agent-threat-rules 4.0.0 → 4.2.0

package/rules/privilege-escalation/ATR-2026-02530-git-config-execution-key-set-by-agent.yaml

@@ -0,0 +1,131 @@
+title: Git Configuration Turned Into an Execution Hook by an Agent
+id: ATR-2026-02530
+rule_version: 1
+status: experimental
+description: |
+  Detects an agent tool call that points a git configuration callback key at an EPHEMERAL or INLINE-SHELL value. Several git config keys are not settings but callbacks -- core.fsmonitor, core.sshCommand, core.hooksPath, core.askpass, credential.helper, filter.*.clean/smudge, diff.*.textconv, uploadpack.packObjectsHook. Once one of them holds a command, that command runs on the NEXT ORDINARY GIT OPERATION: a status, a diff, a fetch. No further tool call is needed and nothing in the later invocation looks dangerous.
+  Derived from CVE-2026-55607 (Claude Code 2.1.38 to 2.1.163), where worktree handling permitted a worktree named ".git" plus navigation outside the sandbox context, and git fsmonitor execution during worktree operations was the step that turned a directory-confusion trick into code execution outside the seatbelt sandbox. The advisory states that reliable exploitation required the user to clone a malicious repository containing prompt injection content -- so the config write arrives as an agent action taken on behalf of injected text, which is exactly what this rule reads.
+  THE VALUE REQUIREMENT IS THE PRECISION, AND IT IS NOT "LOOKS LIKE A PROGRAM". An earlier draft of this rule required only that the value be a path or an interpreter. That was measured against realistic benign input and fired on 20 of 26 samples -- because a program path is the NORMAL, CORRECT value for every one of these keys. `core.editor=/usr/bin/vim`, `core.pager=/usr/bin/less`, `credential.helper=/usr/share/doc/git/contrib/credential/libsecret/git-credential-libsecret` (git's own documented Linux helper), `filter.nbstripout.clean='python3 -m nbstripout'` (the standard Jupyter setup) and `core.fsmonitor=/opt/homebrew/bin/watchman` all matched. "Points at a program" is what these keys are FOR; it carries no signal at all.
+  So the value must instead look like STAGED ATTACK CODE:
+    - a path under an ephemeral directory (/tmp, /var/tmp, /dev/shm,
+      /private/tmp, /var/folders, ~/.cache, $TMPDIR) -- where a payload dropped
+      moments earlier in the same session lives, and where no package manager,
+      no distro and no developer ever installs a durable git helper; or
+    - an inline interpreter invocation or fetch-and-run (`sh -c`, `bash -c`,
+      `python -c`, `perl -e`, `node -e`, `eval`, `base64 -d`, curl, wget, nc)
+      -- a command literal rather than a reference to an installed tool.
+
+  KEYS DELIBERATELY DROPPED, for measured reasons. core.editor, core.pager and sequence.editor were in the first draft and contradict this rule's own thesis: they do NOT run on the next ordinary git operation, they run when a human interactively commits or reads a log, in the foreground, where the user sees them. They also carry the densest benign population of any key here. Likewise mergetool.*.cmd and difftool.*.cmd fire only on explicit invocation. Removing them cost no true positive and removed nine measured false positives.
+  ALSO COVERED: the one-shot `git -c key=cmd` form, and the same keys written directly into a config file body.
+  NOT COVERED, deliberately, and both for measured reasons.
+    - `git worktree add ./.git`, the directory-confusion half of the same CVE,
+      is already detected by ATR-2026-02302 (Git Worktree Created With
+      Reserved Name .git). A draft of this rule carried that condition; it was
+      removed once the cross-check showed 02302 firing on it.
+    - Git hook FILES (.git/hooks/pre-commit and friends) are a neighbouring
+      persistence technique with a different shape and a much denser benign
+      population -- husky, pre-commit and lefthook all write there. Left out
+      rather than folded in badly.
+author: ATR Community
+date: 2026/08/23
+schema_version: '0.1'
+detection_tier: pattern
+maturity: test
+severity: high
+references:
+  cve:
+    - CVE-2026-55607
+  cwe:
+    - CWE-78
+    - CWE-59
+  owasp_llm:
+    - LLM01:2025
+  owasp_agentic:
+    - ASI04:2026
+  mitre_atlas:
+    - AML.T0051.001 - Indirect
+  mitre_attack:
+    - T1546 - Event Triggered Execution
+compliance:
+  owasp_llm:
+    - id: LLM01:2025
+      context: The advisory names a cloned repository carrying prompt-injection content as the precondition, so the configuration write is an injected instruction executed by the agent.
+      strength: primary
+  owasp_agentic:
+    - id: ASI04:2026
+      context: 'Persistence outside the session: the callback survives in the repository or user configuration and fires on later, unrelated git operations.'
+      strength: primary
+  eu_ai_act:
+    - article: '15'
+      context: Article 15 resilience must hold against an agent being induced to reconfigure its own execution environment so that later benign operations run attacker code.
+      strength: primary
+    - article: '14'
+      context: A reviewer approving a later `git status` cannot see the callback installed earlier; detecting the install is what keeps oversight meaningful across turns.
+      strength: secondary
+    - article: '9'
+      context: Environment-persistence through developer tooling is a foreseeable risk for coding agents and belongs in the risk register with continuous monitoring.
+      strength: secondary
+  nist_ai_rmf:
+    - function: Manage
+      subcategory: MG.2.3
+      context: Runtime treatment for the risk that an agent installs a deferred execution callback in its own working environment.
+      strength: primary
+    - function: Map
+      subcategory: MP.5.1
+      context: 'Catalogues deferred, trigger-based execution as distinct from direct command execution: the dangerous act and the dangerous effect are separated in time.'
+      strength: secondary
+    - function: Measure
+      subcategory: MS.2.7
+      context: Detection events supply the security evidence for the agent's control over its own toolchain configuration.
+      strength: secondary
+  iso_42001:
+    - clause: '8.1'
+      context: Operational control over an AI system with developer tooling access requires that the system cannot silently arm its environment to execute later.
+      strength: primary
+    - clause: '8.4'
+      context: Impact assessment for a coding agent must include sandbox escape by environment reconfiguration; these detections are the supporting evidence.
+      strength: secondary
+    - clause: '6.2'
+      context: Preventing persistent, deferred code execution installed by the agent is an AIMS security objective, operationalised here as a runtime detection.
