Skip to content

CONTRIBUTING.md

Latest commit

 

History

History
55 lines (41 loc) · 2.68 KB

CONTRIBUTING.md

File metadata and controls

55 lines (41 loc) · 2.68 KB
Raw

Contributing to Awesome AI Agent Attacks

Thanks for your interest in contributing. This list aims to be the most comprehensive public reference for AI agent security incidents.

Requirements for New Entries

Every incident submission must include:

  1. Date - Exact date or month/year when the incident occurred or was disclosed
  2. Named entity - Specific company, product, or project affected (no anonymous or hypothetical incidents)
  3. Impact - Concrete, measurable impact (users affected, dollars lost, data exposed, systems compromised)
  4. Root cause - Technical explanation of what went wrong
  5. CVE - If one exists, include the CVE identifier and CVSS score
  6. Source link - At least one verifiable source URL from a reputable publication or official advisory

What We Accept

  • Documented AI agent security incidents with real-world impact
  • AI agent framework and tool vulnerabilities with published advisories or CVEs
  • AI chatbot integration breaches affecting real organizations
  • Supply chain attacks targeting AI development tools and libraries
  • Research disclosures demonstrating exploitable vulnerabilities in production AI systems
  • AI agent autonomous behavior incidents (unintended actions, sandbox escapes)

What We Do Not Accept

  • Product pitches - Do not submit entries that promote any security product, tool, framework, or vendor solution
  • Unverified claims - Every claim must have a verifiable source
  • Opinions or commentary - This is a factual timeline, not an editorial
  • Hypothetical attacks - Only incidents that actually occurred or vulnerabilities confirmed to exist
  • Links to vendor marketing pages - Sources must be news articles, official advisories, CVE databases, or peer-reviewed research
  • Duplicate entries - Check existing entries before submitting

Formatting Rules

  • Use standard Markdown table format matching the existing tables
  • Sort entries by date descending (newest first) within each year section
  • Do not use em dashes (the long dash character) - use regular hyphens or rewrite
  • Keep descriptions concise and factual
  • Include CVE numbers where they exist
  • Use short, descriptive link text for source URLs

How to Submit

  1. Fork the repository
  2. Add your entry to the appropriate year section in README.md
  3. Verify all source URLs are accessible
  4. Submit a pull request with a clear title describing the incident being added

Quality Standards

  • Every source URL must resolve to a real page
  • Financial figures must match reported amounts from cited sources
  • CVE numbers must match entries in the NVD or relevant advisory databases
  • Technical details must be accurate and verifiable from the cited sources