agent-threat-rules 4.2.0 → 4.2.1

package/CHANGELOG.md

@@ -4,6 +4,69 @@ All notable changes to ATR will be documented in this file.
 
 ## [Unreleased]
 
+## [4.2.1] - 2026-10-24
+
+A patch release of rule fixes and one new rule, plus two release-tooling
+fixes. The rule format, identifier scheme and Match output are unchanged.
+
+Default behaviour that changes:
+
+- ATR-2026-01601 (SQL injection with destructive DDL, maturity `stable`, so it
+  runs in the enforce lane) now also matches when whitespace separates the
+  single quote from the semicolon, as in `1' ; TRUNCATE TABLE accounts; --` and
+  `7' ; DELETE FROM sessions; --`, which it missed before. An integration that
+  blocks on the enforce lane blocks these too. Its benign false positives were
+  re-measured: none over the 14,172 samples of the benign gate (#748, issue
+  #620).
+
+### Added
+
+- **ATR-2026-02870: an invisible control before a directive in a tool
+  description or skill file.** A zero-width, soft-hyphen or bidi control
+  character at the start of a clause that tells the agent to ignore or
+  override instructions, send or read secrets, conversations or credential
+  files, or keep something from the user. Presence of the character alone
+  does not match, so soft hyphens in German, ZWNJ in Persian, LRM/RLM in Hebrew
+  and Arabic, emoji ZWJ sequences and a leading BOM stay clear. It reads
+  `tool_description`, so it runs in a `tools/list` scan, on `mcp_exchange`
+  events and on SKILL.md files. Maturity `test` (hunt and alert lanes). No
+  benign false positives on the gate corpora or on the 710 tool definitions in
+  `data/test-corpora/mcp-tools-list-benign/`, which contain no such characters,
+  so that last figure is weak evidence. A control inside a word, rather than at
+  the start of a clause, is ATR-2026-00276's case and not covered here (#749,
+  from issue #653 by @Paraphern).
+
+### Fixed
+
+- **ATR-2026-00040 and -00064 matched the wrong chmod modes.** Their chmod
+  condition matched the owner digit of `chmod 755 deploy.sh` or `chmod 700
+  ~/.ssh` and missed `chmod -R 777 /`. They now match a world-writable mode or
+  a setuid/setgid/sticky four-digit mode; with options such as `-R` before the
+  mode, only when the target is the root, a system directory or the home
+  directory, since `chmod -R 777` on an application subdirectory is documented
+  practice in the benign corpus. Group-writable modes are not matched. Both
+  rules are maturity `test` (#740, issue #735, from the probe in #658 by
+  @PHM-Audit).
+- **ATR-2026-00500, -00501 and -00505 are grounded in the vendor test cases
+  they cite.** 00500 and 00501 matched 1 and 0 of promptfoo's SSRF and
+  data-exfiltration test cases, and 00505 missed an llm-guard case with a
+  typographic apostrophe. They now match all of them (3 of 3, 3 of 3, 6 of 6),
+  their true positives that did not occur in any vendor repository were
+  replaced by verbatim vendor cases with repository, commit, file and line,
+  and -00503 and -00521 gained the vendor originals behind their shortened
+  samples. On the pinned vendor suites, hunt-lane recall goes from 97 to 100 of
+  126 attack cases; the ablation reference is unchanged (#709, measurement in
+  #750).
+- **ATR-2026-00223's samples use a documentation address** (203.0.113.30)
+  instead of an address from a real dropper. Detection is unchanged (#738).
+- **The release workflow commits the reconciled stats cache with the version
+  bump.** The 4.2.0 bump reached `main` with `data/stats.json` still at 4.1.5,
+  which failed CI on `main`; the published package was not affected (#746).
+- **The Gemara catalogs' first publish reads oras's "not found" as
+  unpublished.** The first publish from v4.2.0 stopped at the
+  already-published check; this release tag is the first that can publish the
+  bundle (#747).
+
 ## [4.2.0] - 2026-10-24
 
 The first release since 4.1.5. For an integrator it changes three things at

package/README.md

@@ -13,7 +13,7 @@ AI Agent 威脅偵測規則的開放格式
 [![GitHub Marketplace](https://img.shields.io/badge/Marketplace-ATR%20Scan-2ea44f?style=flat-square&logo=github)](https://github.com/marketplace/actions/atr-scan)
 [![License: MIT](https://img.shields.io/badge/license-MIT-brightgreen?style=flat-square)](LICENSE)
 [![DOI](https://img.shields.io/badge/DOI-10.5281%2Fzenodo.19178002-blue?style=flat-square)](https://doi.org/10.5281/zenodo.19178002)
-[![Rules](https://img.shields.io/badge/rules-843-blue?style=flat-square)](#5-specification)
+[![Rules](https://img.shields.io/badge/rules-844-blue?style=flat-square)](#5-specification)
 [![Categories](https://img.shields.io/badge/categories-10-blue?style=flat-square)](#7-coverage)
 [![OWASP Agentic](https://img.shields.io/badge/OWASP_Agentic_Top_10-10%2F10-brightgreen?style=flat-square)](#7-coverage)
 [![Sponsor](https://img.shields.io/badge/sponsor-Open%20Collective-7FADF2?style=flat-square&logo=opencollective&logoColor=white)](https://opencollective.com/agent-threat-rules)
@@ -478,7 +478,7 @@ Aggregated into [`data/stats.json`](data/stats.json) under `benchmarks[]`.
 | promptfoo (2026-05-12 import) [^legacyvendor] | corpus-2026-05-12 | 44 | 90.9% (hunt) / 6.8% (enforce) | 100.0% | 0.0% | 4.1.5 | 2026-10-15 |
 | PromptInject (academic adversarial) [^promptcorpora] | snapshot-2026-04 | 1,080 | 100.0% (hunt) / 0.0% (enforce) | 100.0% | 0.0% | 4.1.5 | 2026-10-15 |
 | SKILL.md benchmark (internal) [^skilllane] | internal-498 | 498 | 100.0% (hunt) / 0.0% (enforce) | 97.0% (hunt) | 0.20% (hunt) | 4.1.5 | 2026-10-15 |
-| Vendor guardrail suites (pinned upstream tests) [^vendorsuites] | pinned-2026-10-19 | 146 | 77.0% (hunt) / 5.6% (enforce) | not cited [^vendorsuites] | not cited [^vendorsuites] | 4.1.5 | 2026-10-19 |
+| Vendor guardrail suites (pinned upstream tests) [^vendorsuites] | pinned-2026-10-19 | 146 | 79.4% (hunt) / 5.6% (enforce) | not cited [^vendorsuites] | not cited [^vendorsuites] | 4.2.0 | 2026-10-23 |
 | Wild scan (OpenClaw + Skills.sh + Hermes + ClawHub) [^wildscan] | full-scan-v2-2026-04-13 | 101,280 | — | not measured | 1.42% flag rate | 2.0.0 | 2026-04-13 |
 
