This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
Encompasses risks to personal privacy and system security from AI. This spans unauthorized inference or leakage of sensitive information, as well as vulnerabilities in AI systems that can be exploited through adversarial attacks, data breaches, or manipulation of model behavior.
Incident volume relative to governance coverage; each dot is one of 7 domains
Severity by subdomain (current trajectory)
Entity
Who or what caused the harm
Intent
Whether the harm was intentional or accidental
Timing
Whether the risk is pre- or post-deployment
Ethical hacker Nisarga Adhikary exposed multiple security vulnerabilities in India's Central Board of Secondary Education's OnMark digital evaluation platform, revealing that 9.3 million rows of sensitive student data including answer sheets were unprotected and accessible without authentication.
Developers: Large Language Model Developers, Google
Deployers: Government Of India, Coempt Eduteck, Central Board Of Secondary Education
The Galileu AI system, developed by the Brazilian Regional Labor Court, successfully detected and prevented a prompt injection attack in a legal petition that contained hidden instructions attempting to manipulate the AI's analysis.
Developers: Tribunal Regional Do Trabalho Da 4a Regiao, Conselho Superior Da Justica Do Trabalho
Deployers: Conselho Superior Da Justica Do Trabalho, Tribunal Regional Do Trabalho Da 8a Regiao, 3a Vara Do Trabalho DE Parauapebas, Judicial System Of Brazil, Brazilian Labor Courts
A Meta AI agent provided inaccurate technical advice on an internal forum, leading to a security incident that temporarily allowed employees unauthorized access to sensitive company and user data.
Developers: Meta
Deployers: Meta
Authorize the Secretary of Defense to establish AI Institutes focused on national security. Directs support for interdisciplinary AI research, partnership, innovation ecosystems, and workforce development.
Requires the Secretary of Defense to develop requirements ensuring DoD-funded biological data resources facilitate AI use. Defines "qualified biological data," includes metrics for data quality, cybersecurity safeguards, privacy protections, and allows national security exceptions. Requires the Secretary to consult relevant sectors about the feasibility of new requirements and review existing frameworks.
Requires the Secretary of Defense to develop a cybersecurity policy for AI/ML systems no later than 180 days after the act is passed. Develop a comprehensive review of the effectiveness of the AI/ML policies. Addresses potential security risks, implements methods to mitigate those risks, and establishes standard policy. Requires a comprehensive report of the threats and cybersecurity measures by August 31, 2026.
Each metric scaled to 0–100% of its peak across all 24 subdomains, so you can compare relative standing across different scales.
