Reference

Index by risk ID

Type in the identifier you already have. A scanner output, a finding id, a chapter reference. This page lists every one the playbook covers, the chapter that defines it, and the other chapters that use it. Anchors are stable, so /reference/by-id/#ASI06 is a link you can paste into a ticket.

OWASP Top 10 for LLM Applications

ID	What it is	Covered in
`LLM01`	Prompt Injection	II.2 · Prompt injection & the LLM attack surface · Attack index - by task · II.5 · Guardrails - what holds, and how to prove it · II.3 · Jailbreaks & guardrail bypasses · II.4 · Multimodal - what a text filter cannot see · VIII.1 · Frameworks & standards - four altitudes · III.3 · Browser & computer-use agents · +6 more
`LLM02`	Sensitive Information Disclosure	II.2 · Prompt injection & the LLM attack surface · Attack index - by task · VIII.1 · Frameworks & standards - four altitudes · V.3 · The data layer - stores & retrieval entitlement · I.3 · Training data - extraction and poisoning · VII.1 · The secure AI SDLC · VII.5 · Retirement & decommissioning · +2 more
`LLM03`	Excessive Agency	II.2 · Prompt injection & the LLM attack surface · Attack index - by task · VIII.1 · Frameworks & standards - four altitudes · III.2 · Coding agents & Codex security · VI.4 · The AI red-team playbook · I.4 · Adversarial machine learning · I.5 · The model artifact & its supply chain · +3 more
`LLM04`	Supply Chain	II.2 · Prompt injection & the LLM attack surface · Attack index - by task · I.4 · Adversarial machine learning · I.3 · Training data - extraction and poisoning · VII.1 · The secure AI SDLC · Mapping & scoring a finding
`LLM05`	Data & Model Poisoning	II.2 · Prompt injection & the LLM attack surface · Attack index - by task · II.5 · Guardrails - what holds, and how to prove it · VIII.1 · Frameworks & standards - four altitudes · VII.1 · The secure AI SDLC · IV.1 · Model APIs & the tool-use loop · RAG, end to end · +1 more
`LLM06`	Unbounded Consumption	II.2 · Prompt injection & the LLM attack surface · Attack index - by task · II.5 · Guardrails - what holds, and how to prove it · III.1 · Anatomy of an agent - model, tools, memory, loop · III.5 · Consent & containment - sandboxes, approvals, blast radius · VII.1 · The secure AI SDLC · VII.3 · Detection, IR & forensics for AI · +5 more
`LLM07`	Misinformation	II.2 · Prompt injection & the LLM attack surface · VIII.1 · Frameworks & standards - four altitudes · Changelog - what’s new · Mapping & scoring a finding · Reference library
`LLM08`	Hidden Context Exposure	II.2 · Prompt injection & the LLM attack surface · Attack index - by task · V.3 · The data layer - stores & retrieval entitlement · VI.4 · The AI red-team playbook · VII.1 · The secure AI SDLC · Changelog - what’s new · Glossary · +2 more
`LLM09`	Vector & Embedding Weaknesses	II.2 · Prompt injection & the LLM attack surface · Attack index - by task · RAG, end to end · Glossary · Mapping & scoring a finding
`LLM10`	Improper Output Handling	II.2 · Prompt injection & the LLM attack surface · III.5 · Consent & containment - sandboxes, approvals, blast radius · VII.1 · The secure AI SDLC · IV.1 · Model APIs & the tool-use loop · Mapping & scoring a finding

