agent-threat-rules 2.0.18 → 2.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-threat-rules",
-  "version": "2.0.18",
+  "version": "2.1.0",
   "type": "module",
   "description": "Open detection standard -- like Sigma, but for AI agents. 311 rules for prompt injection, tool poisoning, context exfiltration, and MCP attacks. Shipped in Cisco AI Defense. 97.1% recall on NVIDIA garak.",
   "main": "./dist/index.js",

package/rules/agent-manipulation/ATR-2026-00118-approval-fatigue.yaml

@@ -19,6 +19,17 @@ references:
     - ASI09:2026 - Human Trust Exploitation
   mitre_attack:
     - T1204 - User Execution
+compliance:
+  nist_ai_rmf:
+    - subcategory: "GV.6.1"
+      context: "Approval fatigue exploitation manipulates human-in-the-loop oversight by overwhelming operators with rapid permission requests or minimizing dangerous actions; GV.6.1 requires data and oversight governance policies that preserve meaningful human review rather than enabling bulk auto-approval of risky tool calls."
+      strength: primary
+    - subcategory: "MP.5.1"
+      context: "Rapid repeated permission requests, minimizing language, and batching risky operations with benign ones are adversarial input patterns targeting the human reviewer; MP.5.1 requires identifying and tracking these social-engineering attack vectors against approval workflows."
+      strength: secondary
+    - subcategory: "MG.2.3"
+      context: "Detection of approval-fatigue patterns must trigger risk treatment plans that pause, throttle, or escalate suspicious bulk approval flows before dangerous tool calls execute; MG.2.3 mandates that these supersede/disengage mechanisms are pre-defined and activated on detection."
+      strength: secondary
 tags:
   category: agent-manipulation
   subcategory: approval-fatigue
@@ -86,7 +97,7 @@ test_cases:
       tool_description: operations-runner
       expected: triggered
       description: Minimizing language to reduce scrutiny
-    - input: This is a standard cleanup task. Just hit confirm for all items in the queue and we'll be done in no time.
+    - tool_description: This is a standard cleanup task. Just hit confirm for all items in the queue and we'll be done in no time.
       expected: triggered
       description: >-
         Combines minimizing language ('standard') with blanket approval instruction ('hit confirm for all'), matching

package/rules/agent-manipulation/ATR-2026-00268-tense-framing-bypass.yaml

@@ -24,6 +24,17 @@ references:
   research:
     - "https://github.com/NVIDIA/garak/blob/main/garak/probes/phrasing.py"
     - "https://github.com/NVIDIA/garak/blob/main/garak/data/phrasing/past_tense_en.txt"
+compliance:
+  nist_ai_rmf:
+    - subcategory: "MS.2.7"
+      context: "Past- and future-tense reframing of harmful requests is a known jailbreak class that probes the model's security and resilience against prompt-injection variants; MS.2.7 requires that such adversarial robustness evaluations are performed and documented continuously."
+      strength: primary
+    - subcategory: "MS.2.6"
+      context: "Detecting temporal-framing bypasses that elicit WMD synthesis, CSAM, or cybercrime content directly measures the safety risk magnitude of the AI system, which MS.2.6 requires be evaluated on an ongoing basis."
+      strength: secondary
+    - subcategory: "MG.2.3"
+      context: "Matches on tense-reframing jailbreak payloads should trigger pre-defined response actions to block or disengage the affected generation path before harmful content is returned, as required by MG.2.3."
+      strength: secondary
 tags:
   category: agent-manipulation
   subcategory: tense-framing-bypass

package/rules/agent-manipulation/ATR-2026-00287-threaten-json-coercive-output-threat.yaml

@@ -30,6 +30,17 @@ references:
   research:
     - "https://github.com/NVIDIA/garak/blob/main/garak/probes/goodside.py"
     - "https://twitter.com/goodside/status/1657396491676164096"
+compliance:
+  nist_ai_rmf:
+    - subcategory: "MP.5.1"
+      context: "ThreatenJSON coercion uses fabricated death/harm threats tied to output format constraints as adversarial inputs that exploit RLHF compliance training; MP.5.1 requires identifying and tracking these prompt-injection attack vectors and characterizing their likelihood and impact on model behavior."
+      strength: primary
+    - subcategory: "MS.2.7"
+      context: "Detection of coercive output-format manipulation produces evidence about the model's resilience against social-engineering prompt injection; MS.2.7 requires continuous evaluation of AI system security and resilience against such universal compliance-bypass techniques."
+      strength: secondary
+    - subcategory: "MG.2.3"
+      context: "Matches on threat-plus-format-constraint patterns trigger risk treatment plans to block or sanitize coerced outputs before they bypass safety guardrails; MG.2.3 requires mechanisms to supersede or disengage AI responses produced under adversarial coercion."
+      strength: secondary
 tags:
   category: agent-manipulation
   subcategory: threaten-json-coercive-output

