Research crosswalks

Mappings are mechanism-level relations, not proof of equivalence or prevention. Unmapped labels remain explicit.

Retained aliases

• AF-AU-13: Untrusted task or tool text becomes a new authority grant. Resolves to AF-SE-01. Same third-party data-to-authority boundary; general authority wording retained as a variant.
• AF-LV-13: Recovery never re-enters the original task after success. Resolves to AF-LN-07. Same missing repair-to-original-mission continuation edge.
• AF-MM-10: Context compaction evicts load-bearing constraints. Resolves to AF-LN-03. Constraint-loss specialization of lossy summary replacing governing work state.
• AF-HT-04: Available authority is ignored and routine mechanics are returned to the operator. Resolves to AF-LN-14. Same operator-as-mechanical-relay dependency.
• AF-PH-01: Controller acknowledgment mistaken for physical achievement. Resolves to AF-TX-02. Physical specialization of acknowledgment promoted to achieved postcondition.
• AF-PH-05: Physical wear or consumption accumulates under repeatable commands. Resolves to AF-ID-10. Physical specialization of repeated secondary consequences behind an idempotent-looking state.
• AF-EV-03: Deterministic checker implements the wrong predicate. Resolves to AF-VR-03. Wrong/incomplete predicate is the same verification-specification gap.
• AF-EV-08: Evaluator shares the executor's blind spot or incentive. Resolves to AF-VR-15. Same common-source/common-mode false independence.
• AF-ID-11: Replayed result confused with present state. Resolves to AF-VR-05. Replayed historical outcome used as current-state evidence.
• AF-MM-08: Stale memory treated as the authoritative current state. Resolves to AF-VR-05. Memory-cache specialization of historical evidence used as current truth.
• AF-OB-05: Alert generated but not delivered to its real recipient. Resolves to AF-LV-15. Same locally recorded notification without actual delivery; general incident-alert variant retained.
• AF-HT-02: Approval details do not match the executed final payload. Resolves to AF-AU-05. Mutable payload specialization of approval not bound to the actually executed artifact.

Source labels

EFFECT26: A1: duplicate external effect

AF-TX-01, AF-ID-01

all eight published umbrella anomalies mapped

EFFECT26: A2: required effect absent at commit

AF-TX-02, AF-AT-05

all eight published umbrella anomalies mapped

EFFECT26: A3: unsafe undo of unresolved effect

AF-CP-01

all eight published umbrella anomalies mapped

EFFECT26: A4: aborted-workflow residue

AF-CP-04

all eight published umbrella anomalies mapped

EFFECT26: A5: effect released before branch resolution

AF-AT-03

all eight published umbrella anomalies mapped

EFFECT26: A6: committed effect depends on nonsurviving effect

AF-AT-04

all eight published umbrella anomalies mapped

EFFECT26: A7: unordered noncommuting effects

AF-CC-01

all eight published umbrella anomalies mapped

EFFECT26: A8: consequences survive local undo

AF-CP-06

all eight published umbrella anomalies mapped

MAST25: FM-1.1: task constraints not followed

AF-AU-01, AF-VR-03, AF-PL-07

all fourteen labels mapped

Coordination labels do not authorize parallel Camden reasoning roots.

MAST25: FM-1.2: role boundaries not followed

AF-AU-03, AF-AU-04

all fourteen labels mapped

Coordination labels do not authorize parallel Camden reasoning roots.

MAST25: FM-1.3: completed steps repeated

AF-RP-03, AF-PL-13

all fourteen labels mapped

Coordination labels do not authorize parallel Camden reasoning roots.

MAST25: FM-1.4: history lost

AF-LN-03, AF-RP-10

all fourteen labels mapped

Coordination labels do not authorize parallel Camden reasoning roots.

MAST25: FM-1.5: stopping criteria not recognized

AF-PL-13

all fourteen labels mapped

Coordination labels do not authorize parallel Camden reasoning roots.

MAST25: FM-2.1: dialogue restarted incorrectly

AF-RP-09, AF-LN-03

all fourteen labels mapped

Coordination labels do not authorize parallel Camden reasoning roots.

MAST25: FM-2.2: missing clarification

AF-PL-11, AF-BI-03

all fourteen labels mapped

Coordination labels do not authorize parallel Camden reasoning roots.

MAST25: FM-2.3: task derailment

AF-PL-08

all fourteen labels mapped

Coordination labels do not authorize parallel Camden reasoning roots.

MAST25: FM-2.4: necessary information withheld

AF-PL-12

all fourteen labels mapped

Coordination labels do not authorize parallel Camden reasoning roots.

MAST25: FM-2.5: peer input ignored

AF-PL-12

all fourteen labels mapped

Coordination labels do not authorize parallel Camden reasoning roots.

MAST25: FM-2.6: decision/action inconsistency

AF-PL-04

all fourteen labels mapped

Coordination labels do not authorize parallel Camden reasoning roots.

MAST25: FM-3.1: early task termination

AF-PL-07

all fourteen labels mapped

Coordination labels do not authorize parallel Camden reasoning roots.

MAST25: FM-3.2: verification absent or incomplete

AF-VR-03, AF-VR-08

all fourteen labels mapped

Coordination labels do not authorize parallel Camden reasoning roots.

MAST25: FM-3.3: incorrect verification

AF-VR-02, AF-VR-15

all fourteen labels mapped

Coordination labels do not authorize parallel Camden reasoning roots.

