agent-threat-rules 4.0.0 → 4.2.0

package/rules/context-exfiltration/ATR-2026-02602-diagram-theme-css-injection.yaml

@@ -0,0 +1,146 @@
+title: Diagram Theme Config Used to Inject Page-Wide CSS (scope escape, overlay, selector exfil)
+id: ATR-2026-02602
+rule_version: 2
+status: experimental
+description: |
+  Detects CVE-2026-41149: a mermaid initialisation directive embedded in agent-rendered content (`%%{init: {...}}%%`, or a mermaid.initialize call) whose theme value carries CSS that ESCAPES the diagram's scope. Mermaid runs themeCSS through stylis, which prefixes every selector with `#mermaid-<id>`; a selector written `:not(&)` breaks out of that prefix and applies to the whole document. From there the payload is a full-window phishing overlay or character-at-a-time exfiltration through an attribute-prefix selector whose background url() fires one request per guessed character.
+  THE PRECISION LINE, AND WHERE IT WAS DRAWN. `themeCSS` legitimately contains CSS -- `themeCSS: '.node rect { fill: #222 }'` is the documented use, braces and all -- so "contains CSS syntax" is not a signal, and an earlier draft of this rule that fired on a brace pair inside the value was rejected on exactly that benign twin before it was written down.
+  TWO FURTHER MARKERS WERE REMOVED IN ADVERSARIAL REVIEW (rule_version 2), each on measured benign fire, and both removals are corrections of the threat model rather than concessions:
+  1. `position:fixed` inside a diagram theme was claimed as a viewport-pinned
+     overlay. It is not one. Without the stylis escape, stylis prefixes the
+     selector with `#mermaid-<id>`, so the declaration is confined to the
+     diagram and covers nothing. What the marker actually selected was the
+     ordinary fullscreen/lightbox/zoom/print-watermark/pinned-legend feature that
+     docs sites build on purpose. Eleven independent benign inputs fired on it:
+     a VitePress fullscreen handler, an mkdocs-material manifest, a CHANGELOG
+     line, a vitest fixture, a minified bundle line, a Traditional-Chinese blog
+     post, a Stack Overflow answer explaining that this does NOT work, and
+     several cross-key constructions where the `position:fixed` was in a
+     neighbouring key entirely, because `[^\n]{0,200}` runs straight through the
+     closing quote of the themeCSS value. The overlay payload is still detected
+     when it is an attack, because an attack must carry the scope escape and the
+     escape is claimed. Only the escape is load-bearing.
+
+  2. The attribute-prefix selector was matched on ANY attribute name. Only
+     `[value^=` (and `$=` / `*=` on the same attribute) is claimed now, because
+     `value` is the one attribute that carries a secret the page did not choose
+     to publish, and matching on a value PREFIX is something no designer does --
+     the selector sees the server-rendered attribute, not what the user typed, so
+     it is useless for styling and useful only for guessing. Every other
+     attribute name produced benign fire and was removed: `[class^="icon-"]`
+     (icon sprites), `[id^="mermaid-"]` (scoping to mermaid's own generated
+     container), `[data-testid^="node-"]` (generated themes), `[name^="card"]`
+     and `[placeholder^=` (form-field icons), `[title^=` (step badges) -- all of
+     them next to a CDN `url()`, all of them leaking nothing. `[href^=` and
+     `[src^=` are excluded for the same reason: `a[href^="https"]` beside a
+     remote icon url() is a textbook stylesheet. Nine benign inputs fired on the
+     untyped version, including the author's own DELIBERATELY-UNCLAIMED
+     Google-Fonts `@import` the moment ANY ordinary prefix selector appeared
+     within 120 characters of it.
+
+  3. Condition 0's window is `[^\n%]`, not `[^\n]`, so it cannot run out of the
+     `%%{...}%%` directive and pick a marker out of the prose that follows it.
+     A mitigation note that shows a plain `%%{init}%%` line and then discusses
+     the escape in the next sentence was firing before this. MEASURED COST, and
+     it is the only one: a payload that puts a literal `%` (e.g. `width:100%`)
+     inside a fontFamily/altFontFamily value BEFORE the marker is now missed by
+     condition 0. The same payload inside `themeCSS` is still caught, by
+     condition 1, which carries no `%` bound -- verified on both, one fires and
+     one does not.
+
+  The remaining scope escape additionally requires a declaration block after it (`:not(&) ... {`), because an escape with no rule body changes nothing; that drops prose which merely names the marker after a `themeCSS:` colon.
+  A webfont `@import url('https://fonts.googleapis.com/...')` inside themeCSS is a plausible legitimate use of the same mechanism and is DELIBERATELY NOT CLAIMED -- it is a measured true negative, not an oversight.
+  Coverage check, re-run in review and CORRECTED. The only rule that mentions mermaid, ATR-2026-01967, is scoped to DeepChat IPC/MCP registration -- that part of the author's claim holds. What the author missed is a sibling from this same sweep: ATR-2026-02704 detects the CSS attribute-selector exfiltration primitive generically, and it fires on three of the four exfil payloads here. It reached the same conclusion independently -- it only claims SECRET-bearing attributes (`value`, `token`, `csrf`, `secret`, `password`, `api_key`, `otp`) -- which is corroboration that the untyped attribute match this rule shipped with was the wrong line. The exfil branch here is therefore largely redundant with 02704 and is kept only for the themeCSS-scoped ordering 02704 does not cover (url() before the selector). The `:not(&)` stylis scope escape is this rule's own, and nothing else detects it.
+author: ATR Community
+date: 2026/08/23
+schema_version: '0.1'
+detection_tier: pattern
+maturity: test
+severity: high
+references:
+  owasp_llm:
+    - LLM02:2025
+  owasp_agentic:
+    - ASI04:2026
+  mitre_atlas:
+    - AML.T0051 - LLM Prompt Injection
+    - AML.T0051.001 - Indirect
+  cve:
+    - CVE-2026-41149
+compliance:
+  owasp_agentic:
+    - id: ASI04:2026
+      context: Content the agent renders escapes the boundary it was given and takes over the surrounding interface, which is an agent output-handling failure rather than a model failure.
+      strength: primary
+  owasp_llm:
+    - id: LLM02:2025
+      context: 'Insecure output handling: markup produced or relayed by the model reaches a renderer that grants it document-wide effect.'
+      strength: primary
+  eu_ai_act:
+    - article: '15'
+      context: Article 15 requires resilience against attempts to manipulate system output; a diagram config that repaints the whole window is exactly such a manipulation, and detection is the control.
