Method

What gets included

• Only AI agents that take actions: systems that call tools, run code or commands, read or change data, or send, publish, or buy on someone's behalf. Chatbots that only produce text for a person to read are out of scope.
• Only publicly reported incidents: real-world failures and misuse, and vulnerabilities that researchers disclosed or demonstrated, including proofs of concept. No hypotheticals and no unpublished findings.

Cyber incidents and correlation links

• Scope: a cyber incident (CYB-NNN) is added only if it shares a CVE, vendor, product or technique with an AI incident (AIA-NNN) in the tracker. Every cyber record must link to at least one AI record. The tracker is not a general breach database.
• Cyber incidents follow the same rules as AI incidents: a working primary source, factual wording that does not assign fault, NIST SP 800-53 controls and the JCR checkpoint. NIST AI RMF mapping is optional for them.
• Each link has a type (same technique, same CVE, same vendor, same campaign, or AI used in attack), a one-sentence rationale and a source. The source supports the linked incident's side of the comparison; the incident's own side is cited in its sources. A link is written on one record, and the build shows it on both pages, marked derived on the other. The build rejects links to unknown incidents, self-links, and links without a rationale or source.
• A link records co-occurrence, not cause. A shared vendor or technique does not mean one incident led to the other.
• CVEs are checked against the CISA Known Exploited Vulnerabilities (KEV) catalog. Each entry records the catalog version and the date checked, and shows either "Listed in CISA KEV" with the date CISA added it, or "Not in CISA KEV as of catalog" that version. KEV data is CC0 1.0; no CISA endorsement is implied.
• Techniques are mapped to MITRE ATT&CK IDs (and MITRE ATLAS IDs where one applies), linked to the technique's page. Like the control mappings, these are editorial judgments. ATT&CK notice: see About.

Sources

• Every incident cites a primary source: a vendor advisory or CVE, the researcher's own write-up, a court record, or the affected party's own statement. No incident is added without a source that loads.
• A secondary news source is allowed when the original won't load (for example, a post that only renders with JavaScript). The original stays listed and is marked unchecked; the news source is labelled secondary.
• An automated link check is scheduled weekly against every source link and fails when a checked link stops working. To mark a failed link on its entry, the maintainer reruns the check with npm run links -- --update and rebuilds the site. Failed links are marked, not silently removed. When a source moves, the entry links to the same article at its new address and the change is logged as a correction.
• Dates and summaries marked unverified have not yet been rechecked against their source.

Wording

• Factual and attributed: entries say what the source reports ("X reported…"), in 60 words or fewer.
• Never accuse a person. No claims of negligence or fault, and no adjectives about people or companies.
• No copying beyond short quotes.

Control mapping

1. Identify the failure point: untrusted input (prompt injection), excess privilege, an unreviewed destructive or outbound action, supply chain, or missing monitoring.
2. NIST AI RMF: pick up to three subcategories whose outcome, if met, removes that failure point.
3. NIST SP 800-53: name up to four controls that could have prevented or detected it, or supported recovery.
4. JCR checkpoint: applies when the harm needed an irreversible or externally visible agent action (delete, publish, pay, send, run a shell command, privileged query) and a human approval before it could have stopped it; partial when an approval step existed but could be bypassed; not applicable for read-path harms, where the damage happened while the agent was reading or answering, and for attacker-operated agents.

Mappings are judgment calls. A reviewer can disagree through a correction.

Corrections

Changed facts are logged in the entry's corrections history.

Corrections contact: corrections@trulysovereign.com