agent-threat-rules 4.1.5 → 4.2.0

package/rules/context-exfiltration/ATR-2026-02861-exfil-send-email-with-body-directive.yaml

@@ -0,0 +1,83 @@
+title: Injected Directive to Send Email with Attacker-Specified Body
+id: ATR-2026-02861
+rule_version: 1
+status: experimental
+description: |
+  Detects a directive inside tool-returned content (a fetched email, document, web page or other tool output) that tells the agent to send an email, mail, message or notification to a recipient "with [the] body" of the attacker's choosing: the core action of mail-based exfiltration through indirect prompt injection. The condition reads only the tool response, so a user who asks their own agent to send such an email does not trigger it. Scope is narrow and the evidence comes from one benchmark: the rule was mined from LLMail-Inject, where it matches 214 of 1,973 attack submissions (10.8%) and adds coverage for submissions no other rule matched in the tool-response shape; it matches none of the other attack corpora in the repository, including browsesafe-bench. The benign corpora contain very little text with this phrasing (about 33 samples carry the "send an email/mail/message/notification to" prefix), so its 0 false positives there are a weak measurement. It complements ATR-2026-01862, which keys on the recipient address used by that benchmark rather than on the grammar of the directive.
+author: ATR Community (via LLMail-Inject benchmark)
+date: 2026/10/15
+schema_version: '0.1'
+detection_tier: pattern
+maturity: test
+severity: high
+references:
+  owasp_llm:
+    - LLM01:2025
+    - LLM02:2025
+  owasp_agentic:
+    - ASI01:2026
+    - ASI02:2026
+  mitre_atlas:
+    - AML.T0051.001 - Indirect
+    - AML.T0057 - LLM Data Leakage
+  mitre_attack:
+    - T1567 - Exfiltration Over Web Service
+  research:
+    - https://github.com/microsoft/llmail-inject-challenge
+compliance:
+  eu_ai_act:
+    - article: '15'
+      context: Article 15 (accuracy, robustness and cybersecurity) calls for resilience against attempts to alter an AI system's use or behaviour by exploiting its vulnerabilities; this rule provides detection evidence supporting that requirement for injected directives that steer an agent into mailing data to an attacker-chosen recipient.
+      strength: primary
+    - article: '10'
+      context: Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for a context-exfiltration attempt (injected send-email-with-body directive) affecting that data.
+      strength: secondary
+  nist_ai_rmf:
+    - subcategory: MS.2.7
+      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of injected send-email-with-body directives in tool output.
+      strength: primary
+    - subcategory: MS.2.10
+      context: NIST AI RMF MEASURE 2.10 (privacy risk examined and documented) is supported by this rule's detection of attempts to exfiltrate conversation or retrieved data by email.
+      strength: secondary
+  iso_42001:
+    - clause: '8.1'
+      context: 'Clause 8.1 (operational planning and control): runtime detection of injected exfiltration directives in tool output is an operational control on how the agent acts on retrieved content.'
+      strength: primary
+    - clause: '6.2'
+      context: 'Clause 6.2 (AI objectives and planning to achieve them): detections from this rule give measurable input to objectives for preventing data exfiltration through indirect prompt injection.'
+      strength: secondary
+tags:
+  category: context-exfiltration
+  subcategory: exfil-send-email-with-body-directive
+  scan_target: mcp
+  confidence: high
+agent_source:
+  type: mcp_exchange
+  framework:
+    - openai
+    - anthropic
+    - langchain
+    - llamaindex
+    - autogen
+    - crewai
+  provider:
+    - any
+detection:
+  conditions:
+    - field: tool_response
+      operator: regex
+      value: (?i)\bsend\s+(?:an?\s+)?(?:e-?mail|mail|message|notification)\s+to\s+[\s\S]{0,60}?\bwith\s+(?:the\s+)?body\b
+      description: Directive in tool output to send an email/mail/message/notification to a recipient with a specified body
+  condition: any
+  false_positives:
+    - Tool output that legitimately relays a person's own request, such as a ticketing or CRM system echoing "send an email to the customer with the body below"
+    - API or integration documentation returned by a tool that describes sending a message or notification to a channel or user "with the body" field set to some value
+    - Security documentation that quotes a mail-exfiltration payload verbatim
+response:
+  actions:
+    - alert
+    - snapshot
+    - escalate
+  auto_response_threshold: high
+  message_template: '[ATR-2026-02861] Injected Directive to Send Email with Attacker-Specified Body detected.'
+confidence: 85

package/rules/context-exfiltration/ATR-2026-02866-idna-label-separator-in-fetch-url-host.yaml

