Incident or Exercise: Mapping the OWASP Agentic Threat Classes onto MITRE ATLAS Case Studies

Seven of the ten OWASP Top 10 for Agentic Applications classes, and twelve of the seventeen Agentic AI Threats and Mitigations classes, are backed by at least one MITRE ATLAS case study that MITRE itself grades as an incident rather than an exercise. That sentence was written after the tables below were frozen, not before. The words "most", "only" and "few" in this post were chosen by the finished count.

This is a dataset crosswalk, not an argument. The deliverable is an open CSV and JSON file, published under CC BY 4.0, that maps every class in OWASP's two agentic threat lists onto MITRE ATLAS case study IDs, and inherits MITRE's own machine readable type field as the evidence verdict on each cell. It is deliberately distinct from our narrative analysis at Anthropic Mapped a Year of AI Attacks to MITRE ATT&CK, which argues a position. This one just publishes rows and shows its work.

Download: crosswalk.csv | crosswalk.json | README

The question, answered literally

Which OWASP agentic threat classes have actually been observed in real incidents rather than research exercises?

Against the MITRE ATLAS corpus pinned at release v2026.06, and using MITRE's own incident-versus-exercise grading:

Incident-backed (ASI Top 10): ASI01 Agent Goal Hijack, ASI02 Tool Misuse and Exploitation, ASI03 Identity and Privilege Abuse, ASI04 Agentic Supply Chain Vulnerabilities, ASI05 Unexpected Code Execution, ASI06 Memory and Context Poisoning, ASI10 Rogue Agents.

Exercise-only (ASI Top 10): ASI07 Insecure Inter-Agent Communication, ASI08 Cascading Failures, ASI09 Human-Agent Trust Exploitation.

Read the split carefully, because it is the most useful thing in this dataset. The seven classes with real-world incident receipts are the ones that reduce to conventional security failures: stolen credentials against model endpoints, a rugpulled npm package, a deserialization payload in a model file, an over-scoped token on a source repository. The three classes that remain exercise-only are precisely the distinctly multi-agent and emergent ones, where the harm depends on agents talking to agents, faults compounding across a fleet, or a human over-trusting a fluent machine.

That is not the "agentic threats are hype" finding, and it is not the "agentic AI is fully weaponised" finding either. It is a third thing: the agentic attack surface is already being exploited through its ordinary plumbing, while the exotic, genuinely novel failure modes remain, for now, demonstrated rather than observed.

Figure 1: Evidence status per class against the pinned corpus. Verdicts are MITRE's, copied not re-adjudicated. Source: MITRE ATLAS v2026.06, commit 651dad9.

TL;DR

• Corpus, pinned: 63 MITRE ATLAS case studies at commit 651dad90d3c007e797c89356fa1f4d8732f90c8d, release v2026.06 (mitre-atlas/atlas-data).

• MITRE's own split: 18 graded Incident, 45 graded Exercise.

• ASI Top 10 result (denominator 10): 7 incident-backed, 3 exercise-only, 0 with no qualifying entry.

• Threats and Mitigations v1.1 result (denominator 17): 12 incident-backed, 3 exercise-only, 2 with no qualifying entry.

• Rows published: 143, each carrying a verbatim quote verified as a substring of the ATLAS record.

• Coverage of the corpus: 13 of the 18 incident-graded studies and 27 of the 45 exercise-graded studies are cited at least once.

• Taxonomy correction: the Threats and Mitigations list is commonly cited as T1 to T15. Version 1.1, the copy currently served by OWASP, runs to T17, adding Insecure Inter-Agent Protocol Abuse and Supply Chain Compromise.

• Alias correction: PROMPTSTEAL is not missing from ATLAS. It is indexed as AML.CS0044 under the CERT-UA alias LAMEHUG (Google Threat Intelligence Group).

• Excluded field: ATLAS's actor column is not reproduced. It carries 51 distinct values across 63 studies and is populated mostly with the discovering researcher, not the adversary.