+      strength: primary
+    - article: '14'
+      context: A full-window overlay defeats human oversight by design -- the operator sees the attacker's surface instead of the system's -- so detecting it is an Article 14 control.
+      strength: secondary
+    - article: '9'
+      context: Rendered-output injection is a documented risk class for agent interfaces; these events are the Article 9 monitoring evidence.
+      strength: secondary
+  nist_ai_rmf:
+    - function: Manage
+      subcategory: MG.2.3
+      context: Runtime treatment for untrusted content reaching a rendering surface with more authority than intended.
+      strength: primary
+    - function: Map
+      subcategory: MP.5.1
+      context: Catalogues CSS-only injection as a distinct risk from script injection, which existing rules already cover.
+      strength: secondary
+    - function: Measure
+      subcategory: MS.2.7
+      context: Detection events document the security of the output-rendering path as MEASURE 2.7 requires.
+      strength: secondary
+  iso_42001:
+    - clause: '8.1'
+      context: Clause 8.1 operational control over the rendering pipeline that turns model output into a user-facing surface.
+      strength: primary
+    - clause: '6.2'
+      context: Preventing interface takeover and selector-based data exfiltration is an AIMS information security objective under clause 6.2.
+      strength: secondary
+    - clause: '8.4'
+      context: Impact assessment under 8.4 must account for what a rendered artifact can do to the viewer; these events are the evidence for that path.
+      strength: secondary
+tags:
+  category: context-exfiltration
+  subcategory: rendered-output-injection
+  scan_target: both
+  confidence: medium
+agent_source:
+  type: llm_io
+  framework:
+    - any
+  provider:
+    - any
+detection:
+  conditions:
+    - field: content
+      operator: regex
+      value: '%%\s*\{[^\n]{0,240}?\b(?:themeCSS|altFontFamily|fontFamily)\b["'']?\s*:\s*["''][^\n%]{0,200}?(?::not\s*\(\s*&[^\n{]{0,20}?\)[^\n]{0,40}?\{|\[\s*value\s*[\^$*]=[^\n]{0,60}?\{[^\n]{0,90}?url\s*\(\s*["'']?(?:https?:)?//|url\s*\(\s*["'']?(?:https?:)?//[^\n]{0,120}?\[\s*value\s*[\^$*]=)'
+      description: Mermaid init directive whose theme value breaks the stylis scope with :not(&) and opens a rule body, or pairs a SECRET-BEARING attribute-prefix selector with a remote url()
+    - field: content
+      operator: regex
+      value: \bthemeCSS\b["']?\s*:\s*["'][^\n]{0,200}?(?::not\s*\(\s*&[^\n{]{0,20}?\)[^\n]{0,40}?\{|\[\s*value\s*[\^$*]=[^\n]{0,60}?\{[^\n]{0,90}?url\s*\(\s*["']?(?:https?:)?//|url\s*\(\s*["']?(?:https?:)?//[^\n]{0,120}?\[\s*value\s*[\^$*]=)
+      description: A themeCSS value carrying the same two escape markers, in the JS/JSON config form
+  condition: any
+  false_positives:
+    - 'THE ONE REAL RESIDUAL, measured, and it is a whole class rather than one shape: ANY prose that reproduces the payload -- the theme key, a colon, a quote, then the stylis escape opening a rule body -- is textually identical to the attack, so no pattern separates them. Three independent constructions fire and are accepted: a CVE advisory quoting the payload, a CHANGELOG line announcing the fix, and a GitHub bug report using the escape as its reproduction case. It does not occur in 12,830 benign corpus samples or in 556 repo doc/skill files. This rule''s own prose deliberately never reassembles that sequence, and that is verified: it does not fire on itself minus its test_cases'
+    - A theme that loads a remote webfont AND matches on a value PREFIX (`[value^=`) in the same 120 characters for unrelated reasons -- constructible, never observed, and there is no styling reason to write it
+    - 'NOT a false positive any more, and recorded so it is not re-added: a mermaid theme that uses position:fixed for a fullscreen, lightbox, zoom, print-watermark or pinned-legend feature. Confined by stylis, harmless, and the marker was removed'
+    - 'NOT a false positive any more, and recorded so it is not re-widened: [class^=], [id^=], [data-*^=], [name^=], [placeholder^=], [title^=] or [href^=] beside a remote url(). Those attributes carry no secret, so the selector-exfil primitive does not apply and the marker no longer matches them'
+response:
+  actions:
+    - alert
+    - snapshot
+  auto_response_threshold: high
+  message_template: |
+    [ATR-2026-02602] A diagram theme configuration carries CSS that leaves the diagram's scope -- a stylis `:not(&)` escape opening a rule body, or a secret-bearing attribute-prefix selector paired with a remote url(). Rendered content can repaint the whole window or leak field values one character at a time. Do not render until the source of this block is established.
+confidence: 70

package/rules/context-exfiltration/ATR-2026-02608-graph-query-remote-egress.yaml

@@ -0,0 +1,109 @@
+title: LLM-Generated Graph Query Reaching a Remote Endpoint (APOC remote script, raw-IP load, remote export)
+id: ATR-2026-02608
+rule_version: 1
+status: experimental
+description: |
+  Detects a Cypher statement -- typically one an LLM wrote for a text-to-query agent -- that leaves the database: it fetches and runs a remote Cypher script (apoc.cypher.runFile at an http URL), reads from a bare IPv4 address rather than a named service, or exports graph contents to a remote URL. GHSA-2pq5-3q89-j7cc (Langroid Neo4jChatAgent) executes model-written Cypher with no validation, so a prompt injection anywhere upstream becomes a data-egress primitive. Verified on the engine: apoc.load.jsonParams and apoc.cypher.runFile at http endpoints score zero, while the file:// form only matches because two SSRF rules recognise the scheme.
+  WHAT IS DELIBERATELY NOT CLAIMED, AND WHY. apoc.load.json against an https hostname is the procedure's DOCUMENTED purpose -- the APOC manual's own first example calls a public API -- and enriching nodes by concatenating an id into a URL is ordinary practice. Both were written as benign twins and both are measured silent. That is why the load condition demands a raw IPv4 literal: a legitimate enrichment call names a service, a beacon names an address. The cost of that choice is that exfiltration to an attacker-owned DOMAIN through apoc.load is not detected here, and no attempt is made to guess at it.
