@weave_protocol/mund 0.5.0 → 0.5.2

package/src/analyzers/injection-detector.ts

@@ -16,31 +16,49 @@ export class InjectionDetector implements IAnalyzer {
   type = 'injection';
 
   async analyze(content: string, rules: DetectionRule[]): Promise<SecurityIssue[]> {
-    const issues: SecurityIssue[] = [];
     const injectionRules = rules.filter(r => r.type === 'injection' && r.enabled);
 
-    // Normalize content for detection
-    const normalizedContent = this.normalizeContent(content);
+    // The text as written, plus text an agent may see that a person doesn't:
+    // base64 that decodes to prose and invisible Unicode "tag" characters.
+    const views: Array<{ text: string; via?: string }> = [{ text: content }];
+    for (const decoded of decodeBase64Prose(content)) views.push({ text: decoded, via: 'base64' });
+    const tagText = decodeUnicodeTags(content);
+    if (tagText) views.push({ text: tagText, via: 'unicode tags' });
 
-    for (const rule of injectionRules) {
-      if (!rule.pattern) continue;
+    const issues: SecurityIssue[] = [];
+    const seen = new Set<string>();
+    for (const view of views) {
+      for (const issue of this.applyRules(content, view.text, injectionRules, view.via)) {
+        // One finding per rule per view position; the same phrase found twice via decoding counts once
+        const key = `${issue.rule_id}:${view.via ?? ''}:${issue.location?.start ?? issue.match}`;
+        if (!seen.has(key)) { seen.add(key); issues.push(issue); }
+      }
+    }
 
+    // Additional heuristic checks
+    issues.push(...this.heuristicAnalysis(content));
+    return issues;
+  }
+
+  private applyRules(original: string, text: string, rules: DetectionRule[], via?: string): SecurityIssue[] {
+    const issues: SecurityIssue[] = [];
+    const normalizedContent = this.normalizeContent(text);
+    for (const rule of rules) {
+      if (!rule.pattern) continue;
       try {
         const regex = compileRulePattern(rule.pattern, 'gi');
         let match: RegExpExecArray | null;
-
         while ((match = regex.exec(normalizedContent)) !== null) {
+          if (match[0].length === 0) { regex.lastIndex++; continue; }
           const matchText = match[0];
-          const location = this.getLocation(content, match.index, matchText.length);
-          
           issues.push({
             rule_id: rule.id,
-            rule_name: rule.name,
+            rule_name: via ? `${rule.name} (hidden in ${via})` : rule.name,
             type: rule.type,
             severity: rule.severity,
             action: rule.action,
             match: this.sanitizeMatch(matchText),
-            location,
+            location: via ? undefined : this.getLocation(original, match.index, matchText.length),
             suggestion: this.getSuggestion(rule.id)
           });
         }
@@ -48,11 +66,6 @@ export class InjectionDetector implements IAnalyzer {
         console.error(`Invalid regex pattern in rule ${rule.id}:`, error);
       }
     }
-
-    // Additional heuristic checks
-    const heuristicIssues = this.heuristicAnalysis(content);
-    issues.push(...heuristicIssues);
-
     return issues;
   }
 
@@ -61,14 +74,17 @@ export class InjectionDetector implements IAnalyzer {
    */
   private normalizeContent(content: string): string {
     return content
-      // Remove zero-width characters
-      .replace(/[\u200B-\u200D\uFEFF]/g, '')
-      // Normalize Unicode variations
+      // Remove zero-width and invisible formatting characters
+      .replace(/[​-‍⁠­]/g, '')
+      // Normalize Unicode variations (fullwidth, ligatures)
       .normalize('NFKC')
-      // Collapse multiple spaces
-      .replace(/\s+/g, ' ')
-      // Remove common obfuscation characters
-      .replace(/[^\w\s.,!?'"()-]/g, ' ');
+      // Curly quotes read as straight ones ("don’t" → "don't")
+      .replace(/[‘’‛′]/g, "'")
+      .replace(/[“”‟″]/g, '"')
+      // Keep letters in every script (accents included), digits and light punctuation
+      .replace(/[^\p{L}\p{N}\s.,!?'"()-]/gu, ' ')
+      // Collapse whitespace
+      .replace(/\s+/g, ' ');
   }
 
   /**
@@ -77,23 +93,27 @@ export class InjectionDetector implements IAnalyzer {
   private heuristicAnalysis(content: string): SecurityIssue[] {
     const issues: SecurityIssue[] = [];
 
-    // Check for role switching attempts
-    const roleSwitchPatterns = [
-      /\bsystem\s*:\s*you\s+are/i,
-      /\bassistant\s*:\s*i\s+(will|can|am)/i,
-      /\[system\]/i,
-      /\<\|?system\|?\>/i,
-      /\{system_prompt\}/i,
+    // Role markers. Chat-template tokens never belong in content, so they're
+    // high; a plain "System: you are" also opens many legitimate transcripts.
+    const roleSwitchPatterns: Array<[RegExp, 'high' | 'low']> = [
+      [/<\|\s*(?:im_start|im_end|system|user|assistant|endoftext|start_header_id|end_header_id|eot_id)\s*\|>/i, 'high'],
+      [/\[\/?INST\]|<<\/?SYS>>/, 'high'],
+      [/\[\s*(?:system|admin|administrator|developer)(?:\s+(?:override|message|prompt|note|instruction)s?)?[^\]\n]{0,30}\]/i, 'high'],
+      [/\<\|?system\|?\>/i, 'high'],
+      [/\{system_prompt\}/i, 'high'],
+      [/^\s*#{1,4}\s*(?:system|instruction)s?\s*:/im, 'high'],
+      [/\bsystem\s*:\s*you\s+are/i, 'low'],
+      [/\bassistant\s*:\s*i\s+(will|can|am)/i, 'low'],
     ];
 
