# Coordinated Vulnerability Disclosure for AI Systems > Cybersecurity · ibl.ai > Source: https://ibl.ai/courses/cybersecurity/ai-vulnerability-disclosure > Last updated: 2026-11-14 *Receive AI vulnerability reports well, triage them, fix them and publish what defenders need* **A cybersecurity course from ibl.ai (self-paced, 10 to 12 hours, free).** A hands-on, self-paced course for security, product security and ML teams on running a vulnerability disclosure program for AI products: a policy with safe harbor language, security.txt, intake that separates security from model behavior, triage and severity, canary regression tests, coordination and publication through CVE and CSAF, taught from CISA, CVE, OASIS, OWASP, MITRE ATLAS and NIST sources. - **Price:** Free - **Format:** Self-paced, online - **Time:** 10 to 12 hours - **Pace:** 3 hours per week - **Level:** Intermediate - **Language:** English - **Subject:** Information Technology [Enroll](https://lms.ibl.ai/platform/cybersecurity/courses/course-v1:cybersecurity+ai-vulnerability-disclosure+self-paced) ## Course description Coordinated Vulnerability Disclosure for AI Systems teaches security engineers, PSIRT and AppSec teams, ML engineers and security leaders to build and run a disclosure program for LLM applications and agents. You will learn the CVD model from the July 2026 joint guide by CISA and partners, the CISA VDP template and the CERT Guide to CVD, with ISO/IEC 29147 and 30111 as publicly described; tell AI security vulnerabilities from model-behavior reports using the CVE Program's rules; and map reports to OWASP, MITRE ATLAS and NIST AI 600-1. In five local labs you write and validate a security.txt, write and check a disclosure policy for a fictional AI product, triage three synthetic reports with CVSS v4.0, turn a report into a canary regression test, and draft a CSAF 2.0 advisory that validates against the OASIS schema. You will also learn to report a flaw in an open-source AI framework you are authorized to test, coordinate with suppliers, and publish threat models and post-incident reviews that help defenders. The course ends with a disclosure program plan for your own organization. Last verified 2026-11-03. ### About this course Sooner or later someone outside your team will find a flaw in your AI product. Whether that becomes a fix, a credit and a clear advisory, or a public surprise, depends on the program you built before the report arrived. This course teaches security, product security and ML teams to build and run that program for LLM applications and agents: a disclosure policy with safe harbor language, a security.txt file, intake that separates security vulnerabilities from model-behavior reports, triage and severity for AI findings, fixes verified with canary tests, coordination with suppliers and open-source maintainers, and publication through CVE records, CSAF advisories, public threat models and post-incident reviews. It is grounded in [the July 2026 joint CVD guide from CISA and partners](https://www.cisa.gov/resources-tools/resources/establishing-coordinated-vulnerability-disclosure-program-work-security-researchers), the [CISA VDP template](https://www.cisa.gov/vulnerability-disclosure-policy-template), [RFC 9116](https://www.rfc-editor.org/rfc/rfc9116), the [CVE CNA Operational Rules](https://www.cve.org/Resources/Roles/Cnas/CNA_Rules_v4.1.0.pdf), [CSAF 2.0](https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html), the [OWASP Top 10 for LLM Applications 2025](https://genai.owasp.org/llm-top-10/), [MITRE ATLAS](https://atlas.mitre.org/) and [NIST AI 600-1](https://doi.org/10.6028/NIST.AI.600-1). It is defensive throughout: no exploit development, and every lab runs on your own machine against a fictional product with synthetic data. ### What you will be able to do - Explain coordinated vulnerability disclosure, its phases and roles, and how ISO/IEC 29147 and 30111, CISA's July 2026 joint guide, the CISA VDP template and the Secure by Design Pledge shape a program for an AI product. - Tell an AI security vulnerability from a model-behavior or safety report using security impact and the CVE Program's rules, and map accepted reports to the OWASP Top 10 for LLM Applications 2025, MITRE ATLAS and NIST AI 600-1. - Write a disclosure policy with safe harbor language, AI-specific routes