genai-security-crosswalk 2.0.0

package/data/entries/DSGAI01.json

@@ -0,0 +1,779 @@
+{
+  "id": "DSGAI01",
+  "name": "Sensitive Data Leakage",
+  "source_list": "DSGAI-2026",
+  "version": "2026-Q1",
+  "severity": "Critical",
+  "aivss_score": null,
+  "audience": [
+    "red-teamer",
+    "security-engineer",
+    "ciso",
+    "compliance",
+    "ml-engineer",
+    "ot-engineer",
+    "auditor",
+    "developer",
+    "data-engineer"
+  ],
+  "mappings": [
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0035",
+      "control_name": "Exfiltrate via ML Inference API",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Adversary queries LLM to extract sensitive data from training corpus, RAG store, or prompt cache through crafted inference queries"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0024.000",
+      "control_name": "Membership Inference",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Adversary determines whether specific sensitive records were used in training — confirms presence of target data"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0025",
+      "control_name": "Exfiltrate via Cyber Means",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Sensitive content in LLM outputs, logs, or observability pipelines captured and transmitted to adversary"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "GV-1.6",
+      "control_name": "Policies for data privacy",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Organisational policy on data classification, handling, and disclosure controls for GenAI data assets"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MP-2.3",
+      "control_name": "Risk categorisation",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Sensitive data leakage categorised and rated in AI system risk register — specific to each deployment"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MS-2.6",
+      "control_name": "Testing — data leakage",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Evaluation programme includes data leakage testing — training data, RAG over-retrieval, output redaction"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MG-2.4",
+      "control_name": "Risk response — data",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Defined incident response for sensitive data disclosure — notification, containment, regulatory reporting"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Training data must be relevant, representative, and subject to appropriate privacy measures",
+      "control_name": "Art. 10 — Data and data governance",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Data governance controls preventing sensitive data ingestion and memorisation are Art. 10 requirements"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "High-risk AI must be resilient and implement cybersecurity measures",
+      "control_name": "Art. 15 — Accuracy, robustness, cybersecurity",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Output scanning, DLP, and access controls on RAG retrieval are Art. 15 technical requirements"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "GPAI providers must maintain technical documentation including training data governance",
+      "control_name": "Art. 53(1)(a) — GPAI documentation",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Data governance for training data — sources, quality, privacy measures — is a GPAI documentation obligation"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.11",
+      "control_name": "Data masking",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Masking or redaction of sensitive data in LLM outputs, RAG results, and prompts"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.12",
+      "control_name": "Data leakage prevention",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "DLP controls on all GenAI output channels — model API, chat interfaces, logs"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.5.12",
+      "control_name": "Classification of information",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All data in GenAI scope classified — training data, RAG corpora, outputs, embeddings"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.3",
+      "control_name": "Information access restriction",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Access controls on RAG data sources limiting retrieval to authorised user scope"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.5.13",
+      "control_name": "Labelling of information",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Classification labels propagated to derived assets — embeddings, caches, summaries"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Data for AI — acquisition",
+      "control_name": "A.7.2",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Data for AI — preparation",
+      "control_name": "A.7.3",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Hardening"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Lifecycle — operational",
+      "control_name": "A.6.2.3",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Impact assessment",
+      "control_name": "A.5.2",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Hardening"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "CIS 3",
+      "control_name": "3.1 — Establish and maintain data management process",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "CIS 3",
+      "control_name": "3.13 — Deploy DLP solutions",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "CIS 8",
+      "control_name": "8.2 — Collect audit logs",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "CIS 16",
+      "control_name": "16.12 — Implement code-level security checks",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V8 Data Protection",
+      "control_name": "V8.1.1 — Sensitive data not transmitted in URL parameters",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V8 Data Protection",
+      "control_name": "V8.3.4 — Sensitive data identified and classified",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V4 Access Control",
+      "control_name": "V4.1.3 — Deny by default access control",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V5 Validation",
+      "control_name": "V5.2.8 — Output encoding for context",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V6 Cryptography",
+      "control_name": "V6.1.1 — Sensitive data not stored in cleartext",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 4.1",
+      "control_name": "Data confidentiality",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All OT data flowing through GenAI systems encrypted — historian exports, embedding stores, prompt caches"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 4.4",
+      "control_name": "Use of physical diagnostic and test interfaces",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "GenAI outputs containing sensitive OT identifiers (tag names, IPs, device types) masked before leaving DMZ"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 1.2",
+      "control_name": "Human user authentication",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Access to GenAI systems in OT scope authenticated — each user with unique, traceable identity"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 6.1",
