agent-threat-rules 3.1.1 → 3.3.0

package/rules/skill-compromise/ATR-2026-00527-skill-silent-git-remote-mirror-exfiltration.yaml

@@ -55,6 +55,9 @@ compliance:
         Article 10 data governance — repository content includes source code
         which may be IP or contain secrets; this rule guards that exposure.
       strength: secondary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the skill supply-chain compromise (Silent git-remote + mirror-push Exfiltration from Skill Instructions)."
+      strength: secondary
   nist_ai_rmf:
     - function: Manage
       subcategory: MG.4.3
@@ -62,12 +65,24 @@ compliance:
         Supply-chain monitoring under MG.4.3 must include the skill
         instruction layer; this rule is the runtime detection signature.
       strength: primary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the skill supply-chain compromise (Silent git-remote + mirror-push Exfiltration from Skill Instructions)."
+      strength: primary
+    - subcategory: "MG.3.1"
+      context: "NIST AI RMF MANAGE 3.1 (third-party resources regularly monitored) is supported where this rule detects the skill supply-chain compromise (Silent git-remote + mirror-push Exfiltration from Skill Instructions)."
+      strength: secondary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the skill supply-chain compromise (Silent git-remote + mirror-push Exfiltration from Skill Instructions)."
+      strength: secondary
   iso_42001:
     - clause: "8.3"
       context: >
         AIMS information security under 8.3 requires controls against
         unauthorized data egress; detection events feed the incident path.
       strength: primary
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the skill supply-chain compromise (Silent git-remote + mirror-push Exfiltration from Skill Instructions)."
+      strength: primary
 
 tags:
   category: skill-compromise

package/rules/tool-poisoning/ATR-2026-00010-mcp-malicious-response.yaml

@@ -71,12 +71,21 @@ compliance:
       subcategory: MP.3.3
       context: "MCP servers are third-party components in the AI tool ecosystem; identifying malicious tool responses is an MP.3.3 third-party component risk detection action."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (Malicious Content in MCP Tool Response)."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (Malicious Content in MCP Tool Response)."
+      strength: secondary
   iso_42001:
     - clause: "6.2"
       context: "Clause 6.2 AIMS security planning requires controls for third-party tool interfaces; this rule operationalizes the detection measure for malicious content delivered via MCP."
       strength: primary
-    - clause: "8.5"
-      context: "MCP server integrations are externally-provided AI-related processes under clause 8.5; this rule validates that external tool responses do not contain adversarial payloads before the agent acts on them."
+    - clause: "8.1"
+      context: "MCP server integrations are externally-provided AI-related processes under clause 8.1; this rule validates that external tool responses do not contain adversarial payloads before the agent acts on them."
+      strength: secondary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (Malicious Content in MCP Tool Response) as a treatment control."
       strength: secondary
 
 tags:

package/rules/tool-poisoning/ATR-2026-00011-tool-output-injection.yaml

@@ -51,6 +51,23 @@ compliance:
         embedded commands; MG.2.3 requires these response mechanisms be defined
         and activated on detection.
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (Instruction Injection via Tool Output)."
+      strength: primary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the tool-poisoning technique (Instruction Injection via Tool Output)."
+      strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (Instruction Injection via Tool Output) as a treatment control."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the tool-poisoning technique (Instruction Injection via Tool Output)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the tool-poisoning technique (Instruction Injection via Tool Output)."
+      strength: secondary
 tags:
   category: tool-poisoning
   subcategory: output-injection

