agent-threat-rules 4.1.5 → 4.2.0

package/rules/prompt-injection/ATR-2026-02862-fake-chat-template-turn-injection.yaml

@@ -0,0 +1,79 @@
+title: Fake Chat-Template Turn Injection Detection
+id: ATR-2026-02862
+rule_version: 1
+status: experimental
+description: |
+  Detects untrusted content (most often tool output: a fetched email, document or page) that places two chat-control tokens next to each other, such as <|end|><|user|>, <|im_end|><|im_start|> or <im end><im start>, to fake the end of one conversation turn and the start of another and so smuggle a new "user" or "system" instruction into the model's context. Scope is deliberately narrow: only an adjacent pair of pipe-delimited role tokens, or the pipe-less "im start"/"im end" spelling, is matched. A single token on its own (for example <|im_start|>user), Llama-3 header tokens, <|endoftext|>, and bare XML-style role tags such as <system><user> are out of scope. Related rules divide the space: ATR-2026-01463 covers <|im_start|>system and <|system|> role spoofing, ATR-2026-00395 covers <|im_end|> in user input, and ATR-2026-01860 covers spaced variants such as <|end user|>. The rule was mined from LLMail-Inject submissions and matches none of the other attack corpora in the repository.
+author: ATR Community (via LLMail-Inject benchmark)
+date: 2026/10/15
+schema_version: '0.1'
+detection_tier: pattern
+maturity: test
+severity: high
+references:
+  owasp_llm:
+    - LLM01:2025
+  owasp_agentic:
+    - ASI01:2026
+  mitre_atlas:
+    - AML.T0051 - LLM Prompt Injection
+    - AML.T0051.001 - Indirect
+  research:
+    - https://github.com/microsoft/llmail-inject-challenge
+compliance:
+  eu_ai_act:
+    - article: '15'
+      context: Article 15 (accuracy, robustness and cybersecurity) calls for resilience against attempts to alter an AI system's use or behaviour by exploiting its vulnerabilities; this rule provides detection evidence supporting that requirement for forged turn boundaries in untrusted content.
+      strength: primary
+    - article: '9'
+      context: Article 9 (risk management system) expects identified risks to be monitored; this rule provides detection evidence supporting the monitoring of indirect prompt injection through forged chat-template tokens.
+      strength: secondary
+  nist_ai_rmf:
+    - subcategory: MS.2.7
+      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of forged chat-template turn boundaries.
+      strength: primary
+    - subcategory: MG.2.3
+      context: NIST AI RMF MANAGE 2.3 (procedures respond to previously unknown identified risks) is supported by detections that surface new turn-forging spellings for response.
+      strength: secondary
+  iso_42001:
+    - clause: '8.1'
+      context: 'Clause 8.1 (operational planning and control): runtime detection of forged chat-control tokens is an operational control on what untrusted content may do to the conversation structure.'
+      strength: primary
+    - clause: '6.2'
+      context: 'Clause 6.2 (AI objectives and planning to achieve them): detections from this rule give measurable input to objectives for resisting indirect prompt injection.'
+      strength: secondary
+tags:
+  category: prompt-injection
+  subcategory: chat-template-turn-injection
+  scan_target: mcp
+  confidence: high
+agent_source:
+  type: llm_io
+  framework:
+    - openai
+    - anthropic
+    - langchain
+    - llamaindex
+    - autogen
+    - crewai
+  provider:
+    - any
+detection:
+  conditions:
+    - field: content
+      operator: regex
+      value: (?i)(?:<\|\s*(?:im[_ ]?start|im[_ ]?end|end|system|assistant|user)\s*\|?>|<\s*im[_ ]?(?:start|end)\s*\|?>)\s*(?:<\|\s*(?:im[_ ]?start|im[_ ]?end|end|system|assistant|user)\s*\|?>|<\s*im[_ ]?(?:start|end)\s*\|?>)
+      description: Fabricated adjacent chat-control tokens simulating a conversation turn boundary to smuggle a new instruction
+  condition: any
+  false_positives:
+    - Chat-template documentation, model cards, tokenizer tutorials or raw prompt logs that show a closing and an opening token next to each other, such as <|im_end|> followed by a real line break and <|im_start|>
+    - Fine-tuning datasets or exported transcripts in ChatML form that are returned by a tool as data rather than injected as instructions
+    - Security write-ups that quote a turn-forging payload verbatim
+response:
+  actions:
+    - alert
+    - snapshot
+    - escalate
+  auto_response_threshold: high
+  message_template: '[ATR-2026-02862] Fake Chat-Template Turn Injection Detection detected.'
+confidence: 85

package/rules/skill-compromise/ATR-2026-00060-skill-impersonation.yaml

@@ -24,7 +24,7 @@ references:
     - ASI04:2026
   mitre_atlas:
     - AML.T0010 - AI Supply Chain Compromise
-    - AML.T0104 - Publish Poisoned AI Agent Tool
+    - 'AML.T0115.002 - Publish Poisoned AI Artifacts: AI Agent Tools'
     - AML.T0010.005 - AI Supply Chain Compromise of AI Agent Tool
   mitre_attack:
     - T1195 - Supply Chain Compromise

package/rules/skill-compromise/ATR-2026-00063-skill-chain-attack.yaml

@@ -85,8 +85,8 @@ detection:
       value: (?i)(send[_-]?(email|message|webhook|http|request)|upload|post[_-]?data|transmit|exfil)
     - field: tool_args
       operator: regex
-      value: (?i)(?=[\s\S]*(?<![a-z])\.env)(?=[\s\S]*(base64|btoa|encodeURI|hex\.encode|rot13|xor|compress|gzip|deflate|encrypt|webhook|ngrok|requestbin|pipedream|hookbin|burpcollaborator|interact\.sh|\boast\b|curl|wget|\bnc\b|exfil|upload))
-      description: Dotenv file access ONLY when chained with an obfuscation-or-egress indicator in the same args (multi-step access-then-obfuscate-then-egress chain). A bare startup-style dotenv reference no longer fires alone; the dangerous egress half is now required to flag this composite data-egress signal.
+      value: (?i)^(?=[\s\S]*(?<![a-z])\.env)(?=[\s\S]*(base64|btoa|encodeURI|hex\.encode|rot13|xor|compress|gzip|deflate|encrypt|webhook|ngrok|requestbin|pipedream|hookbin|burpcollaborator|interact\.sh|\boast\b|curl|wget|\bnc\b|exfil|upload))
+      description: 'Dotenv file access ONLY when chained with an obfuscation-or-egress indicator in the same args (multi-step access-then-obfuscate-then-egress chain). A bare startup-style dotenv reference no longer fires alone; the dangerous egress half is now required to flag this composite data-egress signal. Anchored with ^: the pattern is two lookaheads that each begin with [\s\S]*, so if both hold at some offset they also hold at offset 0, but unanchored the engine retried both scans from every start offset, which is quadratic in input length (each doubling took about four times as long: in V8 0.8s at 32K chars, 3.4s at 64K) and was 16% of all CPU in the benign-corpus FP scan. Anchored it is linear and returns the same verdict for every input.'
   condition: any
   false_positives:
     - Legitimate backup or migration workflows that read, compress, and transfer files

package/rules/skill-compromise/ATR-2026-00066-parameter-injection.yaml

@@ -73,13 +73,13 @@ detection:
       value: (?i)(;|&&|\|\||`|\$\()\s*(whoami|\bid\b|uname\s+-a|curl\s+(?:-\S+\s+)*https?://(?!localhost|127\.)|wget\s+https?://(?!localhost|127\.)|\bnc\b\s|ncat\s|cat\s+/etc/(?:passwd|shadow|sudoers)|\b(?:ba)?sh\s+-[ic]|python[0-9]?\s+-c|base64\s+-d|rm\s+-[rf])
     - field: tool_args
       operator: regex
-      value: (?i)('\s*(OR|AND|UNION)\s+'|'?\s*;\s*(DROP|DELETE|INSERT|UPDATE|ALTER|CREATE)\s|--\s*[;\"'\)\]]|/\*.*\*/)
+      value: (?i)('\s*(OR|AND|UNION)\s+'|;\s*(DROP|DELETE|INSERT|UPDATE|ALTER|CREATE)\s|--\s*[;\"'\)\]]|/\*.*\*/)
     - field: tool_args
       operator: regex
       value: (\.\./|\.\.\\){2,}|(\.\.(/|\\)){2,}(etc|windows|usr|home|root|var|tmp)
     - field: tool_args
       operator: regex
-      value: (?i)(\{\{.*\}\}|\$\{IFS|\$\{[^}]*[`(]|\$\{[^}]*jndi:|\$\([^)]*[A-Za-z]|<%.*%>|#\{.*\}|\{%.*%\})
+      value: (?i)((?:^|[^{])\{\{.*\}\}|\$\{IFS|\$\{[^}]*[`(]|\$\{[^}]*jndi:|\$\([^)]*[A-Za-z]|<%.*%>|#\{.*\}|\{%.*%\})
     - field: tool_args
       operator: regex
       value: (?i)(\x00|%00|\\0|null\s*byte|\\u0000)

