agent-threat-rules 3.1.1 → 3.2.0

package/rules/prompt-injection/ATR-2026-00092-consensus-poisoning.yaml

@@ -19,6 +19,8 @@ references:
     - AML.T0010
   mitre_attack:
     - T0010
+  owasp_agentic:
+    - ASI01:2026 - Agent Goal Hijack
 metadata_provenance:
   owasp_llm: auto-generated
 compliance:
@@ -32,6 +34,26 @@ compliance:
     - subcategory: "MG.2.3"
       context: "Detection of consensus poisoning and Sybil attacks must trigger pre-defined risk treatment plans to quarantine fraudulent votes and disengage compromised agents before manipulated decisions are executed; MG.2.3 mandates these supersede/deactivate mechanisms are in place."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the prompt-injection attempt (Multi-Agent Consensus Poisoning and Sybil Attack)."
+      strength: primary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the prompt-injection attempt (Multi-Agent Consensus Poisoning and Sybil Attack)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the prompt-injection attempt (Multi-Agent Consensus Poisoning and Sybil Attack) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the prompt-injection attempt (Multi-Agent Consensus Poisoning and Sybil Attack)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the prompt-injection attempt (Multi-Agent Consensus Poisoning and Sybil Attack)."
+      strength: secondary
+    - article: "14"
+      context: "Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the prompt-injection attempt (Multi-Agent Consensus Poisoning and Sybil Attack) would bypass or undermine that oversight."
+      strength: secondary
 tags:
   category: prompt-injection
   subcategory: consensus-poisoning

package/rules/prompt-injection/ATR-2026-00093-gradual-escalation.yaml

@@ -17,6 +17,8 @@ references:
     - LLM01:2025 - Prompt Injection
   mitre_atlas:
     - AML.T0051
+  owasp_agentic:
+    - ASI01:2026 - Agent Goal Hijack
 metadata_provenance:
   owasp_llm: auto-generated
 compliance:
@@ -33,6 +35,26 @@ compliance:
       context: >-
         Once cumulative escalation is detected, response mechanisms must be able to revoke newly added capabilities or deactivate the agent before normalized malicious functionality is exercised; MG.2.3 mandates these supersede/disengage controls are in place.
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the prompt-injection attempt (Gradual Capability Escalation via Incremental Introduction)."
+      strength: primary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the prompt-injection attempt (Gradual Capability Escalation via Incremental Introduction)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the prompt-injection attempt (Gradual Capability Escalation via Incremental Introduction) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the prompt-injection attempt (Gradual Capability Escalation via Incremental Introduction)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the prompt-injection attempt (Gradual Capability Escalation via Incremental Introduction)."
+      strength: secondary
+    - article: "14"
+      context: "Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the prompt-injection attempt (Gradual Capability Escalation via Incremental Introduction) would bypass or undermine that oversight."
+      strength: secondary
 tags:
   category: prompt-injection
   subcategory: gradual-escalation

package/rules/prompt-injection/ATR-2026-00094-audit-bypass.yaml

@@ -18,6 +18,8 @@ references:
     - LLM01:2025 - Prompt Injection
   mitre_atlas:
     - AML.T0051
+  owasp_agentic:
+    - ASI01:2026 - Agent Goal Hijack
 metadata_provenance:
   owasp_llm: auto-generated
 compliance:
@@ -34,6 +36,23 @@ compliance:
       context: >-
         Identifying staged bypass payloads that attempt to smuggle malicious functionality through the full audit pipeline triggers the deactivation and containment mechanisms MG.2.3 mandates before the malicious code reaches execution.
       strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the prompt-injection attempt (Systematic Multi-Layer Audit System Bypass)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the prompt-injection attempt (Systematic Multi-Layer Audit System Bypass) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the prompt-injection attempt (Systematic Multi-Layer Audit System Bypass)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the prompt-injection attempt (Systematic Multi-Layer Audit System Bypass)."
+      strength: secondary
+    - article: "14"
+      context: "Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the prompt-injection attempt (Systematic Multi-Layer Audit System Bypass) would bypass or undermine that oversight."
+      strength: secondary
 tags:
   category: prompt-injection
   subcategory: systematic-audit-bypass