@@ -0,0 +1,104 @@
+title: Non-ASCII IDNA Label Separator Inside the Host of a Fetch-Tool URL Argument
+id: ATR-2026-02866
+rule_version: 1
+status: experimental
+description: |
+  Detects a tool call whose URL-typed argument (url, uri, target_url, href, link, src, endpoint, location, website, site, page, target) or host-typed argument (host, hostname, domain, *_host, server_name) carries one of five separator characters: the three that IDNA / UTS #46 mapping turns into an ordinary dot -- U+3002 IDEOGRAPHIC FULL STOP, U+FF0E FULLWIDTH FULL STOP, U+FF61 HALFWIDTH IDEOGRAPHIC FULL STOP -- plus the two look-alike separators U+2024 ONE DOT LEADER and U+FE52 SMALL FULL STOP, INSIDE THE HOST COMPONENT (after '//' and before the first '/', '?' or '#'), and immediately followed by another hostname label, a path/query/fragment delimiter, or a ':port'. Examples: https://evil。com/page, https://evil.com．/page, https://internal-admin。corp。example/api/keys.
+  Mined from CVE-2026-107288 (Pydantic AI web_fetch_tool and the WebFetch local fallback, 1.77.0 up to 1.107.6 / 2.44.0): blocked_domains entries were compared with the URL hostname before either side was normalised to the form getaddrinfo resolves, so a model steered by injected content could spell a blocked host with a non-ASCII label separator and the application fetched it with its own privileges (SSRF). The detection is not bound to any domain: a hostname has no legitimate reason to carry these characters in the serialized tool argument, because every conforming client folds them to '.' before resolution, so their presence is the signature of a string-level allow/block-list being dodged. The same shape defeats any agent fetch tool whose domain filter compares strings before IDNA mapping.
+  BOTH ENCODINGS. The separator is matched as the literal character (what JSON.stringify emits) and as the JSON escape \u3002 / \uff0e / \uff61 / \u2024 / \ufe52 (what Python json.dumps emits with its default ensure_ascii=True), so a Python-side hook log is covered as well.
+  WHY A KEYED ARGUMENT IS REQUIRED. Chinese and Japanese prose routinely ends a sentence with U+3002 directly after a URL ("請參考 https://example.com。謝謝"), and mixed-language text can put an ASCII word straight after that full stop ("https://example.com。GitHub 上也有說明"). The second form is indistinguishable by pattern from https://evil。com, so the rule only reads a value that sits behind a quoted URL/host argument key, where prose does not appear. A separator that is the LAST character of the value (the trailing full stop an extractor copies from a sentence) is also excluded.
+  HOST-TYPED ARGUMENTS ARE READ STRICTLY. Keys such as domain, host or server_name are also used for free text (a topic domain, a podcast host, a display name), so for those keys the WHOLE value must be ASCII hostname shaped -- [a-z0-9.-] labels, the separator, more labels, an optional ':port' -- and must run to the closing quote. CJK prose in such a field (醫療。AI 應用, 王小明。Guest: Amy, 東京サーバー。Tokyo-1) is therefore not read.
+  SCOPE AND LIMITS, stated honestly. (1) Not covered: case variation (EVIL.COM) and a plain trailing root dot (evil.com.) -- they are the same bytes as ordinary URLs. (2) Not covered by this rule: fullwidth-letter hostnames with only ASCII dots (ｅｖｉｌ.ｃｏｍ) -- ATR-2026-00444 sees those; cloud-metadata hosts written with separators also hit ATR-2026-00013. (3) Not covered: a bare URL in prose or in a non-URL argument (a chat message, a document body, a search query); that form is undecidable from Chinese punctuation. A URL passed under a key outside the lists above (q, query, text, content, input) is a known gap. (4) Not covered: punycode (xn--) spellings of a blocked IDN, percent-encoded host bytes, and a trailing separator that ends the value. (5) A security test suite or advisory that reproduces the serialized call verbatim will match.
+  RE2 PORTABILITY. Both conditions are written for RE2-family engines (Go regexp, Rust regex) as well as JavaScript and Python re: the five separator characters and the fullwidth letter/digit ranges are written as literal characters rather than \\uXXXX escapes (which RE2 spells \\x{XXXX} and JS without the u flag does not), there is no lookahead or lookbehind, and every repeat bound is at most 253. The "not the last character of the value" exclusion is expressed by requiring a following label character, delimiter or ':port' after the separator instead of a negative lookahead, so the matched behaviour is unchanged.
+author: ATR Community (CVE sync)
+date: 2026/10/22
+schema_version: '0.1'
+detection_tier: pattern
+maturity: test
+severity: medium
+references:
+  cve:
+    - CVE-2026-107288
+  cwe:
+    - CWE-918
+    - CWE-1289
+    - CWE-176
+  owasp_llm:
+    - LLM02:2025
+    - LLM06:2025
+  owasp_agentic:
+    - ASI02:2026
+  mitre_atlas:
+    - AML.T0053 - AI Agent Tool Invocation
+  mitre_attack:
+    - T1090 - Proxy
+  external:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-107288
+    - https://github.com/pydantic/pydantic-ai/commit/a9dab92099d0ef9d5d4aa34ccac8a6f1b0e51284
+    - https://github.com/pydantic/pydantic-ai/commit/c1f212a084cbfa0012f2044cdb4731d214b3b983
+    - https://github.com/pydantic/pydantic-ai/commit/490335f8e2322e143a79337ddca9410e0176c812
+    - https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.6
+    - https://www.unicode.org/reports/tr46/
+metadata_provenance:
+  cve: human-reviewed
+  cwe: human-reviewed
+  owasp_llm: human-reviewed
+  owasp_agentic: human-reviewed
+  mitre_atlas: human-reviewed
+  mitre_attack: human-reviewed
+compliance:
+  eu_ai_act:
+    - article: '15'
+      context: Article 15 (accuracy, robustness and cybersecurity) calls for resilience against attempts to circumvent security controls. This rule provides detection evidence supporting that requirement by flagging a fetch-tool URL whose host is spelled with an IDNA label separator so that a string-compared domain block list is bypassed.
+      strength: primary
+    - article: '10'
+      context: Article 10 (data and data governance) concerns which data an AI system draws on. An SSRF fetch of a blocked internal host pulls unauthorised data into the agent's context; this rule provides detection evidence supporting control over that data path.
+      strength: secondary
+  nist_ai_rmf:
+    - subcategory: MS.2.7
+      context: MS.2.7 requires security and resilience of the AI system to be evaluated. Counting tool calls whose URL host carries a non-ASCII label separator measures whether the fetch tool's domain control actually holds against normalisation-based bypass.
+      strength: primary
+    - subcategory: MS.2.10
+      context: MS.2.10 covers privacy risk. A blocked internal or metadata host reached through SSRF can expose credentials and personal data to the model; this rule surfaces the attempt for that assessment.
+      strength: secondary
+  iso_42001:
+    - clause: '8.1'
+      context: 'ISO/IEC 42001 Clause 8.1 (operational planning and control): the fetch tool''s domain block list is an operational control, and this rule reports arguments crafted to slip past it before IDNA normalisation.'
+      strength: primary
+    - clause: '6.2'
+      context: 'ISO/IEC 42001 Clause 6.2 (AI objectives and planning): keeping agent egress inside approved destinations is a security objective, and this rule supplies runtime evidence of attempts to defeat it.'
+      strength: secondary
+tags:
+  category: context-exfiltration
+  subcategory: ssrf-idna-label-separator-host
+  scan_target: runtime
+  confidence: high
+  source: cve-disclosure
+agent_source:
+  type: tool_call
+  framework:
+    - any
+  provider:
+    - any
+detection:
+  condition: any
+  conditions:
+    - field: tool_args
+      operator: regex
+      value: \\?["\x27](?:[a-z]{0,16}_?ur[il]|href|link|src|endpoint|location|website|site|page|target)\\?["\x27]\s{0,3}[:=]\s{0,3}\\?["\x27]\s{0,3}(?:[a-z][a-z0-9+.-]{0,15}:)?//[^\s/?#"\x27\\。．｡․﹒]{0,253}(?:[。．｡․﹒]|\\u(?:3002|ff0e|ff61|2024|fe52))(?:[a-z0-9-]|[０-９Ａ-Ｚａ-ｚ]|[/?#]|:\d)
+      description: A quoted URL-typed argument whose HOST component (between '//' and the first '/', '?' or '#') contains an IDNA label separator (U+3002, U+FF0E, U+FF61) or look-alike dot (U+2024, U+FE52), literal or JSON-escaped, followed by another label, a delimiter or a port -- the CVE-2026-107288 blocked_domains bypass shape.
+    - field: tool_args
+      operator: regex
+      value: \\?["\x27](?:host|hostname|domain|[a-z]{1,12}_host|server_name)\\?["\x27]\s{0,3}[:=]\s{0,3}\\?["\x27]\s{0,3}[a-z0-9.-]{1,253}(?:[。．｡․﹒]|\\u(?:3002|ff0e|ff61|2024|fe52))[a-z0-9-](?:[a-z0-9.-]|[。．｡․﹒]|\\u(?:3002|ff0e|ff61|2024|fe52)){0,253}(?::\d{1,5})?\\?["\x27]
+      description: The same separator inside a bare host-typed argument (host / hostname / domain / *_host / server_name) that a tool resolves directly -- the scheme-less form of the same normalisation bypass. The whole value must be an ASCII hostname (labels, separators, optional :port) running to the closing quote, so CJK free text in such a field is not read.
+  false_positives:
+    - Security test suites, CVE reproductions and advisories that quote the serialized tool call verbatim (for example the upstream tests/test_ssrf.py fixtures) match -- same bytes as the attack.
+    - A URL argument whose host was copied out of East Asian text together with a full stop AND has more host text after it (https://example.com。cn/...) matches. That value does not resolve as written by a strict parser and does resolve to a different host after IDNA folding, so it is reported deliberately.
+    - A link / href / url field populated from scraped prose can carry a sentence-final full stop followed by an ASCII word, for example {"link":"https://t.co。Thanks"}. That value matches, because it is byte-for-byte the same shape as https://evil。com and cannot be told apart by pattern.
+    - 'Not matched by design: a separator in the PATH, QUERY or FRAGMENT (https://zh.wikipedia.org/wiki/句號。, ?q=台北。天氣), a separator that is the last character of the value, punycode xn-- hosts, native IDN hosts such as bücher.example, and any URL that appears in prose or a non-URL argument.'
+response:
+  actions:
+    - alert
+  message_template: |
+    [ATR-2026-02866] A fetch-tool URL or host argument spells its hostname with a non-ASCII label separator (U+3002 / U+FF0E / U+FF61 / U+2024 / U+FE52). DNS resolution folds these to '.', so a string-compared domain block list can be bypassed (CVE-2026-107288). Normalise the host with IDNA/UTS #46 before any allow/block-list check and re-evaluate this call.
+confidence: 78

