# Codebook for the open question on AI security risks

Every answer to the open question received one primary code from this list. The question asked: what AI security risk is most on your mind right now? The authors used the codes to test whether the eight asset classes capture what practitioners worry about. Codes follow the class definitions below rather than example lists.

## Codes

| Code | Meaning (keyed to the published row definitions) |
|------|--------|
| `workload-platforms` | AI-Workload Platforms: the compute and serving infrastructure models run on (inference servers, vector databases) |
| `orchestration-tools` | AI Orchestration Tools: the application layer connecting models to tools and data (agent frameworks, agent harnesses, MCP clients) |
| `generated-code` | AI-Generated Code: code produced by AI assistants and coding agents |
| `gateways-routers` | AI Gateways and Routers: the network path to AI services (LLM routers, MCP gateways) |
| `ai-model` | AI Model: the model itself, self-hosted or consumed as a service, including its weights |
| `training-data` | Training Data: datasets used to train or fine-tune models |
| `runtime-data` | Runtime AI Data: prompts, responses, RAG content, and agent memory flowing through AI at runtime |
| `agent-identities` | AI Agent Identities: AI agents and other non-human identities, and the credentials they act with |
| `straddle` | The concern is asset-framed and spans two or more rows with no single primary. |
| `outside-asset` | The concern names or implies an AI asset that fits NO row: a missing-row candidate |
| `outside-scope` | The concern is not about an asset at all (process, staffing, budget, regulation, awareness, attacker capabilities, abstract risk) |
| `uncodeable` | Noise, test strings, or answers too vague to interpret ("Yes", "All", single letters) |

The authors of the AI Defense Matrix renamed two asset classes after this survey ran. AI Gateways and Routers is now AI Traffic. AI Orchestration Tools is now AI Coding and Orchestration Tools, with a different scope. This codebook keeps the names used to classify the answers.

## Counting rules

- Coded to one row → counts toward coverage.
- `straddle` → counts toward coverage, reported separately as boundary evidence.
- `outside-asset` → counts against coverage (missing-row candidate).
- `outside-scope` → excluded from the coverage calculation, reported as outside the taxonomy's scope by design.
- Coverage = (single-row + straddle) / (single-row + straddle + outside-asset).

## Decision rules

1. Code the ASSET the concern is about, not the threat vector. "Prompt injection" is a concern about what flows through AI at runtime → `runtime-data`. "Model poisoning" → `training-data` if about poisoning the training pipeline, `ai-model` if about tampering with the model artifact itself.
2. Data leaking THROUGH AI use (employees pasting secrets into chatbots, copilot exposure of internal data, sensitive data in prompts or RAG) → `runtime-data`. Generic "data breach" with no AI-asset anchor → `outside-scope`.
3. Agent concerns: access, credentials, permissions, authority, or identity of agents and other non-human actors → `agent-identities`. Agent frameworks/tooling/MCP plumbing → `orchestration-tools`. "Agentic AI risk" with no sharper anchor → `agent-identities` if about what agents may do with access, `straddle` if genuinely both.
4. Shadow AI and unsanctioned tool use → `outside-scope` (usage governance), unless the answer anchors to a specific asset ("employees pasting data into unapproved chatbots" → `runtime-data`).
5. Hallucination, accuracy, overreliance on outputs → `outside-scope` (output-quality risk, not an asset to secure), unless anchored to an asset ("AI-generated code with vulnerabilities shipping to prod" → `generated-code`).
6. Supply-chain concerns about model provenance (malicious models from public hubs) → `ai-model`. Supply-chain concerns about AI features embedded in purchased software → `outside-asset` (candidate: embedded third-party AI is arguably no single row).
7. Speed of adoption, keeping up, skills, budget, compliance, regulation → `outside-scope`.
8. When two rules fire, prefer the more specific asset anchor. When no reading yields an asset, `outside-scope` beats a forced fit: forcing fits flatters the taxonomy.