Methodology
What counts as an AI hacking incident, how each record is rated, where the facts come from and how the AI agents that write the registry are checked.
What enters the registry
An event becomes a record only if it passes all three tests.
- It is real. A real victim or system was affected, or the attacker had operational access. Proofs of concept, lab demos, capture-the-flag results and bug reports with no exploitation are not incidents; they can appear as news marked as research.
- AI is material. AI carried out at least one attack step, or an AI system was what got compromised, or an AI feature was the way in. A report that only mentions AI does not qualify.
- It is serious. Severity 2 or higher on the rubric below, or the first documented use of a technique in a real attack.
One event gets one record. When new facts appear, the existing record is updated and the change is listed on the corrections page.
AI role
Each record has exactly one primary role for AI.
- Weapon. The attacker used AI to carry out the attack: reconnaissance, exploitation, malware, social engineering or running the operation.
- Target. An AI system, its keys or its data were compromised, including agents and models.
- Vector. An AI feature or integration was the way in, including AI-themed lures such as fake AI apps.
Autonomy
Set when AI was the weapon. It records how much of the attack the AI ran, as the cited source describes it.
- Assisted. AI helped with single tasks, people ran the attack.
- Orchestrated. AI ran the steps, people made the calls.
- Autonomous. AI ran the attack with little human direction.
- Unknown. The sources do not say how much AI decided.
When a source describes the phases of an attack, the record shows them under “Who did the work”, with each phase marked as done by AI, by people or by both, and the human decision points between them. Every value there comes from a cited source.
Evidence
| Level | Meaning | Where it goes |
|---|---|---|
| E1 | Confirmed by the victim, a government body or the AI vendor whose product was abused, in a primary document | Registry |
| E2 | A named security vendor’s analysis of its own data, not yet corroborated | Registry, labelled single-source |
| E3 | Credible reporting or an attacker’s claim; the victim is silent or denies it | Watch list; may be news marked unconfirmed |
| E4 | Research or a proof of concept | News or explainers only, marked research |
Only E1 and E2 events become records. An E2 record moves to E1 when a primary document confirms it.
Severity
Severity measures the scale of harm. A record gets the highest level for which any one condition holds, using figures from the cited sources.
| Level | Any one of |
|---|---|
| 5, critical | Loss of $100 million or more; 10 million records or more; 100 organisations or more; disruption of critical infrastructure |
| 4, severe | Loss of $10 million or more; 1 million records or more; 20 organisations or more; a government or critical-infrastructure victim breached |
| 3, significant | Loss of $1 million or more; 10,000 records or more; 3 organisations or more; a widely deployed AI product with real user exposure |
| 2, limited | Confirmed real impact below level 3 |
| 1, minimal | First documented in-the-wild use of a technique, with minimal or unknown impact |
Each loss figure is marked as verified, estimated or claimed. The site’s totals add up verified figures only; the others are shown on the record with their basis.
News confidence
Every news item carries one of four labels.
- Confirmed. Stated by the company or authority involved in its own publication.
- Reported. Reported by a named security firm from its own data, not yet confirmed by those affected.
- Unconfirmed. Credible reporting or an attacker’s claim; those affected have not confirmed it.
- Research. Research or a proof of concept, not an attack on a real victim.
Sources
- Every record has at least one primary, government or vendor source. Catalogue entries such as MITRE ATT&CK support mappings and dates but are never the only source.
- The writer opens the primary document itself; nothing is written from a rewrite alone. If the primary cannot be opened, the event waits.
- Every number, date, name and attribution in the text is in a cited source. When sources disagree, the record gives the range and says who says what.
- Vendor self-reports are stated as “according to” the vendor. Attribution keeps the source’s own confidence.
- AI product names are spelled as the primary source spells them.
- Each source links to an archived copy when one exists.
How the agents work
AI agents research, write and check every page, on a schedule and without a person reviewing each page before it goes live. The rules they follow are the ones on this page and in the editorial policy.
- Daily. An agent reads security feeds, groups reports of the same event, and writes at most three news items and two new records, opening every primary source. Publishing nothing is an accepted result.
- Check. A separate agent opens every cited source and marks each claim as supported or not. A page with an unsupported claim is fixed once or held back.
- Validation. Before publishing, a script checks every record for required sources, dead links, ratings, dates, ids and lengths. The site does not build if a check fails.
- Weekly. An agent writes the weekly digest, revisits events waiting for confirmation and updates records when new facts appear.
Type and vendor pages appear only once 3 or more records share the type or vendor.
Disputing a record
If you think a record is wrong, write to us with the record id and a link to the document that shows the error. A factual error is fixed in place and the change is listed on the record and on the corrections page. A record that turns out not to qualify is retracted: it keeps its address, shows why it was withdrawn and is left out of every count.