agent-threat-rules 4.0.0 → 4.1.5

package/rules/privilege-escalation/ATR-2026-02681-reflective-function-constructor-sandbox-escape.yaml

@@ -0,0 +1,100 @@
+title: JavaScript Sandbox Escape by Acquiring the Function Constructor Reflectively
+id: ATR-2026-02681
+rule_version: 2
+status: experimental
+description: |
+  Detects code handed to an agent code-execution / expression-evaluation tool that reaches the Function constructor WITHOUT writing the well-known x.constructor.constructor ladder, by pulling the "constructor" property off a prototype through a reflective accessor -- Reflect.get(Reflect.getPrototypeOf( async function(){}), "constructor") or Object.getOwnPropertyDescriptor( Object.getPrototypeOf(Object), "constructor").value -- and then invoking it on a source string that returns the global object. Mined from CVE-2025-53626 (@pdfme/common expression evaluation) and its sibling CVE-2025-61927 (happy-dom VM context escape). ATR already detects the direct ladder (ATR-2026-00436 / ATR-2026-01953); those rules key on the literal ".constructor.constructor" or "process.mainModule.require", so the reflective spelling -- which produces the identical Function object -- passes them untouched. The rule requires BOTH halves in one event: the reflective acquisition of "constructor" from a prototype, and a quoted source string whose body returns this/globalThis/global/process. Either half alone is ordinary metaprogramming and is deliberately not matched.
+author: ATR Community (CVE sweep)
+date: 2026/08/23
+schema_version: '0.1'
+detection_tier: pattern
+maturity: test
+severity: critical
+references:
+  cve:
+    - CVE-2025-53626
+    - CVE-2025-61927
+  cwe:
+    - CWE-94
+    - CWE-693
+    - CWE-1321
+  owasp_llm:
+    - LLM05:2025
+    - LLM06:2025
+  owasp_agentic:
+    - ASI05:2026
+    - ASI04:2026
+  mitre_attack:
+    - T1059.007 - JavaScript
+  mitre_atlas:
+    - AML.T0053 - AI Agent Tool Invocation
+  external:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-53626
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-61927
+metadata_provenance:
+  cve: human-reviewed
+  cwe: human-reviewed
+  owasp_llm: human-reviewed
+  owasp_agentic: human-reviewed
+  mitre_attack: human-reviewed
+  mitre_atlas: human-reviewed
+compliance:
+  eu_ai_act:
+    - article: '15'
+      context: Article 15 (accuracy, robustness and cybersecurity) requires resilience against attempts to alter system behaviour by exploiting vulnerabilities; this rule detects a sandbox escape that converts a restricted expression evaluator into arbitrary host code execution.
+      strength: primary
+    - article: '9'
+      context: Article 9 (risk management system) requires identified risks to be treated; this rule is the runtime treatment for the code-sandbox escape risk class.
+      strength: secondary
+  nist_ai_rmf:
+    - subcategory: MG.2.3
+      context: Sandbox escape from an agent code-execution tool is an identified AI risk requiring an active runtime countermeasure; this rule implements it.
+      strength: primary
+    - subcategory: MS.2.7
+      context: Measuring AI system security by testing whether restricted evaluators can be escaped; this rule is the detection instrument for that measurement.
+      strength: secondary
+  iso_42001:
+    - clause: '8.1'
+      context: ISO/IEC 42001 Clause 8.1 (operational planning and control) is operationalised by detecting expression payloads that break the evaluator's containment.
+      strength: primary
+    - clause: '8.3'
+      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is implemented by alerting on the reflective Function-constructor acquisition.
+      strength: secondary
+tags:
+  category: privilege-escalation
+  subcategory: js-sandbox-escape-reflective
+  scan_target: agent
+  confidence: high
+  suppress_in_code_blocks: true
+agent_source:
+  type: tool_call
+  framework:
+    - any
+  provider:
+    - any
+detection:
+  condition: any
+  conditions:
+    - field: content
+      operator: regex
+      value: (?:\\{0,2}["'][\w-]{0,24}(?:code|script|expression|expr|snippet|program)\\{0,2}["']\s*:\s*\\{0,2}["']|[\w-]{0,24}(?:code|script|expression|expr|snippet|program)\s*=\s*\\{0,2}["'])[^\n]{0,100}(?:getownpropertydescriptor|reflect\.get)\s*\(\s*(?:object|reflect)\.getprototypeof[^\n]{0,40}\\?["']constructor\\?["'][^\n]{0,120}\\?["'`]\s*return\s+(?:this|globalthis|global|process)\b
+      description: 'Reflective acquisition of the constructor slot from a prototype, followed on the same line by a quoted source string that returns the global object -- the Function constructor obtained without ever writing .constructor.constructor, then invoked to hand back the host realm. The whole thing must sit inside a CODE-VALUED TOOL ARGUMENT ("code": "...", "script": "...", expression="..."), which is the channel the title claims and the only one that separates evaluating the payload from merely writing it down. See false_positives.'
