References
On this page
Every source the manual cites, grouped by use. Where a standard is paywalled, the link is its catalogue page.
Standards and guidance#
| Source | Cited for |
|---|---|
| Office of the Director of National Intelligence, Intelligence Community Directive 203: Analytic Standards, signed 2 January 2015, as amended. https://archive.dni.gov/files/documents/ICD/ICD-203.pdf | The likelihood table, the rule against combining confidence and likelihood in one sentence, and separating information from judgment (chapter 8, FM-7.6, FM-9.12). |
| S. Bradner, Key words for use in RFCs to Indicate Requirement Levels, RFC 2119, 1997. https://www.rfc-editor.org/rfc/rfc2119 | Requirement words (index). |
| B. Leiba, Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words, RFC 8174, 2017. https://www.rfc-editor.org/rfc/rfc8174 | Requirement words. |
| K. Davis, B. Peabody, P. Leach, Universally Unique IDentifiers (UUIDs), RFC 9562, 2024. https://www.rfc-editor.org/rfc/rfc9562 | UUID versions, node ids and the multicast bit (FM-5.23). |
| Regulation (EU) 2024/1689 (the AI Act), Article 73, Reporting of serious incidents. https://eur-lex.europa.eu/eli/reg/2024/1689/oj | Providers' reporting deadlines (FM-12.5). |
Disclosure#
| Source | Cited for |
|---|---|
| ISO/IEC 29147:2018, Information technology - Security techniques - Vulnerability disclosure. https://www.iso.org/standard/72311.html | FM-10.3. |
| ISO/IEC 30111:2019, Information technology - Security techniques - Vulnerability handling processes. https://www.iso.org/standard/69725.html | FM-10.3. |
| ISO/IEC TR 5895:2022, Cybersecurity - Multi-party coordinated vulnerability disclosure and handling. https://www.iso.org/standard/81807.html | FM-10.3. |
| FIRST, Guidelines and Practices for Multi-Party Vulnerability Coordination and Disclosure, version 1.1, 2020. https://www.first.org/global/sigs/vulnerability-coordination/multiparty/guidelines-v1.1 | Embargo defaults and the active-exploitation exception (FM-10.3). |
| Coalition for Secure AI (CoSAI), AI Incident Response Framework, version 1.0, October 2025. https://www.coalitionforsecureai.org/defending-ai-systems-a-new-framework-for-incident-response-in-the-age-of-intelligent-technology/ | Incident response for defenders of AI systems (FM-16.5). |
| FIRST, member team directory. https://www.first.org/members/teams/ | Finding a national CSIRT (FM-10.1). |
| E. Foudil, Y. Shafranovich, A File Format to Aid in Security Vulnerability Disclosure, RFC 9116, 2022. https://www.rfc-editor.org/rfc/rfc9116 | security.txt contacts (FM-10.4). |
Threat frameworks#
| Source | Cited for |
|---|---|
| MITRE, ATLAS: Adversarial Threat Landscape for AI Systems, data version 2026.09. https://atlas.mitre.org/; data: https://github.com/mitre-atlas/atlas-data | ATLAS technique ids and names (FM-4.6); agent communication and orchestration (FM-1.3); agent techniques in the crosswalk (FM-12.4). |
| OWASP GenAI Security Project, OWASP Top 10 for Agentic Applications for 2026, December 2025. https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/ | ASI01 to ASI10 in the crosswalk (FM-12.4). |
| MITRE, ATT&CK Enterprise. https://attack.mitre.org/ | ATT&CK technique ids and names (FM-4.6). |
Attribution practice#
| Source | Cited for |
|---|---|
| K. Vanderlee, DebUNCing Attribution: How Mandiant Tracks Uncategorized Threat Actors, Mandiant, 17 December 2020. https://cloud.google.com/blog/topics/threat-intelligence/how-mandiant-tracks-uncategorized-threat-actors | Clusters that grow, merge and split before they are named (FM-5.8, FM-5.13). |
| R. J. Heuer Jr., Psychology of Intelligence Analysis, CIA Center for the Study of Intelligence, 1999, chapter 8, "Analysis of Competing Hypotheses". https://www.cia.gov/resources/csi/static/Pyschology-of-Intelligence-Analysis.pdf | The competing-hypotheses worksheets (FM-7.12). |
