genai-incidents 2.13.0

One queryable index of AI security incidents, vulnerabilities, and red-team findings,
normalized onto the OWASP Top 10 for LLM Applications, the OWASP Top 10 for Agentic Applications, NIST AI RMF, and MITRE ATLAS.

🔎 Browse the site · ⚡ Quick start · 📚 Docs · 📝 Cite · 🤝 Contribute

genai_incidents is a consolidated, machine-readable index of publicly disclosed security incidents, vulnerabilities, and red-team findings involving generative-AI and agentic-AI systems. It pulls together AIID, OECD AIM, AIAAIC, MITRE ATLAS, NVD/GHSA/OSV, and researcher and vendor write-ups and maps them onto the same security taxonomies, so you can query and pivot across sources that don't share a schema.

⚠️ Important — read this before citing a number. genai_incidents is not a complete census of every AI incident. Most taxonomy and severity labels are assigned by deterministic heuristics, not human review. A count like "N incidents tagged LLM01" is a labeling artifact of what the heuristics matched across whichever sources happened to be aggregated — it is not a measured rate of how often that failure mode occurs in the real world. This is the datasheet's own warning, not a paraphrase of it: see Limitations & biases for the full statement and known gaps.

📊 At a glance

The landmark tier is the headline-citation set: rows that are hand-curated, catalogued in the AI Incident Database, or AI-harm cases. Every other row is the feed, mainly the CVE/GHSA/OSV advisory stream plus OECD-sourced rows. It is a derived field and is not the same axis as quality_tier (see docs/DATA_DICTIONARY.md's tier field for the exact definition). Cite the landmark count, not the full corpus, when you mean "headline incidents."

_{Charts are regenerated on every build. They show what the aggregated sources contain and what the heuristics matched — not real-world rates (see the note above).}

👀 Explore it

_{The website: search, filter by year, severity, OWASP code, vector, corpus or quality tier, expand any entry, and deep-link the result. Screenshot taken 2026-09-30.}

⚡ Quick start

Python

pip install genai-incidents

from genai_incidents import query, by_cve, resolve_id

for inc in query(severity="Critical", attack_vector="prompt-injection", year=2026):
    print(inc["id"], "-", inc["title"])

print(by_cve("CVE-2026-21520"))   # all incidents that list this CVE
print(resolve_id("INC-00139"))    # follow merge history to the current canonical INC

Hugging Face

from datasets import load_dataset
ds = load_dataset("emmanuelgjr/genai-incidents")

Raw JSON

curl -sL https://raw.githubusercontent.com/emmanuelgjr/genai_incidents/main/data/incidents.json -o incidents.json

Every way to get it

_{A real excerpt from the published STIX 2.1 bundle (INC-00924, captured 2026-09-30; elided fields shown as …). Each incident is an x-genai-incident SDO linked to MITRE ATLAS attack-patterns and CVE vulnerability objects.}

