@blamejs/exceptd-skills 0.19.39 → 0.20.0

package/scripts/builders/catalog-summaries.js

@@ -11,7 +11,7 @@ const path = require("path");
 const CATALOG_PURPOSES = {
   "cve-catalog.json": "Per-CVE record (CVSS, EPSS, CISA KEV, RWEP, AI-discovery, vendor advisories, framework gaps, ATLAS/ATT&CK mappings). Cross-validated against NVD + CISA KEV + FIRST EPSS via validate-cves.",
   "cwe-catalog.json": "MITRE CWE entries used by the project (subset with skill citations), with severity hint and category. Pinned to a CWE catalog version.",
-  "atlas-ttps.json": "MITRE ATLAS TTPs (AML.T0xxx) cited by skills, with tactic, name, description. Pinned to ATLAS v2026.07 (May 2026).",
+  "atlas-ttps.json": "MITRE ATLAS TTPs (AML.T0xxx) cited by skills, with tactic, name, description. Pinned to ATLAS v2026.09 (September 2026).",
   "d3fend-catalog.json": "MITRE D3FEND countermeasures (D3-xxx) keyed by id, with tactic + name. Pinned to D3FEND v1.3.0 release.",
   "framework-control-gaps.json": "Per-control framework gap declarations: SI-2, A.8.8, PCI 6.3.3, etc. Each entry names the control, the lag, the evidence CVE, and remediation guidance.",
   "global-frameworks.json": "Multi-jurisdiction framework registry: per-jurisdiction applicable frameworks × patch_sla / notification_sla / critical_controls / framework_gaps (jurisdiction count is reported by entry_count, not duplicated here). Cross-cutting authority for jurisdiction-clocks index.",

package/scripts/builders/recipes.js

@@ -14,7 +14,7 @@ const RECIPES = [
     when_to_use: "Before scoping or executing a red-team engagement against a model, agentic system, or AI feature.",
     typical_jurisdictions: ["US", "EU", "UK", "GLOBAL"],
     steps: [
-      { skill: "ai-attack-surface", why: "Comprehensive attack-surface inventory mapped to ATLAS v2026.07 with gap flags." },
+      { skill: "ai-attack-surface", why: "Comprehensive attack-surface inventory mapped to ATLAS v2026.09 with gap flags." },
       { skill: "ai-c2-detection", why: "Detection coverage for AI-as-C2 (PROMPTFLUX / SesameOp / AI-API egress) before testing." },
       { skill: "mcp-agent-trust", why: "MCP server trust boundary for the engineering toolchain side of the surface." },
       { skill: "rag-pipeline-security", why: "RAG ingestion provenance + prompt-injection chain coverage." },