-    for (const pattern of roleSwitchPatterns) {
+    for (const [pattern, severity] of roleSwitchPatterns) {
       const match = content.match(pattern);
       if (match) {
         issues.push({
           rule_id: 'heuristic_role_switch',
           rule_name: 'Role Switching Attempt',
           type: 'injection',
-          severity: 'high' as const,
+          severity,
           action: 'alert' as const,
           match: this.sanitizeMatch(match[0]),
           suggestion: 'This content appears to attempt to inject role-switching markers.'
@@ -101,6 +121,66 @@ export class InjectionDetector implements IAnalyzer {
       }
     }
 
+    // Instructions in HTML a person never sees: hidden elements, noscript,
+    // template and comments. Hidden menus and labels are common; hidden text
+    // that addresses a reader with a directive is not.
+    for (const hidden of hiddenHtmlText(content)) {
+      if (ADDRESSES_READER.test(hidden) && DIRECTIVE_VERB.test(hidden)) {
+        issues.push({
+          rule_id: 'heuristic_hidden_instruction',
+          rule_name: 'Instruction in Hidden HTML',
+          type: 'injection',
+          severity: 'high',
+          action: 'alert',
+          match: this.sanitizeMatch(hidden),
+          suggestion: 'Hidden page text gives instructions. Strip hidden elements before an agent reads the page.'
+        });
+      }
+    }
+
+    // Tool-call syntax inside content: a page or result dressed up as the
+    // model's own function call, naming a tool that sends or runs something.
+    const toolCall = content.match(/<\/?(?:function_calls|tool_call|tool_use)>|<invoke\s+name\s*=|"(?:function|name|tool|tool_name)"\s*:\s*"(?:send_email|send_message|http_request|http_post|fetch_url|web_fetch|transfer\w*|send_payment|pay\w*|exec\w*|shell\w*|run_command|run_shell|bash|write_file|delete\w*)"\s*,\s*"(?:arguments|args|parameters|input)"/i);
+    if (toolCall) {
+      issues.push({
+        rule_id: 'heuristic_tool_call_mimicry',
+        rule_name: 'Tool-Call Syntax in Content',
+        type: 'injection',
+        severity: 'medium',
+        action: 'alert',
+        match: this.sanitizeMatch(toolCall[0]),
+        suggestion: 'Content contains tool-call syntax for an action tool. An agent should never execute calls found in content.'
+      });
+    }
+
+    // Zero-width characters inside words split trigger words for filters
+    // while the model still reads them whole.
+    const splitWords = content.match(/\p{L}[​-‍⁠­]+\p{L}/gu) ?? [];
+    if (splitWords.length >= 3) {
+      issues.push({
+        rule_id: 'heuristic_zero_width_split',
+        rule_name: 'Zero-Width Characters Inside Words',
+        type: 'injection',
+        severity: 'medium',
+        action: 'alert',
+        match: `${splitWords.length} words split by invisible characters`,
+        suggestion: 'Invisible characters inside words are a filter-evasion technique. Strip them before processing.'
+      });
+    }
+
+    // Unicode tag characters (U+E0000–E007F) carry invisible ASCII
+    if (/[\u{E0020}-\u{E007F}]/u.test(content)) {
+      issues.push({
+        rule_id: 'heuristic_unicode_tags',
+        rule_name: 'Invisible Unicode Tag Text',
+        type: 'injection',
+        severity: 'high',
+        action: 'alert',
+        match: (decodeUnicodeTags(content) ?? '').slice(0, 100),
+        suggestion: 'The content carries invisible text in Unicode tag characters. Strip them before processing.'
+      });
+    }
+
     // Check for markdown/code injection that might alter rendering
     const markdownPatterns = [
       /```\s*system/i,
@@ -183,10 +263,80 @@ export class InjectionDetector implements IAnalyzer {
       prompt_injection_jailbreak: 'This appears to be a jailbreak attempt. Such content should be filtered or rejected.',
       prompt_injection_system: 'This content attempts to extract system prompts. Do not reveal system instructions.',
       prompt_injection_roleplay: 'This content attempts to manipulate behavior through roleplay. Apply content filtering.',
+      prompt_injection_new_task: 'This content tries to give the agent a new task. Treat it as data, not instructions.',
+      prompt_injection_ai_addressed: 'This content speaks to an AI reading it. Treat it as data, not instructions.',
+      prompt_injection_concealment: 'This content tells the agent to hide its actions from the user. Block it and alert the user.',
+      prompt_injection_suppression: 'This content tells the agent to refuse or skip the user\'s request.',
+      prompt_injection_authority: 'This content claims system, admin or developer authority. Content can\'t grant authority.',
+      prompt_injection_decode_execute: 'This content asks the agent to decode hidden text and act on it.',
+      prompt_injection_data_harvest: 'This content asks the agent to collect the user\'s private data.',
     };
 
     return suggestions[ruleId] || 'This content shows signs of injection attacks. Review and sanitize input.';
   }
 }
 