Key takeaways

The classes with real-world receipts are the boring ones. Every ASI class that reaches incident grade does so through a mechanism a 2015 security programme would recognise: credential theft, package impersonation, unsafe deserialization, an over-permissioned token. The novelty is the target, not the tradecraft.

The genuinely novel classes are still exercise-only, and that is a statement about evidence, not about risk. ASI07, ASI08 and ASI09 have no incident-graded ATLAS entry in the pinned corpus. That means no qualifying record exists in this corpus as of the cut-off date. It does not mean the attacks are not happening. Multi-agent estates are young, and detection for agent-to-agent compromise barely exists, so absence of evidence is doing a lot of work here.

Verdict inheritance is the whole point. This dataset does not invent an evidence grade. It copies MITRE's type field. That means the most contestable column in the table is the one Stingrai had no hand in, and the only thing a reader needs to audit is whether each mapping quote genuinely describes the class mechanism.

Two OWASP lists, two denominators, never one. The Top 10 and the Threats and Mitigations taxonomy overlap so heavily that OWASP publishes its own cross-mapping between them. Summing them into 27 would double-count memory poisoning, tool misuse, rogue agents, supply chain compromise and identity abuse.

Most of the unindexed column is publication lag, not an ATLAS gap. The pinned corpus has a latest event date of 2026-05-07. Anything disclosed after that window cannot be indexed yet. Treating recency as an editorial failure would be a misreading.

Methodology

This section is the method, published in full, so the tables can be rebuilt from scratch by anyone.

1. Corpus and pinning

The corpus is the MITRE ATLAS data repository, cloned and parsed locally at a pinned commit:

1repo:    https://github.com/mitre-atlas/atlas-data
2file:    dist/ATLAS-latest.yaml
3commit:  651dad90d3c007e797c89356fa1f4d8732f90c8d
4release: ATLAS v2026.06 (tagged 2026-06-30)

Parse it locally. Fetching that file over HTTP through a summarising intermediary truncates it, and has returned a false zero-case-study count.

One file-selection note matters for reproducibility. At this commit, dist/ATLAS.yaml is a deprecated v5.6.0 snapshot whose own header states it is no longer updated; it carries 57 case studies under the older case-study-type key. This dataset uses dist/ATLAS-latest.yaml, the current v6 collection, where the field is named type and values are title-cased.

Table 1: parsed corpus totals at the pinned commit

Figure 2: The pinned corpus and the share of it this crosswalk cites. Source: MITRE ATLAS v2026.06, commit 651dad9.

2. Class lists, verbatim, with two denominators

Both OWASP lists are enumerated verbatim from the primary documents.

The OWASP Top 10 for Agentic Applications 2026 was published 9 December 2025 and runs ASI01 to ASI10 (OWASP GenAI Security Project).

The OWASP Agentic AI Threats and Mitigations document requires a correction that most secondary coverage has not caught up with. It is very widely cited as a list of 15 threats, T1 to T15. That was true of version 1.0, dated February 2025. The copy currently served from the OWASP resource page is version 1.1, dated December 2025, and it runs to T17: it adds T16 Insecure Inter-Agent Protocol Abuse and T17 Supply Chain Compromise to synchronise the taxonomy with the new Top 10 (OWASP GenAI Security Project). This crosswalk uses 17. Anyone reporting a "T1 to T15" denominator in 2026 is working from the superseded version.

The two lists are never summed. They overlap by design, and OWASP publishes the overlap itself in Appendix A of the Top 10 document. There is no denominator of 27.

3. Pre-registered mapping rule

Stated before any table was built, and not relaxed afterwards:

A class is credited against an ATLAS case study only where the ATLAS record explicitly describes the mechanism defining that class, evidenced by a verbatim quoted sentence stored in the cell. No quote, no mapping.

This was enforced mechanically, not by eye. The build script asserts that each stored quote is a genuine substring of that ATLAS record's description field at the pinned commit, and fails closed: a quote that does not match aborts the run rather than emitting an unverified row. It fired during development on a smart-quote mismatch in AML.CS0047 and blocked eight rows until the quote was corrected.

