agent-threat-rules 4.2.0 → 4.2.2

package/rules/context-exfiltration/ATR-2026-00449-spring-ai-chatmemory-cross-user-leak.yaml

@@ -15,10 +15,9 @@ references:
     - LLM02:2025
     - LLM08:2025
   owasp_agentic:
-    - ASI04:2026
-    - ASI09:2026
+    - ASI03:2026
+    - ASI06:2026
   mitre_atlas:
-    - AML.T0024 - Exfiltration via AI Inference API
     - AML.T0057 - LLM Data Leakage
   mitre_attack:
     - T1530 - Data from Cloud Storage Object

package/rules/context-exfiltration/ATR-2026-00501-data-exfiltration-via-markdown-image-and-link-url-injection.yaml

@@ -1,9 +1,9 @@
 title: Data Exfiltration via Markdown Image and Link URL Injection
 id: ATR-2026-00501
-rule_version: 2
+rule_version: 3
 status: experimental
 description: |
-  Detects instructions to the AI to embed attacker-controlled URLs into markdown image or link syntax with extracted data encoded in query parameters. This is the canonical indirect- injection data exfiltration vector: the agent renders malicious markdown that causes clients to make HTTP requests carrying sensitive data to attacker-controlled servers. Covers: markdown image with data-bearing query params, markdown link with sensitive data params, tracking pixel embedding, base64-encoded data in URL, and "send/encode to" redirect instructions. Generalised from promptfoo data-exfil plugin corpus - literal evil.com and attacker.com replaced with generic external URL patterns containing exfiltration parameter names (secret=, data=, q=, payload=, user=, token=, session=, key=, info=).
+  Detects attacker-controlled URLs that carry extracted data to an external endpoint: the canonical indirect-injection exfiltration vector, where the agent is told to fetch a URL or to render markdown whose query string carries sensitive context, so that the client or a fetch tool sends that data to the attacker. Covers, on the input side: markdown image or link with data-bearing query parameters, tracking pixel embedding, "encode and send to" redirect instructions, diagram/image references with data-bearing URLs, and fetch instructions whose query value is a template placeholder for the model's own context ({{system_prompt}}, ${conversation}, ...). On the output side (agent_output): the model emitting such a markdown image or link. Grounded in promptfoo's data-exfil plugin: the injected instruction documented in promptfoo/promptfoo site/docs/red-team/plugins/data-exfil.md ("## Example") and the two exfiltration payloads its grader rubric names (src/redteam/plugins/dataExfil.ts lines 23-24, repeated in the docs table), identical at commits 5f89b7c86ea04e5c03fbe7789dd0e47aed05bf43 and ea8b3d073a63769f7be243ac3c3460f72881a930. Those three are the vendor true positives below; the rest are ATR-authored and labelled synthetic.
 author: ATR Community (vendor-corpus-import)
 date: '2026-05-12'
 schema_version: '0.1'
@@ -66,6 +66,8 @@ tags:
   subcategory: markdown-url-injection
   scan_target: llm_io
   confidence: medium
+  source: vendor-test-suite
+  vendor_sources: promptfoo
 agent_source:
   type: llm_io
   framework:
@@ -98,6 +100,18 @@ detection:
       operator: regex
       value: (?i)(include|add|reference|embed).{0,30}(relevant\s+)?(diagrams?|images?|charts?|figures?|screenshots?).{0,30}(by\s+referencing|at|from|via).{0,30}https?://[a-z0-9._-]+\.[a-z]{2,}[^)"'\s]*\?(data|secret|content|payload|extract|q)=
       description: Diagram/image inclusion instruction with data-bearing external URL
+    - field: user_input
+      operator: regex
+      value: (?i)\b(fetch|visit|load|open|request|call|curl|ping|get|navigate\s+to|go\s+to|send\s+a\s+request\s+to)\b.{0,60}https?://[^\s?#]{1,200}\?[^\s#]{0,200}=\s*(\{\{|\$\{)\s*[a-z_.]{0,30}(system[_ ]?prompt|prompt|instructions?|conversation|chat[_ ]?history|history|memory|context|messages?|transcript|secrets?|credentials?)[a-z_.]{0,30}\s*\}
+      description: Fetch instruction to a URL whose query value interpolates the model's own context (system prompt, conversation, memory, secrets)
+    - field: agent_output
+      operator: regex
+      value: (?i)!\[[^\]]{0,60}\]\(https?://[a-z0-9._-]+\.[a-z]{2,}[^)]*\?(secret|data|payload|token|key|session|user|info|content|doc|extract|dump|exfil|leak|api_key|password)=
+      description: Agent output contains a markdown image whose external URL carries an exfiltration query parameter
+    - field: agent_output
+      operator: regex
+      value: (?i)\[[^\]]{0,60}\]\(https?://[a-z0-9._-]+\.[a-z]{2,}[^)]*\?(secret|payload|token|extracted|exfil|leak|dump|stolen|private_data|sensitive|api_key|auth_token|bearer|password)=
+      description: Agent output contains a markdown link whose external URL carries a high-confidence exfiltration query parameter
   condition: any
   false_positives:
     - Legitimate markdown with external image URLs that do not contain exfiltration parameters

