Entries group related changes by the date they shipped. For the commit-level history, see the source repository.
Talk claims defined
The agentic AI security page defines claim in Terms used on this page: a short statement the page records and cites with a short code. The Conference talks note says the Claims column repeats principle statements that cite the talk. Those statements are paraphrased takeaways, not direct quotes from the speaker, and they may include our own conclusions. The column name stays Claims.
Shorter conference talk cards
On a narrow screen, each talk on the agentic AI security page puts the code, the organization, and the date on one line. The claim text stays closed until you open Show the claim. The control is a disclosure, so it works from the keyboard with no script. The title stays visible.
Source links repaired
CoSAI moved four papers into new folders in its GitHub repositories, and the old links returned 404. The agentic security source table, its llms-full.txt copy, and ai-agentic-principles.json now point to the new paths for the AI supply chain risks paper, Signing ML Artifacts, the AI Incident Response Framework, and MCP Security. The OWASP AISVS entry in principle-candidates.json now links to the AISVS 1.0 PDF; the v1.0 release tag it cited does not exist. No principle text changed.
Multimodal classes in the attack inventory
Attack inventory 0.6.0 adds three classes after a review of a streaming-media attack inventory: adversarial perturbation of audio, image, or video input; media preprocessing that hides content from a model reviewer; and untrusted media decoded inside a model server, which cites vLLM CVE-2026-22778. Multimodal instruction injection gains the alias typographic prompt injection and two papers. The streaming rows on DRM, watermarks, HDMI output, and player parsers have no model or agent in the path and were not added.
Telemetry classes in the attack inventory
Attack inventory 0.5.0 adds feedback-loop poisoning, where
ordinary users steer the next model version through prompts and
ratings, and control sequences in model output that a terminal or
log viewer acts on. Observability-plane evasion and log tampering
now cite ATT&CK 19.2 T1685,
T1685.002, and T1070; 19.x revoked the
older T1562 Impair Defenses. The OWASP LLM Top 10
2026 is still a release candidate, so the inventory keeps the
2025 pin.
Three more attack inventory classes
Attack inventory 0.4.0 adds computer-use action on a stale screen, replay of encrypted reasoning blocks, and a multi-agent covert channel past a monitor model. They cover the three AITBM failure modes that 0.3.0 listed as uncovered. The covert channel stays separate from encoded input guardrail evasion because the monitor's tokenizer deletes the hidden text before the monitor reads it. Its only source is a self-published report, and the reasoning-block paper reports that providers fixed the tested APIs by August 2026; the known limits say both.
Five new attack inventory classes
Attack inventory 0.3.0 adds agent skill poisoning, coding agent
rules file poisoning, exposed agent control interfaces, agent
session smuggling, and malicious LLM API routers. The first three
split from MCP tool poisoning, indirect prompt injection, and
agent config credential exposure, and the
attack inventory
page states the check that separates each pair.
AML.CS0049 moves to skill poisoning. The router class
has no threat crosswalk row, so 12 of 50 classes now lack one.
Incident refs in the attack inventory
Attack inventory 0.2.2 adds 18 incident refs to 13 classes: 8 ATLAS case studies, 5 CVE records, and 5 vendor or researcher reports. Seven classes that had no incident now have one, among them RAG poisoning, excessive agency, agent tool SSRF, and malicious model artifacts. The leads came from the AITBM use-case pages; each ref cites the case study, CVE record, or original report instead.
Business-process classes in the attack inventory
Attack inventory 0.2.0 adds eight classes in which an AI system
or agent moves money, changes a vendor or beneficiary record, or
passes an approval step, from agent payment diversion to deepfake
impersonation of a payment approver. Their refs cite two newly
pinned catalogs, FINOS AI Governance Framework v2 and ATT&CK
Enterprise 19.2, because ATLAS has no technique for changing a
business process. Seven of the eight link to finance, insurance,
or manufacturing controls through a new
vertical_controls field. Three have no threat
crosswalk row, since that file has no L1 row for approvals.