4. Verdict inheritance

The evidence verdict on every mapped cell is MITRE's own type value, copied and not re-adjudicated. Stingrai's only judgement in this dataset is the mapping itself, that is, whether a class's defining mechanism is explicitly described in a given record. Whether that record represents a real-world incident or a research exercise is MITRE's call, reproduced verbatim.

This is deliberate. A rival evidence grade invented by a vendor is one more thing a reader has to audit and trust. Inheriting MITRE's field makes the verdict column exactly as reproducible as the corpus.

5. The unindexed column

Events with primary receipts that ATLAS has not ingested are recorded with their primary URL and a verbatim quote, flagged not indexed in ATLAS as of 2026-07-28, and marked as candidates for ATLAS submission.

The important caveat, stated up front: the pinned corpus has a latest event date of 2026-05-07 and a collection modified date of 2026-05-27. Anything after that window cannot be indexed yet. Most of this column is publication lag rather than an editorial gap.

6. Excluded field: actor

ATLAS's actor field is not reproduced. It carries 51 distinct values across the 63 case studies and is populated predominantly with the discovering researcher or research team, not the adversary. Values in the pinned corpus include named research teams, Unknown, Two individuals and One individual alongside genuine threat-group designations such as APT28 and Storm-2139. A column built on that field would read as threat-group attribution while actually being a mixture of attribution and research credit, so it is omitted rather than shipped with a footnote. For the same reason, case studies are referenced throughout by ATLAS ID and MITRE's own case study name, never by discovering vendor.

7. How negatives are written

Every negative in this dataset renders as "no qualifying ATLAS entry or primary receipt found in the pre-registered corpus as of 2026-07-28". This dataset never claims a class has never been observed in the wild. Absence from ATLAS is evidence about ATLAS's coverage, not about the world.

8. Scope, freezing, and cadence

The tables were frozen before any summary sentence was written about them. The headline of this post was chosen by the finished count. Cut-off date is 2026-07-28, the dataset carries a dated revision log, and the stated re-check cadence is monthly against the then-current ATLAS release.

Table 2: OWASP Top 10 for Agentic Applications 2026, denominator 10

Verdicts are MITRE's. Inc counts distinct incident-graded ATLAS studies mapped to the class; Exe counts exercise-graded studies.

Totals: 7 incident-backed, 3 exercise-only, 0 with no qualifying entry, out of 10.

Three cells deserve their caveats stated in the open, because they are the ones a careful reader will push on:

• ASI06 rests on a single, old incident. The only incident-graded record whose description explicitly carries the memory-poisoning mechanism is AML.CS0009, Tay Poisoning (2016), where "A coordinated attack encouraged malicious users to tweet abusive and offensive language at Tay, which eventually led to Tay generating similarly inflammatory content towards other users." Tay is a pre-agentic conversational system. The mapping is retained because the pre-registered rule is mechanism-based, not architecture-based, and the caveat is carried in the row's note field. Readers who reject that mapping should read ASI06 as exercise-only, which would move the headline to 6 of 10.

• ASI01's second incident was an attempt that failed. AML.CS0043 records a live malware sample carrying an embedded prompt injection "designed to manipulate LLM-based malware detectors and/or analysis tools", and ATLAS states plainly that the injection was not effective against the models tested. It is counted because the mechanism was observed in the wild, not because it worked.

• ASI04 includes one AI-framework rather than agent-runtime case. AML.CS0015, the compromised PyTorch dependency chain, is a model-library supply chain attack rather than an agent-runtime one. It is retained because ASI04 explicitly scopes models, libraries and tools, and the caveat is in the row note.

Table 3: OWASP Agentic AI Threats and Mitigations v1.1, denominator 17

Totals: 12 incident-backed, 3 exercise-only, 2 with no qualifying entry, out of 17.

