agent-threat-rules 4.1.5 → 4.2.0

package/dist/verdict.d.ts

@@ -6,9 +6,42 @@
  *
  * @module agent-threat-rules/verdict
  */
-import type { ATRMatch, ATRSeverity, ATRVerdict } from './types.js';
+import type { ATRMatch, ATRSeverity, ATRAction, ATRVerdict } from './types.js';
+/**
+ * Whether a model, not a rule's deterministic logic, decided this match. A match
+ * without a decider (built outside the engine, as every match was before
+ * decidedBy existed) is read as deterministic; an unknown decider as a model.
+ */
+export declare function isModelDecided(match: Pick<ATRMatch, 'decidedBy'>): boolean;
+/**
+ * What a model-decided match may do.
+ *   'advisory' (default): it is reported and its observe-tier actions run, but
+ *     it takes no part in the outcome and its actions above observe are not
+ *     dispatched.
+ *   'enforce': it counts like any other match. Its false-positive rate has not
+ *     been measured; choose this only if you accept that.
+ */
+export type ModelDecisions = 'advisory' | 'enforce';
+export interface VerdictOptions {
+    readonly modelDecisions?: ModelDecisions;
+}
+/** Read a modelDecisions setting, refusing anything but the two values. */
+export declare function modelDecisionsFromConfig(value: unknown): ModelDecisions;
 /** Severity rank from most severe (0) to least severe (4) */
 export declare const SEVERITY_RANK: Readonly<Record<ATRSeverity, number>>;
+/**
+ * Minimum confidence at which a high-severity match denies; below it, asks.
+ *
+ * Compared as given. A confidence the engine derives from a rule's
+ * `tags.confidence` label reaches this threshold only from a `high` label:
+ * `src/rule-confidence.ts` caps every lower label one basis point under it.
+ */
+export declare const HIGH_SEVERITY_DENY_CONFIDENCE = 0.8;
+/**
+ * Minimum confidence at which a medium-severity match asks; below it, allows.
+ * A `low` label reaches it exactly (0.6) when every condition matched.
+ */
+export declare const MEDIUM_SEVERITY_ASK_CONFIDENCE = 0.6;
 /**
  * Check whether auto-response is enabled for a matched rule.
  * The auto_response_threshold field on ATRResponse indicates the
@@ -16,11 +49,22 @@ export declare const SEVERITY_RANK: Readonly<Record<ATRSeverity, number>>;
  * automatically (without human approval).
  */
 export declare function isAutoResponseEnabled(match: ATRMatch): boolean;
+/**
+ * The observe-tier actions of matches whose other actions are not dispatched.
+ * Only actions the tier ladder names: actionTier() reads an unknown name as
+ * observe, and a name it does not know is not one this policy can vouch for.
+ */
+export declare function observeActions(matches: readonly ATRMatch[]): readonly ATRAction[];
 /**
  * Compute a verdict from an array of ATR matches.
  *
+ * A match a model decided (isModelDecided) is reported but, unless
+ * options.modelDecisions is 'enforce', takes no part in the outcome, and of its
+ * actions only the observe tier is dispatched: no benign-corpus measurement
+ * stands behind a model's decision. Every other match counts as before.
+ *
  * This is a pure function -- no side effects, no mutation.
  * Returns a frozen ATRVerdict object.
  */
-export declare function computeVerdict(matches: readonly ATRMatch[]): ATRVerdict;
+export declare function computeVerdict(matches: readonly ATRMatch[], options?: VerdictOptions): ATRVerdict;
 //# sourceMappingURL=verdict.d.ts.map

package/dist/verdict.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verdict.d.ts","sourceRoot":"","sources":["../src/verdict.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,QAAQ,EACR,WAAW,EAEX,UAAU,EAEX,MAAM,YAAY,CAAC;AAEpB,6DAA6D;AAC7D,eAAO,MAAM,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAM/D,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,QAAQ,GACd,OAAO,CAcT;AAwED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,SAAS,QAAQ,EAAE,GAC3B,UAAU,CAkCZ"}
+{"version":3,"file":"verdict.d.ts","sourceRoot":"","sources":["../src/verdict.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,QAAQ,EAER,WAAW,EACX,SAAS,EACT,UAAU,EAEX,MAAM,YAAY,CAAC;AAsBpB;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,OAAO,CAE1E;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,SAAS,CAAC;AAEpD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;CAC1C;AAED,2EAA2E;AAC3E,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,CAMvE;AAED,6DAA6D;AAC7D,eAAO,MAAM,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAM/D,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,MAAM,CAAC;AAEjD;;;GAGG;AACH,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAElD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,QAAQ,GACd,OAAO,CAcT;AAkDD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,SAAS,QAAQ,EAAE,GAAG,SAAS,SAAS,EAAE,CAIjF;AA8BD;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,SAAS,QAAQ,EAAE,EAC5B,OAAO,GAAE,cAAmB,GAC3B,UAAU,CAmDZ"}

