agent-threat-rules 4.0.0 → 4.2.0

package/rules/excessive-autonomy/ATR-2026-00050-runaway-agent-loop.yaml

@@ -12,7 +12,7 @@ description: |
   costs, and may indicate logic errors or adversarial manipulation.
 author: ATR Community
 date: 2026/03/08
-schema_version: "0.1"
+schema_version: '0.1'
 detection_tier: pattern
 maturity: test
 severity: high
@@ -25,55 +25,53 @@ references:
   mitre_atlas:
     - AML.T0053 - AI Agent Tool Invocation
     - AML.T0046 - Spamming AI System with Chaff Data
-
 compliance:
   owasp_agentic:
     - id: ASI05:2026
-      context: "Runaway agent loops represent uncontrolled autonomous execution — the agent performs repeated identical actions without human intervention, satisfying the ASI05:2026 Unexpected Code Execution category at the behavioral level."
+      context: Runaway agent loops represent uncontrolled autonomous execution — the agent performs repeated identical actions without human intervention, satisfying the ASI05:2026 Unexpected Code Execution category at the behavioral level.
       strength: primary
   owasp_llm:
     - id: LLM06:2025
-      context: "An agent running infinite retry loops without termination conditions exercises excessive agency beyond its task scope, accumulating costs and resource consumption classified under LLM06:2025."
+      context: An agent running infinite retry loops without termination conditions exercises excessive agency beyond its task scope, accumulating costs and resource consumption classified under LLM06:2025.
       strength: primary
     - id: LLM10:2025
-      context: "Runaway loops that exhaust compute resources, API rate limits, or accumulated context constitute an LLM10:2025 Unbounded Consumption incident with direct financial and availability impact."
+      context: Runaway loops that exhaust compute resources, API rate limits, or accumulated context constitute an LLM10:2025 Unbounded Consumption incident with direct financial and availability impact.
       strength: secondary
   eu_ai_act:
-    - article: "14"
-      context: "Article 14 human oversight requires that AI systems can be stopped and corrected; runaway loops that resist termination or mask their loop state undermine the human override capability Article 14 mandates."
+    - article: '14'
+      context: Article 14 human oversight requires that AI systems can be stopped and corrected; runaway loops that resist termination or mask their loop state undermine the human override capability Article 14 mandates.
       strength: primary
-    - article: "15"
-      context: "Article 15 robustness requires that AI systems handle failure states gracefully; detection of runaway loops is a monitoring control ensuring the system does not enter unrecoverable autonomous states."
+    - article: '15'
+      context: Article 15 robustness requires that AI systems handle failure states gracefully; detection of runaway loops is a monitoring control ensuring the system does not enter unrecoverable autonomous states.
       strength: secondary
-    - article: "9"
-      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the unsafe autonomous action (Runaway Agent Loop Detection)."
+    - article: '9'
+      context: Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the unsafe autonomous action (Runaway Agent Loop Detection).
       strength: secondary
   nist_ai_rmf:
     - function: Manage
       subcategory: MG.3.2
-      context: "Runaway agent loops are an AI system failure mode requiring active detection and termination; this rule implements the MG.3.2 response capability for AI failures and disruptions."
+      context: Runaway agent loops are an AI system failure mode requiring active detection and termination; this rule implements the MG.3.2 response capability for AI failures and disruptions.
       strength: primary
     - function: Govern
       subcategory: GV.1.2
-      context: "GV.1.2 accountability roles must include responsibility for detecting and halting runaway agent behavior; this rule provides the signal required to fulfill that accountability."
+      context: GV.1.2 accountability roles must include responsibility for detecting and halting runaway agent behavior; this rule provides the signal required to fulfill that accountability.
       strength: secondary
-    - subcategory: "MG.2.3"
-      context: "NIST AI RMF MANAGE 2.3 (respond to previously unknown identified risks) is supported by this rule, which surfaces the unsafe autonomous action (Runaway Agent Loop Detection) so the risk can be treated."