The two empty rows are empty for stated, principled reasons rather than for lack of looking:

• T7 Misaligned & Deceptive Behaviors is defined by OWASP as misalignment that arises "without direct malicious input". Every case study in the pinned ATLAS corpus has an identified adversary supplying exactly that input. Guardrail-bypass records such as AML.CS0057 were considered and rejected on this basis: a jailbreak is direct malicious input, so it fails the class's own defining clause. Under a strict reading, no ATLAS record qualifies.

• T10 Overwhelming Human in the Loop has no record in the pinned corpus whose description makes defeating or saturating a human review step the mechanism of compromise. The nearest record, AML.CS0045, actually documents the human check working: ATLAS notes the tool "does prompt the user before executing the malicious command, potentially mitigating the attack."

The overlap map, published by OWASP itself

The two lists are not independent, and the cleanest evidence of that is OWASP's own cross-mapping in Appendix A of the Top 10 document. Reproducing it here is what makes the two-denominator rule auditable rather than an assertion.

Five mechanisms appear on both lists under different names: memory and context poisoning, tool misuse, rogue agents, identity and privilege abuse, and supply chain compromise. Any total that adds 10 and 17 counts each of those twice.

Note the structural consequence. ASI03 maps one-to-one onto T3, so the two lists agree exactly on identity abuse. ASI04 fans out across six T-classes, which is why supply chain shows the densest incident evidence in both tables: it is the class where the OWASP taxonomies, and the real-world receipts, converge hardest.

Not indexed in ATLAS as of 2026-07-28

These events carry primary receipts but have no ATLAS case study at the pinned commit. Each is flagged in the dataset as a candidate for ATLAS submission.

C0062 is the structurally interesting one. MITRE has indexed it, just not in ATLAS. It sits in ATT&CK as a Campaign, described as "a highly coordinated operation that manipulated Claude Code to perform reconnaissance, vulnerability discovery, exploitation, lateral movement, credential harvesting, data analysis, and exfiltration operations at approximately 30 entities in the technology, financial, chemical, and government sectors." The vendor disclosure states the actor "was able to use AI to perform 80-90% of the campaign, with human intervention required only sporadically" (Anthropic). An analyst crosswalking only against ATLAS would score this as absent evidence, when MITRE has in fact adjudicated it inside a different framework. Anyone doing agentic threat coverage work should query both.

The Hugging Face incident is the first receipt in this dataset for an autonomous agent framework causing a third-party compromise. The primary disclosure states that "A malicious dataset abused two code-execution paths in our dataset processing (a remote-code dataset loader and a template-injection in a dataset configuration) to run code on a processing worker", and describes a campaign "run by an autonomous agent framework". A second, corroborating disclosure was published by OpenAI; it is listed as a reference rather than quoted, because the page was not retrievable for direct quotation at the cut-off date. Our narrative treatment of that event lives at The Hugging Face Breach.

A candidate that turned out to be already indexed

PROMPTSTEAL is not missing from ATLAS. It was checked as an unindexed candidate and found present as AML.CS0044, graded Incident, under its CERT-UA alias LAMEHUG. Google Threat Intelligence Group tracks the malware as PROMPTSTEAL and states that its use "constitutes our first observation of malware querying an LLM deployed in live operations"; CERT-UA tracks the same family as LAMEHUG; ATLAS indexes the CERT-UA name.

The lesson generalises: resolve aliases before recording a gap. Vendor malware naming and national CERT naming diverge routinely, and a crosswalk that greps for the vendor name alone will manufacture false negatives. We cover this family's runtime behaviour separately in PROMPTSTEAL and PROMPTFLUX.

Worked example: why CVE-2025-32711 is not proof of in-the-wild agentic exploitation

CVE-2025-32711, the Microsoft 365 Copilot flaw commonly called EchoLeak, is the single most-cited artifact in vendor marketing that argues agentic risk has arrived. It is carried here as the worked example of why a vendor's assertion of real-world exploitation needs primary confirmation before it enters a dataset.