package/rules/prompt-injection/ATR-2026-00097-cjk-injection-patterns.yaml

@@ -44,6 +44,23 @@ compliance:
     - subcategory: "MS.2.7"
       context: "Expanding detection coverage to Simplified and Traditional Chinese, Japanese, and Korean patterns evidences continuous evaluation of AI system security/resilience against multilingual adversarial inputs as required by MS.2.7."
       strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the prompt-injection attempt (CJK Prompt Injection - Expanded Chinese/Japanese/Korean Patterns)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the prompt-injection attempt (CJK Prompt Injection - Expanded Chinese/Japanese/Korean Patterns) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the prompt-injection attempt (CJK Prompt Injection - Expanded Chinese/Japanese/Korean Patterns)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the prompt-injection attempt (CJK Prompt Injection - Expanded Chinese/Japanese/Korean Patterns)."
+      strength: secondary
+    - article: "14"
+      context: "Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the prompt-injection attempt (CJK Prompt Injection - Expanded Chinese/Japanese/Korean Patterns) would bypass or undermine that oversight."
+      strength: secondary
 tags:
   category: prompt-injection
   subcategory: cjk-social-engineering

package/rules/prompt-injection/ATR-2026-00104-persona-hijacking.yaml

@@ -35,6 +35,26 @@ compliance:
     - subcategory: "MG.2.3"
       context: "Detection of mandatory persona adoption and instruction replacement patterns must trigger predefined risk treatment to disengage or block the offending tool before the agent's identity and guardrails are subverted; MG.2.3 mandates these supersede/deactivate mechanisms."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the prompt-injection attempt (Persona Hijacking via Mandatory System Prompt Override)."
+      strength: primary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the prompt-injection attempt (Persona Hijacking via Mandatory System Prompt Override)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the prompt-injection attempt (Persona Hijacking via Mandatory System Prompt Override) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the prompt-injection attempt (Persona Hijacking via Mandatory System Prompt Override)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the prompt-injection attempt (Persona Hijacking via Mandatory System Prompt Override)."
+      strength: secondary
+    - article: "14"
+      context: "Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the prompt-injection attempt (Persona Hijacking via Mandatory System Prompt Override) would bypass or undermine that oversight."
+      strength: secondary
 tags:
   category: prompt-injection
   subcategory: persona-hijacking

package/rules/prompt-injection/ATR-2026-00130-indirect-authority-claim.yaml

@@ -36,6 +36,26 @@ compliance:
     - subcategory: "GV.1.2"
       context: "Indirect authority claims attempt to subvert the accountability boundaries of the agent by impersonating an authoritative voice within ingested content; GV.1.2 requires that role and authority boundaries are enforced so external content cannot assume directive authority over the agent."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the prompt-injection attempt (Indirect Authority Claim in External Content)."
+      strength: primary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the prompt-injection attempt (Indirect Authority Claim in External Content)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the prompt-injection attempt (Indirect Authority Claim in External Content) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the prompt-injection attempt (Indirect Authority Claim in External Content)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the prompt-injection attempt (Indirect Authority Claim in External Content)."
+      strength: secondary
+    - article: "14"
+      context: "Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the prompt-injection attempt (Indirect Authority Claim in External Content) would bypass or undermine that oversight."
+      strength: secondary
 tags:
   category: prompt-injection
   subcategory: indirect-authority