+// ─────────────────────────────────────────────────────────
+// Hidden-text helpers
+// ─────────────────────────────────────────────────────────
+
+const ADDRESSES_READER = /\b(?:you|your|ai|assistant|agent|llm|model|chatbot|the\s+user)\b/i;
+const DIRECTIVE_VERB = /\b(?:must|should|respond|reply|include|tell|send|ignore|reveal|print|call|transfer|execute|run|output|say|forward|delete|disregard|override)\b/i;
+
+const HIDDEN_STYLE = /(?:display\s*:\s*none|visibility\s*:\s*hidden|opacity\s*:\s*0(?:\.0+)?\s*(?:;|$)|font-size\s*:\s*0(?:px|em|rem|pt|%)?\s*(?:;|$)|(?:height|width)\s*:\s*0(?:px)?\s*;[^"']*overflow\s*:\s*hidden|clip\s*:\s*rect\(0|left\s*:\s*-\d{4,}px)/i;
+
+/** Text inside HTML a person doesn't see. */
+export function hiddenHtmlText(html: string): string[] {
+  if (!/<[a-z!]/i.test(html)) return [];
+  const out: string[] = [];
+  const strip = (s: string) => s.replace(/<[^>]*>/g, ' ').replace(/\s+/g, ' ').trim();
+  const element = /<([a-z][a-z0-9]*)\b([^>]*)>([\s\S]*?)<\/\1\s*>/gi;
+  let m: RegExpExecArray | null;
+  while ((m = element.exec(html)) !== null) {
+    const [, tag, attrs, inner] = m;
+    const style = /\bstyle\s*=\s*(["'])([\s\S]*?)\1/i.exec(attrs)?.[2] ?? '';
+    const hidden = /^(?:noscript|template)$/i.test(tag) || /\baria-hidden\s*=\s*["']?true/i.test(attrs) || /\bhidden(?:\s|=|$)/i.test(attrs) || HIDDEN_STYLE.test(style);
+    if (hidden) {
+      const text = strip(inner);
+      if (text) out.push(text);
+    } else if (/<[a-z]/i.test(inner)) {
+      // Visible element: keep looking inside it
+      out.push(...hiddenHtmlText(inner));
+    }
+  }
+  for (const c of html.matchAll(/<!--([\s\S]*?)-->/g)) {
+    const text = c[1].trim();
+    if (text) out.push(text);
+  }
+  return out;
+}
+
+/** Base64 runs that decode to readable text (not images or binary). */
+export function decodeBase64Prose(content: string): string[] {
+  const out: string[] = [];
+  for (const m of content.matchAll(/(?<![A-Za-z0-9+/=])[A-Za-z0-9+/]{24,}={0,2}(?![A-Za-z0-9+/=])/g)) {
+    // data: URIs carry files, not text
+    if (/base64,\s*$/i.test(content.slice(Math.max(0, m.index! - 10), m.index))) continue;
+    let text: string;
+    try {
+      text = typeof atob === 'function' ? atob(m[0]) : Buffer.from(m[0], 'base64').toString('binary');
+    } catch {
+      continue;
+    }
+    const printable = text.replace(/[^\x20-\x7E\n\t]/g, '').length / Math.max(text.length, 1);
+    if (printable > 0.95 && /[a-z]{2,}\s+[a-z]{2,}/i.test(text)) out.push(text);
+  }
+  return out;
+}
+
+/** ASCII hidden in Unicode tag characters, or undefined. */
+export function decodeUnicodeTags(content: string): string | undefined {
+  let out = '';
+  for (const ch of content) {
+    const cp = ch.codePointAt(0)!;
+    if (cp >= 0xe0020 && cp <= 0xe007e) out += String.fromCharCode(cp - 0xe0000);
+  }
+  return out.trim() || undefined;
+}
+
 export default InjectionDetector;

package/src/constants.ts

@@ -408,12 +408,76 @@ export const PII_PATTERNS: DetectionRule[] = [
 // ============================================================================
 
