AIVSS Calculator: OWASP AI Vulnerability Scoring

Where AIVSS stands

AIVSS is an OWASP incubator project led by Michael Bargury, Vineeth Sai Narajala and Ken Huang. OWASP's site lists the v0.8 publication as the latest, v0.5 as archived, and links a separate “AIVSS 1.0” reference calculator marked live. We found no single finished specification: the 0.8 text calls itself “a living framework”, and the 1.0 calculator says its Effect Class is “unvalidated”. Treat any score as an input to a decision, not a verdict.

The two models side by side

	v0.8 formula	1.0 reference calculator
Input	CVSS v4.0 base score, ten factors at 0 / 0.5 / 1, exploit maturity, mitigation strength	CVSS v4.0 score, four classifying metrics (LC, CP, AP, RH) and one uplift metric (ES)
Method	Arithmetic: AARS = (10 − CVSS) × (Factor_Sum / 10) × ThM; AIVSS = (CVSS + AARS) × Mitigation	Ordered rule ladder gives an Effect Class (A0, A1, A2, AX); a lookup table gives the score; never lower than CVSS
Can lower the score	Yes, a strong mitigation multiplies by 0.67	No
Stated status	“Living framework”; mitigation floor “provisional”	Effect Class “unvalidated”; timeline overlays “experimental-uncalibrated”

We did not implement OWASP's separate “AIVSS-SSVC” page, which uses yet another set of inputs. For a response decision, use the SSVC calculator.

Agentic AI risk factors, explained

The ten amplification factors in v0.8, each with a plain example and a place on this site to practise the defence. The factor names are OWASP's; the examples are ours.

1. Execution Autonomy

A coding agent that merges and deploys its own changes with nobody approving, against one that only drafts a pull request for review.

Practise: Agent tool scope lab

2. External Tool Control Surface

An MCP server that can run SQL and call a cloud API, against a read-only search tool.

Practise: MCP security linter, MCP server risk

3. Natural Language Interface

A support agent whose tool calls are chosen by whatever text a customer types, against a form that only accepts fixed fields.

Practise: Prompt-injection harness lab, Prompt injection tester

4. Contextual Awareness

An agent that reads email, calendar, tickets and web pages to decide what to do next, against one that sees a single input.

Practise: OWASP LLM Top 10

5. Behavioral Non-Determinism

The same request sometimes triggers a refund and sometimes does not, because tool choice is sampled.

Practise: Agent eval integrity lab

6. Opacity & Reflexivity

No log shows which retrieved document made the agent send a file, so nobody can reconstruct why.

Practise: Agent trace triage lab

7. Persistent State Retention

A poisoned note saved to long-term memory that steers the agent weeks later.

Practise: Agent memory governance lab

8. Dynamic Identity

An agent that can act as the user, as a service account and as an admin, depending on the step.

Practise: Agent governance plane

9. Multi-Agent Interactions

An orchestrator that hands tasks to sub-agents and trusts what they report back.

Practise: Subagent delegation trust lab

10. Self-Modification

An agent that installs plugins, edits its own instructions or writes and runs code to extend itself.

Practise: Plugin supply-chain lab, Harness attack-surface lab

OWASP's own risk-to-factor matrix links each factor to the agentic core risks it drives; see the PDF's Table 3. For models with safety training removed, read the abliterated LLM risk guide and the abliterated model risk calculator. For the agent trust boundary, see the OWASP agent and OpenCRE explainer.

How to use a score

Score the CVSS v4.0 base first, and include subsequent-system impact if the agent can reach other systems.
Put the model name and version on every score. A v0.8 number and a 1.0 number are not comparable.
Compare by severity band. OWASP says not to rank by decimals or average scores.
When the uplift is large compared with the CVSS score, OWASP says the deployment context, not the bug, is the main risk: reduce autonomy, tool access and memory.

Sources

OWASP AIVSS project, aivss.owasp.org; site content is under CC BY-SA 4.0 per its footer. Accessed 2026-11-03.
OWASP, AIVSS Scoring System For OWASP Agentic AI Core Security Risks v0.8 (PDF), sections 2 and 3, Tables 1 to 4b and the section 3.6.1 example (CVSS 9.4, Factor_Sum 9.0, AARS 0.5238, AIVSS 9.9). Accessed 2026-11-03.
OWASP, AIVSS 1.0 reference calculator (calculator 1.2.0, rubric 1.2.0), and its repository README (Table 6, ladder, status wording). Accessed 2026-11-03.
OWASP, AI Vulnerability Scoring System project page (incubator project, leaders). Accessed 2026-11-03.
FIRST, CVSS v4.0 specification, the baseline both models need.

Frequently asked questions

What is AIVSS?

AIVSS, the AI Vulnerability Scoring System, is an OWASP incubator project that extends CVSS-style scoring to AI systems, starting with agentic AI. OWASP describes its first deliverable as a scoring system for the Agentic AI core risks. The idea is that an agent's autonomy, tool access and memory can amplify a technical flaw, so the same bug scores higher in an autonomous agent than in a passive tool.

Is AIVSS an official standard?

No. It is an OWASP incubator project and its documents are drafts. The v0.8 PDF calls itself a living framework and describes its 0.67 mitigation floor as a provisional anchor subject to calibration. The 1.0 reference calculator labels its Effect Class unvalidated. AIVSS is not part of FIRST CVSS, and a score from this page is not an official CVSS score.

Why are there two AIVSS models on this page?

OWASP currently publishes both. The v0.8 PDF uses ten factors scored 0, 0.5 or 1 and arithmetic: AARS = (10 - CVSS) x (Factor_Sum / 10) x ThM, then AIVSS = (CVSS + AARS) x Mitigation_Factor. The 1.0 reference calculator uses four categorical metrics to pick an Agentic Effect Class (A0, A1, A2 or AX) and reads the score from a lookup table. They give different numbers for the same finding, so name the model you used.

What is AARS?

AARS is the Agentic AI Risk Score in the v0.8 model: the agentic uplift added to the CVSS v4.0 base score. It is the share of the remaining gap to 10 that the agent's capabilities close, scaled by exploit maturity. OWASP calls it an intermediate value and not the reported score. The final AIVSS adds it to CVSS and applies a mitigation factor.

Which AIVSS version should I use?

Use the one your programme has adopted and state it in every report. The v0.8 formula is the longest-published and easiest to audit by hand. The 1.0 reference calculator is newer and simpler to apply but says its Effect Class is unvalidated. Do not mix scores from the two models in one ranking.

How do I score a prompt injection or tool misuse finding?

Score the underlying flaw with CVSS v4.0 first, including subsequent-system impact if the agent can reach other systems. Then rate the ten factors for the agent in its real deployment: autonomy, tool scope, whether natural language drives execution, memory, and so on. Weak guardrails on a broad-tool, autonomous agent push the uplift up. Constraining the agent lowers the factors and is usually a better fix than patching alone.

Can I average AIVSS scores across findings?

OWASP says not to. The v0.8 PDF treats AIVSS as ordinal, tells assessors not to average scores, and to compare findings by severity band (Critical 9.0 to 10.0, High 7.0 to 8.9, Medium 4.0 to 6.9, Low 0.1 to 3.9) rather than by decimals.

How does AIVSS relate to SSVC, the OWASP Agentic Top 10 and MITRE ATLAS?

OWASP says it is working on an SSVC-based qualitative approach to run alongside AIVSS bands, so a score can become a response decision; our SSVC calculator covers the CISA tree. The v0.8 PDF maps its ten amplification factors to ten OWASP agentic core risks. MITRE ATLAS is a knowledge base of adversary techniques against AI systems, not a scoring method.