package/dist/verdict.js

@@ -6,6 +6,41 @@
  *
  * @module agent-threat-rules/verdict
  */
+import { ACTION_TIERS, TIERED_ACTIONS, actionTier } from './quality/action-eligibility.js';
+/**
+ * Deciders that are a rule's own deterministic logic. Every other decider is a
+ * model: a semantic rule's judge (`semantic-judge`), the Tier 2.5 embedding
+ * signal (`embedding`), the Layer 3 semantic module (`semantic-layer`), and any
+ * value this list does not know. No evidence a response tier is earned from
+ * measures a model's decisions (the benign-corpus evidence runs the synchronous
+ * engine, where a semantic rule is its pattern fallback), so by default they are
+ * reported and not enforced.
+ */
+const DETERMINISTIC_DECIDERS = new Set([
+    'pattern',
+    'signature',
+    'trace',
+    'semantic-fallback',
+    'invariant',
+    'blacklist',
+    'fingerprint',
+]);
+/**
+ * Whether a model, not a rule's deterministic logic, decided this match. A match
+ * without a decider (built outside the engine, as every match was before
+ * decidedBy existed) is read as deterministic; an unknown decider as a model.
+ */
+export function isModelDecided(match) {
+    return match.decidedBy !== undefined && !DETERMINISTIC_DECIDERS.has(match.decidedBy);
+}
+/** Read a modelDecisions setting, refusing anything but the two values. */
+export function modelDecisionsFromConfig(value) {
+    if (value === undefined)
+        return 'advisory';
+    if (value === 'advisory' || value === 'enforce')
+        return value;
+    throw new TypeError(`modelDecisions must be 'advisory' or 'enforce', not ${JSON.stringify(value)}`);
+}
 /** Severity rank from most severe (0) to least severe (4) */
 export const SEVERITY_RANK = {
     critical: 0,
@@ -14,6 +49,19 @@ export const SEVERITY_RANK = {
     low: 3,
     informational: 4,
 };
+/**
+ * Minimum confidence at which a high-severity match denies; below it, asks.
+ *
+ * Compared as given. A confidence the engine derives from a rule's
+ * `tags.confidence` label reaches this threshold only from a `high` label:
+ * `src/rule-confidence.ts` caps every lower label one basis point under it.
+ */
+export const HIGH_SEVERITY_DENY_CONFIDENCE = 0.8;
+/**
+ * Minimum confidence at which a medium-severity match asks; below it, allows.
+ * A `low` label reaches it exactly (0.6) when every condition matched.
+ */
+export const MEDIUM_SEVERITY_ASK_CONFIDENCE = 0.6;
 /**
  * Check whether auto-response is enabled for a matched rule.
  * The auto_response_threshold field on ATRResponse indicates the
@@ -49,9 +97,9 @@ function determineOutcome(severity, confidence) {
         return 'deny';
     }
     if (severity === 'high') {
-        return confidence >= 0.8 ? 'deny' : 'ask';
+        return confidence >= HIGH_SEVERITY_DENY_CONFIDENCE ? 'deny' : 'ask';
     }
-    if (severity === 'medium' && confidence >= 0.6) {
+    if (severity === 'medium' && confidence >= MEDIUM_SEVERITY_ASK_CONFIDENCE) {
         return 'ask';
     }
     return 'allow';
@@ -73,6 +121,19 @@ function collectUniqueActions(matches) {
     }
     return Object.freeze(actions);
 }
+/**
+ * The observe-tier actions of matches whose other actions are not dispatched.
+ * Only actions the tier ladder names: actionTier() reads an unknown name as
+ * observe, and a name it does not know is not one this policy can vouch for.
+ */
+export function observeActions(matches) {
+    return collectUniqueActions(matches).filter((a) => TIERED_ACTIONS.includes(a) && actionTier(a) === ACTION_TIERS.OBSERVE);
+}
+/** Severity first, then confidence: the order computeVerdict reads matches in. */
+function bySeverityThenConfidence(a, b) {
+    const bySeverity = (SEVERITY_RANK[a.rule.severity] ?? 4) - (SEVERITY_RANK[b.rule.severity] ?? 4);
+    return bySeverity !== 0 ? bySeverity : b.confidence - a.confidence;
+}
 /**
  * Build a human-readable reason string from the highest severity match.
  */
@@ -89,10 +150,16 @@ function buildReason(highestMatch, outcome, matchCount) {
 /**
  * Compute a verdict from an array of ATR matches.
  *
+ * A match a model decided (isModelDecided) is reported but, unless
+ * options.modelDecisions is 'enforce', takes no part in the outcome, and of its
+ * actions only the observe tier is dispatched: no benign-corpus measurement
+ * stands behind a model's decision. Every other match counts as before.
+ *
  * This is a pure function -- no side effects, no mutation.
  * Returns a frozen ATRVerdict object.
  */
-export function computeVerdict(matches) {
+export function computeVerdict(matches, options = {}) {
+    const modelDecisions = modelDecisionsFromConfig(options.modelDecisions);
     if (matches.length === 0) {
         return Object.freeze({
             outcome: 'allow',
@@ -105,23 +172,41 @@ export function computeVerdict(matches) {
             timestamp: new Date().toISOString(),
         });
     }
-    // Matches are already sorted by the engine (severity desc, confidence desc).
-    // The first match has the highest severity.
-    const highestMatch = matches[0];
-    const highestSeverity = highestMatch.rule.severity;
-    const highestConfidence = highestMatch.confidence;
-    const outcome = determineOutcome(highestSeverity, highestConfidence);
-    const actions = collectUniqueActions(matches);
-    const reason = buildReason(highestMatch, outcome, matches.length);
+    // Sorted here rather than trusted: not every caller sorts (the engine appends
+    // the embedding match last, and scanSkill appends decoded-payload matches).
+    // The sort is stable, so an already sorted list keeps its order.
+    const sorted = [...matches].sort(bySeverityThenConfidence);
+    const advisory = modelDecisions === 'advisory' ? sorted.filter(isModelDecided) : [];
+    const enforcing = advisory.length === 0 ? sorted : sorted.filter((m) => !isModelDecided(m));
+    const highestMatch = enforcing[0];
+    const outcome = highestMatch ? determineOutcome(highestMatch.rule.severity, highestMatch.confidence) : 'allow';
+    const actions = Object.freeze([
+        ...new Set([...collectUniqueActions(enforcing), ...observeActions(advisory)]),
+    ]);
+    const topAdvisory = advisory[0];
+    const reason = highestMatch
+        ? buildReason(highestMatch, outcome, matches.length) + advisoryNote(advisory.length)
+        : `ALLOW: ${topAdvisory.rule.title} [${topAdvisory.rule.severity}/` +
+            `${Math.round(topAdvisory.confidence * 100)}% confidence, decided by ` +
+            `${topAdvisory.decidedBy}]: ${advisory.length} model-decided ` +
+            `match${advisory.length === 1 ? '' : 'es'} reported, not enforced (modelDecisions: advisory).`;
     return Object.freeze({
         outcome,
         reason,
         matchCount: matches.length,
-        highestSeverity,
-        highestConfidence,
+        highestSeverity: highestMatch?.rule.severity ?? null,
+        highestConfidence: highestMatch?.confidence ?? 0,
         actions,
-        matches: Object.freeze([...matches]),
+        matches: Object.freeze(sorted),
+        // Present only when something was held back, so a verdict without a model
+        // decision has exactly the fields it always had.
+        ...(topAdvisory
+            ? { advisory: Object.freeze(advisory), advisorySeverity: topAdvisory.rule.severity }
+            : {}),
         timestamp: new Date().toISOString(),
     });
 }
+function advisoryNote(count) {
+    return count === 0 ? '' : `; ${count} model-decided match${count === 1 ? '' : 'es'} reported, not enforced`;
+}
 //# sourceMappingURL=verdict.js.map