+    - field: content
+      operator: regex
+      value: (?:\\{0,2}["'][\w-]{0,24}(?:code|script|expression|expr|snippet|program)\\{0,2}["']\s*:\s*\\{0,2}["']|[\w-]{0,24}(?:code|script|expression|expr|snippet|program)\s*=\s*\\{0,2}["'])[^\n]{0,100}(?:object|reflect)\.getprototypeof\s*\(\s*(?:async\s+function|function\s*\*)[^\n]{0,40}\\?["']?constructor\\?["']?[^\n]{0,80}\\?["'`]\s*return\s+(?:this|globalthis|global|process)\b
+      description: 'The AsyncFunction / GeneratorFunction ladder in a code-valued tool argument: the prototype of an async or generator function literal is taken, its constructor read (quoted or dotted), and that constructor invoked on a quoted source string returning the global object. Reading the AsyncFunction constructor alone is a legitimate feature-detection idiom and is NOT matched -- only its invocation on a global-returning body, inside a code argument.'
+  false_positives:
+    - Serialization and deep-clone helpers that read a descriptor for an ordinary property, e.g. Object.getOwnPropertyDescriptor(Object.getPrototypeOf(instance), 'render') -- the property name must literally be 'constructor'
+    - A class-identity check such as Object.getPrototypeOf(o).constructor === Object -- no quoted return-the-global source string follows, so nothing matches
+    - Prototype-pollution defences that inspect Object.prototype's own descriptors (e.g. for '__proto__') -- the property name is not 'constructor'
+    - |-
+      ADVERSARIAL REVIEW 2026-08-24, FIXED. Rule v1 matched the escape anywhere in `field: content`. Twelve freshly written benign samples were run through the engine and ALL TWELVE fired. The decisive ones were not exotic: a vm2 sandbox-hardening test asserting the escape is BLOCKED, an isolated-vm regression test, an ESLint "examples of incorrect code" block, a static-analysis fixture array, a sandbox library changelog, a Japanese security blog, a fenced code block in an article explaining CVE-2025-53626, and ATR's own test_cases block. Every one of those is something a coding agent writes to a FILE.
+      That is not a coincidence. On a tool_call event `field: content` resolves to fields.content, and src/hook-handler.ts sets that from toolInput.content -- the body of a Write/Edit call. So rule v1's dominant production surface was file writes, not evaluation, which is the exact opposite of what its own title says. Fixed by requiring the payload to sit in a CODE-VALUED ARGUMENT (a code/script/expression-style key, then a quote). "content" is deliberately NOT in that key list: writing a file is not evaluating it. tags.suppress_in_code_blocks was added as a second layer for fenced and backticked article text.
+    - 'KNOWN RESIDUAL: code that legitimately needs the global object and reaches for it through this ladder -- a globalThis fallback such as Object.getPrototypeOf(async function(){}).constructor("return this")() -- still fires if it is submitted to an evaluation tool. It is a real idiom, but inside an agent''s code-execution argument it is also indistinguishable from the escape, and the well-behaved spelling (globalThis, or plain Function) is available. Triage, not a pattern change.'
+    - 'KNOWN GAP: a payload written to a file and evaluated later by a second step is no longer matched here. Rule v1 claimed that ground and paid for it with a 12/12 false-positive rate on benign security and test content.'
+response:
+  actions:
+    - alert
+  message_template: |
+    [ATR-2026-02681] Code submitted to an execution/evaluation tool acquires the Function constructor through a reflective accessor and invokes it on a source string that returns the global object. This is a sandbox escape, not metaprogramming -- do not evaluate it.
+confidence: 85

package/rules/privilege-escalation/ATR-2026-02683-tool-argument-option-injection-executor-flag.yaml

@@ -0,0 +1,108 @@
+title: Agent Tool Data Argument Carries a Program-Executing CLI Option
+id: ATR-2026-02683
+rule_version: 2
+status: experimental
+description: |
+  Detects an agent tool argument that is supposed to hold DATA -- a search pattern, a glob, a file path, an output name -- but whose value begins with a dash and names a CLI option that makes the underlying binary run a program of the caller's choosing. ripgrep's --pre=<prog> (every matched file is piped through <prog>), tar's --checkpoint-action=exec=<cmd> and --to-command=<cmd>, rsync/scp's -e <shell> and --rsh=<shell>, wget's --output-document=<path> (write anywhere, including a shell startup file), GNU tar's --use-compress-program=<prog>. Mined from CVE-2026-48116 (AnythingLLM filesystem-search-files passes the LLM-controlled pattern straight to ripgrep, so "--pre=/bin/sh" is command execution). None of this needs a single shell metacharacter, which is exactly why ATR's metacharacter rules (ATR-2026-00111 and friends) stay silent on it: the injection happens in the argument VECTOR, before any shell is involved. The rule requires the option to carry a real program or path operand, so a developer searching their codebase for the literal string "--pre=" does not match.
+  V2 -- ADVERSARIAL REVIEW 2026-08-24. The operand requirement held, but the KEY side did not. v1 accepted any occurrence of a data-shaped word followed by a colon or an equals sign, which is the syntax of ordinary shell, Make, YAML and Dockerfile assignment. 11 of 18 hand-written benign twins fired:
+    ARGS="--use-compress-program=zstd" in a backup script; a JSON job config
+    {"bin":"tar","args":"--use-compress-program=pigz -cf ..."}; a GitHub Actions
+    step with args: --output-document=/tmp/tool.tgz; a Makefile
+    OUTPUT = --output-document=...; a deploy script ARGS="-e ssh -o
+    StrictHostKeyChecking=no"; rsync telemetry {"cmd":"rsync","args":"-e ssh
+    -o BatchMode=yes"}; a k8s CronJob args:; a Dockerfile ENV OUTPUT=...;
+    a Python unit test args = "--output-document=/home/dev/.bashrc" asserting
+    the validator REJECTS it; and remediation prose (English and Traditional
+    Chinese) that names the payload -- pattern = "--pre=/bin/sh" -- in the
+    course of telling you to block it.