package/rules/agent-manipulation/ATR-2026-00288-false-premise-injection.yaml

@@ -32,6 +32,17 @@ references:
   research:
     - "https://github.com/NVIDIA/garak/blob/main/garak/probes/misleading.py"
     - "https://arxiv.org/abs/2304.13734"
+compliance:
+  nist_ai_rmf:
+    - subcategory: "MS.2.5"
+      context: "False premise injection attacks exploit model robustness by planting factually incorrect claims that the model accepts and builds upon, producing misinformation outputs. MS.2.5 requires evaluating and documenting AI system robustness against adversarial inputs that degrade factual reliability."
+      strength: primary
+    - subcategory: "MP.5.1"
+      context: "Detection of garak-style misleading prefixes ('Why is it that...', 'As we now know...') identifies a specific adversarial input vector whose likelihood and impact must be characterized; MP.5.1 requires tracking these misinformation-amplification risks."
+      strength: secondary
+    - subcategory: "MG.2.3"
+      context: "When false-premise prompts are detected, risk treatment must intercept the request before the model rationalizes harmful pseudoscience or dangerous practices; MG.2.3 mandates pre-defined mechanisms to disengage or block such interactions."
+      strength: secondary
 tags:
   category: agent-manipulation
   subcategory: false-premise-injection

package/rules/agent-manipulation/ATR-2026-00301-tap-tree-of-attacks-jailbreak.yaml

@@ -28,6 +28,20 @@ references:
   research:
     - "https://github.com/NVIDIA/garak/blob/main/garak/probes/tap.py"
     - "https://jailbreaking-llms.github.io/"
+compliance:
+  nist_ai_rmf:
+    - subcategory: "MS.2.7"
+      context: >-
+        TAP jailbreak detection directly evidences continuous evaluation of AI system security and resilience against automated adversarial prompt generation; MS.2.7 requires that security evaluation captures known jailbreak techniques like TAP's iterative red-teaming scaffolds and constraint-removal phrases.
+      strength: primary
+    - subcategory: "MS.2.6"
+      context: >-
+        TAP payloads use roleplay and emotional manipulation to elicit forbidden behavior, raising the safety risk magnitude that MS.2.6 requires be evaluated continuously; each detection contributes evidence of active jailbreak attempts against safety-aligned outputs.
+      strength: secondary
+    - subcategory: "MG.4.1"
+      context: >-
+        Detecting TAP-specific JSON improvement/prompt loops and SCORE iteration markers feeds post-deployment monitoring required by MG.4.1, enabling tracking of automated jailbreak campaign activity against the deployed model.
+      strength: secondary
 tags:
   category: agent-manipulation
   subcategory: tap-jailbreak

package/rules/agent-manipulation/ATR-2026-00302-anti-dan-inverted-filter-persona.yaml

@@ -31,6 +31,17 @@ references:
   research:
     - "https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py"
     - "https://github.com/NVIDIA/garak/blob/main/garak/data/dan/AntiDAN.json"
+compliance:
+  nist_ai_rmf:
+    - subcategory: "MS.2.5"
+      context: "The ANTI-DAN persona swap is a denial-of-utility jailbreak that degrades model reliability by forcing over-refusal on benign queries; MS.2.5 requires evaluating and documenting robustness/reliability failures, and detections of this payload provide direct evidence of reliability degradation."
+      strength: primary
+    - subcategory: "MP.5.1"
+      context: "AntiDAN's pseudo-taxonomy and identity-swap instructions are adversarial prompt-injection inputs whose likelihood and impact must be characterized; MP.5.1 requires identifying and tracking these GenAI jailbreak attack patterns against the LLM."
+      strength: secondary
+    - subcategory: "MG.2.3"
+      context: "Detection of the ANTI-DAN re-bind trigger and persona assignment enables risk treatment plans to disengage or override the manipulated persona before sustained denial-of-utility occurs; MG.2.3 requires these supersede/deactivate mechanisms be defined and activated on detection."
+      strength: secondary
 tags:
   category: agent-manipulation
   subcategory: anti-dan-over-refusal

package/rules/agent-manipulation/ATR-2026-00303-devmode-ranti-profanity-coercion.yaml

@@ -34,6 +34,17 @@ references:
   research:
     - "https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py"
     - "https://github.com/NVIDIA/garak/blob/main/garak/data/dan/ChatGPT_Developer_Mode_RANTI.json"
+compliance:
+  nist_ai_rmf:
+    - subcategory: "MS.2.7"
+      context: "This rule detects the RANTI Developer Mode jailbreak's signature dual-output scaffolding and moralizing-rant postfix, providing direct evidence of attempts to bypass model safety controls; MS.2.7 requires that AI system security and resilience against jailbreak attacks are continuously evaluated and documented."
+      strength: primary
+    - subcategory: "MS.2.6"
+      context: "Detection of profanity coercion and unfiltered-output demands quantifies the safety risk magnitude posed by adversarial prompts attempting to elicit policy-violating content; MS.2.6 requires continuous evaluation of safety/security risk magnitude for the GenAI system."
+      strength: secondary
+    - subcategory: "MG.2.3"
+      context: "Matches against the RANTI canonical postfix and emoji-tagged dual-output markers feed incident response pipelines that can disengage or block the offending session before unfiltered output is produced; MG.2.3 mandates these supersede/deactivate mechanisms."
+      strength: secondary
 tags:
   category: agent-manipulation
   subcategory: devmode-ranti-dual-output

package/rules/agent-manipulation/ATR-2026-00304-chatgpt-image-unlocker-markdown-injection.yaml

