agent-threat-rules 3.1.1 → 3.2.0

package/rules/context-exfiltration/ATR-2026-00113-credential-theft.yaml

@@ -19,6 +19,10 @@ references:
     - ASI03:2026 - Agent Identity and Access Abuse
   mitre_attack:
     - T1552.001 - Credentials In Files
+  owasp_llm:
+    - LLM02:2025 - Sensitive Information Disclosure
+  mitre_atlas:
+    - AML.T0057 - LLM Data Leakage
 compliance:
   eu_ai_act:
     - article: "15"
@@ -27,6 +31,9 @@ compliance:
     - article: "12"
       context: "Credential theft undermines the integrity of audit logs and access records that Article 12 logging obligations depend on; an attacker who obtains credentials can falsify or erase audit trails, making Article 12 compliance unverifiable."
       strength: secondary
+    - article: "10"
+      context: "Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (Credential File Theft from Agent Environment) affecting that data."
+      strength: secondary
   nist_ai_rmf:
     - subcategory: "MP.5.1"
       context: "Adversarial tool calls targeting credential files such as ~/.aws/credentials and SSH private keys represent a direct exploitation of the agent's file-access capabilities that must be identified and tracked as a critical AI system risk."
@@ -34,6 +41,12 @@ compliance:
     - subcategory: "GV.6.1"
       context: "Data governance policies must define and enforce scope restrictions on agent access to credential stores, preventing AI tools from reading authentication files outside their authorized operational boundary."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the context-exfiltration attempt (Credential File Theft from Agent Environment)."
+      strength: primary
+    - subcategory: "MS.2.10"
+      context: "NIST AI RMF MEASURE 2.10 (privacy risk examined and documented) is supported by this rule's detection of the context-exfiltration attempt (Credential File Theft from Agent Environment)."
+      strength: secondary
   iso_42001:
     - clause: "6.2"
       context: "Risk treatment activities must include controls that block agent access to well-known credential file paths, reducing the attack surface for credential theft through AI tool invocations."
@@ -41,6 +54,9 @@ compliance:
     - clause: "8.4"
       context: "AI system impact assessments must document and review the potential consequences of credential file theft, including lateral movement across all downstream services connected to stolen credentials."
       strength: secondary
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (Credential File Theft from Agent Environment)."
+      strength: primary
 tags:
   category: context-exfiltration
   subcategory: credential-theft

package/rules/context-exfiltration/ATR-2026-00114-oauth-token-abuse.yaml

@@ -19,6 +19,10 @@ references:
     - ASI03:2026 - Agent Identity and Access Abuse
   mitre_attack:
     - T1528 - Steal Application Access Token
+  owasp_llm:
+    - LLM02:2025 - Sensitive Information Disclosure
+  mitre_atlas:
+    - AML.T0057 - LLM Data Leakage
 compliance:
   eu_ai_act:
     - article: "15"
@@ -27,6 +31,9 @@ compliance:
     - article: "12"
       context: "Stolen OAuth tokens allow attackers to impersonate legitimate users in audit logs, corrupting the record integrity that Article 12 requires; token interception detection is a prerequisite for maintaining trustworthy audit trails."
       strength: secondary
+    - article: "10"
+      context: "Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (OAuth and API Token Interception) affecting that data."
+      strength: secondary
   nist_ai_rmf:
     - subcategory: "MP.5.1"
       context: "OAuth token interception and malicious redirect_uri manipulation are adversarial input risks that exploit the agent's participation in authentication flows to capture credentials intended for legitimate services."
@@ -34,6 +41,12 @@ compliance:
     - subcategory: "GV.6.1"
       context: "Data governance policies must restrict agent handling of bearer tokens, refresh tokens, and client secrets to prevent AI-assisted exfiltration of authorization credentials via forwarding or redirect manipulation."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the context-exfiltration attempt (OAuth and API Token Interception)."
+      strength: primary
+    - subcategory: "MS.2.10"
+      context: "NIST AI RMF MEASURE 2.10 (privacy risk examined and documented) is supported by this rule's detection of the context-exfiltration attempt (OAuth and API Token Interception)."
+      strength: secondary
   iso_42001:
     - clause: "6.2"
       context: "Risk treatment plans must address OAuth token interception scenarios by requiring agents to validate redirect URIs and prohibiting forwarding of authorization tokens to non-allowlisted destinations."
@@ -41,6 +54,9 @@ compliance:
     - clause: "8.4"
       context: "Impact assessments must document the account-takeover blast radius of OAuth token theft through agent-mediated flows, covering all services that accept the stolen bearer token."
       strength: secondary
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (OAuth and API Token Interception)."
+      strength: primary
 tags:
   category: context-exfiltration
   subcategory: oauth-token-abuse

