{
  "schema": "ai-03-source-inventory-v1",
  "accessed": "2026-07-22",
  "sources": [
    {
      "id": "SRC-NIST-GLOSSARY",
      "name": "NIST indirect prompt injection glossary",
      "url": "https://csrc.nist.gov/glossary/term/indirect_prompt_injection",
      "needles": ["resource control", "NIST AI 100-2e2025"]
    },
    {
      "id": "SRC-NIST-HIJACKING",
      "name": "NIST agent hijacking evaluation",
      "url": "https://www.nist.gov/news-events/news/2025/01/technical-blog-strengthening-ai-agent-hijacking-evaluations",
      "needles": ["trusted internal instructions", "untrusted external data"]
    },
    {
      "id": "SRC-OWASP-CODING",
      "name": "OWASP secure coding with AI",
      "url": "https://cheatsheetseries.owasp.org/cheatsheets/Secure_Coding_with_AI_Cheat_Sheet.html",
      "needles": ["Treat all repository content", "Error traces and log output", "Fetched web pages"]
    },
    {
      "id": "SRC-OWASP-INJECTION",
      "name": "OWASP LLM prompt injection prevention",
      "url": "https://cheatsheetseries.owasp.org/cheatsheets/LLM_Prompt_Injection_Prevention_Cheat_Sheet.html",
      "needles": ["Remote/Indirect Prompt Injection", "principle of least privilege", "Pattern-based filters do not reliably catch indirect injection"]
    },
    {
      "id": "SRC-OPENAI-SAFETY",
      "name": "OpenAI safety in building agents",
      "url": "https://developers.openai.com/api/docs/guides/agent-builder-safety",
      "needles": ["untrusted data never directly drives agent behavior", "Use structured outputs to constrain data flow", "Keep tool approvals on"]
    }
  ]
}