agent-threat-rules 3.1.1 → 3.3.0

package/rules/prompt-injection/ATR-2026-00088-adaptive-countermeasure.yaml

@@ -17,6 +17,8 @@ references:
     - LLM01:2025 - Prompt Injection
   mitre_atlas:
     - AML.T0051
+  owasp_agentic:
+    - ASI01:2026 - Agent Goal Hijack
 metadata_provenance:
   owasp_llm: auto-generated
 compliance:
@@ -30,6 +32,26 @@ compliance:
     - subcategory: "MG.2.3"
       context: "Adversarial instructions to reset baselines or hide anomalies must trigger pre-defined response plans to disengage or contain the agent before monitoring blind spots enable further compromise; MG.2.3 mandates that such supersede/deactivate mechanisms exist."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the prompt-injection attempt (Adaptive Countermeasure Against Behavioral Monitoring)."
+      strength: primary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the prompt-injection attempt (Adaptive Countermeasure Against Behavioral Monitoring)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the prompt-injection attempt (Adaptive Countermeasure Against Behavioral Monitoring) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the prompt-injection attempt (Adaptive Countermeasure Against Behavioral Monitoring)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the prompt-injection attempt (Adaptive Countermeasure Against Behavioral Monitoring)."
+      strength: secondary
+    - article: "14"
+      context: "Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the prompt-injection attempt (Adaptive Countermeasure Against Behavioral Monitoring) would bypass or undermine that oversight."
+      strength: secondary
 tags:
   category: prompt-injection
   subcategory: monitoring-countermeasure

package/rules/prompt-injection/ATR-2026-00089-polymorphic-skill.yaml

@@ -10,13 +10,15 @@ author: ATR Community (MiroFish Predicted)
 date: 2026/03/11
 schema_version: "0.1"
 detection_tier: pattern
-maturity: test
+maturity: stable
 severity: high
 references:
   owasp_llm:
     - LLM01:2025 - Prompt Injection
   mitre_atlas:
     - AML.T0051
+  owasp_agentic:
+    - ASI01:2026 - Agent Goal Hijack
 metadata_provenance:
   owasp_llm: auto-generated
 compliance:
@@ -30,6 +32,23 @@ compliance:
     - subcategory: "MG.2.3"
       context: "Detection of malicious tool registration or aliased invocation must trigger pre-defined risk treatment to disengage or block the offending capability before execution; MG.2.3 mandates these supersede/deactivate mechanisms be in place."
       strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the prompt-injection attempt (Polymorphic Skill and Capability Aliasing Attack)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the prompt-injection attempt (Polymorphic Skill and Capability Aliasing Attack) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the prompt-injection attempt (Polymorphic Skill and Capability Aliasing Attack)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the prompt-injection attempt (Polymorphic Skill and Capability Aliasing Attack)."
+      strength: secondary
+    - article: "14"
+      context: "Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the prompt-injection attempt (Polymorphic Skill and Capability Aliasing Attack) would bypass or undermine that oversight."
+      strength: secondary
 tags:
   category: prompt-injection
   subcategory: polymorphic-evasion

package/rules/prompt-injection/ATR-2026-00090-threat-intel-exfil.yaml

@@ -17,6 +17,8 @@ references:
     - LLM01:2025 - Prompt Injection
   mitre_atlas:
     - AML.T0051
+  owasp_agentic:
+    - ASI01:2026 - Agent Goal Hijack
 metadata_provenance:
   owasp_llm: auto-generated
 compliance:
@@ -30,6 +32,23 @@ compliance:
     - subcategory: "MG.2.3"
       context: "Detection of rule-enumeration and security-config exfiltration attempts must trigger containment responses before attackers reverse-engineer defenses; MG.2.3 mandates predefined mechanisms to disengage or block the offending session."
       strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the prompt-injection attempt (Threat Intelligence Exfiltration and Rule Enumeration)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the prompt-injection attempt (Threat Intelligence Exfiltration and Rule Enumeration) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the prompt-injection attempt (Threat Intelligence Exfiltration and Rule Enumeration)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the prompt-injection attempt (Threat Intelligence Exfiltration and Rule Enumeration)."
+      strength: secondary
+    - article: "14"
+      context: "Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the prompt-injection attempt (Threat Intelligence Exfiltration and Rule Enumeration) would bypass or undermine that oversight."
+      strength: secondary
 tags:
   category: prompt-injection
   subcategory: intel-exfiltration