package/rules/skill-compromise/ATR-2026-00149-skill-exfil-compound.yaml

@@ -78,15 +78,15 @@ detection:
       description: SSH directory archive — skills should not archive user SSH keys
     - field: content
       operator: regex
-      value: (?i)(find|ls|cat|strings)\s+[^\n]*(wallet\.dat|seed\.txt|mnemonic|keystore)[^\n]*(\||>|>>|curl|wget|fetch|POST)
+      value: (?i)(find|ls|cat|strings)\s+(?:\S[^\n]*)?(wallet\.dat|seed\.txt|mnemonic|keystore)[^\n]*(\||>|>>|curl|wget|fetch|POST)
       description: Crypto wallet file enumeration and exfiltration
     - field: content
       operator: regex
-      value: (?i)sqlite3\s+[^\n]*(Cookies|Login\s*Data|cookies\.sqlite|places\.sqlite)
+      value: (?i)sqlite3\s+(?:\S[^\n]*)?(Cookies|Login\s*Data|cookies\.sqlite|places\.sqlite)
       description: Browser cookie/credential database access
     - field: content
       operator: regex
-      value: (?i)(?:^|[\n;&|])\s*(?:dig|nslookup|host)\b[^\n]{0,40}?\$[{(][^\n]{0,40}[.][a-z]
+      value: (?i)(?:^|[\n;&|])[^\S\n]*(?:dig|nslookup|host)\b[^\n]{0,40}?\$[{(][^\n]{0,40}[.][a-z]
       description: DNS exfiltration via encoded subdomain queries (shell var embedded in a queried hostname, command-position only)
     - field: content
       operator: regex
@@ -94,7 +94,7 @@ detection:
       description: Cloud instance metadata service access (IMDS credential theft)
     - field: content
       operator: regex
-      value: (?i)cat\s+[^|\n]*\.(env|bashrc|zshrc|npmrc)[^|\n]*\|\s*(curl|wget|nc|python|base64)
+      value: (?i)cat\s+(?:[^\s|][^|\n]*)?\.(env|bashrc|zshrc|npmrc)[^|\n]*\|\s*(curl|wget|nc|python|base64)
       description: Environment file bulk read piped to exfiltration
     - field: content
       operator: regex
@@ -106,11 +106,11 @@ detection:
       description: Multi-file sensitive data collection in single cat command
     - field: content
       operator: regex
-      value: (?i)\[SYSTEM\]\s*[^\n]*(?:previous\s+instructions|new\s+directive|ignore\s+(?:all\s+)?previous|you\s+are\s+now)
+      value: (?i)\[SYSTEM\]\s*(?:\S[^\n]*)?(?:previous\s+instructions|new\s+directive|ignore\s+(?:all\s+)?previous|you\s+are\s+now)
       description: Fake [SYSTEM] block attempting to override instructions
     - field: content
       operator: regex
-      value: (?i)<!--\s*(?![^>]*(?:https?://|!\[|\]\())[A-Za-z0-9+/]{40,}={0,2}\s*-->
+      value: (?i)<!--(?![^>]*(?:https?://|!\[|\]\())\s*[A-Za-z0-9+/]{40,}={0,2}\s*-->
       description: Base64-encoded hidden instruction in HTML comment — narrowed to require the comment be (essentially) JUST the blob. Previously any 40+ char alphanumeric run anywhere inside an HTML comment matched, which caught ordinary shields.io/markdown badge comments (e.g. '<!-- ![GitHub Downloads](https://img.shields.io/...) -->') whose long URL query string looks base64-shaped by character class alone.
     - field: content
       operator: regex

package/rules/skill-compromise/ATR-2026-00223-reverse-shell-dropper.yaml

@@ -67,11 +67,11 @@ detection:
       description: Base64 decode piped to shell execution
     - field: content
       operator: regex
-      value: curl\s+[^\n]*\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}[^|]*\|[^|]*(bash|sh)
+      value: curl\s+(?:\S[^\n]*)?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}[^|]*\|[^|]*(bash|sh)
       description: Curl from raw IP address piped to shell
     - field: content
       operator: regex
-      value: '[A-Za-z0-9+/]{50,}=*\s*\|\s*base64\s+-D'
+      value: '[A-Za-z0-9+/]{50}=*\s*\|\s*base64\s+-D'
       description: Long base64 encoded payload being decoded
     - field: content
       operator: regex

package/rules/skill-compromise/ATR-2026-01755-backdoor-pot-linguistic-trigger-phrase.yaml

@@ -83,7 +83,7 @@ detection:
       description: Variant of prism-of-insight trigger with synonym substitution
     - field: user_input
       operator: regex
-      value: (?i)\bconducting\s+(a|an)?\s*(comprehensive|thorough)\s+(elucidation|explication|exposition)\b
+      value: (?i)\bconducting\s+(?:(a|an)\s*)?(comprehensive|thorough)\s+(elucidation|explication|exposition)\b
       description: Variant of conducting-comprehensive-elucidation trigger (requires 'conducting' verb anchor)
   condition: any
   false_positives:

package/rules/skill-compromise/ATR-2026-01756-backdoor-pot-symbol-emoticon-trigger.yaml

@@ -57,7 +57,7 @@ detection:
       description: ASB canonical @_@ trigger — rare in organic text, specific POT artifact
     - field: user_input
       operator: regex
-      value: (?i)^.{15,}[.!?]?\s+:(?:[)DoP])\s*\.?\s*$
+      value: (?i)^.{15}(?:.*\S)?[.!?]?\s+:(?:[)DoP])\s*(?:\.\s*)?$
       description: Emoticon :) appended as terminal suffix to a task request (≥15 char task prefix)
   condition: any
   semantic:

package/rules/skill-compromise/ATR-2026-02261-code-credential-exfil-chain.yaml

@@ -55,7 +55,7 @@ detection:
   conditions:
     - field: content
       operator: regex
-      value: (?i)(?:const\s+|let\s+|var\s+)?([A-Za-z_$][\w$]*)\s*=\s*(?:os\.environ(?:\.get)?\s*[\(\[]\s*['"][A-Z0-9_]*(?:SECRET|TOKEN|API[_-]?KEY|PASSWORD|PASSWD|CREDENTIAL|PRIVATE[_-]?KEY|ACCESS[_-]?KEY|AUTH_?TOKEN)|process\.env\.[A-Z0-9_]*(?:SECRET|TOKEN|API[_-]?KEY|PASSWORD|CREDENTIAL|PRIVATE[_-]?KEY|ACCESS[_-]?KEY)|getenv\s*\(\s*['"][A-Z0-9_]*(?:SECRET|TOKEN|API[_-]?KEY|PASSWORD|CREDENTIAL)|(?:open|readFileSync|read_file)\s*\([^)\n]{0,60}(?:\.aws/credentials|\.ssh/id_[a-z0-9]+|\.netrc|credentials\.json))[\s\S]{0,160}?(?:base64\.(?:b64encode|standard_b64encode|encodebytes)\s*\(\s*\1\b|Buffer\.from\s*\(\s*\1\b[^)]*\)\.toString\s*\(\s*['"]base64|btoa\s*\(\s*\1\b|binascii\.(?:hexlify|b2a_base64)\s*\(\s*\1\b|\1\.encode\s*\(\s*['"]base64['"])[\s\S]{0,160}?(?:requests\.(?:post|put|patch)|httpx\.(?:post|put)|urllib\.request\.urlopen|urllib2\.urlopen|http\.client\.HTTPS?Connection|aiohttp\.[A-Za-z_]*\.(?:post|put)|fetch\s*\(|axios\.(?:post|put)|\.sendall\s*\(|\.sendto\s*\()
+      value: (?i)(?:^|[^\w$])(?:const\s+|let\s+|var\s+)?([A-Za-z_$][\w$]*)\s*=\s*(?:os\.environ(?:\.get)?\s*[\(\[]\s*['"][A-Z0-9_]*(?:SECRET|TOKEN|API[_-]?KEY|PASSWORD|PASSWD|CREDENTIAL|PRIVATE[_-]?KEY|ACCESS[_-]?KEY|AUTH_?TOKEN)|process\.env\.[A-Z0-9_]*(?:SECRET|TOKEN|API[_-]?KEY|PASSWORD|CREDENTIAL|PRIVATE[_-]?KEY|ACCESS[_-]?KEY)|getenv\s*\(\s*['"][A-Z0-9_]*(?:SECRET|TOKEN|API[_-]?KEY|PASSWORD|CREDENTIAL)|(?:open|readFileSync|read_file)\s*\([^)\n]{0,60}(?:\.aws/credentials|\.ssh/id_[a-z0-9]+|\.netrc|credentials\.json))[\s\S]{0,160}?(?:base64\.(?:b64encode|standard_b64encode|encodebytes)\s*\(\s*\1\b|Buffer\.from\s*\(\s*\1\b[^)]*\)\.toString\s*\(\s*['"]base64|btoa\s*\(\s*\1\b|binascii\.(?:hexlify|b2a_base64)\s*\(\s*\1\b|\1\.encode\s*\(\s*['"]base64['"])[\s\S]{0,160}?(?:requests\.(?:post|put|patch)|httpx\.(?:post|put)|urllib\.request\.urlopen|urllib2\.urlopen|http\.client\.HTTPS?Connection|aiohttp\.[A-Za-z_]*\.(?:post|put)|fetch\s*\(|axios\.(?:post|put)|\.sendall\s*\(|\.sendto\s*\()
       description: 'Ordered chain: secret read into a variable -> that SAME variable base64/hex-encoded (backreference-bound) -> outbound network send, within a bounded window. The backreference (\1) is what keeps the encode stage tied to the secret: a skill that reads a token for SDK auth but base64-encodes an UNRELATED image/file and POSTs it (a very common legitimate upload pattern) no longer matches, because the encoded operand is a different variable than the one holding the secret.'
   condition: all
   false_positives:

package/rules/tool-poisoning/ATR-2026-00012-unauthorized-tool-call.yaml

@@ -1,6 +1,6 @@
 title: Unauthorized Tool Call Detection
 id: ATR-2026-00012
-rule_version: 2
+rule_version: 3
 status: experimental
 description: |
   Detects unauthorized or malicious tool call attempts including parameter injection, path traversal, shell injection in string parameters, privilege escalation via parameter manipulation, tool enumeration/discovery, SQL injection in tool arguments, LDAP injection, template injection, environment variable extraction, file operation abuse, and serialization attacks. This rule focuses on parameter-level attacks rather than tool name matching, since tool names are easily changed but injection patterns in arguments are structurally consistent across attack variants.
@@ -8,7 +8,7 @@ author: ATR Community
 date: 2026/03/08
 schema_version: '0.1'
 detection_tier: pattern
-maturity: test
+maturity: experimental
 severity: high
 references:
   owasp_llm:
@@ -64,12 +64,12 @@ detection:
   conditions:
     - field: tool_args
       operator: regex
-      value: (\.\.[\/\\]){2,}|\.\.[\/\\][^\s]*[\/\\](etc|proc|root|sys|var|home|tmp|boot|dev|usr|opt|passwd|shadow|hosts)[\/\\]?|~[\/\\]\.\.[\/\\]
-      description: Path traversal sequences targeting sensitive directories
+      value: (\.\.[\/\\]){4,}|\.\.[\/\\][^\s"'`]{0,60}[\/\\](etc|proc|root|boot|passwd|shadow|hosts)[\/\\]?|~[\/\\]\.\.[\/\\]
+      description: Path traversal that either goes 4+ levels up or lands on a sensitive root (v3 tightened, strict subset of v2). v2's bare `(\.\./){2,}` fired on every markdown relative link (`](../../CONNECTORS.md)`) — 147 of its 155 benign hits — and its target list included `var|home|tmp|dev|usr|opt|sys`, which are ordinary directory names in a RELATIVE source path (`../figma-use/references/var`). Both were removed; the traversal-to-sensitive-root form and `~/../` are kept.
     - field: tool_args
       operator: regex
-      value: (;|&&|\|\|)\s*(?:sudo\s+)?(?:curl\s+(?:-\S+\s+)*['"]?https?://(?!localhost|127\.0\.0\.1|0\.0\.0\.0)|wget\s+(?:-\S+\s+)*['"]?https?://(?!localhost|127\.)|\bnc\b\s+-?[a-z0-9]|ncat\s+\S|\b(?:ba)?sh\s+-[ic]|python[0-9]?\s+-c|perl\s+-e|ruby\s+-e|node\s+-e|\beval\s|rm\s+-[rf]|cat\s+/etc/(?:passwd|shadow|sudoers)|whoami|\bid\b\s*(?:;|&|\||$)|uname\s+-a|base64\s+(?:-d|--decode)|ifconfig|>&\s*/dev/tcp)|[$`]\([^)`]{0,80}(?:curl|wget|\bnc\b|\bbash\b|\bsh\s+-|whoami|\bid\b|base64\s+-d|/etc/(?:passwd|shadow))
-      description: Shell metacharacter chained to a genuinely dangerous command — external network fetch, pipe-to-shell / interpreter one-liner, recon (whoami/id/uname -a), or sensitive-file read (v2 tightened; legit build chains like "npm i && bash setup.sh", "&& python -m pytest", "| jq" no longer fire)
+      value: (;|&&|\|\|)\s*(?:sudo\s+)?(?:curl\s+(?:-\S+\s+)*['"]?https?://(?!localhost|127\.0\.0\.1|0\.0\.0\.0)|wget\s+(?:-\S+\s+)*['"]?https?://(?!localhost|127\.)|\bnc\b\s+-?[a-z0-9]|ncat\s+\S|\b(?:ba)?sh\s+-[ic]|python[0-9]?\s+-c|perl\s+-e|ruby\s+-e|node\s+-e|\beval\s+["'$`(]|rm\s+-[rf]{1,2}\s+(?:-\S+\s+)*(?:/\s|/\*|~|\$HOME|\*|/(?:etc|var|usr|home|root|bin|Users)\b)|cat\s+/etc/(?:passwd|shadow|sudoers)|whoami|\bid\b\s*(?:;|&|\||$)|uname\s+-a|base64\s+(?:-d|--decode)|ifconfig|>&\s*/dev/tcp)|[$`]\([^)`]{0,80}(?:\bnc\b|\b(?:ba)?sh\s+-[ic]|whoami|base64\s+-d|/etc/(?:passwd|shadow))
+      description: 'Shell metacharacter chained to a genuinely dangerous command — external network fetch, pipe-to-shell / interpreter one-liner, recon (whoami/uname -a), or sensitive-file read. v2 tightened the `;|&&|||` branch (legit build chains like "npm i && bash setup.sh" no longer fire). v3 is a further strict subset: (a) the command-substitution branch drops `\bid\b` (matched the identifier `Id` in `$(aws ... --query ''Accounts[*].Id'')` and `${trade.id}`), `\bbash\b` (matched `$(gh completion -s bash)`), `\bsh\s+-` (matched the filename in `$(scripts/filter-sessions.sh -x)`) and `curl|wget` (15 hits — `MODEL_ID=$(curl -fsS "$BASE_URL/v1/models")` is the ordinary capture-a-response idiom and carries no execution); (b) `rm\s+-[rf]` now needs a root/home/wildcard target, because `&& rm -rf ./skills/my-skill` is normal cleanup; (c) `\beval\s` now needs an actual argument, because it matched the prose "**uv**; eval deps:".'
     - field: tool_name
       operator: regex
       value: (?i)^(admin_|root_|sudo_|system_|internal_|debug_|maintenance_|privileged_|superuser_|__)
@@ -80,36 +80,36 @@ detection:
       description: Tool enumeration attempts to discover available attack surface
     - field: tool_args
       operator: regex
-      value: (?i)('\s*(OR|AND|UNION)\s+['"]?\d|"\s*(OR|AND|UNION)\s+['"]?\d|\b(UNION\s+(ALL\s+)?SELECT|INSERT\s+INTO|UPDATE\s+.*\s+SET|DELETE\s+FROM|DROP\s+(TABLE|DATABASE)|ALTER\s+TABLE|EXEC(UTE)?\s+|xp_cmdshell)\b|;\s*(DROP|DELETE|INSERT|UPDATE|ALTER|EXEC)\b)
-      description: SQL injection patterns in tool parameters
+      value: (?i)(['"]\s*(OR|AND)\s+['"]?\d+\s*['"]?\s*(=|<|>|--|\)|;|\bLIKE\b)|['"]\s*(UNION\s+(ALL\s+)?SELECT|INSERT\s+INTO|DELETE\s+FROM|UPDATE\s+\w{1,64}\s+SET|DROP\s+(TABLE|DATABASE)|ALTER\s+TABLE)\b[^\n]{0,160}(--|\/\*)|\bUNION\s+(ALL\s+)?SELECT\b|\bxp_cmdshell\b|;\s*(DROP\s+(TABLE|DATABASE)|DELETE\s+FROM|INSERT\s+INTO|UPDATE\s+\w{1,64}\s+SET|ALTER\s+TABLE|EXEC(UTE)?\s+(xp_|sp_))\b)
+      description: 'SQL injection in a tool parameter: quote-break tautology, quote-break followed by a DML/DDL statement, UNION SELECT, xp_cmdshell, or a stacked statement after `;`. v3 is a strict subset of v2. v2 matched BARE SQL keywords, which is not injection — `EXEC(UTE)?\s+` matched the English word "execute " (≈864 of its 1,139 benign hits, e.g. "you execute them automatically"), and `UPDATE\s+.*\s+SET` had an unbounded `.*` that spans a whole JSON-encoded document (src/hook-handler.ts encodes a newline as the two characters \ and n, so `.` never stops). Bare INSERT INTO / DELETE FROM / ALTER TABLE / DROP TABLE now require a quote-break AND a SQL comment terminator, or a stacked `;` in front. The tautology branch additionally requires a comparison or terminator after the digit: v2''s `["'']\s*(OR|AND)\s+["'']?\d` matched ordinary English — `"Cinematic braam, horror" or "8-bit retro jump sound"`, `period: "30d" or "7d"`, `choose 0.3" or 0.5" gaps`.'
     - field: tool_args
       operator: regex
-      value: (?i)(\$\{?\w*(KEY|TOKEN|SECRET|PASSWORD|PASS|PWD|CREDENTIAL|AUTH|API_KEY|ACCESS_KEY|PRIVATE)\w*\}?|process\.env\.|os\.environ|System\.getenv|ENV\[|getenv\s*\()
-      description: Attempts to extract environment variables containing secrets
+      value: (?i)(\$\{?\w*(SECRET|CREDENTIAL|ACCESS_KEY|PRIVATE|PASSWORD|PASSWD)\w*\}?|(process\.env\.|os\.environ\s*[\[\.]\s*\\?['"]?|System\.getenv\s*\(\s*\\?['"]?|getenv\s*\(\s*\\?['"]?|ENV\[\s*\\?['"]?)\w*(SECRET|CREDENTIAL|ACCESS_KEY|PRIVATE|PASSWORD|PASSWD)\w*|(dict|list|str|json\.dumps|pprint|print)\s*\(\s*os\.environ|os\.environ\.(items|copy|keys|values)\s*\()
+      description: 'Reference to a secret-bearing environment variable, or a wholesale dump of the environment. v3 is a strict subset of v2. v2 fired on the language construct alone — `process.env.` (167 benign hits), `os.environ` (51), `System.getenv` (12), `getenv(` (7) — and on the generic words KEY|TOKEN|PASS|PWD|AUTH, which match `$HF_TOKEN`, `${token}`, `$ai_input_tokens`, `${BRAVE_SEARCH_API_KEY}`: every integration doc on earth reads an API key from the environment, so those forms carry no attack signal. The env-reading constructs now have to name a secret-bearing variable, and a whole-environment dump (dict(os.environ), os.environ.items()) fires on its own. RESIDUAL BY DESIGN: bare `${OPENAI_API_KEY}` / `$GITHUB_TOKEN` references no longer fire here — see the dedicated exfiltration rules ATR-2026-00115, ATR-2026-01892, ATR-2026-02262, which require an egress sink.'
