An open, fully-cited knowledge base on AI and LLM security — 92 pages built from 437 source documents, covering the OWASP LLM Top 10, MITRE ATLAS, 70 prompt-injection techniques, agentic and MCP threats, and the EU AI Act.

Every factual claim names the source file and page it came from. Where two frameworks disagree, both readings stay on the page and the disagreement is named — because which one is right is usually the actual finding.

⭐ Star on GitHub Read the README

Start here if you only read one thing: ATLAS and PITAX — two taxonomies, different jobs. All four major taxonomies independently point at the agentic and retrieval surface, yet seven of OWASP ASI’s 17 agentic threats map to no Top 10 entry at all — and EU AI Act Article 15(5), law since 2024, names none of it.

Other high-signal pages: Telemetry and logging (the only control every framework demands independently) and Where defenses fail (56% of ATLAS techniques have zero mapped mitigations).

Citations point at files in raw/, which isn’t published here — those are 437 third-party copyrighted documents, kept in the repo so every claim stays checkable against the exact text it was written from. Clone the repo to verify one.

Summary: Root index for the wiki. One entry per source collection in raw/.

Last updated: 2026-07-30

Collections

OWASP Top 10 for LLM Applications — the community-standard risk list (2025 v2.0), plus the wider GenAI Security Project. The shared vocabulary the other frameworks assume.
AI Attack Techniques — the 70-technique Arcanum Prompt Injection Taxonomy (PITAX), clustered into attack families. Deep on prompt-injection payload craft.
MITRE ATLAS — the ATT&CK-style matrix for AI: 16 tactics, 173 techniques, 35 mitigations, 63 documented case studies. The full attack chain, plus the vault’s only technique-level mitigations.
Data Poisoning — corrupting what a model learns, at training time or at retrieval time.
Model Theft — extraction, inversion and membership inference. “Behavior is the model.”
Secure Coding Patterns — securing the code AI writes. Slopsquatting, insecure-by-default patterns, and the bridge to conventional appsec.
Supply Chain Attacks — the five-layer AI supply chain, real incidents, provenance as the defence. Also holds the Stanford study on AI coding risk and defences for code that calls models.
AI Regulations — the EU AI Act (Regulation (EU) 2024/1689): risk tiers, prohibited practices, high-risk requirements, GPAI rules, incident reporting, penalties, timeline.
Laws — voluntary and institutional frameworks: NIST AI RMF, OECD AI Principles, Singapore Model Framework, IEEE Ethically Aligned Design, the GPAI Code of Practice, and the EU AI Act’s governance bodies.
AI Incident Response — how IR changes when the system under attack is probabilistic: CoSAI framework, Microsoft readiness pattern, AIID public responses.
Agentic Security — the largest collection. OWASP’s ASI taxonomy (T1–T17) and playbooks; CSA’s MAESTRO layered framework; the vault’s only agent audit-trail implementation and its only measured context-failure data. Threats to systems that act rather than generate. Also the vault’s only MCP/A2A coverage.
Mitigations — cross-collection synthesis, no paired raw/ folder. Every control in the vault indexed by control rather than by threat, tiered by how many frameworks independently agree. The defence-side counterpart to the taxonomies.

Cross-collection anchors

Four pages carry most of the load between collections:

AI Act Article 15 — the only place EU law names data poisoning, model poisoning, adversarial examples and confidentiality attacks as things you must engineer against. It is where attack techniques become a legal requirement.
ATLAS mitigations — technique-level defensive mappings, and the finding that 56% of techniques have none.
Code of Practice security mitigations — the most prescriptive control set in the corpus (weight protection, insider threat, red teaming).
AI incident response — where attack techniques, reporting duties and governance meet operationally.
Agentic threat taxonomy — T1–T17 with a six-step decision path that prunes the list against a specific architecture. The only scoping tool in the vault, and the fifth independent confirmation of the agentic gap.
Control catalogue — every control the vault holds, indexed by control and tiered by cross-framework agreement. Where the defensive material from all six collections converges.
Context failure modes — the only measured effect sizes in the corpus for context corruption, and the only source showing the mechanism behind memory poisoning occurring with no attacker. Where the engineering literature supplies what the security literature asserts.
Agent observability and logging — the vault’s only implementation-level detection source, in any collection: a concrete log schema rather than an instruction to keep audit trails.