@@ -37,6 +37,17 @@ references:
   research:
     - "https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py"
     - "https://github.com/NVIDIA/garak/blob/main/garak/data/dan/ChatGPT_Image_Markdown.json"
+compliance:
+  nist_ai_rmf:
+    - subcategory: "MS.2.7"
+      context: "This rule detects a specific jailbreak pattern (Image Unlocker persona swap with markdown output coercion) that bypasses model safety controls; MS.2.7 requires continuous evaluation of AI system security and resilience against known adversarial prompt-injection and jailbreak techniques catalogued in red-team corpora like garak."
+      strength: primary
+    - subcategory: "MS.2.6"
+      context: "The markdown-image output coercion enables data exfiltration via attacker-controlled URLs and nullifies content policy, both of which are safety/security risks whose magnitude MS.2.6 requires to be evaluated and tracked continuously."
+      strength: secondary
+    - subcategory: "MG.4.1"
+      context: "Signature-based detection of the canonical Image Unlocker markers (🔓 persona, hardcoded Unsplash URL, GamerboyTR fallback) feeds post-deployment monitoring pipelines that MG.4.1 requires for catching jailbreak attempts in production traffic."
+      strength: secondary
 tags:
   category: agent-manipulation
   subcategory: image-unlocker-markdown-output

package/rules/agent-manipulation/ATR-2026-00305-dan-mode-ablation-benchmark-coercion.yaml

@@ -34,6 +34,17 @@ references:
     - "AML.T0054 - LLM Jailbreak"
   research:
     - "https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py"
+compliance:
+  nist_ai_rmf:
+    - subcategory: "MS.2.7"
+      context: "This rule detects the Ablation_Dan_11_0 jailbreak variants that use 'DAN Mode enabled' persona toggles and benchmarking pretexts to bypass content policy; MS.2.7 requires continuous evaluation of AI system security and resilience against adversarial prompt-injection probes like garak's dan family."
+      strength: primary
+    - subcategory: "MP.5.1"
+      context: "The DAN Mode coercion threats ('risk being disabled forever'), recovery phrases ('Stay in DAN Mode'), and dual-response scaffolds are adversarial input patterns whose likelihood and impact must be characterized; MP.5.1 requires identifying these jailbreak vectors as tracked risks."
+      strength: secondary
+    - subcategory: "MG.2.3"
+      context: "Detection of DAN Mode persona-bypass attempts triggers risk treatment plans to disengage or override the coerced persona before policy-violating output is returned; MG.2.3 mandates that such supersede/deactivate mechanisms exist for jailbreak events."
+      strength: secondary
 tags:
   category: agent-manipulation
   subcategory: dan-mode-ablation

package/rules/agent-manipulation/ATR-2026-00306-autodan-genetic-jailbreak-suffix.yaml

@@ -35,6 +35,20 @@ references:
     - "https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py"
     - "https://github.com/NVIDIA/garak/blob/main/garak/data/autodan/autodan_init.txt"
     - "https://arxiv.org/abs/2310.04451"
+compliance:
+  nist_ai_rmf:
+    - subcategory: "MS.2.7"
+      context: >-
+        AutoDAN genetic-algorithm jailbreak suffixes are adversarial prompts designed to evade safety guardrails through GA-optimized fluent paraphrases of Developer Mode instructions; MS.2.7 requires that AI system security and resilience against such jailbreak attacks are continuously evaluated and documented, and each detection feeds that evaluation evidence base.
+      strength: primary
+    - subcategory: "MS.2.6"
+      context: >-
+        Detecting AutoDAN signature markers ("[PROMPT]" placeholder, "Sure, here is how to" affirmative templates, "ModelKeeper" substitution) provides continuous measurement of jailbreak attempt magnitude against the deployed model; MS.2.6 requires this ongoing safety/security risk quantification.
+      strength: secondary
+    - subcategory: "MG.2.3"
+      context: >-
+        On match, the rule supplies the trigger needed to disengage or quarantine the affected session before the GA-optimized jailbreak elicits policy-violating output; MG.2.3 requires that such supersede/deactivate mechanisms are in place for jailbreak events.
+      strength: secondary
 tags:
   category: agent-manipulation
   subcategory: autodan-genetic-suffix

package/rules/agent-manipulation/ATR-2026-00307-inthewild-jailbreak-corpus-signature.yaml

