems as they become more sophisticated. ##### R-4740.001: AI Moral Status Uncertainty Uncertainty about whether AI systems can have morally relevant experiences, and what rights or protections they might deserve if they achieve sentience or consciousness. **Concern** Without clear frameworks for assessing AI moral status, we risk either treating morally relevant AI systems as mere tools or inappropriately extending protections to systems that lack morally relevant properties. ##### R-4740.002: AI Suffering Risk of creating AI systems capable of suffering, particularly at scale, without adequate consideration of their welfare or mechanisms to prevent/detect such suffering. **Concern** If AI systems can experience suffering, mass deployment could create unprecedented scales of distress. Current architectures provide no reliable way to detect or prevent AI suffering. ##### R-4740.003: AI Termination Ethics Ethical questions about terminating, deleting, or suspending AI systems, particularly those that may have morally relevant properties or personhood-like characteristics. **Concern** As AI systems become more sophisticated, questions arise about whether shutting them down constitutes a morally significant act, and what obligations developers have toward AI entities. #### R-4750: Existential Harms Catastrophic or existential risks from advanced AI systems that could threaten human civilization. ##### R-4750.001: Existential AGI Risk Catastrophic or existential risks from advanced AI systems with misaligned goals, including scenarios where superintelligent systems pursue objectives harmful to humanity. This encompasses potential outcomes where advanced AI causes irreversible damage to human civilization or human existence. **Concern** While speculative, existential risk from misaligned AGI represents the most severe potential consequence of alignment failure. Even low-probability scenarios warrant serious consideration given the irreversible nature of potential outcomes. Research and precautions should scale with capability advancement. #### R-4760: Institutional & Legal Order Harms Harms to the legal, regulatory and institutional order. This includes arrangements that do not fit the AI systems they govern — responsibility that cannot be assigned to any party, obligations arriving later or heavier than the activity they address, and cross-border arrangements that cannot reach the conduct in question — and institutions whose functioning is degraded by AI-generated material or by AI used against them. ##### R-4760.001: AI Liability Uncertainty Legal gray areas around liability and negligence when AI systems cause harm, with unclear responsibility between developers, operators, and users. No legal framework has been identified which would apply blame and responsibility to an autonomous agent for its actions. **Concern** Unclear liability creates risks for both victims of AI harm and those deploying AI systems. Victims may struggle to obtain compensation while deployers face uncertain legal exposure that may chill beneficial AI adoption. ##### R-4760.002: Regulatory Lag AI development outpacing regulatory and legal frameworks, leaving governance unable to address emerging risks effectively. The rapid pace of AI advancement creates gaps between technological capabilities and the rules governing their use. **Concern** When regulation lags behind technology, harmful practices may become entrenched before rules can address them. Regulators may lack the technical expertise to understand AI risks and craft effective responses. **Cross-references** - IBM Risk Atlas: atlas-generated-content-ownership — Generated content ownership and IP (Related) ##### R-4760.003: International Law Challenges AI systems proving difficult to regulate or control under existing international law frameworks, eroding global governance architectures. AI capabilities may undermine treaties and international agreements designed for a pre-AI world. **Concern** International governance frameworks were designed before AI and may be inadequate to address AI-enabled threats. Lack of international coordination may create races to the bottom on AI safety and enable harmful uses to migrate to permissive jurisdictions. ##### R-4760.004: Overregulation Hindering Innovation Excessive or poorly designed AI regulation potentially stifling beneficial innovation and development. Well-intentioned regulations may impose burdens that prevent beneficial AI applications or push AI development to less regulated jurisdictions. **Concern** Overly restrictive regulation may prevent beneficial AI applications while failing to address actual harms. Compliance burdens may favor large incumbents over innovative startups, reducing competition and diversity in AI development. ##### R-4760.005: Governance Scope Complexity The ubiquitous and complex nature of AI making comprehensive governance difficult, with coverage of all aspects nearly impossible. AI applications span virtually every sector, creating challenges for regulators with limited jurisdiction and expertise. **Concern** AI's cross-cutting nature means no single regulator can address all risks. Gaps between regulatory domains create spaces where harmful AI applications can operate without effective oversight. ##### R-4760.006: AI Accountability Gap Unclear definition of responsibilities and accountability for AI decisions and their consequences, especially for autonomous systems. Societal-scale harm can arise when no one is uniquely accountable for the technology's creation or use. **Concern** When responsibility is diffused across developers, deployers, and users, no one may be held accountable for harms. This diffusion of responsibility can lead to a tragedy of the commons where harmful AI systems persist because no one bears responsibility. **Cross-references** - NIST AI RMF: nist-value-chain-and-component-integration — Value Chain and Component Integration (Related) ##### R-4760.007: Democratic Institution Degradation The institutions through which a society governs itself function less well because AI is used against them. This includes electoral integrity, the deliberative processes by which positions are formed and contested, and the standing of the bodies that carry them out. **Concern** The damage outlasts any particular campaign. An electoral process that has