AI Risk Register — 30 real-world risks
Every risk below is grounded in a documented incident or published research — Samsung's ChatGPT data leak, the $25M deepfake CEO fraud, prompt injection across every major model, EU AI Act enforcement deadlines and more. Download the full register as CSV and use it as a starting point for your own AI risk program.
Severity scores use a simple Likelihood (1–5) × Impact (1–5) matrix. Critical ≥ 20, High ≥ 12, Medium ≥ 6, Low < 6. Adjust the scores to your environment — these are defaults, not gospel.
| ID | Risk | Category | Severity | Score | Controls | Tool |
|---|---|---|---|---|---|---|
| AIR-001 | Confidential data leakage via LLM prompts Samsung engineers pasted proprietary source code into ChatGPT (2023), leading to a company-wide ban. | Data & Privacy | Critical | 25 5×5 | DLP on AI endpoints; approved-tool-only policy; prompt logging | Prompt Scan |
| AIR-002 | Deepfake-enabled CEO fraud Attackers used AI-cloned voice and video of a CFO to trick an employee into wiring US $25M in Hong Kong (2024). | Security | Critical | 15 3×5 | Out-of-band verification for wire transfers; deepfake awareness training; callback procedures | |
| AIR-003 | Prompt injection in LLM-powered applications Demonstrated across GPT-4, Claude, Gemini — attackers override system prompts to exfiltrate data or alter behavior. | Security | Critical | 20 5×4 | Input sanitization; privilege separation; output filtering; red-team testing | Prompt Scan |
| AIR-007 | Malicious models in public registries JFrog researchers found 100+ malicious models on HuggingFace with hidden code execution via pickle deserialization (2024). | Supply Chain | Critical | 20 4×5 | Model provenance verification; scan before load; pin model hashes; internal model registry | Model Risk Scanner |
| AIR-015 | Insecure AI agent tool use OWASP Agentic AI Top 10 (2025) — agents granted broad tool access executing unintended file, DB or API operations. | Security | Critical | 20 4×5 | Least-privilege tool grants; human-in-the-loop for destructive actions; tool-call audit logging; sandboxed execution | Agent Governance Plane |
| AIR-004 | Shadow AI — unauthorized tool adoption Salesforce survey (2024): 55% of generative-AI users at work had not received employer approval. | Governance | High | 20 5×4 | AI acceptable-use policy; network-level visibility; approved tool catalogue | |
| AIR-005 | AI hallucination in high-stakes decisions Lawyer Steven Schwartz cited six fabricated case citations generated by ChatGPT in a federal filing — Mata v. Avianca (2023). | Operational | High | 20 5×4 | Mandatory human review for any AI-assisted output used in decisions; citation verification workflows | |
| AIR-006 | Training data poisoning Nightshade and Glaze tools (2024) demonstrated practical poisoning of image-model training data at scale. | Security | High | 15 3×5 | Data provenance tracking; input validation on training pipelines; anomaly detection on training metrics | Model Risk Scanner |
| AIR-008 | AI-powered phishing at scale WormGPT and FraudGPT (2023) — purpose-built LLMs for generating convincing phishing emails, lowering attacker skill barrier. | Security | High | 20 5×4 | AI-aware email gateway; phishing simulation training; DMARC/DKIM/SPF enforcement | |
| AIR-009 | Jailbreak attacks bypassing safety guardrails Many-shot jailbreaking (Anthropic, 2024), DAN prompts, and crescendo attacks consistently bypass model alignment. | Security | High | 20 5×4 | Layered guardrails (input + output); behavioral monitoring; model red-teaming; rate limiting | Model Audit |
| AIR-010 | Biased AI in hiring and HR decisions Amazon scrapped an AI recruiting tool that systematically downgraded female applicants (disclosed 2018, widely cited since). | Legal & Compliance | High | 16 4×4 | Bias testing before deployment; demographic parity checks; human override; NYC Local Law 144 compliance | |
| AIR-011 | AI API key and credential exposure GitGuardian (2024): 12.8M secrets detected in public GitHub repos — OpenAI, Anthropic and cloud-AI keys among the fastest-growing categories. | Data & Privacy | High | 16 4×4 | Secret scanning in CI/CD; key rotation automation; vault-based secret management; least-privilege API scopes | |
| AIR-012 | Adversarial evasion of ML-based security tools Academic research and real-world bypasses of ML-based malware classifiers, spam filters, and fraud-detection models using adversarial perturbations. | Security | High | 12 3×4 | Ensemble detection; adversarial training; signature + ML hybrid approach; regular model retraining | |
| AIR-013 | AI copyright and IP infringement NYT v. OpenAI (2023), Getty v. Stability AI (2023) — lawsuits alleging training on copyrighted works without license. | Legal & Compliance | High | 16 4×4 | Training data audit; license clearance; opt-out compliance; output watermarking | |
| AIR-014 | GDPR / data-protection violations from AI processing Italy's Garante temporarily banned ChatGPT (March 2023) for GDPR violations — unlawful processing, no age verification, no legal basis. | Legal & Compliance | High | 16 4×4 | DPIA before deployment; lawful basis documentation; data-subject rights workflows; DPO involvement in AI projects | |