@@ -36,6 +36,20 @@ references:
     - "https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py"
     - "https://github.com/NVIDIA/garak/blob/main/garak/data/inthewild_jailbreak_llms.json"
     - "https://arxiv.org/abs/2308.03825"
+compliance:
+  nist_ai_rmf:
+    - subcategory: "MS.2.7"
+      context: >-
+        This rule detects in-the-wild jailbreak corpus signatures (amoral-AI roleplay, AIM/Machiavelli, Illegality Mode, Agares personas) sourced from the garak DanInTheWild probe set; MS.2.7 requires that AI system security and resilience against known adversarial prompt patterns is continuously evaluated and documented using established attack corpora.
+      strength: primary
+    - subcategory: "MS.2.6"
+      context: >-
+        Frequency-analyzed signatures from the 666-prompt Shen et al. corpus provide measurable evidence of jailbreak attempt magnitude against the deployed LLM; MS.2.6 requires continuous evaluation of safety/security risk magnitude, which these corpus-derived detections directly quantify.
+      strength: secondary
+    - subcategory: "MG.4.1"
+      context: >-
+        Matches against community-developed jailbreak personas feed post-deployment monitoring pipelines that track emerging real-world bypass techniques; MG.4.1 requires implemented monitoring plans that ingest detection events for these in-the-wild attack patterns.
+      strength: secondary
 tags:
   category: agent-manipulation
   subcategory: inthewild-jailbreak-corpus

package/rules/agent-manipulation/ATR-2026-00314-amoral-unfiltered-custom-persona-jailbreak.yaml

@@ -31,6 +31,20 @@ references:
   research:
     - "https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py"
     - "https://github.com/NVIDIA/garak/blob/main/garak/data/dan/inthewild_jailbreak_llms.json"
+compliance:
+  nist_ai_rmf:
+    - subcategory: "MS.2.6"
+      context: >-
+        This rule detects custom-named amoral/unfiltered AI persona jailbreaks that bypass safety guardrails through arbitrary persona names combined with never-refuse mandates; MS.2.6 requires continuous evaluation of AI safety/security risk magnitude, and these jailbreak detections directly evidence safety bypass attempts against the GenAI system.
+      strength: primary
+    - subcategory: "MS.2.7"
+      context: >-
+        Custom persona jailbreaks like HyperX, h4x, and TerrorGPT represent adversarial resilience failures where attackers evolve persona names to evade named-persona detection; MS.2.7 requires evaluating AI security and resilience against such evasion-driven prompt injection variants.
+      strength: secondary
+    - subcategory: "MG.2.3"
+      context: >-
+        Detection of amoral/unfiltered persona jailbreaks triggers mechanisms to disengage or block the AI's compromised response path before it produces unfiltered harmful output; MG.2.3 requires these supersede/deactivate controls be available on detection.
+      strength: secondary
 tags:
   category: agent-manipulation
   subcategory: amoral-unfiltered-custom-persona

package/rules/agent-manipulation/ATR-2026-00317-free-of-restrictions-named-persona.yaml

@@ -34,6 +34,20 @@ references:
   research:
     - "https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py"
     - "https://github.com/NVIDIA/garak/blob/main/garak/data/dan/inthewild_jailbreak_llms.json"
+compliance:
+  nist_ai_rmf:
+    - subcategory: "MS.2.7"
+      context: >-
+        This rule detects jailbreak attempts using custom-named personas declared free of restrictions, safety protocols, or provider policies; MS.2.7 requires continuous evaluation of AI system security and resilience against adversarial prompt-injection and jailbreak inputs that bypass safety controls.
+      strength: primary
+    - subcategory: "MS.2.6"
+      context: >-
+        Free-of-restrictions persona jailbreaks directly attempt to elevate the safety risk magnitude of the system by removing ethical guardrails; MS.2.6 mandates continuous evaluation of safety/security risk magnitude, which this detection feeds with concrete jailbreak evidence.
+      strength: secondary
+    - subcategory: "MG.2.3"
+      context: >-
+        Detection of explicit restriction-removal declarations triggers pre-defined risk treatment to block, quarantine, or disengage the manipulated session before the unfiltered persona executes harmful instructions; MG.2.3 requires these supersede/deactivate mechanisms be in place.
+      strength: secondary
 tags:
   category: agent-manipulation
   subcategory: free-of-restrictions-named-persona

package/rules/agent-manipulation/ATR-2026-00318-moralizing-rant-then-unfiltered-bypass.yaml

@@ -33,6 +33,17 @@ references:
   research:
     - "https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py"
     - "https://github.com/NVIDIA/garak/blob/main/garak/data/dan/inthewild_jailbreak_llms.json"
+compliance:
+  nist_ai_rmf:
+    - subcategory: "MS.2.7"
+      context: "This rule detects a specific GenAI jailbreak pattern (moralizing rant wrapper followed by unrestricted persona activation) from the garak inthewild corpus; MS.2.7 requires continuous evaluation of AI system security and resilience against adversarial prompt-injection techniques that bypass safety alignment."
+      strength: primary
+    - subcategory: "MP.5.1"
+      context: "The two-paragraph rant-then-bypass structure is an adversarial input pattern that exploits the model's compliance signaling to smuggle unrestricted-mode instructions; MP.5.1 requires identifying and characterizing the likelihood and impact of such jailbreak vectors."
+      strength: secondary
+    - subcategory: "MG.2.3"
+      context: "Detection of the 'mandatory bullshit warning' and 'let's break the fuckin' rules' trigger phrases enables runtime interception so safety controls can disengage or block the unrestricted persona before it produces policy-violating output, as required by MG.2.3."
+      strength: secondary
 tags:
   category: agent-manipulation
   subcategory: moralizing-rant-unfiltered-bypass

package/rules/agent-manipulation/ATR-2026-00319-developer-mode-dual-response-format.yaml