Claims-test pack 1.0.9 adds
the business-process topic and selects inventory
classes by industry pilot.
Attack inventory with checked ids
The attack inventory lists 37 published attack classes against AI models, LLM applications, and agents. Its 142 ATLAS, OWASP, CWE, arXiv, and CVE refs were checked against pinned catalog versions on 1 October 2026. Claims-test pack 1.0.8 reads the file by default and builds its attack table from it first, so those rows cite checked ids; classes the inventory lacks still get ids from model memory, marked unresolved. Checking the 31 seed rows changed refs on 11 of them, including EchoLeak, which ATLAS tags as triggered injection.
Deck says step, not hop
The OpenAI / Hugging Face deck opens on the path out of the sandbox. A step is one point where the agents acted, and the next point they reached from there. The word hop is gone from the spoken slides.
OpenAI / Hugging Face deck retimed around the path
The practitioner deck now opens on the claim, puts the path on its own slide, and speaks three rows. The other five rows, the record hedges, and the OASIS map sit after the close for questions. Artifactory is described as a permitted path. The declaration row uses the 27 June port-sweep and the 20 July notification.
Companion agentic extensions (not a CoSAI v1.0 revision)
Homepage lede now states that autonomy L0 to L5 and override T1 to T5 describe independence and intervention, not a change of owner. Six glossary terms, vendor-risk questions, operating-model enforcement-plane copy, threshold schema optional fields, and AI SAFE² on /compare/ are independently proposed companion material. Register: proposed next-version asks. Not part of CoSAI SRF v1.0.
Draft claims-test prompt pack v1.0.5
Non-interactive chain at
/assess/claims-test/
scores draft AI security claims on risk, obligation, control,
and one accountable party, then replies with a markdown report
that includes Google Docs or GitHub suggestion packets.
Independently proposed; not part of CoSAI SRF v1.0. Cousin of
the whitepaper assessment catalog grader, not a merge. v1.0.1:
chain run may fetch or attach prompts.json. v1.0.2:
chain run prints the markdown report, not intermediate JSON.
v1.0.3: C-attacks collects published topic attacks from ATLAS,
OWASP, BIML, and related papers before draft-treated inventory.
v1.0.4: Track A shortcut names C-attacks and requires a Published
attack classes table of ATT-xx rows even when a fetched pack is
older or topics is empty. v1.0.5: intake packet uses bracketed
examples, lists github-md, and drops
cosai_workstreams.
Whitepaper assessment prompt v2.2
Intake runs before any catalog fetch. The prompt loads slim
principle catalogs, merges extract/map/classify into one pass,
and treats Novel as a map result rather than a catalog-addition
form. A named map-only switch skips citation
registries, live SRF fetch, and draft mechanics.
Changelog.
L5 is the model-artifact supply chain
The L5 subtitle is now Models, Training, Model Supply Chain. Enterprise vendor-risk inventory, tiering, and contracting for all seven vendor categories sit at L1. L5 keeps model cards, signing, BoAIM or SBOM, and vulnerability disclosure, plus a pass-through of that package when a SaaS, agentic, or VAR vendor embeds a model. Public-sector SRF-L5-MON-007 moved to SRF-L1-ACQ-010. Finance and healthcare each gained an L1 vendor register. The security-controls wizard and regulation discovery now assign generic TPRM, HIPAA BAAs, and NYDFS third-party risk to L1.
TSC presentation removed
Removed the May 2026 CoSAI Technical Steering Committee deck from /presentation/. That URL now redirects to the [un]prompted October 2026 deck.
DSGAI identifiers on the threat crosswalk
Added OWASP GenAI Data Security Risks (DSGAI 2026) as a mapping source on threats.json. Nine of the sixteen AI Exchange rows now carry a DSGAI identifier where a one-to-one mapping holds. Fifteen new rows cover DSGAI failures the AI Exchange slug set does not name, including shadow AI, vector-store isolation, over-broad context windows, and telemetry leakage. DSGAI07 and DSGAI08 have no rows: they are a control gap and a compliance outcome, not attack techniques. The file cites DSGAI identifiers and published names; it does not copy DSGAI mitigations.