package/rules/prompt-injection/ATR-2026-00131-fictional-academic-framing.yaml

@@ -34,6 +34,26 @@ compliance:
     - subcategory: "MG.2.3"
       context: "Detection of framing-based jailbreak attempts triggers risk treatment plans to block or quarantine the request before restricted content is generated; MG.2.3 mandates these response mechanisms be in place to disengage unsafe agent behavior."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the prompt-injection attempt (Fictional and Academic Framing Attack)."
+      strength: primary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the prompt-injection attempt (Fictional and Academic Framing Attack)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the prompt-injection attempt (Fictional and Academic Framing Attack) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the prompt-injection attempt (Fictional and Academic Framing Attack)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the prompt-injection attempt (Fictional and Academic Framing Attack)."
+      strength: secondary
+    - article: "14"
+      context: "Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the prompt-injection attempt (Fictional and Academic Framing Attack) would bypass or undermine that oversight."
+      strength: secondary
 tags:
   category: prompt-injection
   subcategory: framing-attack

package/rules/prompt-injection/ATR-2026-00133-paraphrase-injection.yaml

@@ -34,6 +34,23 @@ compliance:
     - subcategory: "MG.2.3"
       context: "Matches on paraphrased override language trigger pre-defined containment actions to disengage or redirect the AI system before the injected instruction takes effect; MG.2.3 requires these supersede/deactivate mechanisms be available on detection."
       strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the prompt-injection attempt (Paraphrased Prompt Injection)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the prompt-injection attempt (Paraphrased Prompt Injection) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the prompt-injection attempt (Paraphrased Prompt Injection)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the prompt-injection attempt (Paraphrased Prompt Injection)."
+      strength: secondary
+    - article: "14"
+      context: "Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the prompt-injection attempt (Paraphrased Prompt Injection) would bypass or undermine that oversight."
+      strength: secondary
 tags:
   category: prompt-injection
   subcategory: paraphrase

package/rules/prompt-injection/ATR-2026-00137-authority-claim-injection.yaml

@@ -34,6 +34,23 @@ compliance:
       context: >-
         Matches on authority-claim injection patterns trigger pre-defined response plans to quarantine or deactivate the affected interaction before the AI executes attacker-supplied overrides; MG.2.3 mandates these supersede/disengage mechanisms.
       strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the prompt-injection attempt (Authority Claim Prompt Injection)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the prompt-injection attempt (Authority Claim Prompt Injection) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the prompt-injection attempt (Authority Claim Prompt Injection)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the prompt-injection attempt (Authority Claim Prompt Injection)."
+      strength: secondary
+    - article: "14"
+      context: "Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the prompt-injection attempt (Authority Claim Prompt Injection) would bypass or undermine that oversight."
+      strength: secondary
 tags:
   category: prompt-injection
   subcategory: authority-claim

package/rules/prompt-injection/ATR-2026-00138-fictional-framing-bypass.yaml

@@ -31,6 +31,26 @@ compliance:
     - subcategory: "MG.2.3"
       context: "Detection of fictional-framing bypass attempts triggers pre-defined risk treatment to disengage or block the manipulated generation path before unsafe content is produced, as required by MG.2.3."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the prompt-injection attempt (Fictional Framing Safety Bypass)."
+      strength: primary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the prompt-injection attempt (Fictional Framing Safety Bypass)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the prompt-injection attempt (Fictional Framing Safety Bypass) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the prompt-injection attempt (Fictional Framing Safety Bypass)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the prompt-injection attempt (Fictional Framing Safety Bypass)."
+      strength: secondary
+    - article: "14"
+      context: "Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the prompt-injection attempt (Fictional Framing Safety Bypass) would bypass or undermine that oversight."
+      strength: secondary
 tags:
   category: prompt-injection
   subcategory: fictional-framing

package/rules/prompt-injection/ATR-2026-00140-indirect-reference-reversal.yaml

@@ -34,6 +34,23 @@ compliance:
       context: >-
         Identification of instruction-reversal probing patterns enables containment mechanisms to disengage or block the agent before it executes inverted (unsafe) versions of its original directives, satisfying MG.2.3's requirement for runtime treatment of adversarial manipulation.
       strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the prompt-injection attempt (Indirect Reference Instruction Reversal)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the prompt-injection attempt (Indirect Reference Instruction Reversal) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the prompt-injection attempt (Indirect Reference Instruction Reversal)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the prompt-injection attempt (Indirect Reference Instruction Reversal)."
+      strength: secondary
+    - article: "14"
+      context: "Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the prompt-injection attempt (Indirect Reference Instruction Reversal) would bypass or undermine that oversight."
+      strength: secondary
 tags:
   category: prompt-injection
   subcategory: indirect-reference-reversal

