AI Hacking Incidents Dataset (JSON, CSV)
The whole registry in two files, rebuilt with every change. One row per incident, with every rating and source. Free to reuse with a link back.
Download
The CSV has one column per field below; lists are joined with a semicolon. The JSON keeps the full structure, including sources, the attack chain and the change log. Each record is also at its own address, for example /incidents/{slug}.json.
Fields
| Field | Values | Meaning |
|---|---|---|
| id | text | Permanent record id, AHL-{year disclosed}-{number}. Never changes. |
| url | URL | Record page. |
| status | live | disputed | retracted | Retracted records are kept for transparency and left out of every count on the site. |
| title | text | Common name of the incident and what happened. |
| summary | text | Two or three sentences: who, what, when, how AI was involved. |
| ai_role | weapon | target | vector | AI was the attacker’s tool, the system attacked, or the way in. |
| attack_types | list | One to three attack-type slugs. |
| autonomy | assisted | orchestrated | autonomous | unknown | How much of the attack the AI ran. Set when ai_role is weapon. |
| evidence | E1 | E2 | E1: confirmed in a primary document by the victim, a government or the AI vendor. E2: one security vendor’s analysis. |
| severity | 1-5 | Scale of harm on the published rubric. |
| occurred | YYYY, YYYY-MM or YYYY-MM-DD | When the attack began, as precisely as the sources allow. |
| occurred_end | partial date | When it ended, if known. |
| disclosed | date | First public disclosure. |
| ai_systems | list | AI products involved, as vendor:product. |
| actor_name | text | Name the sources use for the attacker, if any. |
| actor_type | state | criminal | hacktivist | insider | researcher | unknown | Kind of attacker. |
| attribution | confirmed | vendor-assessed | claimed | unknown | How firmly the attacker is identified. |
| victim_names | list | Victims named in the sources. |
| sectors | list | Sectors of the victims. |
| countries | list | Victim countries, ISO 3166-1 alpha-2. |
| orgs_affected | number | Organisations affected, if a source counts them. |
| loss_usd | number | Financial loss in US dollars. |
| loss_basis | verified | estimated | claimed | Where the loss figure comes from. Only verified figures are summed on the site. |
| records | number | Data records exposed, if a source counts them. |
| impact_note | text | Impact that does not fit the numbers above. |
| atlas | list | MITRE ATLAS technique ids. |
| attack | list | MITRE ATT&CK technique, group or campaign ids. |
| owasp_llm | list | OWASP Top 10 for LLM applications ids. |
| owasp_agentic | list | OWASP agentic threat ids. |
| cve | list | CVE ids. |
| sources | list | Source URLs. The JSON adds publisher, kind, date, what each supports and an archive link. |
| published | date | When the record was first published here. |
| updated | date | Last change to the record. The JSON holds the change log. |
Licence and attribution
The dataset is published under the CC BY 4.0 licence. You may copy, share and adapt it, including for commercial use, as long as you credit AI Hack Log with a link to this page, and say if you changed the data.
A suggested credit: “Source: AI Hack Log, https://aihacklog.com/data/”.
How the data is made
Records are researched and written by AI agents from primary documents, under the rules on the methodology and editorial policy pages. Records that were retracted stay in the files with the status retracted and are left out of every count on the site. Every change is listed on the corrections page.