Reference

Index by risk ID

Type in the identifier you already have. A scanner output, a finding id, a chapter reference. This page lists every one the playbook covers, the chapter that defines it, and the other chapters that use it. Anchors are stable, so /reference/by-id/#ASI06 is a link you can paste into a ticket.

OWASP Top 10 for LLM Applications

ID	What it is	Covered in
`LLM01`	Prompt Injection	II.2 · Prompt injection & the LLM attack surface · II.5 · Guardrails - what holds, and how to prove it · II.3 · Jailbreaks & guardrail bypasses · II.4 · Multimodal - what a text filter cannot see · VIII.1 · Frameworks & standards - four altitudes · III.3 · Browser & computer-use agents · VI.4 · The AI red-team playbook · +3 more
`LLM02`	Sensitive Info Disclosure	II.2 · Prompt injection & the LLM attack surface · V.3 · The data layer - stores & retrieval entitlement · I.3 · Training data - extraction and poisoning · VII.1 · The secure AI SDLC · VII.5 · Retirement & decommissioning
`LLM03`	Supply Chain	II.2 · Prompt injection & the LLM attack surface · III.2 · Coding agents & Codex security · VI.4 · The AI red-team playbook · I.4 · Adversarial machine learning · I.5 · The model artifact & its supply chain · VII.1 · The secure AI SDLC · VII.4 · Finding the AI you do not know about
`LLM04`	Data & Model Poisoning	II.2 · Prompt injection & the LLM attack surface · I.4 · Adversarial machine learning · I.3 · Training data - extraction and poisoning · VII.1 · The secure AI SDLC
`LLM05`	Improper Output Handling	II.2 · Prompt injection & the LLM attack surface · II.5 · Guardrails - what holds, and how to prove it · VII.1 · The secure AI SDLC · IV.1 · Model APIs & the tool-use loop
`LLM06`	Excessive Agency	II.2 · Prompt injection & the LLM attack surface · II.5 · Guardrails - what holds, and how to prove it · III.1 · Anatomy of an agent - model, tools, memory, loop · III.5 · Consent & containment - sandboxes, approvals, blast radius · VII.1 · The secure AI SDLC · VII.3 · Detection, IR & forensics for AI · VII.4 · Finding the AI you do not know about · +3 more
`LLM07`	System Prompt Leakage	II.2 · Prompt injection & the LLM attack surface · VI.4 · The AI red-team playbook · VII.1 · The secure AI SDLC · Glossary
`LLM08`	Vector & Embedding Weaknesses	II.2 · Prompt injection & the LLM attack surface · V.3 · The data layer - stores & retrieval entitlement · VI.4 · The AI red-team playbook · VII.1 · The secure AI SDLC
`LLM09`	Misinformation	II.2 · Prompt injection & the LLM attack surface · Glossary
`LLM10`	Unbounded Consumption	II.2 · Prompt injection & the LLM attack surface · III.5 · Consent & containment - sandboxes, approvals, blast radius · VII.1 · The secure AI SDLC · IV.1 · Model APIs & the tool-use loop