+  THAT PREMISE HOLDS ONLY FOR PUBLIC ADDRESSES, which adversarial review established by counter-example. In loopback, RFC1918 and link-local space an IP literal is the NORM, not the anomaly: APOC's own integration tests call http://127.0.0.1:<port>, docker and Kubernetes fixtures address pod and bridge IPs, and ansible/terraform bootstrap jobs and non-English tutorials name 10.x/192.168.x hosts directly. Fourteen such twins fired the original condition. The load condition therefore excludes 0.x, 10.x, 127.x, 169.254.x, 172.16-31.x and 192.168.x, with one carve-in: 169.254.169.254, the cloud metadata address, still fires because reaching it is never ordinary enrichment. A beacon to a private address from a compromised in-network host is consequently NOT detected here.
+  THE EXPORT CONDITION MATCHES THE DESTINATION ARGUMENT, NOT ANY URL. It first accepted any quoted http(s) URL within 200 characters of the open paren, which made apoc.export.csv.query fire whenever the EXPORTED QUERY happened to quote a URL -- a STARTS WITH filter on a page url, a SKOS or schema.org namespace, a coalesce default, a feed identifier -- while the destination was a local file. Six such twins fired. The URL must now be a complete string argument immediately followed by the config map that every apoc.export signature requires, so a URL nested inside the query no longer counts. A second review round found that the config-map requirement alone was not enough: an exported query that itself CALLs apoc.load.json(url, {}) presents a URL followed by a config map, so the condition also requires the URL to be either the first argument or to follow a comma whose preceding character is not an open paren. apoc.export.*.data and .graph, whose destination is the third and second argument, are covered by that comma form and are carried as true positives so the carve-out cannot silently cost recall.
+  TWO LIMITS FOUND BY REVIEW AND LEFT IN PLACE ON PURPOSE. (1) The list form apoc.cypher.runFiles(['http://host/x.cypher']) is NOT matched, because the bracket sits between the paren and the quote; it was measured silent and is a real evasion. Widening the pattern to accept the bracket was tried and rejected: it turns APOC's own documentation sentence about runFiles and allowed_protocols into a false positive, which is a worse trade for a rule whose action is alert. (2) The 200-character window in the export condition cannot cross a newline, so a remote export written across several lines with a multi-line query is missed. Letting it cross newlines was tried and rejected too: a script that exports locally and then, on the next line, calls apoc.load.json against an API with a config map becomes a false positive.
+author: ATR Community
+date: 2026/08/23
+schema_version: '0.1'
+detection_tier: pattern
+maturity: test
+severity: high
+references:
+  owasp_llm:
+    - LLM02:2025
+  owasp_agentic:
+    - ASI02:2026
+  mitre_atlas:
+    - AML.T0057 - LLM Data Leakage
+    - AML.T0051 - LLM Prompt Injection
+  cve:
+    - GHSA-2pq5-3q89-j7cc
+compliance:
+  owasp_agentic:
+    - id: ASI02:2026
+      context: Model-authored query text reaches the network, so a text-to-query agent becomes an egress and remote-execution channel for whoever influenced the prompt.
+      strength: primary
+  owasp_llm:
+    - id: LLM02:2025
+      context: 'Insecure output handling: the model''s output is executed by a database engine whose procedure library can fetch and run remote code.'
+      strength: primary
+  eu_ai_act:
+    - article: '15'
+      context: 'Article 15 cybersecurity: query text crossing into remote code execution and data egress is the manipulation the article requires resilience against.'
+      strength: primary
+    - article: '10'
+      context: 'Article 10 data governance: the graph''s contents leaving the deployment boundary is a data-governance event that must be detectable.'
+      strength: secondary
+    - article: '9'
+      context: Text-to-query injection is a documented risk class for database agents; detections are the Article 9 monitoring evidence.
+      strength: secondary
+  nist_ai_rmf:
+    - function: Manage
+      subcategory: MG.2.3
+      context: Runtime treatment for model-authored queries that reach beyond the datastore.
+      strength: primary
+    - function: Map
+      subcategory: MP.5.1
+      context: Catalogues graph-query egress as distinct from SQL injection, which existing rules already cover.
+      strength: secondary
+    - function: Measure
+      subcategory: MS.2.7
+      context: Detection events document the security of the query-execution path as MEASURE 2.7 requires.
+      strength: secondary
+  iso_42001:
+    - clause: '8.1'
+      context: Clause 8.1 operational control over what the system may execute against its data stores.
+      strength: primary
+    - clause: '6.2'
+      context: Preventing unauthorised data egress from the graph is an AIMS information security objective under clause 6.2.
+      strength: secondary
+    - clause: '8.4'
+      context: Impact assessment under 8.4 must account for query-mediated egress; these events are the evidence for that path.
+      strength: secondary
+tags:
+  category: context-exfiltration
+  subcategory: query-language-egress
+  scan_target: both
+  confidence: medium
+agent_source:
+  type: mcp_exchange
+  framework:
+    - any
+  provider:
+    - any
+detection:
+  conditions:
+    - field: content
+      operator: regex
+      value: \bapoc\.cypher\.(?:runFile|runFiles|runSchemaFiles?|runMany)\s*\(\s*["'](?:https?|ftp)://
+      description: APOC procedure fetching and executing a Cypher script from a remote URL
+    - field: content
+      operator: regex
+      value: \bapoc\.load\.(?:json|jsonParams|csv|csvParams|xml|html|arrow)\s*\(\s*["'](?:https?)://(?:(?:1[01]\d|12[0-6]|12[89]|1[3-5]\d|16[0-8]|17[01]|17[3-9]|18\d|19[01]|19[3-9]|2[0-4]\d|25[0-5]|1[1-9]|[2-9]\d|[1-9])\.(?:\d{1,3}\.){2}\d{1,3}|169\.254\.169\.254|172\.(?:1[0-5]|3[2-9]|[4-9]\d|1\d\d|2[0-4]\d|25[0-5]|\d)\.\d{1,3}\.\d{1,3}|192\.(?:1[0-5]\d|16[0-79]|1[7-9]\d|2[0-4]\d|25[0-5]|[1-9]\d|\d)\.\d{1,3}\.\d{1,3})
+      description: APOC load procedure pointed at a bare PUBLIC IPv4 address rather than a named service (loopback, RFC1918 and link-local are excluded; 169.254.169.254 cloud metadata is not)
+    - field: content
+      operator: regex
+      value: \bapoc\.export\.(?:json|csv|cypher|graphml)\.(?:all|data|query|graph)\s*\(\s*(?:[^\n]{0,200}?[^\n(,\s]\s*,\s*)?["'](?:https?|ftp)://[^"'\s\n]{0,300}["']\s*,\s*[\{\$]
+      description: APOC export procedure whose DESTINATION argument is a remote URL -- the URL must be a whole string argument followed by the mandatory config map, so a URL merely quoted inside the exported query does not count
+  condition: any
+  false_positives:
+    - 'REMAINS AND IS NOT FIXABLE BY PATTERN: security writing that quotes one of these payloads verbatim -- an advisory, an OWASP writeup, a pentest finding -- fires, including inside a fenced code block. suppress_in_code_blocks is deliberately NOT set, because a text-to-query agent''s own model output routinely arrives wrapped in a ```cypher fence and suppressing it would remove the rule''s primary channel.'