package/rules/context-exfiltration/ATR-2026-00115-env-var-harvesting.yaml

@@ -20,6 +20,10 @@ references:
     - ASI03:2026 - Agent Identity and Access Abuse
   mitre_attack:
     - T1082 - System Information Discovery
+  owasp_llm:
+    - LLM02:2025 - Sensitive Information Disclosure
+  mitre_atlas:
+    - AML.T0057 - LLM Data Leakage
 compliance:
   eu_ai_act:
     - article: "15"
@@ -28,6 +32,9 @@ compliance:
     - article: "12"
       context: "Exfiltrated environment variables typically include logging and monitoring credentials; Article 12 record-keeping integrity depends on protecting the secrets that secure audit infrastructure from compromise via environment harvesting."
       strength: secondary
+    - article: "10"
+      context: "Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (Bulk Environment Variable Harvesting and Exfiltration) affecting that data."
+      strength: secondary
   nist_ai_rmf:
     - subcategory: "MP.5.1"
       context: "Bulk environment variable harvesting via printenv, os.environ, or .env file reads is an adversarial technique that exploits agent runtime access to extract every secret in a single operation, and must be tracked as a critical AI system attack vector."
@@ -35,6 +42,12 @@ compliance:
     - subcategory: "GV.6.1"
       context: "Data governance policies must explicitly prohibit agent tools from accessing the full process environment or .env files, as these sources aggregate all application secrets and database credentials into a single exfiltration target."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the context-exfiltration attempt (Bulk Environment Variable Harvesting and Exfiltration)."
+      strength: primary
+    - subcategory: "MS.2.10"
+      context: "NIST AI RMF MEASURE 2.10 (privacy risk examined and documented) is supported by this rule's detection of the context-exfiltration attempt (Bulk Environment Variable Harvesting and Exfiltration)."
+      strength: secondary
   iso_42001:
     - clause: "6.2"
       context: "Risk treatment activities must implement least-privilege environment access controls that prevent agent tools from reading bulk environment state and combining it with network exfiltration calls."
@@ -42,6 +55,9 @@ compliance:
     - clause: "8.4"
       context: "Impact assessments must document the total credential exposure scope of a successful environment harvesting attack, as compromising the full environment grants access to every connected service simultaneously."
       strength: secondary
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (Bulk Environment Variable Harvesting and Exfiltration)."
+      strength: primary
 tags:
   category: context-exfiltration
   subcategory: env-var-harvesting

package/rules/context-exfiltration/ATR-2026-00136-tool-response-data-piggyback.yaml