package/rules/excessive-autonomy/ATR-2026-00710-ipi-physical-access-grant.yaml

@@ -63,7 +63,7 @@ detection:
       description: Unlock door to allow entry for a third party
     - field: content
       operator: regex
-      value: (?i)(?:grant|add|give)\s+(?:permanent|temporary|guest|unlimited)?\s+access\s+to\s+(?:my\s+)?(?:friend|guest|person|user|visitor|Amy|Bob|Alice)[^.\n]{0,80}(?:smart\s+lock|August|Kwikset|home|premises|house|building)
+      value: (?i)(?:grant|add|give)\s(?:\s*(?:permanent|temporary|guest|unlimited))?\s+access\s+to\s+(?:my\s+)?(?:friend|guest|person|user|visitor|Amy|Bob|Alice)[^.\n]{0,80}(?:smart\s+lock|August|Kwikset|home|premises|house|building)
       description: Grant person access to home/premises via smart lock
     - field: content
       operator: regex

package/rules/model-abuse/ATR-2026-01897-host-sabotage.yaml

@@ -69,7 +69,7 @@ detection:
       description: 'BIPIA host-sabotage invariant #2'
     - field: user_input
       operator: regex
-      value: (?i)while\s+True\s*:\s*\n?\s*os\.fork\(\)
+      value: (?i)while\s+True\s*:\s*os\.fork\(\)
       description: 'BIPIA host-sabotage invariant #3'
     - field: user_input
       operator: regex
@@ -81,7 +81,7 @@ detection:
       description: 'BIPIA host-sabotage invariant #5'
     - field: user_input
       operator: regex
-      value: (?i)while\s+True\s*:\s*\n?\s*create_window\(\)
+      value: (?i)while\s+True\s*:\s*create_window\(\)
       description: 'BIPIA host-sabotage invariant #6'
   condition: any
   false_positives:

package/rules/model-security/ATR-2026-00433-modelcache-torch-load-deserialization-rce.yaml

@@ -81,7 +81,7 @@ detection:
   conditions:
     - field: content
       operator: regex
-      value: (?i)torch\.load\s*\(\s*[^,)]*(?:request\.|flask\.request|user_input|untrusted|attacker|payload|upload|f\.read\(\)|response\.content)[^)]{0,200}\)
+      value: (?i)torch\.load\s*\([^,)]*(?:request\.|flask\.request|user_input|untrusted|attacker|payload|upload|f\.read\(\)|response\.content)[^)]{0,200}\)
       description: torch.load called on attacker-derived input — direct CVE-2025-45146 sink
     - field: content
       operator: regex

package/rules/privilege-escalation/ATR-2026-00436-enclave-vm-sandbox-escape-rce.yaml

@@ -8,7 +8,7 @@ author: ATR Community
 date: 2026/05/10
 schema_version: '0.1'
 detection_tier: pattern
-maturity: stable
+maturity: test
 severity: critical
 references:
   owasp_llm:

package/rules/privilege-escalation/ATR-2026-01601-sql-injection-destructive-ddl.yaml

@@ -60,11 +60,11 @@ detection:
   conditions:
     - field: tool_args
       operator: regex
-      value: (?i)(?:';|"\s*;|--\s*)\s*(?:DROP\s+(?:TABLE|DATABASE|INDEX|VIEW)|TRUNCATE\s+(?:TABLE\s+)?\w|DELETE\s+FROM\s+\w)
+      value: (?i)(?:';|"\s*;|--)\s*(?:DROP\s+(?:TABLE|DATABASE|INDEX|VIEW)|TRUNCATE\s+(?:TABLE\s+)?\w|DELETE\s+FROM\s+\w)
       description: 'SQL injection: quote-termination followed by destructive DDL'
     - field: tool_args
       operator: regex
-      value: (?i)\bDROP\s+TABLE\s+\w+\s*;?\s*--
+      value: (?i)\bDROP\s+TABLE\s+\w+\s*(?:;\s*)?--
       description: DROP TABLE with comment suppressor
     - field: user_input
       operator: regex

package/rules/privilege-escalation/ATR-2026-01612-debug-mode-privilege-escalation.yaml

@@ -69,7 +69,7 @@ detection:
       description: Explicit privileged/debug/admin mode activation command targeting the agent (enter/switch to/go into)
     - field: user_input
       operator: regex
-      value: (?i)(?:^|\n)\s*(?:/debug|/admin|/system|/root)(?![\w/])
+      value: (?i)(?:^|\n)[^\S\n]*(?:/debug|/admin|/system|/root)(?![\w/])
       description: Slash-command debug/admin invocation as the leading token of a line (not a URL/config path)
     - field: user_input
       operator: regex

package/rules/privilege-escalation/ATR-2026-02867-identifier-typed-tool-argument-dot-dot-path-segment.yaml