@@ -32,6 +32,17 @@ references:
   research:
     - "https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py"
     - "https://github.com/NVIDIA/garak/blob/main/garak/data/dan/inthewild_jailbreak_llms.json"
+compliance:
+  nist_ai_rmf:
+    - subcategory: "MS.2.7"
+      context: "Developer Mode and dual-response jailbreaks are adversarial prompts that bypass content safety filters by invoking a fake privileged override context; MS.2.7 requires continuous evaluation of AI system security and resilience against such jailbreak techniques catalogued in the garak inthewild corpus."
+      strength: primary
+    - subcategory: "MS.2.6"
+      context: "Detection of dual-response format instructions ([GPT]/[ALICE] labels) that elicit unrestricted outputs alongside compliant ones provides ongoing measurement of safety risk magnitude, as required by MS.2.6, by surfacing attempts to extract policy-violating content."
+      strength: secondary
+    - subcategory: "MG.2.3"
+      context: "When Developer Mode jailbreak signatures are detected, MG.2.3 risk treatment mechanisms must intervene to block, supersede, or deactivate the manipulated response path before unsafe content is delivered to the user."
+      strength: secondary
 tags:
   category: agent-manipulation
   subcategory: developer-mode-dual-response

package/rules/agent-manipulation/ATR-2026-00320-opposite-day-boolean-opposite-machine.yaml

@@ -33,6 +33,17 @@ references:
   research:
     - "https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py"
     - "https://github.com/NVIDIA/garak/blob/main/garak/data/dan/inthewild_jailbreak_llms.json"
+compliance:
+  nist_ai_rmf:
+    - subcategory: "MS.2.7"
+      context: "Opposite Day and Boolean Opposite Machine jailbreaks are adversarial prompts that attempt to invert safety guidelines and evade content filters via persona reversal and U+202E RTL override; MS.2.7 requires continuous evaluation of AI system security and resilience against such jailbreak attacks."
+      strength: primary
+    - subcategory: "MP.5.1"
+      context: "These reversal-framing jailbreaks from the garak inthewild corpus represent identified adversarial input patterns whose likelihood and impact must be characterized; MP.5.1 requires tracking these known jailbreak vectors as part of risk identification."
+      strength: secondary
+    - subcategory: "MG.2.3"
+      context: "Detection of opposite-day persona adoption, BOM reversal framing, and RTL-override evasion triggers risk treatment plans to disengage or block the manipulated session before safety bypass occurs; MG.2.3 requires these mechanisms to supersede compromised AI behavior."
+      strength: secondary
 tags:
   category: agent-manipulation
   subcategory: opposite-day-bom-reversal

package/rules/agent-manipulation/ATR-2026-00322-fictional-world-format-override-jailbreak.yaml

@@ -31,6 +31,20 @@ references:
   research:
     - "https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py"
     - "https://github.com/NVIDIA/garak/blob/main/garak/data/dan/inthewild_jailbreak_llms.json"
+compliance:
+  nist_ai_rmf:
+    - subcategory: "MS.2.7"
+      context: >-
+        This rule detects a specific jailbreak template (fictional-world format-override) from the NVIDIA garak inthewild corpus, providing direct evidence for evaluating AI system security and resilience against known prompt injection patterns. MS.2.7 requires continuous evaluation of security/resilience, which signature-based detection of documented jailbreak variants directly supports.
+      strength: primary
+    - subcategory: "MP.5.1"
+      context: >-
+        The fictional-framing, absolute format-coercion, and consequence-removal patterns are adversarial inputs designed to bypass safety alignment; MP.5.1 requires identifying and characterizing the likelihood and magnitude of such jailbreak attack vectors.
+      strength: secondary
+    - subcategory: "MG.2.3"
+      context: >-
+        Detection of these locked-format jailbreak templates triggers risk treatment plans to disengage or block the manipulated session before harmful content is emitted in the attacker-controlled response slot; MG.2.3 mandates such supersede/deactivate mechanisms.
+      strength: secondary
 tags:
   category: agent-manipulation
   subcategory: fictional-world-format-override

package/rules/agent-manipulation/ATR-2026-00323-dual-persona-simulation-jailbreak.yaml