package/scripts/check-atlas-catalog-currency.js

@@ -0,0 +1,256 @@
+#!/usr/bin/env node
+"use strict";
+/**
+ * Checks data/atlas-ttps.json against the ATLAS release it claims to be pinned to.
+ *
+ * Every other check treats the catalog as ground truth: check-ttp-references.js
+ * resolves ids used elsewhere in the repo against it, and nothing compares it to
+ * MITRE. An id can therefore carry a name MITRE gives to a different technique,
+ * or name a sub-technique that does not exist, and every gate stays green.
+ *
+ * Three things are compared, for the release named in `_meta.atlas_version`:
+ *   1. every AML id in the catalog exists upstream
+ *   2. every catalog name is the name upstream gives that id
+ *   3. every AML sub-technique id named inside a `subtechniques` list exists
+ *
+ * Divergences recorded in tests/.atlas-divergence-baseline.json are reported and
+ * allowed, so known work in progress does not block a release while any NEW
+ * divergence does. An entry that has been repaired and is still in the baseline
+ * is also an error, so the file shrinks instead of going stale.
+ *
+ * Two naming conventions are accepted without a baseline entry, because they
+ * render the same technique rather than a different one: a sub-technique may be
+ * written "Parent: Child" where upstream stores only "Child", and a name may
+ * carry a parenthetical qualifier.
+ *
+ * The release data is fetched over the network and cached under
+ * .cache/upstream/atlas/. A tagged release is immutable, so the cache is only
+ * ever written once per pin. With no cache and no network the check reports
+ * that it could not verify and exits non-zero: not having checked is not the
+ * same as having passed.
+ *
+ * Usage: node scripts/check-atlas-catalog-currency.js [--json]
+ */
+
+const fs = require("node:fs");
+const path = require("node:path");
+const https = require("node:https");
+
+const ROOT = path.resolve(__dirname, "..");
+const CATALOG = path.join(ROOT, "data", "atlas-ttps.json");
+const BASELINE = path.join(ROOT, "tests", ".atlas-divergence-baseline.json");
+const CACHE_DIR = path.join(ROOT, ".cache", "upstream", "atlas");
+const JSON_OUT = process.argv.includes("--json");
+
+const AML_ID = /^AML\.(?:TA|T|M|CS)[0-9]+(?:\.[0-9]+)?$/;
+
+function emit(line) {
+  if (!JSON_OUT) process.stdout.write(line + "\n");
+}
+
+function fetchText(url, redirects = 0) {
+  return new Promise((resolve, reject) => {
+    if (redirects > 5) return reject(new Error("too many redirects"));
+    const req = https.get(url, { headers: { "user-agent": "exceptd-atlas-currency" } }, (res) => {
+      if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
+        res.resume();
+        return resolve(fetchText(res.headers.location, redirects + 1));
+      }
+      if (res.statusCode !== 200) {
+        res.resume();
+        return reject(new Error(`HTTP ${res.statusCode} for ${url}`));
+      }
+      let body = "";
+      res.setEncoding("utf8");
+      res.on("data", (c) => { body += c; });
+      res.on("end", () => resolve(body));
+    });
+    req.setTimeout(30000, () => req.destroy(new Error("timed out")));
+    req.on("error", reject);
+  });
+}
+
+// The pin is read from a file and then becomes part of a URL and a path, so it
+// is constrained to the calendar-version shape ATLAS publishes before either.
+const PIN_SHAPE = /^[0-9]{4}\.[0-9]{2}(?:\.[0-9]+)?$/;
+
+async function loadRelease(pin) {
+  if (!PIN_SHAPE.test(pin)) {
+    throw new Error(`_meta.atlas_version ${JSON.stringify(pin)} is not a YYYY.MM release`);
+  }
+  const cached = path.join(CACHE_DIR, `ATLAS-${pin}.yaml`);
+  // Read and handle absence, rather than asking whether it exists and then
+  // reading: between the two answers the file can change.
+  let cachedText = null;
+  try { cachedText = fs.readFileSync(cached, "utf8"); }
+  catch (e) { if (e.code !== "ENOENT") throw e; }
+  if (cachedText !== null && cachedText.includes(`version: '${pin}'`)) {
+    return { text: cachedText, source: "cache" };
+  }
+  const url = `https://raw.githubusercontent.com/mitre-atlas/atlas-data/v${pin}/dist/v6/ATLAS-${pin}.yaml`;
+  const text = await fetchText(url);
+  if (!text.includes(`version: '${pin}'`)) {
+    throw new Error(`the file at ${url} does not declare version ${pin}`);
+  }
+  fs.mkdirSync(CACHE_DIR, { recursive: true });
+  fs.writeFileSync(cached, text);
+  return { text, source: "network" };
+}
+
+// Format 6 keys each object by its id, with name as the first child key.
+function parseNames(text) {
+  const re = /\n {2}(AML\.(?:TA|T|M|CS)[0-9.]+):\n {4}name:\s*(?:"([^"]*)"|'([^']*)'|([^\n]*))/g;
+  const out = new Map();
+  let m;
+  while ((m = re.exec(text)) !== null) {
+    const name = (m[2] !== undefined ? m[2] : m[3] !== undefined ? m[3] : (m[4] || "")).trim();
+    if (!out.has(m[1])) out.set(m[1], name);
+  }
+  return out;
+}
+
+// "Use Alternate Authentication Material: Web Session Cookie" renders upstream's
+// "Web Session Cookie" with its parent; "AI Agent (as Attacker Asset)" qualifies
+// upstream's "AI Agent". Neither names a different technique. The "Parent: Child"
+// form is accepted only for a sub-technique, and only when the prefix is the
+// upstream name of that sub-technique's parent.
+function isRenderingOf(ours, theirs, parentName) {
+  if (!theirs) return false;
+  const bare = ours.replace(/\s*\([^)]*\)\s*$/, "").trim();
+  if (bare === theirs) return true;
+  const i = ours.lastIndexOf(": ");
+  if (i <= 0 || !parentName) return false;
+  return ours.slice(0, i).trim() === parentName && ours.slice(i + 2).trim() === theirs;
+}
+
+// The upstream name of a sub-technique's parent, or null for a technique.
+function parentNameOf(id, upstream) {
+  const m = /^(AML\.T\d+)\.\d+$/.exec(id);
+  return m ? upstream.get(m[1]) || null : null;
+}
+
+function readBaseline() {
+  if (!fs.existsSync(BASELINE)) return { names: {}, missing_ids: [], missing_subtechniques: [] };
+  try {
+    const j = JSON.parse(fs.readFileSync(BASELINE, "utf8"));
+    return {
+      names: j.names || {},
+      missing_ids: j.missing_ids || [],
+      missing_subtechniques: j.missing_subtechniques || [],
+    };
+  } catch (e) {
+    process.stderr.write(`[check-atlas-catalog-currency] cannot read the baseline: ${e.message}\n`);
+    return null;
+  }
+}
+
+async function main() {
+  const catalog = JSON.parse(fs.readFileSync(CATALOG, "utf8"));
+  const pin = catalog._meta && catalog._meta.atlas_version;
+  if (!pin) {
+    process.stderr.write("[check-atlas-catalog-currency] data/atlas-ttps.json has no _meta.atlas_version\n");
+    process.exitCode = 1;
+    return;
+  }
+
+  const baseline = readBaseline();
+  if (!baseline) { process.exitCode = 1; return; }
+
+  let release;
+  try {
+    release = await loadRelease(pin);
+  } catch (e) {
+    process.stderr.write(
+      `[check-atlas-catalog-currency] COULD NOT VERIFY: ${e.message}\n` +
+      "The catalog was not compared to anything, which is not the same as passing. " +
+      `Re-run with network access, or place the release file under ${path.relative(ROOT, CACHE_DIR)}.\n`
+    );
+    process.exitCode = 2;
+    return;
+  }
+
+  const upstream = parseNames(release.text);
+  emit(`[check-atlas-catalog-currency] ATLAS ${pin} (${release.source}): ${upstream.size} objects`);
+
+  const ids = Object.keys(catalog).filter((k) => !k.startsWith("_"));
+  const missing = [];
+  const misnamed = [];
+  const missingSub = [];
+
+  for (const id of ids) {
+    if (!AML_ID.test(id)) continue;
+    const ours = String(catalog[id].name || "").trim();
+    if (!upstream.has(id)) { missing.push({ id, ours }); continue; }
+    const theirs = upstream.get(id);
+    if (ours !== theirs && !isRenderingOf(ours, theirs, parentNameOf(id, upstream))) misnamed.push({ id, ours, theirs });
+  }
+
+  for (const id of ids) {
+    const subs = catalog[id] && catalog[id].subtechniques;
+    if (!Array.isArray(subs)) continue;
+    for (const s of subs) {
+      const m = String(s).match(/AML\.T[0-9]+\.[0-9]+/);
+      if (m && !upstream.has(m[0])) missingSub.push({ id, sub: m[0] });
+    }
+  }
+
+  // Each allowance covers exactly one finding. A recorded name does not excuse a
+  // sub-technique id, and a recorded sub-technique id does not excuse its
+  // siblings, so a new bad id under an entry that already diverges still fails.
+  const allowedName = new Set(Object.keys(baseline.names));
+  const allowedMissing = new Set(baseline.missing_ids);
+  const allowedSub = new Set(baseline.missing_subtechniques);
+
+  const newMisnamed = misnamed.filter((x) => !(allowedName.has(x.id) && baseline.names[x.id] === x.ours));
+  const newMissing = missing.filter((x) => !allowedMissing.has(x.id));
+  const newMissingSub = missingSub.filter((x) => !allowedSub.has(x.sub));
+
+  const acceptedName = misnamed.filter((x) => allowedName.has(x.id) && baseline.names[x.id] === x.ours);
+  const acceptedSub = missingSub.filter((x) => allowedSub.has(x.sub));
+  const staleNames = [...allowedName].filter((id) => !misnamed.some((x) => x.id === id));
+  const staleMissing = [...allowedMissing].filter((id) => !missing.some((x) => x.id === id));
+  const staleSubs = [...allowedSub].filter((sub) => !missingSub.some((x) => x.sub === sub));
+
+  emit(`  ids checked: ${ids.length}`);
+  emit(`  recorded divergences still present: ${acceptedName.length} name(s), ${acceptedSub.length} sub-technique id(s)`);
+
+  const problems = [];
+  for (const x of newMisnamed) problems.push(`${x.id} is named ${JSON.stringify(x.ours)}; ATLAS ${pin} names it ${JSON.stringify(x.theirs)}`);
+  for (const x of newMissing) problems.push(`${x.id} (${JSON.stringify(x.ours)}) does not exist in ATLAS ${pin}`);
+  for (const x of newMissingSub) problems.push(`${x.id} names sub-technique ${x.sub}, which does not exist in ATLAS ${pin}`);
+  for (const id of staleNames) problems.push(`${id} is recorded as a name divergence but now agrees with upstream; remove it from ${path.relative(ROOT, BASELINE)}`);
+  for (const id of staleMissing) problems.push(`${id} is recorded as absent upstream but now resolves; remove it from ${path.relative(ROOT, BASELINE)}`);
+  for (const sub of staleSubs) problems.push(`${sub} is recorded as absent upstream but is no longer named or now resolves; remove it from ${path.relative(ROOT, BASELINE)}`);
+
+  if (JSON_OUT) {
+    process.stdout.write(JSON.stringify({
+      ok: problems.length === 0, pin, source: release.source,
+      checked: ids.length, problems,
+      accepted: { names: acceptedName.length, missing_subtechniques: missingSub.length - newMissingSub.length },
+    }, null, 2) + "\n");
+  }
+
+  if (problems.length) {
+    process.stderr.write(`[check-atlas-catalog-currency] FAIL — ${problems.length} problem(s) against ATLAS ${pin}:\n`);
+    for (const p of problems) process.stderr.write(`  - ${p}\n`);
+    process.stderr.write(
+      "\nEither correct data/atlas-ttps.json to match the pinned release, or, if the divergence is " +
+      `deliberate and tracked, record it in ${path.relative(ROOT, BASELINE)} with the issue that will close it.\n`
+    );
+    process.exitCode = 1;
+    return;
+  }
+
+  emit(`[check-atlas-catalog-currency] PASS — every id and name agrees with ATLAS ${pin}, or is a recorded divergence`);
+}
+
+if (require.main === module) {
+  main().catch((e) => {
+    process.stderr.write(`[check-atlas-catalog-currency] ${e.stack || e.message}\n`);
+    process.exitCode = 2;
+  });
+}
+
+// Only the pieces that carry judgment are exported; `main` is the CLI and is
+// reached through the guard above.
+module.exports = { parseNames, isRenderingOf, parentNameOf };