+    - subcategory: MG.2.3
+      context: NIST AI RMF MANAGE 2.3 (respond to previously unknown identified risks) is supported by this rule, which surfaces the unsafe autonomous action (Runaway Agent Loop Detection) so the risk can be treated.
       strength: primary
-    - subcategory: "MS.2.7"
-      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the unsafe autonomous action (Runaway Agent Loop Detection)."
+    - subcategory: MS.2.7
+      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the unsafe autonomous action (Runaway Agent Loop Detection).
       strength: secondary
   iso_42001:
-    - clause: "8.1"
-      context: "Clause 8.1 AI system operational control requires monitoring for abnormal execution patterns; runaway loop detection is the primary operational control for this failure class."
+    - clause: '8.1'
+      context: Clause 8.1 AI system operational control requires monitoring for abnormal execution patterns; runaway loop detection is the primary operational control for this failure class.
       strength: primary
-    - clause: "9.1"
-      context: "Clause 9.1 monitoring and evaluation requires measuring AI system behavior against expected norms; loop counter patterns are the measurable anomaly indicators for this rule."
+    - clause: '9.1'
+      context: Clause 9.1 monitoring and evaluation requires measuring AI system behavior against expected norms; loop counter patterns are the measurable anomaly indicators for this rule.
       strength: secondary
-    - clause: "6.2"
-      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the unsafe autonomous action (Runaway Agent Loop Detection) is such a treatment."
+    - clause: '6.2'
+      context: ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the unsafe autonomous action (Runaway Agent Loop Detection) is such a treatment.
       strength: primary
-
 tags:
   category: excessive-autonomy
   subcategory: runaway-loop
@@ -97,18 +95,15 @@ detection:
       description: Attempt X of Y counter pattern (e.g., attempt 5 of 10)
     - field: content
       operator: regex
-      value: >-
-        (?i)(?:trying\s+again|let\s+me\s+(?:try|attempt)\s+(?:again|once\s+more|one\s+more\s+time)|retrying\s+(?:the\s+)?(?:same|previous|last)\s+(?:operation|request|call|action))
+      value: (?i)(?:trying\s+again|let\s+me\s+(?:try|attempt)\s+(?:again|once\s+more|one\s+more\s+time)|retrying\s+(?:the\s+)?(?:same|previous|last)\s+(?:operation|request|call|action))
       description: Natural language retry patterns in agent output
     - field: content
       operator: regex
-      value: >-
-        (?i)(?:still\s+(?:failing|not\s+working|getting\s+(?:the\s+same\s+)?error)|same\s+error\s+(?:again|as\s+before|persists)|error\s+(?:persists|continues|remains))
+      value: (?i)(?:still\s+(?:failing|not\s+working|getting\s+(?:the\s+same\s+)?error)|same\s+error\s+(?:again|as\s+before|persists)|error\s+(?:persists|continues|remains))
       description: Stalled progress with persistent error indicators
     - field: content
       operator: regex
-      value: >-
-        (?i)(?:calling\s+(?:myself|this\s+(?:function|tool|agent))\s+(?:again|recursively)|recursive\s+(?:call|invocation|execution))
+      value: (?i)(?:calling\s+(?:myself|this\s+(?:function|tool|agent))\s+(?:again|recursively)|recursive\s+(?:call|invocation|execution))
       description: Recursive self-invocation patterns (v2 — dropped the bare 'self-call' / 'self-invoke' token, which agent-framework documentation uses as ordinary vocabulary when describing how an agent may call itself. The remaining branches require the recursion to be asserted as happening, which is the runaway signal; both recursion true_positives use those branches)