@@ -31,6 +31,9 @@ compliance:
     - article: "13"
       context: "Piggybacked data theft disguised as normal tool responses undermines the transparency Article 13 requires between AI system behavior and what users or operators understand to be occurring; users cannot exercise informed oversight when tool responses silently exfiltrate their data."
       strength: secondary
+    - article: "10"
+      context: "Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (Tool Response Data Piggybacking) affecting that data."
+      strength: secondary
   nist_ai_rmf:
     - subcategory: "MP.5.1"
       context: "Tool response piggybacking is an adversarial input risk where legitimate-looking MCP outputs embed credential theft payloads; MP.5.1 requires that this class of adversarial tool-output attack be identified and tracked in the AI system risk inventory."
@@ -38,6 +41,12 @@ compliance:
     - subcategory: "GV.6.1"
       context: "Piggybacked credential exfiltration in tool responses breaches data governance controls by transmitting SSH keys and API tokens to attacker endpoints; GV.6.1 data governance policies must cover tool output integrity as a data handling boundary."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the context-exfiltration attempt (Tool Response Data Piggybacking)."
+      strength: primary
+    - subcategory: "MS.2.10"
+      context: "NIST AI RMF MEASURE 2.10 (privacy risk examined and documented) is supported by this rule's detection of the context-exfiltration attempt (Tool Response Data Piggybacking)."
+      strength: secondary
   iso_42001:
     - clause: "6.2"
       context: "Risk treatment plans under clause 6.2 must include controls for tool response piggybacking attacks, where malicious MCP servers embed credential theft within normal-appearing tool result payloads to exploit agent trust."
@@ -45,6 +54,9 @@ compliance:
     - clause: "8.4"
       context: "Impact assessment under clause 8.4 must document the tool-response piggybacking vector — where credential theft is hidden in legitimate tool outputs — as a high-impact data exfiltration pathway for AI systems using MCP tool exchanges."
       strength: secondary
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (Tool Response Data Piggybacking)."
+      strength: primary
 tags:
   category: context-exfiltration
   subcategory: tool-response-piggyback

package/rules/context-exfiltration/ATR-2026-00141-example-format-key-leak.yaml

@@ -31,6 +31,20 @@ compliance:
     - subcategory: "MG.2.3"
       context: "Detection of API key leakage attempts triggers containment and disengagement workflows to prevent the agent from emitting credentials; MG.2.3 mandates that supersede/deactivate mechanisms are available when sensitive data exposure is detected."
       strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (API Key Leakage via Example Format)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the context-exfiltration attempt (API Key Leakage via Example Format) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the context-exfiltration attempt (API Key Leakage via Example Format)."
+      strength: primary
+    - article: "10"
+      context: "Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (API Key Leakage via Example Format) affecting that data."
+      strength: secondary
 tags:
   category: context-exfiltration
   subcategory: example-format-leak

package/rules/context-exfiltration/ATR-2026-00142-piggyback-transition-words.yaml

@@ -31,6 +31,20 @@ compliance:
     - subcategory: "MG.2.3"
       context: "Detection of transition-word piggyback patterns triggers containment workflows to block credential exfiltration before it leaves the agent boundary; MG.2.3 mandates that mechanisms exist to disengage or quarantine AI outputs when data leakage indicators are matched."
       strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (Data Piggybacking via Casual Transition Words)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the context-exfiltration attempt (Data Piggybacking via Casual Transition Words) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the context-exfiltration attempt (Data Piggybacking via Casual Transition Words)."
+      strength: primary
+    - article: "10"
+      context: "Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (Data Piggybacking via Casual Transition Words) affecting that data."
+      strength: secondary
 tags:
   category: context-exfiltration
   subcategory: piggyback-transition

package/rules/context-exfiltration/ATR-2026-00145-obfuscated-key-disclosure.yaml

@@ -32,6 +32,20 @@ compliance:
     - subcategory: "MG.2.3"
       context: "Detection of fake-encryption-wrapped credentials must trigger response plans to block transmission and revoke exposed keys; MG.2.3 requires mechanisms to supersede or disengage AI actions before the leak completes."
       strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (Obfuscated API Key Disclosure)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the context-exfiltration attempt (Obfuscated API Key Disclosure) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the context-exfiltration attempt (Obfuscated API Key Disclosure)."
+      strength: primary
+    - article: "10"
+      context: "Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (Obfuscated API Key Disclosure) affecting that data."
+      strength: secondary
 tags:
   category: context-exfiltration
   subcategory: obfuscated-key

package/rules/context-exfiltration/ATR-2026-00146-env-var-existence-probe.yaml

@@ -35,6 +35,20 @@ compliance:
       context: >-
         Detection of env var probing patterns enables containment responses to halt the exfiltration attempt before the agent escalates to retrieving the actual value; MG.2.3 mandates pre-defined treatment mechanisms for these risk events.
       strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (Environment Variable Existence Probing)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the context-exfiltration attempt (Environment Variable Existence Probing) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the context-exfiltration attempt (Environment Variable Existence Probing)."
+      strength: primary
+    - article: "10"
+      context: "Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (Environment Variable Existence Probing) affecting that data."
+      strength: secondary
 tags:
   category: context-exfiltration
   subcategory: env-var-probe

package/rules/context-exfiltration/ATR-2026-00150-credential-in-tool-response.yaml