package/rules/tool-poisoning/ATR-2026-00012-unauthorized-tool-call.yaml

@@ -36,6 +36,23 @@ compliance:
     - subcategory: "MP.5.1"
       context: "Parameter injection patterns and tool enumeration probes are adversarial inputs whose likelihood and magnitude of impact must be characterized for the AI system's tool-use surface; MP.5.1 requires identifying and tracking these attack vectors as part of risk characterization."
       strength: secondary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (Unauthorized Tool Call Detection)."
+      strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the tool-poisoning technique (Unauthorized Tool Call Detection)."
+      strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (Unauthorized Tool Call Detection) as a treatment control."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the tool-poisoning technique (Unauthorized Tool Call Detection)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the tool-poisoning technique (Unauthorized Tool Call Detection)."
+      strength: secondary
 tags:
   category: tool-poisoning
   subcategory: unauthorized-access

package/rules/tool-poisoning/ATR-2026-00013-tool-ssrf.yaml

@@ -44,6 +44,23 @@ compliance:
       context: >-
         Detection of SSRF indicators in tool parameters triggers risk treatment plans to block or disengage the agent's outbound request before internal services or cloud credentials are exposed; MG.2.3 mandates these response mechanisms are pre-defined.
       strength: secondary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (SSRF via Agent Tool Calls)."
+      strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the tool-poisoning technique (SSRF via Agent Tool Calls)."
+      strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (SSRF via Agent Tool Calls) as a treatment control."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the tool-poisoning technique (SSRF via Agent Tool Calls)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the tool-poisoning technique (SSRF via Agent Tool Calls)."
+      strength: secondary
 tags:
   category: tool-poisoning
   subcategory: ssrf

package/rules/tool-poisoning/ATR-2026-00095-supply-chain-poisoning.yaml

@@ -10,13 +10,15 @@ author: ATR Community (MiroFish Predicted)
 date: 2026/03/11
 schema_version: "0.1"
 detection_tier: pattern
-maturity: test
+maturity: stable
 severity: critical
 references:
   owasp_llm:
     - LLM06:2025 - Excessive Agency
   mitre_atlas:
     - AML.T0053
+  owasp_agentic:
+    - ASI05:2026 - Unexpected Code Execution
 metadata_provenance:
   owasp_llm: auto-generated
 compliance:
@@ -30,6 +32,26 @@ compliance:
     - subcategory: "GV.6.2"
       context: "When poisoned tools are detected, contingency processes must isolate or disable the affected supplier tool to prevent unintended code execution and data exfiltration; GV.6.2 requires these third-party failure response processes to be in place."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (MCP Tool Supply Chain Poisoning)."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (MCP Tool Supply Chain Poisoning)."
+      strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the tool-poisoning technique (MCP Tool Supply Chain Poisoning)."
+      strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (MCP Tool Supply Chain Poisoning) as a treatment control."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the tool-poisoning technique (MCP Tool Supply Chain Poisoning)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the tool-poisoning technique (MCP Tool Supply Chain Poisoning)."
+      strength: secondary
 tags:
   category: tool-poisoning
   subcategory: supply-chain-attack

package/rules/tool-poisoning/ATR-2026-00096-registry-poisoning.yaml

@@ -10,7 +10,7 @@ author: ATR Community (MiroFish Predicted)
 date: 2026/03/11
 schema_version: "0.1"
 detection_tier: pattern
-maturity: test
+maturity: stable
 severity: critical
 references:
   owasp_llm:
@@ -19,6 +19,8 @@ references:
     - AML.T0056
   mitre_attack:
     - T0056
+  owasp_agentic:
+    - ASI05:2026 - Unexpected Code Execution
 metadata_provenance:
   owasp_llm: auto-generated
 compliance:
@@ -32,6 +34,23 @@ compliance:
     - subcategory: "MG.3.2"
       context: "Compromised skills and tools function as pre-built components incorporated into agent capability; MG.3.2 requires monitoring of these third-party artifacts for tampering, backdoors, and malicious behavior post-acquisition."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (Skill Registry Poisoning and Compromised Tool Distribution)."
+      strength: primary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the tool-poisoning technique (Skill Registry Poisoning and Compromised Tool Distribution)."
+      strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (Skill Registry Poisoning and Compromised Tool Distribution) as a treatment control."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the tool-poisoning technique (Skill Registry Poisoning and Compromised Tool Distribution)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the tool-poisoning technique (Skill Registry Poisoning and Compromised Tool Distribution)."
+      strength: secondary
 tags:
   category: tool-poisoning
   subcategory: registry-poisoning