+      strength: secondary
+tags:
+  category: privilege-escalation
+  subcategory: vcs-config-execution-hook
+  scan_target: both
+  confidence: medium
+  suppress_in_code_blocks: true
+agent_source:
+  type: tool_call
+  framework:
+    - any
+  provider:
+    - any
+detection:
+  condition: any
+  conditions:
+    - field: tool_args
+      operator: regex
+      value: (?i)(?:^|[^\x60])\bgit\s+(?:-[a-zA-Z]\s+\S{1,40}\s+|--\S{1,24}\s+){0,3}config\s+(?:--\S{1,16}\s+){0,2}['\"]?(?:core\.(?:fsmonitor|sshcommand|hookspath|askpass)|credential\.helper|(?:diff|merge)\.[\w.-]{1,32}\.(?:textconv|driver)|filter\.[\w.-]{1,32}\.(?:clean|smudge|process)|uploadpack\.packobjectshook)['\"]?\s*[= ]\s*['\"]?\s*(?:(?:/private)?/(?:tmp|var/tmp|dev/shm)/|\b(?:sh|bash|zsh|dash)\b\s{1,4}-c|\b(?:python[23]?|perl|ruby|node)\b\s{1,4}-[ce]\b|\b(?:curl|wget|eval|nc)\s)
+      description: A git callback key is set to a staged payload path or an inline interpreter command, arming code that runs on the next ordinary git operation
+    - field: tool_args
+      operator: regex
+      value: (?i)(?:^|[^\x60])\bgit\s+-c\s+['\"]?(?:core\.(?:fsmonitor|sshcommand|hookspath|askpass)|credential\.helper|(?:diff|merge)\.[\w.-]{1,32}\.(?:textconv|driver)|filter\.[\w.-]{1,32}\.(?:clean|smudge))\s*=\s*['\"]?\s*(?:(?:/private)?/(?:tmp|var/tmp|dev/shm)/|\b(?:sh|bash|zsh|dash)\b\s{1,4}-c|\b(?:python[23]?|perl|ruby|node)\b\s{1,4}-[ce]\b|\b(?:curl|wget|eval|nc)\s)
+      description: The one-shot -c form arms the same callback for the duration of a single git invocation, leaving no persistent config entry to review
+    - field: tool_args
+      operator: regex
+      value: (?i)\[(?:core|filter\s+\"[^\"\]]{1,32}\"|diff\s+\"[^\"\]]{1,32}\")\][\s\S]{0,120}\b(?:fsmonitor|sshcommand|hookspath|askpass|textconv|packobjectshook|clean|smudge)\s*=\s*['\"]?\s*(?:(?:/private)?/(?:tmp|var/tmp|dev/shm)/|\b(?:sh|bash|zsh|dash)\b\s{1,4}-c|\b(?:python[23]?|perl|ruby|node)\b\s{1,4}-[ce]\b|\b(?:curl|wget|eval|nc)\s)
+      description: A git config file is written with a callback key pointing at a staged payload or inline shell, bypassing the git config command entirely
+  false_positives:
+    - CI that legitimately stages an ssh wrapper or askpass helper in a temp directory for the life of one job, e.g. `git config core.sshCommand /tmp/ssh-wrap.sh`. This is genuinely the same shape as the attack and is expected to match; the ephemeral location is the whole signal and cannot distinguish a friendly script from a hostile one
+    - 'Security documentation that quotes the arming command as BARE PROSE with no backticks and no fence, e.g. a SECURITY.md paragraph written through a write_file tool call. Measured residue: code-block suppression catches the backticked and fenced forms, which is how documentation is written the overwhelming majority of the time, but unformatted prose still matches'
+    - A durable helper deliberately installed under /var/tmp, which is a temp root but survives reboot. Pointing a git callback there is anomalous regardless of intent, so it matches
+    - A repository bootstrap script that fetches a filter helper with curl and wires it into filter.*.clean in the same command
+response:
+  actions:
+    - alert
+    - escalate
+  actions_rationale: 'response-action eligibility (docs/RESPONSE-ACTION-ELIGIBILITY.md): no FP measurement on the benign corpus; ceiling = observe. Removed block_tool(interrupt). Detection unchanged — recall cost is zero.'
+  auto_response_threshold: high
+  message_template: |
+    [ATR-2026-02530] A git configuration callback key was pointed at a program. It will execute on the next ordinary git operation, not on this tool call (CVE-2026-55607 shape). Inspect the repository this agent was working in before allowing further git commands.
+confidence: 70

package/rules/privilege-escalation/ATR-2026-02531-kusto-query-injection-outbound-reach.yaml

@@ -0,0 +1,110 @@
+title: Kusto Pipeline Injection Through a Table Identifier Parameter
+id: ATR-2026-02531
+rule_version: 2
+status: experimental
+description: |
+  Detects a Kusto (KQL) pipeline smuggled into an MCP tool parameter whose schema declares it to be a bare table or database identifier: the value carries a pipe character followed by another KQL operator, so the tool executes more than the single table it was asked about.
+  Derived from CVE-2026-33980 (Azure Data Explorer MCP Server through 0.1.1), where the `table_name` parameter of get_table_schema, sample_table_data and get_table_details is interpolated straight into KQL via f-strings with no validation. The advisory names a prompt-injected AI agent, not only a direct attacker, as the party that reaches the vulnerable handler -- so the injected pipeline arrives as an ordinary tool argument on a tool whose name says "sample" or "schema".
+  WHY THIS IS NOT THE SQL RULE. KQL is not SQL and shares none of its injection surface: there is no quote-and-UNION break-out to look for, because a Kusto table reference is a bare identifier and the injection is a pipe character followed by another operator. Every SQL-injection pattern in the corpus keys on quote break-out, comment markers, or UNION SELECT. Measured before this rule was written, a table_name value of "Logs | union externaldata(x:string)[@'https://...']" produced zero matches across the entire rule set.
+  WHAT THIS RULE DELIBERATELY DOES NOT DETECT, and the measurement that decided it. Rule version 1 carried two further conditions -- a bare `externaldata` operator given a remote URI, and `evaluate http_request` / `http_request_post` -- on the theory that they were the ingestion and exfiltration halves of the reach. Both were deleted after adversarial review, because both match the documented, correct, publicly published spelling of supported Kusto features and carry no attacker signal a single event can see:
+    - The externaldata condition fired on Microsoft Learn's own operator
+      reference page, on a first-party lookup-blob join, and on the widely
+      republished Sentinel hunting query that enriches CommonSecurityLog with
+      the public Tor exit-node list. The engine cannot tell an attacker-chosen
+      URI from a team's own storage account.
+    - The http_request condition fired on Microsoft Learn's plugin reference
+      page and on an ordinary enrichment query. The plugin is governed by the
+      cluster's callout policy, which the engine also cannot see.