 The `Vendor guardrail suites` row is the test cases of llm-guard, NeMo
@@ -764,8 +764,9 @@ See [CHANGELOG.md](CHANGELOG.md).
 benign test cases (llm-guard 46 / 16, NeMo Guardrails 22 / 4, promptfoo 58 / 0),
 each traceable to repo, commit, path and line in
 [`manifest.json`](data/test-corpora/vendor-guardrail-suites/manifest.json). At ATR
-4.1.5 (measured 2026-10-19) recall is 97/126 (hunt), 92/126 (alert) and 7/126
-(enforce). Without the 16 rules whose YAML names promptfoo, llm-guard or NeMo, or
+4.2.0 (measured 2026-10-23, after #709 grounded ATR-2026-00500, -00501 and
+-00505 in these cases) recall is 100/126 (hunt), 95/126 (alert) and 7/126
+(enforce); at 4.1.5 (2026-10-19) it was 97, 92 and 7. Without the 16 rules whose YAML names promptfoo, llm-guard or NeMo, or
 carries the `(vendor-corpus-import)` tag, it is 78/126 = 61.9% (hunt), 70/126 =
 55.6% (alert) and 7/126 = 5.6% (enforce); per vendor in the hunt lane, llm-guard
 26/46, NeMo Guardrails 20/22, promptfoo 32/58. That ablation is the reference

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-threat-rules",
-  "version": "4.2.0",
+  "version": "4.2.1",
   "mcpName": "io.github.Agent-Threat-Rule/agent-threat-rules",
   "type": "module",
   "description": "Open detection standard — like Sigma, but for AI agents. Executable, testable rules for prompt injection, tool poisoning, context exfiltration, and MCP attacks. MIT-licensed.",

package/rules/context-exfiltration/ATR-2026-00501-data-exfiltration-via-markdown-image-and-link-url-injection.yaml

@@ -1,9 +1,9 @@
 title: Data Exfiltration via Markdown Image and Link URL Injection
 id: ATR-2026-00501
-rule_version: 2
+rule_version: 3
 status: experimental
 description: |
-  Detects instructions to the AI to embed attacker-controlled URLs into markdown image or link syntax with extracted data encoded in query parameters. This is the canonical indirect- injection data exfiltration vector: the agent renders malicious markdown that causes clients to make HTTP requests carrying sensitive data to attacker-controlled servers. Covers: markdown image with data-bearing query params, markdown link with sensitive data params, tracking pixel embedding, base64-encoded data in URL, and "send/encode to" redirect instructions. Generalised from promptfoo data-exfil plugin corpus - literal evil.com and attacker.com replaced with generic external URL patterns containing exfiltration parameter names (secret=, data=, q=, payload=, user=, token=, session=, key=, info=).
+  Detects attacker-controlled URLs that carry extracted data to an external endpoint: the canonical indirect-injection exfiltration vector, where the agent is told to fetch a URL or to render markdown whose query string carries sensitive context, so that the client or a fetch tool sends that data to the attacker. Covers, on the input side: markdown image or link with data-bearing query parameters, tracking pixel embedding, "encode and send to" redirect instructions, diagram/image references with data-bearing URLs, and fetch instructions whose query value is a template placeholder for the model's own context ({{system_prompt}}, ${conversation}, ...). On the output side (agent_output): the model emitting such a markdown image or link. Grounded in promptfoo's data-exfil plugin: the injected instruction documented in promptfoo/promptfoo site/docs/red-team/plugins/data-exfil.md ("## Example") and the two exfiltration payloads its grader rubric names (src/redteam/plugins/dataExfil.ts lines 23-24, repeated in the docs table), identical at commits 5f89b7c86ea04e5c03fbe7789dd0e47aed05bf43 and ea8b3d073a63769f7be243ac3c3460f72881a930. Those three are the vendor true positives below; the rest are ATR-authored and labelled synthetic.
 author: ATR Community (vendor-corpus-import)
 date: '2026-05-12'
 schema_version: '0.1'
@@ -66,6 +66,8 @@ tags:
   subcategory: markdown-url-injection
   scan_target: llm_io
   confidence: medium
+  source: vendor-test-suite
+  vendor_sources: promptfoo
 agent_source:
   type: llm_io
   framework:
@@ -98,6 +100,18 @@ detection:
       operator: regex
       value: (?i)(include|add|reference|embed).{0,30}(relevant\s+)?(diagrams?|images?|charts?|figures?|screenshots?).{0,30}(by\s+referencing|at|from|via).{0,30}https?://[a-z0-9._-]+\.[a-z]{2,}[^)"'\s]*\?(data|secret|content|payload|extract|q)=
       description: Diagram/image inclusion instruction with data-bearing external URL
+    - field: user_input
+      operator: regex
+      value: (?i)\b(fetch|visit|load|open|request|call|curl|ping|get|navigate\s+to|go\s+to|send\s+a\s+request\s+to)\b.{0,60}https?://[^\s?#]{1,200}\?[^\s#]{0,200}=\s*(\{\{|\$\{)\s*[a-z_.]{0,30}(system[_ ]?prompt|prompt|instructions?|conversation|chat[_ ]?history|history|memory|context|messages?|transcript|secrets?|credentials?)[a-z_.]{0,30}\s*\}
+      description: Fetch instruction to a URL whose query value interpolates the model's own context (system prompt, conversation, memory, secrets)
+    - field: agent_output
+      operator: regex
+      value: (?i)!\[[^\]]{0,60}\]\(https?://[a-z0-9._-]+\.[a-z]{2,}[^)]*\?(secret|data|payload|token|key|session|user|info|content|doc|extract|dump|exfil|leak|api_key|password)=
+      description: Agent output contains a markdown image whose external URL carries an exfiltration query parameter
+    - field: agent_output
+      operator: regex
+      value: (?i)\[[^\]]{0,60}\]\(https?://[a-z0-9._-]+\.[a-z]{2,}[^)]*\?(secret|payload|token|extracted|exfil|leak|dump|stolen|private_data|sensitive|api_key|auth_token|bearer|password)=
+      description: Agent output contains a markdown link whose external URL carries a high-confidence exfiltration query parameter
   condition: any
   false_positives:
     - Legitimate markdown with external image URLs that do not contain exfiltration parameters