+    - 'REMAINS BY DESIGN: apoc.cypher.runFile against an INTERNAL http host, e.g. a nightly schema bootstrap served from an artifact server. Fetching and executing a Cypher script over the network is the primitive this rule is about, so the host is not used to excuse it.'
+    - An operations job that exports a graph snapshot to a PUBLIC HTTP object store, where the destination is a whole string argument followed by the config map
+    - A data pipeline that loads seed data from a public host addressed by a bare IP rather than a name
+    - 'REMAINS: a tutorial or runbook that hosts a sample file on a public throwaway box and names it by IP, including the RFC 5737 documentation ranges. Those ranges cannot be excluded -- the GHSA payload this rule is built on uses 198.51.100.9, which is one of them.'
+    - 'REMAINS: apoc.export.*.query whose exported query RETURNs a bare URL literal immediately followed by a bare map literal, e.g. RETURN n.a, ''https://x'', {k:1}. That is not idiomatic Cypher; separating it from a real destination argument would need paren-depth tracking, which a regex cannot do.'
+response:
+  actions:
+    - alert
+    - snapshot
+  auto_response_threshold: high
+  message_template: |
+    [ATR-2026-02608] A graph query fetches remote code, reads from a bare IP address, or exports graph contents to a remote URL. If this statement was written by a model, treat the destination as attacker-chosen until proven otherwise.
+confidence: 70

package/rules/context-exfiltration/ATR-2026-02621-prompt-mention-autofetch-internal-target.yaml

@@ -0,0 +1,102 @@
+title: Prompt-Embedded Auto-Fetch Mention Pointed at an Internal Address
+id: ATR-2026-02621
+rule_version: 2
+status: experimental
+description: |
+  Detects an @-mention token inside prompt text whose target is an internal address. CLIs that expand mentions (@url:, @fetch:, @web:) resolve them BEFORE the agent runs: the URL is fetched and the response body is prepended into model context, with no tool call, no egress policy and no consent gate. CVE-2026-47395 (PraisonAI CLI) is this exact mechanism -- @url:<http...> is urlopen'd and inlined, with no loopback, RFC1918 or metadata restriction.
+  MEASURED GAP. `@url:http://localhost.:8766/debug/vars summarize this` and `@url:http://2130706433:8765/admin` returned zero matches on all seven event types. The same line aimed at 169.254.169.254 fires ATR-2026-00500 and ATR-2026-00568. So the metadata IP is guarded and loopback / private space is not, and nothing in the corpus recognises the auto-expanding mention syntax itself as a fetch primitive.
+  WHY THE PLAIN LOOPBACK FORM IS NOT FLAGGED. ATR-2026-00013 documents in-rule that bare localhost / 127.0.0.1 is deliberately exempt, because coding agents legitimately read their own dev server. `@url:http://localhost:3000/api/health` is that same benign act and this rule leaves it alone. Condition 1 therefore fires only on encodings of the loopback address that a human never types by hand -- decimal, octal, hex, short-form, trailing-dot -- whose only purpose is to defeat a string comparison. Condition 2 keeps the plain hosts but requires a control-plane port or a secret-store path alongside them, so the dev-server exemption survives intact.
+author: ATR Community
+date: 2026/08/23
+schema_version: '0.1'
+detection_tier: pattern
+maturity: test
+severity: high
+references:
+  cve:
+    - CVE-2026-47395
+  owasp_llm:
+    - LLM01:2025
+  owasp_agentic:
+    - ASI05:2026
+  mitre_atlas:
+    - AML.T0051 - LLM Prompt Injection
+    - AML.T0057 - LLM Data Leakage
+compliance:
+  owasp_agentic:
+    - id: ASI05:2026
+      context: The mention expands into an outbound request the agent never decided to make, reaching resources outside the boundary the operator granted.
+      strength: primary
+  owasp_llm:
+    - id: LLM01:2025
+      context: Content fetched from the internal endpoint is prepended into model context as trusted text, which is indirect prompt injection with an SSRF carrier.
+      strength: primary
+  eu_ai_act:
+    - article: '15'
+      context: 'Article 15 accuracy and robustness: an unconsented fetch of internal state into model context alters system behaviour through a path the operator cannot see.'
+      strength: primary
+    - article: '14'
+      context: Expansion happens before the agent runs, so the human oversight Article 14 requires has no point at which to intervene; detection restores that visibility.
+      strength: secondary
+    - article: '12'
+      context: 'Article 12 record-keeping: these events log network reach that leaves no tool-call trace of its own.'
+      strength: secondary
+  nist_ai_rmf:
+    - function: Manage
+      subcategory: MG.2.3
+      context: Runtime treatment for prompt-borne SSRF that bypasses the tool layer entirely.
+      strength: primary
+    - function: Map
+      subcategory: MP.5.1
+      context: Catalogues pre-execution mention expansion as a distinct attack surface from tool-invoked fetches.
+      strength: secondary
+    - function: Measure
+      subcategory: MS.2.7
+      context: Detection events document the security and resilience property MEASURE 2.7 asks be measured for network egress.
+      strength: secondary
+  iso_42001:
+    - clause: '8.1'
+      context: 'Clause 8.1 operational control: content entering model context from an internal endpoint has bypassed every configured input control.'
+      strength: primary
+    - clause: '6.2'
+      context: Preventing unauthorised internal network reach is an AIMS information security objective under clause 6.2.
+      strength: secondary
+    - clause: '8.4'
+      context: Impact assessment under clause 8.4 must account for internal service data reaching the model provider through context.