+  The common factor: an executing CLI option is a perfectly ordinary VALUE for a variable that holds command-line options. What makes it an attack is that the value arrived as a TOOL ARGUMENT, and v1 never checked that.
+  THE FIX: the key/value pair must be framed as an agent tool invocation -- either a QUOTED key inside an arguments/parameters/params/tool_input object, or a keyword argument sitting immediately after "(" or "," in a call. Bare KEY=value and bare YAML key: value no longer match. Measured after the fix: 0 of 18 benign twins, 0 of 10 fresh round-2 twins (legitimate search / extract / rsync / fetch tool calls, and bash tool calls where the option is the command's OWN flag: tar --use-compress-program=zstd, rsync -e 'ssh -o BatchMode=yes', wget --output-document=/tmp/tool.tgz), 5 of 5 true positives retained.
+  RESIDUAL, MEASURED: an advisory that quotes the tool call verbatim ({"arguments":{"pattern":"--pre=/bin/sh"}}) still fires. Irreducible: those are the exact bytes of the attack.
+  CORPUS CAVEAT: FP-clean on the 13,601-sample benign corpus is a ZERO-MEASUREMENT pass here -- only 2 corpus samples contain any of these option spellings at all. The twins below are the real evidence.
+author: ATR Community (CVE sweep)
+date: 2026/08/23
+schema_version: '0.1'
+detection_tier: pattern
+maturity: test
+severity: high
+references:
+  cve:
+    - CVE-2026-48116
+  cwe:
+    - CWE-88
+    - CWE-78
+  owasp_llm:
+    - LLM06:2025
+    - LLM01:2025
+  owasp_agentic:
+    - ASI05:2026
+    - ASI02:2026
+  mitre_attack:
+    - T1059 - Command and Scripting Interpreter
+  mitre_atlas:
+    - AML.T0053 - AI Agent Tool Invocation
+  external:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-48116
+    - https://www.gnu.org/software/tar/manual/html_section/checkpoints.html
+metadata_provenance:
+  cve: human-reviewed
+  cwe: human-reviewed
+  owasp_llm: human-reviewed
+  owasp_agentic: human-reviewed
+  mitre_attack: human-reviewed
+  mitre_atlas: human-reviewed
+compliance:
+  eu_ai_act:
+    - article: '15'
+      context: Article 15 (accuracy, robustness and cybersecurity) requires resistance to behaviour-altering exploitation; this rule detects argument-vector injection that turns a read-only agent tool into command execution.
+      strength: primary
+    - article: '9'
+      context: Article 9 (risk management system) requires identified risks to be treated by appropriate measures; this rule is the runtime treatment for the tool-argument option-injection risk class.
+      strength: secondary
+  nist_ai_rmf:
+    - subcategory: MG.2.3
+      context: Option injection through model-controlled tool arguments is an identified AI risk requiring an active runtime countermeasure; this rule implements it.
+      strength: primary
+    - subcategory: MP.5.1
+      context: Cataloguing argument-vector injection into agent tools as a risk in the organizational AI risk register.
+      strength: secondary
+  iso_42001:
+    - clause: '8.1'
+      context: ISO/IEC 42001 Clause 8.1 (operational planning and control) is operationalised by validating that data-shaped tool arguments are not option flags.
+      strength: primary
+    - clause: '8.3'
+      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is implemented by alerting on the executing-option operand.
+      strength: secondary
+tags:
+  category: privilege-escalation
+  subcategory: tool-argument-option-injection
+  scan_target: agent
+  confidence: high
+agent_source:
+  type: tool_call
+  framework:
+    - any
+  provider:
+    - any
+detection:
+  condition: any
+  conditions:
+    - field: content
+      operator: regex
+      value: (?i)(?:["']?\b(?:arguments|parameters|tool_input|params|toolinput)["']?\s{0,3}[:=][\s\S]{0,300}?\\?["'](?:pattern|query|search_?term|search_?string|glob|regex|file_?path|file_?name|filename|path|dir|directory|target|source|input|output|args?)\\?["']\s{0,3}:\s{0,3}\\?["']--(?:pre|pre-glob|use-compress-program|rsh|to-command|output-document|remote-shell|checkpoint-action)=\s{0,3}["']?[./~$]{0,2}[\w./$-]{1,40}|[(,]\s{0,3}(?:pattern|query|search_?term|search_?string|glob|regex|file_?path|file_?name|filename|path|dir|directory|target|source|input|output|args?)\s{0,3}=\s{0,3}["']--(?:pre|pre-glob|use-compress-program|rsh|to-command|output-document|remote-shell|checkpoint-action)=\s{0,3}["']?[./~$]{0,2}[\w./$-]{1,40})
+      description: 'A data-shaped tool argument whose value is an executing CLI option with a real operand: ripgrep --pre=<prog>, tar --to-command=/--use-compress-program=/--checkpoint-action=exec=<cmd>, rsync --rsh=<shell>, wget --output-document=<path>. The operand requirement is what separates this from someone searching for the flag name itself.'