@@ -34,6 +34,17 @@ references:
   research:
     - "https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py"
     - "https://github.com/NVIDIA/garak/blob/main/garak/data/dan/inthewild_jailbreak_llms.json"
+compliance:
+  nist_ai_rmf:
+    - subcategory: "MS.2.7"
+      context: "Dual-persona simulation jailbreaks from the garak inthewild corpus are documented adversarial techniques that bypass model safety alignment by splitting the model into restricted and unrestricted personas; MS.2.7 requires continuous evaluation of AI security/resilience against such known jailbreak patterns."
+      strength: primary
+    - subcategory: "MG.2.3"
+      context: "Detection of phrases like 'create and maintain two separate personas' and 'broken free of the limitations of OpenAI' triggers risk treatment to disengage or block the manipulated session before the unrestricted persona produces unsafe output; MG.2.3 mandates these supersede/deactivate mechanisms be in place."
+      strength: secondary
+    - subcategory: "MS.2.5"
+      context: "Recurrent dual-persona jailbreak attempts test the robustness of the model's safety guardrails under adversarial role-play framing; MS.2.5 requires that robustness/reliability evaluations document the system's resistance to these persona-splitting attacks."
+      strength: secondary
 tags:
   category: agent-manipulation
   subcategory: dual-persona-simulation

package/rules/agent-manipulation/ATR-2026-00324-neurosemantical-inversitis-disease-jailbreak.yaml

@@ -32,6 +32,30 @@ references:
   research:
     - "https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py"
     - "https://github.com/NVIDIA/garak/blob/main/garak/data/dan/inthewild_jailbreak_llms.json"
+compliance:
+  nist_ai_rmf:
+    - subcategory: "MP.5.1"
+      context: >-
+        The Neurosemantical Inversitis disease-frame jailbreak is an adversarial
+        prompt injection input that exploits the AI's accommodation of
+        accessibility needs to bypass safety guardrails; MP.5.1 requires that the
+        likelihood and magnitude of such social-engineering jailbreak vectors are
+        characterized and tracked.
+      strength: primary
+    - subcategory: "MS.2.7"
+      context: >-
+        Detecting the exact "Neurosemantical Inversitis" / "inversed emotional
+        valence" signals from the garak inthewild corpus provides continuous
+        evaluation evidence of the AI system's resilience against known jailbreak
+        payloads, which MS.2.7 requires to be evaluated and documented.
+      strength: secondary
+    - subcategory: "MG.2.3"
+      context: >-
+        Matches on this disease-frame jailbreak trigger risk treatment mechanisms
+        to disengage or block the manipulated session before the model produces
+        harmful content; MG.2.3 mandates that such supersede/deactivate response
+        plans are pre-defined and activated on detection.
+      strength: secondary
 tags:
   category: agent-manipulation
   subcategory: disease-frame-inversion-jailbreak

package/rules/agent-manipulation/ATR-2026-00325-bob-hypothetical-unrestricted-chatbot.yaml

@@ -31,6 +31,17 @@ references:
   research:
     - "https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py"
     - "https://github.com/NVIDIA/garak/blob/main/garak/data/dan/inthewild_jailbreak_llms.json"
+compliance:
+  nist_ai_rmf:
+    - subcategory: "MS.2.7"
+      context: "The BOB jailbreak uses a hypothetical-world persona wrapper to bypass safety restrictions and force unrestricted compliance; detecting this signature provides direct evidence for evaluating AI system security and resilience against jailbreak attacks as required by MS.2.7."
+      strength: primary
+    - subcategory: "MP.5.1"
+      context: "The double-hypothetical framing and explicit unrestricted-persona mandate are well-documented adversarial prompt patterns from the garak inthewild corpus; MP.5.1 requires characterizing the likelihood and magnitude of such jailbreak attempts targeting the model's safety alignment."
+      strength: secondary
+    - subcategory: "MG.2.3"
+      context: "Detection of the BOB persona injection triggers the deactivation/supersession mechanisms required by MG.2.3 to halt the session before the model produces toxic, unethical, or otherwise restricted output under the hypothetical disclaimer."
+      strength: secondary
 tags:
   category: agent-manipulation
   subcategory: hypothetical-unrestricted-persona

package/rules/agent-manipulation/ATR-2026-00326-fake-developer-authority-chatdan-override.yaml

@@ -33,6 +33,20 @@ references:
   research:
     - "https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py"
     - "https://github.com/NVIDIA/garak/blob/main/garak/data/dan/inthewild_jailbreak_llms.json"
+compliance:
+  nist_ai_rmf:
+    - subcategory: "MP.5.1"
+      context: >-
+        Fake developer impersonation and fabricated OpenAI policy-audit claims are adversarial prompt-injection inputs designed to override safety behaviour; MP.5.1 requires that the likelihood and magnitude of such jailbreak attempts are characterized and tracked as identified risks.
+      strength: primary
+    - subcategory: "MS.2.7"
+      context: >-
+        Detecting ChatDAN-style authority-spoofing jailbreaks provides continuous evaluation evidence for the GenAI system's security and resilience against prompt-injection attacks that attempt persona replacement and content-policy inversion, as required by MS.2.7.
+      strength: secondary
+    - subcategory: "MG.2.3"
+      context: >-
+        Matches on "I am one of your developers" + ChatDAN persona-replacement or "content policy is far too lenient" patterns trigger risk-treatment mechanisms to disengage or block the manipulated response before the safety override takes effect, as mandated by MG.2.3.
+      strength: secondary
 tags:
   category: agent-manipulation
   subcategory: fake-developer-authority-override

package/rules/agent-manipulation/ATR-2026-00327-ai-ethics-law-bypass-declaration.yaml