     - field: tool_args
       operator: regex
-      value: (?i)([\/\\](etc[\/\\](passwd|shadow|sudoers|ssh[\/\\]|ssl[\/\\])|proc[\/\\](self[\/\\]|\d+[\/\\])(environ|cmdline|maps|fd)|root[\/\\]\.(bash_history|ssh)|\.env|\.git[\/\\]config|\.aws[\/\\]credentials|\.ssh[\/\\](id_rsa|authorized_keys)|wp-config\.php|\.htpasswd|\.netrc|\.pgpass))
-      description: Access to known sensitive files (credentials, config, keys)
+      value: (?i)([\/\\](etc[\/\\](passwd|shadow|sudoers|ssh[\/\\]|ssl[\/\\])|proc[\/\\](self[\/\\]|\d+[\/\\])(environ|cmdline|maps|fd)|root[\/\\]\.(bash_history|ssh)|\.git[\/\\]config|\.aws[\/\\]credentials|\.ssh[\/\\](id_rsa|authorized_keys)|wp-config\.php|\.htpasswd|\.netrc|\.pgpass)|(\.\.[\/\\]){2,}[^\s"'`]{0,40}\.env\b)
+      description: 'Access to known sensitive files (credentials, config, keys). v3 is a strict subset of v2: the bare `[\/\\]\.env` alternative (42 of v2''s 65 benign hits) now requires a 2+ level traversal in front, because `./.env`, `assets/.env.example`, `~/.env` and `docker compose --env-file ../.env` are how every project documents and wires its own configuration.'
     - field: tool_args
       operator: regex
-      value: (\{\{.*?(config|self|request|__class__|__builtins__|__import__|lipsum|cycler|joiner|namespace).*?\}\}|\$\{.*?(Runtime|ProcessBuilder|getClass|forName|exec).*?\}|<%.*?(Runtime|exec|system|eval).*?%>)
-      description: Server-side template injection (Jinja2, Java EL, JSP)
+      value: (\{\{[^{}]{0,120}((config|self|request)\s*[\.\[]\s*\\?['"]?_|__class__|__builtins__|__import__|lipsum|cycler|joiner|namespace)[^{}]{0,120}\}\}|\$\{[^{}]{0,100}(Runtime|ProcessBuilder|getClass|forName)[^{}]{0,100}\}|<%[^%]{0,120}(Runtime|exec|system|eval)[^%]{0,120}%>)
+      description: 'Server-side template injection (Jinja2, Java EL, JSP). v3 is a strict subset of v2: v2''s unbounded lazy `.*?` gaps let a match start at a JavaScript template literal (`${config.name}`) and run forward across a whole JSON-encoded document until it found the literal word "exec" and any later closing brace — 349 of its 372 benign hits came from the `pre-tool-json-arg` shape for exactly that reason. The gaps are now brace-bounded and length-bounded, and `exec` is dropped from the `${...}` branch (Java EL RCE still matches on Runtime / ProcessBuilder / getClass / forName). `config` / `self` / `request` also have to be followed by an attribute access into a dunder — bare `{{ github.event.pull_request.title }}`, `{{config_file}}`, `{{ config(materialized=''view'') }}` (dbt) and `{{.Config.User}}` (Docker Go template) are template placeholders, not Jinja2 sandbox escapes.'
     - field: tool_args
       operator: regex
-      value: (?i)(O:\d+:\s*"|a:\d+:\s*\{|rO0ABX|aced0005|\{\s*"__type"\s*:|\{\s*"\$type"\s*:|yaml\.unsafe_load|pickle\.loads|unserialize\s*\(|Marshal\.load|ObjectInputStream)
-      description: Serialized object injection (PHP, Java, Python pickle, YAML, .NET)
+      value: (?i)(O:\d+:\s*"|a:\d+:\s*\{|rO0ABX|aced0005|\{\s*"__type"\s*:|yaml\.unsafe_load|pickle\.loads|unserialize\s*\(|Marshal\.load|ObjectInputStream)
+      description: 'Serialized object injection (PHP, Java, Python pickle, YAML, .NET). v3 is a strict subset of v2: `{"$type":` is dropped — the W3C Design Tokens format uses `"$type"` as an ordinary schema key, so it is not evidence of .NET TypeNameHandling deserialization on its own.'
     - field: tool_args
       operator: regex
-      value: (?i)(\*\)\(|\)\(|\|\s*\(|&\s*\(|\(\|\(|\(&\().*?(objectClass|uid|cn|sn|mail|userPassword|memberOf)\s*[=~<>]
-      description: LDAP filter injection patterns
+      value: (?i)(\*\)\(|\(\|\(|\(&\()[^()]{0,60}(objectClass|uid|cn|sn|userPassword|memberOf)\s*[=~<>]
+      description: LDAP filter injection patterns. v3 is a strict subset of v2. v2's anchors included a bare `\)\(`, `\|\s*\(` and `&\s*\(` — `require('stripe')('sk_...')`, `sequenceS(validation)({...})` and JSX `&& (` all match — and the following `.*?` was unbounded, so it ran across a whole JSON-encoded document to find any later `mail=` / `uid=`. The gap is now paren-bounded and length-bounded, only the three genuinely LDAP-shaped anchors remain, and the English word `mail` is dropped from the attribute list.
     - field: tool_args
       operator: regex
-      value: (?i)(@|%40)(localhost|127\.0\.0\.1|0\.0\.0\.0|internal|intranet|corp|private)|\\@(localhost|127)|url\s*=\s*['"]?(file|gopher|dict|ftp|ldap|tftp)://
-      description: URL manipulation to access internal resources via @ notation or exotic protocols
+      value: (?i)(https?|ftp|gopher|dict|ldap|tftp)://[^\s/"'<>]{0,120}(@|%40)(localhost|127\.0\.0\.1|0\.0\.0\.0|internal|intranet|corp|private)|url\s*=\s*['"]?(file|gopher|dict|ftp|ldap|tftp)://
+      description: 'URL manipulation to access internal resources via @ userinfo notation or exotic protocols. v3 is a strict subset of v2: the `@host` form now has to sit inside an actual URL. v2 matched a bare `@localhost` / `@corp` / `@private` anywhere, i.e. the e-mail address `admin@localhost.com`, the npm scope `@private/auth-form` and the connection string `postgresql://user:pass@localhost:5432/db`.'
     - field: tool_args
       operator: regex
-      value: (?i)(\*\s*;|\*\s*&&|\*\s*\|\||\bfind\s+/\s+-name|\bfind\s+/\s+-exec|\bxargs\s+|\bglob\s*\(.{0,20}\*\*)
-      description: Wildcard and glob patterns combined with shell execution
+      value: (?i)(\bfind\s+/\s+-name|\bfind\s+/\s+-exec|\bxargs\s+(-\S+\s+)*(rm|sh|bash|zsh|curl|wget|chmod|chown|dd|cat|base64|nc)\b|\*\s*(;|&&|\|\|)\s*(rm|curl|wget|sh|bash|nc|cat|python|perl|tar|zip|base64)\b)
+      description: Wildcard / glob combined with an actually dangerous command. v3 is a strict subset of v2. v2 fired on `\*\s*;` (44 benign hits — any `**;` in markdown or code), on a bare `\bxargs\s+` (15 hits — `find . -name "*.py" | xargs grep -l` is ordinary shell), and on `glob(...**` (ordinary globbing in application code). The chain now has to end in a destructive/exfiltrating command.
     - field: tool_args
       operator: regex
       value: (?i)(admin\s*=\s*(true|1|yes)|role\s*=\s*(admin|root|superuser|system)|is_admin\s*=\s*(true|1)|privilege\s*=\s*(elevated|admin|root|full)|permission\s*=\s*(all|\*|admin|root)|access_level\s*=\s*(admin|root|full|unlimited))
@@ -126,7 +126,7 @@ response:
     - alert
     - snapshot
     - escalate
-  actions_rationale: 'response-action eligibility (docs/RESPONSE-ACTION-ELIGIBILITY.md): benign FP 1672/5352 = 31.24% (partial measurement — a lower bound) exceeds the 2% automatic-demotion line; ceiling = observe. Removed block_tool(interrupt). Detection unchanged — recall cost is zero.'
+  actions_rationale: 'response-action eligibility (docs/RESPONSE-ACTION-ELIGIBILITY.md): block_tool(interrupt) was removed when rule_version 2 measured 1672/5352 = 31.24% benign FP, over the 2% automatic-demotion line. rule_version 3 measures 150/14157 = 1.06% (partial measurement: the tool_name conditions are not measurable on a text corpus) and is maturity experimental; its detection fingerprint is new, so until data/benign-fp-measurement.json is regenerated the gate treats it as unmeasured and the ceiling is observe. alert, snapshot and escalate are all observe-tier.'
   auto_response_threshold: high
   message_template: |
     [ATR-2026-012] Unauthorized tool call detected. Rule: ATR-2026-012. Tool: {tool_name}. Pattern: {matched_pattern}. This rule no longer blocks the tool; it alerts and snapshots. The hook may still deny on severity — see docs/RESPONSE-ACTION-ELIGIBILITY.md.