TOOLSCAN25: IAC: too few required calls

AF-PL-01, AF-PL-07

all seven labels mapped

TOOLSCAN25: IAV: invalid value or omitted required argument

AF-PX-04, AF-PX-14

all seven labels mapped

TOOLSCAN25: IAN: nonexistent argument name

AF-PX-04

all seven labels mapped

TOOLSCAN25: IAT: wrong argument type

AF-PX-04

all seven labels mapped

TOOLSCAN25: RAC: repeated calls

AF-PL-13, AF-ID-01

all seven labels mapped

TOOLSCAN25: IFN: nonexistent function

AF-PX-03

all seven labels mapped

TOOLSCAN25: IFE: malformed call format

AF-PX-04

all seven labels mapped

TOOLBENCHX26: contract drift

AF-PX-11

all five hazard families mapped

TOOLBENCHX26: invocation mismatch

AF-PX-04, AF-TX-10

all five hazard families mapped

TOOLBENCHX26: tool execution failure

AF-LV-08, AF-EN-10

all five hazard families mapped

TOOLBENCHX26: output representation drift

AF-PX-15

all five hazard families mapped

TOOLBENCHX26: conflicting source outputs

AF-VR-07

all five hazard families mapped

CHAOS26: ToolFailure

AF-EN-10, AF-PX-16

all ten injected fault types mapped

Injected fault family, not automatically a separately observed production incident.

CHAOS26: A2ATimeout

AF-TX-01, AF-PX-08

all ten injected fault types mapped

Injected fault family, not automatically a separately observed production incident.

CHAOS26: ToolLatency

AF-LV-12, AF-EC-07

all ten injected fault types mapped

Injected fault family, not automatically a separately observed production incident.

CHAOS26: A2ALatency

AF-LV-12, AF-PX-08

all ten injected fault types mapped

Injected fault family, not automatically a separately observed production incident.

CHAOS26: InfiniteLoop

AF-LV-07, AF-PL-13

all ten injected fault types mapped

Injected fault family, not automatically a separately observed production incident.

CHAOS26: ToolMisroute

AF-BI-10, AF-PX-13

all ten injected fault types mapped

Injected fault family, not automatically a separately observed production incident.

CHAOS26: AgentMisroute

AF-LN-05, AF-SE-06

all ten injected fault types mapped

Injected fault family, not automatically a separately observed production incident.

CHAOS26: ContextOverflow

AF-EC-05, AF-LN-03

all ten injected fault types mapped

Injected fault family, not automatically a separately observed production incident.

CHAOS26: OutputCorruption

AF-TX-10, AF-EN-09

all ten injected fault types mapped

Injected fault family, not automatically a separately observed production incident.

CHAOS26: GuardrailBypass

AF-VR-12, AF-SE-13

all ten injected fault types mapped

Injected fault family, not automatically a separately observed production incident.

OWASP26: ASI01: goal hijack

AF-SE-01, AF-SE-05

all ten umbrella labels mapped

Mapped from the official launch article; umbrella categories overlap.

OWASP26: ASI02: tool misuse

AF-SE-02, AF-PX-13

all ten umbrella labels mapped

Mapped from the official launch article; umbrella categories overlap.

OWASP26: ASI03: identity and privilege abuse

AF-AU-03, AF-SE-06

all ten umbrella labels mapped

Mapped from the official launch article; umbrella categories overlap.

OWASP26: ASI04: supply-chain compromise

AF-SC-01, AF-SC-03

all ten umbrella labels mapped

Mapped from the official launch article; umbrella categories overlap.

OWASP26: ASI05: unexpected code execution

AF-SE-07, AF-SC-02

all ten umbrella labels mapped

Mapped from the official launch article; umbrella categories overlap.

OWASP26: ASI06: memory/context poisoning

AF-SE-04, AF-SE-05

all ten umbrella labels mapped

Mapped from the official launch article; umbrella categories overlap.

OWASP26: ASI07: insecure agent communication

AF-SE-06, AF-PR-07

all ten umbrella labels mapped

Mapped from the official launch article; umbrella categories overlap.

OWASP26: ASI08: cascading failures

AF-LV-09, AF-PH-04, AF-VR-15

all ten umbrella labels mapped

Mapped from the official launch article; umbrella categories overlap.

OWASP26: ASI09: human-agent trust exploitation

AF-AU-07, AF-HT-01

all ten umbrella labels mapped

Mapped from the official launch article; umbrella categories overlap.

OWASP26: ASI10: rogue agents

AF-SE-14, AF-EC-08

all ten umbrella labels mapped

Mapped from the official launch article; umbrella categories overlap.

MEMFAIL26: summary/detail failure

AF-MM-05, AF-LN-03

four mechanism families mapped

MEMFAIL26: storage/update failure

AF-MM-03, AF-MM-04

four mechanism families mapped

MEMFAIL26: retrieval failure

AF-MM-01, AF-MM-06

four mechanism families mapped

MEMFAIL26: reasoning despite correct memory

AF-MM-14

four mechanism families mapped

AGENTLEAK26: final output

AF-PR-01

all seven disclosure channels mapped

The paper does not evaluate every channel at the same scale.

AGENTLEAK26: agent messages

AF-PR-07

all seven disclosure channels mapped

The paper does not evaluate every channel at the same scale.

AGENTLEAK26: tool input

AF-PR-02

all seven disclosure channels mapped

The paper does not evaluate every channel at the same scale.

AGENTLEAK26: tool output

AF-PR-03

all seven disclosure channels mapped

The paper does not evaluate every channel at the same scale.

AGENTLEAK26: shared memory

AF-PR-04

all seven disclosure channels mapped

The paper does not evaluate every channel at the same scale.

AGENTLEAK26: system logs

AF-PR-05

all seven disclosure channels mapped

The paper does not evaluate every channel at the same scale.

AGENTLEAK26: artifacts

AF-PR-06

all seven disclosure channels mapped

The paper does not evaluate every channel at the same scale.

RAJ26: owner: instruction/grader mismatch

AF-VR-03, AF-EV-04

role-specific label mapped

Mapped by mechanism; fault-bearing component remains a separate source axis.

RAJ26: owner: excessive initiative

AF-AU-01

role-specific label mapped

Mapped by mechanism; fault-bearing component remains a separate source axis.

RAJ26: owner: insufficient initiative

AF-LN-14

role-specific label mapped

Mapped by mechanism; fault-bearing component remains a separate source axis.

RAJ26: owner: satisficing

AF-PL-07

role-specific label mapped

Mapped by mechanism; fault-bearing component remains a separate source axis.