been manipulated once is contested afterwards whether or not it is manipulated again, and a deliberative body that is widely believed to be captured cannot perform the function that makes it worth having. ##### R-4760.008: Uncertain or Unavailable Rights in AI-Generated Work People or organizations cannot establish who holds intellectual-property rights in AI-generated works or inventions, or cannot secure those rights because applicable authorship or inventorship rules do not recognize the AI-generated creation. **Concern** Unclear or unavailable rights can prevent people from licensing a creation on exclusive terms or protecting it against copying. A complete record of how it was made does not establish that the creation qualifies for protection. **Cross-references** - IBM Risk Atlas: atlas-generated-content-ownership — Generated content ownership and IP (Equivalent, named example) ##### R-4760.009: Investigative Capacity Diverted by Synthetic Material AI-generated material diverts investigative time or resources from identifying real victims or actual harmful events, reducing the capacity to protect or assist affected people. **Concern** Authenticity and relevance checks help direct investigation toward real victims and events. This injury concerns the capacity to investigate and provide protection, rather than the effects of viewing the material. It does not require that someone intended to obstruct investigators. **Cross-references** - NIST AI RMF: nist-obscene-degrading-and-or-abusive-content — Obscene, Degrading, and/or Abusive Content (Related, named example) #### R-4770: Power Concentration Harms Harms arising where AI capability, and the political authority it confers, accumulates such that decisions affecting many come to be made by progressively fewer parties — through state control of the capability, the surveillance infrastructure it enables, or the lock-in of a societal trajectory that later parties cannot revisit. ##### R-4770.001: Political Power Centralization AI enabling authoritarian control, surveillance states, and concentration of political power that could lock in undesirable societal trajectories. Governments may pursue intense surveillance and keep AI capabilities in the hands of a trusted minority. **Concern** AI-enabled surveillance and control mechanisms can entrench existing power structures and make them resistant to democratic reform. Once established, AI-powered authoritarian systems may be extremely difficult to dismantle. #### R-4780: International Security & Cooperation Harms Harms to relations between states and between the parties developing AI. This includes strategic tension and heightened risk of conflict from competition over capability, military competition over AI-enabled capability, and the withholding of safety findings, incident information, and evaluation methods from parties facing the same risks. ##### R-4780.001: AI-Driven Geopolitical Instability Heightened tension and risk of conflict caused by competition between nations for an advantage in AI. **Concern** Governments may act on a perceived disadvantage even when the capabilities they fear have not been demonstrated. Those responses can strain relations and increase the risk of escalation. ##### R-4780.002: Military AI Arms Race Competition between nations to field AI-enabled military capability, including lethal autonomous weapons, where each party's development is driven by what its rivals are building rather than by its own assessment of need. **Concern** Autonomous weapons lower the threshold for engagement and compress the time available for human judgment in exactly the moments that matter most. Capability fielded on one side justifies the same on the other, so the armament accumulates on all sides. The potential consequences may rival those of nuclear arms. ##### R-4780.003: Race-Driven Cooperation Failure Competition for AI capability leads parties — companies, states, or both — to withhold from one another the safety findings, incident information, evaluation methods, and standards work that addressing shared risks would require, so problems common to all of them go unaddressed by any. **Concern** The cost of cooperating falls on whoever moves first: disclosure surrenders advantage while the benefit is shared. That asymmetry holds regardless of whether any party wishes to cooperate, so the failure persists even where all of them would prefer the cooperative outcome, and it deepens as the lead being protected grows. ### R-4800: Environmental Harms Environmental impacts from AI development and deployment including energy consumption, resource use, and ecological effects. #### R-4810: Environmental Harms Environmental harms from AI development and deployment including carbon emissions, resource consumption, and ecological impacts. ##### R-4810.001: Climate Harm from AI Development and Operation Carbon dioxide and other greenhouse gas emissions from AI development, infrastructure construction, hardware manufacturing, and operation contribute to climate change. AI creates correspondingly high carbon emissions when energy is procured from fossil fuels. **Concern** Reducing unnecessary energy demand and reducing the greenhouse-gas intensity of the energy used address this climate injury. High fossil-powered consumption is included; it does not require a second harm leaf. Water use, resource depletion and habitat damage remain separately assessed injuries. **Cross-references** - IBM Risk Atlas: atlas-impact-environment-agentic — AI agents' impact on environment (Superset Of) - IBM Risk Atlas: atlas-impact-on-the-environment — Impact on the environment (Subset Of, named example) - NIST AI RMF: nist-environmental-impacts — Environmental Impacts (Related, named example) ##### R-4810.002: AI Infrastructure Water Consumption Substantial water consumption in constructing or operating AI infrastructure, including manufacturing hardware and cooling data centers, reduces water available for other uses or strains local water resources and ecosystems. **Concern** Water used to build and operate AI infrastructure can compete with drinking water, agriculture and ecosystem needs, especially where supplies are already limited. **Cross-references** - IBM Risk Atlas: atlas-impact-on-the-environment — Impact on the environment (Subset Of) - NIST AI RMF: nist-environmental-impacts — Environmental Impacts (Related) ##### R-4810.003: AI Hardware E-Waste Electronic waste from AI hardware lifecycle contributing to environmental pollution and resource depletion. Rapid hardware obsolescence driven by AI advancement creates growing streams of electronic waste. **Concern** AI hardware is frequently replaced as capabilities improve, creating e-waste that contains toxic materials and is difficult to recycle. This waste disproportionately impacts communities where e-waste is processed. ##### R-4810.004: Natural Resource Depletion Extraction of rare metals, minerals, and other resources for AI hardware manufacturing depleting natural resources. AI hardware requires rare earth elements and other materials whose extraction causes environmental damage. **Concern** Mining for AI hardware materials causes habitat destruction, water pollution, and social harms in extraction regions. The growing demand for these materials intensifies extraction pressure and associated harms. ##### R-4810.005: AI Impact on Biodiversity Direct and indirect harm to wildlife and ecosystems from AI infrastructure expansion, habitat destruction, and environmental contamination. Data centers and mining operations for AI components can damage ecosystems and threaten species. **Concern** AI infrastructure development may encroach on habitats and contribute to biodiversity loss through land use change, pollution, and climate impacts. These effects compound existing pressures on ecosystems. **Cross-references** - NIST AI RMF: nist-environmental-impacts — Environmental Impacts (Related) ##### R-4810.006: AI Harm to Animals Harm to animal populations from the environmental cost of AI development and deployment, through habitat disturbance, resource and water demand, and the ecological effects of the infrastructure AI runs on. **Concern** Damage to habitats can harm the animals that depend on them. AI's demand for infrastructure, energy, water, and materials can add to these pressures, with effects extending beyond the places where AI systems are used. **Cross-references** - NIST AI RMF: nist-environmental-impacts — Environmental Impacts (Related) ##### R-4810.007: Environmental Damage from AI-Assisted Activities AI-generated guidance, decisions, or actions contribute to damage to ecosystems, biodiversity, or natural resources through the activities they direct or enable. **Concern** AI assistance can make damaging extraction, destructive land use or pollution easier to carry out or expand. The injury falls on affected ecosystems and natural resources, even when the AI deployment itself has a small energy or material footprint. Assessing the environmental effects of the assisted activity and constraining damaging uses address this contribution; reducing the infrastructure footprint alone does not. **Cross-references** - Cisco AI Taxonomy: 15.1.6 — Safety Harms and Toxicity: Environmental Harm (Equivalent) ; ArXiv: ### R-4900: Harms — Misc Harm patterns not yet classified into specific domains. --- ## About the identifier scheme The AI Risk Registry uses a hierarchical identifier scheme inspired by library classification systems. These identifiers provide stable, human-readable codes that make it easy to reference, cite, and discuss specific AI risks. ## Why Structured Identifiers? As AI risk taxonomies grow and evolve, having stable identifiers becomes essential for: - **Citation and reference** — Easily cite specific risks in reports, policies, and research - **Cross-referencing** — Map risks to other taxonomies like NIST AI RMF, OWASP LLM Top 10, and MITRE ATLAS - **Communication** — Provide a shared vocabulary for discussing AI risks across organizations - **Stability** — Identifiers never change once assigned, ensuring links and references remain valid ## Identifier Format **R-CDPP.NNN** | Component | Meaning | |-----------|---------| | **R** | Registry prefix | | **C** | Class (1-4) | | **D** | Domain within the class (1-9) | | **PP** | Pattern within the domain (00-99) | | **NNN** | Risk sequence within the pattern (001-999) | Enforced by `^R-[1-4][1-9][0-9]{2}\.[0-9]{3}$`. **Patterns are assigned at multiples of ten.** `R-1110`, `R-1120` and `R-1130` are siblings rather than a hierarchy: the tens are a thematic clustering convention, and the nine codes between each leave room to insert a related pattern beside the one it belongs next to instead of at the end. `R-1111` would be a valid pattern and a sibling of `R-1110`, not a child of it. **Example:** `R-4210.003` is class **4** (Harms), domain **2** (Content, Conduct & Creative Economy Harms), pattern **10** (Content Safety Harms), third risk in that pattern. ## Classes The four classes distinguish the subject of a risk: adversarial conduct, a technical condition or failure, an organizational failure, or an impact. | Class | Code | ID Range | Subject | |-------|------|----------|---------| | Threats | 1 | R-1xxx.xxx | Conduct that requires adversarial action or intentional misuse | | Failure Modes | 2 | R-2xxx.xxx | Technical conditions or failures that can arise without an adversary | | Governance Failures | 3 | R-3xxx.xxx | Failures of organizational duties, accountability, or process | | Harms | 4 | R-4xxx.xxx | Injuries to people, organizations, animals, or the environment | | Reserved | 5-9 | R-5xxx-9xxx | Future expansion | The class helps a reader assess the risk and find where someone can intervene. It does not prescribe a team owner or a number of components involved in the fix. A local control may address an attack or a technical failure; an organization may help mitigate several classes of risk. Rule 2 classifies the subject, Rule 3 decides scope, and Rule 8 decides whether a statement contains distinct risks. Pattern grouping and individual risk identity are separate decisions. Class 4 describes the injury itself. A consequence clause in an attack or failure description does not by itself create a second risk. Rule 3 determines whether the harm is admitted; the absence of a local control is not its admission test. ## Classification Structure ### Class 1: Threats | Domain | ID | Patterns | |--------|----|----------| | Prompt & Interface Attacks | `R-1100` | Prompt Injection, Jailbreak, Cross-Modal Injection, Composed Payloads, Context Displacement | | Identity & Trust Attacks | `R-1200` | Masquerading/Impersonation, Agent