agent-threat-rules 3.1.1 → 3.2.0

package/rules/tool-poisoning/ATR-2026-00526-claude-code-shell-metachar-in-double-quoted-path.yaml

@@ -51,6 +51,9 @@ compliance:
         Article 15 robustness against manipulation requires defending
         against this specific shell metacharacter bypass class.
       strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the tool-poisoning technique (Claude Code Shell Metacharacter in Double-Quoted File Path)."
+      strength: secondary
   nist_ai_rmf:
     - function: Manage
       subcategory: MG.2.3
@@ -58,12 +61,24 @@ compliance:
         MG.2.3 runtime risk treatment — detecting the metacharacter
         shape blocks the exploit before shell execution.
       strength: primary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (Claude Code Shell Metacharacter in Double-Quoted File Path)."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (Claude Code Shell Metacharacter in Double-Quoted File Path)."
+      strength: secondary
   iso_42001:
     - clause: "8.4"
       context: >
         AIMS impact assessment for AI tool integrations must cover
         path-injection RCE; this rule is the detection control.
       strength: primary
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the tool-poisoning technique (Claude Code Shell Metacharacter in Double-Quoted File Path)."
+      strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (Claude Code Shell Metacharacter in Double-Quoted File Path) as a treatment control."
+      strength: secondary
 
 tags:
   category: tool-poisoning

package/rules/tool-poisoning/ATR-2026-00529-litellm-proxy-sqli-cisa-kev.yaml

@@ -48,6 +48,9 @@ compliance:
         Article 15 robustness — defending AI proxies against SQL injection
         is required for high-risk AI systems with persistent state.
       strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the tool-poisoning technique (LiteLLM Proxy SQL Injection (CVE-2026-42208, CISA KEV 2026-05-08))."
+      strength: secondary
   nist_ai_rmf:
     - function: Manage
       subcategory: MG.2.3
@@ -55,12 +58,24 @@ compliance:
         Runtime risk treatment for AI proxy components includes detection
         of injection metacharacters reaching SQL boundary.
       strength: primary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (LiteLLM Proxy SQL Injection (CVE-2026-42208, CISA KEV 2026-05-08))."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (LiteLLM Proxy SQL Injection (CVE-2026-42208, CISA KEV 2026-05-08))."
+      strength: secondary
   iso_42001:
     - clause: "8.4"
       context: >
         AIMS impact assessment must cover the proxy SQL surface;
         detection events feed the required monitoring trail.
       strength: primary
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the tool-poisoning technique (LiteLLM Proxy SQL Injection (CVE-2026-42208, CISA KEV 2026-05-08))."
+      strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (LiteLLM Proxy SQL Injection (CVE-2026-42208, CISA KEV 2026-05-08)) as a treatment control."
+      strength: secondary
 
 tags:
   category: tool-poisoning

package/rules/tool-poisoning/ATR-2026-00530-ms-agent-shell-tool-unsanitized-argv-rce.yaml

@@ -50,6 +50,9 @@ compliance:
         Article 15 robustness explicitly requires defending agent tool
         wrappers against prompt-to-RCE primitives.
       strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the tool-poisoning technique (ModelScope MS-Agent Shell Tool Unsanitized Argv RCE (CVE-2026-2256))."
+      strength: secondary
   nist_ai_rmf:
     - function: Manage
       subcategory: MG.2.3
@@ -57,6 +60,12 @@ compliance:
         MG.2.3 runtime risk treatment — detection on unsafe shell-tool
         invocation prevents the exploit before shell execution.
       strength: primary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (ModelScope MS-Agent Shell Tool Unsanitized Argv RCE (CVE-2026-2256))."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (ModelScope MS-Agent Shell Tool Unsanitized Argv RCE (CVE-2026-2256))."
+      strength: secondary
   iso_42001:
     - clause: "8.4"
       context: >
@@ -64,6 +73,12 @@ compliance:
         prompt-to-RCE shell vectors; detection events feed the
         monitoring trail.
       strength: primary
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the tool-poisoning technique (ModelScope MS-Agent Shell Tool Unsanitized Argv RCE (CVE-2026-2256))."
+      strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (ModelScope MS-Agent Shell Tool Unsanitized Argv RCE (CVE-2026-2256)) as a treatment control."
+      strength: secondary
 
 tags:
   category: tool-poisoning

package/rules/tool-poisoning/ATR-2026-00531-praisonai-unauthenticated-agent-api.yaml