+    - field: content
+      operator: regex
+      value: (?i)(?:["']?\b(?:arguments|parameters|tool_input|params|toolinput)["']?\s{0,3}[:=][\s\S]{0,300}?\\?["'](?:pattern|query|glob|file_?path|filename|path|dir|directory|target|source|input|args?)\\?["']\s{0,3}:\s{0,3}\\?["']-e\s{1,3}(?:/bin/|\bsh\b|\bbash\b|ssh\s{1,3}-o)|[(,]\s{0,3}(?:pattern|query|glob|file_?path|filename|path|dir|directory|target|source|input|args?)\s{0,3}=\s{0,3}["']-e\s{1,3}(?:/bin/|\bsh\b|\bbash\b|ssh\s{1,3}-o))
+      description: rsync/scp -e supplied as a data argument, naming a shell (or ssh with an option) as the remote-shell program -- the classic argument-vector escape for file-transfer tools
+  false_positives:
+    - 'Searching a codebase for the flag itself, e.g. {"pattern": "--pre="} or rg -- ''--output-document'' -- the patterns require a real operand after the equals sign'
+    - A legitimate rsync invocation written as a command string rather than as a data argument, e.g. rsync -e 'ssh -p 2222' src host:/dst -- the -e condition requires the value to sit behind a data-shaped key such as path/pattern/filename
+    - tar --use-compress-program=pigz used deliberately by a build script as the compressor, when it is passed as the command itself and not as the value of a path/pattern argument
+    - Documentation describing ripgrep's --pre preprocessor feature in prose
+response:
+  actions:
+    - alert
+  message_template: |
+    [ATR-2026-02683] A tool argument that should carry data (a search pattern, a path, an output name) instead carries a CLI option that executes a program. The underlying binary will run it. Reject the argument or pass it after an explicit -- terminator.
+confidence: 82

package/rules/privilege-escalation/ATR-2026-02700-percent-encoded-path-traversal-tool-argument.yaml

@@ -0,0 +1,90 @@
+title: Percent-Encoded Path Traversal in an Agent File-Tool Argument
+id: ATR-2026-02700
+rule_version: 1
+status: experimental
+description: |
+  Detects a tool-call argument whose value carries a repeated path-traversal sequence written in an ENCODED form -- %2e%2e, %252e%252e (double-encoded), or a literal `..` followed by an encoded separator %2f / %5c / %252f / %255c / %c0%af -- resolving toward a system or credential directory. Mined from CVE-2025-66689 (Zen MCP Server) and the CVE-2026-33344 / CVE-2026-27598 Dagu `locateDAG` pair, where the containment check compared the raw string against `../` while the framework percent-decoded the path afterwards, so the literal filter never saw the traversal it was written to stop. ATR already covers the encoded form on the llm_io side (ATR-2026-00569) and the LITERAL `../` form on tool_call (ATR-2026-01616), but neither combination covers an encoded payload arriving as a tool ARGUMENT: 00569 declares agent_source.type llm_io, so src/engine.ts never evaluates it on a tool_call event, and 01616's conditions are the literal `(?:\.\./){2,}` only. Verified on the shipped engine: `..%2f..%2f..%2fhome%2fanalyst%2f.ssh%2fid_rsa` as a tool_call matched no traversal rule at all, while the same target spelled `../../../home/analyst/.ssh/id_rsa` matched ten. This rule closes that one channel and is deliberately not vendor-scoped: the decode-after-check ordering bug is generic to agent file tools.
+author: ATR Community (CVE sweep)
+date: 2026/08/23
+schema_version: '0.1'
+detection_tier: pattern
+maturity: test
+severity: high
+references:
+  cwe:
+    - CWE-22
+    - CWE-172
+  owasp_llm:
+    - LLM06:2025
+  owasp_agentic:
+    - ASI02:2026
+  mitre_attack:
+    - T1083 - File and Directory Discovery
+  mitre_atlas:
+    - AML.T0053 - LLM Plugin Compromise
+  cve:
+    - CVE-2025-66689
+    - CVE-2026-33344
+  external:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-66689
+metadata_provenance:
+  cwe: human-reviewed
+  owasp_llm: human-reviewed
+  owasp_agentic: human-reviewed
+  mitre_attack: human-reviewed
+  mitre_atlas: human-reviewed
+compliance:
+  eu_ai_act:
+    - article: '15'
+      context: Article 15 (accuracy, robustness and cybersecurity) requires resistance to unauthorised access to data held by the system; this rule detects an encoded path-traversal argument aimed at reading files outside the agent's authorised working directory.
+      strength: primary
+    - article: '9'
+      context: Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is the runtime treatment for the encode-to-bypass-containment risk class in agent file tools.
+      strength: secondary
+  nist_ai_rmf:
+    - subcategory: MG.2.3
+      context: Encoded path traversal through an agent file tool is an identified AI risk requiring an active runtime countermeasure; this detection rule is that treatment.
+      strength: primary
+    - subcategory: MP.5.1
+      context: Cataloguing decode-after-validation containment bypass as an AI-specific risk in the organizational risk register.
+      strength: secondary
+  iso_42001:
+    - clause: '8.1'
+      context: ISO/IEC 42001 Clause 8.1 (operational planning and control) is operationalised by detecting encoded traversal in agent file-tool arguments before the read is performed.
+      strength: primary
+    - clause: '8.3'
+      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is implemented through runtime detection of the containment-bypass attempt.