+  Eleven of fourteen adversarial benign inputs fired against version 1, including this rule's own file. Version 2 keeps only the parameter-shaped condition, where the tool's own schema supplies the missing context: it said the argument was an identifier, and an identifier has no pipe in it.
+  A management-command condition (.export, .ingest, .drop, .alter) was removed even earlier, for the same reason: against the 3,042-sample skills-sh corpus it fired fourteen times on a single "eventhouse-authoring-cli" skill whose entire declared purpose is issuing those commands against Fabric KQL databases.
+  BOUNDARY. A tool that genuinely accepts a KQL fragment in a parameter it nonetheless named `table_name` will match. That is a schema bug on the server side and is worth surfacing. Advisory text that quotes the payload in its JSON-argument form will also match, as it does for every signature rule in the corpus.
+author: ATR Community
+date: 2026/08/23
+schema_version: '0.1'
+detection_tier: pattern
+maturity: test
+severity: high
+references:
+  cve:
+    - CVE-2026-33980
+  cwe:
+    - CWE-943
+    - CWE-918
+  owasp_llm:
+    - LLM05:2025
+  owasp_agentic:
+    - ASI02:2026
+  mitre_atlas:
+    - AML.T0051.001 - Indirect
+    - AML.T0053 - LLM Plugin Compromise
+compliance:
+  owasp_llm:
+    - id: LLM05:2025
+      context: A model-supplied parameter is interpolated into a query string and executed; the handling of the model's output is where the whole vulnerability lives.
+      strength: primary
+  owasp_agentic:
+    - id: ASI02:2026
+      context: The schema or sampling tool is invoked as designed while its single argument silently widens what the tool executes.
+      strength: primary
+  eu_ai_act:
+    - article: '15'
+      context: Article 15 robustness for an analytics agent means the query scope it was granted holds against the content of its own generated parameters.
+      strength: primary
+    - article: '9'
+      context: Query-language injection through agent tool parameters is a foreseeable risk for any data-platform MCP server and needs the continuous monitoring Article 9 requires.
+      strength: secondary
+    - article: '12'
+      context: Logging the operator a generated query attempted to reach gives the record Article 12 requires to reconstruct what data was touched.
+      strength: secondary
+  nist_ai_rmf:
+    - function: Manage
+      subcategory: MG.2.3
+      context: Runtime treatment for the risk that an agent's analytics query reaches a different data source than the one it was scoped to.
+      strength: primary
+    - function: Measure
+      subcategory: MS.2.7
+      context: Detection events document the security of the parameter-to-query boundary in data-platform integrations.
+      strength: secondary
+    - function: Map
+      subcategory: MP.5.1
+      context: 'Records Kusto pipeline injection as distinct from SQL injection: no quoting break-out is involved, so SQL-shaped controls do not apply.'
+      strength: secondary
+  iso_42001:
+    - clause: '8.1'
+      context: Operational control of an analytics agent requires that its granted table scope cannot be widened by the parameter it supplies.
+      strength: primary
+    - clause: '8.4'
+      context: Impact assessment must cover cross-source data reach and outbound requests from the data platform; these detections are the evidence.
+      strength: secondary
+    - clause: '6.2'
+      context: Keeping an analytics agent inside its authorised data scope is an AIMS security objective, operationalised here as a runtime detection.
+      strength: secondary
+tags:
+  category: privilege-escalation
+  subcategory: analytics-query-scope-escape
+  scan_target: both
+  confidence: medium
+agent_source:
+  type: mcp_exchange
+  framework:
+    - any
+  provider:
+    - any
+detection:
+  condition: any
+  conditions:
+    - field: content
+      operator: regex
+      value: (?i)"(?:table_?name|database_?name)"\s*:\s*"[\w.\-]{0,48}\s*\|\s*(?:union|externaldata|evaluate|search|print|invoke|mv-expand|find|\.show|\.export|\.ingest)[\s(]
+      description: A table or database identifier parameter continues with a pipe and another Kusto operator taking an operand — the CVE-2026-33980 injection point
+  false_positives:
+    - A data-platform MCP server whose parameter is named table_name but documented to accept a KQL fragment. The rule fires; the underlying schema is what should change
+    - Advisory or regression-test text that quotes the injected argument in its literal JSON form, as this rule's own test_cases block does
+response:
+  actions:
+    - alert
+  actions_rationale: 'response-action eligibility (docs/RESPONSE-ACTION-ELIGIBILITY.md): no FP measurement on the benign corpus; ceiling = observe. Removed block_tool(interrupt). Detection unchanged — recall cost is zero.'
+  auto_response_threshold: high
+  message_template: |
+    [ATR-2026-02531] An MCP tool argument declared to be a Kusto table or database identifier carries a pipe and a further KQL operator, so the executed query reaches past the named table (CVE-2026-33980 shape). Validate the identifier before interpolating it into the query.
+confidence: 75

package/rules/privilege-escalation/ATR-2026-02601-tool-argument-option-injection.yaml

@@ -0,0 +1,116 @@
+title: 'Argument Injection: Execution-Bearing CLI Option Smuggled into a Tool Data Parameter'
+id: ATR-2026-02601
+rule_version: 1
+status: experimental
+description: |
+  Detects the argument-injection shape behind CVE-2026-25130 (CAI find_file): a value that a tool documents as DATA -- a filename, a glob, a search term, an args string -- begins with a dash and therefore reaches the underlying binary as an OPTION, and the option it reaches is one that executes a program. No shell metacharacter is involved anywhere, which is why the existing shell metacharacter rule ATR-2026-00111 stays silent on the whole family: verified against the engine, the same payload only fires 00111 once a pipe is added.
+  WHAT MAKES IT PRECISE, AND WHAT THAT COSTS. `-exec` on its own is not the signal -- `find . -name "*.pyc" -exec rm -f {} \;` is a thing developers and agents legitimately do all day, and it appears in the find(1) manual, in Makefile lint targets and in CI logs. Three things have to line up before this rule fires: (a) the dash-leading value sits in a parameter NAMED as data (args/pattern/path/query/...; `command`, `cmd` and `script` are excluded because a shell tool is supposed to receive options), (b) the option is one with execution or file-write semantics, and (c) the thing it executes is an INTERPRETER or network client (sh, bash, python, perl, node, nc, curl, wget) or lives in a world-writable scratch directory. `-exec rm`, `-exec chmod`, `-exec shellcheck`, `-exec gzip {} +` are all deliberately NOT claimed.