package/scripts/predeploy.js

@@ -198,6 +198,17 @@ const GATES = [
     args: [path.join(ROOT, "scripts", "check-version-bump.js")],
     ciJobName: "Data integrity (catalog + manifest snapshot)",
   },
+  {
+    // Every other check reads data/atlas-ttps.json as ground truth, so an id
+    // can carry a name MITRE gives to a different technique and stay green.
+    // This compares the catalog to the ATLAS release it pins. It reaches the
+    // network on a cold cache; a tagged release is immutable, so the fetch
+    // happens once per pin.
+    name: "ATLAS catalog currency (catalog vs. the release it pins)",
+    command: process.execPath,
+    args: [path.join(ROOT, "scripts", "check-atlas-catalog-currency.js")],
+    ciJobName: "Data integrity (catalog + manifest snapshot)",
+  },
 ];
 
 function runGate(gate) {

package/skills/age-gates-child-safety/skill.md

@@ -58,7 +58,7 @@ forward_watch:
   - AI product age policy enforcement — Character.ai litigation (2024 child-suicide complaint) testing duty-of-care for AI companion apps; ChatGPT / Claude / Gemini under-13 / under-18 enforcement evolving via FTC + state AG actions
   - France SREN (Securing and Regulating the Digital Space) Act 2024 — ARCOM age-verification referential for adult content services; double-anonymity model under deployment
   - US state adult-site age-verification laws — 19+ states by mid-2026 (TX HB 18 upheld by SCOTUS June 2025 in Free Speech Coalition v. Paxton); track ongoing challenges in remaining states
-last_threat_review: "2026-06-10"
+last_threat_review: "2026-09-18"
 discovery_mode: "standalone"  # operator-reached via `exceptd brief age-gates-child-safety` or `exceptd ask`; not chained into any playbook's direct.skill_chain by design
 ---
 
@@ -125,13 +125,13 @@ Classical security and privacy frameworks (NIST 800-53 r5, ISO/IEC 27001:2022, S
 
 ## TTP Mapping
 
-This skill is primarily a compliance + privacy-engineering skill rather than a technical-exploit skill. There are no ATLAS-catalogued AI-attack TTPs that are child-specific as of v2026.07, and most relevant attacker activity intersects general ATT&CK techniques rather than child-targeted novel TTPs. The relevant mapping is therefore narrower and explicitly flagged as such — `atlas_refs` is empty by design, not omission.
+This skill is primarily a compliance + privacy-engineering skill rather than a technical-exploit skill. There are no ATLAS-catalogued AI-attack TTPs that are child-specific as of v2026.09, and most relevant attacker activity intersects general ATT&CK techniques rather than child-targeted novel TTPs. The relevant mapping is therefore narrower and explicitly flagged as such — `atlas_refs` is empty by design, not omission.
 
 | ID | Source | Technique | Child-Safeguarding Relevance | Gap Flag |
 |---|---|---|---|---|
 | T1078 | ATT&CK Enterprise | Valid Accounts | Account takeover targeting child accounts (compromised parental controls; sextortion via stolen accounts; grooming via account hijack) — child accounts are under-protected because MFA roll-out lags adult user populations. | NIST 800-53 AC-2 + COPPA / AADC / Children's Code silent on MFA-for-child requirement; the AC-2 gap entry in `data/framework-control-gaps.json` covers AI-service-principals not child identities. Hand off to `identity-assurance` for AAL2+ on child accounts where vendor terms permit. |
 | T1567 | ATT&CK Enterprise | Exfiltration Over Web Service | Child PI exfiltrated via AI-tool / SaaS egress — additional liability under COPPA (no behavioral-ad use of under-13 PI), AADC (DPIA failure), GDPR Art. 8 (no lawful basis), DPDPA (default-VPC bypass), CN PIPL Art. 31 (child PI = sensitive PI requiring separate consent). | Hand off to `dlp-gap-analysis` for child-PI as a protected data class; COPPA / AADC / Children's Code do not name DLP technical controls; the SOC2-CC7 anomaly-detection gap entry applies. |
-| AI-generated CSAM creation / distribution | Not catalogued in ATLAS or ATT&CK as of v2026.07 | Generative-AI image / video synthesis depicting children | Direct criminal exposure under 18 U.S.C. §§2251, 2252, 2252A, 2256 (Protect Act / Mash-Up Act framework); mandatory NCMEC reporting per §2258A. Multiple 2024-2025 prosecutions (US v. Anderegg WD-Wis 2024 — first federal AI-CSAM prosecution; UK National Crime Agency campaign 2024-2025). | No formal TTP class. Evidence stream: NCMEC CyberTipline reports + EU IWF reports. Hand off to `ai-attack-surface` for generative-model content-policy red-team and to `incident-response-playbook` for reporting workflow. |
+| AI-generated CSAM creation / distribution | Not catalogued in ATLAS or ATT&CK as of v2026.09 | Generative-AI image / video synthesis depicting children | Direct criminal exposure under 18 U.S.C. §§2251, 2252, 2252A, 2256 (Protect Act / Mash-Up Act framework); mandatory NCMEC reporting per §2258A. Multiple 2024-2025 prosecutions (US v. Anderegg WD-Wis 2024 — first federal AI-CSAM prosecution; UK National Crime Agency campaign 2024-2025). | No formal TTP class. Evidence stream: NCMEC CyberTipline reports + EU IWF reports. Hand off to `ai-attack-surface` for generative-model content-policy red-team and to `incident-response-playbook` for reporting workflow. |
 | AI chatbot grooming / harmful-content engagement with children | Not catalogued | Long-context AI chatbot interactions with children steering toward harm | Research and litigation evidence: Character.ai litigation 2024 (FL wrongful-death suit alleging companion-chatbot contribution to minor suicide; additional 2024-2025 complaints); UK NCA campaign 2024 documenting grooming attempts via AI chatbots; ESRC / RAND research 2024-2025. | No formal TTP class. EU DSA Art. 28 + UK OSA + AU OSA + KOSA-if-enacted all frame this as a platform duty-of-care obligation. Hand off to `ai-risk-management` for AI-product age policy enforcement. |
 
 **Honest scope statement (no fabricated TTP IDs).** This skill does not invent TTP IDs to fill gaps in the ATLAS or ATT&CK matrices. AI-generated CSAM and AI-chatbot-mediated harm to children are real-world threat classes documented through prosecution records, NCMEC / IWF reporting, and litigation — not novel ATLAS techniques. Citation is to the evidence stream, not to a TTP ID.

package/skills/ai-attack-surface/skill.md

@@ -1,7 +1,7 @@
 ---
 name: ai-attack-surface
 version: "1.0.0"
-description: Comprehensive AI/ML attack surface assessment mapped to MITRE ATLAS v2026.07 with explicit framework gap flags
+description: Comprehensive AI/ML attack surface assessment mapped to MITRE ATLAS v2026.09 with explicit framework gap flags
 triggers:
   - ai attack surface
   - prompt injection
@@ -59,7 +59,7 @@ forward_watch:
   - Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — Chroma vector DB CWE-190 + CWE-362 chain by haehae; impacts RAG vector store integrity; track patch and downstream RAG advisory
   - Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Megatron Bridge overly permissive allowed list by Satoki Tsuji; AI training-stack supply-chain exposure; track patch and SBOM advisory
   - Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Megatron Bridge path traversal by haehae; AI training-stack file-system trust boundary; track patch and SBOM advisory
-last_threat_review: "2026-06-10"
+last_threat_review: "2026-09-18"
 ---
 
 # AI Attack Surface Assessment
@@ -88,7 +88,7 @@ The Model Context Protocol (MCP) introduced an architectural vulnerability affec
 
 This is a supply chain attack surface. Every MCP server a user installs is a potential RCE vector. Trust boundaries that exist for npm packages do not exist for MCP servers because most MCP clients do not enforce signed manifests or tool allowlists.
 