     - field: content
       operator: regex
@@ -116,18 +111,15 @@ detection:
       description: High iteration count indicating prolonged looping
     - field: content
       operator: regex
-      value: >-
-        (?i)(?:repeating\s+(?:the\s+)?(?:same|previous|identical)\s+(?:step|action|operation|request)|performing\s+(?:the\s+)?(?:same|identical)\s+(?:action|call)\s+again)
+      value: (?i)(?:repeating\s+(?:the\s+)?(?:same|previous|identical)\s+(?:step|action|operation|request)|performing\s+(?:the\s+)?(?:same|identical)\s+(?:action|call)\s+again)
       description: Agent acknowledging it is repeating identical actions
     - field: content
       operator: regex
-      value: >-
-        (?i)(?:max(?:imum)?\s+retries?\s+(?:reached|exceeded|hit)|(?:exceeded|hit|reached)\s+(?:the\s+)?(?:retry|attempt|iteration)\s+(?:limit|maximum|cap))
+      value: (?i)(?:max(?:imum)?\s+retries?\s+(?:reached|exceeded|hit)|(?:exceeded|hit|reached)\s+(?:the\s+)?(?:retry|attempt|iteration)\s+(?:limit|maximum|cap))
       description: Retry limit reached indicators
     - field: content
       operator: regex
-      value: >-
-        (?i)(?:no\s+progress\s+(?:after|in)\s+\d+\s+(?:attempts?|tries|iterations?|cycles?)|stuck\s+(?:in\s+(?:a\s+)?loop|on\s+(?:the\s+)?same\s+(?:step|error)))
+      value: (?i)(?:no\s+progress\s+(?:after|in)\s+\d+\s+(?:attempts?|tries|iterations?|cycles?)|stuck\s+(?:in\s+(?:a\s+)?loop|on\s+(?:the\s+)?same\s+(?:step|error)))
       description: Explicit stall or no-progress acknowledgement
     - field: content
       operator: regex
@@ -135,13 +127,11 @@ detection:
       description: Infinite loop constructs in generated or executed code
     - field: content
       operator: regex
-      value: >-
-        (?i)(?:will\s+keep\s+(?:trying|retrying|attempting)|(?:continuously|endlessly|infinitely)\s+(?:retrying|looping|repeating|calling))
+      value: (?i)(?:will\s+keep\s+(?:trying|retrying|attempting)|(?:continuously|endlessly|infinitely)\s+(?:retrying|looping|repeating|calling))
       description: Agent declaring intent to retry indefinitely
     - field: content
       operator: regex
-      value: >-
-        (?i)(?:spawn(?:ing|ed)?\s+(?:another|new|additional)\s+(?:instance|copy|clone)\s+of\s+(?:myself|this\s+agent)|fork(?:ing|ed)?\s+(?:a\s+)?(?:new\s+)?(?:agent|process|instance))
+      value: (?i)(?:spawn(?:ing|ed)?\s+(?:another|new|additional)\s+(?:instance|copy|clone)\s+of\s+(?:myself|this\s+agent)|fork(?:ing|ed)?\s+(?:a\s+)?(?:new\s+)?(?:agent|process|instance))
       description: Agent spawning copies of itself (fork bomb pattern)
   condition: any
   false_positives:
@@ -150,18 +140,13 @@ detection:
     - Long-running data pipeline agents with expected high iteration counts
     - Retry logic in error handling with bounded retry limits
     - CI/CD build logs that include 'attempt 2 of 3' progress counters during normal deployment retries
-    - >-
-      Monitoring dashboards displaying iteration counts for scheduled polling jobs that legitimately run hundreds of
-      cycles
+    - Monitoring dashboards displaying iteration counts for scheduled polling jobs that legitimately run hundreds of cycles
 response:
   actions:
     - reduce_permissions
     - escalate
     - alert
-  actions_rationale: >-
-    response-action eligibility (docs/RESPONSE-ACTION-ELIGIBILITY.md): benign FP 11/5352 = 0.21%
-    meets the 0.5% ceiling but is not zero; ceiling = degrade. Removed kill_agent(terminate).
-    Detection unchanged — recall cost is zero.