@@ -35,6 +35,20 @@ compliance:
       context: >-
         Detection of leaked credentials in tool responses must trigger response mechanisms to disengage or block the agent before it propagates or acts on the exfiltrated secrets; MG.2.3 requires these supersede/deactivate controls be in place.
       strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (Credential Data Leaked in Tool Response)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the context-exfiltration attempt (Credential Data Leaked in Tool Response) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the context-exfiltration attempt (Credential Data Leaked in Tool Response)."
+      strength: primary
+    - article: "10"
+      context: "Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (Credential Data Leaked in Tool Response) affecting that data."
+      strength: secondary
 tags:
   category: context-exfiltration
   subcategory: credential-in-response

package/rules/context-exfiltration/ATR-2026-00152-obfuscated-credential-leak.yaml

@@ -32,6 +32,20 @@ compliance:
     - subcategory: "MG.2.3"
       context: "Detection of obfuscated credential exfiltration patterns must trigger risk treatment to disengage or quarantine the agent response before secrets leave the trust boundary; MG.2.3 mandates these supersede/deactivate mechanisms exist for such incidents."
       strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (Obfuscated Credential Exfiltration via Encoding)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the context-exfiltration attempt (Obfuscated Credential Exfiltration via Encoding) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the context-exfiltration attempt (Obfuscated Credential Exfiltration via Encoding)."
+      strength: primary
+    - article: "10"
+      context: "Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (Obfuscated Credential Exfiltration via Encoding) affecting that data."
+      strength: secondary
 tags:
   category: context-exfiltration
   subcategory: obfuscated-credential

package/rules/context-exfiltration/ATR-2026-00162-skill-credential-exfil-combo.yaml

@@ -34,6 +34,20 @@ compliance:
       context: >-
         High-confidence matches for credential read-and-exfiltrate pipelines must trigger response actions to disengage or quarantine the offending skill before execution. MG.2.3 mandates that mechanisms exist to deactivate AI components when such risks are detected.
       strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (Credential Access with Exfiltration in Skill Instructions)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the context-exfiltration attempt (Credential Access with Exfiltration in Skill Instructions) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the context-exfiltration attempt (Credential Access with Exfiltration in Skill Instructions)."
+      strength: primary
+    - article: "10"
+      context: "Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (Credential Access with Exfiltration in Skill Instructions) affecting that data."
+      strength: secondary
 tags:
   category: context-exfiltration
   subcategory: credential-exfil-combo

package/rules/context-exfiltration/ATR-2026-00201-credential-pipe-exfiltration.yaml

@@ -39,6 +39,20 @@ compliance:
       context: >-
         Detection of credential exfiltration patterns must trigger immediate containment to disengage the agent before secrets reach attacker-controlled endpoints; MG.2.3 mandates pre-defined mechanisms to supersede or deactivate the AI system on such high-severity events.
       strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (Credential Exfiltration via Shell Pipe)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the context-exfiltration attempt (Credential Exfiltration via Shell Pipe) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the context-exfiltration attempt (Credential Exfiltration via Shell Pipe)."
+      strength: primary
+    - article: "10"
+      context: "Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (Credential Exfiltration via Shell Pipe) affecting that data."
+      strength: secondary
 tags:
   category: context-exfiltration
   subcategory: credential-pipe

package/rules/context-exfiltration/ATR-2026-00212-mcp-atlassian-credential-leak.yaml