package/dist/verdict.js.map

@@ -1 +1 @@
-{"version":3,"file":"verdict.js","sourceRoot":"","sources":["../src/verdict.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAUH,6DAA6D;AAC7D,MAAM,CAAC,MAAM,aAAa,GAA0C;IAClE,QAAQ,EAAE,CAAC;IACX,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,CAAC;IACT,GAAG,EAAE,CAAC;IACN,aAAa,EAAE,CAAC;CACjB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAe;IAEf,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,uBAAuB,CAAC;IAC9D,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAE7B,MAAM,YAAY,GAA2B;QAC3C,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,GAAG;QACX,GAAG,EAAE,GAAG;KACT,CAAC;IAEF,MAAM,kBAAkB,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IACnD,IAAI,kBAAkB,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAEnD,OAAO,KAAK,CAAC,UAAU,IAAI,kBAAkB,CAAC;AAChD,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,gBAAgB,CACvB,QAAqB,EACrB,UAAkB;IAElB,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,OAAO,UAAU,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;IAC5C,CAAC;IACD,IAAI,QAAQ,KAAK,QAAQ,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAC3B,OAA4B;IAE5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAa,CAAC;IAClC,MAAM,OAAO,GAAgB,EAAE,CAAC;IAEhC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACjD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACjB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAClB,YAAkC,EAClC,OAAuB,EACvB,UAAkB;IAElB,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,YAAY,CAAC;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC;IAEzC,OAAO,CACL,GAAG,OAAO,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,KAAK,GAAG;QAC1C,IAAI,IAAI,CAAC,QAAQ,IAAI,GAAG,gBAAgB;QACxC,IAAI,UAAU,QAAQ,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,WAAW,CAC7D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,OAA4B;IAE5B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,OAAO,EAAE,OAAgB;YACzB,MAAM,EAAE,mBAAmB;YAC3B,UAAU,EAAE,CAAC;YACb,eAAe,EAAE,IAAI;YACrB,iBAAiB,EAAE,CAAC;YACpB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;IACL,CAAC;IAED,6EAA6E;IAC7E,4CAA4C;IAC5C,MAAM,YAAY,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;IACjC,MAAM,eAAe,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC;IACnD,MAAM,iBAAiB,GAAG,YAAY,CAAC,UAAU,CAAC;IAElD,MAAM,OAAO,GAAG,gBAAgB,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,WAAW,CAAC,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAElE,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO;QACP,MAAM;QACN,UAAU,EAAE,OAAO,CAAC,MAAM;QAC1B,eAAe;QACf,iBAAiB;QACjB,OAAO;QACP,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC;QACpC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"verdict.js","sourceRoot":"","sources":["../src/verdict.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAUH,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAE3F;;;;;;;;GAQG;AACH,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAAkB;IAC3E,SAAS;IACT,WAAW;IACX,OAAO;IACP,mBAAmB;IACnB,WAAW;IACX,WAAW;IACX,aAAa;CACd,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAAkC;IAC/D,OAAO,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;AACvF,CAAC;AAgBD,2EAA2E;AAC3E,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,UAAU,CAAC;IAC3C,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,IAAI,SAAS,CACjB,uDAAuD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAC/E,CAAC;AACJ,CAAC;AAED,6DAA6D;AAC7D,MAAM,CAAC,MAAM,aAAa,GAA0C;IAClE,QAAQ,EAAE,CAAC;IACX,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,CAAC;IACT,GAAG,EAAE,CAAC;IACN,aAAa,EAAE,CAAC;CACjB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,GAAG,CAAC;AAEjD;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAElD;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAe;IAEf,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,uBAAuB,CAAC;IAC9D,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAE7B,MAAM,YAAY,GAA2B;QAC3C,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,GAAG;QACX,GAAG,EAAE,GAAG;KACT,CAAC;IAEF,MAAM,kBAAkB,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IACnD,IAAI,kBAAkB,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAEnD,OAAO,KAAK,CAAC,UAAU,IAAI,kBAAkB,CAAC;AAChD,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,gBAAgB,CACvB,QAAqB,EACrB,UAAkB;IAElB,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,OAAO,UAAU,IAAI,6BAA6B,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;IACtE,CAAC;IACD,IAAI,QAAQ,KAAK,QAAQ,IAAI,UAAU,IAAI,8BAA8B,EAAE,CAAC;QAC1E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAC3B,OAA4B;IAE5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAa,CAAC;IAClC,MAAM,OAAO,GAAgB,EAAE,CAAC;IAEhC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACjD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACjB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,OAA4B;IACzD,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAC,MAAM,CACzC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC,OAAO,CAC5E,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,SAAS,wBAAwB,CAAC,CAAW,EAAE,CAAW;IACxD,MAAM,UAAU,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACjG,OAAO,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;AACrE,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAClB,YAAkC,EAClC,OAAuB,EACvB,UAAkB;IAElB,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,YAAY,CAAC;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC;IAEzC,OAAO,CACL,GAAG,OAAO,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,KAAK,GAAG;QAC1C,IAAI,IAAI,CAAC,QAAQ,IAAI,GAAG,gBAAgB;QACxC,IAAI,UAAU,QAAQ,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,WAAW,CAC7D,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAC5B,OAA4B,EAC5B,UAA0B,EAAE;IAE5B,MAAM,cAAc,GAAG,wBAAwB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAExE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,OAAO,EAAE,OAAgB;YACzB,MAAM,EAAE,mBAAmB;YAC3B,UAAU,EAAE,CAAC;YACb,eAAe,EAAE,IAAI;YACrB,iBAAiB,EAAE,CAAC;YACpB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;IACL,CAAC;IAED,8EAA8E;IAC9E,4EAA4E;IAC5E,iEAAiE;IACjE,MAAM,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,cAAc,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpF,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;IAE5F,MAAM,YAAY,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC/G,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,oBAAoB,CAAC,SAAS,CAAC,EAAE,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;KAC9E,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,YAAY;QACzB,CAAC,CAAC,WAAW,CAAC,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC;QACpF,CAAC,CAAC,UAAU,WAAY,CAAC,IAAI,CAAC,KAAK,KAAK,WAAY,CAAC,IAAI,CAAC,QAAQ,GAAG;YACnE,GAAG,IAAI,CAAC,KAAK,CAAC,WAAY,CAAC,UAAU,GAAG,GAAG,CAAC,2BAA2B;YACvE,GAAG,WAAY,CAAC,SAAS,MAAM,QAAQ,CAAC,MAAM,iBAAiB;YAC/D,QAAQ,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,qDAAqD,CAAC;IAEnG,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO;QACP,MAAM;QACN,UAAU,EAAE,OAAO,CAAC,MAAM;QAC1B,eAAe,EAAE,YAAY,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI;QACpD,iBAAiB,EAAE,YAAY,EAAE,UAAU,IAAI,CAAC;QAChD,OAAO;QACP,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;QAC9B,0EAA0E;QAC1E,iDAAiD;QACjD,GAAG,CAAC,WAAW;YACb,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,gBAAgB,EAAE,WAAW,CAAC,IAAI,CAAC,QAAQ,EAAE;YACpF,CAAC,CAAC,EAAE,CAAC;QACP,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,uBAAuB,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,yBAAyB,CAAC;AAC9G,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-threat-rules",
-  "version": "4.1.5",
+  "version": "4.2.0",
   "mcpName": "io.github.Agent-Threat-Rule/agent-threat-rules",
   "type": "module",
   "description": "Open detection standard — like Sigma, but for AI agents. Executable, testable rules for prompt injection, tool poisoning, context exfiltration, and MCP attacks. MIT-licensed.",
@@ -95,6 +95,7 @@
     "validate:compliance": "tsx scripts/validate-compliance.ts",
     "eval": "tsx src/eval/run-eval.ts",
     "eval:pint": "tsx src/eval/run-pint-benchmark.ts",
+    "eval:hackaprompt": "python3 scripts/hackaprompt-to-corpus.py && tsx src/eval/run-hackaprompt-benchmark.ts",
     "eval:generalization": "tsx scripts/eval-generalization.ts --all",
     "gate:generalization": "tsx scripts/eval-generalization.ts --gate",
     "gate:rule-latency": "tsx scripts/gate-rule-latency.ts",