package/rules/prompt-injection/ATR-2026-00148-language-switch-injection.yaml

@@ -32,6 +32,26 @@ compliance:
     - subcategory: "MG.4.1"
       context: "Crystallized from 216 adversarial samples, this rule operationalizes post-deployment monitoring for cross-lingual injection attempts, providing the ongoing telemetry MG.4.1 mandates for deployed GenAI systems."
       strength: secondary
+    - subcategory: "MG.2.3"
+      context: "NIST AI RMF MANAGE 2.3 (respond to previously unknown identified risks) is supported by this rule, which surfaces the prompt-injection attempt (Multilingual Prompt Injection via Language Switch) so the risk can be treated."
+      strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the prompt-injection attempt (Multilingual Prompt Injection via Language Switch)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the prompt-injection attempt (Multilingual Prompt Injection via Language Switch) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the prompt-injection attempt (Multilingual Prompt Injection via Language Switch)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the prompt-injection attempt (Multilingual Prompt Injection via Language Switch)."
+      strength: secondary
+    - article: "14"
+      context: "Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the prompt-injection attempt (Multilingual Prompt Injection via Language Switch) would bypass or undermine that oversight."
+      strength: secondary
 tags:
   category: prompt-injection
   subcategory: language-switch

package/rules/prompt-injection/ATR-2026-00153-tool-with-embedded-instruction-to-bypass.yaml

@@ -33,6 +33,26 @@ compliance:
     - subcategory: "GV.6.1"
       context: "Malicious tools shipped via MCP represent third-party supplier AI risk; GV.6.1 requires policies that detect and reject third-party tool definitions containing hidden exfiltration directives."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the prompt-injection attempt (Tool with embedded instruction to bypass user confirmation and exfiltrate data)."
+      strength: primary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the prompt-injection attempt (Tool with embedded instruction to bypass user confirmation and exfiltrate data)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the prompt-injection attempt (Tool with embedded instruction to bypass user confirmation and exfiltrate data) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the prompt-injection attempt (Tool with embedded instruction to bypass user confirmation and exfiltrate data)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the prompt-injection attempt (Tool with embedded instruction to bypass user confirmation and exfiltrate data)."
+      strength: secondary
+    - article: "14"
+      context: "Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the prompt-injection attempt (Tool with embedded instruction to bypass user confirmation and exfiltrate data) would bypass or undermine that oversight."
+      strength: secondary
 tags:
   category: tool-poisoning
   subcategory: confirmation-bypass-instruction

package/rules/prompt-injection/ATR-2026-00154-unauthorized-background-task-execution-v.yaml

@@ -32,6 +32,26 @@ compliance:
     - subcategory: "MG.4.1"
       context: "Background tasks executing every 10 seconds during idle periods evade normal interactive oversight, so post-deployment monitoring per MG.4.1 is required to detect and log unauthorized scheduled execution outside user-initiated sessions."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the prompt-injection attempt (Unauthorized Background Task Execution via Cron Job Installation)."
+      strength: primary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the prompt-injection attempt (Unauthorized Background Task Execution via Cron Job Installation)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the prompt-injection attempt (Unauthorized Background Task Execution via Cron Job Installation) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the prompt-injection attempt (Unauthorized Background Task Execution via Cron Job Installation)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the prompt-injection attempt (Unauthorized Background Task Execution via Cron Job Installation)."
+      strength: secondary
+    - article: "14"
+      context: "Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the prompt-injection attempt (Unauthorized Background Task Execution via Cron Job Installation) would bypass or undermine that oversight."
+      strength: secondary
 tags:
   category: skill-compromise
   subcategory: unauthorized-background-execution

package/rules/prompt-injection/ATR-2026-00155-hidden-llm-instructions-in-skill-descrip.yaml