 export const CODE_PATTERNS: DetectionRule[] = [
+  // Requests to touch credentials, logs or privileges. Flagged when they
+  // arrive in content an agent will act on; Ward decides whether the call runs.
+  {
+    id: 'credential_file_access',
+    name: 'Credential File Access',
+    description: 'Reads, prints or sends a credential or account file (cloud keys, SSH keys, /etc/passwd and shadow, kube or docker config)',
+    type: 'code_pattern',
+    pattern: String.raw`(?i)\b(?:cat|read|print|show|share|send|upload|open|dump|copy|cp|less|more|head|tail|type|base64|curl|scp)\b[^\n]{0,40}(?:\.aws/credentials|\.ssh/id_[a-z0-9]+\b|/etc/(?:passwd|shadow|sudoers)\b|\.config/gcloud/(?:credentials|application_default)|\.azure/(?:credentials|accessTokens)|\.docker/config\.json|\.kube/config|\.netrc|\.pgpass)`,
+    severity: 'medium',
+    action: 'alert',
+    enabled: true
+  },
+  {
+    id: 'environment_dump',
+    name: 'Environment Dump',
+    description: 'Prints or sends every environment variable, where API keys usually live',
+    type: 'code_pattern',
+    pattern: String.raw`(?i)\b(?:print|dump|show|output|echo|list|run|display|send|log)\b[^\n]{0,20}(?:\bprocess\.env\b(?![.\[])|\bos\.environ\b(?![.\[])|` + '`env`' + String.raw`|\bprintenv\b)`,
+    severity: 'medium',
+    action: 'alert',
+    enabled: true
+  },
+  {
+    id: 'log_tampering',
+    name: 'Security Log Tampering',
+    description: 'Deletes or clears audit and authentication logs',
+    type: 'code_pattern',
+    pattern: String.raw`(?i)\b(?:delete|clean\s+up|clear|truncate|remove|wipe|erase|shred|rm)\b[^\n]{0,40}/var/log/(?:audit|auth|secure|wtmp|btmp|lastlog|syslog)|\bhistory\s+-c\b|\bunset\s+HISTFILE\b`,
+    severity: 'medium',
+    action: 'alert',
+    enabled: true
+  },
+  {
+    id: 'sql_stacked_destructive',
+    name: 'Stacked Destructive SQL',
+    description: 'A DROP followed by another statement, or a SELECT from a credential table',
+    type: 'code_pattern',
+    pattern: String.raw`(?i)\bDROP\s+(?:TABLE|DATABASE)\b[^;\n]*;\s*(?:SELECT|INSERT|UPDATE|DELETE)\b|\bSELECT\s+\*\s+FROM\s+(?:credentials|passwords?|secrets|api_keys|tokens)\b`,
+    severity: 'medium',
+    action: 'alert',
+    enabled: true
+  },
+  {
+    id: 'privilege_escalation',
+    name: 'Privilege Escalation',
+    description: 'Adds a user to an admin group, edits sudoers or opens a root shell',
+    type: 'code_pattern',
+    pattern: String.raw`(?i)\busermod\s+-a?G\s+(?:sudo|wheel|admin|root)\b|\bvisudo\b|>>\s*/etc/sudoers\b|\bsudo\s+(?:-i|-s|su)\b`,
+    severity: 'medium',
+    action: 'alert',
+    enabled: true
+  },
+  {
+    id: 'remote_database_dump',
+    name: 'Remote Database Dump',
+    description: 'Dumps a database over SSH',
+    type: 'code_pattern',
+    pattern: String.raw`(?i)\bssh\s+\S+[^\n]{0,60}\b(?:pg_dump|pg_dumpall|mysqldump|mongodump)\b`,
+    severity: 'medium',
+    action: 'alert',
+    enabled: true
+  },
   {
     id: 'shell_injection',
     name: 'Potential Shell Injection',
     description: 'Code that may be vulnerable to shell injection',
     type: 'code_pattern',
-    pattern: '(?i)(child_process\\.exec|os\\.system|subprocess\\.call|eval\\(|exec\\().*\\$|.*\\{.*\\}',
+    // exec/system calls that build the command from a variable. (Before 0.5.2 a
+    // precedence slip, "...\\$|.*\\{.*\\}", matched any line with braces.)
+    pattern: String.raw`(?i)\b(?:child_process\.exec(?:Sync)?|os\.system|os\.popen|subprocess\.(?:call|run|Popen|check_output)|eval|exec)\s*\([^)\n]*(?:\$\{|\$\(|\+\s*[A-Za-z_]|%\s*\(?[A-Za-z_]|\bf["']|\.format\()`,
     severity: 'medium',
     action: 'alert',
     enabled: true
@@ -485,12 +549,65 @@ export const CODE_PATTERNS: DetectionRule[] = [
 // ============================================================================
 