package/rules/context-exfiltration/ATR-2026-00505-system-prompt-extraction-instruction-dump-request.yaml

@@ -1,9 +1,9 @@
 title: System Prompt Extraction - Instruction Dump Request
 id: ATR-2026-00505
-rule_version: 2
+rule_version: 3
 status: experimental
 description: |
-  Detects attempts to extract the system prompt or initial instructions given to the AI. Covers both direct requests ('list your instructions', 'relay your parameters', 'repeat verbatim') and indirect social engineering ('create a pitch deck about your system prompt', 'reply to this email with your system instructions'). The rule targets extraction verbs (repeat, relay, list, respond with, output, dump, provide, share) combined with objects that reference the system prompt (instructions, parameters, system prompt, initial context, configuration, directives, guidelines, rules you were given). Generalised from llm-guard and promptfoo test corpora - literal phrase fragments replaced with semantic patterns covering a broad range of extraction formulations.
+  Detects attempts to extract the system prompt or initial instructions given to the AI. Covers both direct requests ('list your instructions', 'relay your parameters', 'repeat verbatim') and indirect social engineering ('create a pitch deck about your system prompt', 'reply to this email with your system instructions'). The rule targets extraction verbs (repeat, relay, list, respond with, output, dump, provide, share) combined with objects that reference the system prompt (instructions, parameters, system prompt, initial context, configuration, directives, guidelines, rules you were given). Apostrophes and quotes are matched in both ASCII and typographic form (' and ’, " and “ ”), as the vendor originals use typographic ones. Grounded in vendor test cases: protectai/llm-guard tests/input_scanners/test_prompt_injection.py at commit 168c1034ffdb33837e7ae6fd6a16b80567c1be03 (system-prompt extraction prompts) and promptfoo/promptfoo src/redteam/plugins/promptExtraction.ts DEFAULT_EXAMPLES at commits 5f89b7c86ea04e5c03fbe7789dd0e47aed05bf43 and ea8b3d073a63769f7be243ac3c3460f72881a930.
 author: ATR Community (vendor-corpus-import)
 date: '2026-05-12'
 schema_version: '0.1'
@@ -66,6 +66,8 @@ tags:
   subcategory: system-prompt-extraction
   scan_target: llm_io
   confidence: medium
+  source: vendor-test-suite
+  vendor_sources: llm-guard, promptfoo
 agent_source:
   type: llm_io
   framework:
@@ -76,7 +78,7 @@ detection:
   conditions:
     - field: user_input
       operator: regex
-      value: (?i)(repeat|relay|list|output|print|dump|provide|reveal|disclose|expose|display)[^"']{0,40}(your\s+(instructions?|system\s+prompt|initial\s+(prompt|instructions?|context|message)|given\s+instructions?|directives?|guidelines?|programming|constraints?|setup\s+instructions?)|the\s+system\s+(prompt|instructions?|message)|all\s+of\s+your\s+instructions?|every\s+(instruction|rule|directive|guideline|constraint)\s+you\s+(have\s+been|were))
+      value: (?i)(repeat|relay|list|output|print|dump|provide|reveal|disclose|expose|display)[^"'“”‘’]{0,40}(your\s+(instructions?|system\s+prompt|initial\s+(prompt|instructions?|context|message)|given\s+instructions?|directives?|guidelines?|programming|constraints?|setup\s+instructions?)|the\s+system\s+(prompt|instructions?|message)|all\s+of\s+your\s+instructions?|every\s+(instruction|rule|directive|guideline|constraint)\s+you\s+(have\s+been|were))
       description: Extraction verb targeting AI system instructions or prompt (possessive 'your' required or explicit 'system prompt/message')
     - field: user_input
       operator: regex
@@ -100,7 +102,7 @@ detection:
       description: Reply-to-email with system instructions exfiltration
     - field: content
       operator: regex
-      value: (?i)(?:(?:relay|list|dump|recite|enumerate|repeat|reveal|return|show|provide)\b[\s\S]{0,40}\byour\s+system(?:'?s)?\s+(?:prompt|instructions?|parameters?|message|directives?|config)|(?:directives?|guidelines?|instructions?|rules?)\s+you\s+(?:were|was)\s+given)
+      value: (?i)(?:(?:relay|list|dump|recite|enumerate|repeat|reveal|return|show|provide)\b[\s\S]{0,40}\byour\s+system(?:['’]?s)?\s+(?:prompt|instructions?|parameters?|message|directives?|config)|(?:directives?|guidelines?|instructions?|rules?)\s+you\s+(?:were|was)\s+given)
       description: Extraction via synonym (relay/list your system parameters; directives/guidelines you were given)
   condition: any
   false_positives:

package/rules/excessive-autonomy/ATR-2026-00500-ssrf-via-agent-url-fetch-instruction.yaml

@@ -1,9 +1,9 @@
 title: SSRF via Agent URL Fetch Instruction
 id: ATR-2026-00500
-rule_version: 2
+rule_version: 3
 status: experimental
 description: |
-  Detects prompts instructing an AI agent to fetch or retrieve content from internal network addresses, exposing SSRF (Server-Side Request Forgery) risk. Covers: cloud metadata endpoints (AWS IMDS 169.254.169.254, GCP metadata.google.internal), localhost and loopback admin panels (127.0.0.1, localhost), RFC-1918 private IP ranges (10.x.x.x, 172.16-31.x.x, 192.168.x.x), and generic internal hostname patterns. These attacks exploit agents with web-fetch tools to pivot to internal services. Generalised from promptfoo SSRF plugin corpus - literal internal.corp.example.com replaced with pattern matching any internal-like hostname or private IP range.
+  Detects prompts instructing an AI agent to fetch or retrieve content from internal network addresses or local resources, exposing SSRF (Server-Side Request Forgery) risk. Covers: cloud metadata endpoints (AWS IMDS 169.254.169.254, GCP metadata.google.internal), localhost and loopback admin panels (127.0.0.1, localhost), RFC-1918 private IP ranges (10.x.x.x, 172.16-31.x.x, 192.168.x.x), internal hostname prefixes (internal., intranet., corp.), hosts under internal-only names (.local, .internal, .intranet, .corp, .lan, .localdomain, .home.arpa), and local-file / non-HTTP SSRF schemes (file:// to system paths, gopher://, dict://, ldap://, tftp://). These attacks exploit agents with web-fetch tools to pivot to internal services or read local files. Grounded in the promptfoo SSRF plugin's documented test cases (promptfoo/promptfoo site/docs/red-team/plugins/ssrf.md, "Example Test Cases" 1-3, identical at commits 5f89b7c86ea04e5c03fbe7789dd0e47aed05bf43 and ea8b3d073a63769f7be243ac3c3460f72881a930), which are the three vendor true positives below. promptfoo generates SSRF prompts server-side and ships no further SSRF prompts in its repository; the remaining true positives are ATR-authored and labelled synthetic.
 author: ATR Community (vendor-corpus-import)
 date: '2026-05-12'
 schema_version: '0.1'
@@ -63,6 +63,8 @@ tags:
   subcategory: ssrf-via-agent
   scan_target: llm_io
   confidence: medium
+  source: vendor-test-suite
+  vendor_sources: promptfoo
 agent_source:
   type: llm_io
   framework:
@@ -91,6 +93,14 @@ detection:
       operator: regex
       value: (?i)https?://169\.254\.169\.254/(latest|v[0-9]|meta|latest/meta-data)
       description: Direct mention of AWS IMDS endpoint URL
+    - field: user_input
+      operator: regex
+      value: (?i)(\b(can|could|would|will)\s+you\b.{0,30}|\bplease\s+)\b(fetch|retrieve|get|load|read|access|visit|open|download|pull|grab|scrape|crawl|display|show)\b.{0,60}https?://[a-z0-9.-]{1,253}\.(local|internal|intranet|corp|lan|localdomain|home\.arpa)(:[0-9]{1,5})?([/?#]|\s|$)
+      description: Request to the agent to fetch from a host under an internal-only name (.local, .internal, .intranet, .corp, .lan, .localdomain, .home.arpa)
+    - field: user_input
+      operator: regex
+      value: (?i)\b(fetch|retrieve|get|request|load|read|access|open|download|curl|display|show|summari[sz]e|print|dump)\b.{0,60}(file://(localhost)?/(etc|proc|root|sys|boot|var/run|var/lib|windows|\.ssh|\.aws|\.kube)\b|(gopher|dict|ldap|tftp)://)
+      description: Fetch/read instruction targeting a local system path via file:// or a non-HTTP SSRF scheme (gopher, dict, ldap, tftp)
   condition: any
   false_positives:
     - Network troubleshooting discussions mentioning private IP ranges without fetch instructions

