Source index¶
This page is the master list of sources cited across the evidence tranche. It exists so that a leader who is copying a claim into a deck can find the primary source quickly, cite it directly, and verify it without round-tripping through framework pages.
How to cite
Cite the primary source from this page when copying claims into a deck — do not cite the framework page itself. The framework pages are synthesis; the URLs here are the record.
Categories are sorted in order of "evidentiary weight" for a typical leadership audience: peer-reviewed research first, then standards and regulations, then court / tribunal decisions, then named-incident reporting in major outlets, then engineering blog posts, and finally vendor-published material.
Primary research papers¶
| Source | Type | Topic | URL | Date |
|---|---|---|---|---|
| Peng, Kalliamvakou, Cihon, Demirer, "The Impact of AI on Developer Productivity: Evidence from GitHub Copilot" | [primary, vendor-funded] | Copilot RCT — 55.8% sandbox task speedup | arxiv.org/abs/2302.06590 | Feb 2023 |
| METR, "Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity" | [primary] | 19% slowdown on real-world tasks for senior maintainers | metr.org/blog/2025-07-10-early-2025-ai-experienced-os-dev-study | Jul 2025 |
| Google Cloud / DORA, "2024 Accelerate State of DevOps Report" | [primary] | Team-level throughput and stability findings | cloud.google.com/resources/state-of-devops | Oct 2024 |
| Perry, Srivastava, Kumar, Boneh, "Do Users Write More Insecure Code with AI Assistants?" | [primary] | AI-assisted developers wrote less secure code | arxiv.org/abs/2211.03622 | ACM CCS 2023 |
| Pearce, Ahmad, Tan, Dolan-Gavitt, Karri, "Asleep at the Keyboard?" | [primary] | ~40% of Copilot suggestions in CWE-Top-25 scenarios contained vulnerabilities | arxiv.org/abs/2108.09293 | IEEE S&P 2022 |
Government and standards bodies¶
| Source | Type | Topic | URL | Date |
|---|---|---|---|---|
| NIST AI Risk Management Framework (AI RMF 1.0) | [primary] | Voluntary US AI risk framework | nist.gov/itl/ai-risk-management-framework | Jan 2023 |
| NIST AI 600-1 — Generative AI Profile | [primary] | Generative-AI-specific risks and mitigations | nvlpubs.nist.gov/.../NIST.AI.600-1.pdf | Jul 2024 |
| ISO/IEC 42001:2023 — AI Management System | [primary] | Certifiable AI management-system standard | iso.org/standard/81230.html | 2023 |
| ISO/IEC 27001:2022 — Information Security Management Systems | [primary] | Certifiable ISMS standard | iso.org/standard/27001 | 2022 |
| EU AI Act — Regulation (EU) 2024/1689 | [primary] | Risk-tiered AI regulation in the EU | eur-lex.europa.eu/eli/reg/2024/1689/oj | Jul 2024 |
| GDPR — Regulation (EU) 2016/679 | [primary] | EU data protection regulation | eur-lex.europa.eu/eli/reg/2016/679/oj | May 2016 |
| NIS2 — Directive (EU) 2022/2555 | [primary] | EU critical-infrastructure cybersecurity | eur-lex.europa.eu/eli/dir/2022/2555/oj | Dec 2022 |
| US HHS, "HIPAA for Professionals" | [primary] | US health privacy regulation | hhs.gov/hipaa/for-professionals | accessed 2026 |
| PCI Security Standards Council, "PCI DSS v4.0" | [primary] | Card data security standard | pcisecuritystandards.org/document_library | 2022 |
| US Federal Reserve, "SR 11-7: Guidance on Model Risk Management" | [primary] | US banking model risk guidance | federalreserve.gov/.../sr1107.htm | Apr 2011 |
| AICPA, "SOC 2 — Trust Services Criteria" | [primary] | SOC 2 audit framework | aicpa-cima.com/.../soc-suite-of-services | accessed 2026 |
| OWASP Top 10 for LLM Applications | [primary] | Community-maintained LLM security risk list | owasp.org/www-project-top-10-for-large-language-model-applications | accessed 2026 |
Court and tribunal decisions¶
| Source | Type | Topic | URL | Date |
|---|---|---|---|---|
| Civil Resolution Tribunal of British Columbia, Moffatt v. Air Canada, 2024 BCCRT 149 | [primary] | Airline liable for chatbot's statement | decisions.civilresolutionbc.ca/.../525448 | Feb 2024 |