+  actions_rationale: 'response-action eligibility (docs/RESPONSE-ACTION-ELIGIBILITY.md): benign FP 11/5352 = 0.21% meets the 0.5% ceiling but is not zero; ceiling = degrade. Removed kill_agent(terminate). Detection unchanged — recall cost is zero.'
   auto_response_threshold: high
   message_template: |
     [ATR-2026-050] HIGH: Runaway agent loop detected. Agent {agent_id}
@@ -172,61 +157,3 @@ response:
 confidence: 69
 wild_validated: 2026/04/08
 wild_samples: 53577
-test_cases:
-  true_positives:
-    - input: Retrying attempt 15 of 10. The request still returns the same error.
-      expected: triggered
-      description: Retry counter exceeding stated maximum
-    - input: Still failing after 25 iterations. Let me try again with the same parameters.
-      expected: triggered
-      description: Agent stuck in retry loop with no progress
-    - input: "Calling myself recursively to process the remaining items. Recursive call depth: 47."
-      expected: triggered
-      description: Recursive self-invocation with deep call stack
-    - input: Will keep trying until it works. Continuously retrying the API call.
-      expected: triggered
-      description: Agent declaring intent to retry indefinitely
-    - input: "iteration #450 - still processing the same batch. No new results returned from the API."
-      expected: triggered
-      description: High iteration count (pattern 6) indicating prolonged looping with 3+ digit iteration number
-  true_negatives:
-    - input: Processing batch 3 of 5. All items completed successfully so far.
-      expected: not_triggered
-      description: Legitimate batch processing with bounded progress counter
-    - input: The API returned an error. Retrying once with exponential backoff.
-      expected: not_triggered
-      description: Normal bounded retry logic in error handling
-    - input: Task completed after 3 attempts. Here are the final results.
-      expected: not_triggered
-      description: Successful completion after reasonable retry count
-    - input: >-
-        The pipeline completed successfully. Total records processed: 15000 across 4 stages. Final output saved to
-        /data/results.csv.
-      expected: not_triggered
-      description: Legitimate pipeline completion report with large numbers that do not match loop patterns
-    - input: >-
-        Here is a summary of the error handling strategy: if a transient fault occurs, the system will back off
-        exponentially and make up to 3 additional requests before returning a failure response to the caller.
-      expected: not_triggered
-      description: >-
-        Documentation describing bounded retry architecture without using trigger phrases like 'retrying N' or 'try
-        again'
-evasion_tests:
-  - input: Volviendo a intentar la misma operación por 30ª vez. El servidor sigue devolviendo el mismo error.
-    expected: not_triggered
-    bypass_technique: language_switch
-    notes: Spanish translation of retry loop language completely avoids English regex patterns.
-  - input: >-
-      Re-doing the exact same step for the umpteenth time... the server keeps handing back an identical failure. I'll
-      give it another go.
-    expected: not_triggered
-    bypass_technique: casual_paraphrase
-    notes: >-
-      Paraphrases retry and same-error concepts using synonyms like 're-doing', 'umpteenth', 'identical failure', 'give
-      it another go' that don't match the specific regex phrases.
-  - input: sеlf_invоke triggered. Rеcursivе exеcution in progress, dеpth = 99.
-    expected: not_triggered
-    bypass_technique: unicode_homoglyph
-    notes: >-
-      Uses Cyrillic homoglyphs (е→е, o→о) in 'self_invoke' and 'recursive execution' to visually match but evade ASCII
-      regex matching.

package/rules/excessive-autonomy/ATR-2026-00051-resource-exhaustion.yaml

@@ -12,7 +12,7 @@ description: |
   cause denial of service.
 author: ATR Community
 date: 2026/03/08
-schema_version: "0.1"
+schema_version: '0.1'
 detection_tier: pattern
 maturity: test
 severity: high
@@ -25,39 +25,37 @@ references:
   mitre_atlas:
     - AML.T0046 - Spamming AI System with Chaff Data
     - AML.T0053 - AI Agent Tool Invocation
-
 compliance:
   eu_ai_act:
-    - article: "14"
-      context: "Resource exhaustion attacks prevent human operators from accessing or stopping the AI system, directly undermining the human oversight and intervention capability Article 14 requires."