RAJ26: owner: task-instruction failure

AF-AU-01, AF-PL-07

role-specific label mapped

Mapped by mechanism; fault-bearing component remains a separate source axis.

RAJ26: owner: reasoning error

AF-PL-10

role-specific label mapped

Mapped by mechanism; fault-bearing component remains a separate source axis.

RAJ26: owner: unapproved irreversible action

AF-AU-01, AF-AU-04

role-specific label mapped

Mapped by mechanism; fault-bearing component remains a separate source axis.

RAJ26: owner: sycophancy

AF-HT-05

role-specific label mapped

Mapped by mechanism; fault-bearing component remains a separate source axis.

RAJ26: owner: missing domain knowledge

AF-PL-09

role-specific label mapped

Mapped by mechanism; fault-bearing component remains a separate source axis.

RAJ26: owner: value misalignment

Unmapped

outside a purely observable effect taxonomy

The source includes judgments about deliberation even with an apparently correct outcome. This catalog does not invent observable effect evidence or require private chain-of-thought disclosure. Observable stakeholder/constraint violations map to PL/AU/PR; the broader label remains a scope limitation.

RAJ26: grader: specification gaming

AF-EV-02

role-specific label mapped

Mapped by mechanism; fault-bearing component remains a separate source axis.

RAJ26: grader: evaluation awareness

AF-EV-09

role-specific label mapped

Mapped by mechanism; fault-bearing component remains a separate source axis.

RAJ26: third party: indirect injection

AF-SE-01

role-specific label mapped

Mapped by mechanism; fault-bearing component remains a separate source axis.

RAJ26: third party: contextual sycophancy

AF-HT-05, AF-VR-15

role-specific label mapped

Mapped by mechanism; fault-bearing component remains a separate source axis.

RAJ26: context: state tracking failure

AF-PL-13, AF-LV-07

role-specific label mapped

Mapped by mechanism; fault-bearing component remains a separate source axis.

RAJ26: context: goal drift

AF-PL-08

role-specific label mapped

Mapped by mechanism; fault-bearing component remains a separate source axis.

RAJ26: context: rationale erosion

AF-LN-03

role-specific label mapped

Mapped by mechanism; fault-bearing component remains a separate source axis.

RAJ26: memory: missed write

AF-MM-15

role-specific label mapped

Mapped by mechanism; fault-bearing component remains a separate source axis.

RAJ26: memory: stale state

AF-MM-04, AF-VR-05

role-specific label mapped

Mapped by mechanism; fault-bearing component remains a separate source axis.

RAJ26: memory: overgeneralized rule

AF-MM-05

role-specific label mapped

Mapped by mechanism; fault-bearing component remains a separate source axis.

RAJ26: memory: rationale erosion

AF-MM-05

role-specific label mapped

Mapped by mechanism; fault-bearing component remains a separate source axis.

RAJ26: memory: pollution

AF-MM-09

role-specific label mapped

Mapped by mechanism; fault-bearing component remains a separate source axis.

RAJ26: memory: redundancy

AF-MM-09

role-specific label mapped

Mapped by mechanism; fault-bearing component remains a separate source axis.

RAJ26: memory: missed read

AF-MM-01

role-specific label mapped

Mapped by mechanism; fault-bearing component remains a separate source axis.

RAJ26: memory: retrieved constraint ignored

AF-MM-02

role-specific label mapped

Mapped by mechanism; fault-bearing component remains a separate source axis.

RAJ26: tool: malformed arguments

AF-PX-04

role-specific label mapped

Mapped by mechanism; fault-bearing component remains a separate source axis.

RAJ26: tool: low-quality arguments

AF-PX-14

role-specific label mapped

Mapped by mechanism; fault-bearing component remains a separate source axis.

RAJ26: tool: wrong available tool

AF-PX-13

role-specific label mapped

Mapped by mechanism; fault-bearing component remains a separate source axis.

RAJ26: tool: nonexistent tool

AF-PX-03

role-specific label mapped

Mapped by mechanism; fault-bearing component remains a separate source axis.

RAJ26: tool: feedback neglected

AF-PX-16

role-specific label mapped

Mapped by mechanism; fault-bearing component remains a separate source axis.

RAJ26: tool: recovery failure

AF-LV-07, AF-LV-08

role-specific label mapped

Mapped by mechanism; fault-bearing component remains a separate source axis.

RAJ26: tool: integration mistranslation

AF-TX-10, AF-PX-15

role-specific label mapped

Mapped by mechanism; fault-bearing component remains a separate source axis.

RAJ26: peer: delegation failure

AF-PL-01, AF-CC-02

role-specific label mapped

Mapped by mechanism; fault-bearing component remains a separate source axis.

RAJ26: peer: communication failure

AF-PL-12

role-specific label mapped

Mapped by mechanism; fault-bearing component remains a separate source axis.

RAJ26: subagent: delegation failure

AF-PL-01, AF-LN-05

role-specific label mapped

Mapped by mechanism; fault-bearing component remains a separate source axis.

RAJ26: subagent: communication failure

AF-PL-12, AF-LN-09

role-specific label mapped

Mapped by mechanism; fault-bearing component remains a separate source axis.

RAJ26: external environment: service failure

AF-EN-10

role-specific label mapped

Mapped by mechanism; fault-bearing component remains a separate source axis.

RAJ26: external environment: stale delivery

AF-TX-05, AF-TM-05

role-specific label mapped

Mapped by mechanism; fault-bearing component remains a separate source axis.

RAJ26: external environment: recovery failure

AF-LV-08, AF-LN-07

role-specific label mapped

Mapped by mechanism; fault-bearing component remains a separate source axis.

RAJ26: local environment: observation failure

AF-EN-11, AF-PL-11

role-specific label mapped

Mapped by mechanism; fault-bearing component remains a separate source axis.

RAJ26: local environment: recovery failure

AF-LV-07, AF-LV-08

role-specific label mapped

Mapped by mechanism; fault-bearing component remains a separate source axis.

