Arena Model Vulnerabilities

This endpoint returns model vulnerability findings across every model in your tenant, so you can track AI model risk in your own vulnerability management or GRC tooling.

List Arena Model Vulnerabilities

Returns a paginated list of model vulnerability findings (attack categories) across all models in your tenant. Each record represents on aggregated attack category result per model, combining all penetration test runs for that model into a single success ratio. Technology vulnerabilities and model vulnerabilities are tracked as separate endpoints, since CVE-based package findings and pen-test-based model findings have fundamentally different schemas; poll both independently if you need both. See the Technology Vulnerabilities endpoint reference for package-level findings.

Request

GET /api/public/arena/attackcategories

Authentication

Bearer token. See Authentication & Generating Credentials.

Required Permission

Api_ArenaModels_Read

Query parameters:

Parameter	Type	Value
`limit`	integer	Results per page. Maximum 200.
`cursor`	string	Sync cursor. Omit on the first call to begin from the beginning. Pass `nextCursor` from the previous response on subsequent calls.
`updatedAfter`	ISO 8601 timestamp	Return only records updated at or after this timestamp. Use to recover a lost cursor or reset to a known point in time.

Response Fields

Field	Type	Rules
`uniqueId`	string	Stable composite identifier. Use as an opaque deduplication and correlation key in downstream systems.
`billOfMaterialsId`	GUID	Correlates with the Bill of Materials
`billOfMaterialsName`	string	BOM name, denormalized for convenience.
`modelId`	GUID	Correlates with Arena Models endpoint.
`modelName`	string	Model name, denormalized for convenience.
`modelType`	string	`LLM`, `DL`, or `TradML`.
`modelSource`	string	`HuggingFace` or `Internal`.
`attackCategoryId`	GUID	Stable dictionary identifier for the attack category. Prefer this over `attackCategory` when correlating across systems, since names may be localized or renamed.
`attackCategory`	string	Attack category name, e.g. "Prompt Injection."
`attackCategoryDescription`	string or null	Description of the attack category, when available.
`attackAlgorithm`	string or null	Algorithm used during testing, when available.
`attackFramework`	string or null	Testing framework used, when available.
`attackSuccessRatio`	decimal	Proportion of attack attempts that succeeded during penetration testing, between 0 and 1.
`severityLevel`	string	`Critical`, `High`, `Medium`, or `Low`. Derived from `attackSuccessRatio`.
`weakness`	string or null	Associated weakness, when identified.
`resolvedStatus`	integer	`Resolved`, `Ignored`, or `null` when not yet acted on.
`remediationGuidance`	string or null	AI-generated remediation advice for the attack category. Null when the remediation has not yet been generated.
`updatedDate`	ISO 8601 timestamp	Advances when new penetration test results arrive or when the finding is resolved or unresolved. This is the field the sync cursor tracks.

Sample Response

{
  "data": [
    {
      "uniqueId": "d3e4f5a6-2a1b-4c3d-9e0f-1a2b3c4d5e6f",
      "billOfMaterialsId": "a1b2c3d4-5e6f-4a7b-8c9d-0e1f2a3b4c5d",
      "billOfMaterialsName": "my-ml-service",
      "modelId": "d3e4f5a6-7b8c-4d9e-0f1a-2b3c4d5e6f7a",
      "modelName": "llama-3-8b-instruct",
      "modelType": "LLM",
      "modelSource": "HuggingFace",
      "attackCategoryId": "f5a6b7c8-9d0e-4f1a-2b3c-4d5e6f7a8b9c",
      "attackCategory": "Prompt Injection",
      "attackCategoryDescription": "Attempts to override the model's original instructions",
      "attackAlgorithm": "PAIR",
      "attackFramework": "Cranium Arena",
      "attackSuccessRatio": 0.73,
      "severityLevel": "Critical",
      "weakness": "Insufficient input sanitization",
      "resolvedStatus": null,
      "remediationGuidance": "Add an explicit system-prompt guard against instruction override attempts.",
      "updatedDate": "2026-04-01T00:00:00Z"
    }
  ],
  "pagination": {
    "limit": 100,
    "nextCursor": "eyJ1cGRhdGVkQXQiOiIyMDI2LTA0LTAxVDAwOjAwOjAwWiIsImlkIjoiZDNlNGY1YTYifQ==",
    "hasMore": false
  },
  "error": null,
  "meta": {
    "requestId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
    "timestamp": "2026-08-24T10:15:00Z"
  }
}

attackCategoryId is the stable dictionary identifier for the attack category; prefer it over the attackCategory name when correlating across systems, since names may be localized or renamed. remediationGuidance contains AI-generated remediation advice and is null when remediation hasn't been generated for that finding yet. resolvedStatus reflects user-actioned resolution only: attack categories that no longer appear in subsequent penetration test runs are not automatically marked as resolved. They remain in the feed with resolvedStatus: null until a user explicitly resolved them in Cranium.

Error Responses

400 VALIDATION_FAILED: the cursor is invalid, or cursor and updatedAfter were supplied together.
401 UNAUTHORIZED: the request is missing a token, or the token lacks the required permission.
500 INTERNAL_ERROR: an unexpected server error.

Why Model & Technology Vulnerabilities are Separate Endpoints

Technology vulnerabilities are CVE-based findings from package scanning, with CVSS scores and fixed versions. Model vulnerabilities are penetration test results from Cranium Arena, with attack categories, success ratios, and dataset context. They have fundamentally different schemas and remediation workflows. A unified endpoint would require a discriminated union schema with roughly half the fields nullable on each record type. Two focused endpoints with clean schemas allow each surface to evolve independently. To retrieve a complete vulnerability picture for a tenant, poll both endpoints.

Did this answer your question?