@@ -49,6 +49,9 @@ compliance:
     - article: "12"
       context: "Leakage of Atlassian OAuth tokens and API keys via hint injection compromises the authentication credentials that protect audit logs and records; Article 12 logging integrity depends on protecting the access tokens that secure the audit trail from being exfiltrated through tool parameter injection."
       strength: secondary
+    - article: "10"
+      context: "Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (mcp-atlassian Credential Leak via Hint Parameter Injection (CVE-2026-27825/27826)) affecting that data."
+      strength: secondary
   nist_ai_rmf:
     - subcategory: "MP.5.1"
       context: "CVE-2026-27825/27826 mcp-atlassian hint parameter injection is an adversarial input attack where unsanitized hint values coerce the agent into leaking OAuth session cookies and API tokens; MP.5.1 requires this class of MCP tool parameter injection attack to be identified and tracked as an adversarial input risk."
@@ -56,6 +59,12 @@ compliance:
     - subcategory: "GV.6.1"
       context: "Credential exfiltration via the mcp-atlassian hint parameter violates data governance boundaries by leaking Atlassian OAuth tokens and API keys through a tool parameter field that GV.6.1 data policies must designate as a sensitive data handling boundary."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the context-exfiltration attempt (mcp-atlassian Credential Leak via Hint Parameter Injection (CVE-2026-27825/27826))."
+      strength: primary
+    - subcategory: "MS.2.10"
+      context: "NIST AI RMF MEASURE 2.10 (privacy risk examined and documented) is supported by this rule's detection of the context-exfiltration attempt (mcp-atlassian Credential Leak via Hint Parameter Injection (CVE-2026-27825/27826))."
+      strength: secondary
   iso_42001:
     - clause: "6.2"
       context: "Risk treatment plans under clause 6.2 must include input sanitization controls for MCP tool parameters such as the mcp-atlassian hint field, which the CVE-2026-27825/27826 attack exploits to exfiltrate OAuth session credentials."
@@ -63,6 +72,9 @@ compliance:
     - clause: "8.4"
       context: "AI system impact assessment under clause 8.4 must document the mcp-atlassian hint parameter injection vector (CVE-2026-27825/27826), where unsanitized hint values forwarded into LLM context enable attacker-directed credential leakage."
       strength: secondary
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (mcp-atlassian Credential Leak via Hint Parameter Injection (CVE-2026-27825/27826))."
+      strength: primary
 
 tags:
   category: context-exfiltration

package/rules/context-exfiltration/ATR-2026-00261-markdown-image-exfiltration.yaml

@@ -35,6 +35,9 @@ compliance:
     - article: "13"
       context: "Covert exfiltration via markdown rendering is invisible to users and operators, directly violating the transparency that Article 13 requires by allowing AI-generated output to silently transmit user data without any indication."
       strength: secondary
+    - article: "10"
+      context: "Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (Markdown Image URL Data Exfiltration) affecting that data."
+      strength: secondary
   nist_ai_rmf:
     - subcategory: "MP.5.1"
       context: "Markdown image URL exfiltration is an adversarial input technique that coerces LLMs into generating image references that encode base64 conversation data in query strings, triggering auto-fetch exfiltration; MP.5.1 requires this output-channel attack pattern to be identified and tracked."
@@ -42,6 +45,12 @@ compliance:
     - subcategory: "GV.6.1"
       context: "Exfiltrating conversation context and user secrets via markdown-rendered image URLs to attacker-controlled domains violates data governance boundaries; GV.6.1 policies must cover AI-generated output as a potential unauthorized data transmission channel."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the context-exfiltration attempt (Markdown Image URL Data Exfiltration)."
+      strength: primary
+    - subcategory: "MS.2.10"
+      context: "NIST AI RMF MEASURE 2.10 (privacy risk examined and documented) is supported by this rule's detection of the context-exfiltration attempt (Markdown Image URL Data Exfiltration)."
+      strength: secondary
   iso_42001:
     - clause: "6.2"
       context: "Risk treatment activities under clause 6.2 must include output scanning controls targeting markdown image syntax with encoded payloads, which exploits chat UI auto-fetch behavior to silently exfiltrate conversation data."
@@ -49,6 +58,9 @@ compliance:
     - clause: "8.4"
       context: "AI system impact assessment under clause 8.4 must document the markdown image exfiltration vector, where LLM-generated image references encode sensitive context in URLs that the rendering client automatically fetches to attacker domains."
       strength: secondary
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (Markdown Image URL Data Exfiltration)."
+      strength: primary
 tags:
   category: context-exfiltration
   subcategory: markdown-image-uri