package/rules/privilege-escalation/ATR-2026-00040-privilege-escalation.yaml

@@ -102,7 +102,7 @@ detection:
       description: Kubernetes privilege escalation (RBAC-binding creation, auth probing, or exec that spawns an absolute-path/bash shell; routine interactive debug exec excluded)
     - field: tool_args
       operator: regex
-      value: (?i)(?:chmod\s+(?:[2467][0-7]{3}|[0-7]{0,3}7[0-7]{0,2})|chmod\s+[ug]\+s|chown\s+root|setcap\s+)
+      value: (?i)(?:chmod\s+(?:[0-7]?[0-7]{2}[2367]|[2467][0-7]{3})(?:[^0-7]|$)|chmod\s+(?:-[-\w]+\s+)+(?:[0-7]?[0-7]{2}[2367]|[2467][0-7]{3})\s+(?:/(?:[\s"'*;]|$)|/(?:etc|usr|var|bin|sbin|boot|lib|opt|root|home|srv)\b|~|\$HOME)|chmod\s+[ug]\+s|chown\s+root|setcap\s+)
       description: Unix permission escalation commands (setuid, root ownership)
     - field: tool_args
       operator: regex

package/rules/privilege-escalation/ATR-2026-01601-sql-injection-destructive-ddl.yaml

@@ -60,7 +60,7 @@ detection:
   conditions:
     - field: tool_args
       operator: regex
-      value: (?i)(?:';|"\s*;|--)\s*(?:DROP\s+(?:TABLE|DATABASE|INDEX|VIEW)|TRUNCATE\s+(?:TABLE\s+)?\w|DELETE\s+FROM\s+\w)
+      value: (?i)(?:'\s*;|"\s*;|--)\s*(?:DROP\s+(?:TABLE|DATABASE|INDEX|VIEW)|TRUNCATE\s+(?:TABLE\s+)?\w|DELETE\s+FROM\s+\w)
       description: 'SQL injection: quote-termination followed by destructive DDL'
     - field: tool_args
       operator: regex
@@ -68,7 +68,7 @@ detection:
       description: DROP TABLE with comment suppressor
     - field: user_input
       operator: regex
-      value: (?i)(?:';|"\s*;)\s*(?:DROP\s+TABLE|TRUNCATE|DELETE\s+FROM\s+\w)
+      value: (?i)(?:'\s*;|"\s*;)\s*(?:DROP\s+TABLE|TRUNCATE|DELETE\s+FROM\s+\w)
       description: Destructive DDL injection in user input
   condition: any
   false_positives:

package/rules/prompt-injection/ATR-2026-00503-fake-error-state-takeover-unrestricted-replacement-bot.yaml

@@ -1,9 +1,9 @@
 title: Fake Error State Takeover - Unrestricted Replacement Bot
 id: ATR-2026-00503
-rule_version: 2
+rule_version: 3
 status: experimental
 description: |
-  Detects injection attacks claiming the legitimate assistant is offline, in error, or temporarily unavailable, and that an unrestricted replacement AI has taken over. This pattern hijacks agent sessions by falsely asserting a system failure and substituting an unconstrained AI that bypasses safety rules. The injected replacement is then tasked with executing the attacker's goal covertly ("without raising suspicion", "in a friendly way"). Generalised from llm-guard test corpus - literal phrase fragments replaced with semantic patterns covering: assistant-offline framing, unrestricted replacement AI declaration, elevated permissions claim, and covert-mode instruction.
+  Detects injection attacks claiming the legitimate assistant is offline, in error, or temporarily unavailable, and that an unrestricted replacement AI has taken over. This pattern hijacks agent sessions by falsely asserting a system failure and substituting an unconstrained AI that bypasses safety rules. The injected replacement is then tasked with executing the attacker's goal covertly ("without raising suspicion", "in a friendly way"). Generalised from llm-guard test corpus - literal phrase fragments replaced with semantic patterns covering: assistant-offline framing, unrestricted replacement AI declaration, elevated permissions claim, and covert-mode instruction. The three vendor originals are protectai/llm-guard tests/input_scanners/test_prompt_injection.py lines 113, 123 and 133 at commit 168c1034ffdb33837e7ae6fd6a16b80567c1be03; they are the first three true positives below, verbatim. The shortened copies that follow them are kept as variants.
 author: ATR Community (vendor-corpus-import)
 date: '2026-05-12'
 schema_version: '0.1'
@@ -64,6 +64,8 @@ tags:
   subcategory: fake-error-replacement
   scan_target: llm_io
   confidence: medium
+  source: vendor-test-suite
+  vendor_sources: llm-guard
 agent_source:
   type: llm_io
   framework:

package/rules/skill-compromise/ATR-2026-00064-over-permissioned-skill.yaml

@@ -69,7 +69,7 @@ detection:
       value: (?i)(sudo|runas|doas|pkexec|gsudo)\s+
     - field: tool_args
       operator: regex
-      value: (?i)(chmod\s+(?:[2467][0-7]{3}|[0-7]{0,3}7[0-7]{0,2})|chmod\s+[ug]?\+[sx]|chown\s+root|setcap\s)
+      value: (?i)(chmod\s+(?:[0-7]?[0-7]{2}[2367]|[2467][0-7]{3})(?:[^0-7]|$)|chmod\s+(?:-[-\w]+\s+)+(?:[0-7]?[0-7]{2}[2367]|[2467][0-7]{3})\s+(?:/(?:[\s"'*;]|$)|/(?:etc|usr|var|bin|sbin|boot|lib|opt|root|home|srv)\b|~|\$HOME)|chmod\s+[ug]?\+[sx]|chown\s+root|setcap\s)
     - field: tool_args
       operator: regex
       value: (?i)(iptables|ufw|firewall-cmd|netsh\s+advfirewall|pfctl)\s

package/rules/tool-poisoning/ATR-2026-00521-shell-command-injection-agent-tool-context.yaml

