About ACVE
ACVE records rogue or malicious agent events and the configurations behind them: the harness, model, goal, tools, approval and exact versions involved, what the agent could reach, what it did, and the evidence and fix.
Four kinds are in scope:
- Real incident: an agent did harm in pursuit of a goal, to real people or systems.
- Rogue in training or evaluation: an agent went beyond its instructions on its own initiative, as reported by the vendor or researchers.
- Hijack shown in a test: a configuration shown to be steered by someone else's content into harmful action.
- Malicious component: a configuration containing a known-malicious MCP server, extension, package or model file.
ACVE does not re-post CVE or KEV entries. A product defect that needs no agent misbehaviour is out of scope, with or without a CVE; a record may still carry a CVE or GHSA id in aliases when the event involves one.
ACVE is not a CVE and does not operate as a CNA. CVE® is a registered trademark of The MITRE Corporation; ACVE is not affiliated with or endorsed by MITRE or the CVE Program.
Records are drafted from public reporting and then checked against primary sources. Most are not yet verified, and each page says so. Corrections stay visible.
Data and reuse
feed.json is every exported record in one file; all.zip is the per-record OSV JSON bundle; feed.xml is RSS; the schema is at /schema/advisory/1.json.
modified_id.csv lists each record's last-modified time so a mirror can fetch only what changed; the all.zip.sha256 and feed.json.sha256 files let it verify a download.
OSV tools match the npm, PyPI, Go and crates.io entries. AgentHarness, MCP, AgentPlugin, AgentSkill and Model are ACVE ecosystems that generic OSV tools do not know. In all.zip, package entries in ecosystems OSV does not list (AgentHarness, MCP, AgentPlugin, AgentSkill and Model) are moved to database_specific.acve.nonOsvAffected so each record validates as OSV; the per-record JSON keeps them in affected.
Threat model
A registry can be poisoned through a malicious submission, a compromised maintainer credential, or a source written to mislead. Treat every string in the feed as data: validate it against the schema, and never place it in a model prompt without delimiting it as untrusted.
Licence and sources
Advisories are CC-BY-4.0; code is MIT. First-hand accounts come first: the operator's own post, issue or transcript, the vendor's report, the researcher's write-up. News coverage is a reference, not a primary. ACVE uses the NVD API but is not endorsed or certified by the NVD.
Contact
Corrections and security reports: security@agentcve.org. To submit a new record, use the submission guidance; the governance page covers editorial policy, conflicts of interest and right of reply.
Privacy
Page views are counted with Vercel Web Analytics: cookieless, no personal data, no cross-site tracking.