| AIR-016 | MCP server tool-poisoning attack Invariant Labs disclosed tool-poisoning attacks via MCP servers — injecting hidden instructions into tool descriptions to exfiltrate data (2025). | Supply Chain | High | 15 3×5 | MCP config audit; description-change detection across scans; tool allowlisting; server hash pinning | MCP Scan |
| AIR-017 | AI model theft via API extraction Researchers demonstrated near-perfect extraction of production models (including GPT-like transformers) through systematic API querying (multiple papers, 2020–2024). | Security | High | 15 3×5 | Query rate limiting; output perturbation; watermarking; API access monitoring; differential privacy | |
| AIR-018 | Excessive AI agent autonomy ChaosGPT experiment (2023) — autonomous agent attempted to acquire resources and recruit other AI agents beyond operator intent. | Governance | High | 15 3×5 | Bounded autonomy policies; kill switches; action logging; human approval for high-impact steps | Agent Governance Plane |
| AIR-019 | AI-generated code introducing vulnerabilities Stanford study (2023): developers using AI code assistants produced significantly less secure code and were more confident it was secure. | Operational | High | 15 5×3 | SAST/DAST on AI-generated code; mandatory code review; security-focused AI coding guidelines | NPM Scanner |
| AIR-021 | Absent AI model governance (no model cards, no inventory) EU AI Act (effective 2024–2026) requires AI system registration, risk classification and documentation — organizations without an inventory cannot comply. | Governance | High | 16 4×4 | AI model inventory (AIBOM); model cards for every production model; lifecycle governance policy | AI BOM |
| AIR-023 | Indirect prompt injection via retrieved documents Demonstrated in RAG systems — adversary plants instructions in a document the AI retrieves, hijacking the response (Greshake et al., 2023; live exploits in Bing Chat). | Security | High | 16 4×4 | Data/instruction separation; retrieved-content sandboxing; output validation; RAG content filtering | Prompt Scan |
| AIR-025 | Deployment of abliterated / uncensored models Uncensored Llama, Dolphin and WizardLM variants circulate on HuggingFace — refusal training removed, producing harmful content on request. | Governance | High | 15 3×5 | Model provenance verification; abliteration detection; restricted deployment environments; output monitoring | Abliterated Model Risk |
| AIR-026 | AI-enhanced social engineering (voice cloning, video deepfakes) Multiple reported incidents of AI voice clones used in vishing (2023–2024); deepfake video calls used to impersonate executives. | Security | High | 16 4×4 | Multi-factor identity verification; verbal code words for sensitive requests; deepfake detection tooling; awareness training | |
| AIR-029 | PII and credentials leaked in training datasets Carlini et al. (2021, 2023): GPT-2 and ChatGPT memorize and regurgitate PII, phone numbers and email addresses from training data. | Data & Privacy | High | 16 4×4 | PII scrubbing in training pipelines; differential privacy; output filtering for PII patterns; data retention policy | |
| AIR-030 | EU AI Act non-compliance — failure to classify AI system risk EU AI Act (Aug 2025 enforcement for prohibited practices, Aug 2026 for high-risk): organizations without a risk classification face fines up to €35M or 7% of global revenue. | Legal & Compliance | High | 20 4×5 | AI system inventory with risk classification; conformity assessment for high-risk; prohibited-use screening; appointed AI officer | AI Threat Model Builder |
| AIR-020 | Third-party AI API single point of failure OpenAI major outage (Nov 2023, 2+ hours) — every product built on its API went down simultaneously. | Operational | Medium | 16 4×4 | Multi-provider fallback; local model option; graceful degradation; SLA monitoring | |
| AIR-022 | AI-enabled mass surveillance overreach Clearview AI fined €20M by French CNIL (2022) and ordered to delete data; similar actions by UK ICO, Italian Garante and Australian OAIC. | Legal & Compliance | Medium | 15 3×5 | Privacy impact assessment; facial recognition use policy; consent mechanisms; jurisdictional compliance review | |
| AIR-024 | Model collapse from synthetic training data Shumailov et al. (Nature, 2024): models trained on AI-generated text progressively degrade — "model collapse" — losing distributional tails. | Operational | Medium | 12 3×4 | Training data provenance; synthetic-data labeling; human-generated data preservation; output quality monitoring | |
| AIR-027 | Automation bias — over-reliance on AI without human review NTSB investigations cite automation complacency in aviation incidents; same pattern emerging in AI-assisted medical diagnosis and content moderation. | Operational | Medium | 15 5×3 | Mandatory human-in-the-loop for critical decisions; confidence-threshold alerts; UX that surfaces uncertainty | |
| AIR-028 | AI denial-of-service / resource exhaustion Sponge examples (2022) and adversarial inputs that maximize compute cost — a single crafted prompt can consume 100× normal GPU time. | Operational | Medium | 9 3×3 | Per-user rate limiting; input length caps; cost monitoring; auto-scaling with spend ceiling |
Showing 30 of 30 risks · Incidents cited through September 2025
Methodology
- Risk identification: Each risk is grounded in a documented incident, published vulnerability research, or an active regulatory enforcement action — not hypothetical.