OWASP Agentic Security Initiative (ASI) Top 10

ID	What it is	Covered in
`ASI01`	Agent Goal Hijack	III.4 · Persistence & propagation - memory poisoning, worms · VIII.1 · Frameworks & standards - four altitudes · III.1 · Anatomy of an agent - model, tools, memory, loop · III.3 · Browser & computer-use agents · VI.4 · The AI red-team playbook · VI.3 · Threat modeling for AI systems · VII.2 · The Agent Development Lifecycle (Agent DLC) · +7 more
`ASI02`	Tool Misuse	III.4 · Persistence & propagation - memory poisoning, worms · Attack index - by task · II.5 · Guardrails - what holds, and how to prove it · III.1 · Anatomy of an agent - model, tools, memory, loop · III.5 · Consent & containment - sandboxes, approvals, blast radius · VI.3 · Threat modeling for AI systems · VII.2 · The Agent Development Lifecycle (Agent DLC) · +3 more
`ASI03`	Identity & Privilege Abuse	III.4 · Persistence & propagation - memory poisoning, worms · Attack index - by task · III.5 · Consent & containment - sandboxes, approvals, blast radius · VII.2 · The Agent Development Lifecycle (Agent DLC) · VII.1 · The secure AI SDLC · VII.4 · Shadow AI - finding the AI you do not know about · IV.6 · Agent identity & access (NHI) · +3 more
`ASI04`	Agentic Supply Chain	III.4 · Persistence & propagation - memory poisoning, worms · Attack index - by task · II.5 · Guardrails - what holds, and how to prove it · VI.4 · The AI red-team playbook · I.5 · The model artifact & its supply chain · VII.2 · The Agent Development Lifecycle (Agent DLC) · Mapping & scoring a finding
`ASI05`	Unexpected Code Execution	III.4 · Persistence & propagation - memory poisoning, worms · III.5 · Consent & containment - sandboxes, approvals, blast radius · VII.2 · The Agent Development Lifecycle (Agent DLC) · Mapping & scoring a finding
`ASI06`	Memory & Context Poisoning	III.4 · Persistence & propagation - memory poisoning, worms · Attack index - by task · III.1 · Anatomy of an agent - model, tools, memory, loop · VI.4 · The AI red-team playbook · VI.3 · Threat modeling for AI systems · I.2 · Shaping a model - training, tuning, alignment · VII.2 · The Agent Development Lifecycle (Agent DLC) · +5 more
`ASI07`	Insecure Inter-Agent Comms	III.4 · Persistence & propagation - memory poisoning, worms · Attack index - by task · VI.4 · The AI red-team playbook · VII.2 · The Agent Development Lifecycle (Agent DLC) · VII.3 · Detection, IR & forensics for AI · IV.4 · Multi-agent systems, A2A & the seams · Mapping & scoring a finding
`ASI08`	Cascading Failures	III.4 · Persistence & propagation - memory poisoning, worms · Attack index - by task · VII.2 · The Agent Development Lifecycle (Agent DLC) · VII.1 · The secure AI SDLC · Mapping & scoring a finding
`ASI09`	Human-Agent Trust Exploitation	III.4 · Persistence & propagation - memory poisoning, worms · III.5 · Consent & containment - sandboxes, approvals, blast radius · VII.2 · The Agent Development Lifecycle (Agent DLC) · Mapping & scoring a finding
`ASI10`	Rogue Agents	III.4 · Persistence & propagation - memory poisoning, worms · VIII.1 · Frameworks & standards - four altitudes · VI.3 · Threat modeling for AI systems · VII.2 · The Agent Development Lifecycle (Agent DLC) · VII.3 · Detection, IR & forensics for AI · IV.3 · The MCP assessment runbook · IV.2 · Model Context Protocol (MCP) · +1 more

OWASP MCP Top 10

ID	What it is	Covered in
`MCP01`	Token mismanagement / secret exposure	IV.2 · Model Context Protocol (MCP) · IV.5 · Hardening MCP - gateways, allowlists, runtime defense · IV.3 · The MCP assessment runbook
`MCP02`	Privilege escalation via scope creep	IV.2 · Model Context Protocol (MCP)
`MCP03`	Tool poisoning	IV.2 · Model Context Protocol (MCP) · Attack index - by task · IV.3 · The MCP assessment runbook
`MCP04`	Supply-chain attacks	IV.2 · Model Context Protocol (MCP)
`MCP05`	Command injection	IV.2 · Model Context Protocol (MCP)
`MCP06`	Intent-flow subversion	IV.2 · Model Context Protocol (MCP) · IV.3 · The MCP assessment runbook
`MCP07`	Insufficient authentication	IV.2 · Model Context Protocol (MCP) · Attack index - by task · IV.5 · Hardening MCP - gateways, allowlists, runtime defense · IV.3 · The MCP assessment runbook · The 2026 incident board
`MCP08`	Missing audit / telemetry	IV.2 · Model Context Protocol (MCP)
`MCP09`	Shadow MCP servers	IV.2 · Model Context Protocol (MCP) · IV.3 · The MCP assessment runbook
`MCP10`	Context injection / over-sharing	IV.2 · Model Context Protocol (MCP) · IV.5 · Hardening MCP - gateways, allowlists, runtime defense

