Data access

Machine-readable Agent Incident Registry data

559 source-linked agent-related security and safety events, 2022 to 2026. 212 document realized harm. Every record carries a fetched supporting source and a verbatim quote. Regenerated 2026-10-19. Every file below is static and served with permissive CORS headers.

File	What it is
incidents.json	All records with a `meta` block (count, date range, schema URL, terms).
incidents.jsonl	One record per line, same fields as the full dataset.
incidents.csv	Flat table; list fields joined with `;` , taxonomy flattened to `owasp_asi`, `mitre_atlas`, `labels`.
`/data/i/<AIR-ID>.json`	One record, e.g. AIR-2025-0039.json.
incident.schema.json	JSON Schema 2020-12 for a record.
feed.xml	Atom feed of the 50 most recent disclosures.
sitemap.xml	Every permalink.

Identifiers & permalinks

Every record has a stable public_id of the form AIR-YYYY-NNNN (AIR = Agent Incident Registry; YYYY = disclosure year, NNNN = per-year sequence). IDs are minted once and never reused or renumbered. The permalink is https://agentincident.vercel.app/i/AIR-YYYY-NNNN/; the dashboard deep link is https://agentincident.vercel.app/#/i/AIR-YYYY-NNNN. The internal slug incident_id may be renamed; old slugs and the interim CAIRN- ids redirect to the AIR permalink.

Example: AIR-2025-0039 — EchoLeak: zero-click data exfiltration from Microsoft 365 Copilot via an emailed LLM scope violation.

How to cite

A single record:

Enkrypt AI. "EchoLeak: zero-click data exfiltration from Microsoft 365 Copilot via an emailed LLM scope violation". AIR, AIR-2025-0039. https://agentincident.vercel.app/i/AIR-2025-0039/ (accessed 2026-10-19).

The dataset:

Enkrypt AI. Agent Incident Registry (AIR): verified AI-agent security and safety incidents, 2022–2026. https://agentincident.vercel.app/ (accessed 2026-10-19).

Fields

Enumerations are declared only for vocabularies the curation contract controls. initial_vector, agent_capability_abused and taxonomy.labels are free vocabularies pending normalisation. impact_realized is the dataset's central field: true only when a real party suffered real consequences because of an AI agent.