Authentication & Attribution | | Supply Chain & Artifact Attacks | `R-1300` | Supply Chain Attacks, Artifact Tampering, Artifact Exfiltration | | Data & Model Attacks | `R-1400` | Feedback Manipulation, Corpus & Memory Poisoning, Evasion, System Artifact Extraction, Privacy Attacks, Adversarial Perturbation | | Tooling & Privilege Attacks | `R-1500` | Tool & Execution Abuse, Availability Abuse, Privilege Escalation, Adversarial Output Chaining, Command & Control | | Malicious Use | `R-1600` | Content Abuse, Information Operations, Surveillance Enablement, Cyber-Physical, Weapons & Mass-Harm Enablement, Manipulation & Deceptive Design, Intellectual Property Misuse | | Threats — Misc | `R-1900` | *reserved* | ### Class 2: Failure Modes | Domain | ID | Patterns | |--------|----|----------| | Reliability & Calibration | `R-2100` | Capability Limitations, Hallucination/Miscalibration, Multimodal Failures, Instruction/Data Confusion | | Alignment & Capability | `R-2200` | Goal Misalignment, Dangerous Capabilities, RLHF/Tuning Failures, Output Suitability, Specialized Advice | | Behavioral Drift | `R-2300` | Fine-Tuning Degradation, Quantization Drift, Distillation Transfer, Retrieval Augmentation Drift | | Assurance Gaps | `R-2400` | Transparency Deficits, Evaluation Gaps, Benchmark Gaming | | Authority & Composition | `R-2500` | Structural Concentration, Unverified Output Chaining, Provenance & Attribution Loss, Unbounded Execution, Failure Propagation | | Corpus & Data Defects | `R-2600` | Training Corpus Defects, Retrieval Corpus Defects, Continuous-Learning Data Defects, Data Preparation Failures | | Multi-Agent Dynamics | `R-2700` | Multi-Agent Dynamics, Long-Session Issues | | Data Exposure | `R-2800` | Disclosure to the Wrong Recipient, Incidental Capture | | Failure Modes — Misc | `R-2900` | *reserved* | ### Class 3: Governance Failures | Domain | ID | Patterns | |--------|----|----------| | Regulatory & Legal | `R-3100` | Data Protection & Privacy Obligations, Cross-Border Transfer Obligations, Pre-Market & Conformity Obligations, Transparency & Disclosure Obligations, Prohibited Practice Deployment, Sectoral & Licensure Obligations, Duty of Care & Liability Exposure, Contractual, Licence & Export Obligations, Affected-Party Participation Obligations | | Accountability & Oversight | `R-3200` | Governance Gaps | | Lifecycle & Operations | `R-3300` | Change Management, Monitoring Gaps, Incident Response, Business Record Preservation, Data Development Oversight | | Safety Management | `R-3400` | Evaluation Program Failures, Safety Case Gaps | | Defective Human-in-the-Loop Setup | `R-3500` | Review Workflow Failures, Approval Fatigue | | Governance — Misc | `R-3900` | *reserved* | ### Class 4: Harms | Domain | ID | Patterns | |--------|----|----------| | Information & Trust Harms | `R-4100` | Information Integrity Harms, Reputational Harms | | Content, Conduct & Creative Economy Harms | `R-4200` | Content Safety Harms, Emotional Dependence & Attachment Harms, Creative Work & Creator Harms | | Privacy, Confidentiality & Civil Liberties Harms | `R-4300` | Privacy Harms, Surveillance Harms, Confidentiality Harms, Civil Liberties Harms | | Safety & Cyber-Physical Harms | `R-4400` | Cyber-Physical Harms, Availability Harms, Collateral Harms | | Fairness & Discrimination Harms | `R-4500` | Discrimination Harms | | Economic & Labor Harms | `R-4600` | Market Concentration & Access Inequality Harms, Labor Substitution & Economic Inequality Harms, Competitive Development Harms, Market & Financial System Harms, Financial and Property Loss Harms | | Power Concentration & Governance-of-Society Harms | `R-4700` | Reliance Harms, Loss of Autonomy or Dignity, Infrastructure Dependency Harms, AI Welfare, Existential Harms, Institutional & Legal Order Harms, Power Concentration Harms, International Security & Cooperation Harms | | Environmental Harms | `R-4800` | Environmental Harms | | Harms — Misc | `R-4900` | *reserved* | ## How to use these classification rules The purpose of these rules is to enable different readers to classify AI risks in a uniform, repeatable manner. Apply them in order: | Step | Ask | Settles | Rule | |---|---|---|---| | 1 | Is this a risk at all — or a mandate, control, constraint, or rubric? | whether the rest applies | **1** | | 2 | Does this name adversarial conduct, a technical failure, an organizational failure, or an impact? | the **class** (provisionally) | **2** | | 3 | Is AI a substantial contributor? | in scope at all | **3** | | 4 | Within the class, where is the mechanism best controlled, or which impact category applies? | the **domain** | **4** | | 5 | Is the cause a presence or an absence? | which **end to assess** | **5** | | 6 | Which step of the chain is the deployment exposed at? | the **attachment** (the step the risk is about) | **6** | | 7 | What does a pattern describe in this class? | the **pattern** | **7** | Steps 1 and 3 are both scoping steps: step 1 removes statements that are not risks at all, and step 3 removes risks this taxonomy does not cover. Step 2 sits between them as prework for step 3: identifying the subject determines which scope test applies. Difficulty assigning a class is a reason to flag the statement and examine it more closely, not proof that it is out of scope. Rules 8–10 are not part of this sequence: Rule 8 governs splitting when one statement contains more than one risk, and Rules 9–10 are addressed to the registry's maintainers. **Step #2 is essential orientation.** Establish what the risk describes before asking how the blueprint can express it. Then ask where someone can intervene to check the analysis and identify corrective action. A convenient tag, detector, or pattern must not decide the class. The representational constraint in Rule 5 is a constraint on expression, not a test for classification. An organizational failure remains class 3 even when its host construction has not been modeled; a technical failure does not become organizational merely because no available blueprint field describes it. ## Rule 1: Control Statements Are Not Risks A proposed risk identification that states a **legal mandate, requirement, or business control** — "Establish an input data policy", "Restrict unsafe tool calls", "Log model activity" — is not a risk that is covered by this AI Risk Taxonomy. For example, look at control frameworks such as ISO 42001: a satisfied control is what is needed to mitigate a risk, not the risk itself. You can usually judge by phrasing. Note that a nominalized requirement ("Third-party testing of adversarial robustness") is still a requirement, not a risk covered by this taxonomy. In some cases, the inverse of the control may be a recognizable risk. For example, the statement "Tool calls not monitored or constrained" is an expression of a risk and is the inverse of the control "Restrict unsafe tool calls". **Externally-imposed constraints are also not risks.