{"@ID": "1448", "@Name": "Weaknesses Related to AI/ML Products", "@Type": "Graph", "@Status": "Incomplete", "Objective": "CWE entries in this view (graph) are unique to AI/ML products, or are commonly encountered in products that use or support AI/ML.", "Audience": {"Stakeholder": [{"Type": "Software Developers", "Description": "This view outlines the most important issues for developers who are using or adopting AI/ML."}, {"Type": "Product Customers", "Description": "This view outlines the most important issues that provide product customers with a way of asking their software development teams to follow minimum expectations for secure code."}, {"Type": "Educators", "Description": "Since AI/ML is a growing influence within industry, this view could provide educators and students with a focused set of weaknesses to learn about first."}, {"Type": "Academic Researchers", "Description": "Academic researchers could consult the \"Research Gaps\" notes to consider potential research opportunities for weakness-focused research."}]}, "Members": {"Has_Member": [{"@CWE_ID": "1446", "@View_ID": "1448"}, {"@CWE_ID": "1447", "@View_ID": "1448"}]}, "References": {"Reference": [{"@External_Reference_ID": "REF-1522"}, {"@External_Reference_ID": "REF-1523"}, {"@External_Reference_ID": "REF-1525"}]}, "Mapping_Notes": {"Usage": "Prohibited", "Rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "Comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "Reasons": {"Reason": {"@Type": "View"}}}, "Notes": {"Note": [{"@Type": "Maintenance", "#text": "This view is likely to be updated frequently in future versions. See Research Gaps."}, {"@Type": "Research Gap", "#text": "As of CWE 4.20, it is still difficult to distinguish common AI/ML related attacks from the underlying weaknesses. The CWE AI Working Group has had many discussions about this general topic. Much of the latest research has focused on the attacks, and/or characterizing the underlying design and implementation of AI/ML related systems. From a CWE perspective, the distinction between \"control\" and \"data\" is not necessarily as deep as currently considered within the AI/ML community, since most weaknesses are characterized in terms of potentially insecure \"behavior\" - whether that behavior occurred due to design, insecure code, insecure configuration, or data-driven behaviors such as AI/ML. Since AI/ML is frequently derived from repositories of software that consume AI/ML components - many public reports of AI/ML vulnerabilities ultimately result from commonly-occurring weaknesses that appear in most kinds of software. There are several weakness-focused research efforts within the industry, but these efforts are still in the early stages."}]}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2026-04-27", "Submission_Version": "4.20", "Submission_ReleaseDate": "2026-04-30"}}, "entry_type": "View"}