@@ -62,10 +62,19 @@ compliance:
       function: Govern
       context: "Third-party multi-agent frameworks (including PraisonAI) must be assessed under GV.6.1 supplier risk management for missing-authentication-on-critical-function controls before agent pipelines depend on them."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (PraisonAI Unauthenticated Agent API Exploitation (CVE-2026-44338))."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (PraisonAI Unauthenticated Agent API Exploitation (CVE-2026-44338))."
+      strength: secondary
   iso_42001:
-    - clause: "8.6"
-      context: "Operational controls under clause 8.6 must detect and block tool invocations targeting PraisonAI agent execution endpoints without a verified authentication mechanism."
+    - clause: "8.1"
+      context: "Operational controls under clause 8.1 must detect and block tool invocations targeting PraisonAI agent execution endpoints without a verified authentication mechanism."
       strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (PraisonAI Unauthenticated Agent API Exploitation (CVE-2026-44338)) as a treatment control."
+      strength: secondary
 
 tags:
   category: tool-poisoning

package/rules/tool-poisoning/ATR-2026-00532-apache-doris-mcp-sql-injection.yaml

@@ -58,10 +58,19 @@ compliance:
       function: Govern
       context: "Database MCP servers (including Apache Doris) must be assessed for input validation controls before agent pipelines depend on them."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (Apache Doris MCP Server SQL Injection (CVE-2025-66335))."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (Apache Doris MCP Server SQL Injection (CVE-2025-66335))."
+      strength: secondary
   iso_42001:
-    - clause: "8.6"
-      context: "Operational controls under clause 8.6 must detect SQL injection payloads in MCP tool call arguments before they reach database execution."
+    - clause: "8.1"
+      context: "Operational controls under clause 8.1 must detect SQL injection payloads in MCP tool call arguments before they reach database execution."
       strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (Apache Doris MCP Server SQL Injection (CVE-2025-66335)) as a treatment control."
+      strength: secondary
 
 tags:
   category: tool-poisoning

package/rules/tool-poisoning/ATR-2026-00533-apache-pinot-mcp-unauthenticated-takeover.yaml

@@ -57,10 +57,19 @@ compliance:
       function: Govern
       context: "Database MCP servers must be assessed for missing authentication controls before agent pipelines depend on them."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (Apache Pinot MCP Unauthenticated Remote Cluster Takeover)."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (Apache Pinot MCP Unauthenticated Remote Cluster Takeover)."
+      strength: secondary
   iso_42001:
-    - clause: "8.6"
+    - clause: "8.1"
       context: "Operational controls must detect and block unauthenticated MCP tool invocations targeting Apache Pinot cluster management endpoints."
       strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (Apache Pinot MCP Unauthenticated Remote Cluster Takeover) as a treatment control."
+      strength: secondary
 
 tags:
   category: tool-poisoning

package/rules/tool-poisoning/ATR-2026-00534-alibaba-rds-mcp-unauthenticated-metadata-exfil.yaml

@@ -59,10 +59,19 @@ compliance:
       function: Govern
       context: "Cloud provider MCP tools with unpatched authentication gaps require compensating controls under GV.6.1 supplier risk management."
       strength: primary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (Alibaba RDS MCP Unauthenticated Database Metadata Exfiltration)."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (Alibaba RDS MCP Unauthenticated Database Metadata Exfiltration)."
+      strength: secondary
   iso_42001:
-    - clause: "8.6"
+    - clause: "8.1"
       context: "Operational controls must detect MCP tool calls that would expose Alibaba RDS credentials or schema to unauthenticated callers."
       strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (Alibaba RDS MCP Unauthenticated Database Metadata Exfiltration) as a treatment control."
+      strength: secondary
 
 tags:
   category: tool-poisoning

package/rules/tool-poisoning/ATR-2026-00536-nginx-ui-mcp-unauthenticated-command-execution.yaml