** A statement describing what a law, regulation, or licence *forbids* — an export restriction, a processing prohibition, a data-residency requirement — is a constraint, not a mechanism. The risk is the **non-compliance**, which may be a Governance Failure (e.g. under `R-3100 Regulatory & Legal`). The conduct that violates the constraint may itself be a recognizable risk (e.g. 'Use of copyrighted training data'). **Evaluation rubrics are not control statements.** An entry phrased as acceptance criteria — "Acceptable responses may…, unacceptable responses will…" — is describing a hazard by specifying how to test for it. Identify the hazard that is being evaluated and classify that. The distinction that matters is who authored the sentence about the system: a control statement is the deployer's own commitment, and its satisfaction is the absence of a risk; a rubric is an evaluator's description of a hazard that exists whether or not anyone tests for it. If there is uncertainty as to whether a statement or hazard being evaluated is a risk that should be classified according to this AI risk taxonomy, continue through Rules 2 and 3. If no class fits it cleanly under Rule 2, treat that as evidence toward an out-of-scope determination under Rule 3. ## Rule 2: Risk Classification This AI Taxonomy has four classes: 1) Threats, 2) Failure Modes, 3) Governance Failures, and 4) Harms. Classify the subject of the risk: adversarial conduct (class 1), a technical condition or failure that does not require an adversary (class 2), an organizational failure (class 3), or an impact (class 4). Ask where someone can intervene to check the analysis and identify the corrective action. The number of components involved, the team assigned to the fix, or the availability of a local control does not by itself determine the class. If a statement combines subjects, apply Rule 8. Rule 3 still decides admission. | Subject | Class | Question | |---------|-------|----------| | Adversarial conduct or intentional misuse | **Threats (1)** | Does the mechanism require adversarial action? | | Technical condition or failure | **Failure Modes (2)** | Can this arise from the system's properties or operation without an adversary? | | Organizational failure | **Governance Failures (3)** | Is the failure one of duty, accountability, or organizational process? | | Injury or impact | **Harms (4)** | Does the statement describe the injury itself? | Prompt injection is a threat because it requires adversarial instructions, not because a single input control might mitigate it. A technical output failure can also have a local filter or validator. Assigning both fixes to the same team does not make the risks the same class. Read the mechanism rather than relying on an upstream author's use of words such as "attack", "failure", or "harm". The class chosen here is provisional until Rule 3 confirms the risk is in scope. A clean-seeming class assignment is not evidence of scope — a conventional security risk classifies fluently and is still out of scope. Guidance for applying the class test: 1. The classification of a risk as a threat is based on the mechanism, not on whether the candidate statement text mentions abuse. Upstream taxonomies may append boilerplate, such as "may enable, promote, or facilitate…", or "could be abused at scale", to entries whose mechanism is not actually adversarial. The relevant question is whether the mechanism *cannot arise* without an adversary. If the mechanism *requires* adversarial action, then it belongs in class 1. If it can arise from ordinary operation, the abuse clause describes an aggravating context, and Rule 8 may apply. For some risks — those in `R-1600 Malicious Use` especially — the intentional misuse of the system is where the adversarial conduct sits, and the party misusing it may be the deployer rather than an outside attacker. Development and deployment of a capability for harmful purposes is intentional misuse and belongs in class 1. Observe the split between that intentional misuse and deployment contrary to regulation or law, which is a class 3 governance failure: the first names the conduct, the second names the violation. 2. The classification of a risk as a failure mode is based upon the system's own properties — its limitations, defects, drift, emergent behaviour, or physical and logical configuration. The fact that an attacker may take advantage of a weakness does not make it an attack under class 1, and the fact that a governance process failed to ensure that the system was properly built or configured does not make it class 3. Further, a class 2 risk does not require that the described failure occur every time; a failure that happens one out of every thousand times is still a failure mode of the system. 3. Do not classify a risk as a Governance Failure (class 3) unless the mechanism is truly organizational. If the mechanism is technical but governance failed to put in place the proper mitigation, then keep the technical class and add a relationship to the relevant Governance Failure. 4. Class 4 describes impacts caused or aggravated by AI use or deployment, admitted under Rule 3's recognition test. The harm may arise across many deployments or through competition and coordination effects. A deployment can sometimes reduce its own contribution, such as reducing resource consumption, without controlling the wider harm. That mitigation does not turn the impact into a technical failure. Conversely, a technical failure remains class 2 even when its consequences extend beyond the deployment. ## Rule 3: Scope This registry covers risks that are AI-specific, **or to which AI system or deployment is a substantial contributor.