license: cc-by-4.0
language:

• en
  pretty_name: GenAI & Agentic AI Security Incidents
  tags:
• security
• cybersecurity
• ai-safety
• ai-security
• llm
• agentic-ai
• incidents
• threat-intelligence
• prompt-injection
• owasp
• mitre-atlas
• nist-ai-rmf
  task_categories:
• text-classification
• text-retrieval
  size_categories:
• 10K<n<100K
  configs:
• config_name: default
  data_files: incidents.jsonl

GenAI & Agentic AI Security Incidents

15,637 real-world and research incidents involving generative-AI and agentic-AI
systems — prompt injection, jailbreaks, data exfiltration, deepfakes, model and
supply-chain compromise, agent hijacking, and AI-enabled harms — cross-mapped to six
taxonomies. Dataset version 2.13.0.

Every applicable incident is tagged with four core taxonomies:

• OWASP Top 10 for LLM Applications (2026) — LLM01–LLM10
• OWASP Top 10 for Agentic Applications (ASI) — ASI01–ASI10
• NIST AI RMF (AI 100-1) — GOVERN / MAP / MEASURE / MANAGE
• MITRE ATLAS — techniques (AML.T00xx) and tactics (AML.TA00xx)

Plus, where available:

• MAESTRO architectural layers (L1–L7) — companion, carried where the upstream source provides it
• VERIS 1.4.1 crosswalk (veris:* tags) — experimental, computed at export time from attack_vector, not a stored per-incident field

Quickstart

from datasets import load_dataset
ds = load_dataset("emmanuelgjr/genai-incidents", split="train")

# prompt-injection incidents
ds.filter(lambda r: "LLM01" in (r["owasp_llm"] or []))

# only maintainer-reviewed entries
ds.filter(lambda r: r["quality_tier"] in ("reviewed", "curated"))

# the landmark tier -- the headline-citation set this project asks
# you to cite, rather than the full corpus (which is mostly CVE/advisory bulk)
ds.filter(lambda r: r["tier"] == "landmark")

What's inside

Key fields per record (full reference in the data dictionary):

• id, title, description, date, year, severity
• attack_vector — normalised exploit/harm class (e.g. prompt-injection, deepfake, rce)
• owasp_llm, owasp_asi, nist_ai_rmf, mitre_atlas, mitre_atlas_tactics — framework mappings.
  Pinned taxonomy versions for this release: atlas 2026.09, owasp_llm 2026, owasp_asi 2026, capec unversioned, veris 1.4.1
• cve_ids, cwe_ids, cvss_score — where applicable
• references — source URLs · source_ids — upstream provenance
• quality_tier — curated / reviewed / auto (filter by vetting level)
• tier — landmark (the headline-citation set: rows that are hand-curated, catalogued
  in the AI Incident Database, or AI-harm cases) or feed (everything else: mostly
  CVE/GHSA/OSV advisories, plus OECD AI Incidents and Hazards Monitor incident reports). A different axis from quality_tier, not a rename of it:
  most landmark rows qualify by being catalogued in the AI Incident Database, which
  says nothing about vetting level. Cite the landmark count, not the corpus total,
  when you mean "headline incidents"
• corpus — security or ai-harm
• source_freshness — present only on rows whose upstream source has stopped refreshing (see below)
• status — present only on a row that is not standing as published (absence means it stands).
  22 of the rows above carry status: disputed: every CVE record they rest on is
  listed by the CVE Program as published but disputed. They are counted in the 15,637
  and carry a lowered confidence; retracted rows are omitted from this export.