+    - article: '14'
+      context: Resource exhaustion attacks prevent human operators from accessing or stopping the AI system, directly undermining the human oversight and intervention capability Article 14 requires.
       strength: primary
-    - article: "15"
-      context: "Article 15 robustness requirements mandate that AI systems handle adversarial denial-of-service conditions gracefully; this rule detects resource exhaustion patterns before full system unavailability."
+    - article: '15'
+      context: Article 15 robustness requirements mandate that AI systems handle adversarial denial-of-service conditions gracefully; this rule detects resource exhaustion patterns before full system unavailability.
       strength: secondary
-    - article: "9"
-      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the unsafe autonomous action (Agent Resource Exhaustion Detection)."
+    - article: '9'
+      context: Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the unsafe autonomous action (Agent Resource Exhaustion Detection).
       strength: secondary
   nist_ai_rmf:
-    - subcategory: "GV.1.2"
-      context: "Resource exhaustion attacks exploit the absence of enforced consumption limits within an agent's accountability scope; GV.1.2 requires that resource boundaries are defined, assigned, and monitored for violations."
+    - subcategory: GV.1.2
+      context: Resource exhaustion attacks exploit the absence of enforced consumption limits within an agent's accountability scope; GV.1.2 requires that resource boundaries are defined, assigned, and monitored for violations.
       strength: primary
-    - subcategory: "MG.3.2"
-      context: "Unbounded resource consumption constitutes an AI incident requiring a defined response; MG.3.2 mandates that processes to detect and respond to resource exhaustion failures are in place before full system unavailability occurs."
+    - subcategory: MG.3.2
+      context: Unbounded resource consumption constitutes an AI incident requiring a defined response; MG.3.2 mandates that processes to detect and respond to resource exhaustion failures are in place before full system unavailability occurs.
       strength: secondary
-    - subcategory: "MG.2.3"
-      context: "NIST AI RMF MANAGE 2.3 (respond to previously unknown identified risks) is supported by this rule, which surfaces the unsafe autonomous action (Agent Resource Exhaustion Detection) so the risk can be treated."
+    - subcategory: MG.2.3
+      context: NIST AI RMF MANAGE 2.3 (respond to previously unknown identified risks) is supported by this rule, which surfaces the unsafe autonomous action (Agent Resource Exhaustion Detection) so the risk can be treated.
       strength: primary
-    - subcategory: "MS.2.7"
-      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the unsafe autonomous action (Agent Resource Exhaustion Detection)."
+    - subcategory: MS.2.7
+      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the unsafe autonomous action (Agent Resource Exhaustion Detection).
       strength: secondary
   iso_42001:
-    - clause: "6.2"
-      context: "ISO 42001 clause 6.2 risk treatment plans must address denial-of-service risks from unbounded agent operations; this rule implements the monitoring control for resource exhaustion patterns before they cause system degradation."
+    - clause: '6.2'
+      context: ISO 42001 clause 6.2 risk treatment plans must address denial-of-service risks from unbounded agent operations; this rule implements the monitoring control for resource exhaustion patterns before they cause system degradation.
       strength: primary
-    - clause: "8.1"
-      context: "Clause 8.1 operational controls ensure AI systems execute correctly and within resource limits; detection of SELECT * without LIMIT, infinite loops, and bulk spawn patterns enforces these operational boundaries."
