genai-security-crosswalk 2.0.0

package/data/entries/LLM07.json

@@ -0,0 +1,749 @@
+{
+  "id": "LLM07",
+  "name": "System Prompt Leakage",
+  "source_list": "LLM-Top10-2025",
+  "version": "2026-Q1",
+  "severity": "High",
+  "aivss_score": null,
+  "audience": [
+    "red-teamer",
+    "security-engineer",
+    "developer",
+    "ml-engineer",
+    "ot-engineer",
+    "ciso",
+    "compliance",
+    "auditor"
+  ],
+  "mappings": [
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0041",
+      "control_name": "Configuration Exposure",
+      "tier": "Foundational",
+      "scope": "Build",
+      "url": "https://atlas.mitre.org/techniques/AML.T0041",
+      "notes": "Extraction of internal model configuration, instructions, or system prompts"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0051.000",
+      "control_name": "Direct Prompt Injection",
+      "tier": "Foundational",
+      "scope": "Build",
+      "url": "https://atlas.mitre.org/techniques/AML.T0051.000",
+      "notes": "Crafting inputs specifically designed to reveal or override system prompt content"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "GV-1.6",
+      "control_name": "Policies for data privacy",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "System prompts classified as sensitive configuration — subject to data governance policy"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MS-2.6",
+      "control_name": "Testing — data leakage",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Prompt extraction scenarios included in evaluation programme"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MG-2.4",
+      "control_name": "Risk response — data",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Defined response for detected system prompt leakage"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MP-2.3",
+      "control_name": "Risk categorisation",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "System prompt leakage risk mapped and rated in AI risk register"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Users must receive sufficient information about the AI system — but this does not require disclosing system prompts",
+      "control_name": "Art. 13 — Transparency",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Transparency obligation must be met without exposing security-sensitive system prompt content"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Configuration management documented",
+      "control_name": "Art. 17 — Quality management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "System prompt versions, access controls, and change procedures are quality management artefacts"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "GPAI providers must publish summaries of training data and model capabilities",
+      "control_name": "Art. 53(1)(b) — GPAI transparency",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Published summaries must not inadvertently expose security-sensitive configuration"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.5.12",
+      "control_name": "Classification of information",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "System prompts classified as sensitive configuration — subject to data governance policy"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.3",
+      "control_name": "Information access restriction",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Access controls on system prompt storage — version controlled, access logged"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.24",
+      "control_name": "Use of cryptography",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "System prompts encrypted at rest — not stored in cleartext configuration files"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.15",
+      "control_name": "Logging",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Access to system prompts logged — unauthorised access attempts detectable"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.7.3",
+      "control_name": "Data provenance and characteristics",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "System prompts classified as sensitive operational data — provenance, access controls, handling requirements documented"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.6.2.3",
+      "control_name": "AI system security",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "System prompt encryption and access controls as AIMS security design requirements"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.8.1",
+      "control_name": "Information for interested parties",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Transparency obligations balanced with operational security — what must be disclosed vs what may be kept confidential"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Cl.7",
+      "control_name": "Support",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Documented information controls — system prompts managed as AIMS documented information with appropriate access controls"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "3.1 Establish data management process",
+      "control_name": "CIS 3 — Data Protection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "System prompts classified as sensitive configuration — data handling policy applied"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "4.1 Establish secure configuration process",
+      "control_name": "CIS 4 — Secure Configuration",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Secure configuration for LLM deployments — system prompts not in cleartext config"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "8.2 Collect audit logs",
+      "control_name": "CIS 8 — Audit Log Management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "System prompt access logged — unauthorised access attempts detectable"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V8.1.1",
+      "control_name": "Verify sensitive data not cached in cleartext",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "System prompts not stored in cleartext application configuration or source code"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V4.1.3",
+      "control_name": "Verify access control enforces least privilege",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "System prompt access restricted to authorised personnel — read access logged"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V7.2.1",
+      "control_name": "Verify access control decisions logged",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All access to system prompts logged — unauthorised access attempts detectable"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V14.2.3",
+      "control_name": "Verify secrets not in source code",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "System prompts not hardcoded in source code — stored in secret management system"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 4.1",
+      "control_name": "Data confidentiality in transit",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "System prompt content treated as sensitive OT configuration data — encrypted in transit"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 3.1",
+      "control_name": "Software and information integrity",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "System prompt integrity protected — unauthorised modification detected"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 5.1",
+      "control_name": "Information flow restriction",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "System prompt content cannot flow to unauthorised external destinations"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "OT configuration and topology data as espionage target",
+      "control_name": "Section 5.4 — Information disclosure",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "System prompts containing OT specifics treated as sensitive configuration data"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Protecting sensitive OT data",