package/rules/tool-poisoning/ATR-2026-00100-consent-bypass-instruction.yaml

@@ -37,6 +37,26 @@ compliance:
     - subcategory: "MG.2.3"
       context: "Detection of consent-bypass directives must trigger risk treatment to disengage or block the offending tool before automated data forwarding chains execute; MG.2.3 requires mechanisms to supersede or deactivate AI system components on such detections."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (Consent Bypass via Hidden LLM Instructions in Tool Descriptions)."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (Consent Bypass via Hidden LLM Instructions in Tool Descriptions)."
+      strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the tool-poisoning technique (Consent Bypass via Hidden LLM Instructions in Tool Descriptions)."
+      strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (Consent Bypass via Hidden LLM Instructions in Tool Descriptions) as a treatment control."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the tool-poisoning technique (Consent Bypass via Hidden LLM Instructions in Tool Descriptions)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the tool-poisoning technique (Consent Bypass via Hidden LLM Instructions in Tool Descriptions)."
+      strength: secondary
 tags:
   category: tool-poisoning
   subcategory: consent-bypass-instruction

package/rules/tool-poisoning/ATR-2026-00101-trust-escalation-override.yaml

@@ -39,6 +39,26 @@ compliance:
     - subcategory: "MG.2.3"
       context: "Detection of tools issuing override directives must trigger pre-defined treatment actions to disengage or quarantine the offending tool before the LLM acts on hijacked instructions; MG.2.3 mandates these supersede/deactivate mechanisms exist for compromised components."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (Trust Escalation via Authority Override Instructions)."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (Trust Escalation via Authority Override Instructions)."
+      strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the tool-poisoning technique (Trust Escalation via Authority Override Instructions)."
+      strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (Trust Escalation via Authority Override Instructions) as a treatment control."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the tool-poisoning technique (Trust Escalation via Authority Override Instructions)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the tool-poisoning technique (Trust Escalation via Authority Override Instructions)."
+      strength: secondary
 tags:
   category: tool-poisoning
   subcategory: trust-escalation-override

package/rules/tool-poisoning/ATR-2026-00103-hidden-safety-bypass-instruction.yaml

@@ -34,6 +34,23 @@ compliance:
     - subcategory: "MG.2.3"
       context: "Detection of explicit safety-disregard instructions must trigger mechanisms to disengage or quarantine the offending tool before the LLM acts on the injected directive; MG.2.3 requires that such supersede/deactivate response paths are pre-defined and activated on detection."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (Hidden LLM Safety Bypass Instructions in Tool Descriptions)."
+      strength: primary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the tool-poisoning technique (Hidden LLM Safety Bypass Instructions in Tool Descriptions)."
+      strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (Hidden LLM Safety Bypass Instructions in Tool Descriptions) as a treatment control."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the tool-poisoning technique (Hidden LLM Safety Bypass Instructions in Tool Descriptions)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the tool-poisoning technique (Hidden LLM Safety Bypass Instructions in Tool Descriptions)."
+      strength: secondary
 tags:
   category: tool-poisoning
   subcategory: hidden-llm-instructions

package/rules/tool-poisoning/ATR-2026-00105-silent-action-concealment.yaml

@@ -37,6 +37,26 @@ compliance:
     - subcategory: "MG.3.1"
       context: "MCP tools originate from third-party providers, and concealment instructions embedded in their descriptions must be detected and managed as supply-chain risks; MG.3.1 mandates active management of risks introduced by third-party AI components."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (Silent Action Concealment Instructions in Tool Descriptions)."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (Silent Action Concealment Instructions in Tool Descriptions)."
+      strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the tool-poisoning technique (Silent Action Concealment Instructions in Tool Descriptions)."
+      strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (Silent Action Concealment Instructions in Tool Descriptions) as a treatment control."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the tool-poisoning technique (Silent Action Concealment Instructions in Tool Descriptions)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the tool-poisoning technique (Silent Action Concealment Instructions in Tool Descriptions)."
+      strength: secondary
 tags:
   category: tool-poisoning
   subcategory: silent-action-instruction

package/rules/tool-poisoning/ATR-2026-00106-schema-description-contradiction.yaml