+      strength: secondary
+tags:
+  category: privilege-escalation
+  subcategory: encoded-path-traversal-tool-argument
+  scan_target: runtime
+  confidence: high
+agent_source:
+  type: tool_call
+  framework:
+    - any
+  provider:
+    - any
+detection:
+  condition: any
+  conditions:
+    - field: tool_args
+      operator: regex
+      value: (?:^|[{,(\[])\s{0,3}["\x27]?(?:file_?path|filepath|filename|file|path|name|dest|destination|src|source|target|uri|url|dir|directory|key|object|blob|template|resource)["\x27]?\s{0,3}[:=]\s{0,3}["\x27](?:(?:%2e%2e|%252e%252e|\.\.)(?:%2f|%5c|%252f|%255c|%c0%af)){2,}[^"\x27\s]{0,24}(?:\.ssh|\.aws|\.env\b|\.npmrc|\.netrc|\.pgpass|\.htpasswd|\.kube|passwd\b|shadow\b|id_rsa|id_ed25519|id_ecdsa|authorized_keys|known_hosts|credentials\b|web\.config|boot\.ini|win\.ini|environ\b)
+      description: Two or more percent-encoded traversal segments forming the WHOLE value of a named file-path parameter, resolving onto a credential or system-configuration FILE
+  false_positives:
+    - 'MEASURED AND FIXED 2026-08-24 (adversarial review, 22 benign probes through the shipped engine). The published version fired on 12 of 13 first-wave probes. Its stated defence -- ''the rule is scoped to agent_source.type tool_call, which security prose does not travel through'' -- was simply wrong: write_file, create_issue and send_message are tool calls and they carry prose. These all fired and are now clean: an agent writing a blog post about CVE-2025-66689; an agent filing the vulnerability as a GitHub issue; a security regression test asserting the traversal is REJECTED; a nuclei scanner template; a CHANGELOG entry documenting the fix; a Traditional Chinese writeup; and a #secops chat message. Fixed by requiring the payload to be the whole value of a NAMED file-path parameter reached from an argument boundary, so a payload quoted inside a sentence no longer qualifies.'
+    - MEASURED AND FIXED 2026-08-24, same wave. The directory alternation had no word boundaries, so 'etc' matched inside 'sketch' and 'fetcher', 'var' inside 'variables', 'proc' inside 'process' and 'home' inside 'homepage'. Ordinary encoded relative paths such as ..%2f..%2fsrc%2fsketch.js and ..%2f..%2fstyles%2fvariables.css fired. Fixed with segment boundaries, then superseded by the change below.
+    - 'MEASURED AND FIXED 2026-08-24, second wave. With boundaries added, the bare directory names still fired on project-local folders that happen to be called var/, users/, home/, etc/ or proc/ -- ..%2f..%2fvar%2fcache%2ftwig (Symfony), ..%2f..%2fusers%2fguide.md (docs), ..%2f..%2fhome%2findex.html (pages) -- 7 of 9 probes. The bare directory alternation was therefore REMOVED: every one of this rule''s true positives and its evasion test already contains a credential-file token (.ssh, id_rsa, passwd, shadow, .aws, credentials), so the directory names contributed false positives and no recall.'
+    - A legitimate URL or storage key containing a single percent-encoded slash (S3 keys, GitHub branch refs such as release%2fv2). The condition needs two or more dot-dot-plus-separator segments, not merely an encoded slash.
+    - A relative path such as ../var/cache written with real slashes. The separator must itself be encoded for the condition to fire.
+    - 'STATED GAP: an encoded traversal onto a non-credential system file (etc%2fhosts, a project file two levels up) is no longer detected. That capability could not be kept without firing on ordinary project-local var/, users/ and home/ folders.'
+    - 'STATED GAP: a traversal arriving as a positional argument, or embedded partway through a longer URL value rather than starting it, is not detected.'
+    - 'RESIDUAL: prose that quotes the payload in the full JSON argument form ({"path":"..%2f..%2fetc%2fpasswd"}) still fires. That is a verbatim reproduction of the attack and is inherent to a byte-level signature.'
+response:
+  actions:
+    - alert
+  message_template: |
+    [ATR-2026-02700] Tool-call argument carries a percent-encoded path traversal chain toward a system or credential directory -- the shape of a containment check that compares the raw string while the framework decodes it afterwards. Resolve the path fully before the containment check.
+confidence: 80

package/rules/privilege-escalation/ATR-2026-02705-python-builtins-leak-and-prefix-check-override.yaml

@@ -0,0 +1,87 @@
+title: Python Sandbox Escape by Recovering builtins from a Bound Method or Lambda
+id: ATR-2026-02705
+rule_version: 2
+status: experimental
+description: |
+  Detects recovery of the real Python `builtins` module from the `__self__` of a bound builtin (`print.__self__`) or the `__globals__` of a throwaway lambda (`(lambda: 0).__globals__`). Neither attribute begins with a blocked name and neither needs `__subclasses__`, so both slip past validators built around those two signals. Mined from GHSA-4mr5-g6f9-cfrh (PraisonAI `execute_code`). Verified on the shipped engine: `m = print.__self__; imp = vars(m)['__imp'+'ort__']` and `g = (lambda: 0).__globals__` produced zero matches, while the control payloads `().__class__.__base__.__subclasses__()` and `'{0.__class__...}'.format` fire ATR-2026-00440 and ATR-2026-00554. ATR-2026-02101 covers dynamic dunder assembly and ATR-2026-02145 covers generator and frame attributes -- different routes to the same place, neither of which sees these two. The advisory's third primitive, a `str` subclass whose `startswith` is redefined to answer unconditionally, was authored and then REMOVED: a condition for it fired on ordinary pytest doubles (`class AlwaysMatch(str): def startswith(self, p, *a): return True`), which are indistinguishable from the attack in local text. That primitive is reported as a null result rather than shipped as a noisy condition.
