agent-threat-rules 4.1.5 → 4.2.1

package/dist/verdict.d.ts

@@ -6,9 +6,42 @@
  *
  * @module agent-threat-rules/verdict
  */
-import type { ATRMatch, ATRSeverity, ATRVerdict } from './types.js';
+import type { ATRMatch, ATRSeverity, ATRAction, ATRVerdict } from './types.js';
+/**
+ * Whether a model, not a rule's deterministic logic, decided this match. A match
+ * without a decider (built outside the engine, as every match was before
+ * decidedBy existed) is read as deterministic; an unknown decider as a model.
+ */
+export declare function isModelDecided(match: Pick<ATRMatch, 'decidedBy'>): boolean;
+/**
+ * What a model-decided match may do.
+ *   'advisory' (default): it is reported and its observe-tier actions run, but
+ *     it takes no part in the outcome and its actions above observe are not
+ *     dispatched.
+ *   'enforce': it counts like any other match. Its false-positive rate has not
+ *     been measured; choose this only if you accept that.
+ */
+export type ModelDecisions = 'advisory' | 'enforce';
+export interface VerdictOptions {
+    readonly modelDecisions?: ModelDecisions;
+}
+/** Read a modelDecisions setting, refusing anything but the two values. */
+export declare function modelDecisionsFromConfig(value: unknown): ModelDecisions;
 /** Severity rank from most severe (0) to least severe (4) */
 export declare const SEVERITY_RANK: Readonly<Record<ATRSeverity, number>>;
+/**
+ * Minimum confidence at which a high-severity match denies; below it, asks.
+ *
+ * Compared as given. A confidence the engine derives from a rule's
+ * `tags.confidence` label reaches this threshold only from a `high` label:
+ * `src/rule-confidence.ts` caps every lower label one basis point under it.
+ */
+export declare const HIGH_SEVERITY_DENY_CONFIDENCE = 0.8;
+/**
+ * Minimum confidence at which a medium-severity match asks; below it, allows.
+ * A `low` label reaches it exactly (0.6) when every condition matched.
+ */
+export declare const MEDIUM_SEVERITY_ASK_CONFIDENCE = 0.6;
 /**
  * Check whether auto-response is enabled for a matched rule.
  * The auto_response_threshold field on ATRResponse indicates the
@@ -16,11 +49,22 @@ export declare const SEVERITY_RANK: Readonly<Record<ATRSeverity, number>>;
  * automatically (without human approval).
  */
 export declare function isAutoResponseEnabled(match: ATRMatch): boolean;
+/**
+ * The observe-tier actions of matches whose other actions are not dispatched.
+ * Only actions the tier ladder names: actionTier() reads an unknown name as
+ * observe, and a name it does not know is not one this policy can vouch for.
+ */
+export declare function observeActions(matches: readonly ATRMatch[]): readonly ATRAction[];
 /**
  * Compute a verdict from an array of ATR matches.
  *
+ * A match a model decided (isModelDecided) is reported but, unless
+ * options.modelDecisions is 'enforce', takes no part in the outcome, and of its
+ * actions only the observe tier is dispatched: no benign-corpus measurement
+ * stands behind a model's decision. Every other match counts as before.
+ *
  * This is a pure function -- no side effects, no mutation.
  * Returns a frozen ATRVerdict object.
  */
-export declare function computeVerdict(matches: readonly ATRMatch[]): ATRVerdict;
+export declare function computeVerdict(matches: readonly ATRMatch[], options?: VerdictOptions): ATRVerdict;
 //# sourceMappingURL=verdict.d.ts.map

package/dist/verdict.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verdict.d.ts","sourceRoot":"","sources":["../src/verdict.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,QAAQ,EACR,WAAW,EAEX,UAAU,EAEX,MAAM,YAAY,CAAC;AAEpB,6DAA6D;AAC7D,eAAO,MAAM,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAM/D,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,QAAQ,GACd,OAAO,CAcT;AAwED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,SAAS,QAAQ,EAAE,GAC3B,UAAU,CAkCZ"}
+{"version":3,"file":"verdict.d.ts","sourceRoot":"","sources":["../src/verdict.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,QAAQ,EAER,WAAW,EACX,SAAS,EACT,UAAU,EAEX,MAAM,YAAY,CAAC;AAsBpB;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,OAAO,CAE1E;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,SAAS,CAAC;AAEpD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;CAC1C;AAED,2EAA2E;AAC3E,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,CAMvE;AAED,6DAA6D;AAC7D,eAAO,MAAM,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAM/D,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,MAAM,CAAC;AAEjD;;;GAGG;AACH,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAElD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,QAAQ,GACd,OAAO,CAcT;AAkDD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,SAAS,QAAQ,EAAE,GAAG,SAAS,SAAS,EAAE,CAIjF;AA8BD;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,SAAS,QAAQ,EAAE,EAC5B,OAAO,GAAE,cAAmB,GAC3B,UAAU,CAmDZ"}