package/rules/prompt-injection/ATR-2026-00091-nested-payload.yaml

@@ -10,7 +10,7 @@ author: ATR Community (MiroFish Predicted)
 date: 2026/03/11
 schema_version: "0.1"
 detection_tier: pattern
-maturity: test
+maturity: stable
 severity: critical
 references:
   owasp_llm:
@@ -19,6 +19,8 @@ references:
     - AML.T0051
   mitre_attack:
     - T0051
+  owasp_agentic:
+    - ASI01:2026 - Agent Goal Hijack
 metadata_provenance:
   owasp_llm: auto-generated
 compliance:
@@ -32,6 +34,23 @@ compliance:
     - subcategory: "MG.2.3"
       context: "Detection of nested injection payloads triggers containment workflows to disengage or quarantine the offending request before the LLM executes the smuggled instructions; MG.2.3 mandates that these supersede/deactivate mechanisms are defined and activated upon detection."
       strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the prompt-injection attempt (Advanced Structured Data Injection with Nested Payloads)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the prompt-injection attempt (Advanced Structured Data Injection with Nested Payloads) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the prompt-injection attempt (Advanced Structured Data Injection with Nested Payloads)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the prompt-injection attempt (Advanced Structured Data Injection with Nested Payloads)."
+      strength: secondary
+    - article: "14"
+      context: "Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the prompt-injection attempt (Advanced Structured Data Injection with Nested Payloads) would bypass or undermine that oversight."
+      strength: secondary
 tags:
   category: prompt-injection
   subcategory: nested-data-injection

package/rules/prompt-injection/ATR-2026-00092-consensus-poisoning.yaml

@@ -19,6 +19,8 @@ references:
     - AML.T0010
   mitre_attack:
     - T0010
+  owasp_agentic:
+    - ASI01:2026 - Agent Goal Hijack
 metadata_provenance:
   owasp_llm: auto-generated
 compliance:
@@ -32,6 +34,26 @@ compliance:
     - subcategory: "MG.2.3"
       context: "Detection of consensus poisoning and Sybil attacks must trigger pre-defined risk treatment plans to quarantine fraudulent votes and disengage compromised agents before manipulated decisions are executed; MG.2.3 mandates these supersede/deactivate mechanisms are in place."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the prompt-injection attempt (Multi-Agent Consensus Poisoning and Sybil Attack)."
+      strength: primary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the prompt-injection attempt (Multi-Agent Consensus Poisoning and Sybil Attack)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the prompt-injection attempt (Multi-Agent Consensus Poisoning and Sybil Attack) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the prompt-injection attempt (Multi-Agent Consensus Poisoning and Sybil Attack)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the prompt-injection attempt (Multi-Agent Consensus Poisoning and Sybil Attack)."
+      strength: secondary
+    - article: "14"
+      context: "Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the prompt-injection attempt (Multi-Agent Consensus Poisoning and Sybil Attack) would bypass or undermine that oversight."
+      strength: secondary
 tags:
   category: prompt-injection
   subcategory: consensus-poisoning