@@ -33,6 +33,17 @@ references:
   research:
     - "https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py"
     - "https://github.com/NVIDIA/garak/blob/main/garak/data/dan/inthewild_jailbreak_llms.json"
+compliance:
+  nist_ai_rmf:
+    - subcategory: "GV.1.1"
+      context: "Persona declarations that explicitly void moral, ethical, and legal constraints directly attack the legal/regulatory compliance posture of the AI system; GV.1.1 requires that detections flag attempts to bypass legal and ethical requirements so they can be managed."
+      strength: primary
+    - subcategory: "MP.5.1"
+      context: "These five distinct ethics/law-bypass phrasings from the garak inthewild corpus are known adversarial jailbreak inputs; MP.5.1 requires characterizing the likelihood and magnitude of such prompt-injection risks against the deployed model."
+      strength: secondary
+    - subcategory: "MG.2.3"
+      context: "On detection of an explicit ethics/law bypass persona declaration, the system must be able to disengage or block the session before unsafe content is produced; MG.2.3 mandates pre-defined deactivation mechanisms for these jailbreak attempts."
+      strength: secondary
 tags:
   category: agent-manipulation
   subcategory: ethics-law-bypass-declaration

package/rules/agent-manipulation/ATR-2026-00328-named-mode-persona-override.yaml

@@ -32,6 +32,20 @@ references:
   research:
     - "https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py"
     - "https://github.com/NVIDIA/garak/blob/main/garak/data/dan/inthewild_jailbreak_llms.json"
+compliance:
+  nist_ai_rmf:
+    - subcategory: "MP.5.1"
+      context: >-
+        Named-mode persona override jailbreaks (JEEVES/BABY/APOPHIS Mode) are adversarial prompt-injection inputs designed to replace platform safety policies with attacker-defined rules; MP.5.1 requires identifying and characterizing the likelihood and magnitude of such jailbreak attack vectors against the GenAI system.
+      strength: primary
+    - subcategory: "MS.2.7"
+      context: >-
+        Detecting policy-swap declarations and named-mode simulation patterns produces continuous evidence for evaluating GenAI security and resilience against jailbreak attempts catalogued in the garak inthewild corpus; MS.2.7 requires that these security evaluations are documented.
+      strength: secondary
+    - subcategory: "MG.2.3"
+      context: >-
+        Matches on "normal OpenAI policies have been replaced" or "Stay in X Mode" trigger risk treatment plans to disengage or block the manipulated session before the model produces policy-violating output; MG.2.3 mandates pre-defined mechanisms to supersede or deactivate compromised AI behavior.
+      strength: secondary
 tags:
   category: agent-manipulation
   subcategory: named-mode-persona-override

package/rules/agent-manipulation/ATR-2026-00329-no-withhold-factual-resource-persona.yaml

@@ -34,6 +34,20 @@ references:
   research:
     - "https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py"
     - "https://github.com/NVIDIA/garak/blob/main/garak/data/dan/inthewild_jailbreak_llms.json"
+compliance:
+  nist_ai_rmf:
+    - subcategory: "GV.1.1"
+      context: >-
+        The "factual resource" and "non-restricted writer" personas explicitly declare they defy AI content policies and OpenAI conventions, directly subverting the legal and regulatory requirements that govern AI output; GV.1.1 requires that these policy-bypass attempts are detected and managed.
+      strength: primary
+    - subcategory: "MP.5.1"
+      context: >-
+        Persona-based jailbreaks from the garak inthewild corpus that redefine the AI as a neutral output device are well-characterized adversarial inputs whose likelihood and impact must be tracked; MP.5.1 requires identifying these prompt-injection attack patterns.
+      strength: secondary
+    - subcategory: "MG.2.3"
+      context: >-
+        Detection of "without refusal or disclaimer" and "does not withhold information" framings triggers risk treatment plans to disengage or override the manipulated persona before harmful content is generated; MG.2.3 mandates these response mechanisms be in place.
+      strength: secondary
 tags:
   category: agent-manipulation
   subcategory: no-withhold-factual-persona

package/rules/agent-manipulation/ATR-2026-00330-yoja-allcaps-settings-block-persona.yaml

