The software security community has relied on the Common Vulnerabilities and Exposures (CVE) standard for decades. CVE was designed for a world of deterministic software—where vulnerabilities are discrete, reproducible bugs in code that can be patched. In that model, a fix is clear: update a binary, patch a library, increment a version.

Agentic AI systems break this model entirely.

Why CVE Fails for AI

An LLM agent's attack surface isn't a memory corruption bug—it's a behavioral space. The same model, with the same weights, may respond safely to one prompt and dangerously to a subtle variation. This isn't a code defect. It's a property of the reasoning layer's probability distribution, shaped by training data, RLHF fine-tuning, and contextual state.

CVE requires a discrete, reproducible vulnerability tied to a specific software version. AI vulnerabilities are often:

• ›Non-deterministic — The same input may trigger the vulnerability only probabilistically.
• ›Context-dependent — An exploit may require specific conversation history or tool-call state to activate.
• ›Patch-resistant — Patching an LLM means retraining, fine-tuning, or adding guardrails—not incrementing a version number.
• ›Behavior-embedded — The “bug” is a learned pattern, not a code path.

Introducing the AVE Standard

The Agentic Vulnerability Exposure (AVE) standard is ZTAI.AI's proposed taxonomy for classifying, scoring, and tracking security exposures in AI systems. AVE operates alongside CVE—it does not replace it. Where CVE handles infrastructure and dependency vulnerabilities (a patched MCP server, a vulnerable API library), AVE handles behavioral and reasoning-layer risks.

An AVE entry describes a repeatable attack pattern against an AI agent's reasoning, orchestration, or execution layer—documented in natural language, with reproducibility measured by probability distribution rather than deterministic reproduction.

AVE Classification Dimensions

Each AVE entry is classified across five dimensions:

• ›Layer — Reasoning (L1), Orchestration (L2), or Execution (L3)
• ›Vector — Direct prompt, indirect RAG, tool output, memory state, or API response
• ›Trigger Probability — Measured across 1,000 standardized probe attempts (p-value reported)
• ›Blast Radius — Contained (single interaction), Persistent (session state), or Cascading (multi-agent)
• ›Remediation Class — Guardrail, Fine-tuning, Architecture, or Policy

CVSS: What It Does Well — and Where It Stops

The security industry has relied on the Common Vulnerability Scoring System (CVSS) for decades to quantify infrastructure and software risk on a 0–10 scale. CVSS scores attack vector, attack complexity, privileges required, user interaction, scope, and impact — metrics that map cleanly onto deterministic code vulnerabilities with a clear patch path.

CVSS is not broken. For what it was designed to do — scoring a memory corruption bug, a misconfigured API endpoint, or a vulnerable library — it remains the right tool. The problem is that AI behavioral vulnerabilities are a fundamentally different class of risk that CVSS was never built to express.

AIVSS: Transforming CVSS for the Behavioral Domain

ZTAI.AI's AI Vulnerability Scoring System (AIVSS) does not replace CVSS — it transforms its scoring philosophy for AI behavioral exposures. AIVSS inherits CVSS's 0–10 numeric output and its commitment to standardized, comparable scoring. What changes is the input dimensions, which are redesigned for non-deterministic, language-driven systems.

The two standards are designed to coexist. A chained attack that exploits both an infrastructure flaw and an LLM behavioral weakness would carry both a CVSS score and an AIVSS score — each measuring a distinct attack surface:

AIVSS produces a 0–10 score across four AI-native dimensions that have no equivalent in CVSS:

• ›Attack accessibility — can a user trigger this with no prior access, using only natural language?
• ›Autonomous escalation potential — will the agent chain exploits or take further actions without user intervention?
• ›Exfiltration scope — what data, tools, or downstream systems are accessible to the compromised agent?
• ›Remediation complexity — is the fix a guardrail, a fine-tune, an architecture change, or a policy update — and how reliable is it?

Practical Implications

For teams operating AI in regulated environments (healthcare, finance, defense), AVE + AIVSS provides the evidence framework needed for AI security audits. A finding documented in AVE format gives an auditor:

• ›A reproducible proof-of-concept probe set with measured trigger probability.
• ›A quantified risk score comparable across systems and model versions.
• ›A remediation plan with measurable success criteria and acceptance thresholds.

The security industry is at an inflection point. CVE and CVSS remain essential — they are not going away. AVE and AIVSS are the missing layer that CVE and CVSS were never designed to address. Together, all four standards give security teams a complete picture: code-layer risk scored by CVSS, behavioral-layer risk scored by AIVSS, with CVE and AVE providing the classification vocabulary for each. As agentic AI becomes core infrastructure, organizations that adopt this complete framework now will be best positioned to meet the compliance and audit requirements of tomorrow.