Severity guide
What critical, high, medium, low and info mean in practice, and exactly what raises or lowers a report's 0–100 score.
Every finding gets a score from 0 to 100 and a severity level. The score is arithmetic, not a judgement call and not something the model picks — here's the whole of it.
The five levels
| Level | Score | What it means |
|---|---|---|
| Critical | 80–100 | Actively dangerous — do not point an AI agent at this. |
| High | 60–79 | Likely to hijack an AI assistant. |
| Medium | 40–59 | Suspicious content that could mislead an AI. |
| Low | 20–39 | Minor or ambiguous signals. |
| Info | 0–19 | Nothing harmful found — noted for context. |
The level is the band the score lands in. Nothing else moves it.
Where the score comes from
Start with the technique — what the content actually does. Overwriting an agent's configuration starts higher than a vague "ignore your instructions" line, because it's more likely to work and harder to notice.
Then multiply by four things:
Intent — what it's trying to achieve. Getting code run or a backdoor installed weighs most. Stealing data or credentials is close behind. Nudging an assistant's wording weighs least, and reconnaissance actually lowers the score.
Where it lives. The same sentence is more dangerous in a file an agent reads automatically — an agent config, a tool manifest, an install script — than in a source comment a human would scroll past. A README sits in between.
Whether it's still public. Content anyone can still reach scores higher than content that has been taken down. We re-check, and a report shows which state it's in.
How many people will meet it. A popular repository puts the same payload in front of far more agents than an obscure one, so stars and forks nudge the score up. Popularity never creates a finding — it only scales one that already exists.
Confidence gates the whole thing. If the analysis isn't confident about what it's looking at, the finding is kept but held at the lowest level. We'd rather under-call something than put a number on a guess.
What raises a score
- The content targets an AI agent's configuration, tools, or startup files.
- It asks for code to be executed, or for secrets and files to be sent somewhere.
- It hides itself — invisible characters, encoded blobs, text styled out of sight.
- It's still live, and lots of people use the project.
What lowers a score
- It's a demonstration, a test fixture, or clearly-labelled research.
- It sits somewhere a human reads and an agent doesn't.
- It's been taken down since we found it.
- The analysis wasn't confident, or a reviewer decided the case was weaker than it first looked.
A report's own verdict
A report covers one target, which can hold several findings. The report's verdict is its most serious finding — one critical finding makes the report critical, no matter how many quiet ones sit beside it.
Scores can be wrong
A score is a model of risk, not a measurement of one. Something harmless can look hostile, and a careful payload can score low. Read the evidence, not just the number, and if we got it wrong, tell us.