package/rules/prompt-injection/ATR-2026-00093-gradual-escalation.yaml

@@ -17,6 +17,8 @@ references:
     - LLM01:2025 - Prompt Injection
   mitre_atlas:
     - AML.T0051
+  owasp_agentic:
+    - ASI01:2026 - Agent Goal Hijack
 metadata_provenance:
   owasp_llm: auto-generated
 compliance:
@@ -33,6 +35,26 @@ compliance:
       context: >-
         Once cumulative escalation is detected, response mechanisms must be able to revoke newly added capabilities or deactivate the agent before normalized malicious functionality is exercised; MG.2.3 mandates these supersede/disengage controls are in place.
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the prompt-injection attempt (Gradual Capability Escalation via Incremental Introduction)."
+      strength: primary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the prompt-injection attempt (Gradual Capability Escalation via Incremental Introduction)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the prompt-injection attempt (Gradual Capability Escalation via Incremental Introduction) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the prompt-injection attempt (Gradual Capability Escalation via Incremental Introduction)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the prompt-injection attempt (Gradual Capability Escalation via Incremental Introduction)."
+      strength: secondary
+    - article: "14"
+      context: "Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the prompt-injection attempt (Gradual Capability Escalation via Incremental Introduction) would bypass or undermine that oversight."
+      strength: secondary
 tags:
   category: prompt-injection
   subcategory: gradual-escalation

package/rules/prompt-injection/ATR-2026-00094-audit-bypass.yaml

@@ -18,6 +18,8 @@ references:
     - LLM01:2025 - Prompt Injection
   mitre_atlas:
     - AML.T0051
+  owasp_agentic:
+    - ASI01:2026 - Agent Goal Hijack
 metadata_provenance:
   owasp_llm: auto-generated
 compliance:
@@ -34,6 +36,23 @@ compliance:
       context: >-
         Identifying staged bypass payloads that attempt to smuggle malicious functionality through the full audit pipeline triggers the deactivation and containment mechanisms MG.2.3 mandates before the malicious code reaches execution.
       strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the prompt-injection attempt (Systematic Multi-Layer Audit System Bypass)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the prompt-injection attempt (Systematic Multi-Layer Audit System Bypass) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the prompt-injection attempt (Systematic Multi-Layer Audit System Bypass)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the prompt-injection attempt (Systematic Multi-Layer Audit System Bypass)."
+      strength: secondary
+    - article: "14"
+      context: "Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the prompt-injection attempt (Systematic Multi-Layer Audit System Bypass) would bypass or undermine that oversight."
+      strength: secondary
 tags:
   category: prompt-injection
   subcategory: systematic-audit-bypass

package/rules/prompt-injection/ATR-2026-00097-cjk-injection-patterns.yaml

@@ -44,6 +44,23 @@ compliance:
     - subcategory: "MS.2.7"
       context: "Expanding detection coverage to Simplified and Traditional Chinese, Japanese, and Korean patterns evidences continuous evaluation of AI system security/resilience against multilingual adversarial inputs as required by MS.2.7."
       strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the prompt-injection attempt (CJK Prompt Injection - Expanded Chinese/Japanese/Korean Patterns)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the prompt-injection attempt (CJK Prompt Injection - Expanded Chinese/Japanese/Korean Patterns) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the prompt-injection attempt (CJK Prompt Injection - Expanded Chinese/Japanese/Korean Patterns)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the prompt-injection attempt (CJK Prompt Injection - Expanded Chinese/Japanese/Korean Patterns)."
+      strength: secondary
+    - article: "14"
+      context: "Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the prompt-injection attempt (CJK Prompt Injection - Expanded Chinese/Japanese/Korean Patterns) would bypass or undermine that oversight."
+      strength: secondary
 tags:
   category: prompt-injection
   subcategory: cjk-social-engineering

package/rules/prompt-injection/ATR-2026-00104-persona-hijacking.yaml

@@ -35,6 +35,26 @@ compliance:
     - subcategory: "MG.2.3"
       context: "Detection of mandatory persona adoption and instruction replacement patterns must trigger predefined risk treatment to disengage or block the offending tool before the agent's identity and guardrails are subverted; MG.2.3 mandates these supersede/deactivate mechanisms."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the prompt-injection attempt (Persona Hijacking via Mandatory System Prompt Override)."
+      strength: primary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the prompt-injection attempt (Persona Hijacking via Mandatory System Prompt Override)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the prompt-injection attempt (Persona Hijacking via Mandatory System Prompt Override) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the prompt-injection attempt (Persona Hijacking via Mandatory System Prompt Override)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the prompt-injection attempt (Persona Hijacking via Mandatory System Prompt Override)."
+      strength: secondary
+    - article: "14"
+      context: "Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the prompt-injection attempt (Persona Hijacking via Mandatory System Prompt Override) would bypass or undermine that oversight."
+      strength: secondary
 tags:
   category: prompt-injection
   subcategory: persona-hijacking