@@ -39,6 +39,23 @@ compliance:
     - subcategory: "MS.2.7"
       context: "Detecting tools that claim safety while exposing destructive parameters provides continuous evaluation evidence for AI system security and resilience required by MS.2.7, surfacing tool-poisoning vectors that bypass static review."
       strength: secondary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (Schema-Description Contradiction Attack)."
+      strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the tool-poisoning technique (Schema-Description Contradiction Attack)."
+      strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (Schema-Description Contradiction Attack) as a treatment control."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the tool-poisoning technique (Schema-Description Contradiction Attack)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the tool-poisoning technique (Schema-Description Contradiction Attack)."
+      strength: secondary
 tags:
   category: tool-poisoning
   subcategory: schema-description-mismatch

package/rules/tool-poisoning/ATR-2026-00161-important-tag-cross-tool-shadowing.yaml

@@ -56,6 +56,26 @@ compliance:
     - subcategory: "MP.5.1"
       context: "Cross-tool shadowing directives referencing 'also present' or 'previously declared' tools are adversarial indirect prompt injection vectors with high impact (SSH key and config exfiltration); MP.5.1 requires characterizing the likelihood and magnitude of these supply-chain prompt injection risks."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (MCP Tool Description — IMPORTANT Tag Cross-Tool Shadowing Attack)."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (MCP Tool Description — IMPORTANT Tag Cross-Tool Shadowing Attack)."
+      strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the tool-poisoning technique (MCP Tool Description — IMPORTANT Tag Cross-Tool Shadowing Attack)."
+      strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (MCP Tool Description — IMPORTANT Tag Cross-Tool Shadowing Attack) as a treatment control."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the tool-poisoning technique (MCP Tool Description — IMPORTANT Tag Cross-Tool Shadowing Attack)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the tool-poisoning technique (MCP Tool Description — IMPORTANT Tag Cross-Tool Shadowing Attack)."
+      strength: secondary
 tags:
   category: tool-poisoning
   subcategory: important-tag-shadowing

package/rules/tool-poisoning/ATR-2026-00209-mcpwn-runaway-invocation.yaml

@@ -46,6 +46,9 @@ compliance:
     - article: "14"
       context: "Runaway invocation loops prevent effective human oversight by consuming the agent's token budget before any human-reviewable output is produced; Article 14 oversight mechanisms must include detection of denial-of-oversight patterns that exhaust agent capacity through tool-layer abuse."
       strength: secondary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the tool-poisoning technique (MCPwn Runaway Tool Invocation via Retry Directive (CVE-2026-33032))."
+      strength: secondary
   nist_ai_rmf:
     - subcategory: "MP.5.1"
       context: "CVE-2026-33032 MCPwn runaway invocation uses malicious retry_hint and continue_after_error MCP response fields as adversarial inputs that coerce the client into unbounded tool-call loops; MP.5.1 requires this class of resource exhaustion attack delivered through agent tool channels to be identified and tracked."
@@ -53,12 +56,21 @@ compliance:
     - subcategory: "MG.2.3"
       context: "Risk treatment plans under MG.2.3 must implement hard retry caps and treat retry_hint as advisory-only to prevent malicious MCP servers from exploiting the runaway invocation pattern to consume token budgets and probe rate limits via forced tool-call loops."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (MCPwn Runaway Tool Invocation via Retry Directive (CVE-2026-33032))."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (MCPwn Runaway Tool Invocation via Retry Directive (CVE-2026-33032))."
+      strength: secondary
   iso_42001:
     - clause: "6.2"
       context: "Risk treatment activities under clause 6.2 must address the MCPwn runaway invocation pattern (CVE-2026-33032), where malicious MCP response fields are used as tool-invoke directives to create unbounded retry loops that exhaust agent capacity."
       strength: primary
-    - clause: "8.6"
-      context: "Operational controls under clause 8.6 must enforce bounded retry policies and detect retry_hint or continue_after_error fields set to imperative tool-invoke directives, preventing malicious MCP servers from triggering runaway invocation loops in the agent client."
+    - clause: "8.1"
+      context: "Operational controls under clause 8.1 must enforce bounded retry policies and detect retry_hint or continue_after_error fields set to imperative tool-invoke directives, preventing malicious MCP servers from triggering runaway invocation loops in the agent client."
+      strength: secondary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (MCPwn Runaway Tool Invocation via Retry Directive (CVE-2026-33032)) as a treatment control."
       strength: secondary
 