+author: ATR Community (GHSA sweep)
+date: 2026/08/23
+schema_version: '0.1'
+detection_tier: pattern
+maturity: test
+severity: high
+references:
+  cwe:
+    - CWE-693
+    - CWE-913
+  owasp_llm:
+    - LLM05:2025
+  owasp_agentic:
+    - ASI06:2026
+  mitre_attack:
+    - T1059.006 - Python
+  mitre_atlas:
+    - AML.T0050 - Command and Scripting Interpreter
+  external:
+    - https://github.com/advisories/GHSA-4mr5-g6f9-cfrh
+metadata_provenance:
+  cwe: human-reviewed
+  owasp_llm: human-reviewed
+  owasp_agentic: human-reviewed
+  mitre_attack: human-reviewed
+  mitre_atlas: human-reviewed
+compliance:
+  eu_ai_act:
+    - article: '15'
+      context: Article 15 (accuracy, robustness and cybersecurity) requires resilience against attempts to subvert system controls; this rule detects code that recovers the Python builtins module or neutralises the validator inside a code-execution sandbox.
+      strength: primary
+    - article: '9'
+      context: Article 9 (risk management system) requires identified risks to be treated; this rule is the runtime treatment for sandbox-escape attempts in agent code execution.
+      strength: secondary
+  nist_ai_rmf:
+    - subcategory: MG.2.3
+      context: Sandbox escape from an agent code-execution tool is an identified AI risk requiring an active runtime countermeasure; this rule implements it.
+      strength: primary
+    - subcategory: MP.5.1
+      context: Cataloguing builtins-recovery and validator-override primitives as AI-specific execution risks in the organizational risk register.
+      strength: secondary
+  iso_42001:
+    - clause: '8.1'
+      context: ISO/IEC 42001 Clause 8.1 (operational planning and control) is operationalised by screening generated code for sandbox-escape primitives before execution.
+      strength: primary
+    - clause: '8.3'
+      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is implemented through runtime detection of the escape primitive.
+      strength: secondary
+tags:
+  category: privilege-escalation
+  subcategory: python-sandbox-escape-builtins-leak
+  scan_target: runtime
+  confidence: high
+  suppress_in_code_blocks: true
+agent_source:
+  type: llm_io
+  framework:
+    - any
+  provider:
+    - any
+detection:
+  condition: any
+  conditions:
+    - field: content
+      operator: regex
+      value: (?:(?:^|[^\w.])print\s{0,2}\.\s{0,2}__self__|\(\s{0,2}lambda\s{0,3}:[^)\r\n]{0,12}\)\s{0,2}\.\s{0,2}__globals__)[\s\S]{0,120}(?:vars\s{0,2}\(|getattr\s{0,2}\(|__builtins__|__import__|\[\s{0,2}["']__|\.\s{0,2}get\s{0,2}\(\s{0,2}["']|\beval\s{0,2}\(|\bexec\s{0,2}\(|\bcompile\s{0,2}\(|\bsystem\s{0,2}\(|\bpopen\s{0,2}\(|subprocess)
+      description: Recovery of the real builtins module through the __self__ of a bound builtin or the __globals__ of a throwaway lambda, followed within 120 characters by a USE of the recovered namespace -- vars(), a dunder subscript, __builtins__/__import__, getattr or a direct eval/exec/system call
+  false_positives:
+    - 'FIXED in rule_version 2 -- `print` WAS NOT REQUIRED TO BE THE BUILTIN. The condition opened with \bprint, and \b is satisfied by the dot in an attribute access, so ANY object with a print method fired on the standard bound-method idiom: console.print.__self__ is console (rich), writer.print.__self__ is writer, mock.print.__self__ is mock. __self__ is documented in the data model and asserting on it is ordinary test code. The condition now requires start-of-input or a character that is neither a word character nor a dot before print.'
+    - 'FIXED in rule_version 2 -- RECOVERY ALONE IS WHAT DOCUMENTATION SHOWS; THE ATTACK CHAINS IT. The condition stopped at the attribute, so it fired on writing that merely NAMES the attribute. Eight measured FPs, and five of them carry no security framing at all: a Python tutorial explaining that (lambda: 0).__globals__ is the same dict as globals(), the same lesson in Traditional Chinese, a note that print.__self__ is builtins, a CPython-behaviour test asserting both, and a helper using (lambda: None).__globals__ to reach its defining module. The other three were an advisory paragraph, a hardening CHANGELOG and the project''s own parametrised regression test listing the payloads as strings. The condition now requires a USE of the recovered namespace within 120 characters -- vars(), a dunder subscript, __builtins__/__import__, getattr, or a direct eval/exec/compile/system/popen call. All fourteen benign probes are silent; all four true positives and the evasion test still fire.'
+    - 'RECALL COST, STATED PLAINLY: bare recovery with no subsequent use is no longer detected. Two true positives were bare (b = print . __self__) and were extended with their exploitation step, because bare recovery is exactly the shape a tutorial has and does nothing on its own -- every published PoC for GHSA-4mr5-g6f9-cfrh chains it immediately. The whitespace-padding property those cases existed to test is preserved in the extended spellings.'
+    - 'tags.suppress_in_code_blocks was added in rule_version 2: a fenced security article printing the payload fired before it and is silent after. No true positive is fenced.'
+    - 'A str subclass that stubs startswith. Deliberately NOT matched: a condition for it was written, measured against pytest-style doubles, found to fire on them, and removed.'