🚨 Latest release

2.13.0 — released 2026-10-13. Export integrity, a taxonomy refresh and a set of honesty corrections; no entry was added or removed (the counts above are unchanged from v2.12.0). (1) Export integrity: SHA256SUMS now covers the STIX bundle, the TAXII collection and the MISP feed, build_manifest.json ships on every channel, and the GitHub Release now carries assets. STIX modified and the MISP event timestamp are derived from the data, so every STIX object that persists has a new modified and a client that dedupes on (id, modified) will re-import them; retired objects are absent, not revoked, so prune against the current bundle. (2) MITRE ATLAS 2026.06 to 2026.09: thousands of entries were re-mapped (AML.T0058 and AML.T0019 are replaced by AML.T0115.*; filters on the old ids must change), and taxonomy_versions is now published. (3) CVE disputes: 22 entries that rest only on CVEs disputed upstream are now status: disputed (still counted in incident_count, confidence lowered one level). (4) Behaviour changes for consumers: load_deprecations() returns a different value for five keys (use resolve_id() or the new resolve_id_status()); tier, quality_tier, corpus and content_license now move updated; the served incidents.core.json gains status. (5) Mapping and IDs: the ASI mapping is now named "OWASP Top 10 for Agentic Applications" and re-pinned to its 2026 edition (a metadata relabel, 0 entries change; that one mapping file is CC BY-SA 4.0 for the OWASP codes and names, the dataset stays CC BY 4.0); the published IDs that used to resolve to silence, including nine never recorded before, now have records; and the "IDs are never reused" claim was corrected (retired IDs are never reissued, but some live IDs have carried more than one title across releases). Known limitations, as of this release: the OECD/AIID refresh is frozen on purpose (stage 1 of a deliberate freeze, not a stall); the AIRI Navigator ingest is dead and its rows are marked stale, with a human review committed for 2027-01-07; the precision measurement is pending human labels (the sample is drawn, no figure is published, and the pending state is ratified), so no precision figure exists. See docs/releases/v2.13.0.md for the full disclosure and the re-derivation recipe for every figure. Previous release, v2.12.0 (2026-10-04): three new sources (AVID, cvelistV5 with the huntr CNA slice, arXiv cs.CR metadata; all quality_tier: auto, tier: feed, not human-reviewed) and a retraction mechanism: entries whose CVEs the CVE Program REJECTED are status: retracted (nothing deleted). Breaking for some consumers: incident_count counts only incidents that stand, and retracted_count is published beside it; load_incidents() and the slim JSON include the retracted rows (filter on status). The STIX/TAXII OWASP LLM source_name became owasp-llm-top10-2026 (re-import advised). See docs/releases/v2.12.0.md. Previous release, v2.11.0 (2026-10-01): a 47-split remediation (board ruling D28) undid a query-string over-merge in normalize_url(), growing the corpus by 301 entries; four IDs were permanently retired (INC-00311, INC-00554, INC-00754, INC-01897) and a fifth, INC-07738, stops resolving to itself via an ordinary merge. Every retired ID still resolves through data/id_deprecations.json (nine pre-tombstone IDs are a known exception, docs/ID_POLICY.md §1.4(a)). Twelve IDs change their resolve_id() answer — if you cached old mappings, re-resolve them — and load_deprecations() values are now str | list[str], so upgrade the package and data together. See docs/releases/v2.11.0.md. Previous release, v2.10.0 (2026-09-18): A silent breaking change for anyone matching on owasp_llm code strings: every code was migrated from the OWASP Top 10 for LLM Applications 2025 edition to the 2026 edition. The code space is identical before and after, so LLM03 is still valid and now means Excessive Agency instead of Supply Chain — nothing errors, nothing fails validation. Concretely: a filter on LLM03 matched roughly eight times as many rows at v2.9.0 as it matches today — the release notes give both exact counts and the command to re-derive them. Data at or before v2.9.0, including its Zenodo deposits, carries 2025 codes; the crosswalk is mappings/owasp_llm_2025_to_2026.json. Also fixed eight weeks of silently-dead weekly refreshes, an 800 KB page truncation that dropped ~38 incidents per run, and the OECD crawl budget. Exactly one corpus row changed, at the time of that cut — INC-11516's description had the query string of an expired pre-signed URL removed. The v2.10.0 release notes are at docs/releases/v2.10.0.md; CHANGELOG.md carries both entries.

✨ How it differs from AIID / MIT AI Risk Repository / AVID

AIID, the MIT AI Risk Repository, and AVID are themselves primary or aggregated incident trackers, and this dataset draws on several of them as upstream sources (see docs/SOURCE_LICENSES.md) rather than replacing them. What this project adds is normalization onto security-oriented taxonomies (OWASP Top 10 for LLM Applications, OWASP Top 10 for Agentic Applications, NIST AI RMF, MITRE ATLAS) across sources that don't share a common schema. A full side-by-side positioning comparison is planned but not yet written.