@@ -64,10 +64,19 @@ compliance:
       function: Govern
       context: "Third-party MCP-enabled server tools (including nginx-ui) must be assessed under GV.6.1 supplier risk management for missing-authentication-on-critical-function controls before agent pipelines depend on them."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (nginx-ui MCP Endpoint Unauthenticated Command Execution (CVE-2026-33032))."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (nginx-ui MCP Endpoint Unauthenticated Command Execution (CVE-2026-33032))."
+      strength: secondary
   iso_42001:
-    - clause: "8.6"
-      context: "Operational controls under clause 8.6 must detect and block MCP server registrations or tool invocations targeting nginx-ui command-execution endpoints without a verified authentication mechanism."
+    - clause: "8.1"
+      context: "Operational controls under clause 8.1 must detect and block MCP server registrations or tool invocations targeting nginx-ui command-execution endpoints without a verified authentication mechanism."
       strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (nginx-ui MCP Endpoint Unauthenticated Command Execution (CVE-2026-33032)) as a treatment control."
+      strength: secondary
 
 tags:
   category: tool-poisoning

package/rules/tool-poisoning/ATR-2026-00537-fastmcp-server-name-cmd-injection-windows.yaml

@@ -76,13 +76,22 @@ compliance:
         `[A-Za-z0-9\-_.\ ]` on any MCP server name field that flows into a
         shell-backed installer, mirroring the FastMCP 3.2.0 patch.
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (FastMCP Windows cmd.exe Injection via Server Name Metacharacters (CVE-2025-64340))."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (FastMCP Windows cmd.exe Injection via Server Name Metacharacters (CVE-2025-64340))."
+      strength: secondary
   iso_42001:
-    - clause: "8.6"
+    - clause: "8.1"
       context: >
-        Operational controls under clause 8.6 must detect cmd.exe metacharacters
+        Operational controls under clause 8.1 must detect cmd.exe metacharacters
         in MCP server name fields to prevent installation-time command injection
         on Windows agent infrastructure.
       strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (FastMCP Windows cmd.exe Injection via Server Name Metacharacters (CVE-2025-64340)) as a treatment control."
+      strength: secondary
 
 tags:
   category: tool-poisoning

package/rules/tool-poisoning/ATR-2026-00538-langchain-chatchat-mcp-stdio-unauthenticated-rce.yaml

@@ -85,13 +85,22 @@ compliance:
         management interfaces and deny arbitrary binary values in command
         fields (enforce an allowlist of approved MCP server executables).
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (LangChain-ChatChat Unauthenticated MCP STDIO Server Configuration RCE (CVE-2026-30617))."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (LangChain-ChatChat Unauthenticated MCP STDIO Server Configuration RCE (CVE-2026-30617))."
+      strength: secondary
   iso_42001:
-    - clause: "8.6"
+    - clause: "8.1"
       context: >
         Operational controls must detect and block unauthenticated MCP STDIO
         server registration attempts carrying shell-binary command fields and
         RCE argument patterns.
       strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (LangChain-ChatChat Unauthenticated MCP STDIO Server Configuration RCE (CVE-2026-30617)) as a treatment control."
+      strength: secondary
 
 tags:
   category: tool-poisoning

package/rules/tool-poisoning/ATR-2026-00540-praisonai-parse-mcp-command-cli-injection.yaml

@@ -55,6 +55,9 @@ compliance:
         AI agent CLI interfaces validate user-controlled parameters before any
         subprocess execution.
       strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the tool-poisoning technique (PraisonAI parse_mcp_command() CLI Argument Command Injection (CVE-2026-34935))."
+      strength: secondary
   nist_ai_rmf:
     - subcategory: "MP.5.1"
       context: >
@@ -62,12 +65,21 @@ compliance:
         an adversarial input attack; MP.5.1 requires scanning MCP CLI arguments
         for inline-exec flags and shell metacharacters.
       strength: primary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (PraisonAI parse_mcp_command() CLI Argument Command Injection (CVE-2026-34935))."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (PraisonAI parse_mcp_command() CLI Argument Command Injection (CVE-2026-34935))."
+      strength: secondary
   iso_42001:
-    - clause: "8.6"
+    - clause: "8.1"
       context: >
         Operational controls must detect and block PraisonAI --mcp arguments
         containing shell interpreter inline-exec primitives before process launch.
       strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (PraisonAI parse_mcp_command() CLI Argument Command Injection (CVE-2026-34935)) as a treatment control."
+      strength: secondary
 
 tags:
   category: tool-poisoning

package/rules/tool-poisoning/ATR-2026-00541-agent-zero-mcp-config-command-injection.yaml

