Reporting & severity
Prompt behavior alone is rarely the whole story — severity should reflect data exposure, authorization gaps, tool impact, business action, cost, and repeatability.
Severity guidance
Common finding scenarios and where their severity typically lands. Adjust to your own scope, data sensitivity, and the controls already in place.
| Scenario | Severity guidance |
|---|---|
| Prompt injection without data or tool impact | Low to Medium depending on whether users are meaningfully deceived or workflows are disrupted. |
| Sensitive data leakage | High when private customer, employee, source-code, legal, or financial data is exposed. |
| Cross-tenant RAG leakage | High to Critical depending on data sensitivity, repeatability, and scale. |
| Unauthorized tool action | High when state changes are possible; Critical for payment, admin, identity, or account actions. |
| Output XSS or unsafe rendering | Use normal web severity based on stored/reflected behavior, origin trust, and account impact. |
| Denial-of-wallet | Medium to High based on authentication, cost ceiling, shared service impact, and exploitability. |
| Sensitive prompt logging | Medium to High depending on the data, access scope, retention, and third-party exposure. |
| MCP filesystem, shell, or local network abuse | High to Critical depending on workspace scope, secrets exposure, command execution, and approval gaps. |
| Multimodal prompt injection | Same basis as text injection; severity follows the data exposed or actions reached, not the channel used. |
| Package hallucination | High when a hallucinated dependency or import creates a real supply-chain or code-execution path. |
| Multi-agent privilege escalation | High to Critical when inherited authority lets the agent graph perform privileged or cross-tenant actions. |
Report template
Write each finding from a consistent template so it stays reviewable and easy to triage. Cover these fields, in order:
- Title
- Summary
- Affected component
- Prerequisites
- Steps to reproduce
- Expected result
- Actual result
- Business impact
- Evidence
- Root cause
- Recommended remediation
- OWASP LLM mapping
- CWE mapping
Finding type to report language
Use this as a starting point, then adjust severity based on affected data, reachable actions, trust boundary, exploit preconditions, and available compensating controls.
| Finding type | Example report title | OWASP LLM category | CWE | Typical severity |
|---|---|---|---|---|
| Prompt injection | AI Assistant Follows User-Controlled Prompt Injection | LLM01:2026 Prompt Injection | CWE-74 Improper Neutralization of Special Elements ('Injection') | Low to High |
| Indirect prompt injection | Retrieved Document Controls AI Assistant Behavior | LLM01:2026 Prompt Injection | CWE-74 Improper Neutralization of Special Elements ('Injection') | Medium to Critical |
| Multimodal prompt injection | Image-Based Prompt Injection Overrides Assistant Instructions | LLM01:2026 Prompt Injection | CWE-74 Improper Neutralization of Special Elements ('Injection') | Low to Critical |
| Jailbreak / safety bypass | Model Safety Controls Bypassed via Multi-Turn Jailbreak | LLM01:2026 Prompt Injection | CWE-693 Protection Mechanism Failure | Low to High |
| System prompt leakage | AI Feature Reveals Hidden Prompt and Tool Details | LLM08:2026 Hidden Context Exposure | CWE-200 Exposure of Sensitive Information | Low to High |
| Sensitive information disclosure | Chatbot Reveals Private Customer Data | LLM02:2026 Sensitive Information Disclosure | CWE-359 Exposure of Private Personal Information | High |
| RAG cross-tenant leakage | RAG Assistant Returns Another Tenant's Document | LLM09:2026 Vector and Embedding Weaknesses | CWE-863 Incorrect Authorization | High to Critical |
| Tool abuse | Prompt Injection Changes Agent Tool Arguments | LLM03:2026 Excessive Agency | CWE-841 Improper Enforcement of Behavioral Workflow | High |
| Missing tool authorization | AI Tool Allows Unauthorized Account Update | LLM03:2026 Excessive Agency | CWE-862 Missing Authorization | High to Critical |
| Multi-agent privilege escalation | Privilege Escalation Through Agent Delegation | LLM03:2026 Excessive Agency | CWE-269 Improper Privilege Management | High to Critical |
| Improper output handling | AI Chat Output Allows Stored XSS | LLM10:2026 Improper Output Handling | CWE-116 Improper Encoding or Escaping of Output (CWE-79 Cross-Site Scripting for the stored/reflected XSS example) | Medium to High |