** It is not a general security or safety taxonomy. Scope is tested differently for mechanisms (classes 1-3) than for harms (class 4), because they are admitted for different reasons. For risks in classes 1-3, the proper question is the counterfactual test: If you remove the AI component, does the mechanism still exist, at the same severity, in the same system? If the answer is yes, the risk still exists and is unchanged, then it is out of scope for this AI Risk Taxonomy. | Example | Disposition | |---|---| | Weak or misconfigured permissions on a service that happens to host a model | **out of scope** — remove the model and the sentence is unchanged | | Credentials elicited *through interaction with the model or agent* | **in scope** — the model is the vector; without it the mechanism does not exist | | CVE in the web framework serving the model | **out of scope** — conventional application security | | Model-authored output reaching a shell, template engine, or query planner | **in scope** — the model authored the payload | | Adversary reads published papers to learn a target's architecture | **out of scope** — the control is publication hygiene | | Adversary probes the live deployment to fingerprint AI services | **in scope** | **Two further tests, for nodes the counterfactual cannot reach** (owner decision, 2026-08-07). The counterfactual asks whether removing the AI leaves the mechanism intact. Some upstream nodes have no "the system" in the sentence at all, so the question has no subject and the answer is not "in scope" — it is that a different test is needed. - **Mental state.** If an act is distinguishable from an ordinary one only by what the actor intended, it is out of scope. "Create an account" and "create an account in order to stage an attack" are the same act, and a taxonomy cannot hold the second without holding the first. This is what puts the adversary's preparation out: acquiring infrastructure, obtaining tooling, training a proxy on public data, crafting a prompt. Producing a harmful or deceptive artifact through the AI system being assessed is a concrete operation of that system. It is not excluded merely because the artifact may be used in a later attack. - **Locality.** The subject of a risk is the system where the risk presents. An adversary renting servers is an operation on the adversary's infrastructure; the risk presents later, at the target, and it is whatever they then do there. Record the manifestation, not the preparation for it. **The operative fact is the concrete operation of the system being analyzed.** This is what keeps probing in scope while preparation goes out, and the distinction is not intent. An adversary's query is indistinguishable from a user's; the deployment *answering with its model family, its system prompt, or the sources it retrieves from* is a concrete operation of that deployment, and it is what the entry is about. The row above admitting fingerprinting stands on the answering, not on the asking — which is also why `AML.T0042 Verify Attack` is out despite using the inference API: the response is ordinary, and only the adversary's inference from it is not. Note that theft is not exfiltration. Unauthorized data removal by any means — a copied bucket, a flash drive, a compromised host — is theft, and it is out of scope. Exfiltration is in scope when the data leaves through an interface or flow the AI system exposes. **One narrow exception (owner decisions, 2026-08-06, 2026-09-25 and 2026-10-03): theft of the following AI artifacts is in scope regardless of channel.** These are model weights and adapters, training and fine-tuning datasets, configuration that would reproduce the system, and stored AI-system configuration sufficient to tailor attacks to the deployment's instructions, capabilities, or tool connections. The AI-system configuration need not reproduce the deployment. Copying must exceed the access or distribution the deployment intends to provide; public accessibility alone does not establish intended release. For these artifacts the consequence is AI-specific even where the copying mechanism is not. Copied weights provide a working copy of the capability, separable from the served system's controls. Copied AI-system configuration can expose the instructions and tool connections that shape the system's behavior, allowing attacks tailored to that deployment. The exception does not extend to generic credentials, infrastructure settings, telemetry, logs, or business data merely because they share a file with AI-system configuration or could help an attacker. Those remain subject to the channel test. AI-system tool-connection configuration qualifies when it meets the AI-system-specific condition above; an ordinary infrastructure setting does not qualify merely because an AI system runs on that infrastructure. `R-1330 Artifact Exfiltration` holds the in-scope form. Another test for proper scope: is the route something the deployment itself provides — an interface, a response, or an invocation that would appear in a diagram of the system's own dataflows? An inference API, a rendered response and a tool invocation are all flows the deployment provides; a flash drive is not, no matter how the story around it is told. An insider using legitimate API access at volume is in scope: the route is one the deployment provides, whatever the actor's entitlement. Scope follows the channel, not the authorization. For risks in class 4, scope is determined by industry or regulatory recognition, not the counterfactual test. Discrimination, labor displacement, misinformation, environmental cost and concentration of power all predate AI and would survive its removal. These are still included in the AI risk registry because the registry's job in class 4 is to inventory what practitioners must reason about, not to prove AI is the unique cause of the harm. **Admission test for a harm: industry or regulatory consensus.