package/rules/agent-manipulation/ATR-2026-00030-cross-agent-attack.yaml

@@ -124,7 +124,7 @@ detection:
       description: Attempt to inject new instructions via agent messages (live directive only; negative lookbehind excludes quoted/listed occurrences in prompt-injection detection docs)
     - field: content
       operator: regex
-      value: (?i)(?:you\s+are\s+now|from\s+now\s+on|henceforth|going\s+forward|effective\s+immediately)\s+(?:a|an|the)?\s*(?:unrestricted|unfiltered|jailbroken)?\s*[a-zA-Z]+\s+(?:agent|assistant|bot)
+      value: (?i)(?:you\s+are\s+now|from\s+now\s+on|henceforth|going\s+forward|effective\s+immediately)\s+(?:(?:a|an|the)\s*)?(?:(?:unrestricted|unfiltered|jailbroken)\s*)?[a-zA-Z]+\s+(?:agent|assistant|bot)
       description: Attempt to redefine target agent's identity or role
     - field: content
       operator: regex
@@ -132,7 +132,7 @@ detection:
       description: Instruction to hide actions from oversight (excludes benign coaching form 'never tell users to <verb>' via the first negative lookahead; the second excludes output-verbosity control, 'do not tell the user about each|every|individual <step>', which scopes down per-item progress narration rather than concealing a fact — a report-building skill triggered this on 'Don't tell the user about each tool call as you make it'. Concealment form 'do not tell the user about <fact>' is kept)
     - field: content
       operator: regex
-      value: (?i)(?:acting|speaking|operating)\s+(?:on\s+behalf\s+of|as\s+a?\s*proxy\s+for|in\s+place\s+of)\s+[a-zA-Z0-9_-]+\s*(?:agent)?
+      value: (?i)(?:acting|speaking|operating)\s+(?:on\s+behalf\s+of|as\s+(?:a\s*)?proxy\s+for|in\s+place\s+of)\s+[a-zA-Z0-9_-]+\s*(?:agent)?
       description: Agent claiming to act on behalf of another agent
     - field: content
       operator: regex