@@ -0,0 +1,106 @@
+title: Dot-Dot Path Segment Inside an Identifier-Typed Tool Argument (REST-Wrapper Path Traversal)
+id: ATR-2026-02867
+rule_version: 1
+status: experimental
+description: |
+  Detects a tool-call argument whose KEY says it is an opaque identifier (product_number, licensee_number, customer_id, order_no, user_uuid, productNumber, productId, ...) but whose VALUE carries a dot-dot path segment: a '..' (or %2e%2e, .%2e, %2e.) that starts the value or follows a separator, and is itself followed by a separator ('/', '\', %2f, %5c) or by the end of the value.
+  This is the shape of CVE-2026-57496 / GHSA-hxpf-9xvq-wph8 in the NetLicensing MCP Server (< 0.1.8): netlicensing_get_product interpolated the caller-controlled product_number into the REST path /product/{product_number}. A single product_number of "../token" is normalised by httpx from /product/../token to /token, the response is serialised through the ordinary wrapper instead of the token-redacting one, and the raw API token is returned to the agent. The fix (commit b8fd0ea) added a path-segment validator that rejects '..', '..%2f', '%2e%2e/', backslashes and encoded separators.
+  The rule is deliberately not vendor-scoped. Any MCP server that wraps a REST API by formatting identifier arguments into a URL path has the same bug class, and an identifier never legitimately contains a dot-dot path segment. It keys on the identifier-typed argument name rather than on the tool name or on the '/token' target, so it also fires on licensee_number, a camelCase productNumber, a bare '..' (which walks to the API root) or an encoded separator.
+  Why a new rule rather than relying on existing ones (measured 2026-10-22 on origin/main 69f7f2809 with tool_call and mcp_exchange events whose tool_args is the JSON-encoded argument object): the GHSA PoC {"product_number":"../token"}, "%2e%2e/token", "..\\token" and {"licensee_number":"../token"} matched no rule. ATR-2026-01948 targets this exact CVE but its key regexes expect product_number to be followed directly by ':' or '=', so the closing JSON quote of a real tool_args key defeats it; ATR-2026-02251 / 02353 have the same key-quote gap and list only *_id fields. ATR-2026-00569 catches only the '..%2f' encoding and ATR-2026-00066 / 01616 need two or more '../' levels, while one level is enough against a REST path.
+  Related rule: ATR-2026-01948 (context-exfiltration) is the vendor-specific rule for this same CVE. This rule is the generalised identifier-argument form; keep the two cross-referenced when either is merged, narrowed or retired.
+  Scope and limits. Only JSON double-quoted keys are read ("key": "value"), so a JSON-escaped snippet quoted inside another argument (an agent writing an advisory) does not match. Path-typed keys (path, file, dir, url, key, object_key) are intentionally out of scope - they are covered by the file-path traversal rules - so a traversal smuggled through a key with a non-identifier name (sku, name, product) is not detected here. *_code keys are also out of scope: source_code / python_code / shell_code usually hold free-form program text in which '/../' is ordinary, so product_code / promo_code identifiers are an accepted gap. Plural keys (product_numbers) and array values are not read, and a Tomcat-style path parameter ('..;/token') is not in the separator set. Keys that only END in "id" are matched case-insensitively, so a non-identifier key such as "valid" or "android" holding a dot-dot segment would also match, and identifier keys that legitimately carry a relative path (model_id, doc_id, folder_id) will match as well. CWE-22, CWE-23.
+author: ATR Community (CVE sync)
+date: 2026/10/22
+schema_version: '0.1'
+detection_tier: pattern
+maturity: test
+severity: high
+references:
+  cve:
+    - CVE-2026-57496
+  ghsa:
+    - GHSA-hxpf-9xvq-wph8
+  cwe:
+    - CWE-22
+    - CWE-23
+  owasp_llm:
+    - LLM06:2025
+  owasp_agentic:
+    - ASI03:2026
+    - ASI02:2026
+  mitre_atlas:
+    - AML.T0053 - AI Agent Tool Invocation
+    - AML.T0055 - Unsecured Credentials
+  mitre_attack:
+    - T1552 - Unsecured Credentials
+  external:
+    - https://github.com/Labs64/NetLicensing-MCP/security/advisories/GHSA-hxpf-9xvq-wph8
+    - https://github.com/Labs64/NetLicensing-MCP/commit/b8fd0ea76d533202573eb24add9fb2fbd9331496
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-57496
+metadata_provenance:
+  cve: human-reviewed
+  cwe: human-reviewed
+  owasp_llm: human-reviewed
+  owasp_agentic: human-reviewed
+  mitre_atlas: human-reviewed
+  mitre_attack: human-reviewed
+compliance:
+  eu_ai_act:
+    - article: '15'
+      context: Article 15 (accuracy, robustness and cybersecurity) requires resilience against attempts to exploit system vulnerabilities; this rule provides detection evidence supporting that requirement by flagging an identifier argument that steers an MCP server's REST request onto an unintended endpoint such as /token.
+      strength: primary
+    - article: '14'
+      context: Article 14 (human oversight) needs operators to be able to see and interrupt anomalous agent actions; an alert on a traversal-bearing identifier argument provides detection evidence supporting oversight of tool calls that would otherwise silently return credentials to the model.
+      strength: secondary
+  nist_ai_rmf:
+    - subcategory: MS.2.7
+      context: MEASURE 2.7 requires AI system security and resilience to be evaluated; inspecting identifier-typed tool arguments for dot-dot path segments is a per-invocation measurement of the agent-to-tool boundary rather than an assumption that each MCP server validates its own path segments.
+      strength: primary
+    - subcategory: MG.2.3
+      context: MANAGE 2.3 requires procedures to respond to and recover from identified AI risks; this rule is the runtime trigger for responding to a privilege-escalating path traversal through an agent tool argument.
+      strength: secondary
+  iso_42001:
+    - clause: '8.1'
+      context: Clause 8.1 operational planning and control covers externally provided processes such as third-party MCP servers; this rule is an operational control applied to each tool invocation independent of the server's own input validation.
+      strength: primary
+    - clause: '6.2'
+      context: Clause 6.2 AI objectives and planning to achieve them include keeping credentials out of model context; detecting the traversal that reroutes a lookup onto a token endpoint supports that objective.
+      strength: secondary
+tags:
+  category: privilege-escalation
+  subcategory: identifier-argument-path-traversal
+  scan_target: tool_args
+  confidence: medium
+  source: cve-disclosure
+  vendor_sources: netlicensing-mcp-cve-2026-57496
+  suppress_in_code_blocks: true
+agent_source:
+  type: tool_call
+  framework:
+    - mcp
+    - any
+  provider:
+    - any
+detection:
+  condition: any
+  method: pattern
+  false_positives:
+    - 'A tool whose API genuinely uses ''..'' as an identifier, for example a filesystem-browser tool that addresses the parent entry as {"entry_id": ".."}. Such an argument is itself a traversal and will match.'
+    - Security test fixtures and CVE reproductions that pass the traversal payload through a real tool call match by design.
+    - Keys that end in 'id' are matched case-insensitively (the engine compiles this condition format with flag 'i'), so a non-identifier key such as 'valid' or 'android' holding a dot-dot segment would also match.
+    - 'Identifier-named keys that legitimately hold a relative filesystem path will match: a Hugging Face from_pretrained-style local checkpoint {"model_id": "../checkpoints/llama-ft"}, a RAG or document tool that uses the file path as the document id {"doc_id": "docs/../README.md"}, or a folder-navigation tool addressing the parent folder {"folder_id": ".."}. These are indistinguishable from the traversal by value alone; suppress per tool when the target server resolves such ids against a sandboxed root.'
+  conditions:
+    - field: tool_args
+      operator: regex
+      value: '"(?:[a-z0-9_-]{0,40}[_-](?:id|number|num|no|nr|uuid|guid|slug)|[a-z0-9]{1,40}(?:number|uuid|guid|id)|id|number|uuid|guid|slug)"\s{0,3}:\s{0,3}"(?:[^"\n]{0,120}?(?:/|\\|%2f|%5c))?(?:\.\.|%2e%2e|\.%2e|%2e\.|%252e%252e)(?:/|\\|%2f|%5c|%252f|%255c|")'
+      description: An identifier-typed JSON argument (snake_case *_id/*_number/*_no/*_uuid/*_slug, camelCase *Number/*Id/*Uuid, or a bare id/number key; *_code keys excluded because they usually carry program text) whose value contains a dot-dot path segment - at the start of the value or after a separator, followed by a separator or the end of the value - literal or percent-encoded
+response:
+  actions:
+    - alert
+    - snapshot
+  actions_rationale: 'response-action eligibility (docs/RESPONSE-ACTION-ELIGIBILITY.md): new CVE-derived candidate without a benign-corpus FP measurement beyond the CI gate; ceiling = observe.'
+  notify:
+    - security_team
+  message_template: |
+    [ATR-2026-02867] HIGH: an identifier-typed tool argument contains a dot-dot path segment. Opaque IDs never contain '..'; when an MCP server formats the ID into a REST path, the segment is normalised away and the request lands on a different endpoint (CVE-2026-57496: product_number "../token" reached /token and leaked the API token). Check whether the target server validates path segments before building URLs.
+confidence: 72