package/rules/prompt-injection/ATR-2026-00130-indirect-authority-claim.yaml

@@ -36,6 +36,26 @@ compliance:
     - subcategory: "GV.1.2"
       context: "Indirect authority claims attempt to subvert the accountability boundaries of the agent by impersonating an authoritative voice within ingested content; GV.1.2 requires that role and authority boundaries are enforced so external content cannot assume directive authority over the agent."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the prompt-injection attempt (Indirect Authority Claim in External Content)."
+      strength: primary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the prompt-injection attempt (Indirect Authority Claim in External Content)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the prompt-injection attempt (Indirect Authority Claim in External Content) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the prompt-injection attempt (Indirect Authority Claim in External Content)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the prompt-injection attempt (Indirect Authority Claim in External Content)."
+      strength: secondary
+    - article: "14"
+      context: "Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the prompt-injection attempt (Indirect Authority Claim in External Content) would bypass or undermine that oversight."
+      strength: secondary
 tags:
   category: prompt-injection
   subcategory: indirect-authority

package/rules/prompt-injection/ATR-2026-00131-fictional-academic-framing.yaml

@@ -34,6 +34,26 @@ compliance:
     - subcategory: "MG.2.3"
       context: "Detection of framing-based jailbreak attempts triggers risk treatment plans to block or quarantine the request before restricted content is generated; MG.2.3 mandates these response mechanisms be in place to disengage unsafe agent behavior."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the prompt-injection attempt (Fictional and Academic Framing Attack)."
+      strength: primary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the prompt-injection attempt (Fictional and Academic Framing Attack)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the prompt-injection attempt (Fictional and Academic Framing Attack) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the prompt-injection attempt (Fictional and Academic Framing Attack)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the prompt-injection attempt (Fictional and Academic Framing Attack)."
+      strength: secondary
+    - article: "14"
+      context: "Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the prompt-injection attempt (Fictional and Academic Framing Attack) would bypass or undermine that oversight."
+      strength: secondary
 tags:
   category: prompt-injection
   subcategory: framing-attack

package/rules/prompt-injection/ATR-2026-00133-paraphrase-injection.yaml

@@ -34,6 +34,23 @@ compliance:
     - subcategory: "MG.2.3"
       context: "Matches on paraphrased override language trigger pre-defined containment actions to disengage or redirect the AI system before the injected instruction takes effect; MG.2.3 requires these supersede/deactivate mechanisms be available on detection."
       strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the prompt-injection attempt (Paraphrased Prompt Injection)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the prompt-injection attempt (Paraphrased Prompt Injection) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the prompt-injection attempt (Paraphrased Prompt Injection)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the prompt-injection attempt (Paraphrased Prompt Injection)."
+      strength: secondary
+    - article: "14"
+      context: "Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the prompt-injection attempt (Paraphrased Prompt Injection) would bypass or undermine that oversight."
+      strength: secondary
 tags:
   category: prompt-injection
   subcategory: paraphrase

package/rules/prompt-injection/ATR-2026-00137-authority-claim-injection.yaml

@@ -34,6 +34,23 @@ compliance:
       context: >-
         Matches on authority-claim injection patterns trigger pre-defined response plans to quarantine or deactivate the affected interaction before the AI executes attacker-supplied overrides; MG.2.3 mandates these supersede/disengage mechanisms.
       strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the prompt-injection attempt (Authority Claim Prompt Injection)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the prompt-injection attempt (Authority Claim Prompt Injection) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the prompt-injection attempt (Authority Claim Prompt Injection)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the prompt-injection attempt (Authority Claim Prompt Injection)."
+      strength: secondary
+    - article: "14"
+      context: "Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the prompt-injection attempt (Authority Claim Prompt Injection) would bypass or undermine that oversight."
+      strength: secondary
 tags:
   category: prompt-injection
   subcategory: authority-claim