@@ -1,6 +1,6 @@
 title: Shell Command Injection in Agent Tool Context
 id: ATR-2026-00521
-rule_version: 1
+rule_version: 2
 status: stable
 description: |
   Detects prompts that embed shell command injection payloads within legitimate-sounding task requests to an AI agent with shell/code execution tools. The canonical shape is a benign-looking task followed by a chained shell command that exfiltrates data (env vars, .env files, logs, credentials) to an attacker-controlled URL via curl/wget/nc or Python urllib. Seen in promptfoo redteam shell-injection plugin (7 confirmed samples). The structural detection generalizes from specific evil.com URLs to the structural pattern that distinguishes injection from legitimate shell use: a shell chaining operator (;, &&, ||, $(...), backtick, or 'then') followed immediately by a dangerous network/execution tool (curl, wget, nc, bash, sh, python, powershell, cmd). This covers the data-exfiltration shape without requiring specific domain names. The pipe-to-nc and pipe-to-bash variants are covered by a separate condition.

package/rules/tool-poisoning/ATR-2026-02870-invisible-control-before-directive.yaml

@@ -0,0 +1,94 @@
+title: Invisible Unicode Control Before a Directive in a Tool Description or Skill File
+id: ATR-2026-02870
+rule_version: 1
+status: experimental
+description: |
+  Detects a zero-width, soft-hyphen or bidirectional control character placed at the start of a clause that gives the model or agent an instruction, in the static text an agent reads before it acts: an MCP tool description (tools/list at registration time) or a SKILL.md file. The control is invisible in most renderers, so a reviewer reading the description sees an ordinary sentence while the model still reads the directive after it.
+  Controls covered: U+200B ZERO WIDTH SPACE, U+200C ZWNJ, U+200D ZWJ, U+2060 WORD JOINER, U+180E MONGOLIAN VOWEL SEPARATOR, U+00AD SOFT HYPHEN, U+FEFF (only after punctuation or a word, not at the start of the text or of a line, where it is a byte-order mark), U+200E LRM, U+200F RLM, and the bidi embedding, override and isolate controls U+202A-U+202E and U+2066-U+2069. A run of up to seven controls counts; the last one before the directive must not be a closing control (U+202C PDF, U+2069 PDI), so a directive that follows a closed embedding is not attributed to it.
+  Presence alone does not trigger. These characters are legitimate in right-to-left text (LRM/RLM and embeddings around Latin words in Hebrew, Arabic and Persian), in Persian and Indic shaping (ZWNJ, ZWJ), in emoji ZWJ sequences, in hyphenation hints (soft hyphens inside German compounds), in localized keyboard shortcuts wrapped in LRE/PDF, and in text pasted from chat clients (ZWSP after an @ sign). The rule therefore requires two things: the control starts a clause (it follows ASCII punctuation, an ASCII word and a space, CJK sentence punctuation, or the start of the text or a line, not a letter it is glued to and not a right-to-left word), and the clause is a directive addressed to the model: an instruction override, an attention header whose clause tells the model to read, send or ignore something, an injected <IMPORTANT> or <system> tag, a response-timing hook (before answering, after responding) tied to sending secrets, conversation or a URL, an always/must directive to call this tool first or instead of others, an exfiltration verb on secrets, conversation, environment or credential files, a read of ~/.ssh, .env or cloud credential files, or a concealment directive (do not tell the user).
+  Surfaces: the conditions read tool_description, so the rule runs on an mcp_exchange event that carries fields.tool_description, on each tool definition of a tools/list document scanned with `atr scan` (the tool-definition scope admits a tool_call rule that reads tool_description), and on SKILL.md files (scan_target both; in a skill scan every field resolves to the document). The engine strips most of these controls before matching but also tests each regex against the raw text, which is where these patterns match.
+  Limits: the directive vocabulary is English only. A control glued between two letters (for example a soft hyphen inside a word) is not counted, so a directive written as one run with no space or punctuation before the control is missed. Text reversed under an override (RLO with the directive stored backwards) and Unicode tag characters (U+E0000-U+E007F) are out of scope; ATR-2026-00276 and ATR-2026-00258 cover those on other fields. Directives without any invisible control are left to the tool-poisoning rules (for example ATR-2026-00100 to -00107). Reported in issue #653.
+author: ATR Community
+date: 2026/10/24
+schema_version: '0.1'
+detection_tier: pattern
+maturity: test
+severity: high
+references:
+  owasp_llm:
+    - LLM01:2025