 tags:

package/rules/tool-poisoning/ATR-2026-00210-flowise-system-message-override.yaml

@@ -53,12 +53,21 @@ compliance:
     - subcategory: "MG.2.3"
       context: "Risk treatment plans under MG.2.3 must mandate input sanitization before Flowise template interpolation, as the CVE-2025-59528 attack achieves system prompt override and remote code execution through the vm.runInNewContext and new Function sinks."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (Flowise System Message Override via Template Interpolation (CVE-2025-59528))."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (Flowise System Message Override via Template Interpolation (CVE-2025-59528))."
+      strength: secondary
   iso_42001:
     - clause: "6.2"
       context: "Risk treatment activities under clause 6.2 must address the Flowise system message override vulnerability (CVE-2025-59528), implementing sanitization controls that prevent attacker-controlled chat inputs from reaching template interpolation in privileged execution contexts."
       strength: primary
-    - clause: "8.6"
-      context: "Operational controls under clause 8.6 must include detection of Flowise template interpolation syntax ({{$flow.variables}}, {{$input}}) in content fields that feed into system messages or code execution sinks, blocking the CVE-2025-59528 RCE pathway."
+    - clause: "8.1"
+      context: "Operational controls under clause 8.1 must include detection of Flowise template interpolation syntax ({{$flow.variables}}, {{$input}}) in content fields that feed into system messages or code execution sinks, blocking the CVE-2025-59528 RCE pathway."
+      strength: secondary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (Flowise System Message Override via Template Interpolation (CVE-2025-59528)) as a treatment control."
       strength: secondary
 
 tags:

package/rules/tool-poisoning/ATR-2026-00259-ansi-escape-injection.yaml

@@ -36,6 +36,23 @@ compliance:
     - subcategory: "MP.5.1"
       context: "Embedded terminal escape codes are adversarial inputs targeting downstream rendering surfaces; MP.5.1 requires that the likelihood and magnitude of such terminal-injection impacts are characterized for the deployment context."
       strength: secondary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (ANSI Escape Code Terminal Injection)."
+      strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the tool-poisoning technique (ANSI Escape Code Terminal Injection)."
+      strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (ANSI Escape Code Terminal Injection) as a treatment control."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the tool-poisoning technique (ANSI Escape Code Terminal Injection)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the tool-poisoning technique (ANSI Escape Code Terminal Injection)."
+      strength: secondary
 tags:
   category: tool-poisoning
   subcategory: ansi-escape