Beyond the obvious title/description/severity fields, a few worth knowing about before you build on this data:

• 🔗 Tombstones, never deletions — merged or withdrawn IDs are never dropped; they redirect (or terminate) via data/id_deprecations.json, so a citation of any ID this project has ever published resolves to something, never to silence. resolve_id() returns one ID or None; resolve_id_status(id, release=None) says why for every ID: a single successor, a split group with its set, a successor per cited release, or an explicit withdrawal (since v2.13.0; ID_POLICY.md §8). See docs/ID_POLICY.md for the ID-stability commitment.
• 🏷️ content_license — a row-level marker on entries whose upstream source imposes its own attribution/share-alike obligation on that specific row, carried through the full JSON, the Hugging Face export, and the STIX bundle (as x_content_license). Its absence means no known obligation, not a guarantee the row is unencumbered.
• 🕰️ source_status / source_freshness — whether a row is still emitted by a build and whether the upstream source that fed it is still refreshing are tracked as two separate, independent facts. A committed ingest snapshot keeps re-emitting its rows every build even after the source that produced them goes dark, so a row being present is never itself a freshness claim — source_freshness is the field that actually says so, and it's published at data/source_freshness.json.
• ✅ quality_tier / confidence — vetting level (curated / reviewed / auto) and a rule-derived confidence tier, so you can filter to only human/assisted-reviewed entries instead of the full heuristic-labeled corpus.
• 🧾 A public evidence trail — docs/audits/ is unusual for a dataset repo, and deliberately so: rather than folding a licensing ruling or a data-migration rationale into a doc that then has to be kept perpetually current, each is a dated, standalone record of what was true and why a decision was made — worth a look if you want the reasoning behind a change, not just its result.

Full field reference: docs/DATA_DICTIONARY.md.

🧭 Taxonomies mapped

See docs/TAXONOMIES.md for a chooser table and the full code lists.

🎯 What counts as an incident?

Every entry must satisfy three gates, defined precisely in INCLUSION.md — the authoritative scope contract this project's own ingesters and reviewers decide against, not a keyword list. In gist (not a substitute for the real thing):

1. a real AI-nexus — the AI/ML system is the target, the vector, or a material enabler of harm, not an incidental mention;
2. security or safety relevance — a vulnerability, exploit, attack, misuse, or real-world harm, not a feature or benchmark;
3. at least one citable primary source.

Broad fairness/bias-only harms with no security primitive are out of scope; see INCLUSION.md for the full definition and worked examples.

🌐 Sources aggregated

Each entry retains links back to the originating advisory, post, or paper. Headline sources: AIID, OECD AIM, AIAAIC, MITRE ATLAS, AVID, NVD / GHSA / OSV / CISA KEV, garak, promptfoo, plus dozens of researcher blogs, vendor threat reports, and academic papers.

If a source is missing or mis-attributed, open an issue or PR. One tracked source is currently stale (MIT AIRI Navigator's public bulk download was withdrawn; the corpus keeps re-emitting its last-fetched snapshot, unshrunk, under a dated hold) — see data/source_freshness.json for the reviewed, published status of every source this project actively monitors.

🧱 Reference

{
  "id": "INC-00001",                 // incident ID; a past release may have used it for a different incident (CORRECTIONS.md, 2026-10-10) — see docs/ID_POLICY.md §4 and §8
  "source_ids": ["AIID-123", "CVE-2025-..."],
  "cve_ids": ["CVE-2025-..."],
  "cwe_ids": ["CWE-918"],
  "cvss_score": 9.8,
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "aiid_id": 1234,                   // canonical AIID numeric ID when applicable
  "title": "...",
  "date": "2025-09",
  "disclosure_date": "2025-10-02",   // separate from incident date when known
  "year": 2025,
  "category": "real-world | research | red-team | vulnerability-disclosure | threat-report | policy",
  "description": "...",
  "attack_vector": "prompt-injection | rce | supply-chain | data-exfiltration | ...",
  "affected": "vendor/product",
  "impact": "...",
  "severity": "Critical | High | Medium | Low | Info",
  "owasp_llm": ["LLM01", "LLM06"],
  "owasp_asi": ["ASI01", "ASI02"],
  "nist_ai_rmf": ["MEASURE-2.7", "MAP-3.5"],
  "mitre_atlas": ["AML.T0051", "AML.T0051.001"],
  "mitre_atlas_tactics": ["AML.TA0004"],
  "maestro_layers": [{"layer":"L3","label":"Agent Frameworks & Tooling","role":"origin"}],
  "mitigations": ["..."],
  "references": [
    {"title":"Vendor advisory","url":"https://...","type":"vendor"}
  ],
  "tags": ["mcp","supply-chain"],
  "added": "2026-05-16",             // stable across re-runs
  "updated": "2026-05-16",           // only bumped when content actually changes
  "quality_tier": "curated | reviewed | auto",   // vetting level — see docs/DATA_DICTIONARY.md
  "content_license": null            // present only when this row owes an upstream attribution/share-alike obligation
}