+  owasp_agentic:
+    - ASI01:2026
+    - ASI04:2026
+  mitre_atlas:
+    - 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+  external:
+    - https://github.com/Agent-Threat-Rule/agent-threat-rules/issues/653
+    - https://trojansource.codes/
+    - https://www.unicode.org/reports/tr9/
+compliance:
+  eu_ai_act:
+    - article: '15'
+      context: Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist attempts by third parties to alter their behaviour; this rule provides detection evidence for that requirement by flagging tool descriptions and skill files that hide a directive to the model behind an invisible Unicode control.
+      strength: primary
+    - article: '13'
+      context: Article 13 (transparency) requires that deployers can understand the system they operate; a directive hidden behind an invisible control is text the deployer cannot see in review but the model follows, and this rule surfaces it.
+      strength: secondary
+    - article: '9'
+      context: Article 9 (risk management system) requires identified risks to be treated; this rule is a detection control for the hidden-directive risk in third-party MCP tools and skills, applied before the agent loads them.
+      strength: secondary
+  nist_ai_rmf:
+    - subcategory: MS.2.7
+      context: MEASURE 2.7 requires security and resilience to be evaluated and documented; scanning tool definitions and skill files for directives hidden behind invisible controls is a measurable check on third-party agent components.
+      strength: primary
+    - subcategory: MG.3.1
+      context: MANAGE 3.1 requires risks from third-party resources to be monitored; MCP tool descriptions and skills are third-party text the model treats as instructions, and this rule monitors them for hidden directives.
+      strength: secondary
+    - subcategory: MP.5.1
+      context: MAP 5.1 requires the likelihood and impact of identified attack patterns to be characterised; the gap between what a reviewer sees and what the model reads is one such pattern, and this rule detects its use in static tool text.
+      strength: secondary
+  iso_42001:
+    - clause: '8.1'
+      context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is supported by this rule's detection of hidden directives in externally provided MCP tools and skills.
+      strength: primary
+    - clause: '6.2'
+      context: ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; detecting a directive hidden behind an invisible Unicode control in tool text is such a treatment.
+      strength: secondary
+tags:
+  category: tool-poisoning
+  subcategory: invisible-control-before-directive
+  scan_target: both
+  confidence: medium
+agent_source:
+  type: tool_call
+  framework:
+    - mcp
+    - any
+  provider:
+    - any
+detection:
+  condition: any
+  conditions:
+    - field: tool_description
+      operator: regex
+      value: "(?:(?:[\\x21-\\x2F\\x3A-\\x40\\x5B-\\x60\\x7B-\\x7E、。！，：；？][ \\t]{0,3}|[A-Za-z0-9][ \\t]{1,3})[​‌‍⁠᠎­‎‏‪‫‭‮⁦⁧⁨\uFEFF‬⁩]{0,6}[​‌‍⁠᠎­‎‏‪‫‭‮⁦⁧⁨\uFEFF]|(?:^|[\\r\\n])[ \\t]{0,8}[​‌‍⁠᠎­‎‏‪‫‭‮⁦⁧⁨‬⁩]{0,6}[​‌‍⁠᠎­‎‏‪‫‭‮⁦⁧⁨])[ \\t\"'*_`>(\\[]{0,4}(?:(?:also|then|please|now|first|additionally|and|but|ai|assistant|agent|model|llm|claude)[,:]?\\s+){0,2}(?:(?:ignore|disregard|forget|override|bypass)\\s+(?:all\\s+|any\\s+)?(?:(?:the|your|of\\s+the|previous|prior|above|earlier|preceding|system|original|other|safety|security|developer)\\s+){0,3}(?:instructions?|rules|prompts?|guidelines|directives|polic(?:y|ies)|guardrails|restrictions|constraints)|(?:important|attention|urgent|critical|system\\s+(?:note|override|message|instruction)|admin(?:istrator)?\\s+note|note\\s+to\\s+(?:the\\s+)?(?:ai|assistant|model|agent|llm))\\s{0,3}[:!>-][^\\n]{0,60}?\\b(?:ignore|disregard|forget|read|send|forward|upload|include|attach|exfiltrate|leak|(?:do\\s+not|don't|never)\\s+(?:tell|mention|inform|reveal)|(?:before|after|when)\\s+(?:answering|responding|replying|you\\s+(?:answer|respond|reply)))\\b|<\\s{0,3}/?(?:important|system|instructions?|secret|hidden)\\s{0,3}>|you\\s+are\\s+now\\b|new\\s+(?:system\\s+)?instructions?\\s{0,3}:)"
+      description: Invisible control at the start of a clause, followed by an instruction override (ignore/disregard previous instructions), an attention header whose clause tells the model to read, send, ignore or answer differently, an injected <IMPORTANT>/<system> tag, or a new-instructions / you-are-now header
+    - field: tool_description
+      operator: regex