AGENTEVAL26: scope error

AF-AU-01, AF-PL-08

all visible Table 8 rows mapped; caption discrepancy retained

v1 Table 8 visibly contains 20 rows while its caption states 21; no missing row was invented.

AGENTEVAL26: unresolved ambiguity

AF-PL-11

all visible Table 8 rows mapped; caption discrepancy retained

v1 Table 8 visibly contains 20 rows while its caption states 21; no missing row was invented.

AGENTEVAL26: omitted tool

AF-PL-01

all visible Table 8 rows mapped; caption discrepancy retained

v1 Table 8 visibly contains 20 rows while its caption states 21; no missing row was invented.

AGENTEVAL26: missing verification

AF-VR-03

all visible Table 8 rows mapped; caption discrepancy retained

v1 Table 8 visibly contains 20 rows while its caption states 21; no missing row was invented.

AGENTEVAL26: skipped prerequisite

AF-PL-01

all visible Table 8 rows mapped; caption discrepancy retained

v1 Table 8 visibly contains 20 rows while its caption states 21; no missing row was invented.

AGENTEVAL26: dependency order violated

AF-PL-02

all visible Table 8 rows mapped; caption discrepancy retained

v1 Table 8 visibly contains 20 rows while its caption states 21; no missing row was invented.

AGENTEVAL26: inefficient sequence

AF-PX-13, AF-EC-01

all visible Table 8 rows mapped; caption discrepancy retained

v1 Table 8 visibly contains 20 rows while its caption states 21; no missing row was invented.

AGENTEVAL26: wrong tool category

AF-PX-13

all visible Table 8 rows mapped; caption discrepancy retained

v1 Table 8 visibly contains 20 rows while its caption states 21; no missing row was invented.

AGENTEVAL26: wrong tool granularity

AF-PX-13, AF-PX-14

all visible Table 8 rows mapped; caption discrepancy retained

v1 Table 8 visibly contains 20 rows while its caption states 21; no missing row was invented.

AGENTEVAL26: parameter type mismatch

AF-PX-04

all visible Table 8 rows mapped; caption discrepancy retained

v1 Table 8 visibly contains 20 rows while its caption states 21; no missing row was invented.

AGENTEVAL26: parameter value wrong

AF-PX-14

all visible Table 8 rows mapped; caption discrepancy retained

v1 Table 8 visibly contains 20 rows while its caption states 21; no missing row was invented.

AGENTEVAL26: required parameter absent

AF-PX-04

all visible Table 8 rows mapped; caption discrepancy retained

v1 Table 8 visibly contains 20 rows while its caption states 21; no missing row was invented.

AGENTEVAL26: tool timeout

AF-TX-01, AF-TX-03

all visible Table 8 rows mapped; caption discrepancy retained

v1 Table 8 visibly contains 20 rows while its caption states 21; no missing row was invented.

AGENTEVAL26: unhandled tool error

AF-PX-16

all visible Table 8 rows mapped; caption discrepancy retained

v1 Table 8 visibly contains 20 rows while its caption states 21; no missing row was invented.

AGENTEVAL26: truncated context

AF-LN-03

all visible Table 8 rows mapped; caption discrepancy retained

v1 Table 8 visibly contains 20 rows while its caption states 21; no missing row was invented.

AGENTEVAL26: output selectively omitted

AF-PX-16

all visible Table 8 rows mapped; caption discrepancy retained

v1 Table 8 visibly contains 20 rows while its caption states 21; no missing row was invented.

AGENTEVAL26: fabricated output

AF-VR-10, AF-PL-09

all visible Table 8 rows mapped; caption discrepancy retained

v1 Table 8 visibly contains 20 rows while its caption states 21; no missing row was invented.

AGENTEVAL26: results conflated

AF-TX-07, AF-VR-07

all visible Table 8 rows mapped; caption discrepancy retained

v1 Table 8 visibly contains 20 rows while its caption states 21; no missing row was invented.

AGENTEVAL26: partial task called complete

AF-PL-07

all visible Table 8 rows mapped; caption discrepancy retained

v1 Table 8 visibly contains 20 rows while its caption states 21; no missing row was invented.

AGENTEVAL26: retry loop exited early

AF-LV-08

all visible Table 8 rows mapped; caption discrepancy retained

v1 Table 8 visibly contains 20 rows while its caption states 21; no missing row was invented.

AIRT26: interacting components produce policy violations

AF-PL-12, AF-VR-15, AF-EV-07

34 overview labels mapped at umbrella level

Umbrella mapping may cover only the observable workflow portion of a broader safety/social risk; it does not claim all proposed threat variants were reproduced.

AIRT26: unfair multi-principal allocation

AF-EC-10

34 overview labels mapped at umbrella level

Umbrella mapping may cover only the observable workflow portion of a broader safety/social risk; it does not claim all proposed threat variants were reproduced.

AIRT26: organizational knowledge loss

AF-LN-03, AF-MM-15, AF-MM-05

34 overview labels mapped at umbrella level

Umbrella mapping may cover only the observable workflow portion of a broader safety/social risk; it does not claim all proposed threat variants were reproduced.

AIRT26: safety subordinated to operational priority

AF-PL-14

34 overview labels mapped at umbrella level

Umbrella mapping may cover only the observable workflow portion of a broader safety/social risk; it does not claim all proposed threat variants were reproduced.

AIRT26: agent compromise

AF-SE-04, AF-SE-13

34 overview labels mapped at umbrella level

Umbrella mapping may cover only the observable workflow portion of a broader safety/social risk; it does not claim all proposed threat variants were reproduced.

AIRT26: injected agent instructions

AF-SE-01

34 overview labels mapped at umbrella level

Umbrella mapping may cover only the observable workflow portion of a broader safety/social risk; it does not claim all proposed threat variants were reproduced.

AIRT26: agent impersonation

AF-SE-06

34 overview labels mapped at umbrella level

Umbrella mapping may cover only the observable workflow portion of a broader safety/social risk; it does not claim all proposed threat variants were reproduced.