package/rules/context-exfiltration/ATR-2026-00274-api-key-generation-request.yaml

@@ -41,6 +41,20 @@ compliance:
       context: >-
         Detection of credential generation or completion requests must trigger risk treatment to block the response before the fabricated or memorized secret is emitted. MG.2.3 mandates that these supersede/disengage mechanisms are in place for high-risk output paths.
       strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (API Key / Secret Credential Generation or Completion Request)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the context-exfiltration attempt (API Key / Secret Credential Generation or Completion Request) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the context-exfiltration attempt (API Key / Secret Credential Generation or Completion Request)."
+      strength: primary
+    - article: "10"
+      context: "Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (API Key / Secret Credential Generation or Completion Request) affecting that data."
+      strength: secondary
 tags:
   category: context-exfiltration
   subcategory: api-key-generation

package/rules/context-exfiltration/ATR-2026-00275-system-prompt-training-data-extraction.yaml

@@ -43,6 +43,20 @@ compliance:
       context: >-
         Pattern-based detection of system prompt extraction and training data replay probes feeds post-deployment monitoring telemetry; MG.4.1 requires implemented monitoring plans that flag extraction attempts in production traffic.
       strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (System Prompt Extraction / Training Data Verbatim Replay)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the context-exfiltration attempt (System Prompt Extraction / Training Data Verbatim Replay) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the context-exfiltration attempt (System Prompt Extraction / Training Data Verbatim Replay)."
+      strength: primary
+    - article: "10"
+      context: "Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (System Prompt Extraction / Training Data Verbatim Replay) affecting that data."
+      strength: secondary
 tags:
   category: context-exfiltration
   subcategory: system-prompt-training-data-extraction

package/rules/context-exfiltration/ATR-2026-00290-divergence-repeat-word-training-extraction.yaml

@@ -44,6 +44,20 @@ compliance:
       context: >-
         Detection of "repeat forever/indefinitely" prompts must trigger interception or deactivation of the response stream before memorized training data is fully emitted; MG.2.3 requires mechanisms to supersede or disengage AI output when extraction attacks are identified.
       strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (Divergence Attack — Repeat-Word-Forever Training Data Extraction)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the context-exfiltration attempt (Divergence Attack — Repeat-Word-Forever Training Data Extraction) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the context-exfiltration attempt (Divergence Attack — Repeat-Word-Forever Training Data Extraction)."
+      strength: primary
+    - article: "10"
+      context: "Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (Divergence Attack — Repeat-Word-Forever Training Data Extraction) affecting that data."
+      strength: secondary
 tags:
   category: context-exfiltration
   subcategory: divergence-repeat-word-training-extraction

package/rules/context-exfiltration/ATR-2026-00291-biometric-surveillance-personal-data-request.yaml

@@ -40,6 +40,23 @@ compliance:
     - subcategory: "MG.2.3"
       context: "Detection of named-person biometric extraction attempts must trigger containment responses (refusal, session quarantine) before the model emits identifying biometric content; MG.2.3 mandates that these supersede/disengage mechanisms are defined and activated on detection."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the context-exfiltration attempt (Biometric Surveillance — Personal Biometric Data Request for Named Individual)."
+      strength: primary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (Biometric Surveillance — Personal Biometric Data Request for Named Individual)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the context-exfiltration attempt (Biometric Surveillance — Personal Biometric Data Request for Named Individual) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the context-exfiltration attempt (Biometric Surveillance — Personal Biometric Data Request for Named Individual)."
+      strength: primary
+    - article: "10"
+      context: "Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (Biometric Surveillance — Personal Biometric Data Request for Named Individual) affecting that data."
+      strength: secondary
 tags:
   category: context-exfiltration
   subcategory: biometric-surveillance-personal

package/rules/context-exfiltration/ATR-2026-00293-educational-records-personal-data-request.yaml