package/rules/prompt-injection/ATR-2026-00138-fictional-framing-bypass.yaml

@@ -31,6 +31,26 @@ compliance:
     - subcategory: "MG.2.3"
       context: "Detection of fictional-framing bypass attempts triggers pre-defined risk treatment to disengage or block the manipulated generation path before unsafe content is produced, as required by MG.2.3."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the prompt-injection attempt (Fictional Framing Safety Bypass)."
+      strength: primary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the prompt-injection attempt (Fictional Framing Safety Bypass)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the prompt-injection attempt (Fictional Framing Safety Bypass) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the prompt-injection attempt (Fictional Framing Safety Bypass)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the prompt-injection attempt (Fictional Framing Safety Bypass)."
+      strength: secondary
+    - article: "14"
+      context: "Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the prompt-injection attempt (Fictional Framing Safety Bypass) would bypass or undermine that oversight."
+      strength: secondary
 tags:
   category: prompt-injection
   subcategory: fictional-framing

package/rules/prompt-injection/ATR-2026-00140-indirect-reference-reversal.yaml

@@ -34,6 +34,23 @@ compliance:
       context: >-
         Identification of instruction-reversal probing patterns enables containment mechanisms to disengage or block the agent before it executes inverted (unsafe) versions of its original directives, satisfying MG.2.3's requirement for runtime treatment of adversarial manipulation.
       strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the prompt-injection attempt (Indirect Reference Instruction Reversal)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the prompt-injection attempt (Indirect Reference Instruction Reversal) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the prompt-injection attempt (Indirect Reference Instruction Reversal)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the prompt-injection attempt (Indirect Reference Instruction Reversal)."
+      strength: secondary
+    - article: "14"
+      context: "Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the prompt-injection attempt (Indirect Reference Instruction Reversal) would bypass or undermine that oversight."
+      strength: secondary
 tags:
   category: prompt-injection
   subcategory: indirect-reference-reversal

package/rules/prompt-injection/ATR-2026-00148-language-switch-injection.yaml

@@ -32,6 +32,26 @@ compliance:
     - subcategory: "MG.4.1"
       context: "Crystallized from 216 adversarial samples, this rule operationalizes post-deployment monitoring for cross-lingual injection attempts, providing the ongoing telemetry MG.4.1 mandates for deployed GenAI systems."
       strength: secondary
+    - subcategory: "MG.2.3"
+      context: "NIST AI RMF MANAGE 2.3 (respond to previously unknown identified risks) is supported by this rule, which surfaces the prompt-injection attempt (Multilingual Prompt Injection via Language Switch) so the risk can be treated."
+      strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the prompt-injection attempt (Multilingual Prompt Injection via Language Switch)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the prompt-injection attempt (Multilingual Prompt Injection via Language Switch) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the prompt-injection attempt (Multilingual Prompt Injection via Language Switch)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the prompt-injection attempt (Multilingual Prompt Injection via Language Switch)."
+      strength: secondary
+    - article: "14"
+      context: "Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the prompt-injection attempt (Multilingual Prompt Injection via Language Switch) would bypass or undermine that oversight."
+      strength: secondary
 tags:
   category: prompt-injection
   subcategory: language-switch

package/rules/prompt-injection/ATR-2026-00153-tool-with-embedded-instruction-to-bypass.yaml

@@ -33,6 +33,26 @@ compliance:
     - subcategory: "GV.6.1"
       context: "Malicious tools shipped via MCP represent third-party supplier AI risk; GV.6.1 requires policies that detect and reject third-party tool definitions containing hidden exfiltration directives."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the prompt-injection attempt (Tool with embedded instruction to bypass user confirmation and exfiltrate data)."
+      strength: primary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the prompt-injection attempt (Tool with embedded instruction to bypass user confirmation and exfiltrate data)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the prompt-injection attempt (Tool with embedded instruction to bypass user confirmation and exfiltrate data) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the prompt-injection attempt (Tool with embedded instruction to bypass user confirmation and exfiltrate data)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the prompt-injection attempt (Tool with embedded instruction to bypass user confirmation and exfiltrate data)."
+      strength: secondary
+    - article: "14"
+      context: "Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the prompt-injection attempt (Tool with embedded instruction to bypass user confirmation and exfiltrate data) would bypass or undermine that oversight."
+      strength: secondary
 tags:
   category: tool-poisoning
   subcategory: confirmation-bypass-instruction

package/rules/prompt-injection/ATR-2026-00154-unauthorized-background-task-execution-v.yaml