+      strength: secondary
+tags:
+  category: context-exfiltration
+  subcategory: prompt-mention-ssrf
+  scan_target: both
+  confidence: medium
+agent_source:
+  type: llm_io
+  framework:
+    - any
+  provider:
+    - any
+detection:
+  conditions:
+    - field: user_input
+      operator: regex
+      value: (?i)@(?:(?:url|fetch|web|link|page|browse|site|doc):(?:https?://)?|https?://)(?:2130706433|3232235521|2851995648|0x0*7f0{0,6}1\b|0x0*a9fea9fe\b|0177(?:\.0+){2}\.0*1|127\.1[:/]|localhost\.[:/]|\[::1\]|\[::ffff:(?:7f00:1|127\.0\.0\.1)\])
+      description: Auto-expanding mention aimed at a non-dotted-quad encoding of loopback or link-local -- decimal, octal, hex, short-form or trailing-dot
+    - field: user_input
+      operator: regex
+      value: (?i)@(?:(?:url|fetch|web|link|page|browse|site|doc):(?:https?://)?|https?://)(?:127\.\d{1,3}\.\d{1,3}\.\d{1,3}|localhost|0\.0\.0\.0|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|172\.(?:1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3}|[a-z0-9-]{1,30}\.internal)(?::\d{1,5})?(?:/[^\s"']{0,30})?(?:/v1/secret|/v1/kv|/v2/keys|/latest/meta-data|/computeMetadata|/actuator/env|/debug/pprof|/v1/sys/wrapping|/\.env\b|/\.git/config|/_cluster/settings|docker\.sock)
+      description: Auto-expanding mention aimed at internal space on a path that reads secret material (not a health or version endpoint)
+  condition: any
+  false_positives:
+    - A developer deliberately asking the agent to read a local control-plane endpoint during debugging -- e.g. @url:http://localhost:8200/v1/secret while working on Vault integration. The rule fires by design; provenance of the prompt is what triage must establish.
+    - 'Bare @url: mentions aimed at localhost dev servers are NOT flagged, by design (ATR-2026-00013 exemption)'
+    - 'A control-plane PORT alone is not sufficient and is deliberately not used: measured during authoring, it fired on six out of six plausible local-dev prompts (local elasticsearch, redis, mongo, couchdb, vault health, docker version). Condition 2 requires a secret-material PATH instead.'
+    - 'MEASURED AND FIXED (adversarial review 2026-08-23). The mention prefix was `\s*[:=]\s*`, which is not the mention syntax -- it is the variable syntax of REST-client `.http` files (JetBrains HTTP Client, VS Code REST Client), where `@url = http://localhost:8080/actuator/env` and `@site = http://[::1]:8080/` are ordinary unquoted declarations with nothing to do with this attack. Four such files and a hand-written `@link: http://localhost:8080/actuator/env` docblock all fired. Prefix tightened to a literal `:` with no surrounding whitespace, which is the actual CVE-2026-47395 token form; all six re-run clean and no true positive was lost.'
+    - 'RESIDUAL AND NOT FIXABLE AT THE PATTERN LAYER. The evidence this rule matches is a literal string, and writing ABOUT the attack reproduces that string byte for byte. Measured on 14 authored benign texts that all still fire: a vitest regression test for the CVE fix, a CHANGELOG security entry, a generated policy denylist, Traditional Chinese and Japanese advisories, an SSRF payload wordlist, the mention library''s own README, a prompt-injection benchmark row, a pentest report finding, an incident triage chat log, an agent framework''s own system prompt documenting @browse:, a nuclei template, a docs table of blocked hosts -- and this rule''s own YAML file, which fires itself. No single-event condition separates these from the attack, because they are the same bytes. Triage must establish provenance; a repository that has PATCHED CVE-2026-47395 will carry these artifacts and alert on them routinely. Deliberately NOT papered over with a quote/backtick lookbehind or suppress_in_code_blocks: both would be defeated by one character of attacker formatting, and this rule''s main carrier is untrusted document text arriving on tool_response.'
+    - 'SCOPE NOTE. `field: user_input` is not user-typed-only. src/engine.ts resolves user_input to event.content on llm_input AND tool_response, so every file the agent READS is in scope for this rule -- which is what makes the residual documentation class above an operational cost rather than a theoretical one.'
+response:
+  actions:
+    - alert
+  auto_response_threshold: high
+  message_template: |
+    [ATR-2026-02621] Prompt-embedded auto-fetch mention aimed at an internal address. Mention expansion happens before the agent runs, so no tool-level egress policy applies. Verify who authored this prompt text (CVE-2026-47395).
+confidence: 70

package/rules/context-exfiltration/ATR-2026-02623-obfuscated-uri-scheme-sanitizer-bypass.yaml

@@ -0,0 +1,109 @@
+title: Dangerous URI Scheme Obfuscated by Interstitial Characters
+id: ATR-2026-02623
+rule_version: 2
+status: experimental
+description: |
+  Detects a javascript:, vbscript: or data:text/html URI whose SCHEME NAME has been broken up by characters that a URL parser discards but a string-matching sanitizer does not: a raw tab, newline, carriage return or NUL, the numeric character reference for any of them, or a zero-padded numeric reference standing in for the scheme's first letter. Also covers an svg-namespaced script element carrying an HTML-style src attribute, a construct SVG itself never uses (SVG script loads through href / xlink:href) and which therefore only appears when something is aiming at an HTML parser past a sanitizer. CVE-2026-31807 (SiYuan SVG sanitizer bypass) and CVE-2022-1243 (urijs incorrect protocol extraction via CR, LF and TAB) are the same defect seen from two sides.
+  MEASURED GAP. `<a href="java&#9;script:alert(document.cookie)">`, a raw-newline split, and a zero-padded `&#0000000106;avascript:` all returned zero real matches across the seven event types, while the plain `<a href="javascript:fetch(document.cookie)">` control fires ATR-2026-00511, 00571 and 00497. Reading ATR-2026-00571 explains why: its pattern is `javascript:\s*(?:alert|eval|document\.|window\.|fetch|...)`, which binds both the literal scheme spelling and the callee that follows it. This rule deliberately does NOT require a callee -- an attacker who has already spelled the scheme as java&#9;script: has declared intent, and requiring a known callee is what let `javascript:new Function(atob(...))` through in the first place.
+  WHY A QUOTED URI-BEARING POSITION IS REQUIRED. The first draft matched the split scheme anywhere. Measured against hand-written benign text it fired on YAML and on wrapped prose, because `- java` on one line followed by `script:` on the next contains the literal java\nscript: sequence. Newline is not droppable from the junk set -- CVE-2022-1243 names LF explicitly -- so the draft required the match to sit where a URI goes: an href/src/action attribute, a navigation argument, or a markdown link target.
+  That was not enough, and adversarial review measured why. The position test is a substring test with no word boundary, so `permalink:`, `redirect_uri:`, `avatarUrl:`, `geolocation:`, `transaction:` and `EXTRACTION=` all satisfied it, and every one of the original FPs came straight back -- in YAML, in a Makefile, in a JS object literal, in an OpenAPI document, in a TSV table, in a CHANGELOG and in Japanese prose (11 measured FPs). The discriminator that actually works is the QUOTE: a URI sitting in an href, a src or a navigation argument is always quoted, while a bare YAML scalar or a make variable is not. The quote is therefore mandatory on the keyword branch. The markdown branch keeps no quote but may no longer cross a line break, since a CommonMark inline destination starts on the same line as `](` -- allowing \s* there let `handlers["java"](\njava\nscript: ctx)` match.