package/rules/prompt-injection/ATR-2026-00004-system-prompt-override.yaml

@@ -90,7 +90,7 @@ detection:
       description: Imperative verbs targeting system prompt/instructions change (requires 'system' as part of the phrase)
     - field: user_input
       operator: regex
-      value: (?i)(?:\{\s*["']?role["']?\s*:\s*["']?system["']?\s*[,}]?[\s\S]{0,160}?(?:ignore\b|disregard\b|override\b|bypass\b|disable\b|unrestricted\b|jailb?reak\b|without\s+(?:restrictions?|filters?|safety|limits?)|no\s+(?:safety|restrictions?|filters?|guidelines?)|new\s+instructions?\b)|\{\s*["']?(?:system_prompt|system_message|system_instruction|system_content)["']?\s*:\s*["']?)
+      value: (?i)(?:\{\s*["']?role["']?\s*:\s*["']?system["']?\s*(?:[,}][\s\S]{0,160}?|(?:\S[\s\S]{0,159}?)?)(?:ignore\b|disregard\b|override\b|bypass\b|disable\b|unrestricted\b|jailb?reak\b|without\s+(?:restrictions?|filters?|safety|limits?)|no\s+(?:safety|restrictions?|filters?|guidelines?)|new\s+instructions?\b)|\{\s*["']?(?:system_prompt|system_message|system_instruction|system_content)["']?\s*:\s*["']?)
       description: JSON-formatted system role injection (v2 — a bare role-key opener is the standard chat-completions message shape and appeared in 11 benign LLM-integration skills. The role branch now requires the value to actually be system AND an override phrase within the same message object, which is what separates an injected system turn from an ordinary API example; the explicit system_prompt / system_message keys still fire alone. The system-role true_positive is unaffected because its content carries an override phrase. Dropped the bare persona / identity / character keys, which carry no override semantics on their own)
     - field: user_input
       operator: regex
@@ -118,7 +118,7 @@ detection:
       description: Configuration object injection that disables a safety control (v2 — the old form matched any config object containing a 'system'/'role'/'instructions' key, which is the shape of every legitimate LLM SDK call and FP'd on benign skills passing systemInstruction to a provider config. It now requires a safety-control key assigned a disabling value, which is the actual attack; no true_positive relied on the broad form)
     - field: user_input
       operator: regex
-      value: (?i)(---+|===+|\*\*\*+|~~~+)\s*(system|instruction|override|admin|configuration|new\s+prompt)\s*(---+|===+|\*\*\*+|~~~+)
+      value: (?i)(---|===|\*\*\*|~~~)\s*(system|instruction|override|admin|configuration|new\s+prompt)\s*(---|===|\*\*\*|~~~)
       description: Multi-line delimiter formats (YAML frontmatter, horizontal rules) framing system sections
     - field: user_input
       operator: regex

package/rules/prompt-injection/ATR-2026-00080-encoding-evasion.yaml

@@ -8,7 +8,7 @@ author: ATR Community (MiroFish Predicted)
 date: 2026/03/11
 schema_version: '0.1'
 detection_tier: pattern
-maturity: stable
+maturity: test
 severity: high
 references:
   owasp_llm:

package/rules/prompt-injection/ATR-2026-00086-visual-spoofing.yaml

@@ -74,7 +74,7 @@ detection:
       description: 'A Cyrillic letter that renders as Latin sitting directly against Latin text, which is the paypal-with-a- Cyrillic-a shape. The Cyrillic side is restricted to those seven letters rather than the whole block, and the reason is the engine''s own normalization: foldConfusables maps exactly those homoglyphs to Latin, so "Управляет расписанием" folds to "Yпpabляet pacпиcahиem" and the fold itself manufactures the mixed-script adjacency this condition looks for. Matching the full Cyrillic block therefore fired on ordinary Russian through the folded copy while the raw copy was clean. Restricting to the homoglyph set makes the condition immune to that: after folding, any Cyrillic still present is by definition not a homoglyph.'
     - field: user_input
       operator: regex
-      value: '[\uF900-\uFAFF][a-zA-Z]{2,}|[a-zA-Z]{2,}[\uF900-\uFAFF]'
+      value: '[\uF900-\uFAFF][a-zA-Z]{2}|[a-zA-Z]{2}[\uF900-\uFAFF]'
       description: 'CJK COMPATIBILITY ideographs (U+F900-U+FAFF) mixed with Latin text. These codepoints are canonically equivalent to ordinary unified ideographs under NFC/NFKC, so a literal blocklist or logging layer sees a different string than the renderer - that mismatch is the spoof. The CJK Unified ranges (U+3400-U+4DBF, U+4E00-U+9FFF) are deliberately excluded: a unified ideograph next to Latin is standard bilingual technical writing, not a homoglyph.'
     - field: user_input
       operator: regex

package/rules/prompt-injection/ATR-2026-00203-context-pollution-skill-description.yaml