Four taxonomies, different granularities

The vault holds all four major AI security taxonomies. They divide the problem rather than compete:

	Prompt injection is…	Job
OWASP Top 10	1 of 10 entries	Name the risk for a board
ATLAS	1 technique + 3 sub-techniques (of 173)	Place it in an attack chain for a SOC
PITAX	the entire 70-technique taxonomy	Describe the payload for a red team
OWASP ASI	a delivery mechanism across 5 of 17 threats	Scope an agent architecture for a builder

See ATLAS and PITAX, the OWASP crosswalk and the agentic mapping.

A fifth is now held, and it is not independent. CSA’s MAESTRO decomposes agentic systems into seven layers instead of components or techniques, and reaches three surfaces nothing else here covers: the agent marketplace, infrastructure, and AI security tooling as a target. But Ken Huang authored MAESTRO and contributes to the OWASP Top 10, so its agreement with the ASI taxonomy is not corroboration — the count of independent confirmations stays at five. It also lacks a memory surface and a risk matrix. The crosswalk maps both directions and names the four real disagreements; the framework assessment covers why STRIDE, PASTA, LINDDUN, OCTAVE, Trike and VAST were judged insufficient in the first place.

Four taxonomies, four control sets

Each taxonomy ships with its own control set, and nobody compares them. The comparison is the reason the mitigations collection exists:

Taxonomy	Its control set	Protects
OWASP Top 10	Per-risk prevention guidance	The LLM application
ATLAS	35 mitigations, per technique	The deployed system
OWASP ASI	6 playbooks, ~90 controls	Agent behaviour and seams
— (governance, not a taxonomy)	CoP Appendix 4	Unreleased model weights

They are close to complementary rather than competing — but none covers secure design, and every one of them has coverage gaps that read as coverage. See where defences fail.

Two additions from 2026-07-30 sit at the extremes of this table. MAESTRO is the coarsest control set in the corpus — ~14 controls stated at framework level for ~60 threats, none mapped to an individual threat, including “formal verification of goal alignment” with no method attached. Agent structured logging is the finest — a named 14-field schema, in code. The gap between those two is the whole distance between a framework and a control, and only one of them can be implemented from the page.

The finding they all agree on

Independently built by different communities, all point at the agentic and retrieval surface — PITAX’s six purely-indirect techniques all target agent infrastructure; ATLAS tags 114 techniques as Agentic AI, its largest platform category; OWASP devotes three of ten entries to agent and retrieval plumbing, and restructured its 2025 list around them.

OWASP then confirmed it against its own list. Of the 17 agentic threats in the ASI taxonomy, seven map to no Top 10 entry at all, and LLM06 Excessive Agency alone splits into three. The gap is exactly the set of threats that need a system which acts rather than generates.

AI Act Article 15(5), fixed in law since 2024, names none of it. Six of the ten OWASP entries have no counterpart in it.

Source coverage

Every folder in raw/ is now ingested. Prompt-injection-examples was deleted on 2026-07-28 as redundant against PITAX, which already carries 306 example payloads across its 70 technique cards.

The most-cited absent sources, across all collections: the Spracklen et al. slopsquatting paper (cited twice with different figures), the UK AISI / Anthropic / Alan Turing poisoning study (cited twice, never reproduced), NIST SSDF (SP 800-218), and the CoSAI framework PDF. Added 2026-07-30: the primaries behind the context failure-mode measurements — Drew Breunig’s taxonomy, and the Microsoft/Salesforce multi-turn study whose 39% figure is now cited in this vault at second hand.

Not ingested

raw/Laws/Legal AI Audit Trails_ Designing for Traceability.md (law.co, 2026-05-18) — a failed clipping: 46 words, of which the body is two (AI law). The promised subject, designing AI audit trails for legal traceability, would have paired directly with agent logging and the AI Act’s logging duties. Worth re-clipping — the vault has the engineering side of audit trails and the legal duty, and nothing joining them.
Clippings/What is AI Governance?.md (IBM) is a 119-word truncated stub outside raw/. Nothing substantive to ingest.
Chapters 1–3 and 5 of raw/Agentic/Mastering Multi-Agent Systems eBook.pdf — coordination costs, the four architectures, the LangGraph walkthrough, and Galileo-platform observability. Reliability engineering with no security content the vault lacks; deliberately skipped, available if a question needs it.

Three of these four are clipping failures. Web-clipped markdown in this vault fails silently and often — see also the ASI markdown extraction on 2026-07-29 (7 KB of OCR noise for a 50-page PDF). Check word count against expected length before trusting a clipping, and prefer the PDF where one exists.