Encompasses risks to personal privacy and system security from AI. This spans unauthorized inference or leakage of sensitive information, as well as vulnerabilities in AI systems that can be exploited through adversarial attacks, data breaches, or manipulation of model behavior.
Incident volume relative to governance coverage; each dot is one of 7 domains
An autonomous AI security testing agent successfully compromised McKinsey's internal AI platform Lilli within 2 hours, gaining full read and write access to the production database containing 46.5 million chat messages, 728,000 files, and 57,000 user accounts through an unauthenticated SQL injection vulnerability.
Developers: Mckinsey And Company, Codewall
Deployers: Mckinsey And Company, Codewall
Meta's AI-powered smart glasses captured intimate footage including people using bathrooms, having sex, and handling sensitive documents, which was then reviewed by human contractors in Kenya without the subjects' knowledge or consent.
Developers: Meta, Meta AI
Deployers: Meta, Meta AI, Sama
Three Chinese AI labs (DeepSeek, Moonshot, and MiniMax) conducted large-scale distillation attacks against Anthropic's Claude model, using over 24,000 fraudulent accounts to generate 16+ million exchanges and extract capabilities for their own models.
Developers: Anthropic
Deployers: Deepseek, Moonshot AI, Minimax, Proxy Reseller Services
Entity
Who or what caused the harm
Intent
Whether the harm was intentional or accidental
Timing
Whether the risk is pre- or post-deployment
Authorize the Secretary of Defense to establish AI Institutes focused on national security. Directs support for interdisciplinary AI research, partnership, innovation ecosystems, and workforce development.
Requires the Secretary of Defense to develop requirements ensuring DoD-funded biological data resources facilitate AI use. Defines "qualified biological data," includes metrics for data quality, cybersecurity safeguards, privacy protections, and allows national security exceptions. Requires the Secretary to consult relevant sectors about the feasibility of new requirements and review existing frameworks.
Requires the Secretary of Defense to develop a cybersecurity policy for AI/ML systems no later than 180 days after the act is passed. Develop a comprehensive review of the effectiveness of the AI/ML policies. Addresses potential security risks, implements methods to mitigate those risks, and establishes standard policy. Requires a comprehensive report of the threats and cybersecurity measures by August 31, 2026.
Each metric scaled to 0–100% of its peak across all 24 subdomains, so you can compare relative standing across different scales.