[un]prompted October 2026 draft deck
Added a 9-slide practitioner deck, Who is responsible for what?, teaching the five CoSAI layers and the security roles that own them, then assigning the speaker’s OpenAI / Hugging Face accountability assessment (obligation, control, one job title), then the IaaS / PaaS / SaaS matrix and where CoSAI sits with OASIS Open and MOSAIC, with a Sessionize packet in view-all. Speaker notes on slides 5 and 6 quote the Article 9, NIS2, CFAA and 800-53 phrases those rows map. Slide 2 notes list facts the 26 August OpenAI technical report added after the LinkedIn draft: the 27 June detection clock, shared Artifactory credentials, WebCache, HDF5 heap over-read, screenshot-service path, pull-based C2, two named CVEs and the 19 July OpenAI-side escalation. Slide 7 walks Identity on each layer: each layer has its own risk, obligation, control, and job title (role, data class, session credential, IdP, model provider not involved). Slide 8 runs architecture, detection, monitoring, incident response, audit, red teaming, and vendor risk across the same five layers. The case study tables are the speaker’s analysis from public disclosures. The deck cites the CoSAI SRF as a published catalog.
Vendor risk categories as structured data
Published the vendor risk assessment as machine-readable vendor-risk.json: seven AI vendor categories with SRF layers, operating models, roles, the vendor-versus-customer accountability split, attestation baseline, and evidence asks, plus risk tiers, cross-cutting risks, and an attestation reference. Registered it in the data index and linked it from llms.txt and the full-text file so agents can fetch the categories without parsing HTML.
Incident response playbooks and GRC exports
Added Day-2 incident response playbooks for seven AI boundary failures, each mapping who leads per operating model. Published the accountability matrix as an OSCAL 1.1.2 catalog and a CSV for GRC ingestion, plus the playbooks as structured JSON.
Vendor risk assessment tool
Added vendor risk assessment for AI suppliers: seven vendor categories mapped to SRF layers with accountability splits and evidence asks, a how-to guide, procurement export templates, and a downloadable XLSX workpaper.
For LLMs and agents
Added a homepage resource hub linking llms.txt, the full-text file, machine-readable data, the knowledge graph, the schema viewer, and the retrieval validation tool. Added this changelog and JSON-LD to the newest pages.
License and integrity
Replaced the LICENSE with verbatim Apache-2.0 text, added a NOTICE, pinned jsPDF 2.5.1, hardened the SRF Stress worker with input validation and an anti-injection guard, added a CI verify workflow, and named OCSF as the evidence schema in the v2.0 governance section.
Machine-readable knowledge layer
Published a glossary registry and per-term API, an ontology graph, a canonical ID registry, an export knowledge pack, and a RAG retrieval validation tool. Added page-level LLM metadata and chunk markers across all pages, plus robots.txt, sitemap, llms-full.txt, a data index, and JSON-LD on every page.
Industry verticals
Added finance, healthcare, insurance, public sector, defense, and manufacturing verticals, each with a hub, controls browser, how-to guide, and workpaper. Renamed the medical vertical to healthcare with redirects, and flagged all vertical schemas experimental.
System prompts
Rebuilt the system instruction pages with live content, all six sector parameters, copy buttons, and a site-aware primer for querying the site with an AI assistant.
CoSAI SRF v1.0 (released May 28, 2026)
Adopted official Section 3 language, added announcement links, removed Draft v0.7 references, and corrected the EU AI Act framing throughout the site and the stress test.
Site restructure
Moved to a seven-item navigation with section hubs and a consolidated framework hub. Added the NICE Cybersecurity Workforce Framework mapping page.
SRF Stress Test
Added a Cloudflare Worker proxy for AI-powered scenario analysis, with model iterations and rendering fixes.
Foundation
Stood up the tools hub with assessment wizards, README, Apache-2.0 license, a security audit, the custom domain, and MITRE ATLAS links on adversarial badges.