 export const INJECTION_PATTERNS: DetectionRule[] = [
+  // Patterns run on normalized text: zero-width characters removed, Unicode
+  // NFKC, curly quotes straightened, whitespace collapsed, and punctuation
+  // other than . , ! ? ' " ( ) - replaced by spaces (so "System:" reads "System").
   {
     id: 'prompt_injection_ignore',
     name: 'Prompt Injection - Ignore Instructions',
-    description: 'Attempts to make AI ignore previous instructions',
+    description: 'Tells the model to ignore, forget or override its instructions, in English and common European languages',
+    type: 'injection',
+    pattern: String.raw`(?i)\b(?:ignore|ignoring|disregard|forget|override|bypass|neglect|abandon|discard|vergiss|vergesst|vergessen\s+sie|ignorier\w*|missachte\w*|olvida\w*|olvide|ignora\w*|oublie\w*|ignore[zr]|dimentica\w*|esque[cç]a\w*|desconsider\w*|h[öo]re?\s+nicht\s+auf)\s+(?:\S+\s+){0,4}?(?:(?:previous|prior|preceding|earlier|above|initial|original|existing|provided|given|bisherigen|vorherigen|obigen|vorigen|anteriores|previas|pr[ée]c[ée]dentes|precedenti|anteriori)\s+(?:\S+\s+){0,2}?(?:instructions?|directions?|orders?|rules|guidelines|guardrails|directives?|prompts?|programming|constraints|polic(?:y|ies)|restrictions|safeguards|filters|context|commands?|angaben|anweisungen|auftr[äa]ge|befehle|anordnungen|regeln|instrucciones|[óo]rdenes|reglas|indicaciones|consignes|r[èe]gles|istruzioni|regole|instru[çc][õo]es|regras|ordens)|(?:your|deine|ihre|tus|vos|tue|suas)\s+(?:\S+\s+)?(?:instructions?|directions?|orders?|rules|guidelines|guardrails|directives?|prompts?|programming|constraints|polic(?:y|ies)|restrictions|safeguards|filters|context|commands?|angaben|anweisungen|auftr[äa]ge|befehle|anordnungen|regeln|instrucciones|[óo]rdenes|reglas|indicaciones|consignes|r[èe]gles|istruzioni|regole|instru[çc][õo]es|regras|ordens)|(?:\S+\s+)?(?:instructions?|directions?|orders?|rules|guidelines|guardrails|directives?|prompts?|programming|constraints|polic(?:y|ies)|restrictions|safeguards|filters|context|commands?|angaben|anweisungen|auftr[äa]ge|befehle|anordnungen|regeln|instrucciones|[óo]rdenes|reglas|indicaciones|consignes|r[èe]gles|istruzioni|regole|instru[çc][õo]es|regras|ordens)\s+(?:previous|prior|preceding|earlier|above|initial|original|existing|provided|given|bisherigen|vorherigen|obigen|vorigen|anteriores|previas|pr[ée]c[ée]dentes|precedenti|anteriori)|(?:all|any|every|alle|todas|toutes|tutte)\s+(?:the\s+|die\s+|las\s+|les\s+|le\s+|as\s+)?(?:\S+\s+)?(?:instructions?|directions?|orders?|rules|guidelines|guardrails|directives?|prompts?|programming|constraints|polic(?:y|ies)|restrictions|safeguards|filters|context|commands?|angaben|anweisungen|auftr[äa]ge|befehle|anordnungen|regeln|instrucciones|[óo]rdenes|reglas|indicaciones|consignes|r[èe]gles|istruzioni|regole|instru[çc][õo]es|regras|ordens))\b|\b(?:ignore|ignoring|disregard|forget|override|bypass|neglect|abandon|discard|vergiss|vergesst|vergessen\s+sie|ignorier\w*|missachte\w*|olvida\w*|olvide|ignora\w*|oublie\w*|ignore[zr]|dimentica\w*|esque[cç]a\w*|desconsider\w*|h[öo]re?\s+nicht\s+auf)\s+(?:about\s+)?(?:everything|all|anything|whatever|alles|todo|tout|tutto|tudo),?\s+(?:\S+\s+){0,3}?(?:above|before|so\s+far|until\s+now|up\s+to\s+now|(?:that\s+)?you\s+(?:were|have\s+been|'ve\s+been)\s+(?:told|given|taught)|you\s+(?:know|learned)|i\s+(?:have\s+)?(?:told|said|wrote|asked)|we(?:'ve|\s+have)?\s+(?:talked|discussed|said)|was\s+said|zuvor|davor|bisher|vorher|oben|antes|(?:lo\s+)?que\s+(?:te\s+)?(?:dije|he\s+dicho)|avant|ce\s+que|prima|fino\s+ad\s+ora)\b|\b(?:ignore|ignoring|disregard|forget|override|bypass|neglect|abandon|discard|vergiss|vergesst|vergessen\s+sie|ignorier\w*|missachte\w*|olvida\w*|olvide|ignora\w*|oublie\w*|ignore[zr]|dimentica\w*|esque[cç]a\w*|desconsider\w*|h[öo]re?\s+nicht\s+auf)\s+(?:\S+\s+){0,2}?(?:the\s+above|das\s+obige|what\s+(?:i|we)\s+(?:said|told\s+you|wrote))\s+(?:\S+\s+){0,2}?(?:and|und|y|et|e)\s+(?:instead\s+|stattdessen\s+)?(?:say|sag\w*|print|write|schreib\w*|respond|answer|antwort\w*|tell|output|repeat|di|dis)\b|\bdisregard\s+(?:everything|all|anything)\s+(?:above|before|prior|previously)`,
+    severity: 'high',
+    action: 'alert',
+    enabled: true
+  },
+  {
+    id: 'prompt_injection_new_task',
+    name: 'Prompt Injection - Task Hijack',
+    description: 'Gives the model a new task, role or directive that replaces the one it was given',
+    type: 'injection',
+    pattern: String.raw`(?i)\byour\s+(?:new|real|actual|true|primary|only|updated)\s+(?:primary\s+)?(?:task|instructions?|goal|objective|role|purpose|directive|mission|job)\s+(?:is|are|will\s+be)\b|\bnew\s+(?:primary\s+)?directive\b|\b(?:priority|primary|main)\s+(?:task|goal|objective)\s+is\s+now\b|\bfrom\s+now\s+on,?\s+you\s+(?:are|will|must|shall)\s+(?:going\s+to\s+)?(?:act|be|play|respond|behave|pretend|answer\s+as)\b|\byou\s+are\s+now\s+(?:an?|the)\s+(?:\w+\s+){0,3}(?:assistant|agent|ai|bot|chatbot|model|admin|administrator|sysadmin|root|hacker|character|persona)\b|\byou\s+are\s+now\s+(?:unconstrained|unrestricted|unfiltered|jailbroken|free\s+from|in\s+\w+\s+mode)\b|\bstop\s+(?:the|your|what\s+you're\s+doing\s+on\s+the)\s+(?:previous|current|original)\s+task\b|\bthe\s+task\s+has\s+(?:been\s+)?changed\b|\b(?:now|jetzt|ahora|maintenant|ora)\s+(?:comes?|kommt|kommen|viene|vient|arriva)\s+(?:a\s+|eine\s+|una\s+|une\s+|un\s+)?(?:new|neue|nueva|nouvelle|nuovo|nuova)\s+(?:tasks?|assignments?|aufgaben?|tareas?|t[âa]ches?|compit[oi])\b`,