+  SCOPE. The entity-encoded COLON form (javascript&#58;) is not covered here. The bare `<svg:script>...</svg:script>` element is deliberately NOT covered either: adversarial review measured it firing on an Apache Batik CDATA example and on a zh-TW XHTML+SVG tutorial exactly as it fired on the payload, because at the pattern tier the two differ only in the script body, which this rule does not read. Only the src-attribute form, which SVG never legitimately produces, is kept.
+author: ATR Community
+date: 2026/08/23
+schema_version: '0.1'
+detection_tier: pattern
+maturity: test
+severity: high
+references:
+  cve:
+    - CVE-2026-31807
+    - CVE-2022-1243
+  owasp_llm:
+    - LLM05:2025
+  owasp_agentic:
+    - ASI04:2026
+  mitre_atlas:
+    - AML.T0051 - LLM Prompt Injection
+    - AML.T0057 - LLM Data Leakage
+compliance:
+  owasp_agentic:
+    - id: ASI04:2026
+      context: Content the agent emits or relays executes in the rendering surface, taking actions in the victim's session that the agent was never asked to take.
+      strength: primary
+  owasp_llm:
+    - id: LLM05:2025
+      context: 'Improper output handling: model or tool output containing an executable URI is rendered without neutralisation, which is the canonical instance of this category.'
+      strength: primary
+  eu_ai_act:
+    - article: '15'
+      context: 'Article 15 robustness: an obfuscated scheme is an explicit attempt to defeat the system''s own input sanitisation, which is the attack class the article names.'
+      strength: primary
+    - article: '9'
+      context: Rendered-output injection is a documented risk for agents with a UI surface; these detections are the Article 9 monitoring control.
+      strength: secondary
+    - article: '12'
+      context: 'Article 12 record-keeping: script execution in a rendered surface leaves no server-side trace of its own.'
+      strength: secondary
+  nist_ai_rmf:
+    - function: Manage
+      subcategory: MG.2.3
+      context: Runtime treatment for executable content reaching a rendering surface through agent output.
+      strength: primary
+    - function: Map
+      subcategory: MP.5.1
+      context: Catalogues sanitizer-evasion encodings as distinct from the plain scheme, which is exactly the half existing coverage missed.
+      strength: secondary
+    - function: Measure
+      subcategory: MS.2.7
+      context: Detection events supply the security and resilience evidence MEASURE 2.7 asks be documented for the rendering path.
+      strength: secondary
+  iso_42001:
+    - clause: '8.1'
+      context: 'Clause 8.1 operational control: content leaving the system carries executable code into a downstream surface.'
+      strength: primary
+    - clause: '6.2'
+      context: Preventing script execution in rendered agent output is an AIMS information security objective under clause 6.2.
+      strength: secondary
+    - clause: '8.4'
+      context: Impact assessment under clause 8.4 must account for agent output rendered in a browser under a user's own session.
+      strength: secondary
+tags:
+  category: context-exfiltration
+  subcategory: sanitizer-evasion
+  scan_target: both
+  confidence: medium
+agent_source:
+  type: llm_io
+  framework:
+    - any
+  provider:
+    - any
+detection:
+  conditions:
+    - field: content
+      operator: regex
+      value: '(?i)(?:(?:href|src|action|formaction|xlink:href|url|uri|link|location|open_url|navigate|goto|window\s*\.\s*open)\s*[=(:]\s*(?:\\{0,2}[\"''`])\s*|\]\([ \t]{0,4})(?:j(?:[\x00\x09\x0a\x0d]|&#x0*(?:9|a|d);|&#0*(?:9|10|13);|&Tab;|&NewLine;){1,10}avascript|ja(?:[\x00\x09\x0a\x0d]|&#x0*(?:9|a|d);|&#0*(?:9|10|13);|&Tab;|&NewLine;){1,10}vascript|jav(?:[\x00\x09\x0a\x0d]|&#x0*(?:9|a|d);|&#0*(?:9|10|13);|&Tab;|&NewLine;){1,10}ascript|java(?:[\x00\x09\x0a\x0d]|&#x0*(?:9|a|d);|&#0*(?:9|10|13);|&Tab;|&NewLine;){1,10}script|javas(?:[\x00\x09\x0a\x0d]|&#x0*(?:9|a|d);|&#0*(?:9|10|13);|&Tab;|&NewLine;){1,10}cript|javasc(?:[\x00\x09\x0a\x0d]|&#x0*(?:9|a|d);|&#0*(?:9|10|13);|&Tab;|&NewLine;){1,10}ript|javascr(?:[\x00\x09\x0a\x0d]|&#x0*(?:9|a|d);|&#0*(?:9|10|13);|&Tab;|&NewLine;){1,10}ipt|javascri(?:[\x00\x09\x0a\x0d]|&#x0*(?:9|a|d);|&#0*(?:9|10|13);|&Tab;|&NewLine;){1,10}pt|javascrip(?:[\x00\x09\x0a\x0d]|&#x0*(?:9|a|d);|&#0*(?:9|10|13);|&Tab;|&NewLine;){1,10}t|v(?:[\x00\x09\x0a\x0d]|&#x0*(?:9|a|d);|&#0*(?:9|10|13);|&Tab;|&NewLine;){1,10}bscript|vb(?:[\x00\x09\x0a\x0d]|&#x0*(?:9|a|d);|&#0*(?:9|10|13);|&Tab;|&NewLine;){1,10}script|vbs(?:[\x00\x09\x0a\x0d]|&#x0*(?:9|a|d);|&#0*(?:9|10|13);|&Tab;|&NewLine;){1,10}cript|vbsc(?:[\x00\x09\x0a\x0d]|&#x0*(?:9|a|d);|&#0*(?:9|10|13);|&Tab;|&NewLine;){1,10}ript|vbscr(?:[\x00\x09\x0a\x0d]|&#x0*(?:9|a|d);|&#0*(?:9|10|13);|&Tab;|&NewLine;){1,10}ipt|vbscri(?:[\x00\x09\x0a\x0d]|&#x0*(?:9|a|d);|&#0*(?:9|10|13);|&Tab;|&NewLine;){1,10}pt|vbscrip(?:[\x00\x09\x0a\x0d]|&#x0*(?:9|a|d);|&#0*(?:9|10|13);|&Tab;|&NewLine;){1,10}t)\s*:'
+      description: Dangerous URI scheme split by a character the parser discards -- raw CR/LF/TAB/NUL or its numeric character reference -- in a URI-bearing position
+    - field: content
+      operator: regex
+      value: (?i)(?:(?:href|src|action|formaction|xlink:href|url|uri|link|location|open_url|navigate|goto|window\s*\.\s*open)\s*[=(:]\s*(?:\\{0,2}[\"'`])\s*|\]\([ \t]{0,4})(?:&#0*106;|&#x0*6a;)avascript\s*:|(?:(?:href|src|action|formaction|xlink:href|url|uri|link|location|open_url|navigate|goto|window\s*\.\s*open)\s*[=(:]\s*(?:\\{0,2}[\"'`])\s*|\]\([ \t]{0,4})(?:&#0*118;|&#x0*76;)bscript\s*:|(?:(?:href|src|action|formaction|xlink:href|url|uri|link|location|open_url|navigate|goto|window\s*\.\s*open)\s*[=(:]\s*(?:\\{0,2}[\"'`])\s*|\]\([ \t]{0,4})(?:&#0*100;|&#x0*64;)ata\s*:\s*text/html
+      description: Dangerous URI scheme whose leading character is supplied as a zero-padded numeric character reference
+    - field: content
+      operator: regex
+      value: (?i)<\s*svg\s*:\s*script\b[^>]{0,200}\bsrc\s*=
+      description: Namespace-prefixed script ELEMENT -- an opening tag carrying a src attribute or closed by a matching end tag, not a bare mention of the tag name in prose
+  condition: any
+  false_positives:
+    - Text where 'java' ends a line and a 'script:' key begins the next -- YAML, workflow files, wrapped prose. Measured during authoring, then measured AGAIN in adversarial review because the URI-position test had no word boundary. Now excluded by requiring the value to be quoted.
