AI Risk Register · free download
AI Risk Register — 30 real-world risks
Every risk below is grounded in a documented incident or published research — Samsung's ChatGPT data leak, the $25M deepfake CEO fraud, prompt injection across every major model, EU AI Act enforcement deadlines and more. Download the full register as CSV and use it as a starting point for your own AI risk program.
Severity scores use a simple Likelihood (1–5) × Impact (1–5) matrix. Critical ≥ 20, High ≥ 12, Medium ≥ 6, Low < 6. Adjust the scores to your environment — these are defaults, not gospel.
5
Critical
20
High
5
Medium
0
Low
| ID | Risk | Category | Severity | Score | Controls | Tool |
|---|---|---|---|---|---|---|
| AIR-001 | Confidential data leakage via LLM prompts Samsung engineers pasted proprietary source code into ChatGPT (2023), leading to a company-wide ban. | Data & Privacy | Critical | 25 5×5 | DLP on AI endpoints; approved-tool-only policy; prompt logging | Prompt Scan |
| AIR-002 | Deepfake-enabled CEO fraud Attackers used AI-cloned voice and video of a CFO to trick an employee into wiring US $25M in Hong Kong (2024). | Security | Critical | 15 3×5 | Out-of-band verification for wire transfers; deepfake awareness training; callback procedures | |
| AIR-003 | Prompt injection in LLM-powered applications Demonstrated across GPT-4, Claude, Gemini — attackers override system prompts to exfiltrate data or alter behavior. | Security | Critical | 20 5×4 | Input sanitization; privilege separation; output filtering; red-team testing | Prompt Scan |
| AIR-007 | Malicious models in public registries JFrog researchers found 100+ malicious models on HuggingFace with hidden code execution via pickle deserialization (2024). | Supply Chain | Critical | 20 4×5 | Model provenance verification; scan before load; pin model hashes; internal model registry | Model Risk Scanner |
| AIR-015 | Insecure AI agent tool use OWASP Agentic AI Top 10 (2025) — agents granted broad tool access executing unintended file, DB or API operations. | Security | Critical | 20 4×5 | Least-privilege tool grants; human-in-the-loop for destructive actions; tool-call audit logging; sandboxed execution | Agent Governance Plane |
| AIR-004 | Shadow AI — unauthorized tool adoption Salesforce survey (2024): 55% of generative-AI users at work had not received employer approval. | Governance | High | 20 5×4 | AI acceptable-use policy; network-level visibility; approved tool catalogue | |
| AIR-005 | AI hallucination in high-stakes decisions Lawyer Steven Schwartz cited six fabricated case citations generated by ChatGPT in a federal filing — Mata v. Avianca (2023). | Operational | High | 20 5×4 | Mandatory human review for any AI-assisted output used in decisions; citation verification workflows | |
| AIR-006 | Training data poisoning Nightshade and Glaze tools (2024) demonstrated practical poisoning of image-model training data at scale. | Security | High | 15 3×5 | Data provenance tracking; input validation on training pipelines; anomaly detection on training metrics | Model Risk Scanner |
| AIR-008 | AI-powered phishing at scale WormGPT and FraudGPT (2023) — purpose-built LLMs for generating convincing phishing emails, lowering attacker skill barrier. | Security | High | 20 5×4 | AI-aware email gateway; phishing simulation training; DMARC/DKIM/SPF enforcement | |
| AIR-009 | Jailbreak attacks bypassing safety guardrails Many-shot jailbreaking (Anthropic, 2024), DAN prompts, and crescendo attacks consistently bypass model alignment. | Security | High | 20 5×4 | Layered guardrails (input + output); behavioral monitoring; model red-teaming; rate limiting | Model Audit |
| AIR-010 | Biased AI in hiring and HR decisions Amazon scrapped an AI recruiting tool that systematically downgraded female applicants (disclosed 2018, widely cited since). | Legal & Compliance | High | 16 4×4 | Bias testing before deployment; demographic parity checks; human override; NYC Local Law 144 compliance | |
| AIR-011 | AI API key and credential exposure GitGuardian (2024): 12.8M secrets detected in public GitHub repos — OpenAI, Anthropic and cloud-AI keys among the fastest-growing categories. | Data & Privacy | High | 16 4×4 | Secret scanning in CI/CD; key rotation automation; vault-based secret management; least-privilege API scopes | |
| AIR-012 | Adversarial evasion of ML-based security tools Academic research and real-world bypasses of ML-based malware classifiers, spam filters, and fraud-detection models using adversarial perturbations. | Security | High | 12 3×4 | Ensemble detection; adversarial training; signature + ML hybrid approach; regular model retraining | |
| AIR-013 | AI copyright and IP infringement NYT v. OpenAI (2023), Getty v. Stability AI (2023) — lawsuits alleging training on copyrighted works without license. | Legal & Compliance | High | 16 4×4 | Training data audit; license clearance; opt-out compliance; output watermarking | |
| AIR-014 | GDPR / data-protection violations from AI processing Italy's Garante temporarily banned ChatGPT (March 2023) for GDPR violations — unlawful processing, no age verification, no legal basis. | Legal & Compliance | High | 16 4×4 | DPIA before deployment; lawful basis documentation; data-subject rights workflows; DPO involvement in AI projects | |
| AIR-016 | MCP server tool-poisoning attack Invariant Labs disclosed tool-poisoning attacks via MCP servers — injecting hidden instructions into tool descriptions to exfiltrate data (2025). | Supply Chain | High | 15 3×5 | MCP config audit; description-change detection across scans; tool allowlisting; server hash pinning | MCP Scan |
| AIR-017 | AI model theft via API extraction Researchers demonstrated near-perfect extraction of production models (including GPT-like transformers) through systematic API querying (multiple papers, 2020–2024). | Security | High | 15 3×5 | Query rate limiting; output perturbation; watermarking; API access monitoring; differential privacy | |