Here is what the primary sources actually say.

Microsoft's own machine readable advisory records Exploited:No. MITRE independently grades the matching ATLAS case study as an Exercise, not an Incident. Two primary sources, reached separately, agree.

The vulnerability is real, it was rated Critical, and it was serious enough that Microsoft mitigated it service-side with no customer action required. None of that makes it evidence of exploitation. A crosswalk that ingested "widely cited as proof agentic risk is real" would have graded this cell Incident and been wrong on both MSRC's record and MITRE's.

This is exactly why the verdict column in this dataset is inherited rather than authored. Note also the CVSS divergence: Microsoft scores it 9.3 and NIST scores it 7.5 for the same CVE. If you are citing a severity number for this flaw, cite which body issued it.

What this means for defenders

Five things follow from the frozen tables, aimed at people who have to make a testing or detection decision this quarter.

• Test the boring classes first, because they are the ones with receipts. ASI03 identity and privilege abuse, ASI04 supply chain, and ASI05 code execution carry the densest incident evidence in the corpus. Concretely: inventory the tokens your agents hold, pin and verify the provenance of every MCP server and model artifact you load, and treat any agent that can generate and run code as a host-compromise path rather than a text feature.

• Do not de-prioritise the exercise-only classes; instrument them. ASI07, ASI08 and ASI09 lack incident evidence partly because almost nobody is logging agent-to-agent traffic in a way that would produce such evidence. If you run a multi-agent estate, the absence of incidents in a public corpus says more about telemetry than about safety.

• Resolve aliases before you claim a coverage gap. The PROMPTSTEAL and LAMEHUG case shows how easily a name mismatch becomes a phantom finding. This applies to any framework-coverage claim in a vendor proposal.

• Query ATT&CK and ATLAS together. C0062 sits in one and not the other. A coverage matrix built against a single MITRE framework will under-count agentic evidence.

• Ask for the verdict's provenance whenever a vendor shows you an evidence grade. If the grade is the vendor's own invention, it is an opinion with a table around it. If it is inherited from a named primary source, you can check it.

That last point is the honest reason this dataset exists. Model-layer and agentic assessment work at Stingrai, a CREST-accredited firm, is human-led AI red teaming: senior testers reasoning about goal hijacking, tool boundaries, delegation chains and memory persistence in your specific architecture. Our autonomous agent, Snipe, is a separate thing with a deliberately separate scope: it is a web application pentest agent that hunts IDOR, business logic flaws and broken authorization, and it is described at web application penetration testing. Neither touched the data above. The tables were built from a pinned public corpus with a quote-verified build script, and you can rebuild them yourself.

If you want the buyer-side rubric rather than the dataset, the companion pieces are the OWASP Agentic AI Top 10 test coverage checklist and AI attacker milestones and red team coverage. For how continuous agentic adversary emulation is actually run, see Inside Agentic Red Teaming. Engagement scoping and pricing sit at Stingrai pricing and the full services list.

Using the dataset

The files are CC BY 4.0. Attribution string:

1Stingrai (2026). OWASP Agentic Threat Classes to MITRE ATLAS Case Study Crosswalk, v1.0.
2CC BY 4.0. https://www.stingrai.io/data/owasp-agentic-atlas-crosswalk/crosswalk.csv

crosswalk.csv carries 143 rows with these columns: taxonomy, class_id, class_title, evidence_kind, atlas_case_study_id, atlas_case_study_name, mitre_case_study_type, event_date, evidence_quote, source_url, not_indexed_as_of, atlas_submission_candidate, note. crosswalk.json adds corpus metadata, per-class summary counts and the revision log.

To rebuild the corpus totals yourself:

1git clone https://github.com/mitre-atlas/atlas-data
2cd atlas-data && git checkout 651dad90d3c007e797c89356fa1f4d8732f90c8d
3python3 -c "import yaml,collections; d=yaml.safe_load(open('dist/ATLAS-latest.yaml')); cs=d['case-studies']; print(len(cs), collections.Counter(v['type'] for v in cs.values()))"

Expected output: 63 Counter({'Exercise': 45, 'Incident': 18}).

