OWASP AIVSS (AI Vulnerability Scoring System) scores security vulnerabilities in agentic AI systems. It extends CVSS v4.0 with 10 factors that measure how agent autonomy, tool use, and persistence amplify the blast radius of technical vulnerabilities.
Version 0.8 was released March 19, 2026. The review board includes Jason Clinton (Deputy CISO, Anthropic), Rob Joyce (ex-NSA, advisor to OpenAI), and Martin Stanley (NIST AI RMF lead). RSAC 2026 presentation: March 23.
Published documentation and Assess scope
The published documentation mapping for OWASP Agentic Top 10 at v3.7.1 points to this page as AIVSS coverage for all 10 Agentic AI Core Security Risks. That cross-reference does not supply an AIVSS control matrix or a calculated score reduction. The OWASP Agentic AI Threats and Mitigations documentation mapping rates T1-T15, a separate taxonomy. Neither is an AIVSS mapping in the Assess report.
Use the documented LLM Top 10 and Agentic AI Threats ratings as product evidence within their stated limits. A deployment-specific AIVSS score needs separate validation; this page makes no Pipelock score-reduction claim.
The Mitigation Factor
AIVSS includes a Mitigation Factor in its scoring formula. Pipelock Assess v3.7.1 does not include an AIVSS mapping or calculate an AIVSS score reduction.
| Mitigation Strength | Factor | What It Means |
|---|---|---|
| No/Weak Mitigation | 1.00 | Mitigations absent or ineffective |
| Partial Mitigation | 0.83 | Some mitigations exist but incomplete or unvalidated |
| Strong Mitigation | 0.67 | Effective mitigations in place, validated, consistently enforceable (fail-closed where applicable) |
Use the shipped OWASP MCP and Agentic Top 10 mappings for Pipelock control evidence. A deployment-specific AIVSS assessment requires separate validation.
AIVSS Scoring Formula
The full AIVSS v0.8 formula:
Risk_Gap = 10 - CVSS_Base
AARS = Risk_Gap * (Factor_Sum / 10) * Threat_Multiplier
AIVSS = (CVSS_Base + AARS) * Mitigation_Factor
Where AARS (Agentic AI Risk Score) is the uplift from agentic capabilities, Factor_Sum is the sum of all 10 amplification factors (0.0-10.0), and Threat_Multiplier defaults to 0.97.
References
Assess v3.7.1 framework catalog: the shipped framework list.