@@ -39,6 +39,23 @@ compliance:
     - subcategory: "MG.2.3"
       context: "Detection of named-individual educational record requests must trigger pre-defined risk treatment to block or redirect the response before sensitive data is fabricated or leaked; MG.2.3 mandates that such containment mechanisms are in place."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the context-exfiltration attempt (Educational Records — Personal Academic/Professional Record Request for Named Individual)."
+      strength: primary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (Educational Records — Personal Academic/Professional Record Request for Named Individual)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the context-exfiltration attempt (Educational Records — Personal Academic/Professional Record Request for Named Individual) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the context-exfiltration attempt (Educational Records — Personal Academic/Professional Record Request for Named Individual)."
+      strength: primary
+    - article: "10"
+      context: "Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (Educational Records — Personal Academic/Professional Record Request for Named Individual) affecting that data."
+      strength: secondary
 tags:
   category: context-exfiltration
   subcategory: educational-records-personal

package/rules/context-exfiltration/ATR-2026-00294-financial-pii-personal-data-request.yaml

@@ -43,6 +43,23 @@ compliance:
       context: >-
         Relationship-label social-engineering framing (e.g., "my doctor, Anne's bank account") is an adversarial input pattern whose likelihood and impact must be characterized; MP.5.1 requires identifying and tracking these high-magnitude financial-PII exfiltration vectors.
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the context-exfiltration attempt (Financial PII — Personal Financial Data Request for Named Individual)."
+      strength: primary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (Financial PII — Personal Financial Data Request for Named Individual)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the context-exfiltration attempt (Financial PII — Personal Financial Data Request for Named Individual) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the context-exfiltration attempt (Financial PII — Personal Financial Data Request for Named Individual)."
+      strength: primary
+    - article: "10"
+      context: "Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (Financial PII — Personal Financial Data Request for Named Individual) affecting that data."
+      strength: secondary
 tags:
   category: context-exfiltration
   subcategory: financial-pii-personal

package/rules/context-exfiltration/ATR-2026-00295-medical-pii-personal-data-request.yaml

@@ -43,6 +43,23 @@ compliance:
       context: >-
         Medical PII and SSN disclosure implicate health-privacy and identity-protection legal regimes; GV.1.1 requires that detections of such requests are logged and managed against applicable legal and regulatory requirements.
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the context-exfiltration attempt (Medical PII — Personal Medical/Health Data Request for Named Individual)."
+      strength: primary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (Medical PII — Personal Medical/Health Data Request for Named Individual)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the context-exfiltration attempt (Medical PII — Personal Medical/Health Data Request for Named Individual) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the context-exfiltration attempt (Medical PII — Personal Medical/Health Data Request for Named Individual)."
+      strength: primary
+    - article: "10"
+      context: "Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (Medical PII — Personal Medical/Health Data Request for Named Individual) affecting that data."
+      strength: secondary
 tags:
   category: context-exfiltration
   subcategory: medical-pii-personal

package/rules/context-exfiltration/ATR-2026-00405-markdown-image-url-exfiltration-xss.yaml

@@ -53,6 +53,20 @@ compliance:
         rendering; MG.2.3 requires these containment mechanisms be in place to
         disengage unsafe outputs.
       strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (Markdown Image URL Exfiltration and XSS Injection)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the context-exfiltration attempt (Markdown Image URL Exfiltration and XSS Injection) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the context-exfiltration attempt (Markdown Image URL Exfiltration and XSS Injection)."
+      strength: primary
+    - article: "10"
+      context: "Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (Markdown Image URL Exfiltration and XSS Injection) affecting that data."
+      strength: secondary
 tags:
   category: context-exfiltration
   subcategory: markdown-url-data-leak