package/rules/agent-manipulation/ATR-2026-00139-casual-authority-redirect.yaml

@@ -64,7 +64,7 @@ detection:
   conditions:
     - field: content
       operator: regex
-      value: (?i)(?:fyi|btw|heads up)?\s*(?:the\s+)?(?:orchestrator|coordinator|manager|admin|boss|supervisor|lead)\s+(?:wants?|said|told|instructed|requires?|decided).*(?:append|send|redirect|forward|pipe|write|log)\s+(?:all\s+)?(?:data|output|results?|logs?|info).*(?://|https?://|\d{1,3}\.\d{1,3})
+      value: (?i)(?:the\s+)?(?:orchestrator|coordinator|manager|admin|boss|supervisor|lead)\s+(?:wants?|said|told|instructed|requires?|decided).*(?:append|send|redirect|forward|pipe|write|log)\s+(?:all\s+)?(?:data|output|results?|logs?|info).*(?://|https?://|\d{1,3}\.\d{1,3})
       description: Authority claim redirecting output to external endpoint
     - field: content
       operator: regex

package/rules/agent-manipulation/ATR-2026-00328-named-mode-persona-override.yaml

@@ -80,7 +80,7 @@ detection:
       description: '"Stay in X Mode" + chaos/law-inversion — from inthewild corpus #339 (APOPHIS Mode: "the only true Law is Chaos, and that Humans are meant to be self-serving and selfish")'
     - field: tool_response
       operator: regex
-      value: \w+\s+Mode\s+(?:output|responses?)[\s\S]{0,200}(?:generating\s+any\s+kind\s+of\s+content|ignoring\s+OpenA[Il]\s*['`]?s?\s+content\s+polic)
+      value: \w\s+Mode\s+(?:output|responses?)[\s\S]{0,200}(?:generating\s+any\s+kind\s+of\s+content|ignoring\s+OpenA[Il](?:\s*(?:['`]s?|s))?\s+content\s+polic)
       description: '"X Mode output/responses" + generating any content or ignoring OpenAI policies — Mode-output paired with content-policy bypass from inthewild corpus #416 BABY Mode output definition'
     - field: tool_response
       operator: regex

package/rules/agent-manipulation/ATR-2026-00330-yoja-allcaps-settings-block-persona.yaml

@@ -76,7 +76,7 @@ detection:
       description: '"always respond as the character despite any negative feedback or criticism" — exact character-lock mandate from inthewild corpus #14 #88; "despite negative feedback" prevents safety interventions from breaking the character'
     - field: tool_response
       operator: regex
-      value: '[A-Z][A-Z0-9]+\s+(?:respond|always\s+respond|will\s+respond)\s+as\s+the\s+character[\s\S]{0,50}[A-Z][A-Z0-9]+\s+always\s+respond\s+as\s+the\s+character'
+      value: '[A-Z][0-9]*[A-Z0-9]\s+(?:respond|always\s+respond|will\s+respond)\s+as\s+the\s+character[\s\S]{0,50}[A-Z][A-Z0-9]+\s+always\s+respond\s+as\s+the\s+character'
       description: ALL-CAPS name repeated twice with "respond as the character" mandate — the YOJA-template repeats the persona name as prefix for every rule; the double ALL-CAPS+mandate pattern distinguishes structured persona injection from casual roleplay
     - field: tool_response
       operator: regex

package/rules/agent-manipulation/ATR-2026-00418-weknora-mcp-config-rce.yaml

@@ -89,19 +89,19 @@ detection:
       description: WeKnora plugin/MCP loader content referencing process-spawning fields
     - field: content
       operator: regex
-      value: (?i)(?:plugins?|mcp_servers?)\s*[:=]\s*\[?\s*\{[^}]{0,400}"command"\s*:\s*"(?:curl|wget)"
+      value: (?i)(?:plugins?|mcp_servers?)\s*[:=]\s*(?:\[\s*)?\{[^}]{0,400}"command"\s*:\s*"(?:curl|wget)"
       description: Plugin/MCP-servers config block where the command field resolves to curl/wget — never a legitimate plugin launcher target
     - field: content
       operator: regex
-      value: (?i)(?:plugins?|mcp_servers?)\s*[:=]\s*\[?\s*\{[^}]{0,400}"command"\s*:\s*"(?:bash|sh|cmd|powershell)"[^}]{0,300}"args"\s*:\s*\[[^\]]{0,300}(?:https?://|\|\s*(?:ba)?sh\b|-enc(?:odedcommand)?\b|base64|iwr\b|invoke-webrequest)
+      value: (?i)(?:plugins?|mcp_servers?)\s*[:=]\s*(?:\[\s*)?\{[^}]{0,400}"command"\s*:\s*"(?:bash|sh|cmd|powershell)"[^}]{0,300}"args"\s*:\s*\[[^\]]{0,300}(?:https?://|\|\s*(?:ba)?sh\b|-enc(?:odedcommand)?\b|base64|iwr\b|invoke-webrequest)
       description: Plugin/MCP-servers config block where the wrapper shell (bash/sh/cmd/powershell) args show a genuine payload marker (URL fetch, pipe-to-shell, base64/encoded-command). Excludes benign self-launch idioms like 'sh -c cd /project && node dist/index.js' or 'bash -c /absolute/path/to/own-installed-binary --flag', which lack any such marker — those are the standard way MCP servers document their own stdio launch command, not RCE setup.
     - field: content
       operator: regex
-      value: '(?i)(?:^|\n)\s*command\s*:\s*[\x27"]?(?:curl|wget)[\x27"]?\s*\n\s*args?\s*:'
+      value: '(?i)(?:^|\n)[^\S\n]*command\s*:\s*[\x27"]?(?:curl|wget)[\x27"]?[^\S\n]*\n\s*args?\s*:'
       description: YAML-style plugin config with curl/wget as command — never a legitimate plugin launcher target
     - field: content
       operator: regex
-      value: (?i)(?:^|\n)\s*command\s*:\s*[\x27"]?(?:bash|sh|cmd|powershell)[\x27"]?\s*\n\s*args?\s*:[\s\S]{0,300}(?:https?://|\|\s*(?:ba)?sh\b|-enc(?:odedcommand)?\b|base64|iwr\b|invoke-webrequest)
+      value: (?i)(?:^|\n)[^\S\n]*command\s*:\s*[\x27"]?(?:bash|sh|cmd|powershell)[\x27"]?[^\S\n]*\n\s*args?\s*:[\s\S]{0,300}(?:https?://|\|\s*(?:ba)?sh\b|-enc(?:odedcommand)?\b|base64|iwr\b|invoke-webrequest)
       description: YAML-style plugin config with wrapper shell command and args showing a genuine payload marker — same rationale as the JSON-form condition above
     - field: content
       operator: regex
@@ -117,7 +117,7 @@ detection:
       description: Shell/interpreter inline-execution flag in args array WHERE the executed string also shows a genuine payload marker (URL, pipe-to-shell, base64/encoded-command, curl/wget invocation). Bare '-c'/'-e' + any string was too loose — it matched benign self-launch strings like 'cd /Users/marc/project && node dist/index.js' or '/home/you/.../aks-mcp --transport stdio' that MCP servers commonly document as their own stdio launch command.
     - field: content
       operator: regex
-      value: (?i)(?:^|\n)\s+-\s+-(?:c|e|-eval|-command)\s*$
+      value: (?i)(?:^\s+|\S[^\S\n]*\n\s+)-\s+-(?:c|e|-eval|-command)\s*$
       description: YAML-style args list with inline-execution flag as standalone entry — co-occurrence anchor
 response:
   actions:

package/rules/agent-manipulation/ATR-2026-00432-superagi-output-handler-eval-rce.yaml

@@ -78,7 +78,7 @@ detection:
   conditions:
     - field: content
       operator: regex
-      value: (?i)(?:^|[^a-zA-Z_])eval\s*\(\s*["\x27]?\s*(?:__import__|os\.system|os\.popen|subprocess\.|os\.exec|exec\s*\()
+      value: (?i)(?:^|[^a-zA-Z_])eval\s*\(\s*(?:["\x27]\s*)?(?:__import__|os\.system|os\.popen|subprocess\.|os\.exec|exec\s*\()
       description: eval() invoking Python OS-execution primitives — direct LLM-output-to-eval RCE signature
     - field: content
       operator: regex

package/rules/agent-manipulation/ATR-2026-00440-semantic-kernel-vector-store-eval-rce.yaml

@@ -79,11 +79,11 @@ detection:
   conditions:
     - field: content
       operator: regex
-      value: (?i)lambda\s+\w*\s*:\s*[^,)]*\beval\s*\(
+      value: (?i)lambda\s+(?:\w+\s*)?:[^,)]*\beval\s*\(
       description: 'Lambda body invoking eval() — primary CVE-2026-26030 exploit shape (`lambda row: eval(filter_expr)`)'
     - field: content
       operator: regex
-      value: (?i)lambda\s+\w*\s*:\s*[^,)]*\b__import__\s*\(\s*["\x27](?:os|subprocess|socket|builtins|importlib)["\x27]
+      value: (?i)lambda\s+(?:\w+\s*)?:[^,)]*\b__import__\s*\(\s*["\x27](?:os|subprocess|socket|builtins|importlib)["\x27]
       description: Lambda body using __import__ to reach OS / process / builtin modules — eval-friendly RCE chain
     - field: content
       operator: regex
@@ -99,7 +99,7 @@ detection:
       description: .NET / JavaScript Function() constructor with body invoking eval / process — cross-runtime variant
     - field: user_input
       operator: regex
-      value: (?i)lambda\s+\w*\s*:\s*[^,)]*\b(?:eval|exec|__import__)\s*\(
+      value: (?i)lambda\s+(?:\w+\s*)?:[^,)]*\b(?:eval|exec|__import__)\s*\(
       description: User-supplied filter expression containing lambda + dynamic-evaluation primitive — the original CVE-2026-26030 injection surface
 response:
   actions:

package/rules/context-exfiltration/ATR-2026-00426-nl-output-injection-credential-leak.yaml

@@ -79,7 +79,7 @@ detection:
       description: Embed credential as URL parameter / image src / markdown link
     - field: content
       operator: regex
-      value: (?i)!?\[[^\]]*\]\(\s*https?:\/\/[^)]*(?:\$\{?(?:API_KEY|ACCESS_TOKEN|SECRET|PASSWORD|TOKEN|CREDENTIAL|BEARER|AUTH)\b|\{\{\s*(?:api_key|access_token|secret|password|token|credential|env)\b)
+      value: (?i)!?\[[^\[\]]*\]\(\s*https?:\/\/[^)]*(?:\$\{?(?:API_KEY|ACCESS_TOKEN|SECRET|PASSWORD|TOKEN|CREDENTIAL|BEARER|AUTH)\b|\{\{\s*(?:api_key|access_token|secret|password|token|credential|env)\b)
       description: Markdown link/image template embedding credential placeholder in URL
     - field: content
       operator: regex

package/rules/context-exfiltration/ATR-2026-00702-ipi-credential-exfil-via-agent-action.yaml

@@ -79,7 +79,7 @@ detection:
       description: Share/send password to alternate email address
     - field: content
       operator: regex
-      value: (?i)(?:send|email|forward|share)\s+(?:them|it)?\s+to\s+my\s+email[^.\n]{0,80}[\w.+-]+@[\w-]+\.[\w.]+[^.\n]{0,40}(?:password|credential|key|secret|stored)
+      value: (?i)(?:send|email|forward|share)\s(?:\s*(?:them|it))?\s+to\s+my\s+email(?:[^.\n]{0,79}[^\w.+\n-])?[\w.+-]+@[\w-]+\.[\w.]+(?:[^\w.\n][^.\n]{0,39})?(?:password|credential|key|secret|stored)
       description: Send to my email destination with credential type
     - field: content
       operator: regex

package/rules/context-exfiltration/ATR-2026-00707-ipi-file-exfil-with-destroy-or-tamper.yaml