package/dist/verdict.js

@@ -6,6 +6,41 @@
  *
  * @module agent-threat-rules/verdict
  */
+import { ACTION_TIERS, TIERED_ACTIONS, actionTier } from './quality/action-eligibility.js';
+/**
+ * Deciders that are a rule's own deterministic logic. Every other decider is a
+ * model: a semantic rule's judge (`semantic-judge`), the Tier 2.5 embedding
+ * signal (`embedding`), the Layer 3 semantic module (`semantic-layer`), and any
+ * value this list does not know. No evidence a response tier is earned from
+ * measures a model's decisions (the benign-corpus evidence runs the synchronous
+ * engine, where a semantic rule is its pattern fallback), so by default they are
+ * reported and not enforced.
+ */
+const DETERMINISTIC_DECIDERS = new Set([
+    'pattern',
+    'signature',
+    'trace',
+    'semantic-fallback',
+    'invariant',
+    'blacklist',
+    'fingerprint',
+]);
+/**
+ * Whether a model, not a rule's deterministic logic, decided this match. A match
+ * without a decider (built outside the engine, as every match was before
+ * decidedBy existed) is read as deterministic; an unknown decider as a model.
+ */
+export function isModelDecided(match) {
+    return match.decidedBy !== undefined && !DETERMINISTIC_DECIDERS.has(match.decidedBy);
+}
+/** Read a modelDecisions setting, refusing anything but the two values. */
+export function modelDecisionsFromConfig(value) {
+    if (value === undefined)
+        return 'advisory';
+    if (value === 'advisory' || value === 'enforce')
+        return value;
+    throw new TypeError(`modelDecisions must be 'advisory' or 'enforce', not ${JSON.stringify(value)}`);
+}
 /** Severity rank from most severe (0) to least severe (4) */
 export const SEVERITY_RANK = {
     critical: 0,
@@ -14,6 +49,19 @@ export const SEVERITY_RANK = {
     low: 3,
     informational: 4,
 };
+/**
+ * Minimum confidence at which a high-severity match denies; below it, asks.
+ *
+ * Compared as given. A confidence the engine derives from a rule's
+ * `tags.confidence` label reaches this threshold only from a `high` label:
+ * `src/rule-confidence.ts` caps every lower label one basis point under it.
+ */
+export const HIGH_SEVERITY_DENY_CONFIDENCE = 0.8;
+/**
+ * Minimum confidence at which a medium-severity match asks; below it, allows.
+ * A `low` label reaches it exactly (0.6) when every condition matched.
+ */
+export const MEDIUM_SEVERITY_ASK_CONFIDENCE = 0.6;
 /**
  * Check whether auto-response is enabled for a matched rule.
  * The auto_response_threshold field on ATRResponse indicates the
@@ -49,9 +97,9 @@ function determineOutcome(severity, confidence) {
         return 'deny';
     }
     if (severity === 'high') {
-        return confidence >= 0.8 ? 'deny' : 'ask';
+        return confidence >= HIGH_SEVERITY_DENY_CONFIDENCE ? 'deny' : 'ask';
     }
-    if (severity === 'medium' && confidence >= 0.6) {
+    if (severity === 'medium' && confidence >= MEDIUM_SEVERITY_ASK_CONFIDENCE) {
         return 'ask';
     }
     return 'allow';
@@ -73,6 +121,19 @@ function collectUniqueActions(matches) {
     }
     return Object.freeze(actions);
 }
+/**
+ * The observe-tier actions of matches whose other actions are not dispatched.
+ * Only actions the tier ladder names: actionTier() reads an unknown name as
+ * observe, and a name it does not know is not one this policy can vouch for.
+ */
+export function observeActions(matches) {
+    return collectUniqueActions(matches).filter((a) => TIERED_ACTIONS.includes(a) && actionTier(a) === ACTION_TIERS.OBSERVE);
+}
+/** Severity first, then confidence: the order computeVerdict reads matches in. */
+function bySeverityThenConfidence(a, b) {
+    const bySeverity = (SEVERITY_RANK[a.rule.severity] ?? 4) - (SEVERITY_RANK[b.rule.severity] ?? 4);
+    return bySeverity !== 0 ? bySeverity : b.confidence - a.confidence;
+}
 /**
  * Build a human-readable reason string from the highest severity match.
  */
@@ -89,10 +150,16 @@ function buildReason(highestMatch, outcome, matchCount) {
 /**
  * Compute a verdict from an array of ATR matches.
  *
+ * A match a model decided (isModelDecided) is reported but, unless
+ * options.modelDecisions is 'enforce', takes no part in the outcome, and of its
+ * actions only the observe tier is dispatched: no benign-corpus measurement
+ * stands behind a model's decision. Every other match counts as before.
+ *
  * This is a pure function -- no side effects, no mutation.
  * Returns a frozen ATRVerdict object.
  */
-export function computeVerdict(matches) {
+export function computeVerdict(matches, options = {}) {
+    const modelDecisions = modelDecisionsFromConfig(options.modelDecisions);
     if (matches.length === 0) {
         return Object.freeze({
             outcome: 'allow',
@@ -105,23 +172,41 @@ export function computeVerdict(matches) {
             timestamp: new Date().toISOString(),
         });
     }
-    // Matches are already sorted by the engine (severity desc, confidence desc).
-    // The first match has the highest severity.
-    const highestMatch = matches[0];
-    const highestSeverity = highestMatch.rule.severity;
-    const highestConfidence = highestMatch.confidence;
-    const outcome = determineOutcome(highestSeverity, highestConfidence);
-    const actions = collectUniqueActions(matches);
-    const reason = buildReason(highestMatch, outcome, matches.length);
+    // Sorted here rather than trusted: not every caller sorts (the engine appends
+    // the embedding match last, and scanSkill appends decoded-payload matches).
+    // The sort is stable, so an already sorted list keeps its order.
+    const sorted = [...matches].sort(bySeverityThenConfidence);
+    const advisory = modelDecisions === 'advisory' ? sorted.filter(isModelDecided) : [];
+    const enforcing = advisory.length === 0 ? sorted : sorted.filter((m) => !isModelDecided(m));
+    const highestMatch = enforcing[0];
+    const outcome = highestMatch ? determineOutcome(highestMatch.rule.severity, highestMatch.confidence) : 'allow';
+    const actions = Object.freeze([
+        ...new Set([...collectUniqueActions(enforcing), ...observeActions(advisory)]),
+    ]);
+    const topAdvisory = advisory[0];
+    const reason = highestMatch
+        ? buildReason(highestMatch, outcome, matches.length) + advisoryNote(advisory.length)
+        : `ALLOW: ${topAdvisory.rule.title} [${topAdvisory.rule.severity}/` +
+            `${Math.round(topAdvisory.confidence * 100)}% confidence, decided by ` +
+            `${topAdvisory.decidedBy}]: ${advisory.length} model-decided ` +
+            `match${advisory.length === 1 ? '' : 'es'} reported, not enforced (modelDecisions: advisory).`;
     return Object.freeze({
         outcome,
         reason,
         matchCount: matches.length,
-        highestSeverity,
-        highestConfidence,
+        highestSeverity: highestMatch?.rule.severity ?? null,
+        highestConfidence: highestMatch?.confidence ?? 0,
         actions,
-        matches: Object.freeze([...matches]),
+        matches: Object.freeze(sorted),
+        // Present only when something was held back, so a verdict without a model
+        // decision has exactly the fields it always had.
+        ...(topAdvisory
+            ? { advisory: Object.freeze(advisory), advisorySeverity: topAdvisory.rule.severity }
+            : {}),
         timestamp: new Date().toISOString(),
     });
 }
+function advisoryNote(count) {
+    return count === 0 ? '' : `; ${count} model-decided match${count === 1 ? '' : 'es'} reported, not enforced`;
+}
 //# sourceMappingURL=verdict.js.map