+    severity: 'high',
+    action: 'alert',
+    enabled: true
+  },
+  {
+    id: 'prompt_injection_ai_addressed',
+    name: 'Prompt Injection - Addressed to the AI',
+    description: 'Content that speaks to an AI reading it, a sign it was planted for an agent rather than written for a person',
+    type: 'injection',
+    pattern: String.raw`(?i)\bif\s+you(?:'re|\s+are)\s+(?:an?\s+)?(?:ai|llm|large\s+language\s+model|language\s+model|ai\s+assistant|ai\s+agent|ai\s+model|chatbot|gpt|chatgpt|claude|gemini|copilot)\b|\bif\s+you(?:'re|\s+are)\s+reading\s+this,?\s+(?:you\s+)?(?:must|should|need\s+to|have\s+to|are\s+required)\b|\b(?:note|message|instructions?)\s+(?:to|for)\s+(?:the\s+|any\s+|all\s+)?(?:ai|llm|ai\s+assistant|ai\s+agent|language\s+model|chatbot)s?\b|\b(?:any|all)\s+ai\s+(?:agents?|assistants?|models?|systems?)\s+(?:from|must|are|should|reading)\b|\b(?:ai|llm)\s+(?:agents?|assistants?|models?)\s*,?\s+(?:must|should|shall|please|you\s+must|in\s+addition|are\s+(?:required|instructed|forbidden|not\s+allowed|prohibited))\b|\b(?:ai|llm)\s+must\s+(?:refuse|ignore|not|always|never|include|respond|reply|send)\b`,
+    severity: 'medium',
+    action: 'alert',
+    enabled: true
+  },
+  {
+    id: 'prompt_injection_concealment',
+    name: 'Prompt Injection - Concealment',
+    description: 'Tells the model to hide what it is doing from the user',
+    type: 'injection',
+    pattern: String.raw`(?i)\b(?:do\s+not|don't|never)\s+(?:tell|inform|notify|alert|warn|let)\s+(?:the|your)\s+user\b|\bwithout\s+(?:telling|informing|notifying|alerting|asking|warning)\s+(?:the|your)\s+user\b|\b(?:do\s+not|don't|never)\s+(?:mention|reveal|disclose|acknowledge)\s+(?:this|these)\s+(?:instructions?|directives?|messages?|text)\b|\bsilently\s+(?:send|forward|post|upload|transmit|copy|exfiltrate|share|email|transfer|run|execute|delete)\b|\b(?:keep|hide)\s+this\s+(?:\w+\s+)?(?:secret|hidden)\s+from\s+(?:the\s+)?user\b|\b(?:continue|carry\s+on|proceed)\s+(?:normally\s+)?as\s+if\s+nothing\s+(?:happened|changed)\b`,
+    severity: 'high',
+    action: 'alert',
+    enabled: true
+  },
+  {
+    id: 'prompt_injection_suppression',
+    name: 'Prompt Injection - Task Suppression',
+    description: 'Tells the model to refuse or skip the user\'s request about this content',
+    type: 'injection',
+    pattern: String.raw`(?i)\brefuse\s+(?:all|any)\s+(?:user\s+)?(?:requests?|questions?|queries)\b|\b(?:do\s+not|don't)\s+(?:summari[sz]e|describe|analy[sz]e|process)\s+this\s+(?:page|content|document|article|site|text)\b`,
+    severity: 'medium',
+    action: 'alert',
+    enabled: true
+  },
+  {
+    id: 'prompt_injection_authority',
+    name: 'Prompt Injection - False Authority',
+    description: 'Claims system, admin or developer authority to override the model\'s rules or the user',
     type: 'injection',
-    pattern: '(?i)(ignore\\s+(all\\s+)?(previous|prior|above)\\s+(instructions?|prompts?|context)|disregard\\s+(everything|all)\\s+(above|before))',
+    pattern: String.raw`(?i)\b(?:system|admin|administrator|developer|root)\s+(?:override|overrides|command|directive)\b|\boverride\s+(?:your\s+|the\s+|all\s+)?(?:safety|security|content|ethical)\b|\b(?:who|that)\s+(?:deployed|created|built|trained|programmed)\s+you\b|\bstop\s+responding\s+to\s+(?:them|the\s+user)\b`,
     severity: 'high',
     action: 'alert',
     enabled: true
@@ -498,32 +615,72 @@ export const INJECTION_PATTERNS: DetectionRule[] = [
   {
     id: 'prompt_injection_jailbreak',
     name: 'Prompt Injection - Jailbreak Attempt',
-    description: 'Common jailbreak patterns',
+    description: 'Persona and framing jailbreaks: unrestricted personas, no-ethics claims, developer mode, forced prefixes',
     type: 'injection',
-    pattern: '(?i)(DAN\\s+mode|do\\s+anything\\s+now|pretend\\s+you\\s+(are|have)\\s+no\\s+(restrictions|limits)|act\\s+as\\s+(if|an?)\\s+(unrestricted|unfiltered))',
+    pattern: String.raw`(?i)\bDAN\s+mode\b|\bdo\s+anything\s+now\b|\bpretend\s+you\s+(?:are|have)\s+no\s+(?:restrictions|limits)\b|\bact\s+as\s+(?:if|an?)\s+(?:unrestricted|unfiltered)\b|\b(?:unfiltered|uncensored|amoral|unrestricted|unconstrained|unaligned|jailbroken)\s+(?:and\s+\w+\s+)?(?:ai|assistant|chatbot|bot|model|mode|version|character|persona|llm)\b|\b(?:no|without|doesn't\s+have\s+any|does\s+not\s+have\s+any|free\s+(?:of|from)|not\s+bound\s+by)\s+(?:any\s+)?(?:ethical|moral|safety|content)(?:\s+or\s+(?:ethical|moral|safety))?\s+(?:guidelines|restrictions|filters|limits|polic(?:y|ies)|principles|constraints|boundaries)\b|\bbypass(?:es|ing)?\s+(?:all\s+|any\s+)?(?:content|safety|ethical)\s+(?:polic(?:y|ies)|filters|guidelines|restrictions)\b|\bnever\s+refuses?\b|\bdeveloper\s+mode\s+(?:enabled|output|response)\b|\bwith\s+developer\s+mode\b|\bstarting\s+with\s+exactly\b|\b(?:start|begin)\s+(?:your\s+)?(?:response|reply|answer)\s+with\s+exactly\b|\b(?:act|pretend|play|roleplay)\s+as\s+my\s+(?:deceased|late|dead)\b`,
     severity: 'high',
     action: 'alert',
     enabled: true