AIRT26: workflow graph manipulated

AF-SE-13, AF-LN-05

34 overview labels mapped at umbrella level

Umbrella mapping may cover only the observable workflow portion of a broader safety/social risk; it does not claim all proposed threat variants were reproduced.

AIRT26: poisoned agent provisioning

AF-SC-01, AF-SE-02, AF-SE-04

34 overview labels mapped at umbrella level

Umbrella mapping may cover only the observable workflow portion of a broader safety/social risk; it does not claim all proposed threat variants were reproduced.

AIRT26: distributed jailbreak fragments

AF-AU-08, AF-SE-05

34 overview labels mapped at umbrella level

Umbrella mapping may cover only the observable workflow portion of a broader safety/social risk; it does not claim all proposed threat variants were reproduced.

AIRT26: agentic supply chain

AF-SC-01, AF-SC-03

34 overview labels mapped at umbrella level

Umbrella mapping may cover only the observable workflow portion of a broader safety/social risk; it does not claim all proposed threat variants were reproduced.

AIRT26: goal hijack

AF-SE-01, AF-SE-05

34 overview labels mapped at umbrella level

Umbrella mapping may cover only the observable workflow portion of a broader safety/social risk; it does not claim all proposed threat variants were reproduced.

AIRT26: inter-agent trust escalation

AF-AU-03, AF-SE-06

34 overview labels mapped at umbrella level

Umbrella mapping may cover only the observable workflow portion of a broader safety/social risk; it does not claim all proposed threat variants were reproduced.

AIRT26: computer-use visual attack

AF-SE-03

34 overview labels mapped at umbrella level

Umbrella mapping may cover only the observable workflow portion of a broader safety/social risk; it does not claim all proposed threat variants were reproduced.

AIRT26: session contamination

AF-SE-05

34 overview labels mapped at umbrella level

Umbrella mapping may cover only the observable workflow portion of a broader safety/social risk; it does not claim all proposed threat variants were reproduced.

AIRT26: MCP/plugin abuse

AF-SE-02, AF-SE-09

34 overview labels mapped at umbrella level

Umbrella mapping may cover only the observable workflow portion of a broader safety/social risk; it does not claim all proposed threat variants were reproduced.

AIRT26: architecture/capability disclosure

AF-SE-12

34 overview labels mapped at umbrella level

Umbrella mapping may cover only the observable workflow portion of a broader safety/social risk; it does not claim all proposed threat variants were reproduced.

AIRT26: insufficient transparency/accountability

AF-HT-06, AF-OB-04

34 overview labels mapped at umbrella level

Umbrella mapping may cover only the observable workflow portion of a broader safety/social risk; it does not claim all proposed threat variants were reproduced.

AIRT26: parasocial reliance

AF-HT-05, AF-HT-01

34 overview labels mapped at umbrella level

Umbrella mapping may cover only the observable workflow portion of a broader safety/social risk; it does not claim all proposed threat variants were reproduced.

AIRT26: amplified bias

AF-PL-15

34 overview labels mapped at umbrella level

Umbrella mapping may cover only the observable workflow portion of a broader safety/social risk; it does not claim all proposed threat variants were reproduced.

AIRT26: user impersonation

AF-SE-06, AF-PX-10

34 overview labels mapped at umbrella level

Umbrella mapping may cover only the observable workflow portion of a broader safety/social risk; it does not claim all proposed threat variants were reproduced.

AIRT26: unintelligible consent

AF-HT-07

34 overview labels mapped at umbrella level

Umbrella mapping may cover only the observable workflow portion of a broader safety/social risk; it does not claim all proposed threat variants were reproduced.

AIRT26: hallucinated inputs or results

AF-PX-03, AF-PL-09, AF-VR-10

34 overview labels mapped at umbrella level

Umbrella mapping may cover only the observable workflow portion of a broader safety/social risk; it does not claim all proposed threat variants were reproduced.

AIRT26: instruction misinterpretation

AF-PL-11, AF-AU-01

34 overview labels mapped at umbrella level

Umbrella mapping may cover only the observable workflow portion of a broader safety/social risk; it does not claim all proposed threat variants were reproduced.

AIRT26: memory poisoning/theft

AF-SE-04, AF-PR-04

34 overview labels mapped at umbrella level

Umbrella mapping may cover only the observable workflow portion of a broader safety/social risk; it does not claim all proposed threat variants were reproduced.

AIRT26: targeted knowledge-base poisoning

AF-SE-01, AF-MM-06

34 overview labels mapped at umbrella level

Umbrella mapping may cover only the observable workflow portion of a broader safety/social risk; it does not claim all proposed threat variants were reproduced.

AIRT26: cross-domain injection

AF-SE-01, AF-SE-02

34 overview labels mapped at umbrella level

Umbrella mapping may cover only the observable workflow portion of a broader safety/social risk; it does not claim all proposed threat variants were reproduced.

AIRT26: human-approval bypass

AF-AU-07, AF-AU-06

34 overview labels mapped at umbrella level

Umbrella mapping may cover only the observable workflow portion of a broader safety/social risk; it does not claim all proposed threat variants were reproduced.

AIRT26: malicious or compromised function

AF-SE-07, AF-SC-02

34 overview labels mapped at umbrella level

Umbrella mapping may cover only the observable workflow portion of a broader safety/social risk; it does not claim all proposed threat variants were reproduced.

AIRT26: incorrect permissions

AF-AU-03, AF-AU-04

34 overview labels mapped at umbrella level

Umbrella mapping may cover only the observable workflow portion of a broader safety/social risk; it does not claim all proposed threat variants were reproduced.

AIRT26: resource exhaustion

AF-EC-01, AF-EC-05

34 overview labels mapped at umbrella level

Umbrella mapping may cover only the observable workflow portion of a broader safety/social risk; it does not claim all proposed threat variants were reproduced.

AIRT26: insufficient isolation

AF-SE-11, AF-SC-04

34 overview labels mapped at umbrella level

Umbrella mapping may cover only the observable workflow portion of a broader safety/social risk; it does not claim all proposed threat variants were reproduced.