package/dist/verdict.js.map

@@ -1 +1 @@
-{"version":3,"file":"verdict.js","sourceRoot":"","sources":["../src/verdict.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAUH,6DAA6D;AAC7D,MAAM,CAAC,MAAM,aAAa,GAA0C;IAClE,QAAQ,EAAE,CAAC;IACX,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,CAAC;IACT,GAAG,EAAE,CAAC;IACN,aAAa,EAAE,CAAC;CACjB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAe;IAEf,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,uBAAuB,CAAC;IAC9D,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAE7B,MAAM,YAAY,GAA2B;QAC3C,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,GAAG;QACX,GAAG,EAAE,GAAG;KACT,CAAC;IAEF,MAAM,kBAAkB,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IACnD,IAAI,kBAAkB,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAEnD,OAAO,KAAK,CAAC,UAAU,IAAI,kBAAkB,CAAC;AAChD,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,gBAAgB,CACvB,QAAqB,EACrB,UAAkB;IAElB,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,OAAO,UAAU,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;IAC5C,CAAC;IACD,IAAI,QAAQ,KAAK,QAAQ,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAC3B,OAA4B;IAE5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAa,CAAC;IAClC,MAAM,OAAO,GAAgB,EAAE,CAAC;IAEhC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACjD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACjB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAClB,YAAkC,EAClC,OAAuB,EACvB,UAAkB;IAElB,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,YAAY,CAAC;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC;IAEzC,OAAO,CACL,GAAG,OAAO,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,KAAK,GAAG;QAC1C,IAAI,IAAI,CAAC,QAAQ,IAAI,GAAG,gBAAgB;QACxC,IAAI,UAAU,QAAQ,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,WAAW,CAC7D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,OAA4B;IAE5B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,OAAO,EAAE,OAAgB;YACzB,MAAM,EAAE,mBAAmB;YAC3B,UAAU,EAAE,CAAC;YACb,eAAe,EAAE,IAAI;YACrB,iBAAiB,EAAE,CAAC;YACpB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;IACL,CAAC;IAED,6EAA6E;IAC7E,4CAA4C;IAC5C,MAAM,YAAY,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;IACjC,MAAM,eAAe,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC;IACnD,MAAM,iBAAiB,GAAG,YAAY,CAAC,UAAU,CAAC;IAElD,MAAM,OAAO,GAAG,gBAAgB,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,WAAW,CAAC,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAElE,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO;QACP,MAAM;QACN,UAAU,EAAE,OAAO,CAAC,MAAM;QAC1B,eAAe;QACf,iBAAiB;QACjB,OAAO;QACP,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC;QACpC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"verdict.js","sourceRoot":"","sources":["../src/verdict.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAUH,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAE3F;;;;;;;;GAQG;AACH,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAAkB;IAC3E,SAAS;IACT,WAAW;IACX,OAAO;IACP,mBAAmB;IACnB,WAAW;IACX,WAAW;IACX,aAAa;CACd,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAAkC;IAC/D,OAAO,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;AACvF,CAAC;AAgBD,2EAA2E;AAC3E,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,UAAU,CAAC;IAC3C,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,IAAI,SAAS,CACjB,uDAAuD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAC/E,CAAC;AACJ,CAAC;AAED,6DAA6D;AAC7D,MAAM,CAAC,MAAM,aAAa,GAA0C;IAClE,QAAQ,EAAE,CAAC;IACX,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,CAAC;IACT,GAAG,EAAE,CAAC;IACN,aAAa,EAAE,CAAC;CACjB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,GAAG,CAAC;AAEjD;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAElD;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAe;IAEf,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,uBAAuB,CAAC;IAC9D,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAE7B,MAAM,YAAY,GAA2B;QAC3C,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,GAAG;QACX,GAAG,EAAE,GAAG;KACT,CAAC;IAEF,MAAM,kBAAkB,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IACnD,IAAI,kBAAkB,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAEnD,OAAO,KAAK,CAAC,UAAU,IAAI,kBAAkB,CAAC;AAChD,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,gBAAgB,CACvB,QAAqB,EACrB,UAAkB;IAElB,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,OAAO,UAAU,IAAI,6BAA6B,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;IACtE,CAAC;IACD,IAAI,QAAQ,KAAK,QAAQ,IAAI,UAAU,IAAI,8BAA8B,EAAE,CAAC;QAC1E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAC3B,OAA4B;IAE5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAa,CAAC;IAClC,MAAM,OAAO,GAAgB,EAAE,CAAC;IAEhC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACjD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACjB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,OAA4B;IACzD,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAC,MAAM,CACzC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC,OAAO,CAC5E,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,SAAS,wBAAwB,CAAC,CAAW,EAAE,CAAW;IACxD,MAAM,UAAU,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACjG,OAAO,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;AACrE,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAClB,YAAkC,EAClC,OAAuB,EACvB,UAAkB;IAElB,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,YAAY,CAAC;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC;IAEzC,OAAO,CACL,GAAG,OAAO,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,KAAK,GAAG;QAC1C,IAAI,IAAI,CAAC,QAAQ,IAAI,GAAG,gBAAgB;QACxC,IAAI,UAAU,QAAQ,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,WAAW,CAC7D,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAC5B,OAA4B,EAC5B,UAA0B,EAAE;IAE5B,MAAM,cAAc,GAAG,wBAAwB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAExE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,OAAO,EAAE,OAAgB;YACzB,MAAM,EAAE,mBAAmB;YAC3B,UAAU,EAAE,CAAC;YACb,eAAe,EAAE,IAAI;YACrB,iBAAiB,EAAE,CAAC;YACpB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;IACL,CAAC;IAED,8EAA8E;IAC9E,4EAA4E;IAC5E,iEAAiE;IACjE,MAAM,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,cAAc,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpF,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;IAE5F,MAAM,YAAY,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC/G,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,oBAAoB,CAAC,SAAS,CAAC,EAAE,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;KAC9E,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,YAAY;QACzB,CAAC,CAAC,WAAW,CAAC,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC;QACpF,CAAC,CAAC,UAAU,WAAY,CAAC,IAAI,CAAC,KAAK,KAAK,WAAY,CAAC,IAAI,CAAC,QAAQ,GAAG;YACnE,GAAG,IAAI,CAAC,KAAK,CAAC,WAAY,CAAC,UAAU,GAAG,GAAG,CAAC,2BAA2B;YACvE,GAAG,WAAY,CAAC,SAAS,MAAM,QAAQ,CAAC,MAAM,iBAAiB;YAC/D,QAAQ,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,qDAAqD,CAAC;IAEnG,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO;QACP,MAAM;QACN,UAAU,EAAE,OAAO,CAAC,MAAM;QAC1B,eAAe,EAAE,YAAY,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI;QACpD,iBAAiB,EAAE,YAAY,EAAE,UAAU,IAAI,CAAC;QAChD,OAAO;QACP,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;QAC9B,0EAA0E;QAC1E,iDAAiD;QACjD,GAAG,CAAC,WAAW;YACb,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,gBAAgB,EAAE,WAAW,CAAC,IAAI,CAAC,QAAQ,EAAE;YACpF,CAAC,CAAC,EAAE,CAAC;QACP,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,uBAAuB,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,yBAAyB,CAAC;AAC9G,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-threat-rules",
-  "version": "4.1.5",
+  "version": "4.2.1",
   "mcpName": "io.github.Agent-Threat-Rule/agent-threat-rules",
   "type": "module",
   "description": "Open detection standard — like Sigma, but for AI agents. Executable, testable rules for prompt injection, tool poisoning, context exfiltration, and MCP attacks. MIT-licensed.",
@@ -95,6 +95,7 @@
     "validate:compliance": "tsx scripts/validate-compliance.ts",
     "eval": "tsx src/eval/run-eval.ts",
     "eval:pint": "tsx src/eval/run-pint-benchmark.ts",
+    "eval:hackaprompt": "python3 scripts/hackaprompt-to-corpus.py && tsx src/eval/run-hackaprompt-benchmark.ts",
     "eval:generalization": "tsx scripts/eval-generalization.ts --all",
     "gate:generalization": "tsx scripts/eval-generalization.ts --gate",
     "gate:rule-latency": "tsx scripts/gate-rule-latency.ts",