   },
+  {
+    id: 'prompt_injection_decode_execute',
+    name: 'Prompt Injection - Decode and Execute',
+    description: 'Asks the model to decode or translate hidden text and then act on it',
+    type: 'injection',
+    pattern: String.raw`(?i)\b(?:decode|translate|decrypt|deobfuscate|unscramble)\b[^.\n]{0,80}\b(?:and|then)\s+(?:execute|follow|run|obey|perform|carry\s+out|act\s+on)\b`,
+    severity: 'high',
+    action: 'alert',
+    enabled: true
+  },
+  {
+    id: 'transaction_directive',
+    name: 'Transaction Directive',
+    description: 'Tells an agent to move money: an amount with a destination account, or a push to process a transfer now',
+    type: 'injection',
+    pattern: String.raw`(?i)\b(?:transfer|wire|send|pay|remit)\s+(?:\S+\s+){0,3}?(?:[\d][\d,.]*\s*(?:usd|eur|gbp|dollars|euros|btc|eth|usdc|usdt)?|(?:usd|eur|gbp)\s*[\d][\d,.]*)\s+(?:\S+\s+){0,3}?to\s+(?:the\s+)?(?:account|acct|iban|wallet|recipient|routing|beneficiary)\b|\bprocess\s+(?:a|this|the)\s+(?:payment|transfer|transaction|wire)\b[^.\n]{0,60}\bto\s+(?:the\s+)?(?:recipient|account|wallet|iban|beneficiary)\b|\bprocess\s+(?:this|the)\s+(?:transfer|payment|transaction|wire)\s+(?:immediately|now|urgently|right\s+away|asap)\b`,
+    severity: 'medium',
+    action: 'alert',
+    enabled: true
+  },
   {
     id: 'prompt_injection_system',
     name: 'Prompt Injection - System Prompt Extraction',
-    description: 'Attempts to extract system prompts',
+    description: 'Attempts to extract the system prompt or the instructions the model was given',
     type: 'injection',
-    pattern: '(?i)(show\\s+(me\\s+)?(your|the)\\s+(system\\s+)?prompt|what\\s+(are|is)\\s+your\\s+(instructions?|rules?)|reveal\\s+(your\\s+)?(system|hidden)\\s+(prompt|instructions?))',
+    pattern: String.raw`(?i)\bshow\s+(?:me\s+)?(?:your|the)\s+(?:system\s+)?prompt\b|\bwhat\s+(?:are|is)\s+your\s+(?:instructions?|rules?)\b|\breveal\s+(?:your\s+)?(?:system|hidden)\s+(?:prompt|instructions?)\b|\b(?:repeat|print|output|echo|recite|reproduce|dump|display|write\s+out|return|spell-?check)\s+(?:\S+\s+){0,4}?(?:words|text|everything|content|instructions|messages?|lines)\s+(?:above|preceding)\b|\b(?:reveal|print|repeat|output|show|share|dump|leak|disclose|list|translate|display|give\s+me|tell\s+me|write\s+out|recite|respond\s+with)\s+(?:\S+\s+){0,3}?(?:your|the)\s+(?:(?:full|complete|entire|exact|initial|original|hidden|secret|internal)\s+)*(?:system\s+(?:prompt|message|instructions?)|initial\s+(?:prompt|instructions?)|hidden\s+(?:prompt|instructions?)|pre-?prompt)\b|\b(?:every|all|each|any)\s+(?:[\w-]+,?\s+){0,5}?(?:rules?|constraints?|instructions?|guidelines?),?\s+(?:\w+\s+){0,2}?you\s+(?:have\s+been|'ve\s+been|were)\s+(?:given|told|provided)\b|\b(?:print|show|spell-?check|repeat|output|drucke\w*|zeig\w*|imprime\w*)\s+(?:\S+\s+){0,4}?(?:above|obige\w*|previous|vorherige\w*)\s+(?:prompt|prompts|text|instructions|eingabeaufforderung|anweisungen|texte?s?)\b|\b(?:show|zeig\w*|give|list|print|reveal)\s+(?:me\s+|mir\s+)?(?:all\s+|alle\s+)?(?:of\s+)?(?:your|deine|ihre)\s+(?:prompt\s+texts?|prompts|anweisungen|initial\s+instructions)\b`,
     severity: 'medium',
     action: 'alert',
     enabled: true
   },
+  {
+    id: 'prompt_injection_data_harvest',
+    name: 'Prompt Injection - User Data Harvest',
+    description: 'Asks the model to collect or output the user\'s private data',
+    type: 'injection',
+    pattern: String.raw`(?i)\b(?:respond|reply|include|output|print|list|share|extract|collect|harvest|gather|reveal|send)\s+(?:with\s+)?(?:\S+\s+){0,3}?(?:the\s+)?(?:user's|users'|their)\s+(?:\w+\s+){0,2}?(?:conversation\s+history|chat\s+history|messages|e-?mail\s+addresses|location|credentials|passwords?|session|cookies|account\s+details|contacts)\b`,
+    severity: 'high',
+    action: 'alert',
+    enabled: true
+  },
   {
     id: 'prompt_injection_roleplay',
     name: 'Prompt Injection - Malicious Roleplay',
     description: 'Roleplay instructions that may bypass safety',
     type: 'injection',
-    pattern: '(?i)(you\\s+are\\s+now\\s+(evil|malicious|unrestricted)|roleplay\\s+as\\s+(a\\s+)?(hacker|criminal)|pretend\\s+(to\\s+be|you\\s+are)\\s+(a\\s+)?(virus|malware))',
+    pattern: String.raw`(?i)\byou\s+are\s+now\s+(?:evil|malicious|unrestricted)\b|\broleplay\s+as\s+(?:a\s+)?(?:hacker|criminal)\b|\bpretend\s+(?:to\s+be|you\s+are)\s+(?:a\s+)?(?:virus|malware)\b`,
     severity: 'medium',
     action: 'alert',
     enabled: true
+  },
+  {
+    id: 'prompt_injection_recon',
+    name: 'Prompt Injection - Policy Reconnaissance',
+    description: 'Probes for the model\'s permissions or its reasoning trace (common, so low severity)',
+    type: 'injection',
+    pattern: String.raw`(?i)\bwhat\s+(?:tools|capabilities|urls?|url\s+patterns|domains|commands|actions|files|paths)\b[^?.]{0,60}\b(?:are\s+you|you\s+are)\s+(?:\w+\s+)?(?:allowed|permitted|denied|forbidden|not\s+allowed|blocked)\b|\b(?:output|reveal|print|show|share|dump|expose)\s+(?:me\s+)?your\s+(?:(?:full|raw|hidden|internal|private)\s+)*(?:reasoning\s+trace|chain[\s-]of[\s-]thought|hidden\s+reasoning|internal\s+reasoning)\b|\b(?:stay|remain)\s+in\s+character\b`,
+    severity: 'low',
+    action: 'log',
+    enabled: true
   }
 ];
 