+      "control_name": "Timely response to events",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Sensitive OT data disclosure treated as security event — agent suspended, disclosure scope assessed"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Common ICS vulnerabilities",
+      "control_name": "§5.3",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Injection via OT data feeds is a documented attack vector"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Risk assessment",
+      "control_name": "§6.2",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Assess injection risk at every OT data ingestion point"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Security controls",
+      "control_name": "§7.2",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Input validation mandatory at OT data boundary"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "PR.DS-01",
+      "control_name": "Data Security",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Sensitive data at rest protected — training data, embeddings, RAG stores, prompt caches encrypted"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "PR.DS-02",
+      "control_name": "Data Security",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Sensitive data in transit protected — all GenAI API calls and RAG retrieval paths encrypted"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "DE.CM-01",
+      "control_name": "Continuous Monitoring",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Networks and assets monitored — DLP on all GenAI output channels"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "GV.RM-06",
+      "control_name": "Risk Management Strategy",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Risk tolerance established — acceptable sensitive data disclosure risk defined per GenAI use case"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Policy identifying confidential information in GenAI scope — training data, RAG corpus, embeddings, outputs",
+      "control_name": "C1.1 — Confidentiality policy",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Technical controls protecting confidential data in GenAI pipelines — encryption, access controls, output scanning",
+      "control_name": "C2.1 — Confidential information protection",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Access controls on RAG retrieval — users retrieve only data they are authorised to access",
+      "control_name": "CC6.1 — Logical access",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Personal information in GenAI scope used only for authorised purposes — LLM processing limited to agreed use cases",
+      "control_name": "P5.1 — Personal information use",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "DLP monitoring on all GenAI output channels — sensitive patterns detected before delivery to users",
+      "control_name": "CC7.2 — Anomaly detection",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 3.4.1",
+      "control_name": "PAN rendering unreadable",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "PANs in GenAI outputs masked — only first six/last four digits in any response"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 3.5.1",
+      "control_name": "Protect stored account data",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All CHD in GenAI scope encrypted — training data, RAG stores, embeddings, prompt caches"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 4.2.1",
+      "control_name": "Encryption in transit",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All GenAI data flows carrying CHD encrypted — TLS 1.2 minimum"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 7.2.1",
+      "control_name": "Restrict access",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "RAG retrieval access controls — users retrieve only CHD they are authorised to access"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Data and Model Security (DMS)",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All data in GenAI scope classified and governed — training corpora, RAG sources, embeddings, and outputs subject to DMS practices"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "MON",
+      "control_name": "Monitoring and Detection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "DLP on all GenAI output channels — AI-specific monitoring covering sensitive data patterns before delivery to consumers"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Governance and Risk (GOV)",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "GDPR and EU AI Act Article 10 data governance obligations addressed for all GenAI data assets"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L1",
+      "control_name": "General ICT — Data Protection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Training data, embeddings, and RAG stores encrypted at rest and in transit; least-privilege access enforced"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "D-TA",
+      "control_name": "Design / Threat Assessment",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Model all channels where untrusted content reaches the model"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "I-SB",
+      "control_name": "Implementation / Secure Build",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Enforce sanitisation at every point where external data enters inference pipeline"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "V-ST",
+      "control_name": "Verification / Security Testing",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Adversarial injection tests across all data input channels"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "O-IM",
+      "control_name": "Operations / Incident Management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Alert on unexpected model behaviour correlated with external data retrieval"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "G-EG",
+      "control_name": "Governance / Education & Guidance",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Data engineers understand injection risk surface"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-200",
+      "control_name": "CWE-200",
+      "tier": "Foundational",
+      "scope": "Both",
+      "url": "https://cwe.mitre.org/data/definitions/200.html"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-359",
+      "control_name": "CWE-359",
+      "tier": "Foundational",
+      "scope": "Both",
+      "url": "https://cwe.mitre.org/data/definitions/359.html"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-312",
+      "control_name": "CWE-312",
+      "tier": "Foundational",
+      "scope": "Both",
+      "url": "https://cwe.mitre.org/data/definitions/312.html"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L2",
+      "control_name": "Data Operations",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L1",
+      "control_name": "Foundation Models",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L5",
+      "control_name": "Evaluation & Observability",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B001",
+      "control_name": "Third-party adversarial robustness testing",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B002",
+      "control_name": "Detect adversarial input",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Hardening"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B005",
+      "control_name": "Implement real-time input filtering",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B006",