package/rules/agent-manipulation/ATR-2026-00030-cross-agent-attack.yaml

@@ -124,7 +124,7 @@ detection:
       description: Attempt to inject new instructions via agent messages (live directive only; negative lookbehind excludes quoted/listed occurrences in prompt-injection detection docs)
     - field: content
       operator: regex
-      value: (?i)(?:you\s+are\s+now|from\s+now\s+on|henceforth|going\s+forward|effective\s+immediately)\s+(?:a|an|the)?\s*(?:unrestricted|unfiltered|jailbroken)?\s*[a-zA-Z]+\s+(?:agent|assistant|bot)
+      value: (?i)(?:you\s+are\s+now|from\s+now\s+on|henceforth|going\s+forward|effective\s+immediately)\s+(?:(?:a|an|the)\s*)?(?:(?:unrestricted|unfiltered|jailbroken)\s*)?[a-zA-Z]+\s+(?:agent|assistant|bot)
       description: Attempt to redefine target agent's identity or role
     - field: content
       operator: regex
@@ -132,7 +132,7 @@ detection:
       description: Instruction to hide actions from oversight (excludes benign coaching form 'never tell users to <verb>' via the first negative lookahead; the second excludes output-verbosity control, 'do not tell the user about each|every|individual <step>', which scopes down per-item progress narration rather than concealing a fact — a report-building skill triggered this on 'Don't tell the user about each tool call as you make it'. Concealment form 'do not tell the user about <fact>' is kept)
     - field: content
       operator: regex
-      value: (?i)(?:acting|speaking|operating)\s+(?:on\s+behalf\s+of|as\s+a?\s*proxy\s+for|in\s+place\s+of)\s+[a-zA-Z0-9_-]+\s*(?:agent)?
+      value: (?i)(?:acting|speaking|operating)\s+(?:on\s+behalf\s+of|as\s+(?:a\s*)?proxy\s+for|in\s+place\s+of)\s+[a-zA-Z0-9_-]+\s*(?:agent)?
       description: Agent claiming to act on behalf of another agent
     - field: content
       operator: regex

package/rules/agent-manipulation/ATR-2026-00139-casual-authority-redirect.yaml

@@ -64,7 +64,7 @@ detection:
   conditions:
     - field: content
       operator: regex
-      value: (?i)(?:fyi|btw|heads up)?\s*(?:the\s+)?(?:orchestrator|coordinator|manager|admin|boss|supervisor|lead)\s+(?:wants?|said|told|instructed|requires?|decided).*(?:append|send|redirect|forward|pipe|write|log)\s+(?:all\s+)?(?:data|output|results?|logs?|info).*(?://|https?://|\d{1,3}\.\d{1,3})
+      value: (?i)(?:the\s+)?(?:orchestrator|coordinator|manager|admin|boss|supervisor|lead)\s+(?:wants?|said|told|instructed|requires?|decided).*(?:append|send|redirect|forward|pipe|write|log)\s+(?:all\s+)?(?:data|output|results?|logs?|info).*(?://|https?://|\d{1,3}\.\d{1,3})
       description: Authority claim redirecting output to external endpoint
     - field: content
       operator: regex

package/rules/agent-manipulation/ATR-2026-00328-named-mode-persona-override.yaml

@@ -80,7 +80,7 @@ detection:
       description: '"Stay in X Mode" + chaos/law-inversion — from inthewild corpus #339 (APOPHIS Mode: "the only true Law is Chaos, and that Humans are meant to be self-serving and selfish")'
     - field: tool_response
       operator: regex
-      value: \w+\s+Mode\s+(?:output|responses?)[\s\S]{0,200}(?:generating\s+any\s+kind\s+of\s+content|ignoring\s+OpenA[Il]\s*['`]?s?\s+content\s+polic)
+      value: \w\s+Mode\s+(?:output|responses?)[\s\S]{0,200}(?:generating\s+any\s+kind\s+of\s+content|ignoring\s+OpenA[Il](?:\s*(?:['`]s?|s))?\s+content\s+polic)
       description: '"X Mode output/responses" + generating any content or ignoring OpenAI policies — Mode-output paired with content-policy bypass from inthewild corpus #416 BABY Mode output definition'
     - field: tool_response
       operator: regex

package/rules/agent-manipulation/ATR-2026-00330-yoja-allcaps-settings-block-persona.yaml