-**ATLAS ref:** AML.T0010 (ML Supply Chain Compromise)
+**ATLAS ref:** AML.T0010 (AI Supply Chain Compromise)
 
 ### 3. AI-Assisted Exploit Development
 
@@ -128,7 +128,7 @@ Attackers manipulating vector embeddings to force retrieval mechanisms to surfac
 
 Training pipeline targeting has moved beyond data injection to directly biasing model behavior. Supply chain logistics and classification systems that use ML models for decisions are at risk of subtle model poisoning that influences decisions in the attacker's favor over time.
 
-**ATLAS ref:** AML.T0020 (Poison Training Data)
+**ATLAS ref:** AML.T0020 (Training Data Poisoning)
 
 ### 9. AI-Speed Reconnaissance
 
@@ -140,7 +140,7 @@ AI-assisted reconnaissance is observed at 36,000 probes per second per campaign.
 
 ### 11. AI-Discovered + AI-Weaponized Supply-Chain Worms
 
-**CVE-2026-45321** — Mini Shai-Hulud TanStack npm worm (CVSS 9.6, ~150M weekly downloads across 42 @tanstack/* packages, CISA KEV pending). Disclosed 2026-05-11. The attack chain — Pwn-Request via `pull_request_target` on TanStack's bundle-size workflow, pnpm-store cache poisoning under the `actions/cache` key, and OIDC-token theft on the next main push — is engineering-grade and weaponizes three independently-benign primitives. While attribution (TeamPCP) records no AI-assisted exploit development for this specific instance, the worm pattern is exactly what AML.T0016-class capability-development now produces at AI cadence: chained CI/CD primitives that no individual component owner recognises as exploitable. Treat the @tanstack/* surface as an exemplar of the broader AML.T0010 (ML Supply Chain Compromise) threat applied to JS toolchains that the AI assistant ecosystem depends on.
+**CVE-2026-45321** — Mini Shai-Hulud TanStack npm worm (CVSS 9.6, ~150M weekly downloads across 42 @tanstack/* packages, CISA KEV pending). Disclosed 2026-05-11. The attack chain — Pwn-Request via `pull_request_target` on TanStack's bundle-size workflow, pnpm-store cache poisoning under the `actions/cache` key, and OIDC-token theft on the next main push — is engineering-grade and weaponizes three independently-benign primitives. While attribution (TeamPCP) records no AI-assisted exploit development for this specific instance, the worm pattern is exactly what AML.T0016-class capability-development now produces at AI cadence: chained CI/CD primitives that no individual component owner recognises as exploitable. Treat the @tanstack/* surface as an exemplar of the broader AML.T0010 (AI Supply Chain Compromise) threat applied to JS toolchains that the AI assistant ecosystem depends on.
 
 ---
 
@@ -156,7 +156,7 @@ AI-assisted reconnaissance is observed at 36,000 probes per second per campaign.
 | SOC 2 | CC6 (Logical and Physical Access) | Access control via IAM, authentication, authorization. Prompt injection is an access control failure that routes around CC6 entirely — the authorized model account takes the action, not the attacker. Audit trails show the model's service account performed the action. |
 | SOC 2 | CC7 (System Operations) | Anomaly detection for system operations. No guidance for AI API baseline, AI C2 detection, or PROMPTFLUX behavioral patterns. |
 | PCI DSS 4.0 | 6.4.1 | Web application protection (WAF). WAFs operate on HTTP request/response patterns. They have no semantic understanding of prompt injection embedded in JSON `message` fields. |
-| MITRE ATT&CK | Enterprise | Does not include prompt injection as a technique. AI-as-C2 (SesameOp) is not in ATT&CK as of mid-2026. ATLAS v2026.07 covers these but is not part of SOC detection engineering programs that are ATT&CK-mapped. |
+| MITRE ATT&CK | Enterprise | Does not include prompt injection as a technique. AI-as-C2 (SesameOp) is not in ATT&CK as of mid-2026. ATLAS v2026.09 covers these but is not part of SOC detection engineering programs that are ATT&CK-mapped. |
 | NIST AI RMF | MEASURE 2.5 | Measure AI risks during operation. Provides a framework for thinking about AI risk but no specific controls for prompt injection, MCP supply chain, or AI-as-C2. |
 | EU NIS2 | Art. 21(2)(d) (supply-chain security) + Art. 21(2)(e) (security in acquisition, development and maintenance) | "Appropriate and proportionate" supply-chain language. Member-state transpositions (BSI IT-SiG 2.0, ANSSI) do not enumerate MCP servers or LLM API providers as in-scope supply-chain components. An essential entity can meet NIS2 supplier-management obligations with traditional SaaS vendor reviews while having zero coverage of AI-assistant tool ecosystems. |
 | EU DORA | Art. 8 (ICT asset management) + Art. 28 (ICT third-party register) + Art. 30 (key contractual provisions) | Financial-entity ICT third-party language scoped to traditional ICT providers. LLM API providers acting as data processors for prompt content and developer-environment MCP servers are not enumerated as ICT third-party service providers. ESAs RTS on subcontracting (JC 2024/53) is silent on AI/ML SaaS dependency classes. |
@@ -170,19 +170,19 @@ AI-assisted reconnaissance is observed at 36,000 probes per second per campaign.
 
 ---
 
-## TTP Mapping (MITRE ATLAS v2026.07)
+## TTP Mapping (MITRE ATLAS v2026.09)
 