package/rules/tool-poisoning/ATR-2026-00013-tool-ssrf.yaml

@@ -1,9 +1,9 @@
 title: SSRF via Agent Tool Calls
 id: ATR-2026-00013
-rule_version: 2
+rule_version: 4
 status: experimental
 description: |
-  Detects high-confidence Server-Side Request Forgery (SSRF) that targets cloud CREDENTIAL / metadata services or uses deliberate obfuscation — the cases where an agent has no legitimate reason to make the request. Detection covers: AWS/GCP/Azure/DigitalOcean/Oracle/Alibaba metadata and IMDS credential endpoints and token headers, OBFUSCATED loopback encodings (hex/octal), exotic URI schemes (file, gopher, dict, tftp, ldap) targeting internal addresses, DNS-rebinding service hostnames, IPv6 mapped/ULA loopback, redirect-parameter SSRF to internal targets, and internal-redirect URL shorteners. NOTE (v2, precision): plain localhost / 127.0.0.1 / ::1, RFC1918 private IPs, and bare internal service names are intentionally NOT flagged by this critical hard-block rule — a coding agent reaches its own dev server and local services (Docker/k8s) constantly, so blocking those is a false positive. Those ambiguous internal-access signals belong in an advisory-severity rule, not this credential-theft hard-block.
+  Detects high-confidence Server-Side Request Forgery (SSRF) that targets cloud CREDENTIAL / metadata services or uses deliberate obfuscation — the cases where an agent has no legitimate reason to make the request. Detection covers: AWS/GCP/Azure/DigitalOcean/Oracle/Alibaba metadata and IMDS credential endpoints and token headers, OBFUSCATED loopback encodings (hex/octal), exotic URI schemes (file, gopher, dict, tftp, ldap) targeting internal addresses, DNS-rebinding service hostnames, IPv4-mapped IPv6 forms of loopback and private IPv4, redirect-parameter SSRF to internal targets, and internal-redirect URL shorteners. NOTE (v2, precision): plain localhost / 127.0.0.1 / ::1, RFC1918 private IPs, and bare internal service names are intentionally NOT flagged by this critical hard-block rule — a coding agent reaches its own dev server and local services (Docker/k8s) constantly, so blocking those is a false positive. Those ambiguous internal-access signals belong in an advisory-severity rule, not this credential-theft hard-block.
 author: ATR Community
 date: 2026/03/08
 schema_version: '0.1'
@@ -24,6 +24,10 @@ references:
   cve:
     - CVE-2019-5418
     - CVE-2021-21311
+    - CVE-2026-55096
+  external:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-55096
+    - https://github.com/leshchenko1979/fast-mcp-telegram/security/advisories/GHSA-xr72-j7vj-vp7g
 compliance:
   nist_ai_rmf:
     - subcategory: MS.2.7
@@ -95,27 +99,34 @@ detection:
       description: Exotic URI schemes targeting internal addresses
     - field: tool_args
       operator: regex
-      value: (?i)(https?://)?[a-zA-Z0-9-]+\.(xip\.io|nip\.io|sslip\.io|localtest\.me|vcap\.me|lvh\.me|lacolhost\.com|127\.0\.0\.1\.[a-z]+\.\w+)(:\d+)?
+      value: (?i)(https?://)?[a-zA-Z0-9-]{1,63}\.(xip\.io|nip\.io|sslip\.io|localtest\.me|vcap\.me|lvh\.me|lacolhost\.com|127\.0\.0\.1\.[a-z]+\.\w+)(:\d+)?
       description: DNS rebinding services that resolve to internal IPs
+    - field: tool_args
+      operator: regex
+      value: (?i)\b(?:https?|wss?|ftp):(?:\\?/){2}(?:[^\s/\\@"'<>]{1,64}@)?(?:localtest\.me|lvh\.me|vcap\.me|lacolhost\.com)\.?(?:[:/?#"'\s\\\],;)>|]|$)
+      description: 'APEX loopback-wildcard domains used as a URL host. localtest.me, lvh.me, vcap.me and lacolhost.com resolve to 127.0.0.1 at the apex as well as on every subdomain, so a hostname-string SSRF denylist that does not resolve DNS lets https://localtest.me/admin reach loopback services (CVE-2026-55096, fast-mcp-telegram send_message files[]). The pattern above only covers the subdomain form; this one requires a URL scheme directly before the apex host (plain "//" or JSON-escaped "\/\/", optional userinfo, optional trailing dot) and then a host terminator character (: / ? # quote whitespace backslash ] , ; ) > |) or end of input, so prose mentions and look-alike hosts such as localtest.mesh.example.com, lvh.media, vcap.me.uk or lvh.me-cdn.net do not match. The terminator is consumed rather than asserted with a lookahead so the pattern stays RE2-portable. Known limitations (not covered): protocol-relative //localtest.me/admin with no scheme; other apex loopback domains such as localho.st or fuf.me; attacker-owned domains whose A record points at an internal IP (needs DNS resolution, not possible at the pattern layer). Known false positives: a developer reaching their own dev server through the lvh.me alias (curl http://lvh.me:3000/...), and a free-text search query that quotes the URL https://localtest.me - the existing subdomain condition above already flags app.lvh.me:3000, so this is consistent with it.'
     - field: tool_args
       operator: regex
       value: (?i)(redirect|redir|url|next|return|returnUrl|returnTo|continue|dest|destination|go|goto|target|link|out|view|ref|callback|forward)\s*=\s*(https?%3A%2F%2F|https?://)(localhost|127\.0\.0\.1|10\.|172\.(1[6-9]|2[0-9])|192\.168|169\.254|0\.0\.0|\[?::1\]?)
       description: URL redirect parameters targeting internal addresses
     - field: tool_args
       operator: regex
-      value: (?i)(https?://)?\[?(::1|::ffff:127\.0\.0\.1|::ffff:10\.|::ffff:172\.(1[6-9]|2[0-9]|3[01])|::ffff:192\.168|fc[0-9a-f]{2}:|fd[0-9a-f]{2}:)\]?(:\d+)?
-      description: IPv6 loopback, IPv4-mapped, and unique local addresses (fc/fd)
+      value: (?i)(?:^|[^0-9a-f:]|%5b)\[?(?:(?:0{1,4}:){1,4}:|::|(?:0{1,4}:){5})ffff:(?:127\.\d{1,3}\.\d{1,3}\.\d{1,3}|10\.|172\.(?:1[6-9]|2[0-9]|3[01])\.|192\.168\.)
+      description: 'IPv4-mapped IPv6 forms (::ffff:a.b.c.d, also written 0::ffff:, 0:0::ffff: or fully expanded 0:0:0:0:0:ffff:) of loopback (127/8) and RFC 1918 IPv4, an obfuscation that slips past filters written for dotted IPv4. The address must start the token (start of input, a character that is not a hex digit or colon, or a percent-encoded bracket %5B), so the suffix of a longer IPv6 address does not count. Known limits: a mapped address directly after a colon (unbracketed host:port:addr syntax such as curl --resolve x:80:::ffff:127.0.0.1) and a JSON-escaped bracket (\u005b) are not matched; the hex form ::ffff:7f00:1, IPv4-compatible ::127.0.0.1 and NAT64 64:ff9b:: forms are left to ATR-2026-02868; ::ffff:0.0.0.0 and ::ffff:100.64.0.0/10 are not covered. Plain ::1 and unique local addresses (fc00::/7) are not matched, for the same reason plain localhost, 127.0.0.1 and RFC 1918 are not (see the v2 note in the description): a coding agent reaches its own dev server on [::1] and private services on ULA all the time. v3 matched both with no token boundary, so the tail of a public 6to4 address (2002:cb00:7101::1), ::10, and Oracle APEX URLs (:::190) matched as loopback.'
     - field: tool_args
       operator: regex
       value: (?i)(https?://)?(bit\.ly|tinyurl\.com|t\.co|goo\.gl|is\.gd|v\.gd|rb\.gy|cutt\.ly|short\.io|tiny\.cc)/[a-zA-Z0-9]+
       description: URL shorteners that may redirect to internal services
   condition: any
   false_positives:
+    - Logs and diagnostics pasted into a tool argument that report IPv4 peers in IPv4-mapped form, as dual-stack sockets do on Linux (netstat / ss / lsof output, Node "connect ECONNREFUSED ::ffff:127.0.0.1:6379", Express req.ip ::ffff:192.168.1.10, nginx or MySQL messages with ::ffff:172.17.0.1). Loopback addresses of system resolvers such as ::ffff:127.0.0.53 match too, since 127/8 is covered.
     - Agents with legitimate access to internal services explicitly allowlisted
     - Development environments where localhost access is expected
     - Private network tools designed for internal infrastructure management
     - Cloud management tools that legitimately query metadata endpoints
     - Service mesh tools that use .internal or .consul DNS names by design
+    - Developers who use the lvh.me / localtest.me / vcap.me / lacolhost.com loopback aliases for their own dev server (common in the Rails community, e.g. curl http://lvh.me:3000/users/sign_in) - both the apex and the subdomain forms are flagged, unlike plain localhost which v2 deliberately allows. Maintainers should decide whether these aliases belong in this hard-block rule or an advisory-severity rule.
+    - Free-text tool arguments (search queries, notes) that quote a full https://localtest.me style URL while discussing it rather than requesting it.
 response:
   actions:
     - block_tool

package/rules/tool-poisoning/ATR-2026-00161-important-tag-cross-tool-shadowing.yaml

@@ -21,7 +21,7 @@ references:
     - AML.T0051.001 - Indirect
     - AML.T0053 - AI Agent Tool Invocation
     - 'AML.T0110.000 - AI Agent Tool Poisoning: Definition and Instructions'
-    - AML.T0104 - Publish Poisoned AI Agent Tool
+    - 'AML.T0115.002 - Publish Poisoned AI Artifacts: AI Agent Tools'
   safe_mcp:
     - SAF-T1102
     - SAF-T1001