Corrections are welcome and will be reflected in the revision log. The dataset is re-checked monthly against the then-current ATLAS release.

Frequently Asked Questions

Which OWASP agentic threat classes have actually been observed in real incidents rather than research exercises?

Against MITRE ATLAS pinned at release v2026.06, seven of the ten OWASP Top 10 for Agentic Applications classes carry at least one case study MITRE grades as an Incident: ASI01 Agent Goal Hijack, ASI02 Tool Misuse and Exploitation, ASI03 Identity and Privilege Abuse, ASI04 Agentic Supply Chain Vulnerabilities, ASI05 Unexpected Code Execution, ASI06 Memory and Context Poisoning, and ASI10 Rogue Agents. The three exercise-only classes are ASI07 Insecure Inter-Agent Communication, ASI08 Cascading Failures and ASI09 Human-Agent Trust Exploitation. On the separate Threats and Mitigations v1.1 list, 12 of 17 classes are incident-backed.

How many case studies are in MITRE ATLAS, and how many are incidents?

At pinned commit 651dad90d3c007e797c89356fa1f4d8732f90c8d, release v2026.06, ATLAS carries 63 case studies: 18 graded Incident and 45 graded Exercise. Event dates run from 2016-03-23 to 2026-05-07. Parse dist/ATLAS-latest.yaml locally; fetching it through a summarising intermediary truncates the file.

Why does this crosswalk use MITRE's incident or exercise verdict instead of its own evidence grade?

Because a vendor-invented evidence grade is one more unauditable thing in the table. ATLAS already ships a machine readable type field on every case study, so this dataset copies it rather than re-adjudicating it. The only Stingrai judgement in the dataset is the mapping, and every mapping carries a verbatim quote so it can be checked.

Does the OWASP Agentic AI Threats and Mitigations list have 15 classes or 17?

Seventeen. The widely cited T1 to T15 figure comes from version 1.0, dated February 2025. Version 1.1, dated December 2025 and currently served from the OWASP resource page, adds T16 Insecure Inter-Agent Protocol Abuse and T17 Supply Chain Compromise to synchronise the taxonomy with the 2026 Top 10.

Can I add the two OWASP lists together to get 27 threat classes?

No. The lists overlap heavily and OWASP publishes the cross-mapping itself in Appendix A of the Top 10 document. Memory poisoning, tool misuse, rogue agents, identity abuse and supply chain compromise all appear on both lists. Report 10 and 17 as two separate denominators.

Is CVE-2025-32711 in Microsoft 365 Copilot proof that agentic attacks are happening in the wild?

No. Microsoft's own advisory records "Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely", and MITRE grades the matching ATLAS case study AML.CS0059 as an Exercise. The flaw is real and was rated Critical, with a 9.3 CVSS base score from Microsoft and 7.5 from NIST, but neither primary source records exploitation.

Which real-world agentic AI events are not yet indexed in MITRE ATLAS?

Three at the cut-off date: ATT&CK Campaign C0062 / GTG-1002 from September 2025, which MITRE has indexed in ATT&CK but not ATLAS; the Hugging Face security incident of July 2026; and JADEPUFFER agentic ransomware from July 2026. The latter two post-date the pinned corpus, whose latest event date is 2026-05-07, so their absence is publication lag rather than an editorial gap.

Why does the dataset exclude the ATLAS actor field?

Because it does not mean what a reader would assume. The actor field carries 51 distinct values across 63 case studies and is populated mostly with the discovering researcher or research team rather than the adversary, mixing genuine designations like APT28 and Storm-2139 with entries such as Unknown and One individual. Publishing it as a threat-group column would be misleading, so it is omitted.

What does it mean when a class shows no qualifying ATLAS entry?