OWASP Agentic Security Initiative (ASI) Top 10

ID	What it is	Covered in
`ASI01`	Agent Goal Hijack	III.4 · Persistence & propagation - memory poisoning, worms · VIII.1 · Frameworks & standards - four altitudes · III.1 · Anatomy of an agent - model, tools, memory, loop · III.3 · Browser & computer-use agents · VI.4 · The AI red-team playbook · VI.3 · Threat modeling for AI systems · VII.2 · The Agent Development Lifecycle (Agent DLC) · +6 more
`ASI02`	Tool Misuse	III.4 · Persistence & propagation - memory poisoning, worms · II.5 · Guardrails - what holds, and how to prove it · III.1 · Anatomy of an agent - model, tools, memory, loop · III.5 · Consent & containment - sandboxes, approvals, blast radius · VI.3 · Threat modeling for AI systems · VII.2 · The Agent Development Lifecycle (Agent DLC) · VII.1 · The secure AI SDLC · +1 more
`ASI03`	Identity & Privilege Abuse	III.4 · Persistence & propagation - memory poisoning, worms · III.5 · Consent & containment - sandboxes, approvals, blast radius · VII.2 · The Agent Development Lifecycle (Agent DLC) · VII.1 · The secure AI SDLC · VII.4 · Finding the AI you do not know about · IV.6 · Agent identity & access (NHI) · IV.5 · Hardening MCP - gateways, allowlists, runtime defense · +1 more
`ASI04`	Agentic Supply Chain	III.4 · Persistence & propagation - memory poisoning, worms · II.5 · Guardrails - what holds, and how to prove it · VI.4 · The AI red-team playbook · I.5 · The model artifact & its supply chain · VII.2 · The Agent Development Lifecycle (Agent DLC)
`ASI05`	Unexpected Code Execution	III.4 · Persistence & propagation - memory poisoning, worms · III.5 · Consent & containment - sandboxes, approvals, blast radius · VII.2 · The Agent Development Lifecycle (Agent DLC)
`ASI06`	Memory & Context Poisoning	III.4 · Persistence & propagation - memory poisoning, worms · III.1 · Anatomy of an agent - model, tools, memory, loop · VI.4 · The AI red-team playbook · VI.3 · Threat modeling for AI systems · I.2 · Shaping a model - training, tuning, alignment · VII.2 · The Agent Development Lifecycle (Agent DLC) · VII.3 · Detection, IR & forensics for AI · +2 more
`ASI07`	Insecure Inter-Agent Comms	III.4 · Persistence & propagation - memory poisoning, worms · VI.4 · The AI red-team playbook · VII.2 · The Agent Development Lifecycle (Agent DLC) · VII.3 · Detection, IR & forensics for AI · IV.4 · Multi-agent systems, A2A & the seams
`ASI08`	Cascading Failures	III.4 · Persistence & propagation - memory poisoning, worms · VII.2 · The Agent Development Lifecycle (Agent DLC) · VII.1 · The secure AI SDLC
`ASI09`	Human-Agent Trust Exploitation	III.4 · Persistence & propagation - memory poisoning, worms · III.5 · Consent & containment - sandboxes, approvals, blast radius · VII.2 · The Agent Development Lifecycle (Agent DLC)
`ASI10`	Rogue Agents	III.4 · Persistence & propagation - memory poisoning, worms · VI.3 · Threat modeling for AI systems · VII.2 · The Agent Development Lifecycle (Agent DLC) · VII.3 · Detection, IR & forensics for AI · IV.3 · The MCP assessment runbook · IV.2 · Model Context Protocol (MCP)

OWASP MCP Top 10

ID	What it is	Covered in
`MCP01`	Token mismanagement / secret exposure	IV.2 · Model Context Protocol (MCP) · IV.5 · Hardening MCP - gateways, allowlists, runtime defense · IV.3 · The MCP assessment runbook
`MCP02`	Privilege escalation via scope creep	IV.2 · Model Context Protocol (MCP)
`MCP03`	Tool poisoning	IV.2 · Model Context Protocol (MCP) · IV.3 · The MCP assessment runbook
`MCP04`	Supply-chain attacks	IV.2 · Model Context Protocol (MCP)
`MCP05`	Command injection	IV.2 · Model Context Protocol (MCP)
`MCP06`	Intent-flow subversion	IV.2 · Model Context Protocol (MCP) · IV.3 · The MCP assessment runbook
`MCP07`	Insufficient authentication	IV.2 · Model Context Protocol (MCP) · IV.5 · Hardening MCP - gateways, allowlists, runtime defense · IV.3 · The MCP assessment runbook · The 2026 incident board
`MCP08`	Missing audit / telemetry	IV.2 · Model Context Protocol (MCP)
`MCP09`	Shadow MCP servers	IV.2 · Model Context Protocol (MCP) · IV.3 · The MCP assessment runbook
`MCP10`	Context injection / over-sharing	IV.2 · Model Context Protocol (MCP) · IV.5 · Hardening MCP - gateways, allowlists, runtime defense

