The weakness the catalog does not record
The reference database tags almost no AI vulnerabilities with the AI-specific weakness. Of 95 prompt-injection flaws, it used the right label zero times. Last updated: 2026-08-22
The National Vulnerability Database is the reference catalog the whole industry builds on. It classifies each vulnerability by weakness type using CWE, the Common Weakness Enumeration. CWE added an identifier for prompt injection, the signature weakness of large language model applications, in 2024. I went looking for how often the NVD actually uses it. Across ninety five vulnerabilities that are clearly prompt injection, the answer was zero.
Measured 2026-07-24 across the AI-related cohort. The generic labels the NVD used most were code injection (CWE-94), command injection (CWE-77), and injection (CWE-74).
The weakness is real; the record is silent
Prompt injection is not a code injection bug in the classic sense. The attacker is not smuggling code past a parser. They are feeding instructions to a model that cannot reliably tell instructions from data. Filing these under "code injection" is not exactly wrong, and it is not right either. It buries a distinct and growing weakness class inside a bucket that dates from the 1990s, so anyone counting AI specific weaknesses in the reference data finds almost none.
That is how you get the comfortable and false impression that AI systems have very few weaknesses of their own. They have plenty. The catalog just files them under older names.
Why it matters past the trivia
Defenders triage and prioritize off the reference data. Frameworks map controls to CWE identifiers. If the AI specific weakness never appears, then a control designed to catch prompt injection has nothing to map to, and a team searching the data for their AI exposure comes up nearly empty. The gap is not academic. It quietly steers attention away from a real and current problem.
What we did about it
Rather than wait for the catalog to catch up, we author the AI relevant weakness directly on the vulnerabilities where it applies, and we label it as our own reading rather than the NVD's. We are careful about it: the pass has to say why the weakness applies, and it declines the ones where it does not. It is a small correction to a large blind spot, and it is honest about being ours.