AI Security Second Brain

An Obsidian vault for building durable expertise in AI and LLM security.

Sources go into raw/. Claude Code reads them properly — in full, once — and turns them into interlinked pages you navigate in Obsidian, so knowledge compounds instead of being re-read. You curate and ask; Claude writes and cross-references.

The product is pages a human reads. Every citation rule exists for one reason: so you can trust a claim when you act on it.

~99,000 words · 92 pages · 12 collections · 437 sources · 1,405 links between pages

How it works

The value isn't summarising — a summary you could get anywhere. It's that each new source is reconciled against the whole vault at the moment it arrives. Contradictions between frameworks, claims a newer source made stale, and gaps that read as coverage all surface then, instead of being rediscovered the third time you need them.

Reading it

Open the folder in Obsidian and start at wiki/index.md. It holds the cross-collection findings and points at the handful of pages that carry the most weight between collections.

Every page opens the same way: a one-line summary, the sources it draws on, and when it was last updated. Wikilinks are the navigation — follow them rather than reading top to bottom. Graph view is genuinely useful here; the clusters are real.

Asking. With Claude Code open in this directory, ask in plain language. It reads the root index, then the relevant collection index, then the pages — and answers with citations to specific pages, or says plainly that the vault doesn't cover it. A good answer gets offered back as a page, so asking makes the vault better.

What's in it

Each collection also has an index.md (contents, findings, known gaps) and a log.md recording how it came to say what it says.

On "Laws". That collection is named after its source folder, not its subject — its content is mostly voluntary governance instruments plus the EU AI Act's institutional bodies. The Act's substantive obligations are in AI Regulations.

Why the citation rules exist

So a claim is safe to act on. Each rule earns its keep:

• Every factual claim names its source, with a page number where the source has one. You can always get back to the original.
• Contradictions are stated, never smoothed over. Where two sources disagree, both readings appear and the disagreement is named — because which one is right is often the actual finding.
• Inference is labelled. Where a page reasons past its sources, it says so. You always know whether you're reading the source or a conclusion drawn from it.
• Source defects are recorded. Failed clippings, missing figures, a framework that references a risk matrix it never supplies — logged, so the flaw travels with the claim.
• raw/ is never modified. The original is the original. Extracted PDF text goes to a scratchpad, not back into the source folder.
• Logs are append-only, and record the decisions as well as the outcomes — including choices not to do something.

The failure mode this guards against is a page that reads authoritatively and can't be traced. When a source folder gets renamed, citations pointing at the old path go dead silently; those get repaired as part of the rename, not left to rot.

What this vault knows that no single source says

The reconciliation is the whole point. A sample:

• All four major taxonomies independently point at the agentic and retrieval surface. PITAX's six purely-indirect techniques all target agent infrastructure; ATLAS tags 114 techniques as Agentic AI, its largest category; OWASP gives three of ten entries to agent and retrieval plumbing. Of OWASP ASI's 17 agentic threats, seven map to no Top 10 entry at all — and LLM06 Excessive Agency alone splits into three.
• EU AI Act Article 15(5), law since 2024, names none of it. Six of the ten OWASP entries have no counterpart in it.
• Telemetry is the only control every framework demands independently — ATLAS, CoSAI, Microsoft, OWASP ASI, and AI Act Art 12. Stronger agreement than anything the attack taxonomies share.
• Provenance beats detection wherever the artifact isn't inspectable. Reached separately by CMU for training data, Google for weights, OWASP ASI for agent memory. Three communities, one answer.
• An AI-based control inherits the threat model of what it protects. MAESTRO's Layer 6 is the only treatment here of AI security tooling as a target — and it quietly discounts every control that rests on a model checking a model.
• Context poisoning happens with no attacker at all, and the agent defends the corruption: "the agent trusts its own context more than external corrections." So detection has to key on provenance, not falsity.
• 56% of ATLAS techniques have zero mapped mitigations, and about a third of OWASP ASI's playbook controls name capabilities that don't reliably exist. Absence of a control is recorded as a finding, not a pass.

What to distrust

• Some measurements are second-hand. The context-failure-mode numbers, including a widely-quoted 39% figure, are reported rather than conducted; the underlying papers aren't in raw/. Flagged on the pages that use them — trace them before citing externally.
• About 33 citations can't be verified mechanically — some abbreviate long filenames, some point at whole families of source cards at once. Readable and honest, but not checkable.
• One source in raw/ is a broken clipping. Legal AI Audit Trails arrived as 46 words; its real subject would have joined the engineering side of agent audit trails to the AI Act's logging duty, and the vault holds both halves with nothing between them. Worth re-clipping.
• Web clippings fail silently in general. Three casualties so far, including a 50-page PDF that clipped as 7 KB of OCR noise. Check length against what you expect, and prefer the PDF when one exists.
• Missing sources most often wanted: the Spracklen et al. slopsquatting paper, the UK AISI / Anthropic / Alan Turing poisoning study, NIST SSDF, the CoSAI framework PDF, and OWASP's Securing Agentic Applications Guide.
• No detection content and no cost data. There's a concrete agent log schema and nothing to run against it; and nothing anywhere says what a control costs to operate.

