In my recent conversation with Ken Huang around the launch of the ๐ข๐ช๐๐ฆ๐ฃ ๐๐ ๐ฉ๐๐น๐ป๐ฒ๐ฟ๐ฎ๐ฏ๐ถ๐น๐ถ๐๐ ๐ฆ๐ฐ๐ผ๐ฟ๐ถ๐ป๐ด ๐ฆ๐๐๐๐ฒ๐บ (๐๐๐ฉ๐ฆ๐ฆ) and honestly, it felt like talking about a CVSS moment for the AI era.
๐ ๐ฃ๐ฟ๐ผ๐ท๐ฒ๐ฐ๐: ๐ต๐๐๐ฝ๐://๐ฎ๐ถ๐๐๐.๐ผ๐๐ฎ๐๐ฝ.๐ผ๐ฟ๐ด/
Weโre starting with a first-of-its-kind scoring system for Agentic AI Core Risks and expanding it into a full-blown AIVSS Framework Package for all AI systems (not just LMMs or GenAI, but the entire AI ecosystem).
Hereโs what makes AIVSS a game-changer: ๐ช๐ต๐ ๐๐๐ฉ๐ฆ๐ฆ? Because AI vulnerabilities today are being described in storiesโฆ but they need to be measured in scores.
๐ช๐ต๐ฎ๐โ๐ ๐ฐ๐ผ๐บ๐ถ๐ป๐ด ๐ฎ๐ ๐ฝ๐ฎ๐ฟ๐ ๐ผ๐ณ ๐๐๐ฉ๐ฆ๐ฆ? ย โข A standardized AIVSS Framework ย โข A detailed AIVSS Framework Guide ย โข An open-source AIVSS Scoring Calculator ย โข Ready-to-use Assessment Report Templates
In my chat with Ken Huang, we kept coming back to one thought: โIf we donโt standardize how we score AI risksโฆ how can we even begin to manage them consistently?โ
๐๐ถ๐ป๐ธ ๐๐ผ ๐ผ๐๐ฟ ๐ฐ๐ผ๐ป๐๐ฒ๐ฟ๐๐ฎ๐๐ถ๐ผ๐ป:-ย https://youtu.be/KZQtC6c_O-k
So hereโs my question to you. ย โขย If you found a vulnerability in an AI agent todayโฆ how would YOU score it? ย โขย What factors would matter more: model behavior, autonomy, data sensitivity, or blast radius?
๐๐ฟ๐ผ๐ฝ ๐๐ผ๐๐ฟ ๐๐ต๐ผ๐๐ด๐ต๐๐ ๐ฏ๐ฒ๐น๐ผ๐ ๐ ๐ฎ๐ฏ๐ผ๐๐ ๐๐ต๐ฒ ๐ณ๐๐๐๐ฟ๐ฒ ๐ผ๐ณ ๐๐ ๐๐ฒ๐ฐ๐๐ฟ๐ถ๐๐, ๐๐ต๐ถ๐ ๐ถ๐ ๐๐ผ๐๐ฟ ๐บ๐ผ๐บ๐ฒ๐ป๐ ๐๐ผ ๐ท๐๐บ๐ฝ ๐ถ๐ป ๐ฎ๐ป๐ฑ ๐ฐ๐ผ๐ป๐๐ฟ๐ถ๐ฏ๐๐๐ฒ.
OWASPยฎ Foundation OWASP AI Exchange OWASP AIVSS Project #OWASP #AIVSS #AISecurity #AgenticAI #AITrust #CyberSecurity #DevSecOps #AIEngineering #AIGovernance #OpenSourceSecurity #SecurityByDesign #OWASPProjects #KenHuang