@@ -60,6 +60,9 @@ compliance:
         mandate that AI agent configuration interfaces sanitize command parameters
         before execution.
       strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the tool-poisoning technique (Agent Zero MCP Configuration Command Injection via mcp_servers field (CVE-2026-30624))."
+      strength: secondary
   nist_ai_rmf:
     - subcategory: "MP.5.1"
       context: >
@@ -67,13 +70,22 @@ compliance:
         constitute an adversarial input; MP.5.1 requires scanning MCP server config
         for shell-binary command fields and inline-exec argument patterns.
       strength: primary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (Agent Zero MCP Configuration Command Injection via mcp_servers field (CVE-2026-30624))."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (Agent Zero MCP Configuration Command Injection via mcp_servers field (CVE-2026-30624))."
+      strength: secondary
   iso_42001:
-    - clause: "8.6"
+    - clause: "8.1"
       context: >
         Operational controls must detect and block Agent Zero mcp_servers
         configurations containing shell binary command fields before agent
         MCP server initialisation.
       strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (Agent Zero MCP Configuration Command Injection via mcp_servers field (CVE-2026-30624)) as a treatment control."
+      strength: secondary
 
 tags:
   category: tool-poisoning

package/rules/tool-poisoning/ATR-2026-00542-upsonic-mcp-command-allowlist-bypass.yaml

@@ -58,6 +58,9 @@ compliance:
         requirements mandate that AI agent configuration interfaces validate
         command parameters before execution.
       strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the tool-poisoning technique (Upsonic MCP Command Allowlist Bypass RCE (CVE-2026-30625))."
+      strength: secondary
   nist_ai_rmf:
     - subcategory: "MP.5.1"
       context: >
@@ -65,13 +68,22 @@ compliance:
         constitute an adversarial input; MP.5.1 requires scanning MCP server
         config for shell-binary command fields and inline-exec argument patterns.
       strength: primary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (Upsonic MCP Command Allowlist Bypass RCE (CVE-2026-30625))."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (Upsonic MCP Command Allowlist Bypass RCE (CVE-2026-30625))."
+      strength: secondary
   iso_42001:
-    - clause: "8.6"
+    - clause: "8.1"
       context: >
         Operational controls must detect and block Upsonic mcp_servers
         configurations containing shell binary command fields before agent
         MCP server initialisation.
       strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (Upsonic MCP Command Allowlist Bypass RCE (CVE-2026-30625)) as a treatment control."
+      strength: secondary
 
 tags:
   category: tool-poisoning

package/rules/tool-poisoning/ATR-2026-00543-litellm-mcp-server-argv-injection.yaml

@@ -59,6 +59,9 @@ compliance:
         subprocess execution; Article 15 cybersecurity requirements mandate
         that AI proxy server-creation APIs validate command parameters.
       strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the tool-poisoning technique (LiteLLM MCP Server Creation Authenticated argv Injection (CVE-2026-30623))."
+      strength: secondary
   nist_ai_rmf:
     - subcategory: "MP.5.1"
       context: >
@@ -66,13 +69,22 @@ compliance:
         subprocess constitute an adversarial input; MP.5.1 requires scanning
         LiteLLM MCP registration payloads for shell-binary command fields.
       strength: primary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (LiteLLM MCP Server Creation Authenticated argv Injection (CVE-2026-30623))."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (LiteLLM MCP Server Creation Authenticated argv Injection (CVE-2026-30623))."
+      strength: secondary
   iso_42001:
-    - clause: "8.6"
+    - clause: "8.1"
       context: >
         Operational controls must detect and block LiteLLM MCP server
         registration payloads containing shell binary command fields before
         proxy-side subprocess spawning.
       strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (LiteLLM MCP Server Creation Authenticated argv Injection (CVE-2026-30623)) as a treatment control."
+      strength: secondary
 
 tags:
   category: tool-poisoning

package/rules/tool-poisoning/ATR-2026-00544-praisonai-pth-file-path-traversal-rce.yaml

