What this is
A sourced log of publicly reported incidents involving AI agents: vulnerabilities that security researchers disclosed or demonstrated, and real-world failures and misuse reported by vendors, affected users, or the press. Each entry records what a cited source reports and maps it to controls that could prevent, detect, or support recovery from that kind of failure: NIST AI RMF subcategories, NIST SP 800-53 controls, and whether a human-approval (JCR) checkpoint applies. These mappings are editorial judgments, not findings about what any party should have done.
The goal is practical: show which controls matter for agents that take actions, using reported incidents and demonstrated vulnerabilities rather than hypotheticals. Entries describe events and systems. They do not assign fault to any person or company.
See the method for what gets included and how entries are sourced and mapped, and the controls page for incidents grouped by control.
Cyber incidents
The tracker also lists a small number of cyber incidents (IDs starting CYB-). One is included only when it shares a CVE, vendor, product or technique with an AI incident in the tracker; this is not a general breach database. Each cyber incident links to the AI incident it shares something with, and every link states its reason and cites a source. A link records co-occurrence, not cause.
Each CVE is checked against the CISA Known Exploited Vulnerabilities (KEV) catalog, and the page shows the catalog version checked. KEV data is published by CISA under CC0 1.0. Its use here does not imply any endorsement by CISA or DHS.
Technique IDs come from MITRE ATT&CK. © The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. See the ATT&CK terms of use.
Who runs it
Owner: Chuck Orlowski.
Corrections
If an entry is wrong, out of date, or unfair, send the incident ID and a source. Changes to an entry's facts are logged in its corrections history, not silently edited.
Corrections contact: corrections@trulysovereign.com