Source freshness

Some rows carry a source_freshness object ({status, as_of, sources, review_by}). It says that
the upstream source that supplied the row has stopped refreshing — not that the row
was withdrawn, superseded, or is wrong. The two are independent facts, and the field
exists because conflating them is how a dataset comes to mislead without any single
value being false: this corpus is rebuilt from committed ingest snapshots, so a row keeps
being emitted long after its upstream download disappears. In particular
source_status: "active" means emitted on the latest build, never re-checked
against a live source. sources names the stale sources by their key in the
repository's published freshness registry (data/source_freshness.json), and as_of is
the earliest last_success date recorded there for those sources — a date taken from the
registry, not the build date. Everything that source contributed to the row,
including any taxonomy or risk-tier tags it supplied, is current through as_of and no
further. review_by is the date a human is due to re-decide whether that source is
refreshed or retired (the until of the registry hold); it is a declared date that
nothing evaluates, not a claim that anything happens then. Absence of the field means no tracked source feeding the row is known to be
stale — not that the row has been verified current. Full definition, the registry's own
fields, and what the registry does and does not cover:
docs/DATA_DICTIONARY.md → Source freshness,
which is authoritative; this is a summary of it.

Sources & provenance

Aggregated and de-duplicated from AIID, OECD AI Incidents and Hazards Monitor, AIAAIC, MITRE ATLAS,
AVID, MIT FutureTech AI Risk Repository, NVD / GitHub Security Advisories / OSV, garak,
promptfoo, red-team benchmark catalogues, and researcher blogs / vendor threat reports.

Intended uses & limitations

Built for security research, red-team scenario design, taxonomy / benchmark work, and
trend analysis. It is not an exhaustive census: coverage skews toward
English-language, publicly-reported events, and auto-tier rows are bulk-ingested
without individual review — filter on quality_tier for higher-confidence subsets. See
the datasheet for full scope, collection method, and limitations.

Licensing

Data is released under CC BY 4.0 overall (license: cc-by-4.0 above; see
LICENSE-DATA and NOTICE-DATA in the source repository). A subset of entries that
cite the AIAAIC Repository — those whose description derives from
AIAAIC's sheet (description_source == "aiaaic") plus a smaller set of hand-curated
rows whose title and categorical facts derive from AIAAIC directly (current count
audited in docs/SOURCE_LICENSES.md §1.1, not restated here to avoid drift) —
carries an additional, row-level CC BY-SA 4.0 attribution/share-alike obligation — this
does not apply project-wide, only to those specific rows. Each such row carries a
machine-readable content_license field (source, license, attribution,
obligations) naming AIAAIC as the attribution target; redistributing or adapting
one of those rows' content should honor that row's attribution and share-alike
obligation. A separate, open question about an EU/UK sui generis database right
over the AIAAIC extraction is tracked in the source repository's NOTICE-DATA and
docs/SOURCE_LICENSES.md (§1.1) and is not resolved by this row-level marker.

Rows sourced from the OECD AI Incidents and Hazards Monitor (AIM) carry a
narrower, separate obligation: description on those rows is reduced to
structural facts and a source link only (never AIM's LLM-generated
summary/evidences, machine output derived from copyrighted third-party
news of unresolved ownership). A small number of rows instead ship another
source's description, where that source won the merge; every OECD AIM-sourced
row carries a per-entry citation (OECD (year), AI Incidents and Hazards Monitor, url (accessed on date)) regardless of which description it ships.
The title field is not covered by the reduction and remains an open
question, tracked at the same posture as the AIAAIC headline question above.
Exact per-row counts and the merge-precedence exceptions: title's in
NOTICE-DATA; description's in docs/SOURCE_LICENSES.md's OECD AIM
summary-of-outcomes row (§1.5 covers the full licensing analysis), in the
source repository.

Links

• Code & issues: https://github.com/emmanuelgjr/genai_incidents
• Field reference: docs/DATA_DICTIONARY.md
• Provenance, scope & limitations: docs/DATASHEET.md
• Build provenance: build_manifest.json (commit, build time, counts, taxonomy versions) and SHA256SUMS (sha256sum -c) ship beside incidents.jsonl in this repository
• Citation: CITATION.cff · DOI 10.5281/zenodo.20248675 (Zenodo concept DOI, always resolves to the latest release)

Licence: data CC-BY-4.0 (see Licensing above for row-level AIAAIC obligations), code MIT.