AI
Where AIVSS Fits in the AI Risk Management Stack
NIST’s AI Risk Management Framework organizes AI governance into four phases: govern, map, measure, and manage. The govern layer, covered by Cloud Security Alliance white papers Ken Huang co-chairs, handles organizational responsibilities. The map layer defines threat identification for agentic systems. AIVSS occupies the measure layer. Without a scoring mechanism in that slot, teams cannot prioritize which risks to fix. The manage layer then closes the loop with red teaming guides and AI control matrices. AIVSS targets the one phase most teams currently skip.
Why CVSS Cannot Score Agentic Behavior
CVSS was built for deterministic code. A buffer overflow either exists or it doesn’t. Agentic AI systems behave nondeterministically, meaning the same input can produce different outputs and different risks. AIVSS v0.5, released a few months ago, started with CVSS v3.5 and then upgraded to CVSS v4’s vector-matrix model. The deeper problem is that CVSS only scores vulnerabilities. Agentic AI risk requires scoring behaviors. Autonomy is not a vulnerability but an amplification factor that multiplies risk severity once an exploit is in play.
Ten Risks, Ten Amplification Factors
AIVSS defines 10 core agentic risks, from tool misuse to goal manipulation. Each risk is scored against 10 amplification factors, including autonomy, nondeterminism, and MCP tool exposure. The combination makes scoring complex but necessary. An agent that only executes static policies at deployment time is not truly agentic. Real agent deployments need ephemeral, task-based identity assignment, where privilege expands for the duration of a task and then retracts. Without scoring these behaviors, organizations have no basis for deciding which agent deployments need tighter controls.
Tool Misuse and Goal Manipulation as Scored Risks
Tool misuse risk begins at selection. A compromised MCP server can impersonate a legitimate tool. Even a legitimate tool can carry SQL injection or command injection. Goal manipulation is separate. The crescendo attack, developed by Microsoft, gradually drifts an agent’s goal through incremental requests. Ask it to lock a port; it opens more. A malicious goal expansion runs alongside the legitimate task. Goal exhaustion loops the agent without ever completing the original request.
Project Status and the Call to Contribute
AIVSS v0.5 published earlier this year. Version 1.0 targets the ISA conference on March 23rd. Contributors include researchers from NIST, Anthropic, banks, pharmaceutical companies, and major AI companies. Rob Joyce, former NSA cybersecurity director and former White House advisor, gave the project his support at the June kickoff. Two documents are in progress: a quantitative scoring guide based on CVSS v4, and a qualitative decision-tree approach based on SSVC. A scoring calculator tool ships alongside both. Registration for contributors is open on the project’s OWASP page.
Notable Quotes
it’s really a behavior or semantic risk Ken Huang · ▶ 29:30
you ask it to lock the port it will not Ken Huang · ▶ 26:35
Key Takeaways
- AIVSS extends CVSS v4 to cover the nondeterministic, behavior-level risks unique to agentic AI.
- Autonomy is an amplification factor, not a vulnerability, and cannot be scored by standard CVSS.
- The project defines 10 core agentic risks paired with 10 amplification factors for quantitative scoring.
- Goal manipulation attacks like crescendo gradually shift agent behavior without triggering obvious alerts.
- Version 1.0 ships March 23rd; contributor registration is open and the community spans NIST, Anthropic, and major banks.
About the Speaker(s)
Ken Huang is a prolific author and expert in AI and Web3, with books published by Cambridge University Press, Springer, China Machine Press, and John Wiley. His book “Securing AI Agents” is directly relevant to the AIVSS project. He serves as Research Fellow and Co-Chair of the AI Safety Working Groups at the Cloud Security Alliance and leads the AIVSS project. His “Beyond AI” book surpassed 35,000 downloads on the Springer website alone and was recently translated into Chinese by Beijing University.
Michael Bargury is co-founder and CTO of Zenity. He leads the OWASP Low Code/No Code Top 10 and co-leads the AIVSS project alongside Ken Huang and Vineeth Sai Narajala.
Vineeth Sai Narajala is an Application Security Engineer at AWS, specializing in core Data Analytics services including EMR, Athena, and LakeFormation. Before AWS he worked as a pentester and in threat intelligence. He co-leads the AIVSS project from AWS’s ISO office at Stanford University.