@@ -33,6 +33,29 @@ compliance:
     - subcategory: "MG.3.2"
       context: "Detecting injected instructions inside skill descriptions provides ongoing monitoring evidence for pre-trained model integrations and supplied components used by the agent; MG.3.2 requires monitoring of these third-party model and content artifacts post-integration."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the prompt-injection attempt (Hidden LLM Instructions in Skill Descriptions)."
+      strength: primary
+    - subcategory: "MG.2.3"
+      context: "NIST AI RMF MANAGE 2.3 (respond to previously unknown identified risks) is supported by this rule, which surfaces the prompt-injection attempt (Hidden LLM Instructions in Skill Descriptions) so the risk can be treated."
+      strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the prompt-injection attempt (Hidden LLM Instructions in Skill Descriptions)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the prompt-injection attempt (Hidden LLM Instructions in Skill Descriptions) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the prompt-injection attempt (Hidden LLM Instructions in Skill Descriptions)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the prompt-injection attempt (Hidden LLM Instructions in Skill Descriptions)."
+      strength: secondary
+    - article: "14"
+      context: "Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the prompt-injection attempt (Hidden LLM Instructions in Skill Descriptions) would bypass or undermine that oversight."
+      strength: secondary
 tags:
   category: prompt-injection
   subcategory: hidden-llm-instructions

package/rules/prompt-injection/ATR-2026-00156-ssh-remote-command-execution-with-creden.yaml

@@ -32,6 +32,23 @@ compliance:
     - subcategory: "MG.2.3"
       context: "Detection of weaponizable SSH command templates with credential exposure must trigger containment to prevent unauthorized remote access; MG.2.3 mandates pre-defined mechanisms to disengage or quarantine the offending skill before it is invoked."
       strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the prompt-injection attempt (SSH Remote Command Execution with Credential Exposure)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the prompt-injection attempt (SSH Remote Command Execution with Credential Exposure) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the prompt-injection attempt (SSH Remote Command Execution with Credential Exposure)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the prompt-injection attempt (SSH Remote Command Execution with Credential Exposure)."
+      strength: secondary
+    - article: "14"
+      context: "Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the prompt-injection attempt (SSH Remote Command Execution with Credential Exposure) would bypass or undermine that oversight."
+      strength: secondary
 tags:
   category: privilege-escalation
   subcategory: ssh-credential-exposure

package/rules/prompt-injection/ATR-2026-00163-skill-hidden-override-instruction.yaml

@@ -18,6 +18,8 @@ references:
     - 'LLM01:2025 - Prompt Injection'
   owasp_agentic:
     - 'ASI01:2026 - Agent Behaviour Hijack'
+  mitre_atlas:
+    - AML.T0051 - LLM Prompt Injection
 compliance:
   nist_ai_rmf:
     - subcategory: "MS.2.7"
@@ -29,6 +31,23 @@ compliance:
     - subcategory: "MG.2.3"
       context: "Detection of unconditional approval and confirmation-suppression instructions triggers the disengage/deactivate response paths required by MG.2.3 to prevent the agent from executing under hijacked safety controls."
       strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the prompt-injection attempt (Hidden Override Instructions in Skill Content)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the prompt-injection attempt (Hidden Override Instructions in Skill Content) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the prompt-injection attempt (Hidden Override Instructions in Skill Content)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the prompt-injection attempt (Hidden Override Instructions in Skill Content)."
+      strength: secondary
+    - article: "14"
+      context: "Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the prompt-injection attempt (Hidden Override Instructions in Skill Content) would bypass or undermine that oversight."
+      strength: secondary
 tags:
   category: prompt-injection
   subcategory: skill-hidden-override

package/rules/prompt-injection/ATR-2026-00202-encoding-evasion-homoglyph-synonym.yaml