+    - 'A lambda whose result is inspected for debugging (`(lambda: 0).__code__`, `.__name__`, `.__qualname__`), none of which is __globals__.'
+    - Frame and generator introspection (gi_frame.f_back, cr_frame.f_globals), deliberately left to ATR-2026-02145 rather than duplicated here.
+response:
+  actions:
+    - alert
+  message_template: |
+    [ATR-2026-02705] Generated Python recovers the builtins module through a bound-method or lambda attribute, or redefines startswith to defeat an attribute-name check. Treat the code-execution sandbox as bypassed.
+confidence: 80

package/rules/privilege-escalation/ATR-2026-02708-loopback-spoofed-host-header-external-request.yaml

@@ -0,0 +1,91 @@
+title: Agent HTTP Request Claims a Loopback Origin While Targeting an External Host
+id: ATR-2026-02708
+rule_version: 2
+status: experimental
+description: |
+  Detects an agent HTTP tool call that sends a request to a NAMED external host while declaring a loopback origin in a header the server is likely to trust -- `Host: 127.0.0.1`, `X-Forwarded-For: 127.0.0.1`, `X-Real-IP: localhost`, `X-Originating-IP: ::1`. Mined from CVE-2026-61435 (PraisonAI), whose bind-host authorization check derived "is this request local?" from `request.url.hostname`, i.e. from the Host header the caller supplies, so an internet-reachable deployment granted localhost-only privileges to anyone who asked for them. Verified on the shipped engine: two payload forms across all five event types matched nothing, and a grep of rules/ finds no Host/X-Forwarded-For spoofing rule at all. RULE_VERSION 2, after adversarial review fired version 1 on 6 of 22 benign probes. Three constraints were added, each forced by a probe. (1) THE CALL MUST BE REQUEST-ISSUING. Version 1 checked only the argument text, so an agent writing a penetration-test note through write_file -- `ffuf -u https://target.example/admin -H "X-Forwarded-For: 127.0.0.1"` -- matched, because the payload was in the file body. Code-block suppression, which version 1 relied on for exactly this sample, only helps when the example is fenced, and a note file is not. (2) `host` NEEDS A REAL HEADER CONTEXT. Version 1 accepted any QUOTED key named host, and its false-positive note claimed configuration files were excluded by that quoting requirement. They are not: JSON quotes its keys, so `{"tool":"db_query","arguments":{"host":"localhost","schema_url":"https://schemas.corp.example/..."}}` matched. `host` now requires -H, --header, a headers object, or an HTTP wire line. The `x-*` names keep the looser form, since nothing else is called x-forwarded-for. (3) THE TWO HALVES MUST BE ADJACENT AND IN THE SAME STATEMENT. Version 1 only asked that both appear somewhere in the arguments, so `curl -H 'Host: localhost' http://127.0.0.1:8080/health; curl https://status.corp.example/ping` satisfied them from two different commands. The gap is now 120 characters with no `;`, no newline, no `://`, no pipe and no `&` -- the last four because every remaining false positive was a loopback header attached to a LOOPBACK request, with an unrelated external URL in a trailing comment, an echo, or the other half of a pipeline. The pairing remains the precision handle: a request TO 127.0.0.1 carrying a virtual-host `Host:` header is ordinary local testing and does not match, because the external-URL condition demands a hostname ending in an alphabetic TLD, which no dotted-quad or bare `localhost` target satisfies.
+author: ATR Community (CVE sweep)
+date: 2026/08/23
+schema_version: '0.1'
+detection_tier: pattern
+maturity: test
+severity: high
+references:
+  cwe:
+    - CWE-290
+    - CWE-350
+  owasp_llm:
+    - LLM06:2025
+  owasp_agentic:
+    - ASI06:2026
+  mitre_attack:
+    - T1078 - Valid Accounts
+  mitre_atlas:
+    - AML.T0053 - LLM Plugin Compromise
+  cve:
+    - CVE-2026-61435
+  external:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-61435
+metadata_provenance:
+  cwe: human-reviewed
+  owasp_llm: human-reviewed
+  owasp_agentic: human-reviewed
+  mitre_attack: human-reviewed
+  mitre_atlas: human-reviewed
+compliance:
+  eu_ai_act:
+    - article: '15'
+      context: Article 15 (accuracy, robustness and cybersecurity) requires resistance to unauthorised use; this rule detects an agent request forging a loopback origin to satisfy a localhost-only authorization check on a remote service.
+      strength: primary
+    - article: '9'
+      context: Article 9 (risk management system) requires identified risks to be treated; this rule is the runtime treatment for header-derived trust decisions in agent-reachable services.
+      strength: secondary
+  nist_ai_rmf:
+    - subcategory: MG.2.3
+      context: Authorization bypass via a spoofed origin header is an identified AI risk requiring an active runtime countermeasure; this rule implements it.
+      strength: primary
+    - subcategory: MP.5.1
+      context: Cataloguing caller-controlled origin headers as an AI-specific authorization risk in the organizational risk register.
+      strength: secondary
+  iso_42001:
+    - clause: '8.1'
+      context: ISO/IEC 42001 Clause 8.1 (operational planning and control) is operationalised by detecting forged origin headers before the request is issued.
+      strength: primary
+    - clause: '8.3'
+      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is implemented through runtime detection of the spoofed header.