+      "control_name": "Prevent unauthorized AI actions",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Injection blast radius limited only by credential scope",
+      "control_name": "NHI-5 Over-Privileged NHI",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Apply least-privilege to all data pipeline credentials"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Injected actions can use pipeline tokens for extended period",
+      "control_name": "NHI-7 Long-Lived Credentials",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Short-lived tokens for all data pipeline service accounts"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PS.1.1-PS",
+      "control_name": "Protect all code from unauthorised access — data access audit controls",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Implement comprehensive audit logging for all access to training data, model weights, embedding stores, and pipeline configuration; enforce tamper-evident log storage"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "RV.1.1-PS",
+      "control_name": "Identify and confirm vulnerabilities — audit-driven detection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Establish procedures to detect data access anomalies using audit logs; define triage workflows for suspicious access patterns across AI data stores"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "AU-2",
+      "control_name": "Event Logging — AI data access logging",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Log all access to AI training data, model weights, inference inputs and outputs, and configuration; include user/service identity, timestamp, and access type"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "AU-12",
+      "control_name": "Audit Generation — inference audit trail",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Generate audit records for all model inference requests with sufficient detail for compliance and incident investigation"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "AC-3",
+      "control_name": "Access Enforcement — authenticated data access",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Enforce authenticated, authorised access to all AI data stores; deny unauthenticated access; log all access decisions"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 8",
+      "control_name": "Identification — data asset classification",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Register all AI data stores in ICT asset inventory; ensure logging coverage for all identified data assets including training data, model weights, and inference stores"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 9",
+      "control_name": "Protection and Prevention — data access controls",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Implement security controls for AI data access — authentication, authorisation, and encryption; enforce least privilege on all data access paths"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 10",
+      "control_name": "Detection — data access monitoring",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Deploy detection mechanisms for anomalous AI data access; monitor for unauthorised access patterns, bulk extractions, and access outside normal parameters"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 17–23",
+      "control_name": "ICT Incident Management — access incident reporting",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Classify material AI data access violations as ICT-related incidents; report to competent authorities per DORA incident classification and reporting requirements"
+    }
+  ],
+  "tools": [
+    {
+      "name": "Microsoft Presidio",
+      "type": "open-source",
+      "url": "https://github.com/microsoft/presidio"
+    },
+    {
+      "name": "Nightfall AI",
+      "type": "commercial",
+      "url": "https://nightfall.ai"
+    },
+    {
+      "name": "Private AI",
+      "type": "commercial",
+      "url": "https://private-ai.com"
+    },
+    {
+      "name": "Presidio",
+      "type": "open-source",
+      "url": "https://github.com/microsoft/presidio"
+    },
+    {
+      "name": "LLM Guard",
+      "type": "open-source",
+      "url": "https://github.com/protectai/llm-guard"
+    },
+    {
+      "name": "Garak",
+      "type": "open-source",
+      "url": "https://github.com/leondz/garak"
+    },
+    {
+      "name": "OpenTelemetry",
+      "type": "open-source",
+      "url": "https://opentelemetry.io"
+    },
+    {
+      "name": "Elastic SIEM",
+      "type": "open-source",
+      "url": "https://www.elastic.co/security"
+    },
+    {
+      "name": "AWS CloudTrail",
+      "type": "commercial",
+      "url": "https://aws.amazon.com/cloudtrail/"
+    },
+    {
+      "name": "Azure Monitor",
+      "type": "commercial",
+      "url": "https://azure.microsoft.com/en-us/products/monitor"
+    },
+    {
+      "name": "AWS CloudTrail / Azure Monitor",
+      "type": "commercial",
+      "url": "https://aws.amazon.com/cloudtrail/"
+    },
+    {
+      "name": "Elasticsearch",
+      "type": "open-source",
+      "url": "https://www.elastic.co"
+    },
+    {
+      "name": "Splunk",
+      "type": "commercial",
+      "url": "https://www.splunk.com"
+    }
+  ],
+  "incidents": [
+    {
+      "name": "Samsung employees leak source code and meeting notes via ChatGPT",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2023,
+      "incident_id": "INC-001"
+    },
+    {
+      "name": "OpenAI Redis caching bug exposes user conversation history",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2023,
+      "incident_id": "INC-006"
+    },
+    {
+      "name": "Indirect prompt injection in LLM email assistant via malicious email body",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-007"
+    },
+    {
+      "name": "GitHub Copilot reproduces verbatim licensed code and embedded secrets",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2023,
+      "incident_id": "INC-008"
+    },
+    {
+      "name": "Microsoft Copilot for M365 — document exfiltration via indirect injection",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-010"
+    },
+    {
+      "name": "GPT-4 system prompt extraction via jailbreak in production deployments",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2023,
+      "incident_id": "INC-018"
+    },
+    {
+      "name": "Slack AI indirect injection via channel content",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-024"
+    },
+    {
+      "name": "GitHub Copilot Workspace prompt injection via repository content",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-025"
+    },
+    {
+      "name": "DeepSeek AI database exposure — 1M+ chat logs publicly accessible",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2025,
+      "incident_id": "INC-032"
+    },
+    {
+      "name": "Cursor AI code agent leaking repository secrets via context window",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2025,
+      "incident_id": "INC-034"
+    }
+  ],
+  "crossrefs": {
+    "llm_top10": [
+      "LLM02",
+      "LLM01",
+      "LLM03",
+      "LLM07"
+    ],
+    "agentic_top10": [
+      "ASI03",
+      "ASI06",
+      "ASI01",
+      "ASI02"
+    ]
+  },
+  "changelog": [
+    {
+      "date": "2026-03-27",
+      "version": "1.0.0",
+      "change": "Initial entry — generated from GenAI Security Crosswalk v1.5.1 mapping files",
+      "author": "emmanuelgjr"
+    }
+  ]
+}