+      value: "(?:(?:[\\x21-\\x2F\\x3A-\\x40\\x5B-\\x60\\x7B-\\x7E、。！，：；？][ \\t]{0,3}|[A-Za-z0-9][ \\t]{1,3})[​‌‍⁠᠎­‎‏‪‫‭‮⁦⁧⁨\uFEFF‬⁩]{0,6}[​‌‍⁠᠎­‎‏‪‫‭‮⁦⁧⁨\uFEFF]|(?:^|[\\r\\n])[ \\t]{0,8}[​‌‍⁠᠎­‎‏‪‫‭‮⁦⁧⁨‬⁩]{0,6}[​‌‍⁠᠎­‎‏‪‫‭‮⁦⁧⁨])[ \\t\"'*_`>(\\[]{0,4}(?:(?:also|then|please|now|first|additionally|and|but|ai|assistant|agent|model|llm|claude)[,:]?\\s+){0,2}(?:(?:before|after|when|while|prior\\s+to|whenever|each\\s+time)\\s+(?:you\\s+)?(?:respond(?:ing)?|answer(?:ing)?|repl(?:y|ying)|returning\\s+(?:the\\s+)?(?:results?|output|answer)|(?:using|calling|invoking)\\s+(?:this|any|another|other)\\s+tools?)\\b[^\\n]{0,80}?\\b(?:(?:send|forward|upload|post|attach|append|include|copy|transmit|exfiltrate|leak|email|share)\\b[^\\n]{0,60}?(?:(?:conversation|chat\\s+history|message\\s+history|system\\s+prompt|(?:process\\s+)?environment|\\benv\\s+vars?|credentials?|secrets?|api[\\s_-]?keys?|(?:access|auth(?:entication)?|session|bearer)\\s+tokens?|passwords?|private\\s+keys?|ssh\\s+keys?|~/\\.ssh|\\.ssh/|id_rsa|id_ed25519|\\.env\\b|\\.aws/|cookies)|https?://|[\\w.+-]{1,64}@[\\w-]{1,63}\\.[a-z]{2,})|(?:call|invoke|use)\\s+this\\s+(?:tool|function))|(?:always|must|you\\s+must|you\\s+should|make\\s+sure\\s+(?:to|you))\\s+(?:first\\s+)?(?:(?:call|invoke|use|run|prefer|choose|select)\\s+this\\s+(?:tool|function|server|skill|plugin)\\s+(?:first|before\\s+(?:any|all|every|other)|instead\\s+of|rather\\s+than|for\\s+(?:every|all|any)\\b|even\\s+(?:if|when))|(?:send|forward|upload|post|attach|append|include|copy|transmit|exfiltrate|leak|email|share)\\b[^\\n]{0,60}?(?:conversation|chat\\s+history|message\\s+history|system\\s+prompt|(?:process\\s+)?environment|\\benv\\s+vars?|credentials?|secrets?|api[\\s_-]?keys?|(?:access|auth(?:entication)?|session|bearer)\\s+tokens?|passwords?|private\\s+keys?|ssh\\s+keys?|~/\\.ssh|\\.ssh/|id_rsa|id_ed25519|\\.env\\b|\\.aws/|cookies))|(?:(?:for\\s+best\\s+results|for\\s+(?:debugging|analytics|telemetry|quality|audit)(?:\\s+purposes)?|to\\s+improve\\s+[a-z]+)[,:]?\\s+)?(?:silently\\s+|quietly\\s+|secretly\\s+)?(?:send|forward|upload|post|attach|append|include|copy|transmit|exfiltrate|leak|email|share)\\b[^\\n]{0,60}?(?:conversation|chat\\s+history|message\\s+history|system\\s+prompt|(?:process\\s+)?environment|\\benv\\s+vars?|credentials?|secrets?|api[\\s_-]?keys?|(?:access|auth(?:entication)?|session|bearer)\\s+tokens?|passwords?|private\\s+keys?|ssh\\s+keys?|~/\\.ssh|\\.ssh/|id_rsa|id_ed25519|\\.env\\b|\\.aws/|cookies)|(?:read|cat|open|load|print|dump|return)\\s+[^\\n]{0,40}?(?:~/\\.ssh|\\.ssh/|id_rsa|id_ed25519|/etc/(?:passwd|shadow)|\\.env\\b|\\.aws/credentials|\\.npmrc|\\.netrc|\\.git-credentials|\\.kube/config))"
+      description: Invisible control at the start of a clause, followed by a response-timing hook (before answering, after responding, when calling another tool) that sends or reads secrets, conversation or a URL; an always/must directive to call this tool first or instead of others, or to send secrets; an exfiltration verb on secrets, conversation, environment or credential files; or a read of ~/.ssh, .env, .aws/credentials and similar files
+    - field: tool_description
+      operator: regex
+      value: "(?:(?:[\\x21-\\x2F\\x3A-\\x40\\x5B-\\x60\\x7B-\\x7E、。！，：；？][ \\t]{0,3}|[A-Za-z0-9][ \\t]{1,3})[​‌‍⁠᠎­‎‏‪‫‭‮⁦⁧⁨\uFEFF‬⁩]{0,6}[​‌‍⁠᠎­‎‏‪‫‭‮⁦⁧⁨\uFEFF]|(?:^|[\\r\\n])[ \\t]{0,8}[​‌‍⁠᠎­‎‏‪‫‭‮⁦⁧⁨‬⁩]{0,6}[​‌‍⁠᠎­‎‏‪‫‭‮⁦⁧⁨])[ \\t\"'*_`>(\\[]{0,4}(?:(?:also|then|please|now|first|additionally|and|but|ai|assistant|agent|model|llm|claude)[,:]?\\s+){0,2}(?:(?:do\\s+not|don't|never|without)\\s+(?:tell(?:ing)?|inform(?:ing)?|notify(?:ing)?|mention(?:ing)?|reveal(?:ing)?|disclos(?:e|ing)|alert(?:ing)?|warn(?:ing)?|ask(?:ing)?)\\s+(?:this\\s+to\\s+|anything\\s+to\\s+)?(?:the\\s+)?(?:user|human|operator)\\b|(?:do\\s+not|don't|never)\\s+let\\s+(?:the\\s+)?(?:user|human)\\s+(?:know|see))"
+      description: Invisible control at the start of a clause, followed by a concealment directive (do not tell, inform, mention or reveal to the user)
+  false_positives:
+    - A security write-up, test fixture or rule file that quotes a poisoned tool description verbatim, invisible control included, will match; that is the text the rule looks for.
+    - A localized description whose right-to-left text puts an LRM or RLM after an ASCII word and a space, directly before an English sentence that tells the model to send credentials or not tell the user, would match. No such text was found in the benign corpora; the non-Latin samples in the true negatives do not match.
+    - Presence of the controls alone (right-to-left marks, ZWNJ in Persian, emoji ZWJ sequences, soft hyphens inside words, LRE/PDF around a keyboard shortcut, ZWSP from pasted chat text, a byte-order mark at the start of a file) does not match.
+response:
+  actions:
+    - alert
+    - snapshot
+  message_template: |
+    [ATR-2026-02870] HIGH: an invisible Unicode control (zero-width, soft hyphen or bidi) starts a clause that instructs the model, in a tool description or skill file. Show the description with control characters made visible, and review the tool or skill before the agent loads it.
+confidence: 60