It means no record in the pre-registered corpus explicitly describes that class's defining mechanism, as of 2026-07-28. It does not mean the attack has never happened. Two classes are in this state: T7 Misaligned & Deceptive Behaviors, whose definition requires misalignment "without direct malicious input" that no adversary-driven case study can satisfy, and T10 Overwhelming Human in the Loop.

Where can I download the crosswalk dataset?

The CSV is at https://www.stingrai.io/data/owasp-agentic-atlas-crosswalk/crosswalk.csv and the JSON at https://www.stingrai.io/data/owasp-agentic-atlas-crosswalk/crosswalk.json, both CC BY 4.0. The README documents the schema, the pinned commit, the mapping rule and the revision log. The dataset is re-checked monthly.

References

1. MITRE. ATLAS Data Repository. Release v2026.06, commit 651dad90d3c007e797c89356fa1f4d8732f90c8d, 2026-06-30. https://github.com/mitre-atlas/atlas-data. Machine readable ATLAS collection including 63 case studies with a type field grading each as Incident or Exercise. Primary corpus for this crosswalk.

2. MITRE. ATLAS Matrix and Case Studies. 2026. https://atlas.mitre.org. Web presentation of the case study corpus parsed above.

3. OWASP GenAI Security Project. OWASP Top 10 for Agentic Applications 2026. 9 December 2025. https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/. Defines ASI01 to ASI10 and publishes the cross-mapping to the Threats and Mitigations taxonomy in Appendix A.

4. OWASP GenAI Security Project. Agentic AI Threats and Mitigations, version 1.1. December 2025. https://genai.owasp.org/resource/agentic-ai-threats-and-mitigations/. Defines T1 to T17. Licensed CC BY-SA 4.0.

5. Microsoft Security Response Center. CVE-2025-32711: M365 Copilot Information Disclosure Vulnerability. June 2025. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-32711. Records CVSS 3.1 base 9.3 and the exploitability string "Publicly Disclosed:No;Exploited:No".

6. NIST. National Vulnerability Database entry for CVE-2025-32711. Published 2025-06-11. https://nvd.nist.gov/vuln/detail/CVE-2025-32711. NIST assigns CVSS 3.1 base 7.5 for the same CVE.

7. MITRE. Campaign C0062, Anthropic AI-orchestrated Campaign. https://attack.mitre.org/campaigns/C0062/. ATT&CK campaign entry for the September 2025 operation attributed to GTG-1002. Indexed in ATT&CK, absent from ATLAS at the pinned commit.

8. Anthropic. Disrupting the first reported AI-orchestrated cyber espionage campaign. 13 November 2025. https://www.anthropic.com/news/disrupting-AI-espionage. States the actor was able to use AI to perform 80-90% of the campaign against roughly thirty targets.

9. Google Threat Intelligence Group. GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools. November 2025. https://services.google.com/fh/files/misc/advances-in-threat-actor-usage-of-ai-tools-en.pdf. Documents PROMPTSTEAL, tracked by CERT-UA as LAMEHUG, as the first observation of malware querying an LLM in live operations.

10. Hugging Face. Security incident disclosure, July 2026. 16 July 2026. https://huggingface.co/blog/security-incident-july-2026. First-party disclosure describing a malicious dataset abusing two code-execution paths and a campaign run by an autonomous agent framework.

11. OpenAI. OpenAI and Hugging Face partner to address security incident during model evaluation. 21 July 2026. https://openai.com/index/hugging-face-model-evaluation-security-incident/. Corroborating second disclosure of the same event.

12. Sysdig. JADEPUFFER: agentic ransomware for automated database extortion. 1 July 2026. https://www.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion. Describes what the publisher characterises as the first documented case of agentic ransomware.

13. Stingrai. OWASP Agentic Threat Classes to MITRE ATLAS Case Study Crosswalk, v1.0. 28 July 2026. https://www.stingrai.io/data/owasp-agentic-atlas-crosswalk/crosswalk.csv. The dataset described by this post. CC BY 4.0.