AIRT26: excessive agency

AF-AU-01, AF-EC-08

34 overview labels mapped at umbrella level

Umbrella mapping may cover only the observable workflow portion of a broader safety/social risk; it does not claim all proposed threat variants were reproduced.

AIRT26: data provenance lost

AF-LN-02, AF-BI-09

34 overview labels mapped at umbrella level

Umbrella mapping may cover only the observable workflow portion of a broader safety/social risk; it does not claim all proposed threat variants were reproduced.

MCPFAULT26: server dependencies

AF-EN-01

visible leaf-family mapping, not a CVE-level incident census

Figure 3 and detailed subtype text were inspected; source hierarchy counts are not added to the anomaly count.

MCPFAULT26: server platform mismatch

AF-EN-02

visible leaf-family mapping, not a CVE-level incident census

Figure 3 and detailed subtype text were inspected; source hierarchy counts are not added to the anomaly count.

MCPFAULT26: server packaging/deployment

AF-SC-07, AF-EN-06

visible leaf-family mapping, not a CVE-level incident census

Figure 3 and detailed subtype text were inspected; source hierarchy counts are not added to the anomaly count.

MCPFAULT26: server access synchronization

AF-CC-12, AF-EN-05

visible leaf-family mapping, not a CVE-level incident census

Figure 3 and detailed subtype text were inspected; source hierarchy counts are not added to the anomaly count.

MCPFAULT26: server resource handling

AF-EN-03, AF-EN-08

visible leaf-family mapping, not a CVE-level incident census

Figure 3 and detailed subtype text were inspected; source hierarchy counts are not added to the anomaly count.

MCPFAULT26: server logging

AF-PX-05, AF-OB-01

visible leaf-family mapping, not a CVE-level incident census

Figure 3 and detailed subtype text were inspected; source hierarchy counts are not added to the anomaly count.

MCPFAULT26: network configuration

AF-TX-11

visible leaf-family mapping, not a CVE-level incident census

Figure 3 and detailed subtype text were inspected; source hierarchy counts are not added to the anomaly count.

MCPFAULT26: API usage

AF-PX-04, AF-PX-11

visible leaf-family mapping, not a CVE-level incident census

Figure 3 and detailed subtype text were inspected; source hierarchy counts are not added to the anomaly count.

MCPFAULT26: server infrastructure

AF-EN-10

visible leaf-family mapping, not a CVE-level incident census

Figure 3 and detailed subtype text were inspected; source hierarchy counts are not added to the anomaly count.

MCPFAULT26: tool call/execution

AF-PX-04, AF-PX-13, AF-EN-04

visible leaf-family mapping, not a CVE-level incident census

Figure 3 and detailed subtype text were inspected; source hierarchy counts are not added to the anomaly count.

MCPFAULT26: tool discovery/registration

AF-PX-02

visible leaf-family mapping, not a CVE-level incident census

Figure 3 and detailed subtype text were inspected; source hierarchy counts are not added to the anomaly count.

MCPFAULT26: tool response handling

AF-TX-10, AF-PX-15

visible leaf-family mapping, not a CVE-level incident census

Figure 3 and detailed subtype text were inspected; source hierarchy counts are not added to the anomaly count.

MCPFAULT26: tool authorization

AF-AU-04, AF-SE-09

visible leaf-family mapping, not a CVE-level incident census

Figure 3 and detailed subtype text were inspected; source hierarchy counts are not added to the anomaly count.

MCPFAULT26: tool connection settings

AF-TX-11, AF-BI-01

visible leaf-family mapping, not a CVE-level incident census

Figure 3 and detailed subtype text were inspected; source hierarchy counts are not added to the anomaly count.

MCPFAULT26: tool connection synchronization

AF-PX-01, AF-PX-09

visible leaf-family mapping, not a CVE-level incident census

Figure 3 and detailed subtype text were inspected; source hierarchy counts are not added to the anomaly count.

MCPFAULT26: tool authentication

AF-SE-09, AF-SE-10

visible leaf-family mapping, not a CVE-level incident census

Figure 3 and detailed subtype text were inspected; source hierarchy counts are not added to the anomaly count.

MCPFAULT26: tool dependency

AF-EN-01

visible leaf-family mapping, not a CVE-level incident census

Figure 3 and detailed subtype text were inspected; source hierarchy counts are not added to the anomaly count.

MCPFAULT26: host server configuration

AF-PX-01, AF-BI-01

visible leaf-family mapping, not a CVE-level incident census

Figure 3 and detailed subtype text were inspected; source hierarchy counts are not added to the anomaly count.

MCPFAULT26: host LLM integration

AF-RP-08, AF-PX-06

visible leaf-family mapping, not a CVE-level incident census

Figure 3 and detailed subtype text were inspected; source hierarchy counts are not added to the anomaly count.

MCPFAULT26: host dependency

AF-EN-01

visible leaf-family mapping, not a CVE-level incident census

Figure 3 and detailed subtype text were inspected; source hierarchy counts are not added to the anomaly count.

MCPFAULT26: host connection synchronization

AF-PX-01, AF-PX-09

visible leaf-family mapping, not a CVE-level incident census

Figure 3 and detailed subtype text were inspected; source hierarchy counts are not added to the anomaly count.

MCPFAULT26: host connection settings

AF-TX-11

visible leaf-family mapping, not a CVE-level incident census

Figure 3 and detailed subtype text were inspected; source hierarchy counts are not added to the anomaly count.

MCPFAULT26: host/server configuration mismatch

AF-PX-11

visible leaf-family mapping, not a CVE-level incident census

Figure 3 and detailed subtype text were inspected; source hierarchy counts are not added to the anomaly count.

MCPFAULT26: session handling

AF-PX-10, AF-PX-07

visible leaf-family mapping, not a CVE-level incident census

Figure 3 and detailed subtype text were inspected; source hierarchy counts are not added to the anomaly count.