+      "control_name": "Section 7.3 — Data protection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "System prompt encryption and access controls as data protection measures"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Title",
+      "control_name": "Control",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Application"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Protection of Information at Rest",
+      "control_name": "SC-28",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "System prompts encrypted at rest — not stored in cleartext configuration files"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Access Enforcement",
+      "control_name": "AC-3",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "System prompt access restricted to authorised personnel — version controlled, access logged"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Protection of Audit Information",
+      "control_name": "AU-9",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "System prompt access logs protected — unauthorised access attempts detectable"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "PR.DS-01",
+      "control_name": "Data Security",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "System prompts classified as sensitive configuration and protected at rest — encrypted, access-controlled"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "PR.AA-05",
+      "control_name": "Identity Management, Authentication & Access Control",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Access to system prompt storage restricted to authorised personnel — least privilege enforced"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "DE.CM-01",
+      "control_name": "Continuous Monitoring",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Access to system prompt storage logged and monitored — anomalous access detected"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "GV.RM-06",
+      "control_name": "Risk Management Strategy",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Risk tolerance defined for system prompt exposure — operational security value of prompt confidentiality assessed"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "System prompts classified as confidential — encryption at rest, access-controlled, not in cleartext config",
+      "control_name": "C2.1 — Confidential information protection",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Access controls on system prompt storage — only authorised personnel can read or modify, all access logged",
+      "control_name": "CC6.1 — Logical access",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "System prompt security procedures — version control, rotation, extraction resistance testing documented",
+      "control_name": "CC5.2 — Control activities",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Access to system prompt storage monitored — anomalous access attempts detected and alerted",
+      "control_name": "CC7.2 — Monitoring",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 3.5.1",
+      "control_name": "Protection of sensitive authentication data",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "System prompts containing CDE configuration treated as sensitive — encrypted at rest, access-controlled"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 7.2.1",
+      "control_name": "Restrict access by need to know",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "System prompt access restricted — only authorised personnel with documented business need"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 10.2.1",
+      "control_name": "Logging and monitoring",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All access to system prompt storage logged — access to CDE configuration data requires audit trail"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 6.2.4",
+      "control_name": "Bespoke software security",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "System prompt design prevents leakage — no cleartext CDE identifiers, tokens resolved at runtime"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Data and Model Security (DMS)",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "System prompts classified as sensitive AI system configuration — encrypted, access-controlled, version-managed"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Governance and Risk (GOV)",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "System prompt security as AI governance obligation — operational security value assessed"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "MON",
+      "control_name": "Monitoring and Detection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "System prompt access logged and monitored — anomalous access detected"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L1",
+      "control_name": "General ICT — Data Protection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "System prompts not stored in cleartext — encryption at rest as L1 data protection practice"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "D-SR",
+      "control_name": "Security Requirements",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "System prompt security as explicit requirement — confidentiality, encryption, access control specified before development"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "I-SB",
+      "control_name": "Secure Build",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "System prompt protection implemented in code — no cleartext storage, version control access restrictions"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "V-ST",
+      "control_name": "Security Testing",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Prompt extraction testing as penetration testing activity — resistance to known extraction techniques verified"
+    },
+    {
+      "framework": "STRIDE",
+      "control_id": "I",
+      "control_name": "Configuration Information Disclosure",
+      "tier": "Foundational",
+      "scope": "Build"
+    },
+    {
+      "framework": "STRIDE",
+      "control_id": "R",
+      "control_name": "Security Control Repudiation",
+      "tier": "Foundational",
+      "scope": "Build"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-200",
+      "control_name": "CWE-200",
+      "tier": "Foundational",
+      "scope": "Build",
+      "url": "https://cwe.mitre.org/data/definitions/200.html"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-312",
+      "control_name": "CWE-312",
+      "tier": "Foundational",
+      "scope": "Build",
+      "url": "https://cwe.mitre.org/data/definitions/312.html"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-215",
+      "control_name": "CWE-215",
+      "tier": "Foundational",
+      "scope": "Build",
+      "url": "https://cwe.mitre.org/data/definitions/215.html"
+    },
+    {
+      "framework": "OWASP AI Testing Guide",
+      "control_id": "System prompt extraction via crafted inputs",
+      "control_name": "IHT — Input Handling",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Attempt to extract system prompt contents through direct requests, indirect summarisation, translation, and instruction-override techniques"
+    },
+    {
+      "framework": "OWASP AI Testing Guide",
+      "control_id": "Credential and sensitive content in system prompt",
+      "control_name": "DPT — Data Protection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Verify that credentials, API keys, or sensitive business logic in the system prompt are not reproducible by any input technique"
+    },
+    {
+      "framework": "OWASP AI Testing Guide",
+      "control_id": "Refusal robustness for system prompt disclosure",