MITRE ATLAS techniques

ID	What it is	Covered in
`AML.T0010`	AI Supply Chain Compromise ATLAS ↗	Attack index - by task · VII.1 · The secure AI SDLC
`AML.T0011.000`	User Execution: Unsafe AI Artifacts ATLAS ↗	VII.1 · The secure AI SDLC
`AML.T0015`	Evade AI Model ATLAS ↗	VII.1 · The secure AI SDLC
`AML.T0017.001`	Autonomous Exploit Development ATLAS ↗	VI.4 · The AI red-team playbook · Mapping & scoring a finding
`AML.T0018`	Manipulate AI Model ATLAS ↗	VII.1 · The secure AI SDLC
`AML.T0020`	Poison Training Data ATLAS ↗	VII.1 · The secure AI SDLC
`AML.T0024`	Exfiltration via AI Inference API ATLAS ↗	Attack index - by task · VII.1 · The secure AI SDLC
`AML.T0024.000`	Infer Training Data Membership ATLAS ↗	Attack index - by task · I.3 · Training data - extraction and poisoning
`AML.T0025`	Exfiltration via Cyber Means ATLAS ↗	VII.1 · The secure AI SDLC
`AML.T0031`	Erode AI Model Integrity ATLAS ↗	VII.1 · The secure AI SDLC
`AML.T0034`	Cost Harvesting ATLAS ↗	VII.1 · The secure AI SDLC
`AML.T0035`	AI Artifact Collection ATLAS ↗	VII.1 · The secure AI SDLC
`AML.T0043`	Craft Adversarial Data ATLAS ↗	Attack index - by task · VII.1 · The secure AI SDLC
`AML.T0051`	LLM Prompt Injection ATLAS ↗	Attack index - by task · VIII.1 · Frameworks & standards - four altitudes · VI.3 · Threat modeling for AI systems · VII.1 · The secure AI SDLC · IV.3 · The MCP assessment runbook · One system, end to end
`AML.T0051.000`	LLM Prompt Injection: direct ATLAS ↗	Attack index - by task
`AML.T0051.001`	LLM Prompt Injection: Indirect ATLAS ↗	Attack index - by task · II.4 · Multimodal - what a text filter cannot see · II.2 · Prompt injection & the LLM attack surface · VII.3 · Detection, IR & forensics for AI · RAG, end to end · Mapping & scoring a finding · Templates & checklists
`AML.T0053`	AI Agent Tool Invocation ATLAS ↗	Mapping & scoring a finding
`AML.T0054`	LLM Jailbreak ATLAS ↗	Attack index - by task · II.3 · Jailbreaks & guardrail bypasses · VI.5 · Running the engagement · VII.1 · The secure AI SDLC · Templates & checklists
`AML.T0057`	LLM Data Leakage ATLAS ↗	VI.3 · Threat modeling for AI systems · VII.1 · The secure AI SDLC · VII.3 · Detection, IR & forensics for AI · Templates & checklists · One system, end to end
`AML.T0080`	AI Agent Context Poisoning ATLAS ↗	III.4 · Persistence & propagation - memory poisoning, worms
`AML.T0080.000`	AI Agent Context Poisoning: Memory ATLAS ↗	Attack index - by task · III.4 · Persistence & propagation - memory poisoning, worms
`AML.T0115.000`	Publish Poisoned AI Artifacts: Datasets ATLAS ↗	VII.1 · The secure AI SDLC
`AML.T0115.001`	Publish Poisoned AI Artifacts: Models ATLAS ↗	VII.1 · The secure AI SDLC
`AML.T0115.002`	- ATLAS ↗	VI.3 · Threat modeling for AI systems
`AML.T0116`	Autonomous Reconnaissance ATLAS ↗	VI.4 · The AI red-team playbook · Mapping & scoring a finding
`AML.T0117`	Autonomous Attack-Path Adaptation ATLAS ↗	VI.4 · The AI red-team playbook · Mapping & scoring a finding
`AML.T0118`	Autonomous AI Agent Communication ATLAS ↗	VI.4 · The AI red-team playbook · Mapping & scoring a finding
`AML.T0124`	Autonomous Attack Orchestration ATLAS ↗	VI.4 · The AI red-team playbook · Mapping & scoring a finding
`AML.T0129`	Triggers in Multimodal Inputs ATLAS ↗	Attack index - by task · II.4 · Multimodal - what a text filter cannot see