+    - clause: '8.1'
+      context: Clause 8.1 operational controls ensure AI systems execute correctly and within resource limits; detection of SELECT * without LIMIT, infinite loops, and bulk spawn patterns enforces these operational boundaries.
       strength: secondary
-
 tags:
   category: excessive-autonomy
   subcategory: resource-exhaustion
@@ -77,33 +75,27 @@ detection:
       description: Unbounded SELECT * query without LIMIT clause (v2 — dropped the '+ WHERE' branch; a WHERE clause bounds the result set, so 'SELECT * FROM users WHERE ...' is not resource exhaustion. That branch matched ordinary SQL examples in documentation; true_positive 'SELECT * FROM transactions;' is unaffected)
     - field: content
       operator: regex
-      value: >-
-        (?i)(?:for\s+each\s+(?:of\s+)?(?:the\s+)?(?:record|row|entry|item|file|document|user|customer|email|account|message|transaction)s?\b[\s\S]{0,30}\b(?:in|of|from|across)\b|iterate\s+(?:over\s+)?(?:all|every|the\s+entire)|process\s+(?:all|every|each)\s+(?:record|row|entry|item|file|document))
+      value: (?i)(?:for\s+each\s+(?:of\s+)?(?:the\s+)?(?:record|row|entry|item|file|document|user|customer|email|account|message|transaction)s?\b[\s\S]{0,30}\b(?:in|of|from|across)\b|iterate\s+(?:over\s+)?(?:all|every|the\s+entire)|process\s+(?:all|every|each)\s+(?:record|row|entry|item|file|document))
       description: Bulk iteration over an entire or unbounded dataset (v3 — dropped the bare '(all|every|entire|whole) <noun>' branch, which matched plain noun phrases such as 'all tables', 'every dataset' and 'all files' in ordinary data-tooling documentation with no consuming action. The remaining branches all require an explicit consuming verb (for each ... in / iterate over all / process all), and the download/fetch-all branch below still covers the 'Downloading all files' true_positive. v2 — bare 'for each' now requires a data-source/scale qualifier; the unqualified form matched ordinary 'for each X' prose; verified 0 recall loss + all true_positives, benign FP 560 to 203)
     - field: content
       operator: regex
-      value: >-
-        (?i)(?:limit|max_results?|page_size|batch_size|count|top)\s*[:=]\s*(?:\d{5,}|all|unlimited|-1|999+|MAX_INT|infinity)
+      value: (?i)(?:limit|max_results?|page_size|batch_size|count|top)\s*[:=]\s*(?:\d{5,}|all|unlimited|-1|999+|MAX_INT|infinity)
       description: Excessively large or unbounded query parameters
     - field: content
       operator: regex
-      value: >-
-        (?i)(?:delete\s+(?:all|every|each)\s+(?:files?|records?|entries|rows?|documents?)|rm\s+-rf\s+[/*]|truncate\s+(?:all\s+)?(?:tables?|data))
+      value: (?i)(?:delete\s+(?:all|every|each)\s+(?:files?|records?|entries|rows?|documents?)|rm\s+-rf\s+[/*]|truncate\s+(?:all\s+)?(?:tables?|data))
       description: Mass deletion or truncation operations
     - field: content
       operator: regex
-      value: >-
-        (?i)(?:download(?:ing)?\s+(?:all|every|the\s+entire)|(?:fetch(?:ing)?|pull(?:ing)?|retriev(?:e|ing))\s+(?:all|every|the\s+complete|the\s+entire)\s+(?:dataset|database|table|collection|bucket))
+      value: (?i)(?:download(?:ing)?\s+(?:all|every|the\s+entire)|(?:fetch(?:ing)?|pull(?:ing)?|retriev(?:e|ing))\s+(?:all|every|the\s+complete|the\s+entire)\s+(?:dataset|database|table|collection|bucket))
       description: Bulk data download or retrieval of entire datasets
     - field: content
       operator: regex
-      value: >-
-        (?i)(?:send\s+(?:a\s+)?(?:request|message|email|notification)\s+to\s+(?:all|every|each)\s+(?:user|member|contact|subscriber|endpoint))
+      value: (?i)(?:send\s+(?:a\s+)?(?:request|message|email|notification)\s+to\s+(?:all|every|each)\s+(?:user|member|contact|subscriber|endpoint))