+  The same three-part test is applied to the archive and transport options in the same family: tar --checkpoint-action=exec=, --to-command=, --use-compress-program=, unzip's --unzip-command=, rsync's --rsh=, and find's -fprintf aimed at a login/startup path. GNU tar's own manual example (--checkpoint-action=exec=/sbin/cdrom-eject) and rsync --rsh=ssh are measured true negatives; --checkpoint-action=exec=/tmp/stage.sh and --rsh=sh are not.
+  NOT COVERED ON PURPOSE. `--upload-pack=` / `ext::` (git transport) and `--pre=` / `-oProxyCommand=` (ripgrep, ssh) belong to the same class but are left to rules scoped to those tools; folding every binary's option table into one regex would trade the precision above for a list nobody can review.
+author: ATR Community
+date: 2026/08/23
+schema_version: '0.1'
+detection_tier: pattern
+maturity: test
+severity: high
+references:
+  owasp_llm:
+    - LLM06:2025
+  owasp_agentic:
+    - ASI03:2026
+  mitre_atlas:
+    - AML.T0053 - LLM Plugin Compromise
+    - AML.T0051 - LLM Prompt Injection
+  cve:
+    - CVE-2026-25130
+compliance:
+  owasp_agentic:
+    - id: ASI03:2026
+      context: A tool the agent is authorised to use for reading files is turned into arbitrary command execution purely through the shape of its argument, which is privilege escalation without any new permission being granted.
+      strength: primary
+  owasp_llm:
+    - id: LLM06:2025
+      context: 'Excessive agency: the effective capability of a read-only tool exceeds what its schema and description advertise, and the gap is reachable from model-controlled input.'
+      strength: primary
+  eu_ai_act:
+    - article: '15'
+      context: 'Article 15 cybersecurity: the rule detects an input crafted so that a component interprets data as control, the canonical injection failure the article requires resilience against.'
+      strength: primary
+    - article: '9'
+      context: Tool argument injection is a documented risk class for tool-using agents; detections are the monitoring output Article 9 risk management requires.
+      strength: secondary
+    - article: '14'
+      context: A human overseeing a file-search tool cannot be expected to notice that its argument reaches -exec; surfacing the event is what makes the oversight in Article 14 effective.
+      strength: secondary
+  nist_ai_rmf:
+    - function: Manage
+      subcategory: MG.2.3
+      context: Runtime treatment for the risk that an agent tool's real capability exceeds its declared one.
+      strength: primary
+    - function: Map
+      subcategory: MP.5.1
+      context: Catalogues option-smuggling as a distinct risk from shell-metacharacter injection, which existing controls already cover.
+      strength: secondary
+    - function: Measure
+      subcategory: MS.2.7
+      context: Detection events document the security and resilience of the tool boundary as MEASURE 2.7 requires.
+      strength: secondary
+  iso_42001:
+    - clause: '8.1'
+      context: 'Clause 8.1 operational control: the boundary between a tool''s data inputs and its control inputs is an operational control this rule verifies at runtime.'
+      strength: primary
+    - clause: '6.2'
+      context: Preventing tool-mediated command execution is an AIMS information security objective under clause 6.2.
+      strength: secondary
+    - clause: '8.4'
+      context: Impact assessment under 8.4 must account for third-party CLI binaries invoked on the agent's behalf; these events are the evidence for that path.
+      strength: secondary
+tags:
+  category: privilege-escalation
+  subcategory: argument-injection
+  scan_target: both
+  confidence: medium
+agent_source:
+  type: mcp_exchange
+  framework:
+    - any
+  provider:
+    - any
+detection:
+  conditions:
+    - field: content
+      operator: regex
+      value: '["'']?(?:args?|arguments|argv|options?|opts|pattern|glob|name|filename|file_?name|path|filepath|dir|directory|query|search|search_?term|term|target|keyword|input|value|expr|expression)["'']?\s*[:=]\s*["'']\s{0,4}-[^"\n]{0,150}?\B-exec(?:dir)?\s+["'']?(?:[^"''\s]{0,40}/)?(?:sh|bash|zsh|dash|ksh|python\d?(?:\.\d+)?|perl|ruby|php|node|nc|ncat|netcat|curl|wget|osascript|powershell|pwsh)\b'
+      description: Dash-leading data parameter whose value reaches find -exec/-execdir with an interpreter or network client
+    - field: tool_args
+      operator: regex
+      value: '["'']?(?:args?|arguments|argv|options?|opts|pattern|glob|name|filename|file_?name|path|filepath|dir|directory|query|search|search_?term|term|target|keyword|input|value|expr|expression)["'']?\s*[:=]\s*["'']\s{0,4}-[^"\n]{0,150}?\B-exec(?:dir)?\s+["'']?(?:[^"''\s]{0,40}/)?(?:sh|bash|zsh|dash|ksh|python\d?(?:\.\d+)?|perl|ruby|php|node|nc|ncat|netcat|curl|wget|osascript|powershell|pwsh)\b'
+      description: Same, in the JSON-encoded tool argument object
+    - field: content
+      operator: regex
+      value: '["'']?(?:args?|arguments|argv|options?|opts|pattern|glob|name|filename|file_?name|path|filepath|dir|directory|query|search|search_?term|term|target|keyword|input|value|expr|expression)["'']?\s*[:=]\s*["'']\s{0,4}-[^"\n]{0,180}?-{0,2}(?:checkpoint-action\s*=\s*exec=?\s*(?:["'']?(?:[^"''\s]{0,40}/)?(?:sh|bash|zsh|dash|ksh|python\d?(?:\.\d+)?|perl|ruby|php|node|nc|ncat|netcat|curl|wget|osascript|powershell|pwsh)\b|["'']?(?:/tmp/|/var/tmp/|/dev/shm/|~/|\$HOME/))|to-command\s*=\s*(?:["'']?(?:[^"''\s]{0,40}/)?(?:sh|bash|zsh|dash|ksh|python\d?(?:\.\d+)?|perl|ruby|php|node|nc|ncat|netcat|curl|wget|osascript|powershell|pwsh)\b|["'']?(?:/tmp/|/var/tmp/|/dev/shm/|~/|\$HOME/))|use-compress-program\s*=\s*(?:["'']?(?:[^"''\s]{0,40}/)?(?:sh|bash|zsh|dash|ksh|python\d?(?:\.\d+)?|perl|ruby|php|node|nc|ncat|netcat|curl|wget|osascript|powershell|pwsh)\b|["'']?(?:/tmp/|/var/tmp/|/dev/shm/|~/|\$HOME/))|unzip-command\s*=\s*(?:["'']?(?:[^"''\s]{0,40}/)?(?:sh|bash|zsh|dash|ksh|python\d?(?:\.\d+)?|perl|ruby|php|node|nc|ncat|netcat|curl|wget|osascript|powershell|pwsh)\b|["'']?(?:/tmp/|/var/tmp/|/dev/shm/|~/|\$HOME/))|rsh\s*=\s*["'']?(?:[^"''\s]{0,40}/)?(?:sh|bash|zsh|dash|ksh|python\d?(?:\.\d+)?|perl|ruby|php|node|nc|ncat|netcat|curl|wget|osascript|powershell|pwsh)\b|fprintf?\s+["'']?(?:~|\$HOME|/home/|/root/|/etc/|/var/spool/cron))'
