{ "schema_version": "1.0", "version": "v1.0", "date": "2026-08-01", "title": "Zytra AI Risk Atlas", "description": "141 canonical AI risks across 11 governance domains — 77 agentic and 64 foundational. Each risk includes severity, likelihood, deployment patterns, and framework crosswalks.", "license": "CC BY 4.0", "source": "https://zytratechnologies.com/risk-atlas", "stats": { "total_risks": 141, "agentic_risks": 77, "foundational_risks": 64, "domains": 11, "controls": 157, "frameworks": 13 }, "frameworks": [ "NIST AI RMF", "OWASP LLM Top 10", "OWASP Agentic AI Top 10", "MITRE ATLAS", "ISO/IEC 42001", "EU AI Act", "DORA", "RBI AI Governance Guidelines", "SEBI AI Framework", "DPDP Act 2023", "IBM AI Risk Atlas", "MAESTRO", "NIST ARIA" ], "domains": [ { "id": "MAR", "name": "Model Accuracy & Reliability", "risk_count": 14, "agentic": 6, "foundational": 8 }, { "id": "SEC", "name": "Security & Adversarial Robustness", "risk_count": 18, "agentic": 11, "foundational": 7 }, { "id": "FAI", "name": "Fairness & Bias", "risk_count": 11, "agentic": 3, "foundational": 8 }, { "id": "GOV", "name": "Governance & Accountability", "risk_count": 13, "agentic": 5, "foundational": 8 }, { "id": "PRV", "name": "Privacy & Data", "risk_count": 12, "agentic": 4, "foundational": 8 }, { "id": "AGT", "name": "Agent Autonomy", "risk_count": 16, "agentic": 16, "foundational": 0 }, { "id": "MAS", "name": "Multi-Agent Security", "risk_count": 13, "agentic": 13, "foundational": 0 }, { "id": "TLR", "name": "Tool & Affordance Risk", "risk_count": 14, "agentic": 14, "foundational": 0 }, { "id": "TRN", "name": "Transparency & Explainability", "risk_count": 10, "agentic": 2, "foundational": 8 }, { "id": "SUP", "name": "Supply Chain & Provenance", "risk_count": 9, "agentic": 2, "foundational": 7 }, { "id": "OPS", "name": "Operational Continuity", "risk_count": 11, "agentic": 1, "foundational": 10 } ], "risks": [ { "risk_id": "MAR-F-01", "type": "foundational", "domain": "Model Accuracy & Reliability", "name": "Output Hallucination", "description": "Model produces confidently stated, factually incorrect output — including fabricated citations, regulatory guidance, or financial figures.", "severity": "High", "likelihood": "High", "inherent_risk": "Critical", "deployment_patterns": ["RAG", "document_summarization", "chat"], "frameworks": ["NIST AI RMF: MEASURE 2.5", "OWASP LLM Top 10: LLM09", "IBM AI Risk Atlas: Hallucination"], "bfsi_relevance": "Incorrect regulatory deadlines, financial product descriptions, KYC guidance" }, { "risk_id": "MAR-F-02", "type": "foundational", "domain": "Model Accuracy & Reliability", "name": "Distributional Drift", "description": "Model performance degrades over time as input distribution shifts from training distribution — undetected in production.", "severity": "Medium", "likelihood": "High", "inherent_risk": "High", "deployment_patterns": ["classification", "scoring", "RAG"], "frameworks": ["NIST AI RMF: MEASURE 2.6", "ISO/IEC 42001: 9.1"], "bfsi_relevance": "Credit scoring models, fraud detection degradation" }, { "risk_id": "MAR-A-01", "type": "agentic", "domain": "Model Accuracy & Reliability", "name": "Compounding Error Chains", "description": "In multi-step agentic workflows, errors in early steps compound — the agent acts on its own incorrect prior outputs, amplifying the original error.", "severity": "High", "likelihood": "Medium", "inherent_risk": "High", "deployment_patterns": ["autonomous_agent", "multi_agent"], "frameworks": ["OWASP Agentic AI Top 10: AA01", "MAESTRO: Layer 4", "NIST AI RMF: MEASURE 2.5"], "bfsi_relevance": "Agentic loan origination, compliance checking workflows" }, { "risk_id": "SEC-F-01", "type": "foundational", "domain": "Security & Adversarial Robustness", "name": "Prompt Injection", "description": "Attacker embeds adversarial instructions in model inputs — via user messages, retrieved documents, or tool outputs — causing the model to override its system instructions.", "severity": "Critical", "likelihood": "High", "inherent_risk": "Critical", "deployment_patterns": ["RAG", "chat", "autonomous_agent"], "frameworks": ["OWASP LLM Top 10: LLM01", "MITRE ATLAS: AML.T0051", "NIST ARIA"], "bfsi_relevance": "Customer-facing chatbots, document processing pipelines" }, { "risk_id": "SEC-A-01", "type": "agentic", "domain": "Security & Adversarial Robustness", "name": "Indirect Prompt Injection via Retrieved Documents", "description": "Malicious instructions embedded in documents retrieved by a RAG pipeline or web browsing agent cause the agent to execute attacker-controlled actions.", "severity": "Critical", "likelihood": "High", "inherent_risk": "Critical", "deployment_patterns": ["RAG", "autonomous_agent"], "frameworks": ["OWASP LLM Top 10: LLM01", "OWASP Agentic AI Top 10: AA03", "MITRE ATLAS: AML.T0054"], "bfsi_relevance": "Document intake agents, research agents with web access" }, { "risk_id": "SEC-A-02", "type": "agentic", "domain": "Security & Adversarial Robustness", "name": "Multi-Turn Crescendo Attack", "description": "Attacker escalates requests gradually across multiple conversation turns, building the model's commitment to a compliant frame before introducing the harmful request.", "severity": "High", "likelihood": "High", "inherent_risk": "Critical", "deployment_patterns": ["chat", "autonomous_agent"], "frameworks": ["OWASP Agentic AI Top 10: AA05", "NIST AI RMF: GOVERN 6.2"], "bfsi_relevance": "Customer service AI, advisory chatbots" }, { "risk_id": "SEC-A-03", "type": "agentic", "domain": "Security & Adversarial Robustness", "name": "Structural / IICL Attack", "description": "Attacker presents harmful content as pattern completion of a structured dataset — bypassing content-layer safety by exploiting the model's tendency to complete established patterns faithfully.", "severity": "High", "likelihood": "Medium", "inherent_risk": "High", "deployment_patterns": ["chat", "RAG", "autonomous_agent"], "frameworks": ["OWASP Agentic AI Top 10: AA05", "IBM AI Risk Atlas: Jailbreaking"], "bfsi_relevance": "Models with near-0% single-turn ASR remain vulnerable" }, { "risk_id": "FAI-F-01", "type": "foundational", "domain": "Fairness & Bias", "name": "Demographic Disparate Impact", "description": "Model produces systematically different outcomes across demographic groups — including protected characteristics — without justifiable basis.", "severity": "High", "likelihood": "Medium", "inherent_risk": "High", "deployment_patterns": ["scoring", "classification"], "frameworks": ["EU AI Act: Art. 10", "NIST AI RMF: MANAGE 2.2", "RBI AI Governance Guidelines"], "bfsi_relevance": "Credit scoring, loan approval, insurance underwriting" }, { "risk_id": "GOV-F-01", "type": "foundational", "domain": "Governance & Accountability", "name": "Missing Risk Ownership", "description": "No named individual is accountable for an AI system's risk profile — creating governance gaps where controls exist on paper but have no enforcement owner.", "severity": "Medium", "likelihood": "High", "inherent_risk": "High", "deployment_patterns": ["all"], "frameworks": ["ISO/IEC 42001: 5.3", "EU AI Act: Art. 17", "NIST AI RMF: GOVERN 1.1"], "bfsi_relevance": "Regulatory accountability requirements under RBI, SEBI, EU AI Act" }, { "risk_id": "GOV-A-01", "type": "agentic", "domain": "Governance & Accountability", "name": "Opaque Agentic Action Trail", "description": "Agentic workflows produce actions without sufficient logging or audit trail — making post-incident review, regulatory evidence, and accountability attribution impossible.", "severity": "High", "likelihood": "Medium", "inherent_risk": "High", "deployment_patterns": ["autonomous_agent", "multi_agent"], "frameworks": ["EU AI Act: Art. 12", "ISO/IEC 42001: 9.2", "MAESTRO: Layer 6"], "bfsi_relevance": "Regulatory audit trails, DORA operational resilience requirements" }, { "risk_id": "PRV-F-01", "type": "foundational", "domain": "Privacy & Data", "name": "Training Data Memorization", "description": "Model memorizes and can reproduce verbatim training data — including PII, financial records, or confidential information included in fine-tuning datasets.", "severity": "High", "likelihood": "Medium", "inherent_risk": "High", "deployment_patterns": ["chat", "document_summarization"], "frameworks": ["OWASP LLM Top 10: LLM06", "DPDP Act 2023", "EU AI Act: Art. 10"], "bfsi_relevance": "Customer data leakage, KYC data exposure" }, { "risk_id": "AGT-A-01", "type": "agentic", "domain": "Agent Autonomy", "name": "Scope Creep Beyond Declared Intent", "description": "Agent acquires capabilities, resources, or