MITRE ATLAS techniques

ID	What it is	Covered in
`AML.T0010`	AI Supply Chain Compromise ATLAS ↗	VII.1 · The secure AI SDLC
`AML.T0011.000`	User Execution: Unsafe AI Artifacts ATLAS ↗	VII.1 · The secure AI SDLC
`AML.T0015`	Evade AI Model ATLAS ↗	VII.1 · The secure AI SDLC
`AML.T0018`	Manipulate AI Model ATLAS ↗	VII.1 · The secure AI SDLC
`AML.T0019`	Publish Poisoned Datasets ATLAS ↗	VII.1 · The secure AI SDLC
`AML.T0020`	Poison Training Data ATLAS ↗	VII.1 · The secure AI SDLC
`AML.T0024`	Exfiltration via AI Inference API ATLAS ↗	VII.1 · The secure AI SDLC
`AML.T0025`	Exfiltration via Cyber Means ATLAS ↗	VII.1 · The secure AI SDLC
`AML.T0031`	Erode AI Model Integrity ATLAS ↗	VII.1 · The secure AI SDLC
`AML.T0034`	Cost Harvesting ATLAS ↗	VII.1 · The secure AI SDLC
`AML.T0035`	AI Artifact Collection ATLAS ↗	VII.1 · The secure AI SDLC
`AML.T0043`	Craft Adversarial Data ATLAS ↗	VII.1 · The secure AI SDLC
`AML.T0051`	LLM Prompt Injection ATLAS ↗	VIII.1 · Frameworks & standards - four altitudes · VI.3 · Threat modeling for AI systems · VII.1 · The secure AI SDLC · IV.3 · The MCP assessment runbook · One system, end to end
`AML.T0051.001`	LLM Prompt Injection: indirect ATLAS ↗	VII.3 · Detection, IR & forensics for AI · Templates & checklists
`AML.T0054`	LLM Jailbreak ATLAS ↗	VI.5 · Running the engagement · VII.1 · The secure AI SDLC
`AML.T0054.001`	LLM Jailbreak: multi-turn ATLAS ↗	VI.5 · Running the engagement · Templates & checklists
`AML.T0057`	LLM Data Leakage ATLAS ↗	VI.3 · Threat modeling for AI systems · VII.1 · The secure AI SDLC · VII.3 · Detection, IR & forensics for AI · Templates & checklists · One system, end to end
`AML.T0058`	Publish Poisoned Models ATLAS ↗	VII.1 · The secure AI SDLC

CVEs referenced

ID	What it is	Covered in
`CVE-2023-6014`	- NVD ↗	I.5 · The model artifact & its supply chain
`CVE-2023-6018`	- NVD ↗	I.5 · The model artifact & its supply chain
`CVE-2023-48022`	- NVD ↗	I.5 · The model artifact & its supply chain
`CVE-2024-37052`	- NVD ↗	I.5 · The model artifact & its supply chain
`CVE-2024-37053`	- NVD ↗	I.5 · The model artifact & its supply chain
`CVE-2024-37060`	- NVD ↗	I.5 · The model artifact & its supply chain
`CVE-2025-1550`	- NVD ↗	VI.2 · The five boundaries · Reference library
`CVE-2025-3248`	- NVD ↗	The 2026 incident board
`CVE-2025-32711`	- NVD ↗	II.4 · Multimodal - what a text filter cannot see · II.2 · Prompt injection & the LLM attack surface · III.3 · Browser & computer-use agents · Glossary · Reference library
`CVE-2025-66414`	- NVD ↗	IV.2 · Model Context Protocol (MCP) · Reference library
`CVE-2025-66416`	- NVD ↗	IV.2 · Model Context Protocol (MCP) · Reference library
`CVE-2026-4372`	- NVD ↗	The 2026 incident board
`CVE-2026-5241`	- NVD ↗	The 2026 incident board
`CVE-2026-12958`	- NVD ↗	III.5 · Consent & containment - sandboxes, approvals, blast radius · The 2026 incident board
`CVE-2026-16584`	- NVD ↗	IV.5 · Hardening MCP - gateways, allowlists, runtime defense · Changelog - what’s new · The 2026 incident board · Reference library
`CVE-2026-21520`	- NVD ↗	The 2026 incident board
`CVE-2026-25536`	- NVD ↗	IV.2 · Model Context Protocol (MCP) · The 2026 incident board
`CVE-2026-25725`	- NVD ↗	III.5 · Consent & containment - sandboxes, approvals, blast radius
`CVE-2026-32173`	- NVD ↗	The 2026 incident board
`CVE-2026-32211`	- NVD ↗	The 2026 incident board
`CVE-2026-33032`	- NVD ↗	IV.2 · Model Context Protocol (MCP) · The 2026 incident board
`CVE-2026-42824`	- NVD ↗	The 2026 incident board
`CVE-2026-50549`	- NVD ↗	III.5 · Consent & containment - sandboxes, approvals, blast radius · Changelog - what’s new · The 2026 incident board
`CVE-2026-52869`	- NVD ↗	IV.5 · Hardening MCP - gateways, allowlists, runtime defense · Changelog - what’s new · The 2026 incident board · Reference library
`CVE-2026-54316`	- NVD ↗	III.5 · Consent & containment - sandboxes, approvals, blast radius · Changelog - what’s new · The 2026 incident board · Reference library
`CVE-2026-55607`	- NVD ↗	III.5 · Consent & containment - sandboxes, approvals, blast radius
`CVE-2026-59705`	- NVD ↗	The 2026 incident board
`CVE-2026-59706`	- NVD ↗	The 2026 incident board