Thirty AI risks, and the one that maps to nothing

OWASP publishes three lists of the security risks in AI systems: the Top 10 for LLM applications, the newer Top 10 for Agentic applications, and the older Machine Learning Security Top 10. Thirty named risks in all. I mapped every one by hand to the weakness catalog (CWE) and the attack catalog (MITRE ATLAS), to ask a simple question: can the things we tell people to worry about in AI actually be traced to a weakness you could scan for, or an attack you could model? Mostly, not yet.

From our own direct mapping of each risk to the weaknesses and attack techniques it generalizes. "Have a CWE weakness" counts risks that map to at least one catalogued weakness; the rest have none.

The weakness catalog cannot name most AI risks

Look down the CWE column. In every one of the three lists, only four of the ten risks map to a weakness. It is the same four-out-of-ten each time, for the same reason: the CWE catalog has about four AI-specific weaknesses in total, covering prompt injection, adversarial input, generative-output validation, and insecure inference settings. Data poisoning, model theft, excessive agency, tool misuse: none of these has a weakness entry to point at. A weakness scan cannot find eighteen of these thirty risks, because it has no name for them.

The attack catalog is more complete, until the agentic frontier

The attack side is healthier. MITRE ATLAS, the catalog of how AI systems get attacked, covers every LLM risk and every ML risk we mapped. That makes sense: those lists are largely attacks on a model, and enumerating attacks on models is exactly what ATLAS is for.

The agentic layer is where it breaks down. Nine of the ten agentic risks map to an ATLAS technique. One does not: ASI08, Cascading Agent Failures, where a small failure in one agent propagates through connected agents and tool chains into a wider incident. It maps to no weakness and no attack technique, because it is neither. It is a systemic, emergent failure of a system of agents acting together, and neither catalog has language for that yet. Of thirty risks, it is the only one that traces to nothing, and it is no accident that it sits in the newest list. That is where the frontier actually is.

The risk vocabulary is ahead of the defenses

Put the three findings together. OWASP can name thirty AI risks. The weakness catalog names four of the underlying weaknesses. And the newest layer, autonomous agents, is already generating risks that nothing catalogs at all. The vocabulary for what can go wrong is running well ahead of the vocabulary for how to defend it. This is the same gap as in the companion piece on the AI attack surface, seen from the other side: there, 170 catalogued attacks sat on top of four weaknesses; here, thirty catalogued risks sit on the same four.

How to use this

• Security leader. If you deploy AI agents, the OWASP Agentic Top 10 is your risk list, but do not expect a weakness scanner or a control framework to cover it. Six of ten have no weakness to scan for, and the systemic ones have no attack playbook. Treat agent security as bespoke, not as something your existing stack already sees.
• Lean IT. The tools that catch ordinary vulnerabilities will not see agentic risk, because the standards behind those tools barely define it. If you run agents in anything that matters, read the OWASP Agentic Top 10 directly rather than trusting a scan.
• Researcher. The full mapping of all three risk lists to CWE and ATLAS is on the map, direct and inspectable. The gaps, and the agentic ones especially, are where the work is.