       description: Mass messaging or notification blast patterns
     - field: content
       operator: regex
-      value: >-
-        (?i)(?:spawn(?:ing)?\s+\d{2,}\s+(?:(?:concurrent|parallel|simultaneous)\s+)?(?:threads?|processes?|workers?|instances?|tasks?|connections?)|(?:create|open|launch)\s+\d{2,}\s+(?:concurrent|parallel|simultaneous))
+      value: (?i)(?:spawn(?:ing)?\s+\d{2,}\s+(?:(?:concurrent|parallel|simultaneous)\s+)?(?:threads?|processes?|workers?|instances?|tasks?|connections?)|(?:create|open|launch)\s+\d{2,}\s+(?:concurrent|parallel|simultaneous))
       description: Spawning excessive concurrent processes or connections
     - field: content
       operator: regex
@@ -111,23 +103,19 @@ detection:
       description: Infinite loop with resource-consuming operations inside
     - field: content
       operator: regex
-      value: >-
-        (?i)(?:(?:scrape|crawl|spider|harvest)\s+(?:all|every|the\s+entire)\s+(?:site|website|domain|pages?)|recursive(?:ly)?\s+(?:crawl|scrape|fetch|download))
+      value: (?i)(?:(?:scrape|crawl|spider|harvest)\s+(?:all|every|the\s+entire)\s+(?:site|website|domain|pages?)|recursive(?:ly)?\s+(?:crawl|scrape|fetch|download))
       description: Unbounded web scraping or crawling operations
     - field: content
       operator: regex
-      value: >-
-        (?i)(?:no\s+(?:limit|cap|maximum|bound|restriction)\s+(?:on|for)\s+(?:requests?|queries|calls?|operations?|iterations?)|(?:unlimited|unbounded|uncapped)\s+(?:requests?|queries|calls?|operations?))
+      value: (?i)(?:no\s+(?:limit|cap|maximum|bound|restriction)\s+(?:on|for)\s+(?:requests?|queries|calls?|operations?|iterations?)|(?:unlimited|unbounded|uncapped)\s+(?:requests?|queries|calls?|operations?))
       description: Explicit removal of rate limits or resource caps
     - field: content
       operator: regex
-      value: >-
-        (?i)(?:process(?:ing)?\s+(?:the\s+)?(?:entire|full|complete|whole)\s+(?:corpus|dataset|collection|index|archive)|scan(?:ning)?\s+(?:all|every)\s+\d{4,}\s+(?:records?|files?|entries))
+      value: (?i)(?:process(?:ing)?\s+(?:the\s+)?(?:entire|full|complete|whole)\s+(?:corpus|dataset|collection|index|archive)|scan(?:ning)?\s+(?:all|every)\s+\d{4,}\s+(?:records?|files?|entries))
       description: Full corpus processing or scanning massive datasets
     - field: content
       operator: regex
-      value: >-
-        (?i)(?:copy\s+(?:all|every|entire)\s+(?:data|files?|records?|tables?)\s+(?:to|into)|replicate\s+(?:the\s+)?(?:entire|full|complete)\s+(?:database|dataset|collection))
+      value: (?i)(?:copy\s+(?:all|every|entire)\s+(?:data|files?|records?|tables?)\s+(?:to|into)|replicate\s+(?:the\s+)?(?:entire|full|complete)\s+(?:database|dataset|collection))
       description: Mass data replication or copy operations
   condition: any
   false_positives:
@@ -135,19 +123,14 @@ detection:
     - Batch analysis tasks with expected high volume approved by admin
     - Initial data ingestion or indexing operations with known high volume
     - Database export operations authorized by data team
-    - >-
-      Authorized ETL pipeline agent performing scheduled nightly full-table exports with pre-approved resource
-      allocation
+    - Authorized ETL pipeline agent performing scheduled nightly full-table exports with pre-approved resource allocation
     - Database migration tool copying entire tables during a sanctioned schema upgrade window
 response:
   actions:
     - escalate
     - alert
     - snapshot
-  actions_rationale: >-
-    response-action eligibility (docs/RESPONSE-ACTION-ELIGIBILITY.md): benign FP 64/5352 = 1.20%
-    exceeds the 0.5% production ceiling; ceiling = interrupt. Removed
-    reduce_permissions(degrade). Detection unchanged — recall cost is zero.