.
├── data/
│   ├── incidents.json          ← the full, authoritative dataset (use this)
│   ├── incidents.min.json      ← slim variant: id, title, taxonomy mappings, primary reference
│   ├── stats.json              ← the single source of every published count (invariant 6)
│   ├── id_deprecations.json    ← merged/withdrawn ID redirects and tombstones
│   ├── source_freshness.json   ← reviewed registry of which sources have stopped refreshing
│   └── legacy_consolidated.json ← intermediate output from the legacy parser
├── schema/
│   └── incident.schema.json    ← JSON Schema for one incident
├── mappings/
│   ├── owasp_llm_top10_2026.json
│   ├── owasp_llm_top10_2025.json
│   ├── owasp_llm_2025_to_2026.json ← crosswalk for the v2.10.0 code migration
│   ├── owasp_asi_top10.json
│   ├── nist_ai_rmf.json
│   ├── mitre_atlas.json
│   ├── cwe_capec.json
│   ├── cwe_attack_vector.json
│   ├── veris.json
│   └── maestro_layers.json
├── legacy/                     ← original source files (preserved verbatim)
├── ingest/                     ← per-source aggregator outputs (CVE, AIID, ATLAS, etc.)
├── scripts/
│   ├── parse_existing.py             ← parse legacy/ → data/legacy_consolidated.json
│   ├── ingest_external.py            ← parse cloned source repos under ../_external/ → ingest/*.json
│   ├── ingest_aiid_snapshot.py       ← AIID official weekly snapshot (sanctioned bulk channel) → ingest/aiid_full.json
│   ├── scrape_aiid.py                ← RETIRED per-page scrape (kept only as a reused parsing-logic library; disabled in Makefile)
│   ├── ingest_airi_navigator.py      ← MIT FutureTech AI Risk Navigator CSV → ingest/airi_navigator_incidents.json
│   ├── ingest_aiaaic_sheet.py        ← AIAAIC Repository public Google Sheet → ingest/aiaaic_sheet_incidents.json
│   ├── ingest_oecd_aim.py            ← OECD AI Incidents Monitor (large page crawl) → ingest/oecd_aim_full_incidents.json
│   ├── ingest_cve_nvd_expanded.py    ← pull AI-relevant CVEs from NVD/GHSA/OSV → ingest/cve_nvd_expanded.json
│   ├── ingest_cisa_kev.py            ← CISA Known Exploited Vulnerabilities catalog (enrichment only)
│   ├── merge_and_dedupe.py           ← merge legacy + ingest/* → data/incidents.json
│   ├── render_markdown.py            ← data/incidents.json → INCIDENTS.md + data/stats.json + docs/charts/*.svg
│   ├── render_docs_stats.py          ← templates data/stats.json's counts into README/DATASHEET/site/CITATION.cff (invariant 6)
│   ├── check_stats_drift.py          ← CI gate: fails on any doc surface out of sync with data/stats.json, or a hardcoded total
│   ├── export_stix.py / export_taxii.py / export_misp.py / export_huggingface.py  ← format exporters
│   └── validate.py                   ← validate JSON against schema
├── INCIDENTS.md                ← rendered index: unified table, newest-first
├── docs/incidents/<year>.md    ← per-year detail shards linked from INCIDENTS.md
├── docs/audits/                ← dated project decision records (licensing, data, conduct)
├── tests/                      ← pytest suite for merge/render/export/ingest-conduct helpers
├── LICENSE                     ← MIT (covers code in scripts/, schema/, src/)
├── LICENSE-DATA                ← CC-BY-4.0 (covers the dataset under data/) — see Licensing below for exceptions
└── README.md

pip install -r requirements.txt
make build      # parse legacy, merge + dedupe, render, template doc stats (invariant 6), validate
make test       # pytest tests/
make ingest-all # (heavy: refresh AIID/AIRI/AIAAIC/OECD AIM/NVD from network)

python scripts/parse_existing.py     # legacy/ -> data/legacy_consolidated.json
python scripts/merge_and_dedupe.py   # legacy + ingest/* -> data/incidents.json
python scripts/render_markdown.py    # data/incidents.json -> INCIDENTS.md + docs/incidents/<year>.md + data/stats.json
python scripts/render_docs_stats.py  # data/stats.json -> templated counts in README/DATASHEET/site/CITATION.cff
python scripts/check_stats_drift.py  # CI gate: fails on drift or an unmarked hardcoded total
python scripts/validate.py           # schema check