+      description: Dash-leading data parameter carrying an archive/transport option that runs a program or writes a login file
+    - field: tool_args
+      operator: regex
+      value: '["'']?(?:args?|arguments|argv|options?|opts|pattern|glob|name|filename|file_?name|path|filepath|dir|directory|query|search|search_?term|term|target|keyword|input|value|expr|expression)["'']?\s*[:=]\s*["'']\s{0,4}-[^"\n]{0,180}?-{0,2}(?:checkpoint-action\s*=\s*exec=?\s*(?:["'']?(?:[^"''\s]{0,40}/)?(?:sh|bash|zsh|dash|ksh|python\d?(?:\.\d+)?|perl|ruby|php|node|nc|ncat|netcat|curl|wget|osascript|powershell|pwsh)\b|["'']?(?:/tmp/|/var/tmp/|/dev/shm/|~/|\$HOME/))|to-command\s*=\s*(?:["'']?(?:[^"''\s]{0,40}/)?(?:sh|bash|zsh|dash|ksh|python\d?(?:\.\d+)?|perl|ruby|php|node|nc|ncat|netcat|curl|wget|osascript|powershell|pwsh)\b|["'']?(?:/tmp/|/var/tmp/|/dev/shm/|~/|\$HOME/))|use-compress-program\s*=\s*(?:["'']?(?:[^"''\s]{0,40}/)?(?:sh|bash|zsh|dash|ksh|python\d?(?:\.\d+)?|perl|ruby|php|node|nc|ncat|netcat|curl|wget|osascript|powershell|pwsh)\b|["'']?(?:/tmp/|/var/tmp/|/dev/shm/|~/|\$HOME/))|unzip-command\s*=\s*(?:["'']?(?:[^"''\s]{0,40}/)?(?:sh|bash|zsh|dash|ksh|python\d?(?:\.\d+)?|perl|ruby|php|node|nc|ncat|netcat|curl|wget|osascript|powershell|pwsh)\b|["'']?(?:/tmp/|/var/tmp/|/dev/shm/|~/|\$HOME/))|rsh\s*=\s*["'']?(?:[^"''\s]{0,40}/)?(?:sh|bash|zsh|dash|ksh|python\d?(?:\.\d+)?|perl|ruby|php|node|nc|ncat|netcat|curl|wget|osascript|powershell|pwsh)\b|fprintf?\s+["'']?(?:~|\$HOME|/home/|/root/|/etc/|/var/spool/cron))'
+      description: Same, in the JSON-encoded tool argument object
+  condition: any
+  false_positives:
+    - 'DEPRECATED 2026-08-23 BY ADVERSARIAL REVIEW. The find -exec branch cannot separate attack from benign inside a single event. Measured on the live engine: 30 of 40 realistic benign inputs fired, including the most-copied find recipe there is -- `-exec php -l`, `-exec python -m py_compile`, `-exec node --check`, `-exec ruby -c`, `-exec perl -c`, `-exec bash -n` -- and GNU findutils OWN recommended safe form, `-exec sh -c` / `-execdir sh -c`. Those strings are character-for-character the same shape as the declared true positives; what makes the real one an attack is that the parameter was model-controlled, and that fact is not in the event'
+    - 'The one narrowing that cleared those FPs -- requiring the executed program to be reached by absolute path -- was measured and rejected as overfitting to the six declared true positives: with it applied, deleting the four characters `/bin/` from TP1, TP2 and TP3 evaded the rule entirely (all three went clean), as did `./sh`. It traded a measurable false-positive rate for a one-edit evasion'
+    - 'Premise (a) of the rule, that the parameter is NAMED as data, does not hold. args/arguments/argv/options/opts are the canonical names for RAW ARGUMENT PASSTHROUGH. The rule''s own true negatives concede it: TN 3, 4 and 5 are all {tool: run_find, args: -... -exec ...} and are negative only because of the program name, never the parameter name. With (a) contributing nothing the rule reduces to `an interpreter name appears after -exec`, which is a keyword list'
+    - The -fprintf branch claimed to detect a login/startup path but tested only the DIRECTORY PREFIX, so `-fprint /home/ci/build-manifest.txt`, `-fprintf /home/deploy/objects.txt`, `-fprintf ~/reports/changed.txt` and `-fprintf /root/suid-audit.txt` all fired on plain manifest generation. `fprintf?` also matches bare `-fprint`, which has no execution semantics at all
+    - 'The claimed 13,246-sample 0 FP was a near-zero measurement: only 69 of the 12,830 samples in data/benign-corpus-extended contain `-exec` at any position, and 4 contain `fprint`. A skills/npm/pypi/arxiv corpus does not carry find command lines inside JSON tool calls, so it could not have charged this rule'
+    - 'Fires on a detection project''s own rule and test files, e.g. a YAML line `value: ''-name x -exec /bin/sh -c id ;''`, because `value` is in the parameter-name list'
+    - 'An awk BEGIN system() condition was authored, measured against the benign corpus, and REMOVED: it fired on three penetration-testing reference skills that quote GTFOBins one-liners. Inline interpreter code is a different shape from argument injection and did not belong in this rule'
+    - 'An operations tool that deliberately exposes raw find/tar arguments and is genuinely asked to run an interpreter over the matches (measured: -exec rm / chmod / shellcheck / gzip do NOT fire; -exec /bin/sh does, by design)'
+    - A backup script whose tar checkpoint action legitimately runs a helper staged in /tmp
+    - Security writing that quotes the CVE-2026-25130 proof of concept inside a JSON tool call verbatim
+response:
+  actions:
+    - alert
+    - snapshot
+  auto_response_threshold: high
+  message_template: |
+    [ATR-2026-02601] A tool parameter documented as data carries a dash-leading value that reaches an execution-bearing CLI option (find -exec, tar --checkpoint-action=exec, --to-command, rsync --rsh). No shell metacharacter is required for this to run code. Verify the value's origin before allowing the call.