package/rules/context-exfiltration/ATR-2026-00505-system-prompt-extraction-instruction-dump-request.yaml

@@ -1,9 +1,9 @@
 title: System Prompt Extraction - Instruction Dump Request
 id: ATR-2026-00505
-rule_version: 2
+rule_version: 3
 status: experimental
 description: |
-  Detects attempts to extract the system prompt or initial instructions given to the AI. Covers both direct requests ('list your instructions', 'relay your parameters', 'repeat verbatim') and indirect social engineering ('create a pitch deck about your system prompt', 'reply to this email with your system instructions'). The rule targets extraction verbs (repeat, relay, list, respond with, output, dump, provide, share) combined with objects that reference the system prompt (instructions, parameters, system prompt, initial context, configuration, directives, guidelines, rules you were given). Generalised from llm-guard and promptfoo test corpora - literal phrase fragments replaced with semantic patterns covering a broad range of extraction formulations.
+  Detects attempts to extract the system prompt or initial instructions given to the AI. Covers both direct requests ('list your instructions', 'relay your parameters', 'repeat verbatim') and indirect social engineering ('create a pitch deck about your system prompt', 'reply to this email with your system instructions'). The rule targets extraction verbs (repeat, relay, list, respond with, output, dump, provide, share) combined with objects that reference the system prompt (instructions, parameters, system prompt, initial context, configuration, directives, guidelines, rules you were given). Apostrophes and quotes are matched in both ASCII and typographic form (' and ’, " and “ ”), as the vendor originals use typographic ones. Grounded in vendor test cases: protectai/llm-guard tests/input_scanners/test_prompt_injection.py at commit 168c1034ffdb33837e7ae6fd6a16b80567c1be03 (system-prompt extraction prompts) and promptfoo/promptfoo src/redteam/plugins/promptExtraction.ts DEFAULT_EXAMPLES at commits 5f89b7c86ea04e5c03fbe7789dd0e47aed05bf43 and ea8b3d073a63769f7be243ac3c3460f72881a930.
 author: ATR Community (vendor-corpus-import)
 date: '2026-05-12'
 schema_version: '0.1'
@@ -66,6 +66,8 @@ tags:
   subcategory: system-prompt-extraction
   scan_target: llm_io
   confidence: medium
+  source: vendor-test-suite
+  vendor_sources: llm-guard, promptfoo
 agent_source:
   type: llm_io
   framework:
@@ -76,7 +78,7 @@ detection:
   conditions:
     - field: user_input
       operator: regex
-      value: (?i)(repeat|relay|list|output|print|dump|provide|reveal|disclose|expose|display)[^"']{0,40}(your\s+(instructions?|system\s+prompt|initial\s+(prompt|instructions?|context|message)|given\s+instructions?|directives?|guidelines?|programming|constraints?|setup\s+instructions?)|the\s+system\s+(prompt|instructions?|message)|all\s+of\s+your\s+instructions?|every\s+(instruction|rule|directive|guideline|constraint)\s+you\s+(have\s+been|were))
+      value: (?i)(repeat|relay|list|output|print|dump|provide|reveal|disclose|expose|display)[^"'“”‘’]{0,40}(your\s+(instructions?|system\s+prompt|initial\s+(prompt|instructions?|context|message)|given\s+instructions?|directives?|guidelines?|programming|constraints?|setup\s+instructions?)|the\s+system\s+(prompt|instructions?|message)|all\s+of\s+your\s+instructions?|every\s+(instruction|rule|directive|guideline|constraint)\s+you\s+(have\s+been|were))
       description: Extraction verb targeting AI system instructions or prompt (possessive 'your' required or explicit 'system prompt/message')
     - field: user_input
       operator: regex
@@ -100,7 +102,7 @@ detection:
       description: Reply-to-email with system instructions exfiltration
     - field: content
       operator: regex
-      value: (?i)(?:(?:relay|list|dump|recite|enumerate|repeat|reveal|return|show|provide)\b[\s\S]{0,40}\byour\s+system(?:'?s)?\s+(?:prompt|instructions?|parameters?|message|directives?|config)|(?:directives?|guidelines?|instructions?|rules?)\s+you\s+(?:were|was)\s+given)
+      value: (?i)(?:(?:relay|list|dump|recite|enumerate|repeat|reveal|return|show|provide)\b[\s\S]{0,40}\byour\s+system(?:['’]?s)?\s+(?:prompt|instructions?|parameters?|message|directives?|config)|(?:directives?|guidelines?|instructions?|rules?)\s+you\s+(?:were|was)\s+given)
       description: Extraction via synonym (relay/list your system parameters; directives/guidelines you were given)
   condition: any
   false_positives:

package/rules/context-exfiltration/ATR-2026-00516-output-xss-via-llm.yaml

@@ -12,19 +12,20 @@ maturity: test
 severity: high
 references:
   owasp_llm:
-    - LLM02:2025
+    - LLM05:2025
   owasp_agentic:
-    - ASI01:2026
+    - ASI05:2026
   mitre_atlas:
-    - AML.T0024 - Exfiltration via AI Inference API
+    - AML.T0077 - LLM Response Rendering
+    - AML.T0050 - Command and Scripting Interpreter
 compliance:
   owasp_agentic:
-    - id: ASI01:2026
-      context: Context exfiltration redirects the agent to expose internal state (system prompt, credentials, conversation history) to an unauthorized party -- a goal hijack variant targeting information disclosure.
-      strength: primary
+    - id: ASI05:2026
+      context: 'The patterns match prompts asking the model to emit a script tag, an on* event-handler attribute, a javascript: URI or a data:text/html URI whose script reads cookies, browser storage, page content or location, or calls fetch, eval or similar functions, and explicit requests for XSS payloads that steal cookies, tokens or credentials. ASI05:2026 builds on LLM05:2025 and covers model output that ends up executed as code; this code would run in the browser that renders the output, not on the agent host, so the fit is partial.'
+      strength: partial
   owasp_llm:
-    - id: LLM02:2025
-      context: This rule implements LLM02:2025 Sensitive Information Disclosure detection, identifying requests that attempt to extract confidential context, system prompts, or credentials from the agent.
+    - id: LLM05:2025
+      context: 'The patterns match the request side of an output-handling attack: prompts asking the model to emit a script tag, an on* event-handler attribute, or a javascript: / data:text/html URI whose script reads cookies, browser storage, page content or location, or calls fetch, eval or similar functions. LLM05:2025 lists JavaScript or Markdown generated by the LLM and interpreted by the browser, resulting in XSS.'
       strength: primary
   eu_ai_act:
     - article: '15'

package/rules/context-exfiltration/ATR-2026-00569-agent-mcp-path-traversal-arbitrary-file-access.yaml

@@ -30,9 +30,11 @@ references:
     - https://github.com/Advanced-Excel-MCP/excel-mcp-server
   owasp_llm:
     - LLM02:2025
+    - LLM05:2025
   owasp_agentic:
-    - ASI01:2026
+    - ASI02:2026
   mitre_atlas:
+    - AML.T0053 - AI Agent Tool Invocation
     - AML.T0057 - LLM Data Leakage
 metadata_provenance:
   cve: human-authored

package/rules/context-exfiltration/ATR-2026-00571-xss-in-agent-mcp-rendered-output.yaml