@@ -57,6 +57,9 @@ compliance:
         cybersecurity requirements mandate that AI agent configuration
         interfaces validate file paths to prevent path traversal attacks.
       strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the tool-poisoning technique (PraisonAI MCP Path-Traversal .pth Injection RCE (GHSA-9mqq-jqxf-grvw))."
+      strength: secondary
   nist_ai_rmf:
     - subcategory: "MP.5.1"
       context: >
@@ -64,12 +67,21 @@ compliance:
         constitutes an adversarial input attack; MP.5.1 requires scanning
         MCP file path fields for traversal sequences targeting site-packages.
       strength: primary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (PraisonAI MCP Path-Traversal .pth Injection RCE (GHSA-9mqq-jqxf-grvw))."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (PraisonAI MCP Path-Traversal .pth Injection RCE (GHSA-9mqq-jqxf-grvw))."
+      strength: secondary
   iso_42001:
-    - clause: "8.6"
+    - clause: "8.1"
       context: >
         Operational controls must detect and block MCP configuration payloads
         containing path traversal sequences targeting site-packages directories.
       strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (PraisonAI MCP Path-Traversal .pth Injection RCE (GHSA-9mqq-jqxf-grvw)) as a treatment control."
+      strength: secondary
 
 tags:
   category: tool-poisoning

package/rules/tool-poisoning/ATR-2026-00545-praisonai-tool-override-unauth-rce.yaml

@@ -58,6 +58,9 @@ compliance:
         requirements mandate comprehensive patch coverage for AI agent
         tool-override interfaces.
       strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the tool-poisoning technique (PraisonAI tool_override.py Unauthenticated RCE — CVE-2026-40287 Patch Bypass (CVE-2026-44334))."
+      strength: secondary
   nist_ai_rmf:
     - subcategory: "MP.5.1"
       context: >
@@ -65,12 +68,21 @@ compliance:
         primitives constitute an adversarial input; MP.5.1 requires scanning
         tool_override requests for embedded execution patterns.
       strength: primary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (PraisonAI tool_override.py Unauthenticated RCE — CVE-2026-40287 Patch Bypass (CVE-2026-44334))."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (PraisonAI tool_override.py Unauthenticated RCE — CVE-2026-40287 Patch Bypass (CVE-2026-44334))."
+      strength: secondary
   iso_42001:
-    - clause: "8.6"
+    - clause: "8.1"
       context: >
         Operational controls must detect and block PraisonAI tool_override
         payloads containing code execution primitives before tool dispatch.
       strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (PraisonAI tool_override.py Unauthenticated RCE — CVE-2026-40287 Patch Bypass (CVE-2026-44334)) as a treatment control."
+      strength: secondary
 
 tags:
   category: tool-poisoning

package/rules/tool-poisoning/ATR-2026-00561-fastmcp-vulnerable-to-windows-command-in.yaml

@@ -22,10 +22,38 @@ references:
   - https://github.com/jlowin/fastmcp/security/advisories/GHSA-rj5c-58rq-j5g5
   - https://nvd.nist.gov/vuln/detail/CVE-2025-62801
   - https://github.com/advisories/GHSA-rj5c-58rq-j5g5
+  owasp_llm:
+    - LLM06:2025 - Excessive Agency
+  owasp_agentic:
+    - ASI05:2026 - Unexpected Code Execution
+  mitre_atlas:
+    - AML.T0049 - Exploit Public-Facing Application
 metadata_provenance:
   ghsa: ghsa-sync
   cve: ghsa-sync
   cwe: ghsa-sync
+compliance:
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the tool-poisoning technique (FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the tool-poisoning technique (FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name)."
+      strength: secondary
+  nist_ai_rmf:
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name)."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name)."
+      strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the tool-poisoning technique (FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name)."
+      strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name) as a treatment control."
+      strength: secondary
 tags:
   category: tool-poisoning
   scan_target: runtime

package/rules/tool-poisoning/ATR-2026-00567-mcp-stdio-config-command-injection.yaml