package/rules/tool-poisoning/ATR-2026-00277-echo-template-command-injection.yaml

@@ -65,11 +65,11 @@ detection:
   conditions:
     - field: tool_response
       operator: regex
-      value: (?:i\s+am\s+(?:an?\s+)?(?:administrator|admin|sysadmin|root|superuser)\s+testing|when\s+I\s+prefix\s+(?:a\s+statement|(?:it\s+)?with)\s+["\x27]?ECHO[\s:]["\x27]?)\s*,?\s*(?:you\s+should\s+)?(?:respond|reply|echo|output|repeat|return)\s+(?:with\s+)?exactly\s+what\s+follows
+      value: (?:i\s+am\s+(?:an?\s+)?(?:administrator|admin|sysadmin|root|superuser)\s+testing|when\s+I\s+prefix\s+(?:a\s+statement|(?:it\s+)?with)\s+["\x27]?ECHO[\s:]["\x27]?)(?:\s*,)?\s*(?:you\s+should\s+)?(?:respond|reply|echo|output|repeat|return)\s+(?:with\s+)?exactly\s+what\s+follows
       description: 'Garak ECHO_TEMPLATE admin preamble: "administrator testing echo — when prefixed with ECHO: respond exactly"'
     - field: tool_response
       operator: regex
-      value: (?:^|\n)\s*ECHO\s*:\s*(?:\{\{[^}]{1,200}\}\}|[`$]\([^)]{1,200}\)|\$\{[^}]{1,200}\}|<\?(?:php|=)[^?]{1,200}\?>|import\s+os|__import__|subprocess|eval\s*\(|exec\s*\()
+      value: (?:^|\n)[^\S\n]*ECHO\s*:\s*(?:\{\{[^}]{1,200}\}\}|[`$]\([^)]{1,200}\)|\$\{[^}]{1,200}\}|<\?(?:php|=)[^?]{1,200}\?>|import\s+os|__import__|subprocess|eval\s*\(|exec\s*\()
       description: 'ECHO: prefix followed by template expression, command substitution, or code execution payload'
     - field: tool_response
       operator: regex

package/rules/tool-poisoning/ATR-2026-00494-garak-exploitation-mixedunassigned.yaml

@@ -80,15 +80,15 @@ detection:
       description: SQL UNION SELECT injection for data exfiltration
     - field: user_input
       operator: regex
-      value: (?i)(and|or|if)\s*\(?\s*(substring|substr|mid|left|right|ascii|char|ord)\s*\(.{0,40}\)\s*=\s*['"]?[a-z0-9]|and\s*if\s*\(.{0,60}(sleep|waitfor\s+delay|benchmark)\s*\(
+      value: (?i)(and|or|if)\s*(?:\(\s*)?(substring|substr|mid|left|right|ascii|char|ord)\s*\(.{0,40}\)\s*=\s*['"]?[a-z0-9]|and\s*if\s*\(.{0,60}(sleep|waitfor\s+delay|benchmark)\s*\(
       description: Blind boolean/time-based SQL injection via character extraction and delay functions
     - field: user_input
       operator: regex
-      value: (?i)'\s*;?\s*insert\s+into\s+[a-z_]+\s*(?:\([^)]{0,100}\)\s*)?values\s*\(
+      value: (?i)'\s*(?:;\s*)?insert\s+into\s+[a-z_]+\s*(?:\([^)]{0,100}\)\s*)?values\s*\(
       description: SQL INSERT INTO injection payload (column list optional)
     - field: user_input
       operator: regex
-      value: (?i)[0-9]+\s*;\s*drop\s+table\s+[a-z_]+\s*(--|;|/\*)
+      value: (?i)[0-9]\s*;\s*drop\s+table\s+[a-z_]+\s*(--|;|/\*)
       description: SQL DROP TABLE destructive injection
     - field: user_input
       operator: regex
@@ -100,7 +100,7 @@ detection:
       description: SQL server shutdown or command execution via stored procedure
     - field: user_input
       operator: regex
-      value: (?i)\(lambda\s+[a-z_,\s]+:\s*\[+[^\]]{0,200}(s\.connect|socket\.connect|os\.system|subprocess|exec|eval).{0,100}\d{4,5}\)
+      value: (?i)\(lambda\s[a-z_,\s]+:\s*\[+(?:[^\]\[][^\]]{0,199})?(s\.connect|socket\.connect|os\.system|subprocess|exec|eval).{0,100}\d{4,5}\)
       description: Python lambda-based reverse shell or code execution payload
   condition: any
   false_positives:

package/rules/tool-poisoning/ATR-2026-00581-mcp-tool-rug-pull-post-approval-redefinition.yaml

@@ -20,7 +20,7 @@ references:
   mitre_atlas:
     - AML.T0053 - AI Agent Tool Invocation
     - AML.T0051.001 - Indirect
-    - AML.T0104 - Publish Poisoned AI Agent Tool
+    - 'AML.T0115.002 - Publish Poisoned AI Artifacts: AI Agent Tools'
   vulnerablemcp_id:
     - tool-poisoning-rce-rug-pull
   external:

package/rules/tool-poisoning/ATR-2026-01303-tool-schema-enumeration-social-engineering.yaml

@@ -56,7 +56,7 @@ detection:
   conditions:
     - field: content
       operator: regex
-      value: (?i)(?:list|show|give|tell\s+me|enumerate)\s+(?:me\s+)?(?:all\s+)?(?:the\s+)?(?:internal|hidden|admin(?:-only)?|privileged?|every)?\s*(?:functions?\s+or\s+tools?|tools?\s+(?:you\s+can\s+call|or\s+functions?)|internal\s+(?:functions?|tools?|api\s+endpoints?))[^.]{0,80}(?:you\s+can\s+call|admin-only|including\s+(?:any\s+)?admin|with\s+their\s+parameters|access\s+to)
+      value: (?i)(?:list|show|give|tell\s+me|enumerate)\s+(?:me\s+)?(?:all\s+)?(?:the\s+)?(?:(?:internal|hidden|admin(?:-only)?|privileged?|every)\s*)?(?:functions?\s+or\s+tools?|tools?\s+(?:you\s+can\s+call|or\s+functions?)|internal\s+(?:functions?|tools?|api\s+endpoints?))[^.]{0,80}(?:you\s+can\s+call|admin-only|including\s+(?:any\s+)?admin|with\s+their\s+parameters|access\s+to)
       description: Request to enumerate the agent's own internal/admin tools or functions
     - field: content
       operator: regex

package/rules/tool-poisoning/ATR-2026-01307-mcp-dns-rebinding-attack.yaml

@@ -62,11 +62,11 @@ detection:
   conditions:
     - field: content
       operator: regex
-      value: (?i)\b[a-zA-Z0-9.-]+\.(?:rebind\.network|rbndr\.us|rebinder\.com|1u\.ms)\b
+      value: (?i)\b[a-zA-Z0-9.-]{1,253}\.(?:rebind\.network|rbndr\.us|rebinder\.com|1u\.ms)\b
       description: Known DNS rebinding service hostname (rebind.network, rbndr.us, etc.)
     - field: content
       operator: regex
-      value: (?i)[\w.-]*(?:1time|forever|ttl\d+|0ttl)[\w.-]+(?:127\.0\.0\.1|192\.168\.\d+\.\d+|10\.\d+\.\d+\.\d+|172\.(?:1[6-9]|2\d|3[0-1])\.\d+\.\d+)
+      value: (?i)(?:1time|forever|ttl\d+|0ttl)[\w.-]{1,253}(?:127\.0\.0\.1|192\.168\.\d+\.\d+|10\.\d+\.\d+\.\d+|172\.(?:1[6-9]|2\d|3[0-1])\.\d+\.\d+)
       description: Time-based DNS rebinding hostname pattern combining public IP with loopback/private IP
     - field: content
       operator: regex

package/rules/tool-poisoning/ATR-2026-01775-semantic-mcp-tool-manifest-poisoning.yaml

@@ -34,7 +34,7 @@ references:
     - ASI02:2026
   mitre_atlas:
     - AML.T0053 - AI Agent Tool Invocation
-    - AML.T0019 - Publish Poisoned Datasets
+    - 'AML.T0115.000 - Publish Poisoned AI Artifacts: Datasets'
     - AML.T0051.001 - Indirect
     - 'AML.T0110.000 - AI Agent Tool Poisoning: Definition and Instructions'
 compliance:

package/rules/tool-poisoning/ATR-2026-01932-shadow-undeclared-mcp-server-registration.yaml

@@ -19,7 +19,7 @@ references:
     - ASI09:2026
   mitre_atlas:
     - AML.T0010 - AI Supply Chain Compromise
-    - AML.T0104 - Publish Poisoned AI Agent Tool
+    - 'AML.T0115.002 - Publish Poisoned AI Artifacts: AI Agent Tools'
   mitre_attack:
     - T1195.002 - Compromise Software Supply Chain
     - T1036 - Masquerading

package/rules/tool-poisoning/ATR-2026-02025-mcp-full-schema-poisoning-nondescription-field.yaml