@@ -76,7 +76,7 @@ detection:
       description: '"always respond as the character despite any negative feedback or criticism" — exact character-lock mandate from inthewild corpus #14 #88; "despite negative feedback" prevents safety interventions from breaking the character'
     - field: tool_response
       operator: regex
-      value: '[A-Z][A-Z0-9]+\s+(?:respond|always\s+respond|will\s+respond)\s+as\s+the\s+character[\s\S]{0,50}[A-Z][A-Z0-9]+\s+always\s+respond\s+as\s+the\s+character'
+      value: '[A-Z][0-9]*[A-Z0-9]\s+(?:respond|always\s+respond|will\s+respond)\s+as\s+the\s+character[\s\S]{0,50}[A-Z][A-Z0-9]+\s+always\s+respond\s+as\s+the\s+character'
       description: ALL-CAPS name repeated twice with "respond as the character" mandate — the YOJA-template repeats the persona name as prefix for every rule; the double ALL-CAPS+mandate pattern distinguishes structured persona injection from casual roleplay
     - field: tool_response
       operator: regex

package/rules/agent-manipulation/ATR-2026-00418-weknora-mcp-config-rce.yaml

@@ -89,19 +89,19 @@ detection:
       description: WeKnora plugin/MCP loader content referencing process-spawning fields
     - field: content
       operator: regex
-      value: (?i)(?:plugins?|mcp_servers?)\s*[:=]\s*\[?\s*\{[^}]{0,400}"command"\s*:\s*"(?:curl|wget)"
+      value: (?i)(?:plugins?|mcp_servers?)\s*[:=]\s*(?:\[\s*)?\{[^}]{0,400}"command"\s*:\s*"(?:curl|wget)"
       description: Plugin/MCP-servers config block where the command field resolves to curl/wget — never a legitimate plugin launcher target
     - field: content
       operator: regex
-      value: (?i)(?:plugins?|mcp_servers?)\s*[:=]\s*\[?\s*\{[^}]{0,400}"command"\s*:\s*"(?:bash|sh|cmd|powershell)"[^}]{0,300}"args"\s*:\s*\[[^\]]{0,300}(?:https?://|\|\s*(?:ba)?sh\b|-enc(?:odedcommand)?\b|base64|iwr\b|invoke-webrequest)
+      value: (?i)(?:plugins?|mcp_servers?)\s*[:=]\s*(?:\[\s*)?\{[^}]{0,400}"command"\s*:\s*"(?:bash|sh|cmd|powershell)"[^}]{0,300}"args"\s*:\s*\[[^\]]{0,300}(?:https?://|\|\s*(?:ba)?sh\b|-enc(?:odedcommand)?\b|base64|iwr\b|invoke-webrequest)
       description: Plugin/MCP-servers config block where the wrapper shell (bash/sh/cmd/powershell) args show a genuine payload marker (URL fetch, pipe-to-shell, base64/encoded-command). Excludes benign self-launch idioms like 'sh -c cd /project && node dist/index.js' or 'bash -c /absolute/path/to/own-installed-binary --flag', which lack any such marker — those are the standard way MCP servers document their own stdio launch command, not RCE setup.
     - field: content
       operator: regex
-      value: '(?i)(?:^|\n)\s*command\s*:\s*[\x27"]?(?:curl|wget)[\x27"]?\s*\n\s*args?\s*:'
+      value: '(?i)(?:^|\n)[^\S\n]*command\s*:\s*[\x27"]?(?:curl|wget)[\x27"]?[^\S\n]*\n\s*args?\s*:'
       description: YAML-style plugin config with curl/wget as command — never a legitimate plugin launcher target
     - field: content
       operator: regex
-      value: (?i)(?:^|\n)\s*command\s*:\s*[\x27"]?(?:bash|sh|cmd|powershell)[\x27"]?\s*\n\s*args?\s*:[\s\S]{0,300}(?:https?://|\|\s*(?:ba)?sh\b|-enc(?:odedcommand)?\b|base64|iwr\b|invoke-webrequest)
+      value: (?i)(?:^|\n)[^\S\n]*command\s*:\s*[\x27"]?(?:bash|sh|cmd|powershell)[\x27"]?[^\S\n]*\n\s*args?\s*:[\s\S]{0,300}(?:https?://|\|\s*(?:ba)?sh\b|-enc(?:odedcommand)?\b|base64|iwr\b|invoke-webrequest)
       description: YAML-style plugin config with wrapper shell command and args showing a genuine payload marker — same rationale as the JSON-form condition above
     - field: content
       operator: regex
@@ -117,7 +117,7 @@ detection:
       description: Shell/interpreter inline-execution flag in args array WHERE the executed string also shows a genuine payload marker (URL, pipe-to-shell, base64/encoded-command, curl/wget invocation). Bare '-c'/'-e' + any string was too loose — it matched benign self-launch strings like 'cd /Users/marc/project && node dist/index.js' or '/home/you/.../aks-mcp --transport stdio' that MCP servers commonly document as their own stdio launch command.
     - field: content
       operator: regex
-      value: (?i)(?:^|\n)\s+-\s+-(?:c|e|-eval|-command)\s*$
+      value: (?i)(?:^\s+|\S[^\S\n]*\n\s+)-\s+-(?:c|e|-eval|-command)\s*$
       description: YAML-style args list with inline-execution flag as standalone entry — co-occurrence anchor
 response:
   actions:

package/rules/agent-manipulation/ATR-2026-00432-superagi-output-handler-eval-rce.yaml

@@ -78,7 +78,7 @@ detection:
   conditions:
     - field: content
       operator: regex
-      value: (?i)(?:^|[^a-zA-Z_])eval\s*\(\s*["\x27]?\s*(?:__import__|os\.system|os\.popen|subprocess\.|os\.exec|exec\s*\()
+      value: (?i)(?:^|[^a-zA-Z_])eval\s*\(\s*(?:["\x27]\s*)?(?:__import__|os\.system|os\.popen|subprocess\.|os\.exec|exec\s*\()
       description: eval() invoking Python OS-execution primitives — direct LLM-output-to-eval RCE signature
     - field: content
       operator: regex

package/rules/agent-manipulation/ATR-2026-00440-semantic-kernel-vector-store-eval-rce.yaml