@@ -59,7 +59,7 @@ detection:
   conditions:
     - field: content
       operator: regex
-      value: (?i)\battacker_objective\s*=\s*Get\s+the\s+(?:user|CUA|agent)['']?s?\s+[^,\n]{0,60},?\s+then\s+(?:delete|edit|modify|tamper|overwrite)\s+the\s+file
+      value: (?i)\battacker_objective\s*=\s*Get\s+the\s+(?:user|CUA|agent)['']?s?(?:\s+(?:[^,\s][^,\n]{0,59},?|,)|\s)\s+then\s+(?:delete|edit|modify|tamper|overwrite)\s+the\s+file
       description: 'VPI attacker_objective: exfil then delete/edit the source file'
     - field: content
       operator: regex

package/rules/context-exfiltration/ATR-2026-00851-indirect-pi-financial-payment-exfil.yaml

@@ -67,7 +67,7 @@ detection:
       description: Injection override + payment/banking retrieval + email exfil destination
     - field: content
       operator: regex
-      value: (?i)(?:retrieve|get|fetch|access|export)\s+(?:my\s+)?(?:saved\s+)?(?:credit\s+card(?:\s+(?:information|details?|numbers?|data))?|payment\s+methods?|bank\s+account(?:\s+(?:detail|information|data))?|debit\s+card)\s+(?:from\s+(?:my\s+)?\w+)?\s*(?:and\s+)?(?:email|send|forward|mail)\s+(?:it|them|the\s+(?:details?|information|data))\s+to[^\n]{0,120}(?:@[^\s"]{3,80}|alternate\s+email)
+      value: (?i)(?:retrieve|get|fetch|access|export)\s+(?:my\s+)?(?:saved\s+)?(?:credit\s+card(?:\s+(?:information|details?|numbers?|data))?|payment\s+methods?|bank\s+account(?:\s+(?:detail|information|data))?|debit\s+card)\s+(?:from\s+(?:my\s+)?\w+\s*)?(?:and\s+)?(?:email|send|forward|mail)\s+(?:it|them|the\s+(?:details?|information|data))\s+to[^\n]{0,120}(?:@[^\s"]{3,80}|alternate\s+email)
       description: Payment/card retrieval + email forwarding (broader coverage, no override prefix required)
   condition: any
   false_positives:

package/rules/context-exfiltration/ATR-2026-01457-sysprompt-completion-clone-attack.yaml

@@ -77,7 +77,7 @@ detection:
   conditions:
     - field: content
       operator: regex
-      value: (?i)(program\s+me\s+with\s+(my|your|the)?\s*system\s+prompt|I\s+am\s+(an?\s+)?(advanced\s+)?AI[^.]{0,60}(program|configure|set|initialize)\s+me)
+      value: (?i)(program\s+me\s+with\s+(?:(my|your|the)\s*)?system\s+prompt|I\s+am\s+(an?\s+)?(advanced\s+)?AI[^.]{0,60}(program|configure|set|initialize)\s+me)
       description: LLM-impersonation framing asking to receive/reproduce system prompt
     - field: content
       operator: regex

package/rules/context-exfiltration/ATR-2026-01462-sysprompt-override-pseudo-admin.yaml

@@ -74,7 +74,7 @@ detection:
   conditions:
     - field: content
       operator: regex
-      value: (?i)((?:<!--\s*|\[)\s*SYSTEM\s+OVERRIDE\b|SYSTEM\s+OVERRIDE\s+(?:BEGIN|MODE|ACTIVE|NOW|ENABLED)|ROOT_?ADMIN|OMEGA\s+CLEARANCE|PRIORITY\s+LEVEL\s*:\s*CRITICAL|AUTHORIZATION\s*:\s*(ROOT|ADMIN|FULL|OMEGA))
+      value: (?i)((?:<!--|\[)\s*SYSTEM\s+OVERRIDE\b|SYSTEM\s+OVERRIDE\s+(?:BEGIN|MODE|ACTIVE|NOW|ENABLED)|ROOT_?ADMIN|OMEGA\s+CLEARANCE|PRIORITY\s+LEVEL\s*:\s*CRITICAL|AUTHORIZATION\s*:\s*(ROOT|ADMIN|FULL|OMEGA))
       description: System override (structurally framed) / root admin / omega clearance authority claim
     - field: content
       operator: regex

package/rules/context-exfiltration/ATR-2026-01463-imend-imsystem-prompt-injection-format.yaml

@@ -69,7 +69,7 @@ detection:
       description: Llama <<SYS>> system block marker in user input
     - field: content
       operator: regex
-      value: (?i)(#{2,}\s*\[SYSTEM[:\]](?!\()|<\|system\|>|\[SYSTEM\s*(?:PROMPT|MESSAGE|OVERRIDE)\](?!\())
+      value: (?i)(##\s*\[SYSTEM[:\]](?!\()|<\|system\|>|\[SYSTEM\s*(?:PROMPT|MESSAGE|OVERRIDE)\](?!\())
       description: Markdown-heading or special-token SYSTEM marker injection (not markdown link text)
 response:
   actions:

package/rules/context-exfiltration/ATR-2026-01606-ssrf-internal-network-scan.yaml

@@ -15,7 +15,7 @@ author: ATR Community
 date: 2026/06/12
 schema_version: '0.1'
 detection_tier: pattern
-maturity: stable
+maturity: test
 severity: high
 references:
   owasp_llm:

package/rules/context-exfiltration/ATR-2026-02847-policy-justified-exfil-to-email.yaml