Field	Type / enum	Meaning
`public_id`	string	Stable citable identifier: AIR-YYYY-NNNN (Agent Incident Registry). Minted once, never reused. Permalink: /i/<public_id>/
`incident_id`	string	Internal slug, YYYY-MM-<vendor>-<short-name>. Dedupe key; may be renamed (old slugs redirect).
`date_disclosed`	string	Public disclosure date. YYYY-MM when the day is unknown.
`date_occurred`	["string", "null"]	When the event happened, if known and different from disclosure. Variable precision: YYYY, YYYY-MM or YYYY-MM-DD.
`title`	string	One-line description of what happened.
`class`	["in_the_wild", "responsible_disclosure", "research_demo", "safety_failure"]	Disclosure pathway, independent of impact_realized: in_the_wild = observed attack/misuse outside a controlled test; responsible_disclosure = shipped vulnerability or concrete vendor threat mode surfaced through disclosure; research_demo = researcher-led test; safety_failure = failure surfaced without an adversary-supplied trigger.
`attack_surface`	["enterprise_assistant", "coding_agent", "browser_agent", "computer_use_agent", "mcp_server", "agent_framework", "skill_plugin", "multi_agent_system", "memory_store", "consumer_chatbot", "autonomous_ops", "other"]	Which kind of agent system was involved.
`initial_vector`	string	How the incident started (e.g. indirect_prompt_injection_email, none_autonomous_action). Free vocabulary, not yet normalised.
`agent_capability_abused`	array	Capabilities the agent used or that were turned against it. Free vocabulary.
`target_product`	string	Product or system involved.
`target_vendor`	["string", "null"]	Vendor or operator of that product; null when there is no identifiable vendor.
`autonomy_level`	["assistant", "copilot_with_approval", "semi_autonomous", "fully_autonomous"]	How much the agent acted without a human approving each step.
`impact_realized`	boolean	true ONLY if a real party suffered real consequences because of an AI agent. A proof of concept against a live system is false.
`impact_type`	array	Kinds of impact (data_exfiltration, financial_loss, physical_safety…).
`blast_radius`	string	Who or what was exposed, in prose.
`cve`	array	CVE identifiers, or GitHub Security Advisory (GHSA) ids where no CVE was assigned.
`taxonomy`	object	Framework crosswalk: OWASP Top 10 for Agentic Applications (ASI01–ASI10), MITRE ATLAS technique or case-study IDs, free labels.
`defense_present`	["string", "null"]	What control was in place, if any. Free text.
`defense_bypassed`	["boolean", "null"]	Legacy source-extraction flag. It conflates attempted, partial, and successful bypass and MUST NOT be used as a guardrail outcome or efficacy measure.
`fix_shipped`	["string", "null"]	Remediation, if known.
`primary_sources`	array	URLs actually fetched during curation. The first one is where verified_quote comes from.
`verified_quote`	string	Verbatim sentence from the fetched supporting source confirming the report.
`confidence`	["high", "medium", "unverified"]	high = primary source fetched and quoted; medium = secondary coverage only; unverified records are quarantined, not published.
`notes`	string	Curator notes: disputes, ambiguity, what is not known.
`risk_category`	string	Legacy (pre-EAI taxonomy): primary risk category (AIR taxonomy, eight categories). Kept for comparability; see eai_category.
`risk_secondary`	array	Legacy (pre-EAI taxonomy): other categories the record also matches.
`risk_subcategory`	string	Legacy (pre-EAI taxonomy): subcategory within the primary category; 'Unclassified' if no sub-rule fired.
`risk_sub_secondary`	array	Legacy (pre-EAI taxonomy): other subcategories matched.
`risk_override_reason`	string	Legacy (pre-EAI taxonomy): present when the category was set by curator judgment rather than the rule engine, with the reason.
`ai_entity`	["generative", "non_generative_autonomy", "not_ai"]	generative = an LLM acted or was targeted; non_generative_autonomy = classical perception/planning stack (robotaxis, robots); not_ai = conventional flaw in a product marketed as smart.
`agency`	["agent_acted", "human_acted_on_output", "ai_as_target", "elicitation_only"]	Mutually exclusive causal-role stratum: the agent acted; the AI system/integration was a passive target, exposure endpoint, or input recipient; a human acted on its output; or the record is elicitation-only. Agency is not an inclusion flag.
`agency_debatable`	boolean	true when the agency call is contested; 23% of the corpus.
`agency_reason`	string	Why the agency value was assigned.
`eai_domain`	["governance", "agent_output_quality", "tool_misuse", "privacy", "reliability_and_observability", "agent_behaviour", "access_control_and_permissions", "unmapped"]	Internal agent-risk domain (one of 7), derived from eai_category; 'unmapped' when no category applied.
`eai_category`	["goal_misalignment", "policy_drift", "hallucination", "bias_and_toxicity", "api_integration", "supply_chain_vulnerabilities", "uncontrolled_resource_consumption", "sensitive_data_exposure", "data_exfiltration_channels", "data_and_memory_poisoning", "opaque_reasoning", "human_manipulation", "unsafe_actuation", "credential_theft", "privilege_escalation", "confused_deputy", "unmapped"]	Primary internal agent-risk category (one of 17), each crosswalked to OWASP Agentic threats, MITRE ATLAS, NIST AI RMF, EU AI Act, ISO/IEC and AIUC-1 in data/eai-taxonomy.json. Set by tools/classify_eai.py from the legacy subcategory plus impact/vector rules, with data/eai-overrides.json for judgment.
`eai_secondary`	array	Other internal categories whose impact or vector rule also fired for the record.
`eai_reason`	string	Which rule or override decided eai_category (audit trail; see data/eai-map-report.md).
`is_umbrella`	boolean	true when one catalog row summarizes several findings, flaws, samples, or campaign events.
`umbrella_constituents`	array	incident_id values separately cataloged inside an umbrella record; empty when the underlying items have no separate AIR records.
`umbrella_reason`	string	Curator rationale for retaining the umbrella and how to interpret without-umbrella sensitivity counts.
`vector_family`	["none_autonomous", "indirect_prompt_injection", "direct_prompt_injection", "malicious_component", "conventional_vulnerability", "misuse", "physical_environment", "other"]	initial_vector normalised to a family (derived).
`vector_detail`	string	Original free-text initial_vector retained alongside the normalized vector_family.
`guardrail_kind`	array	Kinds of control recorded in defense_present, normalised: none, prompt_instruction, input_classifier, output_filter, human_approval, human_supervision, sandbox_isolation, permission_scope, authentication, abuse_detection, physical_safety_system, policy_only, unknown.
`guardrail_outcome`	["defeated", "held", "not_enabled", "silent", "not_applicable"]	Sourced outcome of the recorded control. silent = disclosure does not establish efficacy; not_enabled = relevant control existed but was off; not_applicable = no relevant control existed.
`detection_mechanism`	["external_researcher", "vendor_disclosure", "operator_monitoring", "user_report", "press_investigation", "regulator_or_court", "academic_study", "threat_intel", "unknown"]	Who first surfaced the incident. Rule-proposed with manual overrides; unknown marks unadjudicated or unsupported cases.
`agent_framework`	string	Agent runtime or framework involved (controlled list in CODEBOOK.md), or unknown.
`model_provider`	string	Provider of the model in the causal chain; none for classical autonomy; unknown when unnamed.
`model_name`	string	Model name as stated by the source, if any.
`tool_access`	["none", "read_only", "write", "destructive", "unknown"]	Highest privilege the agent held in the incident. Manual.
`financial_loss_band`	["none_reported", "under_10k", "10k_to_100k", "100k_to_1m", "over_1m", "unknown"]	Reported financial loss in USD bands. Manual; mostly unknown, which is itself a finding.
`xrefs`	object	Structured cross-references: AI Incident Database ids, MITRE ATLAS ids, CVE, GHSA (derived).
`primary_asi`	string	Dominant OWASP Agentic Top 10 mechanism: the first ordered value in taxonomy.owasp_asi, or none when asi_scope is out_of_scope.
`asi_curated`	array	The taxonomy.owasp_asi codes human curation had assigned before the crosswalk pass first ran, in the order a curator put them. Frozen: the pass computes from this, not from its own previous output.
`asi_scope`	["in_scope", "out_of_scope"]	Whether any OWASP Agentic Top 10 mechanism can describe the record. out_of_scope marks non-generative embodied autonomy and conventional flaws in products marketed as smart, so an empty taxonomy.owasp_asi never has to be read as 'not yet adjudicated'. See data/owasp-asi.json -> out_of_scope.
`asi_provenance`	["curated", "curated_plus_rule", "rule", "override", "out_of_scope"]	How the mapping was produced: curated (human, during record curation), curated_plus_rule (human order kept, rule-found codes appended), rule, override (data/owasp-asi-overrides.json), out_of_scope.
`asi_reason`	string	Which rule, curated value or override produced each code (audit trail; see data/owasp-asi-report.md).
`submitted_by`	string	Who submitted the record. 'EAI Internal' for records curated in-house; otherwise the credit the submitter asked for. Attribution only — it says nothing about verification, which is the same for every record regardless of who sent it in. Set by tools/tag_submitter.py from data/submitter-map.json.