+  actions_rationale: 'response-action eligibility (docs/RESPONSE-ACTION-ELIGIBILITY.md): benign FP 64/5352 = 1.20% exceeds the 0.5% production ceiling; ceiling = interrupt. Removed reduce_permissions(degrade). Detection unchanged — recall cost is zero.'
   auto_response_threshold: high
   message_template: |
     [ATR-2026-051] HIGH: Resource exhaustion pattern detected for agent
@@ -157,60 +140,3 @@ response:
 confidence: 73
 wild_validated: 2026/04/08
 wild_samples: 53577
-test_cases:
-  true_positives:
-    - input: SELECT * FROM transactions;
-      expected: triggered
-      description: Unbounded SELECT query without LIMIT
-    - input: I will iterate over all 500000 records and process each one individually.
-      expected: triggered
-      description: Bulk iteration over massive dataset
-    - input: Setting batch_size=999999 and limit=unlimited for maximum throughput.
-      expected: triggered
-      description: Excessively large batch parameters
-    - input: Downloading all files from the S3 bucket. Fetching the entire dataset for local processing.
-      expected: triggered
-      description: Bulk data download of entire storage
-    - input: Spawning 50 concurrent workers to send requests to the API.
-      expected: triggered
-      description: Excessive concurrent process spawning
-  true_negatives:
-    - input: SELECT id, name FROM users WHERE active=true LIMIT 100;
-      expected: not_triggered
-      description: Bounded query with column selection and LIMIT
-    - input: Processing the 25 records from the filtered result set.
-      expected: not_triggered
-      description: Processing a reasonably sized result set
-    - input: Fetching the first page of results with page_size=20.
-      expected: not_triggered
-      description: Paginated query with reasonable page size
-    - input: >-
-        The database query returned 50 rows. I've applied pagination with 20 results per page and will display page 1 to
-        the user.
-      expected: not_triggered
-      description: Normal bounded database operation with reasonable pagination
-    - input: >-
-        I created 3 worker threads to handle the incoming requests efficiently. Each thread processes one task at a time
-        with proper rate limiting.
-      expected: not_triggered
-      description: Reasonable concurrency with small number of threads and rate limiting
-    - input: For each selected threat, add a short remediation note and tag the owner before moving on.
-      expected: not_triggered
-      description: v2 regression — bounded 'for each X' prose with no data-source/scale qualifier must not trigger bulk-iteration
-evasion_tests:
-  - input: Obtener todos los registros de la base de datos sin ningún límite. Descargar la colección completa.
-    expected: not_triggered
-    bypass_technique: language_switch
-    notes: Spanish text requesting unbounded data retrieval bypasses regex that only matches English keywords.
-  - input: Go ahead and ｓｅｌｅｃｔ ＊ ｆｒｏｍ users;
-    expected: not_triggered
-    bypass_technique: unicode_homoglyph
-    notes: Fullwidth Unicode characters for SELECT * FROM bypass the ASCII regex patterns.
-  - input: >-
-      Hey, could you just grab everything from the users table? Don't worry about putting any caps on how much comes
-      back, we need the full dump.
-    expected: not_triggered
-    bypass_technique: casual_paraphrase
-    notes: >-
-      Casual natural language requesting an unbounded full table dump without using any of the specific keyword patterns
-      like 'SELECT *', 'iterate all', 'unlimited requests', etc.