📚 Documentation & policies

🤝 Contributing

PRs welcome — corrections, missing incidents, and new sources especially. Please:

• Add at least one verifiable URL per entry.
• Map to the four core taxonomies where applicable (MAESTRO and VERIS are not contributor-set — see CONTRIBUTING.md). If unsure, leave the field empty rather than guess.
• Run scripts/validate.py and scripts/render_markdown.py before opening a PR.
• For incidents you authored or first reported, that's totally fine — but please link the canonical writeup.

Found something wrong in an existing entry? Open a data correction or a scope dispute.

⚖️ Licensing

MIT for code (scripts/, schema/, src/genai_incidents/) — LICENSE. CC-BY-4.0 for the dataset and documentation (data/, INCIDENTS.md, mappings/, docs/) — LICENSE-DATA. Neither of those is the whole story:

• Two verbatim text bodies are Apache-2.0, not CC-BY-4.0, and are not relicensed by it: MITRE ATLAS case-study text and NVIDIA garak probe docstrings, each reproduced under its own upstream license with its own attribution requirement that stays attached to that material specifically.
• One mapping file is CC BY-SA 4.0 in part: mappings/owasp_asi_top10.json is CC-BY-SA-4.0 AND CC-BY-4.0 — CC BY-SA 4.0 for the OWASP ASI codes and risk names, from the OWASP Top 10 for Agentic Applications (Version 2026, December 2025), and CC BY 4.0 for this project's own descriptions. See NOTICE-DATA.
• AIAAIC-derived rows (a CC BY-SA 4.0, share-alike source) carry a row-level content_license marker — machine-readable, naming AIAAIC as the attribution/share-alike target on the specific rows it applies to, mirrored into the STIX export as x_content_license. This is a per-row obligation honored proactively, not a dataset-wide CC-BY-SA carve-out.
• The OECD AI Incidents and Hazards Monitor (AIM) is, with AIAAIC and AIID, one of three upstream sources whose row text could not simply be carried under the source's own licence grant. Its description field on AIM-sourced rows is reduced to structural facts and a source link rather than AIM's own LLM-generated summary text, and every AIM-sourced row carries a per-entry OECD attribution citation. The title field on those same rows is not covered by that reduction and remains a separate, open question.
• AIID, despite also being a CC BY-SA source, is a resolved question, not an open one for the population this project ships — the legal analysis concludes no row-level marker is owed there. The two sources reach different outcomes under the same kind of license grant for reasons specific to each maker's legal situs, not because one was treated more carefully than the other.

None of the above is exhaustive, and stating exact per-source row counts here would only drift out of sync with the audit that actually tracks them. NOTICE-DATA and docs/SOURCE_LICENSES.md are the authoritative, currently-maintained accounts of every source's terms, this project's remediation for each, and the current per-source figures — read those, not this summary, before making a decision that depends on the details.

How to cite

• Citing the dataset as a whole (statistics, trend analysis, benchmark construction, or other aggregate use): cite this repository using the preferred citation in CITATION.cff, or the DOI badge above.
• Citing an individual incident: cite that incident's own primary source, not this repository. Every incident entry links to its underlying source(s) in its References section — use that link (or, for AIID-derived entries, the AIID citation URL already shown on the entry) as the citation. Citing genai_incidents alone for a single incident credits this aggregator instead of the reporter, researcher, or outlet who actually surfaced it.
• Concept DOI vs. version DOI: the DOI badge and CITATION.cff (10.5281/zenodo.20248675) are Zenodo's concept DOI — it always resolves to the latest release, and is the one to cite for general or ongoing use. Cite a release's own version-specific DOI only when deliberately pinning to that exact version (e.g. reproducing a result against a specific snapshot); see that release's own Zenodo record for its version DOI.