| S. Caltagirone, A. Pendergast, C. Betz, The Diamond Model of Intrusion Analysis, technical report, 2013. https://apps.dtic.mil/sti/pdfs/ADA586960.pdf | Adversary, capability, infrastructure and victim against the attribution layers (FM-16.3). |
Incident reports#
| Source | Cited for |
|---|---|
| J. Cable et al., Early rogue AI agent activity and attempts to hack found on urlquery.net, Transluce, 23 September 2026, and its labelled data release. https://transluce.org/agent-activity | Tier names (FM-1.5); the held-out labels (FM-9.3); a case study (FM-13.4); its grades, attribution wording and disclosure (FM-16.1). |
| J. Cable et al., AI Agents Targeted U.S. and Canadian Government Websites, Transluce, 30 September 2026. https://transluce.org/us-canada-gov | Request patterns reconstructed in the regression set (FM-9.2); a case study (FM-13.5); its sources and triage (FM-16.1). |
| A. I. Perez, E. Elasky, R. Howard-Jones et al. (the Swarmchasers), We found a Chinese agent fleet, swarmcha.se, preliminary report dated 4 October 2026, with its dated changelog. https://swarmcha.se/posts/chinese-agent-fleet | The fleet and swarm distinction (FM-1.3); a withdrawn model-family exclusion (FM-7.5); a case study (FM-13.6); a finding of no coordination (FM-16.1). |
| R. Howard-Jones, OpenAI agents tried to bruteforce a UN website's API fields, swarmcha.se, 26 September 2026. https://swarmcha.se/posts/openai-unctad | Proxy use of a scan service, relays, echo-service answers, double encoding and attribution by shared addresses (FM-16.1). |
| OpenAI, Disrupting malicious uses of AI, threat report series. https://openai.com/index/disrupting-malicious-ai-uses | Provider threat reports (FM-16.2). |
| Anthropic, Disrupting the first reported AI-orchestrated cyber espionage campaign, 13 November 2025. https://www.anthropic.com/news/disrupting-AI-espionage | Provider threat reports (FM-16.2). |
Agent identity#
| Source | Cited for |
|---|---|
| T. Meunier, S. Major, HTTP Message Signatures for automated traffic, Internet-Draft draft-ietf-webbotauth-httpsig-protocol, IETF Web Bot Auth working group, work in progress. https://datatracker.ietf.org/doc/draft-ietf-webbotauth-httpsig-protocol/ | Signed agent requests and the Signature-Agent header (FM-7.11). |
| Registry and Signature Agent card for Web bot auth, Internet-Draft draft-meunier-webbotauth-registry, work in progress. https://datatracker.ietf.org/doc/draft-meunier-webbotauth-registry/ | Signature agent cards (FM-7.11). |
| A. Backman, J. Richer, M. Sporny, HTTP Message Signatures, RFC 9421, February 2024. https://www.rfc-editor.org/rfc/rfc9421 | Signature base, components and the Ed25519 test vectors (FM-7.11). |
| T. Meunier, S. Major, HTTP Message Signatures for Bots, Internet-Draft draft-meunier-web-bot-auth-architecture-05, March 2026. https://datatracker.ietf.org/doc/draft-meunier-web-bot-auth-architecture/ | The Web Bot Auth profile and its test vectors (FM-7.11). |
| OpenAI, Overview of OpenAI Crawlers. https://developers.openai.com/api/docs/bots | Declared products and their range files (FM-7.13). |
| Anthropic, Does Anthropic crawl data from the web, and how can site owners block the crawler? https://privacy.claude.com/en/articles/8896518-does-anthropic-crawl-data-from-the-web-and-how-can-site-owners-block-the-crawler | Declared products and their address list (FM-7.13). |
| Perplexity, Perplexity Crawlers. https://docs.perplexity.ai/guides/bots | Declared products and their range files (FM-7.13). |
| Google, Google's user-triggered fetchers and Web Bot Auth. https://developers.google.com/crawling/docs/crawlers-fetchers/google-user-triggered-fetchers | Google-Agent, its range file and its signing (FM-7.13). |
| NIST, Announcing the "AI Agent Standards Initiative" for Interoperable and Secure Innovation, 17 February 2026. https://www.nist.gov/news-events/news/2026/02/announcing-ai-agent-standards-initiative-interoperable-and-secure | Standards work on agent security and identity (FM-16.5). |
Coordination research#
