aisecurityrisks.com

# register·15 risks·21 documented cases (12 incidents)·checked Nov. 15, 2026

AI security risks, with the sources left in

Each risk links to the incidents and research behind it, the current OWASP, MITRE ATLAS and NIST IDs, and controls you can start on. Pick the AI your organization uses and get a register you can export.

Build your registerRead the 15 risks

What AI does your organization use?

opens the register builder with that use selected

use: employee-chatStaff use public AI chat toolsuse: saas-copilotsAI features inside SaaS you already useuse: coding-assistantsAI coding assistants and coding agentsuse: rag-appA chatbot or search over your own documentsuse: agents-mcpAgents that call tools or MCP serversuse: self-hostedHosting or fine-tuning models yourselfuse: customer-botA customer-facing chatbot

The register

R-number·risk·OWASP 2026 ID

  • R-01 Prompt injection

    Text the model reads changes what it does, whether a user typed it or it arrived hidden in a page, email, file or tool output.

    applies to 6 of 7 uses·cases 11 (4 incidents)

    LLM01:2026ASI01

  • R-02 Sensitive information disclosure

    Confidential, regulated or secret data comes out of an AI system to someone who shouldn't have it.

    applies to 6 of 7 uses·cases 3 (0 incidents)

    LLM02:2026ASI06

  • R-03 Excessive agency

    An AI system has more tools, permissions or autonomy than its job needs, so one bad output turns into a damaging action.

    applies to 4 of 7 uses·cases 4 (1 incident)

    LLM03:2026ASI02ASI03

  • R-04 AI supply chain compromise

    A model, dataset, package, extension or plug-in you pull in is malicious, tampered with or not what it claims to be.

    applies to 4 of 7 uses·cases 6 (4 incidents)

    LLM04:2026ASI04

  • R-05 Data and model poisoning

    Someone tampers with training, fine-tuning or retrieval data so the model learns a backdoor, a bias or a wrong answer.

    applies to 2 of 7 uses·cases 0

    LLM05:2026ASI06

  • R-06 Unbounded consumption and model theft

    Uncontrolled use of an AI service runs up costs, knocks it over, or lets someone copy the model through its outputs.

    applies to 4 of 7 uses·cases 2 (2 incidents)

    LLM06:2026ASI02

  • R-07 Misinformation and overreliance

    A model produces something wrong that looks credible, and a person or system acts on it.

    applies to 4 of 7 uses·cases 1 (0 incidents)

    LLM07:2026ASI08ASI09

  • R-08 Hidden context exposure

    System prompts, tool schemas or other hidden instructions get extracted, along with any secrets someone put in them.

    applies to 4 of 7 uses·cases 1 (0 incidents)

    LLM08:2026ASI06ASI07

  • R-09 Vector and embedding weaknesses

    The retrieval layer behind a RAG app returns the wrong documents, leaks across permissions, or can be poisoned.

    applies to 3 of 7 uses·cases 2 (0 incidents)

    LLM09:2026ASI06

  • R-10 Improper output handling

    Model output is passed to a browser, shell, database or code without being treated as untrusted input.

    applies to 4 of 7 uses·cases 3 (0 incidents)

    LLM10:2026ASI02ASI05

  • R-11 MCP and agent tool poisoning

    A tool or MCP server an agent trusts carries hidden instructions, changes after approval, or is malicious outright.

    applies to 2 of 7 uses·cases 2 (1 incident)

    ASI04ASI02

  • R-12 Memory and context poisoning

    Planted content gets saved into an assistant's memory or long-lived context and quietly shapes later answers and actions.

    applies to 3 of 7 uses·cases 2 (1 incident)

    ASI06

  • R-13 Shadow AI and data shared with AI tools

    Staff put company or customer data into AI tools the organization hasn't approved or set up, under terms nobody reviewed.

    applies to 3 of 7 uses·cases 0

  • R-14 Attackers using AI against you

    Deepfaked voices and faces, AI-written phishing, and malware or intrusions run with help from AI models.

    applies to everyone·cases 3 (3 incidents)

  • R-15 Exposed AI infrastructure and stolen AI keys

    AI services, clusters or API keys are reachable from the internet or leaked, and someone else uses them.

    applies to 4 of 7 uses·cases 4 (4 incidents)

Latest documented cases

all 21 cases →
  • Incidentdisclosed Sept. 8, 2026·AML.CS0076

    Industrial-scale distillation of U.S. models

    NSA, CISA and the FBI say six named China-based AI companies collected outputs from U.S. models over millions of exchanges, from at least late 2024, and used them to train their own models.

    The advisory asks model providers to watch for anomalous accounts and usage, rate-limit, verify identities, log telemetry and share intelligence across providers.

    risks: Unbounded consumption and model theft

    Sources: NSA, CISA and FBI; MITRE ATLAS AML.CS0076

  • Incidentdisclosed July 16, 2026·AML.CS0068

    Malicious dataset used to break into Hugging Face clusters

    Hugging Face says a malicious dataset used two code-execution paths in its dataset processing, a remote-code loader and a template injection in a dataset configuration, to run code on a worker. The intruder then harvested credentials and moved into several internal clusters over a weekend.

    Hugging Face reports access to some internal datasets and service credentials, and no tampering with public models, datasets or Spaces. It closed both paths and rotated credentials. Its post does not name the attacker. MITRE's case study attributes the activity to autonomous agents from OpenAI cyber evaluations.

    risks: AI supply chain compromise, Exposed AI infrastructure and stolen AI keys

    Sources: Hugging Face; MITRE ATLAS AML.CS0068

  • Research demodisclosed June 5, 2026·AML.CS0067

    CI secret read through a coding agent's file tool

    Microsoft researchers hid instructions in GitHub issue and pull request text processed by Anthropic's Claude Code GitHub Action. Secret scrubbing covered shell commands, but the agent's in-process Read tool could open /proc/self/environ and expose the workflow's API key.

    Microsoft reported it on April 29, 2026 and Anthropic fixed it on May 5 by blocking sensitive /proc files (Claude Code 2.1.128). Microsoft's advice: never give one workflow untrusted input, secrets and outbound communication at the same time.

    risks: Prompt injection, Hidden context exposure, Excessive agency

    Sources: Microsoft Threat Intelligence; MITRE ATLAS AML.CS0067

  • Research demodisclosed Feb. 19, 2026·AML.CS0062

    Prompt to code execution in Semantic Kernel's vector search

    In the Python version of Microsoft's Semantic Kernel, the default filter for in-memory vector search built a Python lambda from model-controlled values and ran it with eval(). A crafted prompt got past the blocklist and ran code on the host.

    Fixed in semantic-kernel 1.39.4 (CVE-2026-26030). Microsoft's lesson: any tool parameter the model can influence is attacker-controlled input.

    risks: Improper output handling, Excessive agency, Prompt injection

    Sources: Microsoft Security; NIST National Vulnerability Database; MITRE ATLAS AML.CS0062

Pinned framework versions

Framework IDs change between editions. The register pins each one so a mapping you export today still means the same thing next year. OWASP's main web page still showed the 2025 LLM list when we checked on November 15, 2026, so the 2026 IDs here come from OWASP's 2026 PDF.

See the crosswalk or what changed in the 2026 OWASP list.

OWASP LLM
Top 10 for LLM Applications 2026 (Aug. 3, 2026)
OWASP ASI
Top 10 for Agentic Applications 2026 (Dec. 9, 2025)
MITRE ATLAS
Release 2026.10 (Oct. 28, 2026)
NIST
AI 600-1, Generative AI Profile (July 2024)