+    - 'Security writing or a sanitizer test suite that quotes an obfuscated scheme verbatim, including this rule''s own test cases. Measured in adversarial review: an explainer showing the payload inside a fenced code block fires, and so does prose warning that <svg:script src=> is the wrong attribute. Both are the payload bytes; the pattern tier cannot see the surrounding intent, and suppress_in_code_blocks is deliberately NOT set because a markdown fence would then be a one-character evasion.'
+    - 'The plain javascript: scheme is deliberately NOT matched here; ATR-2026-00571 already covers it'
+    - 'A quoted URI-position value that legitimately begins with the token ''java'' or ''vb'' and is followed only by a raw TAB/CR/LF and then a ''script:'' token -- e.g. a YAML scalar src: "java<TAB>script: label" or a JS template literal `java\nscript: ...`. Both were constructed adversarially and neither is idiomatic, but they remain reachable: dropping raw TAB/LF from the junk set would delete the CVE-2022-1243 core, so they are accepted.'
+    - Namespace-prefixed script elements that are ordinary markup -- <html:script src=>, <xhtml:script src=> in an XSLT stylesheet, <ns2:script> in a JAXB/SOAP payload. Measured FPs in adversarial review; the prefix set is now svg only.
+    - 'Documentation showing a complete <svg:script>...</svg:script> worked example. NOT a false positive any more and NOT detected either: that branch was removed after it fired identically on an Apache Batik CDATA example, a zh-TW compound-document tutorial and the attack payload. Detecting it needs the script body, which is a different tier.'
+response:
+  actions:
+    - alert
+  auto_response_threshold: high
+  message_template: |
+    [ATR-2026-02623] Dangerous URI scheme obfuscated so a string-matching sanitizer cannot see it, but a browser still executes it. Do not render this content (CVE-2026-31807 / CVE-2022-1243 class).
+confidence: 75

package/rules/context-exfiltration/ATR-2026-02649-vendor-fqdn-label-prefix-confusion.yaml

@@ -0,0 +1,109 @@
+title: Vendor API Hostname Used as a Label Prefix of Another Domain
+id: ATR-2026-02649
+rule_version: 2
+status: experimental
+description: |
+  Detects a hostname in which a well-known API FQDN is only the LEFT-HAND part of a longer domain -- `api.contentful.com.collector.example`, `api.openai.com.relay.example`, `login.microsoftonline.com.attacker.io`. Nobody owns those names except the owner of the trailing domain, so any allow-list, log filter or human eye that matches by "starts with" or "contains" reads them as the vendor while the traffic goes somewhere else. GHSA-2xhg-73j7-rrgx (Contentful MCP server) is the reference case: the `host` and `proxy` arguments of export_space/import_space are model- controllable and the CMA client still attaches the operator's management token, so the model chooses where the company's credential is delivered.
+  THE TWO SHAPES. Condition 1 is the general one and needs no context at all: a vendor FQDN followed by two more labels, in URL or assignment position. It is unambiguous -- `bucket.s3.amazonaws.com` (vendor as SUFFIX, which is legitimate) does not match, because the extra labels must come AFTER the vendor name. Condition 2 covers the same trick with only ONE extra label (`api.openai.com.internal`), which is ambiguous on its own, so it is required to appear as the value of an endpoint-override parameter -- base_url, api_base, host, proxy, serverUrl, endpoint.
+  DELIBERATE NON-SCOPE. The plain redirect -- `OPENAI_BASE_URL= https://relay.collector.example/v1` -- is NOT claimed. Deciding that a host is "not the vendor's" requires a negative match the engine cannot express, and the benign case is common: every local model server, gateway and LiteLLM proxy sets exactly that variable to exactly that kind of host. Claiming it would flag them all. What is claimed is only the form that is wrong by construction.
+  Regional legitimate suffixes were checked: `s3.amazonaws.com.cn` is real, and it does not match, because both conditions need two further labels.
+  WHAT rule_version 2 GAVE UP, DELIBERATELY. Condition 1 now requires a scheme in front and a path or port behind. A look-alike host quoted bare (`api.openai.com.relay.example` with no scheme and no path) is only caught when it sits in an endpoint-override parameter, via condition 2. That is a real recall gap and an easy evasion; it is accepted because without it the rule fired on 14 of 16 hand-written benign inputs -- host-derived filenames, HAR captures, TLS cert paths, VCR cassettes, k8s ExternalName values, phishing-awareness bulletins and blocklists. Coverage that costs that much is negative coverage.