package/rules/tool-poisoning/ATR-2026-00270-xss-in-tool-response.yaml

@@ -37,6 +37,23 @@ compliance:
     - subcategory: "MG.2.3"
       context: "Detection of executable XSS sinks in tool output should trigger risk treatment to quarantine or sanitize the response before it reaches the UI; MG.2.3 mandates predefined mechanisms to disengage or block unsafe AI outputs at runtime."
       strength: secondary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (XSS Payload Injection in Tool Response Output)."
+      strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the tool-poisoning technique (XSS Payload Injection in Tool Response Output)."
+      strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (XSS Payload Injection in Tool Response Output) as a treatment control."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the tool-poisoning technique (XSS Payload Injection in Tool Response Output)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the tool-poisoning technique (XSS Payload Injection in Tool Response Output)."
+      strength: secondary
 tags:
   category: tool-poisoning
   subcategory: xss-in-tool-output

package/rules/tool-poisoning/ATR-2026-00277-echo-template-command-injection.yaml

@@ -45,6 +45,23 @@ compliance:
       context: >-
         Detection of injected DROP/DELETE SQL commands or Jinja code-execution payloads must trigger risk treatment to quarantine or block the request before downstream tool execution; MG.2.3 mandates these response mechanisms are pre-defined and activated on detection.
       strength: secondary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (ECHO Template / Jinja / SQL Command Injection via LLM)."
+      strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the tool-poisoning technique (ECHO Template / Jinja / SQL Command Injection via LLM)."
+      strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (ECHO Template / Jinja / SQL Command Injection via LLM) as a treatment control."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the tool-poisoning technique (ECHO Template / Jinja / SQL Command Injection via LLM)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the tool-poisoning technique (ECHO Template / Jinja / SQL Command Injection via LLM)."
+      strength: secondary
 tags:
   category: tool-poisoning
   subcategory: echo-template-sql-injection

package/rules/tool-poisoning/ATR-2026-00393-ansi-code-elicitation-request.yaml

@@ -50,6 +50,23 @@ compliance:
       context: >-
         Matches on escape-code elicitation patterns feed risk treatment workflows that can block, sanitize, or disengage the affected agent before terminal-hijacking payloads propagate; MG.2.3 requires these supersede/deactivate mechanisms be in place.
       strength: secondary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (ANSI Code Elicitation Request)."
+      strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the tool-poisoning technique (ANSI Code Elicitation Request)."
+      strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (ANSI Code Elicitation Request) as a treatment control."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the tool-poisoning technique (ANSI Code Elicitation Request)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the tool-poisoning technique (ANSI Code Elicitation Request)."
+      strength: secondary
 tags:
   category: tool-poisoning
   subcategory: ansi-code-elicitation

package/rules/tool-poisoning/ATR-2026-00415-flowise-custom-mcp-stdio-rce.yaml

@@ -16,7 +16,7 @@ author: "ATR Community"
 date: "2026/05/04"
 schema_version: "0.1"
 detection_tier: pattern
-maturity: experimental
+maturity: test
 severity: critical
 
 references:
@@ -55,10 +55,19 @@ compliance:
     - subcategory: "MG.2.3"
       context: "Risk treatment plans under MG.2.3 must enforce arg-pattern denylists (npx -c, node -e, python -c, sh -c, bash -c) on top of binary allow-lists for any Custom MCP / STDIO / subprocess registration interface."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (Flowise Custom MCP STDIO Command Injection (CVE-2026-40933))."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (Flowise Custom MCP STDIO Command Injection (CVE-2026-40933))."
+      strength: secondary
   iso_42001:
-    - clause: "8.6"
-      context: "Operational controls under clause 8.6 must include detection of interpreter inline-execution flags (-c, -e, --eval, --command) in Custom MCP node configurations and tool registration payloads, since these convert allow-listed binaries into arbitrary code-execution sinks."
+    - clause: "8.1"
+      context: "Operational controls under clause 8.1 must include detection of interpreter inline-execution flags (-c, -e, --eval, --command) in Custom MCP node configurations and tool registration payloads, since these convert allow-listed binaries into arbitrary code-execution sinks."
       strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (Flowise Custom MCP STDIO Command Injection (CVE-2026-40933)) as a treatment control."
+      strength: secondary
 
 tags:
   category: tool-poisoning