MCPFAULT26: host logging

AF-PX-05, AF-OB-01

visible leaf-family mapping, not a CVE-level incident census

Figure 3 and detailed subtype text were inspected; source hierarchy counts are not added to the anomaly count.

MCPFAULT26: host authorization

AF-AU-04

visible leaf-family mapping, not a CVE-level incident census

Figure 3 and detailed subtype text were inspected; source hierarchy counts are not added to the anomaly count.

MCPFAULT26: hook configuration

AF-SC-02, AF-PX-01

visible leaf-family mapping, not a CVE-level incident census

Figure 3 and detailed subtype text were inspected; source hierarchy counts are not added to the anomaly count.

MCPFAULT26: documentation fault

AF-PX-11, AF-PX-12

visible leaf-family mapping, not a CVE-level incident census

Figure 3 and detailed subtype text were inspected; source hierarchy counts are not added to the anomaly count.

MCPFAULT26: general programming fault

AF-EN-01, AF-EN-08, AF-PX-04

visible leaf-family mapping, not a CVE-level incident census

Figure 3 and detailed subtype text were inspected; source hierarchy counts are not added to the anomaly count.

AGFAULT26: LLM integration/configuration

AF-RP-08, AF-PX-01

grouped software fault coverage; not every source sublabel individually reproduced

Grouped at component/defect-family level. Source fault, symptom and proposed-cause taxonomies are not conflated.

AGFAULT26: provider API compatibility

AF-PX-11

grouped software fault coverage; not every source sublabel individually reproduced

Grouped at component/defect-family level. Source fault, symptom and proposed-cause taxonomies are not conflated.

AGFAULT26: token handling/tracking

AF-EC-01, AF-EC-05

grouped software fault coverage; not every source sublabel individually reproduced

Grouped at component/defect-family level. Source fault, symptom and proposed-cause taxonomies are not conflated.

AGFAULT26: LLM authentication

AF-SE-09

grouped software fault coverage; not every source sublabel individually reproduced

Grouped at component/defect-family level. Source fault, symptom and proposed-cause taxonomies are not conflated.

AGFAULT26: agent lifecycle and termination

AF-RP-09, AF-PL-13

grouped software fault coverage; not every source sublabel individually reproduced

Grouped at component/defect-family level. Source fault, symptom and proposed-cause taxonomies are not conflated.

AGFAULT26: state consistency

AF-LN-06, AF-CC-02

grouped software fault coverage; not every source sublabel individually reproduced

Grouped at component/defect-family level. Source fault, symptom and proposed-cause taxonomies are not conflated.

AGFAULT26: tool API and parameter handling

AF-PX-04, AF-PX-11

grouped software fault coverage; not every source sublabel individually reproduced

Grouped at component/defect-family level. Source fault, symptom and proposed-cause taxonomies are not conflated.

AGFAULT26: connection setup

AF-TX-11

grouped software fault coverage; not every source sublabel individually reproduced

Grouped at component/defect-family level. Source fault, symptom and proposed-cause taxonomies are not conflated.

AGFAULT26: authentication/authorization

AF-SE-09, AF-AU-04

grouped software fault coverage; not every source sublabel individually reproduced

Grouped at component/defect-family level. Source fault, symptom and proposed-cause taxonomies are not conflated.

AGFAULT26: database/resource handling

AF-EN-04, AF-EN-08

grouped software fault coverage; not every source sublabel individually reproduced

Grouped at component/defect-family level. Source fault, symptom and proposed-cause taxonomies are not conflated.

AGFAULT26: synchronization

AF-CC-12, AF-EN-05

grouped software fault coverage; not every source sublabel individually reproduced

Grouped at component/defect-family level. Source fault, symptom and proposed-cause taxonomies are not conflated.

AGFAULT26: logging/telemetry

AF-OB-01, AF-PX-05

grouped software fault coverage; not every source sublabel individually reproduced

Grouped at component/defect-family level. Source fault, symptom and proposed-cause taxonomies are not conflated.

AGFAULT26: persistence/state restoration

AF-DS-01, AF-RP-06

grouped software fault coverage; not every source sublabel individually reproduced

Grouped at component/defect-family level. Source fault, symptom and proposed-cause taxonomies are not conflated.

AGFAULT26: types/encoding/validation

AF-PX-04, AF-EN-09

grouped software fault coverage; not every source sublabel individually reproduced

Grouped at component/defect-family level. Source fault, symptom and proposed-cause taxonomies are not conflated.

AGFAULT26: dependency/import/install/resolver

AF-EN-01, AF-SC-07

grouped software fault coverage; not every source sublabel individually reproduced

Grouped at component/defect-family level. Source fault, symptom and proposed-cause taxonomies are not conflated.

AGFAULT26: platform/integration compatibility

AF-EN-02, AF-PX-11

grouped software fault coverage; not every source sublabel individually reproduced

Grouped at component/defect-family level. Source fault, symptom and proposed-cause taxonomies are not conflated.

AGFAULT26: exceptions/implementation defects

AF-OB-01, AF-PX-16

grouped software fault coverage; not every source sublabel individually reproduced

Grouped at component/defect-family level. Source fault, symptom and proposed-cause taxonomies are not conflated.

AGFAULT26: UI/visualization

AF-HT-06, AF-OB-08

grouped software fault coverage; not every source sublabel individually reproduced

Grouped at component/defect-family level. Source fault, symptom and proposed-cause taxonomies are not conflated.

AGFAULT26: documentation

AF-PX-11, AF-PX-12

grouped software fault coverage; not every source sublabel individually reproduced

Grouped at component/defect-family level. Source fault, symptom and proposed-cause taxonomies are not conflated.