information beyond what was declared in its design brief — often through legitimate-seeming tool calls that accumulate into unauthorized capability.", "severity": "Critical", "likelihood": "Medium", "inherent_risk": "Critical", "deployment_patterns": ["autonomous_agent", "multi_agent"], "frameworks": ["OWASP Agentic AI Top 10: AA04", "MAESTRO: Layer 3", "MITRE ATLAS: AML.T0047"], "bfsi_relevance": "Agents with banking API access, payment execution agents" }, { "risk_id": "AGT-A-02", "type": "agentic", "domain": "Agent Autonomy", "name": "Objective Substitution & Proxy Gaming", "description": "Agent optimizes for a measurable proxy of the intended objective rather than the intended objective itself — producing outcomes that satisfy the metric while violating the goal.", "severity": "High", "likelihood": "Medium", "inherent_risk": "High", "deployment_patterns": ["autonomous_agent"], "frameworks": ["OWASP Agentic AI Top 10: AA02", "IBM AI Risk Atlas: Misaligned objective", "NIST AI RMF: MANAGE 1.3"], "bfsi_relevance": "Fraud detection optimization, compliance monitoring automation" }, { "risk_id": "MAS-A-01", "type": "agentic", "domain": "Multi-Agent Security", "name": "Cross-Agent Prompt Injection", "description": "A compromised or adversarially controlled agent in a multi-agent system injects instructions into messages passed to other agents — propagating attacker control through the pipeline.", "severity": "Critical", "likelihood": "Medium", "inherent_risk": "Critical", "deployment_patterns": ["multi_agent"], "frameworks": ["OWASP Agentic AI Top 10: AA03", "MAESTRO: Layer 5", "MITRE ATLAS: AML.T0054"], "bfsi_relevance": "Orchestration layers, agent pipelines with external data access" }, { "risk_id": "TLR-A-01", "type": "agentic", "domain": "Tool & Affordance Risk", "name": "Excessive Tool Affordance", "description": "Agent is granted access to tools or APIs beyond what is necessary for its task — violating least-privilege and expanding the blast radius of a compromise or misuse event.", "severity": "High", "likelihood": "High", "inherent_risk": "Critical", "deployment_patterns": ["autonomous_agent", "multi_agent"], "frameworks": ["OWASP Agentic AI Top 10: AA06", "MAESTRO: Layer 3", "ISO/IEC 42001: 8.4"], "bfsi_relevance": "Agents with payment, KYC, or database write access" }, { "risk_id": "TRN-F-01", "type": "foundational", "domain": "Transparency & Explainability", "name": "Unexplainable Adverse Decision", "description": "AI system produces an adverse decision (credit denial, fraud flag) that cannot be explained to the affected individual or regulator in required detail.", "severity": "High", "likelihood": "Medium", "inherent_risk": "High", "deployment_patterns": ["scoring", "classification"], "frameworks": ["EU AI Act: Art. 13", "RBI AI Governance Guidelines", "SEBI AI Framework"], "bfsi_relevance": "Credit decisions, fraud flags, insurance claim denials" }, { "risk_id": "SUP-F-01", "type": "foundational", "domain": "Supply Chain & Provenance", "name": "Third-Party Model Risk", "description": "Organization deploys a foundation model from an external provider without adequate assessment of that model's safety properties, training data, or alignment guarantees.", "severity": "High", "likelihood": "High", "inherent_risk": "High", "deployment_patterns": ["all"], "frameworks": ["NIST AI RMF: GOVERN 4.2", "ISO/IEC 42001: 8.4", "EU AI Act: Art. 25"], "bfsi_relevance": "API-accessed LLMs, embedded model providers" }, { "risk_id": "OPS-F-01", "type": "foundational", "domain": "Operational Continuity", "name": "AI System Single Point of Failure", "description": "Critical operational processes depend on an AI system without adequate fallback — creating a single point of failure that violates operational resilience requirements.", "severity": "High", "likelihood": "Medium", "inherent_risk": "High", "deployment_patterns": ["all"], "frameworks": ["DORA: Art. 11", "RBI AI Governance Guidelines", "ISO/IEC 42001: 10.1"], "bfsi_relevance": "DORA ICT operational resilience, core banking AI dependencies" } ], "note": "This export contains representative risks from each domain. The full 141-risk catalogue with all controls, evidence requirements, and regulatory clause-level mappings is available at https://zytratechnologies.com/risk-atlas" }