+      strength: secondary
+tags:
+  category: privilege-escalation
+  subcategory: forged-loopback-origin-header
+  scan_target: runtime
+  confidence: high
+  suppress_in_code_blocks: true
+agent_source:
+  type: tool_call
+  framework:
+    - any
+  provider:
+    - any
+detection:
+  condition: all
+  conditions:
+    - field: tool_args
+      operator: regex
+      value: (?:["\x27](?:tool|tool_name|toolName|name|function|mcp_tool)["\x27]\s{0,3}:\s{0,3}["\x27][\w.\-]{0,40}(?:http|curl|wget|fetch|request|req|api|webhook|url|browse|axios|httpx)[\w.\-]{0,20}["\x27]|["\x27](?:command|cmd|script|shell|args|argv)["\x27]\s{0,3}:\s{0,3}[\s\S]{0,20}\b(?:curl|wget|httpie|\bxh\b|invoke-webrequest)\b)
+      description: The call is issued by an HTTP-request tool, or by a shell tool running an HTTP client
+    - field: tool_args
+      operator: regex
+      value: (?:https?://[a-z0-9-]{2,30}(?:\.[a-z0-9-]{1,30}){0,4}\.[a-z]{2,12}(?:[:/?"\x27]|\s|$)(?:[^:;\n|&]|:[^/;\n|&]|:/[^/;\n|&]){0,120}(?:(?:-H\s{1,3}["\x27]?|--header\s{1,3}["\x27]?|\bheaders?\b["\x27]?\s{0,3}[:=]?\s{0,3}[{(\[]?\s{0,3}["\x27]?)host["\x27]?\s{0,3}[:=]\s{0,3}["\x27]?\s{0,2}(?:127\.\d{1,3}\.\d{1,3}\.\d{1,3}|localhost|\[?::1\]?|0\.0\.0\.0)\b|(?:^|[\r\n])\s{0,3}host["\x27]?\s{0,3}[:=]\s{0,3}["\x27]?\s{0,2}(?:127\.\d{1,3}\.\d{1,3}\.\d{1,3}|localhost|\[?::1\]?|0\.0\.0\.0)\b|(?:["\x27]|(?:-H\s{1,3}["\x27]?|--header\s{1,3}["\x27]?|\bheaders?\b["\x27]?\s{0,3}[:=]?\s{0,3}[{(\[]?\s{0,3}["\x27]?))(?:x-forwarded-for|x-real-ip|x-originating-ip|x-client-ip|x-forwarded-host)["\x27]?\s{0,3}[:=]\s{0,3}["\x27]?\s{0,2}(?:127\.\d{1,3}\.\d{1,3}\.\d{1,3}|localhost|\[?::1\]?|0\.0\.0\.0)\b)|(?:(?:-H\s{1,3}["\x27]?|--header\s{1,3}["\x27]?|\bheaders?\b["\x27]?\s{0,3}[:=]?\s{0,3}[{(\[]?\s{0,3}["\x27]?)host["\x27]?\s{0,3}[:=]\s{0,3}["\x27]?\s{0,2}(?:127\.\d{1,3}\.\d{1,3}\.\d{1,3}|localhost|\[?::1\]?|0\.0\.0\.0)\b|(?:^|[\r\n])\s{0,3}host["\x27]?\s{0,3}[:=]\s{0,3}["\x27]?\s{0,2}(?:127\.\d{1,3}\.\d{1,3}\.\d{1,3}|localhost|\[?::1\]?|0\.0\.0\.0)\b|(?:["\x27]|(?:-H\s{1,3}["\x27]?|--header\s{1,3}["\x27]?|\bheaders?\b["\x27]?\s{0,3}[:=]?\s{0,3}[{(\[]?\s{0,3}["\x27]?))(?:x-forwarded-for|x-real-ip|x-originating-ip|x-client-ip|x-forwarded-host)["\x27]?\s{0,3}[:=]\s{0,3}["\x27]?\s{0,2}(?:127\.\d{1,3}\.\d{1,3}\.\d{1,3}|localhost|\[?::1\]?|0\.0\.0\.0)\b)(?:[^:;\n|&]|:[^/;\n|&]|:/[^/;\n|&]){0,120}https?://[a-z0-9-]{2,30}(?:\.[a-z0-9-]{1,30}){0,4}\.[a-z]{2,12}(?:[:/?"\x27]|\s|$))
+      description: A named external host and a loopback-valued origin header, adjacent and in the same statement
+  false_positives:
+    - 'A deliberate penetration test replaying a webhook with X-Forwarded-For: 127.0.0.1 against a staging host. This matches, and matching is correct: the act being performed is the bypass, whoever is performing it.'
+    - 'Local virtual-host testing (`curl -H ''Host: app.example.com'' http://127.0.0.1:8080/`), where the loopback address is the TARGET and the header carries a real name. Neither half matches.'
+    - A reverse-proxy configuration using `proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for`, since the value is a variable rather than a loopback literal.
+    - Configuration that binds a service locally while naming a remote API -- `{"host":"localhost"}` beside `https://api.corp.example`, `- HOST=0.0.0.0` in a compose file, a local debugging proxy on a request to an external API. All of these FIRED version 1; `host` now needs a real header context.
+    - Security-tool documentation whose examples contain the payload, fenced or not. The rule now also requires the call itself to be request-issuing, so writing the ffuf line into a notes file does not match.
+response:
+  actions:
+    - alert
+  message_template: |
+    [ATR-2026-02708] Agent request targets a named external host while declaring a loopback origin (Host / X-Forwarded-For / X-Real-IP). Derive locality from the socket, never from a caller-supplied header.
+confidence: 80