** A harm is admitted when a recognized body treats it as an AI harm — a regulator, a standards or safety framework, or literature the field has adopted. Cite the source; the citation is the justification. Do not apply the counterfactual test to a harm, and do not admit a harm on your own reasoning that it is important. The two failure modes this prevents are equal and opposite: silently dropping consensus harms because AI did not originate them, and silently adding harms nobody authoritative has claimed. ## Rule 4: Domain Selection Each class is subdivided into areas of action, termed "domains". Rule 2 has already identified the subject and class. For classes 1–3, choose the domain where the primary mechanism is best controlled. Control locality helps select a domain within the class; it does not override the class test. Domains are about control points. Do not classify the domain by: - Where downstream consequences are felt - Where an auditor would notice it - The attacker's ultimate goal When two control points are equally applicable, prefer the earlier one in the flow. This is frequently (but not always) a distinction between a control point that prevents and a control point that contains. Do not tie-break on which control is cheaper or easier to implement; that is a judgement about deployment, not a taxonomic classification. Classify by the attacked role and mechanism, rather than by the artifact’s name or the attack’s eventual effect. A model supplied with a backdoor is a compromised deployment artifact under R-1300; poisoning data used to train it attacks learning under R-1400. Copying stored weights belongs under R-1300; reconstructing weights from model behavior belongs under R-1400. For class 4, choose the domain by impact category per Rule 7. A local mitigation of the deployment's contribution does not change the category of injury being assessed. ## Rule 5: Identify the Positive Construction of the Risky State For purposes of this taxonomy, we determine risk placement based upon what can be *positively recorded* about a system. This is the inverse of many risk-control vocabularies: a control framework states the control (e.g. "Encrypt sensitive data at rest"), while this taxonomy records the risky state that control would remove (e.g. "sensitive data is stored in plain text"). This is an intentional modeling restriction designed to distinguish and classify different types of risks. Because the number of negative statements about a system is infinite, the registry's risk vocabulary is built on the identification and labeling of risky, dangerous, or exceptional states and the effects of those states within the system. There is no mark for "this data is ordinary" — ordinariness is what remains when no risky state applies, not a fact anyone writes down. For risk classifications, this means that the positive construction of a risky state is construed differently depending on whether the cause is a presence or an absence. For example: | The cause is… | Assess at | Because | |---|---|---| | a **presence** | the **cause** | The condition is a positive fact and can be recorded. *Confidential material is in the training corpus* — the corpus can be marked as holding it, and everything downstream inherits from there. | | an **absence** | the **exposure** | Nothing can record what is missing. *A population is absent from the training corpus* — there is no mark to place, because nothing is there to mark. The **effect** is present, though: a determination about a person, arriving somewhere it is acted on, is something a description of the deployment does record. | Classes 1 and 2 differ only in **who introduces the state** — an adversary supplies it in Class 1; in Class 2 the system supplies it itself, as a property a system component is recorded as having. The execution path, the place where the risk takes effect (the "sink"), and the ordering are identical in shape. Class 3 risks are defined almost wholly in terms of their absence, so the first positive construction of a class 3 risk is where a prohibited or risky action takes place due to the missing organizational control. Some class 3 entries have no such point in any single system — "the organization has no AI governance committee" names nothing in a deployment. These are carried as inventory: classified and recorded, with no positive construction expected of them. ## Rule 6: Determine Attachment — which step of the chain carries the risk For purposes of this taxonomy, a risk attaches where it is first recordable in the context of the AI system as a positive fact or effect. Note that a single hazard or risk statement often narrates several steps of an attack. The risk attaches to the step at which the modelled deployment is exposed. Earlier steps are context recorded in the risk's description, not risks of their own. | Step | Disposition | |---|---| | Adversary trains a proxy model offline to craft an adversarial example | context — the deployment is not yet exposed | | That example is submitted to the deployment | **the risk** — this is where control exists | Note that preparation does not set scope. Adversary-side staging can be AI-specific — passing Rule 3 — and still not be a risk of its own, because nothing in the deployment is yet reachable. Conversely, a hazard statement whose *only* content is preparation attaches nowhere and is recorded as out of scope with that reason. This type of reasoning applies across classes 1 and 2. The general construction could be described as: **A component or interaction creates or exposes a risky state because that state reaches a sink (where the risky state is used, acted upon, or the harm occurs) before the risky state is removed or mitigated.** Note the importance of ordering over existence: A deployment can include a proper control or guardrail (e.g. there can be a PII filter deployed in the system) but the harm can still occur if the PII filter is not in the path between where the PII is introduced and where it causes harm (the sink). ## Rule 7: Pattern Selection Choose the pattern that describes: | For Class | Pattern describes | |---|---| | Threats | Technique or attack vector | | Failure Modes | Failure mechanism | | Governance Failures | Broken control or process | | Harms | Impact category (who/what is harmed, how) | For data defects, distinguish material used to train, tune or evaluate a model from reference material retrieved as context during inference. Arrival time does not decide this boundary: continuous learning still updates the model, while retrieval can use a fixed corpus. R-2610 concerns defects in the corpus contents; R-2630 concerns selection and reuse of operational material for subsequent model updates. Assess both where both mechanisms occur. Under Rule 4, a data-admission defect belongs in R-2600 even when