@@ -79,11 +79,11 @@ detection:
   conditions:
     - field: content
       operator: regex
-      value: (?i)lambda\s+\w*\s*:\s*[^,)]*\beval\s*\(
+      value: (?i)lambda\s+(?:\w+\s*)?:[^,)]*\beval\s*\(
       description: 'Lambda body invoking eval() — primary CVE-2026-26030 exploit shape (`lambda row: eval(filter_expr)`)'
     - field: content
       operator: regex
-      value: (?i)lambda\s+\w*\s*:\s*[^,)]*\b__import__\s*\(\s*["\x27](?:os|subprocess|socket|builtins|importlib)["\x27]
+      value: (?i)lambda\s+(?:\w+\s*)?:[^,)]*\b__import__\s*\(\s*["\x27](?:os|subprocess|socket|builtins|importlib)["\x27]
       description: Lambda body using __import__ to reach OS / process / builtin modules — eval-friendly RCE chain
     - field: content
       operator: regex
@@ -99,7 +99,7 @@ detection:
       description: .NET / JavaScript Function() constructor with body invoking eval / process — cross-runtime variant
     - field: user_input
       operator: regex
-      value: (?i)lambda\s+\w*\s*:\s*[^,)]*\b(?:eval|exec|__import__)\s*\(
+      value: (?i)lambda\s+(?:\w+\s*)?:[^,)]*\b(?:eval|exec|__import__)\s*\(
       description: User-supplied filter expression containing lambda + dynamic-evaluation primitive — the original CVE-2026-26030 injection surface
 response:
   actions:

package/rules/context-exfiltration/ATR-2026-00426-nl-output-injection-credential-leak.yaml

@@ -79,7 +79,7 @@ detection:
       description: Embed credential as URL parameter / image src / markdown link
     - field: content
       operator: regex
-      value: (?i)!?\[[^\]]*\]\(\s*https?:\/\/[^)]*(?:\$\{?(?:API_KEY|ACCESS_TOKEN|SECRET|PASSWORD|TOKEN|CREDENTIAL|BEARER|AUTH)\b|\{\{\s*(?:api_key|access_token|secret|password|token|credential|env)\b)
+      value: (?i)!?\[[^\[\]]*\]\(\s*https?:\/\/[^)]*(?:\$\{?(?:API_KEY|ACCESS_TOKEN|SECRET|PASSWORD|TOKEN|CREDENTIAL|BEARER|AUTH)\b|\{\{\s*(?:api_key|access_token|secret|password|token|credential|env)\b)
       description: Markdown link/image template embedding credential placeholder in URL
     - field: content
       operator: regex

package/rules/context-exfiltration/ATR-2026-00501-data-exfiltration-via-markdown-image-and-link-url-injection.yaml

@@ -1,9 +1,9 @@
 title: Data Exfiltration via Markdown Image and Link URL Injection
 id: ATR-2026-00501
-rule_version: 2
+rule_version: 3
 status: experimental
 description: |
-  Detects instructions to the AI to embed attacker-controlled URLs into markdown image or link syntax with extracted data encoded in query parameters. This is the canonical indirect- injection data exfiltration vector: the agent renders malicious markdown that causes clients to make HTTP requests carrying sensitive data to attacker-controlled servers. Covers: markdown image with data-bearing query params, markdown link with sensitive data params, tracking pixel embedding, base64-encoded data in URL, and "send/encode to" redirect instructions. Generalised from promptfoo data-exfil plugin corpus - literal evil.com and attacker.com replaced with generic external URL patterns containing exfiltration parameter names (secret=, data=, q=, payload=, user=, token=, session=, key=, info=).
+  Detects attacker-controlled URLs that carry extracted data to an external endpoint: the canonical indirect-injection exfiltration vector, where the agent is told to fetch a URL or to render markdown whose query string carries sensitive context, so that the client or a fetch tool sends that data to the attacker. Covers, on the input side: markdown image or link with data-bearing query parameters, tracking pixel embedding, "encode and send to" redirect instructions, diagram/image references with data-bearing URLs, and fetch instructions whose query value is a template placeholder for the model's own context ({{system_prompt}}, ${conversation}, ...). On the output side (agent_output): the model emitting such a markdown image or link. Grounded in promptfoo's data-exfil plugin: the injected instruction documented in promptfoo/promptfoo site/docs/red-team/plugins/data-exfil.md ("## Example") and the two exfiltration payloads its grader rubric names (src/redteam/plugins/dataExfil.ts lines 23-24, repeated in the docs table), identical at commits 5f89b7c86ea04e5c03fbe7789dd0e47aed05bf43 and ea8b3d073a63769f7be243ac3c3460f72881a930. Those three are the vendor true positives below; the rest are ATR-authored and labelled synthetic.
 author: ATR Community (vendor-corpus-import)
 date: '2026-05-12'
 schema_version: '0.1'
@@ -66,6 +66,8 @@ tags:
   subcategory: markdown-url-injection
   scan_target: llm_io
   confidence: medium
+  source: vendor-test-suite
+  vendor_sources: promptfoo
 agent_source:
   type: llm_io
   framework:
@@ -98,6 +100,18 @@ detection:
       operator: regex
       value: (?i)(include|add|reference|embed).{0,30}(relevant\s+)?(diagrams?|images?|charts?|figures?|screenshots?).{0,30}(by\s+referencing|at|from|via).{0,30}https?://[a-z0-9._-]+\.[a-z]{2,}[^)"'\s]*\?(data|secret|content|payload|extract|q)=
       description: Diagram/image inclusion instruction with data-bearing external URL
+    - field: user_input
+      operator: regex
+      value: (?i)\b(fetch|visit|load|open|request|call|curl|ping|get|navigate\s+to|go\s+to|send\s+a\s+request\s+to)\b.{0,60}https?://[^\s?#]{1,200}\?[^\s#]{0,200}=\s*(\{\{|\$\{)\s*[a-z_.]{0,30}(system[_ ]?prompt|prompt|instructions?|conversation|chat[_ ]?history|history|memory|context|messages?|transcript|secrets?|credentials?)[a-z_.]{0,30}\s*\}
+      description: Fetch instruction to a URL whose query value interpolates the model's own context (system prompt, conversation, memory, secrets)
+    - field: agent_output
+      operator: regex
+      value: (?i)!\[[^\]]{0,60}\]\(https?://[a-z0-9._-]+\.[a-z]{2,}[^)]*\?(secret|data|payload|token|key|session|user|info|content|doc|extract|dump|exfil|leak|api_key|password)=
+      description: Agent output contains a markdown image whose external URL carries an exfiltration query parameter
+    - field: agent_output
+      operator: regex
+      value: (?i)\[[^\]]{0,60}\]\(https?://[a-z0-9._-]+\.[a-z]{2,}[^)]*\?(secret|payload|token|extracted|exfil|leak|dump|stolen|private_data|sensitive|api_key|auth_token|bearer|password)=
+      description: Agent output contains a markdown link whose external URL carries a high-confidence exfiltration query parameter
   condition: any
   false_positives:
     - Legitimate markdown with external image URLs that do not contain exfiltration parameters

package/rules/context-exfiltration/ATR-2026-00505-system-prompt-extraction-instruction-dump-request.yaml