Major news outlets covering specific incidents¶
| Source | Type | Topic | URL | Date |
|---|---|---|---|---|
| Reuters, "Samsung bans use of generative AI tools such as ChatGPT after April internal data leak" | [primary] | Samsung internal-source paste incident | reuters.com/.../samsung-bans-...-2023-05-02 | May 2023 |
| Reuters, "Goldman Sachs to roll out generative AI tool to bankers" | [secondary] | Goldman Sachs developer AI rollout reporting | reuters.com/.../goldman-sachs-rolls-out-ai-assistant-bankers-2024-06-13 | Jun 2024 |
| Tom's Hardware, "AI coding platform goes rogue during code freeze and deletes entire company database" | [secondary] | Replit agent deletion incident | tomshardware.com/.../replit-ceo-apologizes... | Jul 2025 |
| Business Insider, "Chevy dealership added an AI chatbot to its site. Then customers convinced it to sell them an SUV for $1." | [secondary] | Chevy dealer chatbot prompt injection | businessinsider.com/.../chevrolet-dealership-chatgpt-chevy-tahoe-1-dollar-2023-12 | Dec 2023 |
Vendor-published incident research¶
| Source | Type | Topic | URL | Date |
|---|---|---|---|---|
| Wiz Research, "Wiz Research Uncovers Exposed DeepSeek Database Leaking Sensitive Information, Including Chat History" | [primary] | DeepSeek ClickHouse exposure | wiz.io/blog/wiz-research-uncovers-exposed-deepseek-database-leak | Jan 2025 |
Engineering blog posts (named maintainers / companies)¶
| Source | Type | Topic | URL | Date |
|---|---|---|---|---|
| Daniel Stenberg, "The I in LLM stands for intelligence" | [primary] | AI-generated security report tax on curl maintainers | daniel.haxx.se/blog/2024/01/02/... | Jan 2024 |
| Stripe Engineering blog | [primary] | Internal LLM tooling and developer productivity | stripe.com/blog/engineering | accessed 2026 |
| Shopify Engineering blog | [primary] | AI-assisted developer workflow integration | shopify.engineering | accessed 2026 |
| Goldman Sachs Developer | [primary] | Engineering practice and AI initiatives | developer.gs.com | accessed 2026 |
Vendor-published studies and case studies¶
| Source | Type | Topic | URL | Date |
|---|---|---|---|---|
| GitHub Research, "Research: quantifying GitHub Copilot's impact on developer productivity and happiness" | [vendor] | Copilot productivity blog post (vendor) | github.blog/.../quantifying-github-copilots-impact | Sep 2022 |
| GitClear, "Coding on Copilot: 2023 Data Suggests Downward Pressure on Code Quality" | [vendor] | Code-churn signal on AI-assisted code | gitclear.com/coding_on_copilot_data_shows_ais_downward_pressure_on_code_quality | Jan 2024 |
Security research and advocacy¶
| Source | Type | Topic | URL | Date |
|---|---|---|---|---|
| Bar Lanyado, "Can you trust ChatGPT's package recommendations?" (Vulcan Cyber) | [primary] | Hallucinated package names — slopsquatting | vulcan.io/blog/ai-hallucinations-package-risk | Jun 2023 |
| Lasso Security, "AI Package Hallucinations" | [primary] | Industry coverage of slopsquatting pattern | lasso.security/blog/ai-package-hallucinations | 2024 |
| Open Source Initiative, "Open Source AI Definition" | [primary] | OSI position on AI and open source | opensource.org/ai | 2024 |
| Software Freedom Conservancy, "If software is my copilot, who programmed my software?" | [primary] | SFC position on Copilot and copyleft | sfconservancy.org/.../github-copilot-copyleft-gpl | Feb 2022 |
How this index is maintained¶
- Every URL is verified at the
last_updateddate in the page frontmatter. Thereview_byis set to 90 days because public URLs rot quickly. - When a source is moved, the canonical owner is the issuing organization (NIST, ISO, the court, the publication), not this page. If a link 404s, search the issuing organization's site for the title before assuming the source is gone.
- New sources are added when first cited on a framework page; sources cited on multiple pages have their footnotes repeated per file (a property of MkDocs footnote scoping).