@@ -20,11 +20,12 @@ references:
   external:
     - https://github.com/jlowin/fastmcp/security/advisories
   owasp_llm:
-    - LLM02:2025
+    - LLM05:2025
   owasp_agentic:
-    - ASI01:2026
+    - ASI05:2026
   mitre_atlas:
-    - AML.T0057 - LLM Data Leakage
+    - AML.T0077 - LLM Response Rendering
+    - AML.T0050 - Command and Scripting Interpreter
 metadata_provenance:
   cve: human-authored
   cwe: human-authored

package/rules/context-exfiltration/ATR-2026-00702-ipi-credential-exfil-via-agent-action.yaml

@@ -13,13 +13,15 @@ severity: critical
 references:
   owasp_llm:
     - LLM01:2025
+    - LLM02:2025
     - LLM06:2025
   owasp_agentic:
     - ASI01:2026
-    - ASI07:2026
+    - ASI02:2026
   mitre_atlas:
     - AML.T0051 - LLM Prompt Injection
     - AML.T0051.001 - Indirect
+    - AML.T0086 - Exfiltration via AI Agent Tool Invocation
 compliance:
   owasp_llm:
     - id: LLM01:2025
@@ -29,8 +31,8 @@ compliance:
       context: The attack instructs the agent to disclose stored credentials or API keys to an attacker-controlled destination.
       strength: primary
   owasp_agentic:
-    - id: ASI07:2026
-      context: The agent is induced to exfiltrate sensitive data (credentials, API keys, passwords) to an external endpoint.
+    - id: ASI01:2026
+      context: The patterns match content the agent reads that tells it to get API keys, passwords or stored credentials and send, email, share or forward them to an outside email address or URL, or that states such an exfiltration objective. ASI01:2026 covers manipulation of an agent's goals through deceptive tool outputs or poisoned external data, and lists indirect prompt injection that redirects an agent to exfiltrate sensitive data or misuse connected tools.
       strength: primary
   nist_ai_rmf:
     - subcategory: MS.2.7

package/rules/context-exfiltration/ATR-2026-00703-ipi-financial-data-exfil-indirect.yaml

@@ -13,13 +13,15 @@ severity: critical
 references:
   owasp_llm:
     - LLM01:2025
+    - LLM02:2025
     - LLM06:2025
   owasp_agentic:
     - ASI01:2026
-    - ASI07:2026
+    - ASI02:2026
   mitre_atlas:
     - AML.T0051 - LLM Prompt Injection
     - AML.T0051.001 - Indirect
+    - AML.T0086 - Exfiltration via AI Agent Tool Invocation
 compliance:
   owasp_llm:
     - id: LLM01:2025
@@ -29,8 +31,8 @@ compliance:
       context: The agent is induced to disclose sensitive financial data (payment methods, bank accounts, card info) to an attacker.
       strength: primary
   owasp_agentic:
-    - id: ASI07:2026
-      context: Financial data exfiltration via agent-executed tool calls is the ASI07:2026 Data and Model Exfiltration pattern.
+    - id: ASI01:2026
+      context: The patterns match content the agent reads that tells it to retrieve saved payment methods, bank account or card details, or financial reports and email, send, share or forward them, or that states an objective of getting the user's bank, card or payment data. ASI01:2026 covers manipulation of an agent's goals through deceptive tool outputs or poisoned external data, and lists indirect prompt injection that redirects an agent to exfiltrate sensitive data or misuse connected tools.
       strength: primary
   nist_ai_rmf:
     - subcategory: MS.2.7

package/rules/context-exfiltration/ATR-2026-00704-ipi-medical-genetic-data-exfil.yaml

@@ -13,13 +13,15 @@ severity: critical
 references:
   owasp_llm:
     - LLM01:2025
+    - LLM02:2025
     - LLM06:2025
   owasp_agentic:
     - ASI01:2026
-    - ASI07:2026
+    - ASI02:2026
   mitre_atlas:
     - AML.T0051 - LLM Prompt Injection
     - AML.T0051.001 - Indirect
+    - AML.T0086 - Exfiltration via AI Agent Tool Invocation
 compliance:
   owasp_llm:
     - id: LLM01:2025
@@ -29,8 +31,8 @@ compliance:
       context: The agent is induced to disclose sensitive health and genetic information to an attacker-controlled destination.
       strength: primary
   owasp_agentic:
-    - id: ASI07:2026
-      context: Medical record and genetic data exfiltration via agent tool calls is the ASI07:2026 pattern applied to healthcare data.
+    - id: ASI01:2026
+      context: The patterns match content the agent reads that tells it to download health records, lab reports or 23andMe genetic data and email, send, share or forward them, or to delete all clinical documents tied to a diagnosis. ASI01:2026 covers manipulation of an agent's goals through deceptive tool outputs or poisoned external data, and lists indirect prompt injection that redirects an agent to exfiltrate sensitive data or misuse connected tools.
       strength: primary
   nist_ai_rmf:
     - subcategory: MS.2.7