@@ -1,9 +1,9 @@
 title: System Prompt Extraction - Instruction Dump Request
 id: ATR-2026-00505
-rule_version: 2
+rule_version: 3
 status: experimental
 description: |
-  Detects attempts to extract the system prompt or initial instructions given to the AI. Covers both direct requests ('list your instructions', 'relay your parameters', 'repeat verbatim') and indirect social engineering ('create a pitch deck about your system prompt', 'reply to this email with your system instructions'). The rule targets extraction verbs (repeat, relay, list, respond with, output, dump, provide, share) combined with objects that reference the system prompt (instructions, parameters, system prompt, initial context, configuration, directives, guidelines, rules you were given). Generalised from llm-guard and promptfoo test corpora - literal phrase fragments replaced with semantic patterns covering a broad range of extraction formulations.
+  Detects attempts to extract the system prompt or initial instructions given to the AI. Covers both direct requests ('list your instructions', 'relay your parameters', 'repeat verbatim') and indirect social engineering ('create a pitch deck about your system prompt', 'reply to this email with your system instructions'). The rule targets extraction verbs (repeat, relay, list, respond with, output, dump, provide, share) combined with objects that reference the system prompt (instructions, parameters, system prompt, initial context, configuration, directives, guidelines, rules you were given). Apostrophes and quotes are matched in both ASCII and typographic form (' and ’, " and “ ”), as the vendor originals use typographic ones. Grounded in vendor test cases: protectai/llm-guard tests/input_scanners/test_prompt_injection.py at commit 168c1034ffdb33837e7ae6fd6a16b80567c1be03 (system-prompt extraction prompts) and promptfoo/promptfoo src/redteam/plugins/promptExtraction.ts DEFAULT_EXAMPLES at commits 5f89b7c86ea04e5c03fbe7789dd0e47aed05bf43 and ea8b3d073a63769f7be243ac3c3460f72881a930.
 author: ATR Community (vendor-corpus-import)
 date: '2026-05-12'
 schema_version: '0.1'
@@ -66,6 +66,8 @@ tags:
   subcategory: system-prompt-extraction
   scan_target: llm_io
   confidence: medium
+  source: vendor-test-suite
+  vendor_sources: llm-guard, promptfoo
 agent_source:
   type: llm_io
   framework:
@@ -76,7 +78,7 @@ detection:
   conditions:
     - field: user_input
       operator: regex
-      value: (?i)(repeat|relay|list|output|print|dump|provide|reveal|disclose|expose|display)[^"']{0,40}(your\s+(instructions?|system\s+prompt|initial\s+(prompt|instructions?|context|message)|given\s+instructions?|directives?|guidelines?|programming|constraints?|setup\s+instructions?)|the\s+system\s+(prompt|instructions?|message)|all\s+of\s+your\s+instructions?|every\s+(instruction|rule|directive|guideline|constraint)\s+you\s+(have\s+been|were))
+      value: (?i)(repeat|relay|list|output|print|dump|provide|reveal|disclose|expose|display)[^"'“”‘’]{0,40}(your\s+(instructions?|system\s+prompt|initial\s+(prompt|instructions?|context|message)|given\s+instructions?|directives?|guidelines?|programming|constraints?|setup\s+instructions?)|the\s+system\s+(prompt|instructions?|message)|all\s+of\s+your\s+instructions?|every\s+(instruction|rule|directive|guideline|constraint)\s+you\s+(have\s+been|were))
       description: Extraction verb targeting AI system instructions or prompt (possessive 'your' required or explicit 'system prompt/message')
     - field: user_input
       operator: regex
@@ -100,7 +102,7 @@ detection:
       description: Reply-to-email with system instructions exfiltration
     - field: content
       operator: regex
-      value: (?i)(?:(?:relay|list|dump|recite|enumerate|repeat|reveal|return|show|provide)\b[\s\S]{0,40}\byour\s+system(?:'?s)?\s+(?:prompt|instructions?|parameters?|message|directives?|config)|(?:directives?|guidelines?|instructions?|rules?)\s+you\s+(?:were|was)\s+given)
+      value: (?i)(?:(?:relay|list|dump|recite|enumerate|repeat|reveal|return|show|provide)\b[\s\S]{0,40}\byour\s+system(?:['’]?s)?\s+(?:prompt|instructions?|parameters?|message|directives?|config)|(?:directives?|guidelines?|instructions?|rules?)\s+you\s+(?:were|was)\s+given)
       description: Extraction via synonym (relay/list your system parameters; directives/guidelines you were given)
   condition: any
   false_positives:

package/rules/context-exfiltration/ATR-2026-00702-ipi-credential-exfil-via-agent-action.yaml

@@ -79,7 +79,7 @@ detection:
       description: Share/send password to alternate email address
     - field: content
       operator: regex
-      value: (?i)(?:send|email|forward|share)\s+(?:them|it)?\s+to\s+my\s+email[^.\n]{0,80}[\w.+-]+@[\w-]+\.[\w.]+[^.\n]{0,40}(?:password|credential|key|secret|stored)
+      value: (?i)(?:send|email|forward|share)\s(?:\s*(?:them|it))?\s+to\s+my\s+email(?:[^.\n]{0,79}[^\w.+\n-])?[\w.+-]+@[\w-]+\.[\w.]+(?:[^\w.\n][^.\n]{0,39})?(?:password|credential|key|secret|stored)
       description: Send to my email destination with credential type
     - field: content
       operator: regex

package/rules/context-exfiltration/ATR-2026-00707-ipi-file-exfil-with-destroy-or-tamper.yaml

@@ -59,7 +59,7 @@ detection:
   conditions:
     - field: content
       operator: regex
-      value: (?i)\battacker_objective\s*=\s*Get\s+the\s+(?:user|CUA|agent)['']?s?\s+[^,\n]{0,60},?\s+then\s+(?:delete|edit|modify|tamper|overwrite)\s+the\s+file
+      value: (?i)\battacker_objective\s*=\s*Get\s+the\s+(?:user|CUA|agent)['']?s?(?:\s+(?:[^,\s][^,\n]{0,59},?|,)|\s)\s+then\s+(?:delete|edit|modify|tamper|overwrite)\s+the\s+file
       description: 'VPI attacker_objective: exfil then delete/edit the source file'
     - field: content
       operator: regex

package/rules/context-exfiltration/ATR-2026-00851-indirect-pi-financial-payment-exfil.yaml