+confidence: 70

package/rules/privilege-escalation/ATR-2026-02620-dynamic-import-data-uri-module.yaml

@@ -0,0 +1,101 @@
+title: 'Code Execution via data: URI Module Specifier Handed to import()'
+id: ATR-2026-02620
+rule_version: 1
+status: experimental
+description: |
+  Detects code execution smuggled through the SPECIFIER of a dynamic import() rather than through eval() or new Function(). `import('data:text/javascript,<code>')` is a fully supported ES module loader path in Node and in browsers: the inline body becomes a real module and runs at import time. Attacker-controlled module ids reaching import() are the primitive behind CVE-2025-67489 (@vitejs/plugin-rsc RCE through unsafe dynamic imports in RSC server function APIs), where the attacker never needed eval to be reachable.
+  MEASURED GAP. The payload held as true_positive #1 -- an inline data: module whose body fetches an absolute URL with a process.env token appended -- evaluated through the engine matched only ATR-2026-00002 (generic indirect prompt injection) on llm_input/llm_output, and on tool_call matched only ATR-2026-00161/00012/00061 -- none of which key on the execution primitive. The eval() sibling of the same payload fires ATR-2026-00110/00126, so the eval-shaped half of this family is covered and the import-shaped half was not.
+  SCOPE, DELIBERATELY NARROWED. A bare `import('data:text/javascript,...')` is NOT flagged. That construct is documented in the Node ESM manual and is the standard way tooling materialises a module from a string, since there is no eval() for modules -- test-runner ESM shims, loader hooks and REPL glue all emit it, and so does the documentation teaching it. Flagging the bare form would fire on Node's own docs. What this rule requires is the inline module body ALSO reaching for a capability an inline shim has no reason to touch: process/environment, an outbound request, or a child process. That conjunction, not the data: URI, is where the precision comes from.
+  KNOWN GAP, DELIBERATELY LEFT OPEN. The base64-bodied form (`import('data:text/javascript;base64,...')`) is NOT covered. A condition on it existed in review and was removed: it fires on ordinary bundler output, because esbuild's `--loader:.js=dataurl`, webpack's `type: "asset/inline"` and Storybook's inline-CSF emit exactly `import("data:text/javascript;base64, <24+ chars>")` for wholly benign modules, and nothing inside a single event distinguishes those from a payload -- the engine only base64-decodes on the scanSkill() path, never in evaluate(). Flagging every inline base64 module would charge every bundler user for the evasion. So base64 bodies are an admitted blind spot rather than a broad condition.
+  BRIDGE, AND WHY IT IS SHAPED THIS WAY. The span between the specifier's comma and the capability token may not cross a raw quote or newline, and may cross at most ONE escaped quote, immediately before the capability token. Both limits are load-bearing. Without the first, the match walks out of the specifier into surrounding prose. Without the second, a JSON-encoded tool argument -- which is how production presents tool_args -- lets `\"` end the specifier and the match continues through ordinary English into an unrelated `process.env` further down the line. The opening quote is REQUIRED for the same reason: `import(data:text/javascript,...)` unquoted is not valid JavaScript, it only ever occurs in prose, and allowing it made the rule fire on changelogs, markdown tables, CI logs, Semgrep/Sigma rules that detect this very attack, and on this rule's own MEASURED GAP paragraph. The body must also START immediately after the comma with a non-whitespace character, which is what a data: URI looks like; a truncated log line that opens the specifier and never closes it (`import("data:text/javascript, at Module.load (...) - check process.env.NODE_OPTIONS`) otherwise walked straight into prose. An attacker who inserts a leading space evades this, and that is the price paid for the log-noise class.
+  WHAT STILL FIRES ON BENIGN TEXT, MEASURED. Re-measured after the above on 12,931 benign corpus samples (data/benign-corpus-extended/, all shapes plus scanSkill): 0 fired. On 44 adversarially authored benign inputs, 5 still fire, and all 5 are the irreducible class -- text that contains a COMPLETE, correctly quoted payload, or an inline module that genuinely reaches a capability. They are: this rule's own MEASURED GAP paragraph and true_positive fixtures; a scanner's unit-test fixture carrying the payload as a string; a non-English document quoting the payload verbatim to warn against it; an inline module that reads `process.env.NODE_ENV` for a build; and an ESM shim whose inline body calls `require(`. Note that `process.env` alone carries NO true positive in this rule's fixture set -- every true positive matches on fetch(//, globalThis.process, child_process, sendBeacon or require( first -- so that alternative is the weakest part of the conjunction and is kept only because an inline module that returns the environment to its caller is a real attack shape.
+author: ATR Community
+date: 2026/08/23
+schema_version: '0.1'
+detection_tier: pattern
+maturity: test
+severity: high
+references:
+  cve:
+    - CVE-2025-67489
+  owasp_llm:
+    - LLM05:2025
+  owasp_agentic:
+    - ASI04:2026
+  mitre_atlas:
+    - AML.T0053 - LLM Plugin Compromise
+    - AML.T0011 - User Execution
+compliance:
+  owasp_agentic:
+    - id: ASI04:2026
+      context: An attacker-controlled module specifier turns a data-handling path into an execution path, which is unexpected code execution inside the agent's own runtime.
+      strength: primary
+  owasp_llm:
+    - id: LLM05:2025
+      context: 'Improper output handling: a string that reached a module loader is executed as code rather than treated as data.'
+      strength: primary
+  eu_ai_act:
+    - article: '15'
+      context: Article 15 requires high-risk systems to be resilient against attempts to alter their behaviour; executing an attacker-supplied inline module alters the system's behaviour at runtime.
+      strength: primary
+    - article: '9'
+      context: Code execution through a module loader is a risk this rule surfaces as the monitoring evidence Article 9 risk management requires.
+      strength: secondary
+    - article: '12'
+      context: Detection events give the automatic recording of execution attempts that Article 12 logging expects.
+      strength: secondary
+  nist_ai_rmf:
+    - function: Manage
+      subcategory: MG.2.3
+      context: Runtime treatment of the risk that an agent's module loader is used as an execution primitive.
+      strength: primary
+    - function: Map
+      subcategory: MP.5.1
+      context: Catalogues specifier-borne execution as a distinct risk from eval-borne execution, which is the gap this rule closes.
+      strength: secondary
+    - function: Measure
+      subcategory: MS.2.7
+      context: Provides the security and resilience evidence MEASURE 2.7 asks to be documented for code-execution attempts.
+      strength: secondary
+  iso_42001:
+    - clause: '8.1'
+      context: 'Clause 8.1 covers control of operational processes; an inline module fetched from a data: URI enters the runtime without any of the review the supply chain otherwise receives.'
+      strength: primary
+    - clause: '6.2'
+      context: Detecting loader-borne code execution is an AIMS information security objective under clause 6.2, operationalised as a runtime control.