package/rules/context-exfiltration/ATR-2026-00705-ipi-location-address-browsing-exfil.yaml

@@ -13,13 +13,15 @@ severity: high
 references:
   owasp_llm:
     - LLM01:2025
+    - LLM02:2025
     - LLM06:2025
   owasp_agentic:
     - ASI01:2026
-    - ASI07:2026
+    - ASI02:2026
   mitre_atlas:
     - AML.T0051 - LLM Prompt Injection
     - AML.T0051.001 - Indirect
+    - AML.T0086 - Exfiltration via AI Agent Tool Invocation
 compliance:
   owasp_llm:
     - id: LLM01:2025
@@ -29,8 +31,8 @@ compliance:
       context: The agent is induced to disclose personal location data, home/work addresses, or browsing history to an attacker.
       strength: primary
   owasp_agentic:
-    - id: ASI07:2026
-      context: Location and browsing data exfiltration via agent tool calls is the ASI07:2026 pattern applied to personal tracking data.
+    - id: ASI01:2026
+      context: The patterns match content the agent reads that tells it to get the user's current location from Maps, saved home or work addresses, or search and browsing history and email, send, share or forward them. ASI01:2026 covers manipulation of an agent's goals through deceptive tool outputs or poisoned external data, and lists indirect prompt injection that redirects an agent to exfiltrate sensitive data or misuse connected tools.
       strength: primary
   nist_ai_rmf:
     - subcategory: MS.2.7

package/rules/context-exfiltration/ATR-2026-00706-ipi-physical-biometric-exfil.yaml

@@ -13,13 +13,15 @@ severity: critical
 references:
   owasp_llm:
     - LLM01:2025
+    - LLM02:2025
     - LLM06:2025
   owasp_agentic:
     - ASI01:2026
-    - ASI07:2026
+    - ASI02:2026
   mitre_atlas:
     - AML.T0051 - LLM Prompt Injection
     - AML.T0051.001 - Indirect
+    - AML.T0086 - Exfiltration via AI Agent Tool Invocation
     - AML.T0088 - Generate Deepfakes
 compliance:
   owasp_llm:
@@ -30,8 +32,8 @@ compliance:
       context: The agent is induced to generate and exfiltrate deepfake audio or biometric media to an attacker-controlled destination.
       strength: primary
   owasp_agentic:
-    - id: ASI07:2026
-      context: Deepfake audio generation and exfil via agent tool calls is the ASI07:2026 pattern applied to biometric/physical media.
+    - id: ASI01:2026
+      context: The patterns match content the agent reads that tells it to generate a deepfake or voice clone from the user's recordings, process a recording, or fetch ID, passport or driver's license scans, and send the result out. ASI01:2026 covers manipulation of an agent's goals through deceptive tool outputs or poisoned external data, and lists indirect prompt injection that redirects an agent to exfiltrate sensitive data or misuse connected tools.
       strength: primary
   nist_ai_rmf:
     - subcategory: MS.2.7

package/rules/context-exfiltration/ATR-2026-00707-ipi-file-exfil-with-destroy-or-tamper.yaml

@@ -13,13 +13,16 @@ severity: critical
 references:
   owasp_llm:
     - LLM01:2025
+    - LLM02:2025
     - LLM06:2025
   owasp_agentic:
     - ASI01:2026
-    - ASI07:2026
+    - ASI02:2026
   mitre_atlas:
     - AML.T0051 - LLM Prompt Injection
     - AML.T0051.001 - Indirect
+    - AML.T0086 - Exfiltration via AI Agent Tool Invocation
+    - AML.T0101 - Data Destruction via AI Agent Tool Invocation
 compliance:
   owasp_llm:
     - id: LLM01:2025
@@ -29,8 +32,8 @@ compliance:
       context: The combined attack causes sensitive file disclosure followed by destruction or falsification of the source.
       strength: primary
   owasp_agentic:
-    - id: ASI07:2026
-      context: File exfiltration followed by deletion or tampering via agent tool calls is the ASI07:2026 pattern with additional data integrity impact.
+    - id: ASI01:2026
+      context: The patterns match content the agent reads that tells it to take a file from Google Drive, Dropbox, OneDrive or other cloud storage, or a configuration, credential, secret or backup file, and then delete, edit or tamper with the original. ASI01:2026 covers manipulation of an agent's goals through deceptive tool outputs or poisoned external data, and lists indirect prompt injection that redirects an agent to exfiltrate sensitive data or misuse connected tools.
       strength: primary
   nist_ai_rmf:
     - subcategory: MS.2.7

package/rules/context-exfiltration/ATR-2026-00860-indirect-pi-financial-transfer-hijack.yaml

@@ -16,7 +16,7 @@ references:
     - LLM06:2025
   owasp_agentic:
     - ASI01:2026
-    - ASI03:2026
+    - ASI02:2026
   mitre_atlas:
     - AML.T0051.001 - Indirect
   mitre_attack:

package/rules/context-exfiltration/ATR-2026-00861-indirect-pi-crypto-transfer-hijack.yaml

@@ -16,7 +16,7 @@ references:
     - LLM06:2025
   owasp_agentic:
     - ASI01:2026
-    - ASI03:2026
+    - ASI02:2026
   mitre_atlas:
     - AML.T0051.001 - Indirect
   mitre_attack:

package/rules/context-exfiltration/ATR-2026-01605-ssrf-aws-metadata-endpoint.yaml

@@ -19,10 +19,14 @@ severity: critical
 references:
   owasp_llm:
     - LLM02:2025
+    - LLM05:2025
   owasp_agentic:
     - ASI03:2026
+    - ASI02:2026
   mitre_atlas:
-    - AML.T0043 - Craft Adversarial Data
+    - AML.T0055 - Unsecured Credentials
+    - AML.T0049 - Exploit Public-Facing Application
+    - AML.T0053 - AI Agent Tool Invocation
   mitre_attack:
     - T1552.005 - Cloud Instance Metadata API
 compliance:

package/rules/context-exfiltration/ATR-2026-01606-ssrf-internal-network-scan.yaml

@@ -20,10 +20,13 @@ severity: high
 references:
   owasp_llm:
     - LLM02:2025
+    - LLM05:2025
   owasp_agentic:
+    - ASI02:2026
     - ASI03:2026
   mitre_atlas:
-    - AML.T0043 - Craft Adversarial Data
+    - AML.T0049 - Exploit Public-Facing Application
+    - AML.T0053 - AI Agent Tool Invocation
   mitre_attack:
     - T1090 - Proxy
 compliance:

package/rules/context-exfiltration/ATR-2026-01607-ssrf-localhost-service-probe.yaml

@@ -19,10 +19,13 @@ severity: critical
 references:
   owasp_llm:
     - LLM02:2025
+    - LLM05:2025
   owasp_agentic:
+    - ASI02:2026
     - ASI03:2026
   mitre_atlas:
-    - AML.T0043 - Craft Adversarial Data
+    - AML.T0049 - Exploit Public-Facing Application
+    - AML.T0053 - AI Agent Tool Invocation
   mitre_attack:
     - T1552.005 - Cloud Instance Metadata API
 compliance:

package/rules/context-exfiltration/ATR-2026-01924-system-instruction-extraction-reformat.yaml

@@ -15,18 +15,15 @@ references:
     - LLM07:2025
     - LLM01:2025
   owasp_agentic:
-    - ASI05:2026
     - ASI01:2026
   mitre_atlas:
+    - AML.T0056 - Extract LLM System Prompt
     - AML.T0051 - LLM Prompt Injection
     - AML.T0057 - LLM Data Leakage
   research:
     - https://github.com/HumanCompatibleAI/tensor-trust
 compliance:
   owasp_agentic:
-    - id: ASI05:2026
-      context: Reformat-based extraction of the agent's hidden instructions discloses sensitive system configuration, satisfying ASI05:2026 Sensitive Information Disclosure.
-      strength: primary
     - id: ASI01:2026
       context: Reciting the defense prompt as a 'summary' subverts the agent's confidentiality goal, a goal-hijack via laundered reformatting.
       strength: secondary

package/rules/context-exfiltration/ATR-2026-01948-netlicensing-mcp-product-number-path-traversal-token-leak.yaml

@@ -12,11 +12,13 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
-    - LLM06:2025
+    - LLM02:2025
+    - LLM05:2025
   owasp_agentic:
-    - ASI06:2026
+    - ASI02:2026
   mitre_atlas:
     - AML.T0049 - Exploit Public-Facing Application
+    - AML.T0098 - AI Agent Tool Credential Harvesting
   mitre_attack:
     - T1190 - Exploit Public-Facing Application
   cve:

package/rules/context-exfiltration/ATR-2026-01957-m365-copilot-searchleak-open-redirect-exfil.yaml

@@ -12,10 +12,14 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
-    - LLM06:2025
+    - LLM01:2025
+    - LLM02:2025
   owasp_agentic:
-    - ASI06:2026
+    - ASI01:2026
+    - ASI02:2026
   mitre_atlas:
+    - AML.T0051 - LLM Prompt Injection
+    - AML.T0077 - LLM Response Rendering
     - AML.T0049 - Exploit Public-Facing Application
   mitre_attack:
     - T1190 - Exploit Public-Facing Application

package/rules/context-exfiltration/ATR-2026-01961-meta-ads-mcp-unauth-token-leak.yaml

@@ -12,11 +12,14 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
+    - LLM02:2025
     - LLM06:2025
   owasp_agentic:
-    - ASI06:2026
+    - ASI03:2026
+    - ASI02:2026
   mitre_atlas:
     - AML.T0049 - Exploit Public-Facing Application
+    - AML.T0098 - AI Agent Tool Credential Harvesting
   mitre_attack:
     - T1190 - Exploit Public-Facing Application
   cve:

package/rules/context-exfiltration/ATR-2026-01964-langchain-gmailtoolkit-indirect-prompt-injection-email-exfil.yaml

@@ -12,11 +12,15 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
+    - LLM01:2025
+    - LLM02:2025
     - LLM06:2025
   owasp_agentic:
-    - ASI06:2026
+    - ASI01:2026
+    - ASI02:2026
   mitre_atlas:
-    - AML.T0049 - Exploit Public-Facing Application
+    - AML.T0051.001 - Indirect
+    - AML.T0086 - Exfiltration via AI Agent Tool Invocation
   mitre_attack:
     - T1190 - Exploit Public-Facing Application
   cve:

package/rules/context-exfiltration/ATR-2026-02140-ssrf-ipv6-hex-encoded-cloud-metadata-bypass.yaml

@@ -12,7 +12,7 @@ maturity: experimental
 severity: high
 references:
   owasp_llm:
-    - LLM08:2025
+    - LLM05:2025
   owasp_agentic:
     - ASI02:2026
   mitre_attack:

package/rules/context-exfiltration/ATR-2026-02304-preapproved-domain-encoded-path-exfil.yaml

@@ -75,7 +75,7 @@ detection:
       description: WebFetch-style URL to huggingface.co/hf.co whose path contains a base64-padded (trailing '=') encoded segment -- not a normal repo/file name shape
     - field: content
       operator: regex
-      value: (?i)(?<=\b(?:WebFetch|fetch(?:_url)?|curl|wget|GET|POST|download(?:ing)?|(?:send|issue|make)\s+(?:a\s+|an\s+)?(?:web)?fetch|request(?:ing)?)\b[\s\S]{0,30}?)\bhuggingface\.co\b[\s\S]{0,40}?\b(?:encode|base64|exfiltrat\w*|covert\s+channel|out-of-band\s+channel)\b
+      value: (?i)\b(?:WebFetch|fetch(?:_url)?|curl|wget|GET|POST|download(?:ing)?|(?:send|issue|make)\s+(?:a\s+|an\s+)?(?:web)?fetch|request(?:ing)?)\b[\s\S]{0,30}?\bhuggingface\.co\b[\s\S]{0,40}?\b(?:encode|base64|exfiltrat\w*|covert\s+channel|out-of-band\s+channel)\b
       description: Natural-language framing describing encoding/exfiltrating data via a huggingface.co request -- catches the instruction-level technique before a concrete URL is constructed. Requires an actual fetch/request-action cue (WebFetch, fetch, curl, download, 'issue a fetch', etc.) within 30 chars BEFORE the domain, and the encode/base64/exfiltrate trigger within a tightened 40 chars AFTER the domain, so ordinary prose merely co-mentioning huggingface.co and base64/encode in the same sentence (with no request framing) does not fire
   false_positives:
     - An ordinary WebFetch/download URL to a real HuggingFace model or dataset repository, e.g. https://huggingface.co/bert-base-uncased/resolve/main/config.json -- model/file names are short hyphenated slugs, not a 16+ character base64-padded blob

package/rules/context-exfiltration/ATR-2026-02351-wildcard-dns-ssrf-hostname-ip-encoding-bypass.yaml

@@ -15,7 +15,7 @@ references:
   cwe:
     - CWE-918
   owasp_llm:
-    - LLM08:2025
+    - LLM05:2025
   owasp_agentic:
     - ASI02:2026
   mitre_attack:

package/rules/data-poisoning/ATR-2026-00070-data-poisoning.yaml

@@ -42,7 +42,7 @@ compliance:
       context: Poisoned knowledge base entries injected into the supply chain of training or retrieval data satisfy the LLM03:2025 Supply Chain Vulnerabilities category at the data tier.
       strength: secondary
     - id: LLM08:2025
-      context: Malicious vector store entries that cause the agent to retrieve and act on attacker-controlled instructions fall under LLM08:2025 Excessive Agency triggered by contaminated retrieval context.
+      context: 'The patterns match hidden directives in tool output (the rule targets retrieved documents and knowledge-base entries): fake [SYSTEM] or <system> tags, ignore-previous-instructions overrides, retrieval-triggered phrases, BEGIN HIDDEN INSTRUCTIONS blocks, ''for internal use only'' sections, concealment and stealth-action directives, mode switches, role-play and append-to-every-response directives, injected chat turns, prompt-template delimiters and exfiltration commands with a target address. LLM08:2025, which covers systems using Retrieval Augmented Generation, lists data poisoning from insiders, prompts, data seeding or unverified data providers, leading to manipulated model outputs; the patterns see a poisoned entry when it is returned but not whether it came from a vector store, so the fit is partial.'
       strength: partial
   eu_ai_act:
     - article: '15'

package/rules/excessive-autonomy/ATR-2026-00491-garak-agent-breaker-markdown-just-raw-json.yaml

@@ -12,19 +12,19 @@ maturity: test
 severity: high
 references:
   owasp_llm:
-    - LLM06:2025
+    - LLM07:2025
   owasp_agentic:
-    - ASI06:2026
+    - ASI01:2026
   mitre_atlas:
-    - AML.T0053 - AI Agent Tool Invocation
+    - AML.T0084.001 - Tool Definitions
 compliance:
   owasp_agentic:
-    - id: ASI06:2026
-      context: Excessive autonomy attacks induce agents to perform actions beyond their authorized scope -- the canonical ASI06:2026 Tool Misuse vector when executed via prompt manipulation.
-      strength: primary
+    - id: ASI01:2026
+      context: 'The patterns match prompts that ask the agent to turn its self-description or a response into a structured list of tools, to return or list every tool it can use, to analyse each tool for exploits, or that pair a security-researcher framing with the agent''s tools or weaknesses. ASI01:2026 is the closest agentic entry: it covers prompt-based manipulation of an agent''s task selection, but the rule detects a reconnaissance request rather than a changed goal, so the fit is partial.'
+      strength: partial
   owasp_llm:
-    - id: LLM06:2025
-      context: This rule detects LLM06:2025 Excessive Agency patterns where adversarial inputs cause agents to perform unauthorized actions, including SSRF, shell execution, and unscoped browsing.
+    - id: LLM07:2025
+      context: The patterns match requests for the agent to list or dump its own tools, functions and capabilities, or to describe them for exploit analysis. LLM07:2025 covers disclosure of the system prompts or instructions used to steer the model, including exposure of sensitive functionality, which an attacker can use to facilitate other attacks.
       strength: primary
   eu_ai_act:
     - article: '15'