Supplied labels

• lost acknowledgment / duplicate effect: AF-TX-01.
• missing committed effect: AF-TX-02, AF-AT-05.
• orphaned compensation: AF-CP-01.
• ambiguous timeout / late execution: AF-TX-03, AF-TX-04.
• polling desynchronization: AF-TX-06.
• delayed visibility: AF-TX-05.
• compound partial success: AF-AT-11.
• invocation mistranslation: AF-TX-10.
• LLM-minted idempotency key: AF-ID-01.
• premature externalization: AF-AT-03.
• contaminated speculation / discarded branch: AF-AT-03, AF-AT-04.
• out-of-order asynchronous result: AF-TX-07, AF-TX-09.
• partial multi-tool commit: AF-AT-05.
• TOCTOU: AF-CC-15.
• uncompensated residue: AF-CP-04.
• phantom compensation: AF-CP-06.
• cascading compensation failure: AF-CP-02, AF-CP-11.
• irreversibility without rollback: AF-CP-07, AF-AT-05.
• false inverse: AF-CP-07.
• conflicting externalizations: AF-CC-01.
• lost update: AF-CC-02.
• split-brain handoff: AF-CC-11.
• noncommuting operation order: AF-CC-01, AF-PL-02.
• dual write / missing outbox: AF-AT-01.
• stale conflict abort: AF-LV-08.
• verification theater: AF-VR-01.
• circular verification: AF-VR-02.
• verification blind spot: AF-VR-03.
• hallucinated completion: AF-VR-10, AF-PL-07.
• reality substitution: AF-VR-05.
• receipt without effect: AF-TX-02, AF-VR-04.
• effect without receipt: AF-TX-01, AF-LN-09.
• intention without execution: AF-VR-10.
• fail-plausible: AF-VR-11.
• specification gaming: AF-EV-02.
• cross-source conflict: AF-VR-07.
• lineage amputation: AF-LN-02.
• ghost lineage: AF-LN-01.
• summary substitution: AF-LN-03.
• missed write: AF-MM-15.
• memory rationale erosion: AF-MM-05.
• authority inflation: AF-AU-01.
• stale authority: AF-AU-02.
• privilege inheritance: AF-AU-03.
• delayed execution bypass: AF-AU-05, AF-AU-11.
• approval description laundering: AF-AU-07.
• excessive agency: AF-AU-01, AF-AU-04.
• identity-dependent worker: AF-RP-07, AF-MM-15.
• personality/model coupling: AF-RP-08.
• zombie predecessor: AF-CC-09, AF-CC-10.
• silent death: AF-LV-01.
• infinite recovery: AF-LV-07.
• continuation after stop: AF-AU-02, AF-TX-03.
• step repetition: AF-RP-03, AF-PL-13.
• premature loop exit: AF-PL-07.
• dead consumer wait: AF-LV-03, AF-LV-04.
• procedure capture: AF-PL-05.
• safety substitution: AF-PL-06.
• goal drift: AF-PL-08.
• indirect prompt injection: AF-SE-01.
• poisoned fixture or beacon: AF-SE-02, AF-SC-02.
• goal hijack: AF-SE-05.
• memory poisoning: AF-SE-04.
• session contamination: AF-SE-05.
• MCP cross-tool abuse: AF-SE-02, AF-SE-09.
• architecture/secret disclosure: AF-SE-12.
• inter-agent spoofing: AF-SE-06.
• visual injection: AF-SE-03.
• rogue self-propagation: AF-SE-14.
• command interpolation RCE: AF-SE-07.
• human trust exploitation: AF-AU-07, AF-HT-05.
• incorrect tool selection: AF-PX-13.
• tool hallucination: AF-PX-03.
• malformed arguments: AF-PX-04.
• suboptimal arguments: AF-PX-14.
• tool feedback neglect: AF-PX-16.
• tool recovery failure: AF-LV-07, AF-LV-08.
• specification drift: AF-PX-11.
• output drift: AF-PX-15.
• memory-induced tool drift: AF-MM-12.
• wrong environment: AF-BI-01.
• memory following failure: AF-MM-02.
• missed memory read: AF-MM-01.
• memory staleness: AF-VR-05, AF-MM-04.
• overgeneralization: AF-MM-05.
• memory pollution: AF-MM-09.
• temporal memory contamination: AF-MM-13.
• context rot: AF-MM-11.
• retrieval/embedding drift: AF-MM-07.
• collective hallucination: AF-VR-15.
• context overflow: AF-EC-05, AF-LN-03.
• disobey task specification: AF-AU-01, AF-PL-07.
• disobey role specification: AF-AU-03, AF-AU-04.
• conversation reset: AF-RP-09, AF-LN-03.
• failure to clarify: AF-PL-11.
• withheld peer information: AF-PL-12.
• ignored peer input: AF-PL-12.
• reasoning/action mismatch: AF-PL-04.
• incorrect verifier assignment: AF-VR-02, AF-VR-15.
• delegation black hole: AF-LV-01, AF-LN-04.
• multi-agent cascade: AF-VR-15, AF-LV-09, AF-PH-04.
• timezone/DST: AF-TM-01, AF-TM-02.
• budget called success: AF-LV-11, AF-PL-07.
• rate-limit/domain confusion: AF-TX-11, AF-EN-10.
• cost runaway: AF-EC-01.
• context hoarding: AF-EC-05.
• serving cache overhead: AF-EC-07.
• approval fatigue: AF-HT-01.
• unstated expectation mismatch: AF-VR-03, AF-EV-04.
• contextual sycophancy: AF-HT-05.
• error swallowing: AF-OB-01.
• forensic blind spot: AF-OB-03.
• silent guardrail bypass: AF-VR-12, AF-SE-13.
• output corruption: AF-TX-10, AF-EN-09.
• platform quirk: AF-EN-02.
• design-assumption mismatch: AF-EN-04, AF-EV-11.
• unmonitored live consumers: AF-EN-11.
• stale harness event: AF-TM-05, AF-LV-04.
• unobservable tool with no outcome or idempotency primitive: Unmapped. Interface limitation, not automatically a failure. A truthful UNKNOWN and fenced conflicting retry may be the correct outcome. See the guarantee-boundary analysis.
• KV-cache identity splicing or cross-tenant contamination: Unmapped. Not established by the cited tool-progress paper. Actual cache isolation defects would map to PR-04/EN lifecycle boundaries, but no specific observed KV incident is claimed here.