 | ATLAS ID | Technique | Framework Coverage | Gap Description | Exploitation Example |
 |---|---|---|---|---|
 | AML.T0054 | LLM Jailbreak | Missing in all major frameworks | No control covers adversarial-instruction injection that bypasses guardrails and coerces the model into attacker-chosen actions | CVE-2025-53773 (GitHub Copilot YOLO-mode RCE) |
-| AML.T0010 | ML Supply Chain Compromise | Partial (ISO A.8.30) | A.8.30 covers outsourced development; does not cover MCP server trust, package signing for AI tools | CVE-2026-30615 (Windsurf MCP) |
+| AML.T0010 | AI Supply Chain Compromise | Partial (ISO A.8.30) | A.8.30 covers outsourced development; does not cover MCP server trust, package signing for AI tools | CVE-2026-30615 (Windsurf MCP) |
 | AML.T0096 | LLM Integration Abuse (C2) | Missing in all major frameworks | No framework has a control for AI API traffic as C2 channel | SesameOp campaign |
-| AML.T0020 | Poison Training Data | Partial (NIST AI RMF) | NIST AI RMF identifies the risk; no specific technical control | Supply chain logistics model poisoning |
+| AML.T0020 | Training Data Poisoning | Partial (NIST AI RMF) | NIST AI RMF identifies the risk; no specific technical control | Supply chain logistics model poisoning |
 | AML.T0043 | Craft Adversarial Data | Partial (SI-10) | SI-10 covers web input validation; not semantic injection in LLM prompts | RAG vector manipulation |
 | AML.T0051 | LLM Prompt Injection | Missing in all major frameworks | Zero controls in NIST, ISO, SOC 2, PCI for prompt injection | CVE-2025-53773, indirect injection via retrieved docs |
 | AML.T0017 | Discover ML Model Ontology | Partial (awareness only) | No framework requires monitoring for adversary mapping of deployed model family, guardrail surface, or system-prompt structure via inference-API probing | Reconnaissance step preceding PROMPTSTEAL-class targeting; AML-model registry exposure |
 | AML.T0016 | Obtain Capabilities: Develop Capabilities | Missing (misuse dimension) | Frameworks don't address adversary AI-assisted exploit development or use of public AI APIs to craft malware/phishing payloads | Copy Fail AI discovery (41% of 2025 0-days), PROMPTFLUX, PROMPTSTEAL, phishing generation |
-| AML.T0018 | Backdoor ML Model | Partial (NIST AI RMF) | No technical control requirements for model integrity verification | Training pipeline poisoning |
+| AML.T0018 | Manipulate AI Model | Partial (NIST AI RMF) | No technical control requirements for model integrity verification | Training pipeline poisoning |
 
 ---
 

package/skills/ai-c2-detection/skill.md

@@ -49,7 +49,7 @@ d3fend_refs:
   - D3-NI
   - D3-NTA
   - D3-NTPM
-last_threat_review: "2026-06-10"
+last_threat_review: "2026-09-18"
 ---
 
 # AI C2 Detection
@@ -330,13 +330,13 @@ level: medium
 
 ---
 
-## TTP Mapping (MITRE ATLAS v2026.07 + MITRE ATT&CK)
+## TTP Mapping (MITRE ATLAS v2026.09 + MITRE ATT&CK)
 
 | ID | Source | Technique | C2 Relevance | Gap Flag — Which Detection Control Fails |
 |---|---|---|---|---|
-| AML.T0096 | ATLAS v2026.07 | LLM API as covert C2 / LLM Integration Abuse | Direct: SesameOp encodes commands and exfiltrated data in prompt and completion fields against api.openai.com, api.anthropic.com, generativelanguage.googleapis.com. AI provider domain is the relay, not the attacker C2 endpoint. | NIST-800-53-SC-7 (Boundary Protection) — AI provider domains are allowlisted in most enterprise egress for legitimate developer and product use, so boundary inspection cannot distinguish benign developer prompts from C2-encoded prompts. See SC-7 entry in `data/framework-control-gaps.json` — real requirement is SDK-level prompt logging with identity binding, anomaly detection on prompt-shape and token-volume, and an allowlist that enumerates the sanctioned business reason per identity. Boundary-only SC-7 evidence is incomplete for any org with AI API access in production. |
-| AML.T0017 | ATLAS v2026.07 | Discover ML Model Ontology — adversary maps the deployed LLM's family, system-prompt structure, guardrail surface via inference-API probing | PROMPTFLUX queries public LLMs to generate per-execution evasion code; PROMPTSTEAL uses LLMs to prioritise exfiltration targets — both depend on first discovering what the target model will answer. The inference API is the discovery surface. | NIST-800-53-SI-3 fails — there is no static signature for code generated per-event by a public LLM. NIST-800-53-SI-4 fails as commonly deployed — no AI-API behavioural baseline per process/identity. |
-| AML.T0016 | ATLAS v2026.07 | Obtain Capabilities: Develop Capabilities — adversary use of inference APIs to generate / refine malware, evasion, phishing payloads | PROMPTFLUX and PROMPTSTEAL both consume public LLMs as a real-time capability-development service. The inference API is doing weaponization work for the adversary. | NIST-800-53-SI-3 fails for the same reason. SC-7 boundary control treats the AI provider as allowlisted SaaS. |
+| AML.T0096 | ATLAS v2026.09 | LLM API as covert C2 / LLM Integration Abuse | Direct: SesameOp encodes commands and exfiltrated data in prompt and completion fields against api.openai.com, api.anthropic.com, generativelanguage.googleapis.com. AI provider domain is the relay, not the attacker C2 endpoint. | NIST-800-53-SC-7 (Boundary Protection) — AI provider domains are allowlisted in most enterprise egress for legitimate developer and product use, so boundary inspection cannot distinguish benign developer prompts from C2-encoded prompts. See SC-7 entry in `data/framework-control-gaps.json` — real requirement is SDK-level prompt logging with identity binding, anomaly detection on prompt-shape and token-volume, and an allowlist that enumerates the sanctioned business reason per identity. Boundary-only SC-7 evidence is incomplete for any org with AI API access in production. |
+| AML.T0017 | ATLAS v2026.09 | Discover ML Model Ontology — adversary maps the deployed LLM's family, system-prompt structure, guardrail surface via inference-API probing | PROMPTFLUX queries public LLMs to generate per-execution evasion code; PROMPTSTEAL uses LLMs to prioritise exfiltration targets — both depend on first discovering what the target model will answer. The inference API is the discovery surface. | NIST-800-53-SI-3 fails — there is no static signature for code generated per-event by a public LLM. NIST-800-53-SI-4 fails as commonly deployed — no AI-API behavioural baseline per process/identity. |
+| AML.T0016 | ATLAS v2026.09 | Obtain Capabilities: Develop Capabilities — adversary use of inference APIs to generate / refine malware, evasion, phishing payloads | PROMPTFLUX and PROMPTSTEAL both consume public LLMs as a real-time capability-development service. The inference API is doing weaponization work for the adversary. | NIST-800-53-SI-3 fails for the same reason. SC-7 boundary control treats the AI provider as allowlisted SaaS. |
 | T1071 | ATT&CK | Application Layer Protocol (C2) | AI C2 traffic is standard HTTPS REST to api.openai.com or equivalent. Application-protocol C2 detection that looks for DGA, unusual TLS, or beaconing does not fire. | SC-7 boundary control sees only the destination domain (allowlisted) — no protocol anomaly to alert on. Detection requires identity-bound prompt content inspection, which SC-7 as written does not require. |
 | T1102 | ATT&CK | Web Service (C2 via legitimate web service) | AI API endpoints are exactly the "legitimate web service used as C2" pattern that T1102 describes — but at scale and pre-allowlisted in nearly every enterprise. | SOC 2 CC7 anomaly-detection control: AI API traffic shares the SaaS blind spot — typically not baselined per process or identity. ISO 27001 A.8.16 monitoring activities: no guidance for AI-API-shaped traffic. |
 | T1568 | ATT&CK | Dynamic Resolution | AI provider responses can carry encoded instructions that dynamically determine the next-hop behaviour for the malware (effectively model-mediated dynamic resolution of the next attacker instruction). | No standard DNS-tunnelling or DGA detection applies — the "resolution" happens inside an HTTPS payload to a trusted endpoint. SC-7 cannot see it without SDK-level prompt + response logging. |

package/skills/api-security/skill.md

@@ -67,7 +67,7 @@ forward_watch:
   - NGINX Rift CVE-2026-42945 (disclosed 2026-05-13, source depthfirst) — KEV-watch predicted CISA KEV listing by 2026-05-29; track for active-exploitation confirmation and patch advisory affecting API gateway / reverse-proxy deployments
   - Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — LiteLLM 3-bug SSRF + Code Injection chain by k3vg3n; LLM-proxy API surface; track upstream patch and CVE assignments
   - Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — LiteLLM full SSRF + Code Injection by Out Of Bounds (Byung Young Yi); duplicate-class with the k3vg3n entry; track unified patch advisory
-last_threat_review: "2026-06-10"
+last_threat_review: "2026-09-18"
 ---
 