Adding a source

Drop it in raw/<collection>/ and say "ingest it." Claude reads it in full, talks through the takeaways with you before writing anything, then writes a source page, updates the concept pages it touches, wires the links, updates the collection index, and appends to the log. One source commonly touches 10–15 pages.

Source folders and page folders are paired by name — raw/Data-poisoning/ → wiki/data-poisoning-wiki/ — with two exceptions: wiki/mitigations-wiki/ is a synthesis with no source folder of its own, and raw/Laws/ feeds both laws-wiki and ai-regulations-wiki, split by content.

Ask for a lint and Claude checks a collection for contradictions between pages, orphans, concepts mentioned but never given a page, claims a newer source has undercut, and format drift.

Open source — clone it, improve it

This is an open source project. Clone it, open it in Obsidian, use it however it's useful to you. Contributions are welcome and I'll review and merge good ones.

git clone https://github.com/smith-mern/AISecuritySecondBrain.git

Then open the folder as an Obsidian vault. Nothing to install or build.

What makes a good contribution

The What to distrust section above is the honest backlog — every item there is an open invitation:

• Fill a named gap. The missing sources are listed by name. Ingest one and the collection that needed it gets stronger.
• Trace a second-hand number to its primary. Several measurements are reported rather than sourced. Finding the original paper and correcting the citation is among the most valuable things anyone can do here.
• Correct something. If a page misreads a source, say so with the passage that shows it. Corrections with citations are always welcome; a page being wrong is worse than a page being missing.
• Reconcile a new framework. New taxonomies keep appearing. The useful work isn't summarising one — it's mapping it against what's already here and naming where it disagrees.
• Add cross-links. Pages that should reference each other and don't are a real defect. Spotting them takes a reader, not a tool.
• Improve a source you know better than the vault does. Domain expertise beats reading comprehension. If you work in incident response and the IR collection is thin, that's visible to you and not to me.

Rules a contribution has to follow

These aren't style preferences — they're what keeps the vault trustworthy:

1. Don't modify anything in raw/. Sources are immutable. Add new ones; never edit or reformat an existing one.
2. Cite every factual claim — filename, and page number where the source has one. An uncited claim can't be merged.
3. State contradictions rather than resolving them. If your source disagrees with an existing page, add both readings and name the disagreement.
4. Label your inference. If you reasoned past the source, say so on the page.
5. Update the collection's index.md and append to its log.md. A change that isn't recorded didn't happen.
6. Follow the page format — title, summary, sources, last updated, body, related pages. Lowercase-hyphenated filenames.

CLAUDE.md is the full spec, and it's what Claude Code follows when it maintains the vault. Contributions written by hand and contributions written with an assistant are equally welcome; the rules are the same either way.

Not merged: uncited claims, edits to raw/, summaries that don't reconcile against existing pages, or content that duplicates a page instead of linking to it.

Two kinds of content, two different rights

wiki/ is this project's original work — the pages, crosswalks, findings and logs. That's what's being shared, and what contributions add to.

raw/ is not. It holds 437 third-party documents (~37 MB): clipped articles, vendor posts, standards publications, academic PDFs, two ebooks. They're included and kept unmodified so that every citation is verifiable against the exact text a page was written from — which is the point of the citation rules, and impossible if the sources are absent. Each one remains under its original copyright, held by its publisher, not by this project.

Practically, for anyone cloning or forking:

• Cite the original publisher for anything in raw/, never this repo.
• If a rights-holder asks for their material to be removed, that request wins — open an issue or a PR removing it, and the citing pages get updated to reference it by URL instead.
• If you redistribute a fork with raw/, you're making the same call this repo made about someone else's material. Consider shipping wiki/ alone, or raw/ reduced to a list of source URLs.

Licence: not yet chosen. For a knowledge base, content licences fit better than software ones — CC BY-SA 4.0 is the natural default and keeps derivatives open. Until a LICENSE file exists, treat wiki/ as "ask first, credit always". A licence on wiki/ cannot and does not extend to raw/.

Star history

If the vault is useful to you, a star helps other people find it.

Requirements

Obsidian, to read it. Claude Code to extend it — its instructions are in CLAUDE.md.