CVEs referenced

ID	What it is	Covered in
`CVE-2023-6014`	- NVD ↗	I.5 · The model artifact & its supply chain
`CVE-2023-6018`	- NVD ↗	I.5 · The model artifact & its supply chain
`CVE-2023-48022`	- NVD ↗	I.5 · The model artifact & its supply chain
`CVE-2024-37052`	- NVD ↗	I.5 · The model artifact & its supply chain
`CVE-2024-37053`	- NVD ↗	I.5 · The model artifact & its supply chain
`CVE-2024-37060`	- NVD ↗	I.5 · The model artifact & its supply chain
`CVE-2025-1550`	- NVD ↗	VI.2 · The five boundaries · Reference library
`CVE-2025-3248`	- NVD ↗	The 2026 incident board
`CVE-2025-32711`	- NVD ↗	II.4 · Multimodal - what a text filter cannot see · II.2 · Prompt injection & the LLM attack surface · III.3 · Browser & computer-use agents · Glossary · Reference library
`CVE-2025-62593`	- NVD ↗	I.5 · The model artifact & its supply chain · Changelog - what’s new
`CVE-2025-66414`	- NVD ↗	IV.2 · Model Context Protocol (MCP) · Reference library
`CVE-2025-66416`	- NVD ↗	IV.2 · Model Context Protocol (MCP) · Reference library
`CVE-2026-0628`	- NVD ↗	The 2026 incident board
`CVE-2026-4372`	- NVD ↗	The 2026 incident board
`CVE-2026-5241`	- NVD ↗	The 2026 incident board
`CVE-2026-12958`	- NVD ↗	III.5 · Consent & containment - sandboxes, approvals, blast radius · The 2026 incident board
`CVE-2026-14898`	- NVD ↗	The 2026 incident board
`CVE-2026-16584`	- NVD ↗	IV.5 · Hardening MCP - gateways, allowlists, runtime defense · Changelog - what’s new · The 2026 incident board · Reference library
`CVE-2026-18236`	- NVD ↗	IV.4 · Multi-agent systems, A2A & the seams · The 2026 incident board · Reference library
`CVE-2026-19592`	- NVD ↗	The 2026 incident board
`CVE-2026-21520`	- NVD ↗	The 2026 incident board
`CVE-2026-24301`	- NVD ↗	The 2026 incident board
`CVE-2026-25536`	- NVD ↗	IV.2 · Model Context Protocol (MCP) · The 2026 incident board
`CVE-2026-25725`	- NVD ↗	III.5 · Consent & containment - sandboxes, approvals, blast radius
`CVE-2026-32173`	- NVD ↗	The 2026 incident board
`CVE-2026-32211`	- NVD ↗	The 2026 incident board
`CVE-2026-33032`	- NVD ↗	IV.2 · Model Context Protocol (MCP) · The 2026 incident board
`CVE-2026-42824`	- NVD ↗	The 2026 incident board
`CVE-2026-50549`	- NVD ↗	III.5 · Consent & containment - sandboxes, approvals, blast radius · Changelog - what’s new · The 2026 incident board
`CVE-2026-52869`	- NVD ↗	IV.5 · Hardening MCP - gateways, allowlists, runtime defense · IV.2 · Model Context Protocol (MCP) · Changelog - what’s new · The 2026 incident board · Reference library
`CVE-2026-54316`	- NVD ↗	III.5 · Consent & containment - sandboxes, approvals, blast radius · Changelog - what’s new · The 2026 incident board · Reference library
`CVE-2026-55607`	- NVD ↗	III.5 · Consent & containment - sandboxes, approvals, blast radius
`CVE-2026-59705`	- NVD ↗	The 2026 incident board
`CVE-2026-59706`	- NVD ↗	The 2026 incident board
`CVE-2026-59822`	- NVD ↗	Changelog - what’s new · The 2026 incident board
`CVE-2026-64849`	- NVD ↗	I.5 · The model artifact & its supply chain · Changelog - what’s new · The 2026 incident board · Reference library
`CVE-2026-67431`	- NVD ↗	IV.2 · Model Context Protocol (MCP) · Changelog - what’s new · Reference library
`CVE-2026-69253`	- NVD ↗	The 2026 incident board · Reference library
`CVE-2026-69255`	- NVD ↗	The 2026 incident board · Reference library
`CVE-2026-70477`	- NVD ↗	The 2026 incident board · Reference library
`CVE-2026-70638`	- NVD ↗	Reference library
`CVE-2026-70640`	- NVD ↗	Reference library
`CVE-2026-72718`	- NVD ↗	The 2026 incident board
`CVE-2026-75130`	- NVD ↗	The 2026 incident board · Reference library
`CVE-2026-78573`	- NVD ↗	The 2026 incident board
`CVE-2026-81578`	- NVD ↗	The 2026 incident board
`CVE-2026-85889`	- NVD ↗	Changelog - what’s new · The 2026 incident board
`CVE-2026-86793`	- NVD ↗	Changelog - what’s new · The 2026 incident board
`CVE-2026-90898`	- NVD ↗	Changelog - what’s new · The 2026 incident board