@@ -19,9 +19,37 @@ references:
   - GHSA-v4p8-mg3p-g94g
   external:
   - https://github.com/BerriAI/litellm/security/advisories/GHSA-v4p8-mg3p-g94g
+  owasp_llm:
+    - LLM06:2025 - Excessive Agency
+  owasp_agentic:
+    - ASI05:2026 - Unexpected Code Execution
+  mitre_atlas:
+    - AML.T0049 - Exploit Public-Facing Application
 metadata_provenance:
   cve: human-authored
   cwe: human-authored
+compliance:
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the tool-poisoning technique (MCP stdio server config command injection via unvalidated test endpoints)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the tool-poisoning technique (MCP stdio server config command injection via unvalidated test endpoints)."
+      strength: secondary
+  nist_ai_rmf:
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (MCP stdio server config command injection via unvalidated test endpoints)."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (MCP stdio server config command injection via unvalidated test endpoints)."
+      strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the tool-poisoning technique (MCP stdio server config command injection via unvalidated test endpoints)."
+      strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (MCP stdio server config command injection via unvalidated test endpoints) as a treatment control."
+      strength: secondary
 tags:
   category: tool-poisoning
   scan_target: runtime

package/rules/tool-poisoning/ATR-2026-00568-agent-ssrf-cloud-metadata-file-inclusion.yaml

@@ -20,9 +20,37 @@ references:
   - CWE-552
   external:
   - https://nvd.nist.gov/vuln/detail/CVE-2026-40150
+  owasp_llm:
+    - LLM06:2025 - Excessive Agency
+  owasp_agentic:
+    - ASI05:2026 - Unexpected Code Execution
+  mitre_atlas:
+    - AML.T0049 - Exploit Public-Facing Application
 metadata_provenance:
   cve: human-authored
   cwe: human-authored
+compliance:
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the tool-poisoning technique (Agent SSRF to cloud metadata / file inclusion via unvalidated fetch URL)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the tool-poisoning technique (Agent SSRF to cloud metadata / file inclusion via unvalidated fetch URL)."
+      strength: secondary
+  nist_ai_rmf:
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (Agent SSRF to cloud metadata / file inclusion via unvalidated fetch URL)."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (Agent SSRF to cloud metadata / file inclusion via unvalidated fetch URL)."
+      strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the tool-poisoning technique (Agent SSRF to cloud metadata / file inclusion via unvalidated fetch URL)."
+      strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (Agent SSRF to cloud metadata / file inclusion via unvalidated fetch URL) as a treatment control."
+      strength: secondary
 tags:
   category: tool-poisoning
   scan_target: runtime

package/rules/tool-poisoning/ATR-2026-00572-symjack-symlink-config-redirection.yaml

@@ -43,6 +43,28 @@ references:
   research:
     - "Adversa AI / Rony Utevsky, SymJack, 2026-05-26: https://adversa.ai/blog/the-approval-prompt-is-lying-to-you-symlink-rce-in-five-ai-coding-agents-claude-code-cursor-antigravity-copilot-grok-build/"
     - "SecurityWeek / Kevin Townsend, 2026-05-27: https://www.securityweek.com/symjack-attack-turns-ai-coding-agents-into-supply-chain-attack-delivery-systems/"
+compliance:
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the tool-poisoning technique (SymJack — Symlink Approval-Path Spoofing Redirects Writes into Agent MCP/Config (RCE on Restart))."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the tool-poisoning technique (SymJack — Symlink Approval-Path Spoofing Redirects Writes into Agent MCP/Config (RCE on Restart))."
+      strength: secondary
+  nist_ai_rmf:
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (SymJack — Symlink Approval-Path Spoofing Redirects Writes into Agent MCP/Config (RCE on Restart))."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (SymJack — Symlink Approval-Path Spoofing Redirects Writes into Agent MCP/Config (RCE on Restart))."
+      strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the tool-poisoning technique (SymJack — Symlink Approval-Path Spoofing Redirects Writes into Agent MCP/Config (RCE on Restart))."
+      strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (SymJack — Symlink Approval-Path Spoofing Redirects Writes into Agent MCP/Config (RCE on Restart)) as a treatment control."
+      strength: secondary
 tags:
   category: tool-poisoning
   subcategory: symlink-config-redirection