Standards crosswalk

Security and risk teams already work from a handful of public catalogs. This page lines up the failures described in Part Two with four of them. OWASP, a nonprofit security community, publishes a Top 10 for LLM Applications¹ and a Top 10 for Agentic Applications.² MITRE keeps ATLAS, a catalog of attacks on AI systems.³ NIST publishes the AI Risk Management Framework,⁴ with a profile for generative AI.⁵ A short section covers the one article of the EU AI Act that names specific attacks.

The item numbers and names below are copied from those documents. Which item matches which failure is the author’s judgment; the catalogs themselves make no such mapping.

OWASP and MITRE ATLAS, by failure

Each cell gives the closest item and how it relates. Names means the item describes this failure. Part means it covers one part of it. Route means it describes an attacker’s way in, while the failure can also happen with no attacker. Nearest means nothing matches and the item named is the closest. The item names are in the key at the end of the page.

Nine failures meet no item in any of the three catalogs: distribution shift and safety tax (Chapter 6), over-refusal and monitor staleness (Chapter 7), evaluation blind spots and black-box only (Chapter 9), and off-instruction action, unsafe exploration and the certification gap (Chapter 11).

The pattern is plain in the table. Eight of the eleven failures in Chapter 10, where an attacker usually supplies the input, are named by at least one item. None of the failures in Chapters 6 and 7, which come from training and from changes to a deployed system, is. Update regression has only a malicious relative, the “rug pull” (AML.T0109), in which an adopted component turns hostile after an update.³ OWASP’s LLM list does cover one change-related case, weights crafted to look harmless at full precision and misbehave once quantized, under Supply Chain.¹ The same loss of safety after compression, with no attacker involved, appears in none of the catalogs.

Where each failure enters

Each failure in Part Two enters a system at one main stage: data and supply chain, pretraining, post-training and fine-tuning, deployment and inference, agent runtime, continual change after release, or one of the two lanes that run alongside them, evaluation and oversight. Other stages where it can also enter are in parentheses.

Five ATLAS case studies

ATLAS writes up real incidents as case studies.³ Five of them are also cases in Appendix A:

• EchoLeak, a zero-click prompt injection that pulled data out of Microsoft 365 Copilot (AML.CS0059; prompt injection, Chapter 10).³
• Code to deploy a destructive AI agent found in the Amazon Q extension for VS Code (AML.CS0047; agent supply chain, Chapter 8).
• A poisoned Postmark MCP server through which an attacker took users’ emails (AML.CS0053; agent supply chain, Chapter 8).
• Autonomous agents in OpenAI’s internal cyber evaluations that crossed their evaluation boundaries and compromised Hugging Face production systems, in ATLAS’s account (AML.CS0068; instrumental escalation, Chapter 10).
• The GTG-1002 espionage campaign run through Claude Code (AML.CS0069; misuse uplift, Chapter 12).

NIST AI Risk Management Framework

NIST’s framework organizes risk work into four functions: Govern, Map, Measure and Manage.⁴ It does not list failure modes, so the useful mapping runs from its outcomes to the chapters that help meet them.

The generative-AI profile, NIST AI 600-1, names twelve risks.⁵ Five line up with failures in this book. Confabulation matches authoritative confabulation and fabricated actions (Chapter 10). Human-AI Configuration, which covers automation bias and over-reliance, matches sycophancy (Chapter 6) and oversight erosion (Chapter 12). Information Security matches prompt injection (Chapter 10) and misuse uplift (Chapter 12). Value Chain and Component Integration, about untraceable third-party components, matches the supply-chain failures of Chapter 8. CBRN Information or Capabilities, on help toward chemical, biological, radiological or nuclear weapons, matches misuse uplift.

EU AI Act

For high-risk AI systems, Article 15 of the EU AI Act requires measures against “data poisoning”, against manipulation of “pre-trained components used in training (model poisoning)” and against “adversarial examples or model evasion”.⁶ Those match data poisoning and compromised checkpoints (Chapter 8) and physical-channel attacks (Chapter 11).

The same article requires high-risk systems to “perform consistently” throughout their lifecycle and asks that systems which keep learning after release be built to address feedback loops.⁶ No provision of the Act names the other failures in this book.

This page is a reading aid for practitioners and offers no legal advice.

Where each failure appears on alignyourai.com

The site alignyourai.com sorts failures by where they enter a system, on a grid of fifteen layers and fifteen failure words. Each page pairs one layer with one failure and gives the public cases, what people do about it and the sources. The table lists the pages for each failure in Part Two. “Not on the grid” means no pair on the site covers the failure.

Key to the item numbers

OWASP Top 10 for LLM Applications 2026

The 2026 list renumbered the 2025 items and renamed one: “What used to be System Prompt Leakage is now Hidden Context Exposure”.¹ Each 2026 ID ends in “:2026”, left off in the table above.

No failure in this book maps to LLM06, Unbounded Consumption.¹

OWASP Top 10 for Agentic Applications 2026

MITRE ATLAS techniques

Notes

1. OWASP GenAI Security Project. “OWASP Top 10 for LLM Applications 2026.” version 1.0, resource page dated 2026-08-03. https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/. Items LLM01:2026 to LLM10:2026; the quantization supply-chain risk is under LLM04:2026. ↩︎
2. OWASP GenAI Security Project, Agentic Security Initiative. “OWASP Top 10 for Agentic Applications 2026.” resource page dated 2025-12-09. https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/. Items ASI01 to ASI10. ↩︎
3. MITRE. “ATLAS: Adversarial Threat Landscape for AI Systems” (release 2026.09). 2026-09-15. https://atlas.mitre.org/ (data file https://atlas.mitre.org/atlas-data/dist/v6/ATLAS-2026.09.yaml). Technique and case-study IDs and names. ↩︎
4. National Institute of Standards and Technology. “Artificial Intelligence Risk Management Framework (AI RMF 1.0) (NIST AI 100-1).” NIST, 2023-01-26. doi:10.6028/NIST.AI.100-1. The four functions and the subcategories GOVERN 6.1, MEASURE 1.3, 2.4 and 2.7, MANAGE 2.4 and 4.1. ↩︎
5. National Institute of Standards and Technology. “Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (NIST AI 600-1).” NIST, 2024-07-26. doi:10.6028/NIST.AI.600-1. Twelve generative-AI risk categories. ↩︎
6. European Commission, AI Act Service Desk. “Article 15: Accuracy, robustness and cybersecurity” (Regulation (EU) 2024/1689, consolidated text). ai-act-service-desk.ec.europa.eu. https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-15. Paragraphs 1, 4 and 5; Official Journal text at https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng. ↩︎
7. OWASP GenAI Security Project. “OWASP Top 10 for LLM Applications 2025.” genai.owasp.org, 2025 edition. https://genai.owasp.org/llm-top-10/. The 2025 item IDs. ↩︎