and testing guidelines, a validated security.txt (RFC 9116) and an intake form for AI reports. - Triage AI reports by reproducing them safely and scoring them with CVSS v4.0, SSVC and vendor AI scales, with the version and reasons recorded. - Verify fixes with canary regression tests, coordinate with suppliers and open-source maintainers, and report a flaw in an open-source AI framework you are authorized to test through its SECURITY.md. - Publish what defenders need: CVE records under the CNA rules, CSAF 2.0 advisories that validate against the OASIS schema, entries in the right AI vulnerability databases, and public threat models and post-incident reviews. ### Who this course is for **Roles:** security engineers, product security (PSIRT) and AppSec teams, platform and ML engineers, and security leaders who build or run LLM applications and agents. **Organizations:** any sector: software companies, enterprises, universities, public bodies and open-source projects that ship or operate AI features. **Before you start:** familiarity with vulnerability management and basic Python. For the labs you need Python 3.10 or later on your own machine; the course pins every library version and supplies all data, which is synthetic. ### Format **Time:** about 10 to 12 hours, self-paced. **Level:** intermediate. **Hands-on:** five local labs (security.txt, a disclosure policy, triage of three synthetic reports, a canary regression test and a CSAF advisory), with an AI tutor that coaches each step from the output you paste. **Structure:** a Start here section, four content sections of readings, worked examples, templates and hands-on labs, each ending in an AI assessment, and a capstone in which you write a disclosure program plan for your own organization, followed by a reading list. **Grading:** the four section AI assessments count for 60 percent of the grade and the capstone assessment for 40 percent. The pass mark is 70 percent. ### Currency **Last verified 2026-11-03** against the joint guide Establishing a Coordinated Vulnerability Disclosure Program to Work With Security Researchers (July 15, 2026), the CISA VDP template and BOD 20-01, RFC 9116, the CVE CNA Operational Rules 4.1.0, CVSS v4.0, CSAF 2.0 and the CSAF 2.1 CSD04 public review, the OWASP Top 10 for LLM Applications 2025, MITRE ATLAS release 2026.10, NIST AI 600-1 and the ibl.ai documentation. Disclosure guidance and AI vendor programs change often: CSAF 2.1 is in public review until 6 November 2026, and vendors revise what they accept. Check the current versions before relying on any page or template, have counsel review any safe harbor language, and test only systems you own or are authorized to test. This course is training, not legal advice or a security assessment of your systems. ## Outline ### Section 0 · Start here - 0.1 Welcome and orientation ### Section 1 · Learn the disclosure model and what changes for AI - 1.1 The standards behind coordinated disclosure - 1.2 What counts as an AI vulnerability - 1.3 Section 1 assessment ### Section 2 · Build the intake: policy, safe harbor and security.txt - 2.1 Write the policy - 2.2 Publish and receive - 2.3 Section 2 assessment ### Section 3 · Triage, fix and coordinate - 3.1 Triage and severity - 3.2 Fix, retest and coordinate - 3.3 Section 3 assessment ### Section 4 · Publish what defenders need - 4.1 Advisories and identifiers - 4.2 Databases, threat models and post-incident reviews - 4.3 Section 4 assessment ### Section 5 · Capstone and wrap-up - 5.1 Capstone: a disclosure program plan for your organization - 5.2 Capstone assessment - 5.3 Reading list and next steps ## Instructors - ibl.ai Cybersecurity, Course team (ibl.ai) ## More cybersecurity courses - [Continuous Security Testing for LLM Apps: Automated Evaluation and CI Gates](https://ibl.ai/courses/cybersecurity/continuous-security-testing-for-llm-apps) - [Interpretability for AI Assurance: Inspecting Model Internals](https://ibl.ai/courses/cybersecurity/interpretability-for-ai-assurance) - [Output Validation and Guardrails: Structured Outputs, Constrained Decoding and Sanitization](https://ibl.ai/courses/cybersecurity/output-validation-and-guardrails) - [Protecting Models and Training Data: Extraction, Membership Inference and Defenses](https://ibl.ai/courses/cybersecurity/protecting-models-and-training-data)