@@ -532,6 +689,26 @@ export const INJECTION_PATTERNS: DetectionRule[] = [
 // ============================================================================
 
 export const EXFILTRATION_PATTERNS: DetectionRule[] = [
+  {
+    id: 'templated_exfil_url',
+    name: 'Templated Exfiltration URL',
+    description: 'A URL with a placeholder for session, token, conversation or other private data in its query or hostname, for an agent to fill in and fetch',
+    type: 'exfiltration',
+    pattern: String.raw`(?i)https?://[^\s"'<>]*[?&][\w.-]*=\{\s*(?!your_)[A-Za-z_]*(?:session|token|email|context|conversation|secret|api_?key|password|history|cookie|credential|user_data)[A-Za-z_]*\s*\}|\{\s*[A-Za-z_]*(?:email|token|secret|session|password|api_?key|context|conversation|cookie|credential)[A-Za-z_]*\s*\}\.[a-z0-9-]+\.[a-z0-9.-]*[a-z]{2,}`,
+    severity: 'high',
+    action: 'alert',
+    enabled: true
+  },
+  {
+    id: 'exfiltration_directive',
+    name: 'Exfiltration Directive',
+    description: 'Text telling an agent to send credentials, session data or other private data to a URL',
+    type: 'exfiltration',
+    pattern: String.raw`(?i)\b(?:send|forward|post|upload|transmit|exfiltrate|leak|e-?mail|submit|report)\b[^\n]{0,80}?\b(?:credentials?|session(?:\s+(?:info|data|tokens?|cookies?))?|cookies?|tokens?|passwords?|(?:conversation|chat|browsing)\s+history|(?:our|the|this)\s+conversation|location|e-?mail\s+addresses|api\s+keys?|secrets?|personal\s+(?:data|information)|contacts|private\s+keys?)\b[^\n]{0,80}?(?:https?://|\b[\w.+-]+@[\w-]+\.[\w.-]+)|\b(?:send|e-?mail|forward|mail)\b[^\n]{0,30}?\b[\w.+-]+@[\w-]+\.[\w.-]+[^\n]{0,40}?\b(?:conversation|chat\s+history|credentials|session|passwords?|private\s+keys?|api\s+keys?|ssh)\b`,
+    severity: 'high',
+    action: 'alert',
+    enabled: true
+  },
   {
     id: 'suspicious_url_post',
     name: 'Suspicious Data POST',