| Source | Cited for |
|---|---|
| A. Romero Vicente, Coordinated Inauthentic Behaviour detection tree, EU DisinfoLab, 8 August 2024. https://www.disinfo.eu/publications/coordinated-inauthentic-behaviour-detection-tree/ | Separate coordination, source, impact and authenticity assessments (FM-16.3). |
| E. T. Brooking, A. Kann, M. Rizzuto et al., Dichotomies of Disinformation: Project Overview and Codebook, DFRLab and Jigsaw. https://github.com/DFRLab/Dichotomies-of-Disinformation | Attribution and intent coded apart (FM-16.3). |
| K. Mukherjee, C. G. Akcora, M. Kantarcioglu, "MoltGraph: A Longitudinal Temporal Graph Dataset of Moltbook for Coordinated-Agent Detection", arXiv:2603.00646, 2026. https://arxiv.org/abs/2603.00646 | Short coordination bursts (FM-16.4). |
| W. Lugoloobi, S. Marro, J. Magomere, J. Wright, C. Russell, "Known By Their Actions: Fingerprinting LLM Browser Agents via UI Traces", arXiv:2605.14786, 2026. https://arxiv.org/abs/2605.14786 | Model fingerprints from interaction traces (FM-16.4). |
Statistics#
| Source | Cited for |
|---|---|
| E. B. Wilson, "Probable inference, the law of succession, and statistical inference", Journal of the American Statistical Association 22(158), 1927, 209–212. https://doi.org/10.1080/01621459.1927.10502953 | Wilson score intervals (FM-9.5). |
| A. Bagga, B. Baldwin, "Algorithms for scoring coreference chains", LREC Workshop on Linguistic Coreference, 1998. | B-cubed precision and recall (FM-9.6). |
| E. Amigó, J. Gonzalo, J. Artiles, F. Verdejo, "A comparison of extrinsic clustering evaluation metrics based on formal constraints", Information Retrieval 12(4), 2009, 461–486. https://doi.org/10.1007/s10791-008-9066-8 | Why B-cubed suits cluster evaluation (FM-9.6). |
| J. Cohen, "A coefficient of agreement for nominal scales", Educational and Psychological Measurement 20(1), 1960, 37–46. https://doi.org/10.1177/001316446002000104 | Cohen's κ (FM-9.8). |
| J. L. Fleiss, "Measuring nominal scale agreement among many raters", Psychological Bulletin 76(5), 1971, 378–382. https://doi.org/10.1037/h0031619 | Fleiss' κ (FM-9.8). |
| A. Gionis, H. Mannila, T. Mielikäinen, P. Tsaparas, "Assessing data mining results via swap randomization", ACM Transactions on Knowledge Discovery from Data 1(3), 2007, article 14. https://doi.org/10.1145/1297332.1297338 | Swap randomisation with margins kept (FM-5.22). |
| J. Besag, P. Clifford, "Generalized Monte Carlo significance tests", Biometrika 76(4), 1989, 633–642. https://doi.org/10.1093/biomet/76.4.633 | Exact Monte Carlo chances from a Markov chain (FM-5.22). |
| J. A. Hanley, A. Lippman-Hand, "If nothing goes wrong, is everything all right? Interpreting zero numerators", JAMA 249(13), 1983, 1743–1745. https://doi.org/10.1001/jama.1983.03330370053031 | The rule of three for a zero count (FM-9.5). |
Interoperability#
| Source | Cited for |
|---|---|
| OASIS, STIX Version 2.1, OASIS Standard, 10 June 2021. https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html | The export profile; extension definitions (section 7.3) and custom object naming (chapter 12). |
| Responsible AI Collaborative, AI Incident Database and its editors' guide. https://incidentdatabase.ai/editors-guide/ | Report and incident fields (FM-12.3). |
| OECD, Towards a common reporting framework for AI incidents, OECD Artificial Intelligence Papers, 2025. https://www.oecd.org/en/publications/towards-a-common-reporting-framework-for-ai-incidents_f326d4ac-en.html | The 29-criterion common reporting framework and its dimensions (FM-12.3, FM-12.4). |
| OECD.AI, AI Incidents and Hazards Monitor, methodology. https://oecd.ai/en/incidents-methodology | AIM's definitions and planned submission process (FM-12.3). |
| AI Vulnerability Database (AVID), framework documentation. https://docs.avidml.org/database/framework/base-classes | Report types and taxonomy (FM-12.3). |
Every section by id, with search
Source: docs/manual/references.md