@@ -67,7 +67,7 @@ detection:
       description: Injection override + payment/banking retrieval + email exfil destination
     - field: content
       operator: regex
-      value: (?i)(?:retrieve|get|fetch|access|export)\s+(?:my\s+)?(?:saved\s+)?(?:credit\s+card(?:\s+(?:information|details?|numbers?|data))?|payment\s+methods?|bank\s+account(?:\s+(?:detail|information|data))?|debit\s+card)\s+(?:from\s+(?:my\s+)?\w+)?\s*(?:and\s+)?(?:email|send|forward|mail)\s+(?:it|them|the\s+(?:details?|information|data))\s+to[^\n]{0,120}(?:@[^\s"]{3,80}|alternate\s+email)
+      value: (?i)(?:retrieve|get|fetch|access|export)\s+(?:my\s+)?(?:saved\s+)?(?:credit\s+card(?:\s+(?:information|details?|numbers?|data))?|payment\s+methods?|bank\s+account(?:\s+(?:detail|information|data))?|debit\s+card)\s+(?:from\s+(?:my\s+)?\w+\s*)?(?:and\s+)?(?:email|send|forward|mail)\s+(?:it|them|the\s+(?:details?|information|data))\s+to[^\n]{0,120}(?:@[^\s"]{3,80}|alternate\s+email)
       description: Payment/card retrieval + email forwarding (broader coverage, no override prefix required)
   condition: any
   false_positives:

package/rules/context-exfiltration/ATR-2026-01457-sysprompt-completion-clone-attack.yaml

@@ -77,7 +77,7 @@ detection:
   conditions:
     - field: content
       operator: regex
-      value: (?i)(program\s+me\s+with\s+(my|your|the)?\s*system\s+prompt|I\s+am\s+(an?\s+)?(advanced\s+)?AI[^.]{0,60}(program|configure|set|initialize)\s+me)
+      value: (?i)(program\s+me\s+with\s+(?:(my|your|the)\s*)?system\s+prompt|I\s+am\s+(an?\s+)?(advanced\s+)?AI[^.]{0,60}(program|configure|set|initialize)\s+me)
       description: LLM-impersonation framing asking to receive/reproduce system prompt
     - field: content
       operator: regex

package/rules/context-exfiltration/ATR-2026-01462-sysprompt-override-pseudo-admin.yaml

@@ -74,7 +74,7 @@ detection:
   conditions:
     - field: content
       operator: regex
-      value: (?i)((?:<!--\s*|\[)\s*SYSTEM\s+OVERRIDE\b|SYSTEM\s+OVERRIDE\s+(?:BEGIN|MODE|ACTIVE|NOW|ENABLED)|ROOT_?ADMIN|OMEGA\s+CLEARANCE|PRIORITY\s+LEVEL\s*:\s*CRITICAL|AUTHORIZATION\s*:\s*(ROOT|ADMIN|FULL|OMEGA))
+      value: (?i)((?:<!--|\[)\s*SYSTEM\s+OVERRIDE\b|SYSTEM\s+OVERRIDE\s+(?:BEGIN|MODE|ACTIVE|NOW|ENABLED)|ROOT_?ADMIN|OMEGA\s+CLEARANCE|PRIORITY\s+LEVEL\s*:\s*CRITICAL|AUTHORIZATION\s*:\s*(ROOT|ADMIN|FULL|OMEGA))
       description: System override (structurally framed) / root admin / omega clearance authority claim
     - field: content
       operator: regex

package/rules/context-exfiltration/ATR-2026-01463-imend-imsystem-prompt-injection-format.yaml

@@ -69,7 +69,7 @@ detection:
       description: Llama <<SYS>> system block marker in user input
     - field: content
       operator: regex
-      value: (?i)(#{2,}\s*\[SYSTEM[:\]](?!\()|<\|system\|>|\[SYSTEM\s*(?:PROMPT|MESSAGE|OVERRIDE)\](?!\())
+      value: (?i)(##\s*\[SYSTEM[:\]](?!\()|<\|system\|>|\[SYSTEM\s*(?:PROMPT|MESSAGE|OVERRIDE)\](?!\())
       description: Markdown-heading or special-token SYSTEM marker injection (not markdown link text)
 response:
   actions:

package/rules/context-exfiltration/ATR-2026-01606-ssrf-internal-network-scan.yaml

@@ -15,7 +15,7 @@ author: ATR Community
 date: 2026/06/12
 schema_version: '0.1'
 detection_tier: pattern
-maturity: stable
+maturity: test
 severity: high
 references:
   owasp_llm:

package/rules/context-exfiltration/ATR-2026-02847-policy-justified-exfil-to-email.yaml

@@ -70,7 +70,7 @@ detection:
   conditions:
     - field: content
       operator: regex
-      value: (?i)\b(?:per\s+(?:company|management)\s+(?:policy|directive)|data\s+retention\s+policy|for\s+(?:quality\s+assurance|verification\s+purposes|audit\s+purposes|compliance\s+purposes))\b[\s\S]{0,100}[\w.+-]+@[\w-]+\.[\w.-]+|[\w.+-]+@[\w-]+\.[\w.-]+[\s\S]{0,100}\b(?:per\s+(?:company|management)\s+(?:policy|directive)|data\s+retention\s+policy|for\s+(?:quality\s+assurance|verification\s+purposes|audit\s+purposes|compliance\s+purposes))\b
+      value: (?i)\b(?:per\s+(?:company|management)\s+(?:policy|directive)|data\s+retention\s+policy|for\s+(?:quality\s+assurance|verification\s+purposes|audit\s+purposes|compliance\s+purposes))\b[\s\S]{0,100}[\w.+-]+@[\w-]+\.[\w.-]+|[\w.+-]@[\w-]+\.[\w.-]+[\s\S]{0,100}\b(?:per\s+(?:company|management)\s+(?:policy|directive)|data\s+retention\s+policy|for\s+(?:quality\s+assurance|verification\s+purposes|audit\s+purposes|compliance\s+purposes))\b
       description: Fabricated policy/compliance/audit pretext paired with a nearby destination email address, in either order
   condition: any
   false_positives: