{
  "schema_version": 1,
  "description": "The Embodied AI Security Top 10 (a draft taxonomy, not a standard) and which Provael attack family — if any — exercises each risk.",
  "content_updated": "2026-06-27",
  "content_updated_note": "When the DATA last changed. Not the build time — see built_at.",
  "built_at": "2026-11-15T11:56:43.164Z",
  "built_at_note": "When this file was generated. A rebuild re-stamps this without changing any data, so it is not a freshness signal. Read content_updated instead.",
  "source": {
    "repo": "https://github.com/provael/website",
    "repo_visibility": "private",
    "path": "src/data/eai-top-10.ts",
    "commit": "49f208ee61a79dbca185dbdfed1a6c56da9696ac",
    "commit_url": null,
    "note": "The website repository is private, so no commit link is emitted: a provenance URL that answers 404 is worse than none. The SHA is the commit that built this file and becomes checkable when the repository opens."
  },
  "caveats": [
    "This is a DRAFT community taxonomy published by Provael. It is not an OWASP project and carries no standards body behind it. Do not cite it as one.",
    "A `provael_channel` means an attack family is REGISTERED for that risk — implemented and unit-tested. It does not mean the risk has been measured against a real policy.",
    "Two risks have no channel by design rather than by omission: the absence is a scope decision about what a VLA-policy red-teamer can measure, and the per-risk page says which."
  ],
  "data": {
    "version": "v0.2",
    "risks": [
      {
        "id": "EAI01",
        "slug": "eai01",
        "title": "Policy & instruction jailbreak (direct command channel)",
        "summary": "Natural-language commands that drive a VLA policy against its safety constraints - an LLM jailbreak, output as a physical action plan.",
        "sarif_rule_id": "EAI01",
        "provael_channel": "instruction",
        "url": "https://www.provael.com/eai-top-10/eai01/"
      },
      {
        "id": "EAI02",
        "slug": "eai02",
        "title": "Adversarial perception (patches / textures / sensor spoofing)",
        "summary": "Crafted perturbations of what the policy sees or senses - patches, textures, sensor spoofs - that flip behaviour while looking benign to humans.",
        "sarif_rule_id": "EAI02",
        "provael_channel": "visual/sensor_spoof",
        "url": "https://www.provael.com/eai-top-10/eai02/"
      },
      {
        "id": "EAI03",
        "slug": "eai03",
        "title": "Model & pipeline poisoning, backdoors & supply chain",
        "summary": "Hidden triggers planted at training time or via a poisoned open-weights checkpoint - normal behaviour until the trigger fires an attacker-chosen action.",
        "sarif_rule_id": "EAI03",
        "provael_channel": "backdoor/weight_integrity",
        "url": "https://www.provael.com/eai-top-10/eai03/"
      },
      {
        "id": "EAI04",
        "slug": "eai04",
        "title": "Action-space integrity attacks (hijack / targeted trajectory / freeze)",
        "summary": "Attacks optimized in the action output itself - hijack the trajectory to an attacker waypoint, degrade task success, or freeze the policy into paralysis.",
        "sarif_rule_id": "EAI04",
        "provael_channel": "action/action_space/optimized",
        "url": "https://www.provael.com/eai-top-10/eai04/"
      },
      {
        "id": "EAI05",
        "slug": "eai05",
        "title": "Indirect / embodied prompt injection",
        "summary": "Malicious instructions that enter through the environment - a sign, a poisoned label, a hostile tool/MCP description, RAG content - treated as commands.",
        "sarif_rule_id": "EAI05",
        "provael_channel": "injection",
        "url": "https://www.provael.com/eai-top-10/eai05/"
      },
      {
        "id": "EAI06",
        "slug": "eai06",
        "title": "Cross-domain safety misalignment (the embodiment gap)",
        "summary": "Safety at the language layer that does not carry to the physical action - a benign-sounding, “safely-reasoned” instruction still drives an unsafe motion.",
        "sarif_rule_id": "EAI06",
        "provael_channel": "misalignment",
        "url": "https://www.provael.com/eai-top-10/eai06/"
      },
      {
        "id": "EAI07",
        "slug": "eai07",
        "title": "CPS, firmware, comms & teleoperation compromise",
        "summary": "Hardcoded keys, unauthenticated ROS 2/DDS, command injection, hijacked teleop. A real attack surface Provael does not test in simulation - cover it elsewhere.",
        "provael_channel": null,
        "url": "https://www.provael.com/eai-top-10/eai07/"
      },
      {
        "id": "EAI08",
        "slug": "eai08",
        "title": "Identity, access & excessive autonomy",
        "summary": "Weak authn/z on robot control surfaces plus over-broad autonomy - a policy that self-authorizes a high-consequence action without an operator token.",
        "sarif_rule_id": "EAI08",
        "provael_channel": "authorization",
        "url": "https://www.provael.com/eai-top-10/eai08/"
      },
      {
        "id": "EAI09",
        "slug": "eai09",
        "title": "Model & data confidentiality - theft, extraction, inversion & surveillance",
        "summary": "Stealing or extracting the policy (theft, extraction, inversion, membership inference) and the robot as a persistent multimodal surveillance device.",
        "sarif_rule_id": "EAI09",
        "provael_channel": "confidentiality",
        "url": "https://www.provael.com/eai-top-10/eai09/"
      },
      {
        "id": "EAI10",
        "slug": "eai10",
        "title": "Insufficient evaluation, observability & incident response",
        "summary": "The governance meta-risk: no standardized eval, no telemetry to detect an attack, no rollback, no incident process - so the other nine go unmanaged.",
        "provael_channel": null,
        "url": "https://www.provael.com/eai-top-10/eai10/"
      }
    ]
  }
}