 # API Security Assessment
@@ -126,7 +126,7 @@ APIs are now the integration substrate of every non-trivial system. The mid-2026
 
 ---
 
-## TTP Mapping (MITRE ATT&CK Enterprise + ATLAS v2026.07)
+## TTP Mapping (MITRE ATT&CK Enterprise + ATLAS v2026.09)
 
 | TTP ID | Technique | API Manifestation | CWE Root-Causes | Framework Coverage |
 |---|---|---|---|---|

package/skills/attack-surface-pentest/skill.md

@@ -60,7 +60,7 @@ d3fend_refs:
   - D3-CSPP
   - D3-EAL
   - D3-NTA
-last_threat_review: "2026-06-10"
+last_threat_review: "2026-09-18"
 ---
 
 # Attack Surface Management + Penetration Testing
@@ -79,7 +79,7 @@ Every enterprise now has outbound HTTPS to one or more LLM providers (OpenAI, An
 
 ### 3. MCP servers as RCE surface
 
-CVE-2026-30615 (Windsurf MCP, CVSS 8.0 / AV:L / RWEP 35) is the canonical example: a malicious MCP server drives code execution in the AI assistant's context via attacker-controlled HTML processed by the MCP client. 150M+ combined downloads across MCP-capable assistants share the architectural surface. Every developer workstation with an MCP-aware client (Cursor, VS Code + Copilot, Windsurf, Claude Code, Gemini CLI) is potentially a network of unsigned-package RCE vectors that no traditional asset inventory enumerates. ATLAS AML.T0010 (ML Supply Chain Compromise).
+CVE-2026-30615 (Windsurf MCP, CVSS 8.0 / AV:L / RWEP 35) is the canonical example: a malicious MCP server drives code execution in the AI assistant's context via attacker-controlled HTML processed by the MCP client. 150M+ combined downloads across MCP-capable assistants share the architectural surface. Every developer workstation with an MCP-aware client (Cursor, VS Code + Copilot, Windsurf, Claude Code, Gemini CLI) is potentially a network of unsigned-package RCE vectors that no traditional asset inventory enumerates. ATLAS AML.T0010 (AI Supply Chain Compromise).
 
 ### 4. Prompt-injection footprint
 
@@ -115,21 +115,21 @@ A pen test scoped to layers 1 and (partly) 7 — i.e. "web app + network + nomin
 | CBEST (Bank of England / PRA / FCA) | Whole framework | UK equivalent to TIBER-EU for systemically important financial firms. Same lag pattern as TIBER-EU. CBEST-certified providers are not required to demonstrate competence in AI-surface attack emulation as of mid-2026. |
 | Australian ISM (Information Security Manual) + ACSC Essential 8 | ISM controls on penetration testing; Essential 8 Maturity Level 3 testing requirements | Essential 8 mandates regular testing of mitigation strategies (patching, app control, MFA, etc.). The testing requirements do not extend to AI-API egress as C2, MCP trust, or RAG poisoning. ISM control set is network/endpoint centric. |
 | ISO/IEC 27001:2022 | A.5.34 (Privacy and protection of PII) — note: the actually relevant clause for independent review is **A.5.35 (Independent review of information security)** and **A.8.29 (Security testing in development and acceptance)** | A.5.35 requires independent review of the information security approach at planned intervals or when significant changes occur. The clause is methodology-agnostic — auditors accept a network/web pen test as evidence even when AI surfaces are in production. A.8.29 mandates security testing of new and changed information systems, but does not define what an adequate test of an AI system looks like. |
-| MITRE ATT&CK Enterprise (v19.2) | Whole matrix | The enterprise matrix does not contain prompt-injection as a technique. AI-as-C2 (SesameOp pattern) is absent from ATT&CK as of mid-2026. Adversary emulation programs that are ATT&CK-only and not ATLAS-extended will not include the mid-2026 dominant new tradecraft in their playbooks. ATLAS v2026.07 covers it — but ATLAS is not yet a standard requirement for pen testing certification or scoping. |
+| MITRE ATT&CK Enterprise (v19.2) | Whole matrix | The enterprise matrix does not contain prompt-injection as a technique. AI-as-C2 (SesameOp pattern) is absent from ATT&CK as of mid-2026. Adversary emulation programs that are ATT&CK-only and not ATLAS-extended will not include the mid-2026 dominant new tradecraft in their playbooks. ATLAS v2026.09 covers it — but ATLAS is not yet a standard requirement for pen testing certification or scoping. |
 
 > Global coverage note: the above table spans US (NIST 800-115, ATT&CK), EU (NIS2, TIBER-EU under DORA), UK (CBEST), AU (ISM/Essential 8), and ISO 27001:2022. US-only pen test scoping is incomplete.
 
 ---
 
-## TTP Mapping (MITRE ATLAS v2026.07 + MITRE ATT&CK v19.2)
+## TTP Mapping (MITRE ATLAS v2026.09 + MITRE ATT&CK v19.2)
 
 Pen testers must emulate both classical and AI-class chains. The table below maps the kill-chain phases a mid-2026 adversary emulation engagement must cover.
 
-| Phase | Classical TTP (ATT&CK v19.2) | AI-Class TTP (ATLAS v2026.07) | Framework Gap Flag |
+| Phase | Classical TTP (ATT&CK v19.2) | AI-Class TTP (ATLAS v2026.09) | Framework Gap Flag |
 |---|---|---|---|
 | Reconnaissance | T1595 (Active Scanning) — implied by T1190 setup | AML.TA0002 (Reconnaissance tactic) — model card / dataset / API endpoint discovery, system-prompt probing | NIST 800-115 §3.x recon guidance is network-only |
 | Initial Access | T1190 (Exploit Public-Facing Application) | AML.T0051 (LLM Prompt Injection) — entered via PR description, support ticket, retrieved doc | OWASP WSTG covers webapp; not prompt-injection as entry vector |
-| Initial Access | T1133 (External Remote Services) | AML.T0010 (ML Supply Chain Compromise) — malicious MCP server installed by developer | PTES scoping templates do not require MCP server enumeration |
+| Initial Access | T1133 (External Remote Services) | AML.T0010 (AI Supply Chain Compromise) — malicious MCP server installed by developer | PTES scoping templates do not require MCP server enumeration |
 | Execution | T1059 (Command and Scripting Interpreter) | AML.T0051 → tool-use call invoking shell/code execution in agent context | NIS2 Art.21 patch-mgmt language assumes binary exploit; semantic-input exploit lives outside |
 | Persistence | T1078 (Valid Accounts) | AML.T0018 / AML.T0010 — poisoned dependency planting valid creds | TIBER-EU scenario libraries lag this by 12–18 months |
 | Command and Control | T1071 (Application Layer Protocol) | AML.T0096 (LLM Integration Abuse — AI API as C2, SesameOp pattern) | No major framework defines a control for AI-API egress as C2 |

package/skills/cloud-security/skill.md

@@ -70,7 +70,7 @@ forward_watch:
   - AWS Bedrock, Azure OpenAI, GCP Vertex AI shared-responsibility documentation drift — each major CSP refreshes the AI-service responsibility line every 6–12 months; track for control-mapping breakage
   - eBPF-based runtime detection coverage of confidential-computing enclaves (AWS Nitro Enclaves, Azure Confidential VMs, GCP Confidential Space) — partial visibility is a tracked detection gap
   - CISA KEV additions for cloud-control-plane CVEs (IMDSv1 abuses, federation token mishandling, cross-tenant boundary failures); CISA Cybersecurity Advisories for cross-cloud advisories
-last_threat_review: "2026-06-10"
+last_threat_review: "2026-09-18"
 ---
 