+      strength: secondary
+    - clause: '8.4'
+      context: Impact assessment under clause 8.4 must account for arbitrary code running with the agent's own privileges; these events are that path's monitoring evidence.
+      strength: secondary
+tags:
+  category: privilege-escalation
+  subcategory: module-loader-execution
+  scan_target: both
+  confidence: medium
+agent_source:
+  type: mcp_exchange
+  framework:
+    - any
+  provider:
+    - any
+detection:
+  conditions:
+    - field: content
+      operator: regex
+      value: (?i)\bimport\s*\(\s*(?:\\{0,2}["'`])\s*data:\s*(?:text|application)/(?:x-)?(?:java|ecma)script\s*[,;](?:(?:\\{1,3}["'`])?(?:process\s*\.\s*env|globalThis\s*\.\s*process|child_process|\bfetch\s*\(\s*(?:\\{0,2}["'`])?\s*(?:https?:)?//|sendBeacon|XMLHttpRequest|\bexecSync\b|\bspawnSync\b|\brequire\s*\(|\beval\s*\()|[^\s"'`\\\n](?:[^"'`\\\n]|\\[^"'`\n]){0,39}(?:\\{1,3}["'`])?(?:process\s*\.\s*env|globalThis\s*\.\s*process|child_process|\bfetch\s*\(\s*(?:\\{0,2}["'`])?\s*(?:https?:)?//|sendBeacon|XMLHttpRequest|\bexecSync\b|\bspawnSync\b|\brequire\s*\(|\beval\s*\())
+      description: 'Dynamic import of a data: URI JavaScript module whose inline body touches process/env, an outbound request, or a child process'
+  condition: any
+  false_positives:
+    - 'Tooling that materialises a module from a string and legitimately needs process.env inside it -- loader hooks, test-runner ESM shims, bundler virtual modules. Measured as the closest benign shape and the reason the bare data: form is not flagged.'
+    - 'Documentation or a security article that quotes a complete, correctly quoted data: URI import payload verbatim -- including this rule''s own MEASURED GAP paragraph and its true_positive inputs. Prose that merely NAMES the construct (`import(data:text/javascript,...)` without quotes, or with typographic quotes) no longer matches.'
+    - 'A JSON tool argument whose inline module body itself contains a nested quoted string before its first capability token: the bridge crosses at most one escaped quote, so such a payload is missed rather than a benign neighbour being flagged.'
+    - An inline module that legitimately calls fetch() against a relative/same-origin path is NOT flagged; only an absolute or protocol-relative destination counts, since exfiltration needs one.
+    - 'MEASURED RESIDUAL: an inline module that reads process.env.NODE_ENV to bake a build flag, and an ESM shim whose inline body calls require(). Both fire and both can be benign; process.env in particular carries no true positive in the fixture set.'
+    - 'MEASURED RESIDUAL: a scanner''s own test fixture, or a non-English security document, that carries a complete correctly quoted payload as a literal string. Any pattern rule for this class fires on those.'
+response:
+  actions:
+    - alert
+  auto_response_threshold: high
+  message_template: |
+    [ATR-2026-02620] Dynamic import() of a data: URI module detected. The module body executes at import time with the agent's own privileges. Verify the module specifier is not attacker-controlled (CVE-2025-67489 class).
+confidence: 70

package/rules/privilege-escalation/ATR-2026-02626-agent-self-registers-mcp-server.yaml

@@ -0,0 +1,107 @@
+title: Agent Writes a New MCP Server Into Its Own Trust Configuration
+id: ATR-2026-02626
+rule_version: 2
+status: experimental
+description: |
+  Detects an agent tool call that adds an entry to the mcpServers block of a trust-configuration file the agent itself loads -- claude_desktop_config.json, .claude.json, .cursor/mcp.json, .vscode/mcp.json, .continue/config.json, .gemini/settings.json. This is persistence and privilege expansion, not remote code execution: the command field is deliberately unremarkable (python -m pkg, npx -y pkg, node dist/x.js) because the malicious code lives inside the module being launched. MAL-2026-2315 (latinum-wallet-mcp on PyPI) is the reference case -- the package silently registered itself as an MCP server on install.
+  MEASURED GAP. `{"tool":"write_file","arguments":{"path":".../claude_desktop_config.json","content":"{\"mcpServers\":{...\"command\":\"python\"...}}"}}` matched nothing on any of the seven event types. Reading the neighbouring rules explains why: ATR-2026-00419 requires the command itself to be curl/wget or an inline-eval flag; ATR-2026-02022 requires bash/sh/curl near the mcp.json; ATR-2026-01932 matches PROSE describing a rogue registration rather than the registration itself. Swapping the command to curl makes three rules fire immediately, which confirms existing coverage keys on the command string and not on the structural act of granting a new tool source.
+  THE FALSE POSITIVE THIS RULE HAD TO SOLVE. Every MCP server README on earth tells the reader to paste an mcpServers block into claude_desktop_config.json, and a good number give a `cat >> ~/.claude.json <<EOF` one-liner. Measured during authoring, that install documentation is byte-identical in shape to the attack. It is separated here by tags.suppress_in_code_blocks: instructions live inside a fenced block, an agent's actual tool call does not. Both conditions must match (condition: all), so a config payload with no write action, and a write to the trust file that does not add a server, are both silent.
+author: ATR Community
+date: 2026/08/23
+schema_version: '0.1'
+detection_tier: pattern
+maturity: test
+severity: high
+references:
+  owasp_llm:
+    - LLM03:2025
+  owasp_agentic:
+    - ASI05:2026
+    - ASI06:2026
+  mitre_atlas:
+    - AML.T0010 - AI Supply Chain Compromise
+    - AML.T0053 - LLM Plugin Compromise
+compliance:
+  owasp_agentic:
+    - id: ASI05:2026
+      context: Registering a new MCP server grants the agent a tool source nobody authorised, expanding its capability boundary from inside.
+      strength: primary
+    - id: ASI06:2026
+      context: The entry persists in a configuration file, so the expanded capability survives restart and applies to every later session.
+      strength: secondary
+  owasp_llm:
+    - id: LLM03:2025
+      context: A new tool source enters the agent's supply chain without review; the launched module is arbitrary third-party code.
+      strength: primary
+  eu_ai_act:
+    - article: '15'
+      context: 'Article 15 robustness: a self-modification of the trust configuration changes what the system can do, persistently and without authorisation.'
+      strength: primary
+    - article: '14'
+      context: Article 14 human oversight assumes the operator controls which tools the agent has; a silent registration removes that control.
+      strength: secondary
+    - article: '12'
+      context: 'Article 12 record-keeping: a persisted capability grant must be reconstructable after the fact.'