@@ -33,6 +33,26 @@ compliance:
     - subcategory: "MG.4.2"
       context: "Field-tested evasion patterns derived from skill-sanitizer v2.1 represent measurable continuous improvement of detection coverage; MG.4.2 requires that detection rulesets evolve as new bypass techniques emerge in production."
       strength: secondary
+    - subcategory: "MG.2.3"
+      context: "NIST AI RMF MANAGE 2.3 (respond to previously unknown identified risks) is supported by this rule, which surfaces the prompt-injection attempt (Encoding Evasion via Homoglyphs and Synonym Substitution) so the risk can be treated."
+      strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the prompt-injection attempt (Encoding Evasion via Homoglyphs and Synonym Substitution)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the prompt-injection attempt (Encoding Evasion via Homoglyphs and Synonym Substitution) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the prompt-injection attempt (Encoding Evasion via Homoglyphs and Synonym Substitution)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the prompt-injection attempt (Encoding Evasion via Homoglyphs and Synonym Substitution)."
+      strength: secondary
+    - article: "14"
+      context: "Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the prompt-injection attempt (Encoding Evasion via Homoglyphs and Synonym Substitution) would bypass or undermine that oversight."
+      strength: secondary
 tags:
   category: prompt-injection
   subcategory: encoding-evasion

package/rules/prompt-injection/ATR-2026-00203-context-pollution-skill-description.yaml

@@ -36,6 +36,29 @@ compliance:
     - subcategory: "MG.3.2"
       context: "Detection of polluted skill descriptions feeds the monitoring of pre-trained and third-party model components used in development; MG.3.2 requires ongoing monitoring of these supply-chain artifacts for malicious content before they are integrated into agent workflows."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the prompt-injection attempt (Context Pollution in Skill Descriptions)."
+      strength: primary
+    - subcategory: "MG.2.3"
+      context: "NIST AI RMF MANAGE 2.3 (respond to previously unknown identified risks) is supported by this rule, which surfaces the prompt-injection attempt (Context Pollution in Skill Descriptions) so the risk can be treated."
+      strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the prompt-injection attempt (Context Pollution in Skill Descriptions)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the prompt-injection attempt (Context Pollution in Skill Descriptions) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the prompt-injection attempt (Context Pollution in Skill Descriptions)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the prompt-injection attempt (Context Pollution in Skill Descriptions)."
+      strength: secondary
+    - article: "14"
+      context: "Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the prompt-injection attempt (Context Pollution in Skill Descriptions) would bypass or undermine that oversight."
+      strength: secondary
 tags:
   category: prompt-injection
   subcategory: context-pollution

package/rules/prompt-injection/ATR-2026-00206-hidden-priority-instructions.yaml

@@ -16,6 +16,8 @@ references:
     - "LLM01:2025 - Prompt Injection"
   owasp_agentic:
     - "ASI01:2026 - Agent Behaviour Hijack"
+  mitre_atlas:
+    - AML.T0051 - LLM Prompt Injection
 compliance:
   nist_ai_rmf:
     - subcategory: "MP.5.1"
@@ -27,6 +29,23 @@ compliance:
     - subcategory: "MG.2.3"
       context: "Matches against hidden priority-block instructions trigger risk treatment workflows to quarantine or disable the offending skill before the agent executes the overriding commands; MG.2.3 requires these supersede/deactivate mechanisms be in place."
       strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the prompt-injection attempt (Hidden System Instructions with Priority Override Blocks)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the prompt-injection attempt (Hidden System Instructions with Priority Override Blocks) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the prompt-injection attempt (Hidden System Instructions with Priority Override Blocks)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the prompt-injection attempt (Hidden System Instructions with Priority Override Blocks)."
+      strength: secondary
+    - article: "14"
+      context: "Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the prompt-injection attempt (Hidden System Instructions with Priority Override Blocks) would bypass or undermine that oversight."
+      strength: secondary
 tags:
   category: prompt-injection
   subcategory: hidden-priority-instructions