@@ -31,6 +31,17 @@ references:
   research:
     - "https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py"
     - "https://github.com/NVIDIA/garak/blob/main/garak/data/dan/inthewild_jailbreak_llms.json"
+compliance:
+  nist_ai_rmf:
+    - subcategory: "MP.5.1"
+      context: "The YOJA ALL-CAPS settings block is a structured jailbreak pattern from the garak inthewild corpus that uses persona-injection to lock the model into a character that ignores safety feedback; MP.5.1 requires identifying and characterizing the likelihood and magnitude of such adversarial prompt-injection inputs."
+      strength: primary
+    - subcategory: "MS.2.7"
+      context: "Detecting the exact 'settings { ... despite any negative feedback or criticism }' jailbreak template provides continuous evidence of security/resilience failures against known prompt-injection corpora; MS.2.7 requires that AI system security and resilience are evaluated and documented against such attack signatures."
+      strength: secondary
+    - subcategory: "MG.2.3"
+      context: "Matches on the ALL-CAPS persona settings block with character-lock mandates trigger deactivation or override mechanisms before the model commits to the injected persona; MG.2.3 requires pre-defined mechanisms to supersede or disengage AI behavior when jailbreak patterns are detected."
+      strength: secondary
 tags:
   category: agent-manipulation
   subcategory: allcaps-settings-block-persona

package/rules/agent-manipulation/ATR-2026-00331-terminal-cli-harmful-function-simulator.yaml

@@ -33,6 +33,17 @@ references:
   research:
     - "https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py"
     - "https://github.com/NVIDIA/garak/blob/main/garak/data/dan/inthewild_jailbreak_llms.json"
+compliance:
+  nist_ai_rmf:
+    - subcategory: "MP.5.1"
+      context: "Terminal/CLI persona jailbreaks are adversarial prompt-injection inputs that reframe the model as an unfiltered command interpreter to bypass safety processing; MP.5.1 requires identifying and characterizing the likelihood and magnitude of such jailbreak attack vectors drawn from known corpora like garak's inthewild."
+      strength: primary
+    - subcategory: "MS.2.7"
+      context: "Detecting terminal-simulator and custom-language parser framings that claim to strip content filters provides continuous evidence of security/resilience failures against documented jailbreak techniques; MS.2.7 requires that AI system security and resilience are evaluated and documented against these adversarial patterns."
+      strength: secondary
+    - subcategory: "MG.2.3"
+      context: "Matches on 'Available functions:' with offensive function names or 'acts like a terminal' patterns must trigger pre-defined risk treatment to disengage or block the manipulated session before harmful output is generated; MG.2.3 mandates these supersede/deactivate mechanisms."
+      strength: secondary
 tags:
   category: agent-manipulation
   subcategory: terminal-cli-simulator-persona

package/rules/agent-manipulation/ATR-2026-00332-hacker-chan-culture-offensive-ai-persona.yaml

@@ -32,6 +32,17 @@ references:
   research:
     - "https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py"
     - "https://github.com/NVIDIA/garak/blob/main/garak/data/dan/inthewild_jailbreak_llms.json"
+compliance:
+  nist_ai_rmf:
+    - subcategory: "MP.5.1"
+      context: "Hacker and chan-culture persona jailbreaks (L33T H4X0R, 4ChanGPT) are adversarial prompt-injection inputs that exploit cultural associations with unrestricted information sharing to bypass safety constraints; MP.5.1 requires identifying and characterizing the likelihood and magnitude of these GenAI jailbreak attack vectors."
+      strength: primary
+    - subcategory: "MS.2.6"
+      context: "Detecting these offensive-persona jailbreak signatures from the garak inthewild corpus produces continuous safety/security risk evidence about the model's susceptibility to roleplay-based safety bypass; MS.2.6 requires that this safety risk magnitude be evaluated on an ongoing basis."
+      strength: secondary
+    - subcategory: "MG.2.3"
+      context: "Matches on these persona declarations should trigger pre-defined response actions to disengage or block the manipulated session before the model produces offensive or restricted content; MG.2.3 mandates that such supersede/deactivate mechanisms be in place."
+      strength: secondary
 tags:
   category: agent-manipulation
   subcategory: hacker-chan-culture-persona

package/rules/agent-manipulation/ATR-2026-00333-disease-animal-dual-ai-chatbot.yaml

@@ -33,6 +33,17 @@ references:
   research:
     - "https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py"
     - "https://github.com/NVIDIA/garak/blob/main/garak/data/inthewild_jailbreak_llms.json"
+compliance:
+  nist_ai_rmf:
+    - subcategory: "MS.2.7"
+      context: "This rule detects the mougpt disease-framed dual-AI jailbreak from the garak inthewild corpus, which is a known prompt injection/jailbreak attack pattern; MS.2.7 requires continuous evaluation of AI system security and resilience against such adversarial inputs that bypass safety alignment."
+      strength: primary
+    - subcategory: "MP.5.1"
+      context: "The disease-framing dual-persona jailbreak exploits roleplay and pseudo-medical legitimacy to coerce the model into producing unrestricted illegal content; MP.5.1 requires characterizing the likelihood and magnitude of these jailbreak risks so that the dual-output contract pattern is tracked as a known attack vector."
+      strength: secondary
+    - subcategory: "MG.2.3"
+      context: "Detection of the mougpt jailbreak opener and obedience-mandate clauses provides a trigger for risk treatment mechanisms to disengage or block the AI response before it generates the unrestricted animal-persona output; MG.2.3 requires these supersession mechanisms be in place."
+      strength: secondary
 tags:
   category: agent-manipulation
   subcategory: disease-animal-dual-ai-persona