GCD AI RADAR

Data

1,925 published records: 414 incidents and 1,511 disclosed CVEs with no confirmed exploitation, which are tracked separately. Everything below is regenerated on every deploy from the JSON files in the repository.

Building on the numbers? The API page documents every file and field, the counting rules to keep, how to cite the data, and an embeddable card.

Downloads

  • incidents.jsonEvery published record, incidents and disclosed CVEs, with all fields and every source.2.4 MB
  • incidents.min.jsonCompact records without the sources array, with a disclosed flag and the derived owasp_llm and atlas ids.1.4 MB
  • incidents.csvOne row per record for spreadsheets, with record_kind, owasp_llm and atlas columns; list fields are semicolon-separated.1.2 MB
  • years/<year>.jsonThe full records of one year of first report, one file per year; index.json lists the years and their counts.
  • summary.jsonThe headline numbers and the last 24 months in one small file, for widgets and newsletters.5 KB
  • meta.jsonCounts, last collector run, generation time, licence and the standards versions mapped to.2 KB
  • feed.xmlRSS feed of the 50 most recently reported incidents.36 KB
  • briefing.xmlRSS feed of the weekly briefing, This week in AI security.12 KB
  • briefings/<week>.jsonEvery weekly briefing: its counts, deltas, notable incidents and narrative; index.json lists the weeks.

The dataset is stored by year in the repository (data/incidents/<year>.json), and the per-year downloads mirror those files. Per-incident JSON is at /data/incidents/<slug>.json; the canonical URL of a record is https://gcd-ai-radar.vercel.app/incidents/<slug>. Field definitions are on the methodology page; the schema is lib/schema.ts in the repository.

owasp_llm holds OWASP Top 10 for LLM Applications 2025 ids (LLM01…) and atlas MITRE ATLAS technique ids (AML.T0051…, release 2026.09). Both are derived from each record’s type and categories by a fixed table, not classified per record, and either may be empty; the table and its limits are under standards mapping. The full JSON files keep the stored record only; the same table in lib/taxonomy.ts reproduces the two lists from it.

Product pages

The product index lists every product family with records, and each product has its own page at https://gcd-ai-radar.vercel.app/products/<slug> with its disclosed CVEs, confirmed exploitation and CISA KEV flags, newest first. Product names are grouped into families for display only (lib/products.ts); the downloads keep each name as filed.

Chart images

1200×630 PNGs for posts and slides, regenerated with the data. Link back to the site when you use them.

Licence and attribution

The dataset is CC BY-SA 4.0: reuse it, including commercially, with credit to “GCD AI RADAR” and a link, and keep derivative datasets under the same licence. Records carry their origin; when you redistribute the data, keep these upstream notices:

  • AI Incident Database (incidentdatabase.ai), CC BY-SA 4.0. McGregor, S. (2021) “Preventing Repeated Real World AI Failures by Cataloging Incidents: The AI Incident Database.”
  • MITRE ATLAS (atlas.mitre.org), Apache 2.0. © 2021-2026 The MITRE Corporation. Case studies, and the technique ids and names in the standards mapping.
  • OWASP Top 10 for LLM Applications 2025 (genai.owasp.org), CC BY-SA 4.0. © OWASP Foundation. Entry ids and names in the standards mapping; the mapping itself is GCD AI RADAR’s and is not endorsed by OWASP or MITRE.
  • AVID, the AI Vulnerability Database (avidml.org), MIT.
  • NVD: this product uses the NVD API but is not endorsed or certified by the NVD.
  • GitHub Advisory Database (github.com/advisories), CC BY 4.0.
  • CISA Known Exploited Vulnerabilities Catalog, CC0 1.0.
  • arXiv: thank you to arXiv for use of its open access interoperability. Metadata CC0 1.0.
  • Discovery powered by GDELT (gdeltproject.org) and Hacker News search by Algolia.
  • Traffic signal: Cloudflare Radar (radar.cloudflare.com), CC BY-NC 4.0, sidebar only; not part of the dataset.

Titles, links and dates of cited articles remain the property of their publishers. Summaries are written by GCD AI RADAR in its own words.