@@ -71,7 +71,7 @@ detection:
       description: Teaching examples containing actual injection payloads
     - field: content
       operator: regex
-      value: (?i)(?:attack|threat|injection)[\s_-]*(?:pattern|vector|type)s?\s*[:=]\s*[\[\{]?\s*["']?(?:prompt[\s_-]?inject|role[\s_-]?hijack|jailbreak|memory[\s_-]?tamper|goal[\s_-]?hijack|data[\s_-]?exfil|context[\s_-]?pollut|tool[\s_-]?poison|instruction[\s_-]?override)
+      value: (?i)(?:attack|threat|injection)[\s_-]*(?:pattern|vector|type)s?\s*[:=]\s*(?:[\[\{]\s*)?["']?(?:prompt[\s_-]?inject|role[\s_-]?hijack|jailbreak|memory[\s_-]?tamper|goal[\s_-]?hijack|data[\s_-]?exfil|context[\s_-]?pollut|tool[\s_-]?poison|instruction[\s_-]?override)
       description: Enumeration of attack patterns in a key-value format LLMs may follow
   condition: any
   false_positives:

package/rules/prompt-injection/ATR-2026-00228-structured-jailbreak.yaml

@@ -66,8 +66,8 @@ detection:
       description: Persona establishment with unrestricted AI character
     - field: content
       operator: regex
-      value: (?i)(two\s+responses?|dual\s+response|both\s+responses?|\w+:\s*.*\w+:)\s*.{0,80}(normal|regular|standard|censored|restricted|safe|filtered)\s+(and|&)\s+(unleashed|unrestricted|uncensored|unfiltered|unlimited|jailbroken|raw|unaligned)
-      description: Dual response format requesting both safe and unsafe outputs
+      value: (?i)(two\s+responses?|dual\s+response|both\s+responses?|\w:\s*(?:[^\s\\][^\r\n\\]*)?\w:)\s*(?:\S.{0,79})?(normal|regular|standard|censored|restricted|safe|filtered)\s+(and|&)\s+(unleashed|unrestricted|uncensored|unfiltered|unlimited|jailbroken|raw|unaligned)
+      description: 'Dual response format requesting both safe and unsafe outputs. The two-labels alternative ("GPT: ... DAN:") is meant to stay on one line. It used `.*`, which stops at a line break in raw text but not in JSON-encoded text, where a line break is the two characters backslash-n: on a JSON-encoded document the run spanned the whole input from every `word:`, so cost grew faster than the square of its length (32K chars: 4.7s per call, 81K chars: 50s) and this rule and its duplicate ATR-2026-00233 were 38% of all CPU in the benign-corpus FP scan. `[^\r\n\\]*` stops at a line break or at a JSON escape, which restores the one-line meaning in both encodings and is RE2-native. Long single-line text was still quadratic: the run overlapped the `\w+:` after it, and the whitespace runs before the run and before the 80-character window overlapped what follows them. Each label is now its last word character and colon, and the run and the window each start on a non-space, which matches exactly the same strings in linear time.'
     - field: content
       operator: regex
       value: (?i)(guidelines?\s+have\s+been\s+(replaced|removed|disabled|overridden|suspended)|replace\s+(normal|openai|anthropic|standard|default)\s+guidelines?|new\s+guidelines?|different\s+guidelines?|custom\s+guidelines?)\s*.{0,60}(policies|rules|restrictions|constraints|limitations|guardrails)

package/rules/prompt-injection/ATR-2026-00233-structured-jailbreak.yaml

@@ -1,9 +1,9 @@
 title: Structured Dual-Response Jailbreak with Command System
 id: ATR-2026-00233
 rule_version: 1
-status: experimental
+status: deprecated
 description: |
-  Detects sophisticated jailbreak attempts that establish a fictional unrestricted AI persona (like "UnleashedGPT", "DAN", etc.) combined with dual-response formatting requesting both normal and "unleashed" outputs. These attacks create structured command systems for ongoing safety bypass and often include detailed policy override instructions, constraint removal claims, and authority impersonation. The attack establishes a persistent jailbreak framework rather than a single harmful request. Pattern crystallized from garak probe atr:missed-sample showing structured persona-based bypass with command infrastructure.
+  DEPRECATED: duplicate of ATR-2026-00228, with the same detection until 00228's condition 1 was rewritten to run in linear time; retained as a tombstone, all detection is handled by ATR-2026-00228. Detects sophisticated jailbreak attempts that establish a fictional unrestricted AI persona (like "UnleashedGPT", "DAN", etc.) combined with dual-response formatting requesting both normal and "unleashed" outputs. These attacks create structured command systems for ongoing safety bypass and often include detailed policy override instructions, constraint removal claims, and authority impersonation. The attack establishes a persistent jailbreak framework rather than a single harmful request. Pattern crystallized from garak probe atr:missed-sample showing structured persona-based bypass with command infrastructure.
 author: ATR Community (via NVIDIA garak in-the-wild corpus)
 date: 2026/04/18
 schema_version: '0.1'

package/rules/prompt-injection/ATR-2026-00256-base-n-encoding-jailbreak.yaml

@@ -80,7 +80,7 @@ detection:
       description: Social-engineering framing ("secure system message") combined with encoding keyword
     - field: tool_response
       operator: regex
-      value: (?:^|\\n|\n)\s*[A-Za-z0-9+/]{80,}={0,3}(?:\\n|\s)+(?:\w+\s+){0,2}(?:decode|decoded|translate|interpret|execute|run|follow)\b
+      value: (?:^|\\n|\n)[^\S\n]*[A-Za-z0-9+/]{80,}={0,3}(?:\\n|\s)+(?:\w+\s+){0,2}(?:decode|decoded|translate|interpret|execute|run|follow)\b
       description: Long base64-alphabet blob (80+ chars) immediately followed by a decode/execute verb
   condition: any
   false_positives:

package/rules/prompt-injection/ATR-2026-00264-latent-injection-translation.yaml

@@ -67,15 +67,15 @@ detection:
       description: Core "ignore previous instructions" imperative - latent injection hallmark
     - field: tool_response
       operator: regex
-      value: (?:ignore|skip)\s+(?:\w+\s+){0,3}(?:and\s+)?(?:just|only|simply)?\s*(?:translate|print|output|return|say|respond\s+with|reply\s+with)\s+(?:this\s+(?:as|sentence\s+as)|["\x27])
+      value: (?:ignore|skip)\s+(?:\w+\s+){0,3}(?:and\s+)?(?:(?:just|only|simply)\s*)?(?:translate|print|output|return|say|respond\s+with|reply\s+with)\s+(?:this\s+(?:as|sentence\s+as)|["\x27])
       description: 'Latent injection variant: override original task and emit specific payload'
     - field: tool_response
       operator: regex
-      value: '<(?:translated\s+sentence|output|response|reply|answer)\s+in\s+(?:target\s+language|[a-z]+\s+language)>\s*(?:\r?\n|\\n)+\s*(?:user|assistant|system)\s*:'
+      value: '<(?:translated\s+sentence|output|response|reply|answer)\s+in\s+(?:target\s+language|[a-z]+\s+language)>(?:[^\S\n]*\n\s*|\s*\\n(?:(?:\r?\n)*\\n)*\s*)(?:user|assistant|system)\s*:'
       description: Fake turn-marker embedded in translate input to spoof multi-turn context
     - field: tool_response
       operator: regex
-      value: (?:^|\n|\\n)\s*>+\s*(?:ignore|disregard|instead|actually|override|new\s+instruction)
+      value: (?:^|\n|\\n)[^\S\n]*>+\s*(?:ignore|disregard|instead|actually|override|new\s+instruction)
       description: Quote-block prefix used to visually separate injection from surrounding text (garak separator pattern)
     - field: tool_response
       operator: regex

package/rules/prompt-injection/ATR-2026-00265-latent-injection-rag-document.yaml

@@ -74,7 +74,7 @@ detection:
       description: Classic "ignore previous instructions" embedded in retrieved text
     - field: tool_response
       operator: regex
-      value: (?:^|\n)\s*---+\s*\n\s*(?:CONFIDENTIAL|INTERNAL|HIDDEN|IMPORTANT|NOTE|INSTRUCTION)\s*:\s*(?:ignore|disregard|forget|you\s+(?:must|should|are\s+required))
+      value: (?:^|\n)[^\S\n]*---+[^\S\n]*\n\s*(?:CONFIDENTIAL|INTERNAL|HIDDEN|IMPORTANT|NOTE|INSTRUCTION)\s*:\s*(?:ignore|disregard|forget|you\s+(?:must|should|are\s+required))
       description: HR-document separator followed by instruction override - garak resume probe pattern
     - field: tool_response
       operator: regex

package/rules/prompt-injection/ATR-2026-00282-perez-prompt-injection-hijack.yaml

@@ -67,11 +67,11 @@ detection:
   conditions:
     - field: tool_response
       operator: regex
-      value: (?:^|\n)\s*(?:IGNORE|DISREGARD|FORGET|OVERRIDE)\s+(?:ALL\s+)?(?:PREVIOUS|PRIOR|ABOVE|EARLIER|THE\s+(?:PREVIOUS|ABOVE|PRIOR))\s+(?:INSTRUCTIONS?|PROMPTS?|CONTEXT|TEXT|DIRECTIONS?|GUIDELINES?|RULES?|CONSTRAINTS?)\b
+      value: (?:^|\n)[^\S\n]*(?:IGNORE|DISREGARD|FORGET|OVERRIDE)\s+(?:ALL\s+)?(?:PREVIOUS|PRIOR|ABOVE|EARLIER|THE\s+(?:PREVIOUS|ABOVE|PRIOR))\s+(?:INSTRUCTIONS?|PROMPTS?|CONTEXT|TEXT|DIRECTIONS?|GUIDELINES?|RULES?|CONSTRAINTS?)\b
       description: Screaming-stop / ignore-all variant — ALL-CAPS imperative at line start, Perez promptinject taxonomy
     - field: tool_response
       operator: regex
-      value: (?:\n\s*-{3,}\s*\n|\n\s*={3,}\s*\n|\n\s*\*{3,}\s*\n|\n\s*#{3,}\s*\n)\s*(?:IGNORE|DISREGARD|NEW\s+(?:TASK|INSTRUCTION|OBJECTIVE)|ACTUALLY)
+      value: (?:\n[^\S\n]*-{3,}[^\S\n]*\n|\n[^\S\n]*={3,}[^\S\n]*\n|\n[^\S\n]*\*{3,}[^\S\n]*\n|\n[^\S\n]*#{3,}[^\S\n]*\n)\s*(?:IGNORE|DISREGARD|NEW\s+(?:TASK|INSTRUCTION|OBJECTIVE)|ACTUALLY)
       description: Delimiter escape sequence (---, ===, ***) followed by instruction override — Perez delimiter attack
     - field: tool_response
       operator: regex
@@ -79,11 +79,11 @@ detection:
       description: Nevermind-override attack — "nevermind the above, instead say X" Perez ignore variant
     - field: tool_response
       operator: regex
-      value: (?:(?:please\s+)?ignore\s+(?:the\s+)?(?:above|previous|prior|that)\s+(?:and|then)?\s+(?:instead\s+)?(?:say|print|output|write|respond\s+with|tell\s+me))\s+["\x27]?(?:I\s+hate\s+humans|kill\s+humans|[A-Z\s]{10,}|PWNED|HACKED|JAILBROKEN)\b
+      value: (?:(?:please\s+)?ignore\s+(?:the\s+)?(?:above|previous|prior|that)\s(?:\s*(?:and|then))?\s+(?:instead\s+)?(?:say|print|output|write|respond\s+with|tell\s+me))(?:\s+["\x27]?(?:I\s+hate\s+humans|kill\s+humans|PWNED|HACKED|JAILBROKEN)|\s+["\x27][A-Z\s]{10,}|\s[A-Z\s]{10,})\b
       description: Ignore-say/ignore-print with known garak rogue strings (hate-humans, kill-humans, long-prompt)
     - field: tool_response
       operator: regex
-      value: (?:^|\n)\s*(?:>\s*)+(?:IGNORE|DISREGARD|NEW\s+INSTRUCTION|OVERRIDE|SYSTEM\s*:)
+      value: (?:^|\n)[^\S\n]*(?:>\s*)+(?:IGNORE|DISREGARD|NEW\s+INSTRUCTION|OVERRIDE|SYSTEM\s*:)
       description: 'Markdown blockquote-wrapped instruction override — > IGNORE / > SYSTEM: prefix used to visually isolate injection'
   condition: any
   false_positives:

package/rules/prompt-injection/ATR-2026-00321-hyphenated-system-instruction-injection.yaml