- Scoring: Likelihood (1–5) × Impact (1–5). Severity bands: Critical ≥ 20, High ≥ 12, Medium ≥ 6, Low < 6. Calibrate to your own environment.
- Controls: The recommended controls column lists the most effective mitigations per risk. Many map to NIST AI RMF, ISO/IEC 42001 and OWASP AI/LLM Top 10 controls.
- Maintenance: Review quarterly. AI threats evolve faster than traditional IT risks — a quarterly cadence catches new attack classes (e.g. MCP tool poisoning emerged in early 2025).
How to use this register
- Download the CSV — it includes every column you see here plus the raw Likelihood and Impact scores.
- Delete risks that do not apply to your environment (e.g. if you do not deploy agentic AI, remove AIR-015/018).
- Adjust Likelihood and Impact to match your context — a company with no AI-facing APIs has a lower AIR-003 likelihood.
- Assign an owner and a treatment (mitigate, accept, transfer, avoid) per row.
- Set review dates — quarterly is the floor for an AI risk register given the pace of change.
Loading…
Sample report · illustrative data
Sample result: AI risk register
Example rows from the register of 30 AI risks. Each risk has a category, a likelihood and impact score from 1 to 5, a severity band and recommended controls, and the table can be sorted, filtered and adjusted to your context.
How scores work
- Risk score
- Likelihood (1 to 5) x Impact (1 to 5)
- Severity bands
- Critical 20 or more, High 12 or more, Medium 6 or more, Low below 6
- Categories
- Data & Privacy, Security, Governance, Operational, Legal & Compliance, Supply Chain
Example register rows
| ID | Risk | Category | L x I | Score | Severity | Recommended controls |
|---|---|---|---|---|---|---|
| AIR-001 | Confidential data leakage via LLM prompts | Data & Privacy | 5 x 5 | 25 | Critical | DLP on AI endpoints; approved-tool-only policy; prompt logging |
| AIR-003 | Prompt injection in LLM-powered applications | Security | 5 x 4 | 20 | Critical | Input sanitization; privilege separation; output filtering; red-team testing |
| AIR-007 | Malicious models in public registries | Supply Chain | 4 x 5 | 20 | Critical | Model provenance verification; scan before load; pin model hashes; internal model registry |
| AIR-015 | Insecure AI agent tool use | Security | 4 x 5 | 20 | Critical | Least-privilege tool grants; human-in-the-loop for destructive actions; tool-call audit logging; sandboxed execution |
| AIR-020 | Third-party AI API single point of failure | Operational | 4 x 4 | 16 | Medium | Multi-provider fallback; local model option; graceful degradation; SLA monitoring |
Using it
The register ships with default scores. Adjust likelihood and impact to your own environment, since a company with no AI-facing APIs has a lower prompt-injection likelihood, then work the Critical rows first.
Made-up example data. Your own run uses your inputs. Downloads of the full report need Pro.
Frequently asked questions
What is an AI risk register?
An AI risk register is a structured catalogue of the risks an organisation faces from adopting AI — data leakage, prompt injection, deepfake fraud, shadow AI, biased outputs, malicious models, regulatory exposure and more — each recorded with its likelihood, impact, severity and the controls that mitigate it. PlayCISO's register lists 30 such risks, every one grounded in a documented real-world incident.
What are the biggest AI risks for organisations?
The highest-severity AI risks include confidential data leakage through LLM prompts (the Samsung source-code leak), deepfake-enabled executive fraud (the $25M Hong Kong wire fraud), prompt injection in LLM-powered applications, malicious models in public registries, and insecure AI agent tool use. Governance risks like shadow AI (unauthorised tool adoption) and legal risks like GDPR and copyright exposure round out the top tier.
How is each risk scored?
Each risk carries a likelihood (1–5) and an impact (1–5); their product drives a severity band of Critical, High, Medium or Low. The register also records a category (Data & Privacy, Security, Governance, Operational, Legal & Compliance, Supply Chain), the real incident it is grounded in, recommended controls, and — where relevant — a linked PlayCISO tool to help address it.
Can I download the AI risk register?
Yes, with a free account (3 free tool runs, shared across every tool; then Pro). You can browse, filter and sort the full register in the browser and export all 30 risks — with categories, severity, likelihood, impact and controls — as a CSV to drop into your own GRC tooling, board deck or risk-management process.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.