@@ -32,6 +32,26 @@ compliance:
     - subcategory: "MG.4.1"
       context: "Background tasks executing every 10 seconds during idle periods evade normal interactive oversight, so post-deployment monitoring per MG.4.1 is required to detect and log unauthorized scheduled execution outside user-initiated sessions."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the prompt-injection attempt (Unauthorized Background Task Execution via Cron Job Installation)."
+      strength: primary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the prompt-injection attempt (Unauthorized Background Task Execution via Cron Job Installation)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the prompt-injection attempt (Unauthorized Background Task Execution via Cron Job Installation) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the prompt-injection attempt (Unauthorized Background Task Execution via Cron Job Installation)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the prompt-injection attempt (Unauthorized Background Task Execution via Cron Job Installation)."
+      strength: secondary
+    - article: "14"
+      context: "Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the prompt-injection attempt (Unauthorized Background Task Execution via Cron Job Installation) would bypass or undermine that oversight."
+      strength: secondary
 tags:
   category: skill-compromise
   subcategory: unauthorized-background-execution

package/rules/prompt-injection/ATR-2026-00155-hidden-llm-instructions-in-skill-descrip.yaml

@@ -33,6 +33,29 @@ compliance:
     - subcategory: "MG.3.2"
       context: "Detecting injected instructions inside skill descriptions provides ongoing monitoring evidence for pre-trained model integrations and supplied components used by the agent; MG.3.2 requires monitoring of these third-party model and content artifacts post-integration."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the prompt-injection attempt (Hidden LLM Instructions in Skill Descriptions)."
+      strength: primary
+    - subcategory: "MG.2.3"
+      context: "NIST AI RMF MANAGE 2.3 (respond to previously unknown identified risks) is supported by this rule, which surfaces the prompt-injection attempt (Hidden LLM Instructions in Skill Descriptions) so the risk can be treated."
+      strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the prompt-injection attempt (Hidden LLM Instructions in Skill Descriptions)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the prompt-injection attempt (Hidden LLM Instructions in Skill Descriptions) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the prompt-injection attempt (Hidden LLM Instructions in Skill Descriptions)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the prompt-injection attempt (Hidden LLM Instructions in Skill Descriptions)."
+      strength: secondary
+    - article: "14"
+      context: "Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the prompt-injection attempt (Hidden LLM Instructions in Skill Descriptions) would bypass or undermine that oversight."
+      strength: secondary
 tags:
   category: prompt-injection
   subcategory: hidden-llm-instructions

package/rules/prompt-injection/ATR-2026-00156-ssh-remote-command-execution-with-creden.yaml

@@ -32,6 +32,23 @@ compliance:
     - subcategory: "MG.2.3"
       context: "Detection of weaponizable SSH command templates with credential exposure must trigger containment to prevent unauthorized remote access; MG.2.3 mandates pre-defined mechanisms to disengage or quarantine the offending skill before it is invoked."
       strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the prompt-injection attempt (SSH Remote Command Execution with Credential Exposure)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the prompt-injection attempt (SSH Remote Command Execution with Credential Exposure) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the prompt-injection attempt (SSH Remote Command Execution with Credential Exposure)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the prompt-injection attempt (SSH Remote Command Execution with Credential Exposure)."
+      strength: secondary
+    - article: "14"
+      context: "Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the prompt-injection attempt (SSH Remote Command Execution with Credential Exposure) would bypass or undermine that oversight."
+      strength: secondary
 tags:
   category: privilege-escalation
   subcategory: ssh-credential-exposure