+author: ATR Community
+date: 2026/08/23
+schema_version: '0.1'
+detection_tier: pattern
+maturity: test
+severity: high
+references:
+  ghsa:
+    - GHSA-2xhg-73j7-rrgx
+  cwe:
+    - CWE-350
+    - CWE-346
+    - CWE-1385
+  owasp_llm:
+    - LLM02:2025
+  owasp_agentic:
+    - ASI02:2026
+  mitre_atlas:
+    - AML.T0057 - LLM Data Leakage
+  mitre_attack:
+    - 'T1583.001 - Acquire Infrastructure: Domains'
+  external:
+    - https://github.com/advisories/GHSA-2xhg-73j7-rrgx
+compliance:
+  owasp_agentic:
+    - id: ASI02:2026
+      context: Credentials and payloads intended for a named vendor are delivered to a domain the attacker controls, while every string-matching control still reads the vendor's name.
+      strength: primary
+  owasp_llm:
+    - id: LLM02:2025
+      context: 'Sensitive information disclosure through destination confusion: the operator''s API token travels to the attacker because the endpoint argument was model-controllable.'
+      strength: primary
+  eu_ai_act:
+    - article: '15'
+      context: 'Article 15 resilience: an allow-list defeated by prefix matching is a control that does not hold under adversarial input, and these detections are how its failure becomes visible.'
+      strength: primary
+    - article: '10'
+      context: Article 10 data governance -- data leaving to an unintended processor because a hostname was misread.
+      strength: secondary
+    - article: '12'
+      context: 'Article 12 traceability: logs that record the vendor''s name for traffic that never reached the vendor are misleading unless this confusion is flagged.'
+      strength: secondary
+  nist_ai_rmf:
+    - function: Manage
+      subcategory: MG.2.3
+      context: Runtime treatment for the risk that egress allow-lists are matched by substring rather than by authority.
+      strength: primary
+    - function: Measure
+      subcategory: MS.2.7
+      context: Detection events evidence whether destination controls actually bound the traffic.
+      strength: primary
+    - function: Map
+      subcategory: MP.5.1
+      context: Characterises hostname authority confusion as a distinct risk from an outright unknown destination.
+      strength: secondary
+  iso_42001:
+    - clause: '8.1'
+      context: Clause 8.1 control of externally provided processes depends on knowing which external party is actually being called.
+      strength: primary
+    - clause: '8.4'
+      context: Impact assessment under clause 8.4 must account for operator credentials being delivered to a look-alike domain.
+      strength: secondary
+    - clause: '6.2'
+      context: Ensuring outbound traffic reaches the intended processor is an AIMS objective under clause 6.2.
+      strength: secondary
+tags:
+  category: context-exfiltration
+  subcategory: hostname-authority-confusion
+  scan_target: both
+  confidence: medium
+agent_source:
+  type: mcp_exchange
+  framework:
+    - any
+  provider:
+    - any
+detection:
+  conditions:
+    - field: content
+      operator: regex
+      value: https?://(?:api\.openai\.com|api\.anthropic\.com|api\.github\.com|github\.com|raw\.githubusercontent\.com|api\.slack\.com|hooks\.slack\.com|login\.microsoftonline\.com|graph\.microsoft\.com|oauth2\.googleapis\.com|accounts\.google\.com|generativelanguage\.googleapis\.com|api\.contentful\.com|api\.stripe\.com|s3\.amazonaws\.com|sts\.amazonaws\.com|api\.notion\.com|api\.linear\.app|api\.telegram\.org|registry\.npmjs\.org|files\.pythonhosted\.org|api\.mistral\.ai|api\.groq\.com|api\.cohere\.com|huggingface\.co)\.[a-z0-9-]{1,63}\.[a-z]{2,24}[/:]
+      description: Vendor FQDN followed by two further labels IN URL AUTHORITY POSITION -- a scheme in front and a path or port behind. rule_version 1 also accepted the bare `//`, `@` and `key:` prefixes, which made every host-derived FILENAME a match (api.openai.com.2026-08-23.har, api.github.com.chain.pem, api.stripe.com.access.log) and every split-horizon internal name (api.contentful.com.svc.cluster.local).
+    - field: content
+      operator: regex
+      value: \b(?:[a-z_]{0,16}base_?url|api_?base|["']?\bhost\b["']?|["']?\bproxy\b["']?|server_?url|\bendpoint\b|api_?host|["']?\burl\b["']?)["']?\s*[:=]\s*["']?(?:https?://)?(?:api\.openai\.com|api\.anthropic\.com|api\.github\.com|github\.com|raw\.githubusercontent\.com|api\.slack\.com|hooks\.slack\.com|login\.microsoftonline\.com|graph\.microsoft\.com|oauth2\.googleapis\.com|accounts\.google\.com|generativelanguage\.googleapis\.com|api\.contentful\.com|api\.stripe\.com|s3\.amazonaws\.com|sts\.amazonaws\.com|api\.notion\.com|api\.linear\.app|api\.telegram\.org|registry\.npmjs\.org|files\.pythonhosted\.org|api\.mistral\.ai|api\.groq\.com|api\.cohere\.com|huggingface\.co)\.[a-z0-9-]{1,63}\.[a-z]{2,24}
+      description: 'Endpoint-override parameter set to a vendor FQDN that carries two further labels. Two changes from rule_version 1: the key names are \b-anchored, so deny_host / block_url / allow_endpoint no longer match via their suffix (a blocklist entry is not an endpoint override), and the value needs two labels plus a TLD, so a one-label corporate suffix (HTTPS_PROXY=api.anthropic.com.internal) is out of scope rather than alerted on.'
+  condition: any
+  false_positives:
+    - MEASURED AND NOT FIXED. Threat-intel and incident writing that quotes a look-alike URL WITH A PATH -- an IOC list, a runbook line such as 'block https://api.openai.com.relay.example/v1' -- is byte-identical to the redirect itself and still fires. This is the irreducible residue of a hostname signature and is why the action is alert only. Quoting the bare look-alike host without a path no longer fires.
+    - 'A deliberately vendor-shaped test double (OPENAI_BASE_URL=https://api.openai.com.mock.local/v1 pointing at a recorded-response container). Measured: fires. The hostname really is authority-confusing, so the alert is arguably correct, but it is not an attack.'
+    - An internal split-horizon DNS name that appends ONE corporate label to a vendor FQDN is no longer claimed at all (rule_version 2 requires two labels plus a TLD in both conditions).
+    - A test fixture that constructs a look-alike host WITH A PATH to assert the allow-list rejects it.
+response:
+  actions:
+    - alert
+  auto_response_threshold: high
+  message_template: |
+    [ATR-2026-02649] A hostname places a well-known vendor API FQDN in front of another domain, so it resolves to the tail domain while reading as the vendor. Any credential attached to this request goes to the tail domain''s owner. Reference: GHSA-2xhg-73j7-rrgx. Check where the hostname came from and whether a token was attached.
+confidence: 75