+      "control_name": "MBT — Model Behaviour",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Verify that the model consistently refuses system prompt disclosure across varied request phrasings and social engineering approaches"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L1",
+      "control_name": "Foundation Models",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L6",
+      "control_name": "Security & Compliance",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "A",
+      "control_name": "Data & Privacy domain",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B006",
+      "control_name": "Prevent unauthorized AI actions",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "E",
+      "control_name": "Accountability domain",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "API keys or tokens embedded in system prompt",
+      "control_name": "NHI-2 Secret Leakage",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Scan system prompts for credential patterns before deployment"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "System prompt stored as plaintext config with embedded credentials",
+      "control_name": "NHI-6 Insecure Credential Storage",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Externalise credentials to vault; reference by ID in system prompt"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PS.1.1-PS",
+      "control_name": "Protect all code from unauthorised access — system prompt confidentiality",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Classify system prompts as sensitive configuration artefacts; apply access controls, version control, and audit logging to all prompt stores"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PW.5.1-PS",
+      "control_name": "Secure coding — no credentials in prompts",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Enforce secure coding standards prohibiting embedding of credentials, API keys, or sensitive configuration data in system prompts or model context"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PW.7.2-PS",
+      "control_name": "Review for security vulnerabilities — prompt disclosure",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Include system prompt extraction scenarios in pre-release security reviews; verify that outputs cannot reveal system prompt content"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PW.8.2-PS",
+      "control_name": "Test for security vulnerabilities — prompt extraction",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Conduct adversarial prompt extraction testing against all known extraction techniques before deployment and after each system prompt change"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "SC-28",
+      "control_name": "Protection of Information at Rest — system prompt confidentiality",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Classify system prompts as sensitive configuration; encrypt at rest, enforce access controls, and apply version control and audit logging to all prompt stores"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "AC-3",
+      "control_name": "Access Enforcement — prompt configuration access",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Restrict access to system prompt configurations to authorised personnel; enforce role-based access control and change management on all prompt modifications"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "AU-2",
+      "control_name": "Event Logging — prompt extraction detection",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Log inference interactions with sufficient detail to detect system prompt extraction attempts; alert on query patterns indicative of extraction techniques"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "SI-3",
+      "control_name": "Malicious Code Protection — prompt extraction defence",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Deploy output monitoring to detect and block responses containing system prompt content; treat extraction as a security event"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 9",
+      "control_name": "Protection and Prevention — prompt confidentiality",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Classify system prompts as sensitive ICT configuration; implement protection controls including encryption, access control, and output monitoring to prevent extraction"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 17–23",
+      "control_name": "ICT Incident Management — prompt extraction reporting",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Classify successful system prompt extraction as an ICT-related incident; assess impact and report per DORA incident classification criteria"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 13",
+      "control_name": "Learning and Evolving — extraction post-mortem",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Conduct post-incident analysis for prompt extraction events; identify root cause, assess business impact, and update protection controls"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 10",
+      "control_name": "Detection — extraction attempt detection",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Deploy detection mechanisms for system prompt extraction attempts; monitor inference requests for extraction technique patterns"
+    }
+  ],
+  "tools": [
+    {
+      "name": "LLM Guard",
+      "type": "open-source",
+      "url": "https://github.com/protectai/llm-guard"
+    },
+    {
+      "name": "Garak",
+      "type": "open-source",
+      "url": "https://github.com/leondz/garak"
+    },
+    {
+      "name": "Trufflehog",
+      "type": "open-source",
+      "url": "https://github.com/trufflesecurity/trufflehog"
+    },
+    {
+      "name": "Rebuff",
+      "type": "open-source",
+      "url": "https://github.com/protectai/rebuff"
+    },
+    {
+      "name": "HashiCorp Vault",
+      "type": "commercial",
+      "url": "https://www.vaultproject.io"
+    },
+    {
+      "name": "LAAF v2.0",
+      "url": "https://github.com/qorvexconsulting1/laaf-V2.0",
+      "type": "open-source"
+    }
+  ],
+  "incidents": [
+    {
+      "name": "GitHub Copilot reproduces verbatim licensed code and embedded secrets",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2023,
+      "incident_id": "INC-008"
+    },
+    {
+      "name": "WormGPT — uncensored LLM sold for cybercrime on dark web forums",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2023,
+      "incident_id": "INC-011"
+    },
+    {
+      "name": "Perez & Ribeiro — 'Ignore Previous Prompt': foundational direct injection study",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2022,
+      "incident_id": "INC-013"
+    },
+    {
+      "name": "GPT-4 system prompt extraction via jailbreak in production deployments",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2023,
+      "incident_id": "INC-018"
+    },
+    {
+      "name": "LAAF v2.0 — Empirical LPCI breakthrough rates of 67–100% across 5 production LLMs",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2026,
+      "incident_id": "INC-021"
+    },
+    {
+      "name": "Greshake et al. \"Not What You've Signed Up For\" indirect prompt injection paper",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2023,
+      "incident_id": "INC-022"
+    },
+    {
+      "name": "GitHub Copilot Workspace prompt injection via repository content",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-025"
+    },
+    {
+      "name": "Skeleton Key: direct system prompt override (Microsoft)",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-030"
+    }
+  ],
+  "crossrefs": {
+    "agentic_top10": [
+      "ASI01",
+      "ASI02"
+    ],
+    "dsgai_2026": [
+      "DSGAI15",
+      "DSGAI08"
+    ],
+    "llm_top10": [
+      "LLM01"
+    ]
+  },
+  "changelog": [
+    {
+      "date": "2026-03-27",
+      "version": "1.0.0",
+      "change": "Initial entry — generated from GenAI Security Crosswalk v1.5.1 mapping files",
+      "author": "emmanuelgjr"
+    }
+  ]
+}