| AIR-018 | Excessive AI agent autonomy ChaosGPT experiment (2023) — autonomous agent attempted to acquire resources and recruit other AI agents beyond operator intent. | Governance | High | 15 3×5 | Bounded autonomy policies; kill switches; action logging; human approval for high-impact steps | Agent Governance Plane |
| AIR-019 | AI-generated code introducing vulnerabilities Stanford study (2023): developers using AI code assistants produced significantly less secure code and were more confident it was secure. | Operational | High | 15 5×3 | SAST/DAST on AI-generated code; mandatory code review; security-focused AI coding guidelines | NPM Scanner |
| AIR-021 | Absent AI model governance (no model cards, no inventory) EU AI Act (effective 2024–2026) requires AI system registration, risk classification and documentation — organizations without an inventory cannot comply. | Governance | High | 16 4×4 | AI model inventory (AIBOM); model cards for every production model; lifecycle governance policy | AI BOM |
| AIR-023 | Indirect prompt injection via retrieved documents Demonstrated in RAG systems — adversary plants instructions in a document the AI retrieves, hijacking the response (Greshake et al., 2023; live exploits in Bing Chat). | Security | High | 16 4×4 | Data/instruction separation; retrieved-content sandboxing; output validation; RAG content filtering | Prompt Scan |
| AIR-025 | Deployment of abliterated / uncensored models Uncensored Llama, Dolphin and WizardLM variants circulate on HuggingFace — refusal training removed, producing harmful content on request. | Governance | High | 15 3×5 | Model provenance verification; abliteration detection; restricted deployment environments; output monitoring | Abliterated Model Risk |
| AIR-026 | AI-enhanced social engineering (voice cloning, video deepfakes) Multiple reported incidents of AI voice clones used in vishing (2023–2024); deepfake video calls used to impersonate executives. | Security | High | 16 4×4 | Multi-factor identity verification; verbal code words for sensitive requests; deepfake detection tooling; awareness training | |
| AIR-029 | PII and credentials leaked in training datasets Carlini et al. (2021, 2023): GPT-2 and ChatGPT memorize and regurgitate PII, phone numbers and email addresses from training data. | Data & Privacy | High | 16 4×4 | PII scrubbing in training pipelines; differential privacy; output filtering for PII patterns; data retention policy | |
| AIR-030 | EU AI Act non-compliance — failure to classify AI system risk EU AI Act (Aug 2025 enforcement for prohibited practices, Aug 2026 for high-risk): organizations without a risk classification face fines up to €35M or 7% of global revenue. | Legal & Compliance | High | 20 4×5 | AI system inventory with risk classification; conformity assessment for high-risk; prohibited-use screening; appointed AI officer | AI Threat Model Builder |
| AIR-020 | Third-party AI API single point of failure OpenAI major outage (Nov 2023, 2+ hours) — every product built on its API went down simultaneously. | Operational | Medium | 16 4×4 | Multi-provider fallback; local model option; graceful degradation; SLA monitoring | |
| AIR-022 | AI-enabled mass surveillance overreach Clearview AI fined €20M by French CNIL (2022) and ordered to delete data; similar actions by UK ICO, Italian Garante and Australian OAIC. | Legal & Compliance | Medium | 15 3×5 | Privacy impact assessment; facial recognition use policy; consent mechanisms; jurisdictional compliance review | |
| AIR-024 | Model collapse from synthetic training data Shumailov et al. (Nature, 2024): models trained on AI-generated text progressively degrade — "model collapse" — losing distributional tails. | Operational | Medium | 12 3×4 | Training data provenance; synthetic-data labeling; human-generated data preservation; output quality monitoring | |
| AIR-027 | Automation bias — over-reliance on AI without human review NTSB investigations cite automation complacency in aviation incidents; same pattern emerging in AI-assisted medical diagnosis and content moderation. | Operational | Medium | 15 5×3 | Mandatory human-in-the-loop for critical decisions; confidence-threshold alerts; UX that surfaces uncertainty | |
| AIR-028 | AI denial-of-service / resource exhaustion Sponge examples (2022) and adversarial inputs that maximize compute cost — a single crafted prompt can consume 100× normal GPU time. | Operational | Medium | 9 3×3 | Per-user rate limiting; input length caps; cost monitoring; auto-scaling with spend ceiling |
Showing 30 of 30 risks · Incidents cited through September 2025
Methodology
- Risk identification: Each risk is grounded in a documented incident, published vulnerability research, or an active regulatory enforcement action — not hypothetical.
- Scoring: Likelihood (1–5) × Impact (1–5). Severity bands: Critical ≥ 20, High ≥ 12, Medium ≥ 6, Low < 6. Calibrate to your own environment.
- Controls: The recommended controls column lists the most effective mitigations per risk. Many map to NIST AI RMF, ISO/IEC 42001 and OWASP AI/LLM Top 10 controls.
- Maintenance: Review quarterly. AI threats evolve faster than traditional IT risks — a quarterly cadence catches new attack classes (e.g. MCP tool poisoning emerged in early 2025).
How to use this register
- Download the CSV — it includes every column you see here plus the raw Likelihood and Impact scores.
- Delete risks that do not apply to your environment (e.g. if you do not deploy agentic AI, remove AIR-015/018).
- Adjust Likelihood and Impact to match your context — a company with no AI-facing APIs has a lower AIR-003 likelihood.
- Assign an owner and a treatment (mitigate, accept, transfer, avoid) per row.
- Set review dates — quarterly is the floor for an AI risk register given the pace of change.