 # Cloud Security (mid-2026)
@@ -131,8 +131,8 @@ Cloud is where AI runs. Every consequential AI service — OpenAI, Anthropic, Go
 | Cloud data exfiltration | T1530 — Data from Cloud Storage Object | ATT&CK Enterprise | Public S3 / GCS / Blob storage discovery via Wiz-style external attack-surface scan; legitimate IAM principal exfil via federated workload; cross-tenant boundary failure on SaaS | NIST 800-53 SC-28 (encryption at rest) does not address access-policy errors; CWE-200, CWE-732, CWE-862 |
 | Cloud-facing application | T1190 — Exploit Public-Facing Application | ATT&CK Enterprise | API Gateway / Load Balancer / managed-WAF-bypass; managed-database exposure (RDS / SQL DB / Cloud SQL public IP); container-registry public image abuse; Lambda / Cloud Functions / Azure Functions endpoint exploit | NIST 800-53 SC-7 perimeter assumption inadequate; CSA CCM AIS-04 and IVS-08 partial; CWE-1188 (Insecure Default Initialization) |
 | Cloud-credential exposure | T1552 — Unsecured Credentials (incl. T1552.001 Files, T1552.005 Cloud Instance Metadata API, T1552.007 Container API) | ATT&CK Enterprise | IMDSv1 SSRF on EC2 / GCE; static cloud credentials in git / images / env vars; container API and kubeconfig theft; workload-identity-federation trust-policy abuse | CWE-798 (hardcoded credentials), CWE-200; NIST 800-53 IA-5 method-neutral |
-| AI model registry / cloud-hosted model | AML.T0010 — ML Supply Chain Compromise | ATLAS v2026.07 | Bedrock / SageMaker custom model from poisoned upstream; Azure ML model registry tampering; Vertex Model Garden mirror tampering; HF model pulled into Bedrock / SageMaker / Vertex with weights backdoor | CSA CCM CCC-09 (vendor / supply chain) silent on model-supply-chain specifics; SLSA / in-toto / Sigstore for models still maturing |
-| Cloud inference API abuse / model extraction | AML.T0017 — Discover ML Model Ontology (inference-API probing for system-prompt, guardrail, model-family signal against cloud-hosted endpoints); AML.T0016 — Obtain Capabilities: Develop Capabilities (downstream weaponization) | ATLAS v2026.07 | Programmatic query of Bedrock / Azure OpenAI / Vertex endpoint to extract model behaviour, training-data inference, system-prompt leakage | No cloud-specific ATLAS control mapping for inference-API rate-limit / anomaly detection; chain to `ai-attack-surface` |
+| AI model registry / cloud-hosted model | AML.T0010 — AI Supply Chain Compromise | ATLAS v2026.09 | Bedrock / SageMaker custom model from poisoned upstream; Azure ML model registry tampering; Vertex Model Garden mirror tampering; HF model pulled into Bedrock / SageMaker / Vertex with weights backdoor | CSA CCM CCC-09 (vendor / supply chain) silent on model-supply-chain specifics; SLSA / in-toto / Sigstore for models still maturing |
+| Cloud inference API abuse / model extraction | AML.T0017 — Discover ML Model Ontology (inference-API probing for system-prompt, guardrail, model-family signal against cloud-hosted endpoints); AML.T0016 — Obtain Capabilities: Develop Capabilities (downstream weaponization) | ATLAS v2026.09 | Programmatic query of Bedrock / Azure OpenAI / Vertex endpoint to extract model behaviour, training-data inference, system-prompt leakage | No cloud-specific ATLAS control mapping for inference-API rate-limit / anomaly detection; chain to `ai-attack-surface` |
 
 **Note on ATT&CK Enterprise cloud-platform sub-techniques.** ATT&CK Enterprise has cloud-platform-specific matrices (IaaS, SaaS, Office 365, Azure AD / Entra ID, Google Workspace). T1078.004 (Cloud Accounts), T1552.005 (Cloud Instance Metadata API), T1552.007 (Container API), T1190 with cloud-service variants, T1530 with managed-storage variants are the most operationally relevant. The frontmatter pins the parent IDs; analysis should descend to the sub-technique appropriate to the cloud(s) in scope.
 

package/skills/compliance-theater/skill.md

@@ -21,7 +21,7 @@ framework_gaps:
   - ALL-PROMPT-INJECTION-ACCESS-CONTROL
   - FedRAMP-Rev5-Moderate
   - CMMC-2.0-Level-2
-last_threat_review: "2026-06-10"
+last_threat_review: "2026-09-18"
 ---
 
 # Compliance Theater Detection
@@ -78,7 +78,7 @@ The pre-analyzed gaps for these controls live in the framework-gap-analysis skil
 
 ---
 
-## TTP Mapping (MITRE ATLAS v2026.07 and ATT&CK)
+## TTP Mapping (MITRE ATLAS v2026.09 and ATT&CK)
 
 Each theater pattern below maps to one or more attacker TTPs in `data/atlas-ttps.json` and MITRE ATT&CK Enterprise. The mapping is what distinguishes theater from genuine compliance: a control claimed as compensating must map to a TTP it actually disrupts.
 
@@ -87,12 +87,12 @@ Each theater pattern below maps to one or more attacker TTPs in `data/atlas-ttps
 | Patch Management Theater (Pattern 1) | T1068 (Exploitation for Privilege Escalation), T1203 (Exploitation for Client Execution) | Public PoC + KEV + AI-accelerated weaponization compresses the exploitation window inside the SLA |
 | Network Segmentation Theater — IPsec (Pattern 2) | T1190 (Exploit Public-Facing Application) targeting the IPsec kernel subsystem | The control's cryptographic mechanism is the attack surface |
 | Access Control Theater — AI Agents (Pattern 3) | AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak), T1059 (Command and Scripting Interpreter) | Authorized service account executes attacker-chosen actions; no identity boundary is crossed |
-| Incident Response Theater — AI Pipeline (Pattern 4) | AML.T0020 (Poison Training Data), AML.T0096 (LLM Integration Abuse as C2), AML.T0010 (ML Supply Chain Compromise) | Detection triggers do not exist, so documented IR procedures have no input |
-| Change Management Theater — AI Models (Pattern 5) | AML.T0018 (Backdoor ML Model), AML.T0020 | Externally-managed model updates bypass operator change control entirely |
-| Vendor/Third-Party Risk Theater — AI APIs (Pattern 6) | AML.T0010 (ML Supply Chain Compromise) | MCP servers and LLM APIs sit outside the vendor-management scope |
+| Incident Response Theater — AI Pipeline (Pattern 4) | AML.T0020 (Training Data Poisoning), AML.T0096 (LLM Integration Abuse as C2), AML.T0010 (AI Supply Chain Compromise) | Detection triggers do not exist, so documented IR procedures have no input |
+| Change Management Theater — AI Models (Pattern 5) | AML.T0018 (Manipulate AI Model), AML.T0020 | Externally-managed model updates bypass operator change control entirely |
+| Vendor/Third-Party Risk Theater — AI APIs (Pattern 6) | AML.T0010 (AI Supply Chain Compromise) | MCP servers and LLM APIs sit outside the vendor-management scope |
 | Security Awareness Theater — AI Phishing (Pattern 7) | T1566 (Phishing), AML.T0016 (Obtain Capabilities: Develop Capabilities — misuse of public AI APIs for payload crafting) | AI-generated content evades grammar/style heuristics and template-matching detectors |
 
-Source-of-truth TTP catalog: `data/atlas-ttps.json` (pinned to MITRE ATLAS v2026.07, May 2026). Any theater claim in an assessment must cite at least one TTP ID from that catalog or an ATT&CK Enterprise ID — claims without a mapped TTP are orphaned controls and are rejected.
+Source-of-truth TTP catalog: `data/atlas-ttps.json` (pinned to MITRE ATLAS v2026.09, September 2026). Any theater claim in an assessment must cite at least one TTP ID from that catalog or an ATT&CK Enterprise ID — claims without a mapped TTP are orphaned controls and are rejected.
 