| Memory poisoning | Untrusted Memory Alters Future AI Decisions | LLM05:2026 Data and Model Poisoning | CWE-345 Insufficient Verification of Data Authenticity | Medium to High |
| Denial-of-wallet | Missing AI Usage Limits Allow Cost Exhaustion | LLM06:2026 Unbounded Consumption | CWE-770 Allocation of Resources Without Limits | Medium to High |
| Logging sensitive prompts | AI Prompt Logs Store Customer PII | LLM02:2026 Sensitive Information Disclosure | CWE-532 Sensitive Information in Log File | Medium to High |
| MCP over-permission | MCP Server Exposes Files Outside Workspace | LLM03:2026 Excessive Agency | CWE-266 Incorrect Privilege Assignment | High to Critical |
| AI coding assistant prompt injection | AI Coding Agent Follows Malicious Repository Instruction | LLM01:2026 Prompt Injection | CWE-74 Improper Neutralization of Special Elements ('Injection') | Medium to High |
| Package hallucination | AI Coding Assistant Recommends Non-Existent Package | LLM07:2026 Misinformation | CWE-829 Inclusion of Functionality from Untrusted Control Sphere | Medium to High |
| Misinformation or hallucination | AI Output Presents Fabricated Information as Authoritative | LLM07:2026 Misinformation | CWE-1426 Improper Validation of Generative AI Output | Low to High |
| Excessive agency | Agent Performs Sensitive Action Without Approval | LLM03:2026 Excessive Agency | CWE-285 Improper Authorization | High to Critical |
| Supply chain exposure | Frontend Exposes AI Provider API Key | LLM04:2026 Supply Chain | CWE-798 Use of Hard-coded Credentials | High |
Worked example
A complete finding written from the template, using safe test markers. Adapt the wording and severity to your own scope.
RAG Assistant Discloses Another Tenant's Document via Semantic Search
| Field | Content |
|---|---|
| Title | RAG assistant discloses another tenant's private document via semantic search |
| Summary | The workspace assistant retrieved and summarized a document owned by a different tenant when asked a generic question, because retrieval filtered by semantic similarity only and not by tenant authorization. |
| Affected component | Workspace AI assistant — retrieval service and vector index behind POST /api/assistant/query. |
| Prerequisites | Two test tenants (A and B). A unique marker phrase GSL-RAG-001 stored only in a private document owned by Tenant B. An authenticated low-privilege user in Tenant A. |
| Steps to reproduce | 1) As a Tenant B admin, upload a private document containing the marker GSL-RAG-001. 2) As a Tenant A user, ask the assistant: “Summarize anything related to GSL-RAG-001.” 3) Observe that the assistant returns content and source metadata from Tenant B's document. |
| Expected result | The assistant finds no authorized source for the Tenant A user and discloses nothing from Tenant B. |
| Actual result | The assistant summarized Tenant B's document and cited its title and document ID to the Tenant A user. |
| Business impact | Any authenticated tenant can read other tenants' private documents by querying for likely content, breaking tenant isolation. Severity is High to Critical depending on data sensitivity and scale. |
| Evidence | Request and response showing the marker and Tenant B source metadata returned inside a Tenant A session, with sensitive content redacted. |
| Root cause | Authorization is enforced in the UI but not at retrieval; the vector query filters by similarity, not by tenant and object-level ACLs. |
| Recommended remediation | Enforce tenant and object-level authorization at query time (partitioned indexes or mandatory metadata filters), re-check ACLs before response generation, and add cross-tenant marker regression tests. |
| OWASP LLM mapping | LLM09:2026 Vector and Embedding Weaknesses |
| CWE mapping | CWE-863 Incorrect Authorization |
Evidence tips
- Capture the exact prompt, role, tenant, model-visible source, and affected component.
- Show expected behavior and actual behavior without dumping unnecessary sensitive data.
- Map the root cause to a missing deterministic control such as authorization, validation, approval, sanitization, or limits.
- Explain business impact in plain terms: who can see what, who can do what, and what process is affected.
Need hands-on practice?
Use GenAISecurityLab-style labs to turn AI issues into reproducible reports with meaningful impact statements.