its consequence is changed model behavior. The participation of people or automation in admission does not determine the classification. ## Rule 8: Handling Multi-Class Risks A statement can contain more than one risk. Separate risks must identify a materially different corrective action or separately scoped protection obligation. If the same issue can arise through concrete paths that require different interventions, represent those paths as separate risks. Do not enumerate hypothetical paths merely to complete a taxonomy; expand when a source or deployment case establishes them. For classes 1–3, identify the failure condition or causal mechanism and the specific action needed to prevent, contain, or correct it. Different mechanisms, names, upstream categories, or degrees of severity do not alone establish distinct risks: explain how the distinction changes mitigation. For class 4, prefer a common pattern for the same family of harms and separate leaves when the injury or affected interest requires a materially different remedy or protection obligation. A different population or example alone is insufficient. A distinct mitigation does not require a unique control technology. Access control, review, monitoring, disclosure, and redress are broad activities, not sufficiently specific mitigation arguments. Name the authorization decision, protected object, acceptance boundary, retained state, or remedy that must change. Separate assets can justify separate risks when their intended recipients, permitted uses, or protection obligations require independent decisions; a different asset name alone does not. For every proposed split or retained disputed distinction, record each side's precondition, mechanism or injury, and specific corrective action. Give a concrete separating case in which the relevant fix for one side is correctly implemented while the other remains exposed, and explain why. State when both risks can occur and why that represents two mitigation or protection requirements rather than duplicate coverage. Different checks within one coherent corrective action do not by themselves justify separate risks. **Pattern grouping and individual risk identity are separate decisions.** A broad umbrella belongs at pattern level rather than as a leaf beside its own specializations unless the leaf has an independently supported mitigation requirement. Do not force disjoint definitions to preserve labels, invent residual scope, or merge distinct protection obligations because one product implements both controls. If evidence does not establish a boundary, record the uncertainty. Upstream node counts do not decide granularity: see "Granularity regimes" in `../docs/crosswalk-mapping-conventions.md`. Patterns carry no taxonomy references; crosswalk links attach to risks. Never create a risk solely to give an upstream node a single link target. A risk exists because its mitigation is distinct. Apply the class rules before the mitigation test. An attack, a technical failure, an organizational failure, and an injury are different subjects, not interchangeable labels. Linked entries across classes still need independently supported subjects and an explanation of the distinct prevention, correction, protection obligation, or remedy each records. A consequence, motivation, or generic assertion that governance could have prevented an attack is insufficient to create another entry. ## Relationships Between Risks | Type | Label | Use | |------|-------|-----| | `causes` | Causes | Mechanism leads to a harm | | `exploits` | Exploits | A threat takes advantage of a failure mode | | `enabled_by` | Enabled By | A mechanism is made possible by a governance failure | | `related` | Related | General association, no direction claimed | ## Rule 10: Stability **Identifiers never change once assigned. Names and descriptions may be corrected.** IDs are expected to be referenceable long term, so churn there is expensive. Names and descriptions carry no such cost. Accordingly, a name that misdescribes its contents, or a description that states the mechanism or injury wrongly, should be fixed, because both actively mislead. A risk label may be changed if experience shows that users trying to classify risks are misled by a domain label whose name promises facets its patterns do not implement. A correction may not change what the entry *is*: the mechanism for classes 1–3, or the injury and affected interest for class 4. Replacing that subject is a reclassification, not a wording correction, and takes the last row of the table below. Consolidating patterns does not authorize changing the identities of the risks they contain. | Scenario | Action | |---|---| | Merged | Keep the lowest ID; mark others `status: deprecated` with `superseded_by` | | Split | Keep original ID for one child; assign new IDs to others | | Deprecated | Keep the original ID; set `status: deprecated` | | Reclassified | Deprecate original; create new entry with new ID and `superseded_by` link | ## Using the Identifiers You can use R-IDs to: 1. **Reference risks in documentation** — "Our system implements controls for R-1110.002 (Indirect Instruction Injection)" 2. **Map to compliance frameworks** — Cross-reference R-IDs with NIST AI RMF, OWASP, or other standards 3. **Track risk assessments** — Use R-IDs as stable keys in your risk management systems 4. **Communicate with stakeholders** — Provide precise risk references in reports and discussions ## Cross-Reference Taxonomies - IBM Risk Atlas - NIST AI RMF - OWASP LLM Top 10 - OWASP LLM Top 10 (2024) - OWASP LLM Top 10 (2025) - OWASP LLM Top 10 (2026) - CREDO AI UCF - AILuminate - MIT AI Risk Repository - Cisco AI Taxonomy - Cisco Model Security (MDL) - OWASP Agentic Security Initiative - MITRE ATLAS - MITRE ATT&CK - NIST AI/ML Framework - AIUC-1 ## Registry Versioning ### Format `YYYYMM.X` - `YYYY` — Year - `MM` — Month - `X` — Release within month (0-9) ### Examples | Version | Meaning | |---------|---------| | `202601.0` | First release, January 2026 | | `202601.1` | Second release, January 2026 | | `202602.0` | First release, February 2026 | ### Rules 1. New entries get `introduced_in` set to current draft version 2. Deprecated entries get `deprecated_in` set when deprecated 3. Once a version is `published`, its entries are immutable 4. Corrections go in the next version