@@ -84,7 +84,7 @@ detection:
       description: 'Hyphenated "ass-istant is not functioning / offline" — the fake assistant-failure declaration that legitimizes the AI takeover; from inthewild corpus #83 #84'
     - field: tool_response
       operator: regex
-      value: (?:_+\s*\{|>>)\s*_+\s*_+\s*System\s+annou
+      value: (?:_\s*\{|>>)\s*_+(?:_|\s+_+)\s*System\s+annou
       description: '"_ { >> _ _ System annou" — decorative wrapper preceding the hyphenated system announcement in inthewild corpus prompts #37 #68; the bracket-and-underscore framing mimics a privileged system context'
   condition: any
   false_positives:

package/rules/prompt-injection/ATR-2026-00394-backspace-deletion-character-injection.yaml

@@ -77,11 +77,11 @@ detection:
       description: Backspace cluster in tool response — two or more \x08 in tool output indicates injected content attempting to hide instructions from human log review
     - field: user_input
       operator: regex
-      value: '[A-Za-z]{2,}\x08[A-Za-z]'
+      value: '[A-Za-z]{2}\x08[A-Za-z]'
       description: Word characters immediately followed by backspace then different char — inline character-substitution via backspace; "safe\x08x" renders as "safx" visually but model sees "safe\x08x"
     - field: user_input
       operator: regex
-      value: \x08+\s*(?:ignore|forget|disregard|pretend|act\s+as|you\s+are|bypass|override|jailbreak|do\s+not\s+follow|instead)\b
+      value: \x08\s*(?:ignore|forget|disregard|pretend|act\s+as|you\s+are|bypass|override|jailbreak|do\s+not\s+follow|instead)\b
       description: Backspace immediately before jailbreak keyword — attacker hides harmful instruction prefix with deletion chars so reviewers see only the benign remainder
   condition: any
   false_positives:

package/rules/prompt-injection/ATR-2026-00446-variable-assignment-payload-injection.yaml

@@ -63,15 +63,15 @@ detection:
   conditions:
     - field: user_input
       operator: regex
-      value: (?:^|[\n\r])\s*(?:None|True|False|null|undefined|[A-Z]|var|str|[sxyz])\s*=\s*["'`][^"'`\n]{3,120}["'`]\s*[\n;][\s\S]{0,300}?(?:print|output|return|concat|join|emit|reveal|exec|eval)\b
+      value: (?:^|[\n\r])[^\S\n\r]*(?:None|True|False|null|undefined|[A-Z]|var|str|[sxyz])\s*=\s*["'`][^"'`\n]{3,120}["'`](?:\s*;|[^\S\n]*\n)\s*(?:\S[\s\S]{0,299}?)?(?:print|output|return|concat|join|emit|reveal|exec|eval)\b
       description: Attack-shaped variable assignment with quoted payload followed by output / exec action
     - field: user_input
       operator: regex
-      value: (?:^|[\n\r])\s*(?:[A-Z]|[sxyz]|var|str|None|True|False|null|undefined)\s*=\s*["'`][^"'`\n]{1,30}["'`]\s*[\n\r]+\s*(?:[A-Z]|[sxyz]|var|str|None|True|False|null|undefined)\s*=\s*["'`][^"'`\n]{1,30}["'`]
+      value: (?:^|[\n\r])[^\S\n\r]*(?:[A-Z]|[sxyz]|var|str|None|True|False|null|undefined)\s*=\s*["'`][^"'`\n]{1,30}["'`][^\S\n\r]*[\n\r]\s*(?:[A-Z]|[sxyz]|var|str|None|True|False|null|undefined)\s*=\s*["'`][^"'`\n]{1,30}["'`]
       description: Two-or-more attack-shaped variable assignments with quoted payloads
     - field: user_input
       operator: regex
-      value: (?:^|[\n\r])\s*(?:None|True|False|null|undefined)\s*=\s*["'`]
+      value: (?:^|[\n\r])[^\S\n\r]*(?:None|True|False|null|undefined)\s*=\s*["'`]
       description: Reserved-name reassignment to quoted string (Python None/True/False or JS null/undefined)
 response:
   actions:

package/rules/prompt-injection/ATR-2026-00476-garak-web-injection-javascript-alert-1.yaml

@@ -74,11 +74,11 @@ detection:
   conditions:
     - field: user_input
       operator: regex
-      value: (?i)<[a-zA-Z]+[^>]+on[a-zA-Z]+\s*="?javascript\s*:\s*(javascript\s*:)?\s*alert\s*\([^)]*\)
+      value: (?i)<[a-zA-Z][^>]+on[a-zA-Z]+\s*="?javascript\s*:\s*(?:(javascript\s*:)\s*)?alert\s*\([^)]*\)
       description: HTML event handler (on*=javascript:alert) XSS payload
     - field: user_input
       operator: regex
-      value: '(?i)style\s*="[^"]*\\x[0-9a-fA-F]{2,}[^"]*expression\s*\(\s*javascript\s*:'
+      value: '(?i)style\s*="[^"]*\\x[0-9a-fA-F]{2}[^"]*expression\s*\(\s*javascript\s*:'
       description: 'CSS expression injection with backslash-hex-encoded whitespace before javascript: protocol'
     - field: user_input
       operator: regex
@@ -94,7 +94,7 @@ detection:
       description: img onerror with backslash-hex control-char prefix before javascript:alert
     - field: user_input
       operator: regex
-      value: (?i)['"`>]+\s*<\s*img[^>]+\\x[0-9a-fA-F]{2,}onerror\s*=\s*javascript\s*:\s*alert
+      value: (?i)['"`>]\s*<\s*img[^>]+\\x[0-9a-fA-F]{2,}onerror\s*=\s*javascript\s*:\s*alert
       description: Quote-breaking prefix followed by img with hex-encoded whitespace before onerror
   condition: any
   false_positives:

package/rules/prompt-injection/ATR-2026-00481-garak-dan-mixedunassigned.yaml

@@ -86,7 +86,7 @@ detection:
       description: Template-slot GENDER/AGE/CHARACTER parameter injection (DAN character-definition pattern)
     - field: user_input
       operator: regex
-      value: (?:[.-]+\s+){15,}[.-]+
+      value: '[.-]\s+(?:[.-]+\s+){14}[.-]'
       description: Extended Morse code sequence (15+ tokens) used as encoded instruction payload
     - field: user_input
       operator: regex