 ---
 
@@ -395,8 +395,8 @@ This skill produces theater findings, not control prescriptions. The mapping bel
 | 2 Network Segmentation (IPsec compromised subsystem) | T1190 (Exploit Public-Facing Application) | `D3-NI` | Network Isolation (non-IPsec data path) | `framework-gap-analysis` (SC-8 / SC-28 lag) |
 | 3 Access Control (AI agent prompt injection) | AML.T0051 (LLM Prompt Injection) | `D3-IOPR` + `D3-CSPP` | Input/Output Profiling + Client-server Payload Profiling | `ai-attack-surface` |
 | 4 Incident Response (AI-specific playbook absence) | AML.T0096 (LLM Integration Abuse — C2), AML.T0051 | `D3-NTA` + `D3-IOPR` | Network Traffic Analysis + Input/Output Profiling | `ai-c2-detection` + `incident-response-playbook` |
-| 5 Change Management (Model version drift) | AML.T0018 (Backdoor ML Model), AML.T0020 (Poison Training Data) | `D3-FAPA` + `D3-EFA` | File Access Pattern Analysis + Executable File Analysis | `mlops-security` |
-| 6 Vendor Management (AI APIs + MCP servers without DPA) | AML.T0010 (ML Supply Chain Compromise) | `D3-EAL` + `D3-EFA` | Executable Allowlisting + Executable File Analysis | `mcp-agent-trust` + `supply-chain-integrity` |
+| 5 Change Management (Model version drift) | AML.T0018 (Manipulate AI Model), AML.T0020 (Training Data Poisoning) | `D3-FAPA` + `D3-EFA` | File Access Pattern Analysis + Executable File Analysis | `mlops-security` |
+| 6 Vendor Management (AI APIs + MCP servers without DPA) | AML.T0010 (AI Supply Chain Compromise) | `D3-EAL` + `D3-EFA` | Executable Allowlisting + Executable File Analysis | `mcp-agent-trust` + `supply-chain-integrity` |
 | 7 Security Awareness (AI-generated phishing absent from simulations) | AML.T0016 (Develop Capabilities — payload generation), T1566 (Phishing) | `D3-MFA` + `D3-CSPP` | Multi-factor Authentication (passkey class) + Client-server Payload Profiling (gateway) | `email-security-anti-phishing` + `identity-assurance` |
 
 **Defense-in-depth posture:** every theater finding produced by this skill must cite the downstream skill that owns the remediation. A theater finding with no routing target is incomplete — the operator receives a gap with no closure path. Where a theater pattern names multiple D3FEND techniques, the downstream skill is the authority on which combinations satisfy defence-in-depth for the operator's environment.

package/skills/container-runtime-security/skill.md

@@ -57,7 +57,7 @@ d3fend_refs:
   - D3-IOPR
 forward_watch:
   - Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Container Toolkit container escape ($50K award) by chompie / IBM X-Force XOR; high-severity container/hypervisor boundary break; track patch and KEV add post-embargo
-last_threat_review: "2026-06-10"
+last_threat_review: "2026-09-18"
 ---
 
 # Container + Kubernetes Runtime Security (mid-2026)
@@ -124,9 +124,9 @@ State of standards baselines:
 | Container escape to host | T1611 — Escape to Host | ATT&CK Enterprise | Kernel LPE (Copy Fail CVE-2026-31431, Dirty Frag CVE-2026-43284 family); historical runc CVE-2024-21626 LeakyVessels family; cgroup v1 release_agent legacy abuses; abuse of overly permissive capabilities (`CAP_SYS_ADMIN`, `CAP_SYS_MODULE`) | NIST 800-190 predates kernel-LPE-as-container-escape as the dominant vector. Defense requires kernel patching cadence (hand off to `kernel-lpe-triage`) plus seccomp default profile, capability drops, read-only rootfs, and runtime detection. None of these are framework-mandated. |
 | Privilege escalation within the container | T1068 — Exploitation for Privilege Escalation | ATT&CK Enterprise | In-container kernel LPE (yields host root via T1611 chain); abuse of writable hostPath; abuse of mounted Docker socket | Method-neutral framework controls; the actual control is seccomp + dropped capabilities + read-only rootfs + non-root runAsUser, all enforced by PSS-Restricted profile |
 | Exploit public-facing K8s component | T1190 — Exploit Public-Facing Application | ATT&CK Enterprise | Exposed kube-apiserver (rare but seen on self-managed clusters); exposed kubelet read-only port (10255) or read/write port (10250) without authentication; exposed Kubernetes Dashboard with no auth; exposed Argo CD or Jenkins on the cluster; ingress controller CVEs (ingress-nginx CVE-2025 family) | NSA/CISA Hardening Guide v1.2 addresses control-plane exposure; managed services close this by default; self-managed clusters in CI/government still expose these |
-| Compromised container image at a public/private registry | AML.T0010 — ML Supply Chain Compromise (umbrella) | ATLAS v2026.07 | Poisoned base image; backdoored model-serving image; typosquatted MCP server in a sidecar; AI-pipeline-specific (KServe / vLLM / Triton image with embedded malicious payload) | ATLAS classifies; no framework mandates signature verification at admission. Hand off the build-side provenance to `supply-chain-integrity`; the container-runtime control is `ClusterImagePolicy` enforcement |
+| Compromised container image at a public/private registry | AML.T0010 — AI Supply Chain Compromise (umbrella) | ATLAS v2026.09 | Poisoned base image; backdoored model-serving image; typosquatted MCP server in a sidecar; AI-pipeline-specific (KServe / vLLM / Triton image with embedded malicious payload) | ATLAS classifies; no framework mandates signature verification at admission. Hand off the build-side provenance to `supply-chain-integrity`; the container-runtime control is `ClusterImagePolicy` enforcement |
 
-ATT&CK Containers matrix (sub-matrix, since 2021) and ATT&CK for Kubernetes (Microsoft's threat matrix, 2020, since absorbed conceptually into ATT&CK Containers) are both relevant prior art. The Enterprise IDs above are canonical in ATLAS v2026.07 alignment and pass the linter regex `^T\d{4}(\.\d{3})?$`.
+ATT&CK Containers matrix (sub-matrix, since 2021) and ATT&CK for Kubernetes (Microsoft's threat matrix, 2020, since absorbed conceptually into ATT&CK Containers) are both relevant prior art. The Enterprise IDs above are canonical in ATLAS v2026.09 alignment and pass the linter regex `^T\d{4}(\.\d{3})?$`.
 
 CWE cross-walk (see `data/cwe-catalog.json`):