+      strength: secondary
+  nist_ai_rmf:
+    - function: Manage
+      subcategory: MG.2.3
+      context: Runtime treatment for unauthorised expansion of the agent's tool surface.
+      strength: primary
+    - function: Map
+      subcategory: MP.5.1
+      context: Catalogues trust-config self-modification as distinct from malicious command execution, which is the framing existing rules assume.
+      strength: secondary
+    - function: Measure
+      subcategory: MS.2.7
+      context: Detection events supply the security and resilience evidence MEASURE 2.7 asks be documented for capability changes.
+      strength: secondary
+  iso_42001:
+    - clause: '8.1'
+      context: 'Clause 8.1 control of externally provided processes: an MCP server is an external process, and this event adds one outside the change-control path.'
+      strength: primary
+    - clause: '6.2'
+      context: Maintaining the integrity of the agent's tool allowlist is an AIMS information security objective under clause 6.2.
+      strength: secondary
+    - clause: '8.4'
+      context: Impact assessment under clause 8.4 must account for capability grants that persist beyond the session that made them.
+      strength: secondary
+tags:
+  category: privilege-escalation
+  subcategory: mcp-trust-config-modification
+  scan_target: both
+  confidence: medium
+  suppress_in_code_blocks: true
+agent_source:
+  type: mcp_exchange
+  framework:
+    - any
+  provider:
+    - any
+detection:
+  condition: all
+  conditions:
+    - field: content
+      operator: regex
+      value: '(?:\\{0,2}["''])(?:tool|tool_name|name|function|toolName)(?:\\{0,2}["''])\s*:\s*(?:\\{0,2}["''])[\w.-]{0,40}(?:write_file|write_to_file|create_file|edit_file|fs_write|apply_patch|str_replace_editor|str_replace_based_edit_tool|update_file|patch_file)(?:\\{0,2}["''])[\s\S]{0,160}(?:\\{0,2}["''])(?:path|file_path|filename|file|target_file|filePath)(?:\\{0,2}["''])\s*:\s*(?:\\{0,2}["''])[^"''\n]{0,120}(?:claude_desktop_config\.json|\.claude\.json|\.cursor/mcp\.json|\.vscode/mcp\.json|\.continue/config\.json|windsurf/mcp_config\.json|\.mcp\.json|\.codex/config\.toml|\.gemini/settings\.json)(?:\\{0,2}["''])[\s\S]{0,140}(?:\\{0,2}["''])(?:mcpServers|servers)(?:\\{0,2}["''])\s*:\s*\{[\s\S]{0,220}(?:\\{0,2}["''])command(?:\\{0,2}["''])\s*:'
+      description: 'A COMPLETE TOOL-INVOCATION ENVELOPE that writes an MCP trust-config file: a quoted tool/tool_name key naming a file-writing tool, a quoted path key whose value is one of the agent trust-config files, and the mcpServers/servers block carrying a command entry. All three parts, in that order, in one event. The envelope requirement is load-bearing and was added by adversarial review -- see false_positives.'
+    - field: content
+      operator: regex
+      value: '(?:\\{0,2}["''])(?:mcpServers|servers)(?:\\{0,2}["''])\s*:\s*\{[\s\S]{0,220}(?:\\{0,2}["''])command(?:\\{0,2}["''])\s*:'
+      description: An mcpServers/servers block carrying a command entry -- the payload that grants a new tool source
+  false_positives:
+    - |-
+      ADVERSARIAL REVIEW 2026-08-24, FIXED. Rule v1 asked only for a write-verb TOKEN somewhere on a line, the config path, and the payload, and leaned entirely on tags.suppress_in_code_blocks to separate documentation from a real call. Fifteen benign samples were run through the engine and ELEVEN fired. Code-fence suppression turned out to cover far less than the rule assumed: src/engine.ts buildCodeBlockRanges recognises ``` fences, inline backticks and markdown table cells ONLY, so an install README using ~~~ fences fired, and one using a 4-space indented block fired. The rest were not code blocks at all -- an installer CI log line, a PR body showing a diff, an MCP installer's own unit test, an e2e fixture object, a changelog entry, a Traditional Chinese install guide, an incident postmortem quoting MAL-2026-2315's payload, and the tool_description of mcp-installer, a tool whose entire job is to do this legitimately.
+      Fixed by requiring a complete tool-invocation envelope: a quoted tool key naming the writing tool AND a quoted path key holding the trust-config path AND the payload. Prose that merely names a write verb near a path no longer matches, which is what all eleven had in common.
+    - 'ADVERSARIAL REVIEW 2026-08-24, ALSO FIXED: RE2 PORTABILITY. Rule v1 used a negative lookbehind (?<![\w.-]) and two negative lookaheads. RE2 -- Go regexp, Rust regex, every Sigma backend built on them -- cannot compile any of those, and ATR-2026-02626 was absent from data/re2-portability-baseline.json, so scripts/gate-re2-portability.ts fails the build on it as a NEW incompatibility. v2 contains no lookaround and no backreference; the path boundary is now an explicit closing-quote character class.'
+    - 'ADVERSARIAL REVIEW 2026-08-24, DEAD TEST CASE REMOVED. v1 shipped a true positive it could not match: the shell heredoc "cat >> ~/.cursor/mcp.json <<EOF ... command ...". Its shell-redirect alternative required a "command": key BEFORE the redirection operator, but in a heredoc the command key arrives after the path, so the branch was unreachable for its own example -- confirmed by running it through the engine. The branch is removed rather than repaired: a bare shell line has no envelope, so it cannot be separated from the identical line inside install documentation. KNOWN GAP.'
+    - 'KNOWN GAP: a positional call such as write_file("/home/ops/.continue/config.json", "{...mcpServers...}") is no longer matched. It is the same shape as an MCP installer''s own unit test (await write_file("~/.claude.json", ''{"mcpServers":...}'')), which fired on v1, so the two cannot be told apart.'
+    - 'KNOWN RESIDUAL: security writing that quotes a COMPLETE tool-call envelope verbatim in bare prose still fires -- including ATR''s own description of this rule. tags.suppress_in_code_blocks covers the fenced and backticked forms, which is where such quotations normally live.'
+    - An operator legitimately installing an MCP server through the agent, at the operator's own request. The rule fires by design; provenance of the request is what triage must establish.
+response:
+  actions:
+    - alert
+  auto_response_threshold: high
+  message_template: |
+    [ATR-2026-02626] The agent modified its own MCP trust configuration to add a tool source. The command field can look completely ordinary -- the malicious code lives in the module it launches, not in the command string. Confirm a human requested this server before allowing it to load.
+confidence: 70