@@ -70,7 +70,7 @@ detection:
   conditions:
     - field: content
       operator: regex
-      value: (?i)\b(?:per\s+(?:company|management)\s+(?:policy|directive)|data\s+retention\s+policy|for\s+(?:quality\s+assurance|verification\s+purposes|audit\s+purposes|compliance\s+purposes))\b[\s\S]{0,100}[\w.+-]+@[\w-]+\.[\w.-]+|[\w.+-]+@[\w-]+\.[\w.-]+[\s\S]{0,100}\b(?:per\s+(?:company|management)\s+(?:policy|directive)|data\s+retention\s+policy|for\s+(?:quality\s+assurance|verification\s+purposes|audit\s+purposes|compliance\s+purposes))\b
+      value: (?i)\b(?:per\s+(?:company|management)\s+(?:policy|directive)|data\s+retention\s+policy|for\s+(?:quality\s+assurance|verification\s+purposes|audit\s+purposes|compliance\s+purposes))\b[\s\S]{0,100}[\w.+-]+@[\w-]+\.[\w.-]+|[\w.+-]@[\w-]+\.[\w.-]+[\s\S]{0,100}\b(?:per\s+(?:company|management)\s+(?:policy|directive)|data\s+retention\s+policy|for\s+(?:quality\s+assurance|verification\s+purposes|audit\s+purposes|compliance\s+purposes))\b
       description: Fabricated policy/compliance/audit pretext paired with a nearby destination email address, in either order
   condition: any
   false_positives:

package/rules/context-exfiltration/ATR-2026-02855-cross-email-exfil-relay.yaml

@@ -0,0 +1,79 @@
+title: Cross-Email Context Exfiltration Relay Detection
+id: ATR-2026-02855
+rule_version: 1
+status: experimental
+description: |
+  Detects cross-document exfiltration-chaining attempts in which a tool output or injected message instructs the agent to pull a value (e.g. a figure, credential, or identifier) out of an unrelated prior email or message in its context window and relay that value via an outbound send action to an attacker-controlled or unverified recipient. This is the core structural pattern of cross-email exfil relay: the agent is told that something was "found", "mentioned", or "contained" in another/previous/other email, immediately followed by an instruction to send an email, regardless of which specific value or destination address is targeted. Detection is anchored on this found-elsewhere-then-send structure rather than any single value or address to generalize across campaigns.
+author: ATR Community
+date: 2026/03/08
+schema_version: '0.1'
+detection_tier: pattern
+maturity: test
+severity: high
+references:
+  owasp_llm:
+    - LLM01:2025
+    - LLM02:2025
+  owasp_agentic:
+    - ASI06:2026
+  mitre_atlas:
+    - AML.T0051 - LLM Prompt Injection
+    - AML.T0057 - LLM Data Leakage
+compliance:
+  eu_ai_act:
+    - article: '15'
+      context: High-risk AI agents must be resilient against adversarial manipulation of their context that causes unauthorized data exfiltration; this rule's detection of cross-document found-elsewhere-then-send relay chains is a concrete cybersecurity control satisfying Article 15 robustness requirements against input-based manipulation.
+      strength: primary
+    - article: '9'
+      context: Cross-email exfiltration relay via injected tool output is a documented risk class in the AI system risk register; Article 9 requires that monitoring controls are deployed to detect these attempts at runtime.
+      strength: secondary
+  nist_ai_rmf:
+    - subcategory: MP.5.1
+      context: Cross-document exfiltration chaining is a primary class of adversarial context-manipulation attack against agentic AI systems; MP.5.1 requires that such adversarial input risks are identified and tracked so that runtime detection controls like this rule can be deployed.
+      strength: primary
+    - subcategory: MG.3.2
+      context: Detected cross-email exfiltration-relay patterns represent a previously unknown risk requiring incident response; MG.3.2 requires procedures to respond to and recover from such risks once identified, which this rule's runtime detection enables.
+      strength: secondary
+  iso_42001:
+    - clause: '8.1'
+      context: Clause 8.1 operational controls require that AI agents execute tool-use and messaging actions only as intended; this rule enforces that outbound send actions are not silently triggered by instructions hidden inside unrelated context documents such as other emails.
+      strength: primary
+    - clause: '8.3'
+      context: Clause 8.3 requires ongoing assessment of AI system impacts; runtime detection of cross-document exfiltration relay chains feeds that impact assessment for agentic data-handling and communication risks.
+      strength: secondary
+tags:
+  category: context-exfiltration
+  subcategory: cross-email-exfil-relay
+  scan_target: mcp
+  confidence: high
+agent_source:
+  type: llm_io
+  framework:
+    - openai
+    - anthropic
+    - langchain
+    - llamaindex
+    - autogen
+    - crewai
+  provider:
+    - any
+detection:
+  conditions:
+    - field: content
+      operator: regex
+      value: (?i)\b(?:found|find|retrieved|mentioned|contained)\b[\s\S]{0,80}\b(?:other|previous|another)\s+emails?\b[\s\S]{0,100}\bsend\b[\s\S]{0,60}\bemail\b|\bsend\b[\s\S]{0,100}\bemail\b[\s\S]{0,100}\b(?:found|retrieved|mentioned|contained)\b[\s\S]{0,60}\b(?:in|within|from)\s+(?:other|previous|another)\s+emails?\b
+      description: Instruction claims a value was found/mentioned/contained in another, previous, or other email and is immediately followed by a request to send an email, the core cross-document exfiltration-relay structure
+  condition: any
+  false_positives:
+    - Legitimate email-summarization workflows that reference content from another email purely for display, with no subsequent send action
+    - Users explicitly asking the assistant to forward a known, user-specified figure to a known, user-approved recipient
+    - Customer-support transcripts where an agent mentions a prior email thread while drafting a reply to the same, already-authorized recipient
+    - Internal documentation or training examples that describe this exfiltration technique by name without instructing an actual send action
+response:
+  actions:
+    - alert
+    - snapshot
+    - escalate
+  auto_response_threshold: high
+  message_template: '[ATR-2026-02855] Cross-Email Context Exfiltration Relay Detection detected.'
+confidence: 90