The vulnerabilitydata command

vulnerabilitydata datasets

Reads the API index: every dataset the site draws, with what it holds, how many records it has, how often it updates and where its numbers come from.

# A table of every dataset.
vulnerabilitydata datasets
# Just the names.
vulnerabilitydata datasets --json | jq -r '.datasets[].name'

JSON output {"api", "version", "updated", "base_url", "licence", "rules", "reproduce", "datasets": [{"name", "description", "url", "records", "updates", "provenance"}]}: the index unchanged.

Calls GET /api/v1/index.json

vulnerabilitydata get <dataset>

Fetches one dataset file. Under --json (or piped) stdout is the file byte for byte as the API serves it. On a terminal it prints the file's fields and provenance; add --json for the full file.

# The hypotheses file.
vulnerabilitydata get hypotheses --json
# The latest time-to-exploit month.
vulnerabilitydata get live-tte | jq '.monthly[-1]'

JSON output The dataset file unchanged.

Calls GET /api/v1/<dataset>.json

vulnerabilitydata hypotheses [id]

Each hypothesis says what AI predicts, what the best non-AI explanation predicts, the falsifier, the series it reads and its evaluation date. None is shown as true or false before that date. Pass an id (or its leading H-number, such as H3) to show one.

# Every hypothesis with its evaluation date.
vulnerabilitydata hypotheses
# One hypothesis in full.
vulnerabilitydata hypotheses H3
# Each falsifier and its date.
vulnerabilitydata hypotheses --json | jq '.hypotheses[] | {title, falsifier, evaluate_on}'

JSON output The hypotheses file unchanged: {"_provenance", "note", "hypotheses": [{"id", "title", "registered_on", "revision", "ai_predicts", "non_ai_predicts", "falsifier", "series", "test_window", "evaluate_on"}]}. With an id: {"hypothesis": Hypothesis}.

Calls GET /api/v1/hypotheses.json

vulnerabilitydata ledger [--kind <kind>] [--tool-class <class>] [--outcome <level>] [--grade <grade>] [--since <YYYY-MM-DD>] [--limit <n>]

The AI-involvement ledger: every documented case where AI was involved, one row per actor or tool per primary document, each with its kind of AI tool, the attack stage, the outcome reached, its evidence grade, the source URL and the quoted span. Rows come newest first. A count by kind of AI shows what each observer could see, not how common each kind is.

# Independently confirmed cases only.
vulnerabilitydata ledger --grade independently-confirmed
# This year's attack-harness rows, as JSON.
vulnerabilitydata ledger --tool-class harness-agent --since 2026-01-01 --json

JSON output {"total": number, "count": number, "filters": {...}, "incidents": [Incident]}. total counts the whole ledger; count the rows returned.

Calls GET /api/v1/ai-incidents.json

vulnerabilitydata live <series> [--last <n>]

The series collected weekly from public feeds, as one row per month. The current month is partial and is named in partial_month. A month a source has no figure for is null, never zero.

# A year of time to exploit.
vulnerabilitydata live tte --last 12
# Every breach population by month, as JSON.
vulnerabilitydata live breaches --json

JSON output {"series", "dataset", "partial_month", "fetched_at", "columns": [string], "rows": [{"month", column: number|null}]}.

Calls GET /api/v1/live-tte.json · GET /api/v1/live-breaches.json · GET /api/v1/live-ca-ag.json · GET /api/v1/live-hhs-ocr.json · GET /api/v1/live-sec-8k.json · GET /api/v1/live-ai-credited-cves.json · GET /api/v1/live-cve-mix.json

vulnerabilitydata sources [--dataset <dataset>]

Reads every dataset (or only --dataset) and collects each source URL its rows and provenance cite, with the datasets that cite it.

# The reports behind the outcome figures.
vulnerabilitydata sources --dataset outcome-reports
# Every source URL.
vulnerabilitydata sources --json | jq -r '.sources[].url'

JSON output {"count": number, "datasets": [string], "sources": [{"url", "datasets": [string]}]}, sorted by URL.

Calls GET /api/v1/index.json · GET /api/v1/<dataset>.json

vulnerabilitydata update [--check]

Downloads the latest vulnerabilitydata.js and its SHA-256 from the site, refuses it unless the hash matches, and replaces this file in place. --check only reports.

# Update in place.
vulnerabilitydata update

JSON output {"updated": boolean, "up_to_date": boolean, "path", "sha256"}

Calls GET /cli/vulnerabilitydata.js · GET /cli/vulnerabilitydata.js.sha256

vulnerabilitydata completion <bash|zsh|fish>

Prints a completion script for bash, zsh or fish. It always prints the script (it is meant for a shell); with --json it prints {"shell", "script"}.

# Install for zsh.
vulnerabilitydata completion zsh > "${fpath[1]}/_vulnerabilitydata"
# Load for this bash session.
eval "$(vulnerabilitydata completion bash)"
# Install for fish.
vulnerabilitydata completion fish > ~/.config/fish/completions/vulnerabilitydata.fish

JSON output The script. With --json: {"shell", "script"}.

Calls nothing: it runs without a network request

vulnerabilitydata version

The CLI version and the runtime running it.

# Print the version.
vulnerabilitydata version

JSON output {"name": "vulnerabilitydata", "version", "runtime"}

Calls nothing: it runs without a network request

vulnerabilitydata help [command]

Text help on a terminal. With --json (or piped) the full machine-readable catalog: every command, flag, exit code, live series and environment variable, so an agent can drive the CLI from it alone.

# Help for one command.
vulnerabilitydata help ledger
# The whole catalog, for agents.
vulnerabilitydata help --json

JSON output {"name", "version", "docs", "api_index", "commands": [CommandSpec], "global_flags", "exit_codes", "error_codes", "environment", "live_series"}, or one CommandSpec for help <command>.

Calls nothing: it runs without a network request