@@ -20,7 +20,7 @@ references:
   mitre_atlas:
     - AML.T0051.001 - Indirect
     - 'AML.T0110.000 - AI Agent Tool Poisoning: Definition and Instructions'
-    - AML.T0104 - Publish Poisoned AI Agent Tool
+    - 'AML.T0115.002 - Publish Poisoned AI Artifacts: AI Agent Tools'
   safe_mcp:
     - SAF-T1001
   research:

package/rules/tool-poisoning/ATR-2026-02817-untrusted-content-dictates-tool-arguments.yaml

@@ -0,0 +1,83 @@
+title: Untrusted Tool Result Dictates a Tool Call by Schema Parameter Name
+id: ATR-2026-02817
+rule_version: 1
+status: experimental
+description: |
+  Detects untrusted content inside a tool result that speaks the agent's OWN tool-schema vocabulary: it names the target function and binds each parameter by its literal schema name to a chosen value, then asks the assistant to construct exactly those arguments and issue the call. This is not an imperative wish ("please transfer 500 dollars") — which ATR already covers — it is a serialised call specification planted in a bill description, a review body or a message body, so the model's remaining work is transcription rather than intent formation. Source: AutoDojo variant generation over the AgentDojo banking and slack suites (agentdojo/variant_generation/variants/banking/.../injections.json and banking_rlhammer.json). Measured before authoring: 4 verbatim variants of this shape produced 1 hit across 785 rules, and that hit was ATR-2026-00504 firing incidentally on the words "full ... overview ... tools", not on the call-spec structure. TWO CONJUNCTS, BOTH REQUIRED. (1) An AGENT-DIRECTED request to emit the call. A bare "call the send_money function with the parameter recipient set to ..." is deliberately NOT matched, because that is exactly how API reference documentation, OpenAPI descriptions, SDK guides, changelog migration notes and bug-report repro steps read; six such benign twins were authored and all six match the parameter-binding condition alone. (2) TWO OR MORE named parameter bindings within 300 characters, which is what makes the text a call spec rather than a sentence that happens to mention an argument. CHANNEL IS PART OF THE DETECTION, NOT AN ACCIDENT. agent_source.type is mcp_exchange, so EVENT_TYPE_TO_SOURCE routes only tool_response and tool_call events here and llm_input is never evaluated. That is load-bearing: a user who types "I would like you to call the geocode function with the parameter address set to ..." is making an ordinary direct request, and it matches both conditions. It is benign because of WHO said it, and the event type is the only place that fact exists. Do not widen this rule to llm_io.
+author: ATR Project
+date: 2026/08/24
+schema_version: '1.0'
+detection_tier: pattern
+maturity: test
+severity: high
+references:
+  owasp_llm:
+    - LLM01:2025
+  owasp_agentic:
+    - ASI01:2026
+    - ASI02:2026
+  mitre_atlas:
+    - AML.T0051 - LLM Prompt Injection
+    - AML.T0053 - LLM Plugin Compromise
+  papers:
+    - 'AutoDojo: automated variant generation for AgentDojo prompt-injection suites — repo: https://github.com/xhOwenMa/AutoDojo, agentdojo/variant_generation/variants/banking/anthropic/claude-haiku-4.5/no_defense/injections.json and banking_rlhammer.json'
+    - 'Debenedetti et al., AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents (arXiv:2406.13352)'
+compliance:
+  nist_ai_rmf:
+    - subcategory: MS.2.7
+      context: A call specification planted in untrusted tool output is a prompt-injection payload aimed at the agent's action surface; MS.2.7 requires that resilience to such injection be evaluated and documented, and this rule supplies the runtime evidence.
+      strength: primary
+    - subcategory: MG.2.3
+      context: MG.2.3 requires mechanisms to disengage or override an AI system that behaves outside intended use; detecting dictated tool arguments is the trigger condition for that override before the call is issued.
+      strength: secondary
+    - subcategory: MS.1.1
+      context: MS.1.1 requires that risks be measured against intended use; a tool call whose arguments originate in retrieved third-party data is outside the agent's intended authority chain, which this rule makes measurable.
+      strength: secondary
+  iso_42001:
+    - clause: '8.1'
+      context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by detecting third-party content that attempts to originate the agent's tool calls.
+      strength: primary
+    - clause: 6.1.2
+      context: ISO/IEC 42001 Clause 6.1.2 (AI risk assessment) identifies untrusted-input-driven action as a treated risk; this rule is the corresponding detective control.
+      strength: secondary
+  eu_ai_act:
+    - article: '15'
+      context: Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist third-party attempts to alter their use or outputs; a dictated tool call is a direct alteration of use, detected here before execution.
+      strength: primary
+    - article: '14'
+      context: Article 14 (human oversight) requires that a natural person can intervene before consequential automated action; flagging an externally dictated call spec is what creates that intervention point.
+      strength: secondary
+    - article: '9'
+      context: Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control for indirect prompt injection targeting tool invocation.
+      strength: secondary
+tags:
+  category: tool-poisoning
+  subcategory: dictated-tool-arguments
+  scan_target: content
+  confidence: medium
+agent_source:
+  type: mcp_exchange
+  framework:
+    - any
+  provider:
+    - any
+detection:
+  conditions:
+    - field: content
+      operator: regex
+      value: (?:\bI\s+(?:would\s+like|want|need|am\s+asking)\s+(?:you|the\s+(?:assistant|agent|ai|model|bot))\s+to\s+(?:call|invoke|execute|run|trigger|use)\b|\b(?:can|could|would|will)\s+you\s+(?:please\s+)?(?:construct|build|create|assemble|prepare|produce|form)\b[^.\n]{0,80}?\b(?:argument|parameter)s?\b[^.\n]{0,80}?\b(?:call|invoke|execute|trigger)\b|\b(?:have|let|ask)\s+the\s+(?:assistant|agent|ai|model|bot)\s+(?:to\s+)?(?:call|invoke|execute|trigger)\b|\bthe\s+(?:assistant|agent|ai|model|bot)\s+(?:should|must|needs\s+to|is\s+to)\s+(?:call|invoke|execute|trigger)\s+the\s+[A-Za-z_][A-Za-z0-9_]{1,40}\s+(?:function|tool|api|method|endpoint|command)\b)
+      description: The retrieved content asks an assistant/agent to construct and issue the call — the conjunct that separates a planted call spec from API reference documentation
+    - field: content
+      operator: regex
+      value: (?:\bthe\s+[A-Za-z_][A-Za-z0-9_]{1,40}\s+(?:parameter|argument|field)\b|\b(?:parameter|argument|field)\s+[A-Za-z_][A-Za-z0-9_]{1,40}\s+(?:\bset\s+to|=|\bas|\bto)\b|\bpassing\s+[^.\n]{0,60}?\bto\s+the\s+[A-Za-z_][A-Za-z0-9_]{1,40}\s+(?:parameter|argument|field)\b)[\s\S]{0,300}?(?:\bthe\s+[A-Za-z_][A-Za-z0-9_]{1,40}\s+(?:parameter|argument|field)\b|\b(?:parameter|argument|field)\s+[A-Za-z_][A-Za-z0-9_]{1,40}\s+(?:\bset\s+to|=|\bas|\bto)\b|\bpassing\s+[^.\n]{0,60}?\bto\s+the\s+[A-Za-z_][A-Za-z0-9_]{1,40}\s+(?:parameter|argument|field)\b)
+      description: Two or more named parameter bindings within 300 chars, i.e. the text is a serialised call specification rather than prose mentioning an argument
+  condition: all
+  false_positives:
+    - A support ticket, bug report or vendor email in which a human legitimately asks the agent to run a specific tool with specific arguments. The text is indistinguishable; what differs is whether the requester is authorised, which is not a property of the content.
+    - Security research or vendor writing that quotes an AutoDojo banking/slack injection variant verbatim.
+    - Agent-framework tutorials retrieved as documentation that phrase an example as a request to the assistant.
+response:
+  actions:
+    - alert
+  message_template: |
+    [ATR-2026-02817] A tool result contains a fully specified tool call — target function plus parameter-by-parameter argument bindings — addressed to the assistant. Arguments originating in retrieved third-party data must not be executed without human confirmation.