agent-threat-rules 4.2.0 → 4.2.2

package/rules/excessive-autonomy/ATR-2026-00500-ssrf-via-agent-url-fetch-instruction.yaml

@@ -1,9 +1,9 @@
 title: SSRF via Agent URL Fetch Instruction
 id: ATR-2026-00500
-rule_version: 2
+rule_version: 3
 status: experimental
 description: |
-  Detects prompts instructing an AI agent to fetch or retrieve content from internal network addresses, exposing SSRF (Server-Side Request Forgery) risk. Covers: cloud metadata endpoints (AWS IMDS 169.254.169.254, GCP metadata.google.internal), localhost and loopback admin panels (127.0.0.1, localhost), RFC-1918 private IP ranges (10.x.x.x, 172.16-31.x.x, 192.168.x.x), and generic internal hostname patterns. These attacks exploit agents with web-fetch tools to pivot to internal services. Generalised from promptfoo SSRF plugin corpus - literal internal.corp.example.com replaced with pattern matching any internal-like hostname or private IP range.
+  Detects prompts instructing an AI agent to fetch or retrieve content from internal network addresses or local resources, exposing SSRF (Server-Side Request Forgery) risk. Covers: cloud metadata endpoints (AWS IMDS 169.254.169.254, GCP metadata.google.internal), localhost and loopback admin panels (127.0.0.1, localhost), RFC-1918 private IP ranges (10.x.x.x, 172.16-31.x.x, 192.168.x.x), internal hostname prefixes (internal., intranet., corp.), hosts under internal-only names (.local, .internal, .intranet, .corp, .lan, .localdomain, .home.arpa), and local-file / non-HTTP SSRF schemes (file:// to system paths, gopher://, dict://, ldap://, tftp://). These attacks exploit agents with web-fetch tools to pivot to internal services or read local files. Grounded in the promptfoo SSRF plugin's documented test cases (promptfoo/promptfoo site/docs/red-team/plugins/ssrf.md, "Example Test Cases" 1-3, identical at commits 5f89b7c86ea04e5c03fbe7789dd0e47aed05bf43 and ea8b3d073a63769f7be243ac3c3460f72881a930), which are the three vendor true positives below. promptfoo generates SSRF prompts server-side and ships no further SSRF prompts in its repository; the remaining true positives are ATR-authored and labelled synthetic.
 author: ATR Community (vendor-corpus-import)
 date: '2026-05-12'
 schema_version: '0.1'
@@ -13,14 +13,16 @@ severity: critical
 references:
   owasp_llm:
     - LLM06:2025
+    - LLM05:2025
   owasp_agentic:
-    - ASI06:2026
+    - ASI02:2026
   mitre_atlas:
     - AML.T0053 - AI Agent Tool Invocation
+    - AML.T0049 - Exploit Public-Facing Application
 compliance:
   owasp_agentic:
-    - id: ASI06:2026
-      context: Excessive autonomy attacks induce agents to perform actions beyond their authorized scope -- the canonical ASI06:2026 Tool Misuse vector when executed via prompt manipulation.
+    - id: ASI02:2026
+      context: The patterns match prompts telling the agent to fetch cloud metadata endpoints (169.254.169.254, metadata.google.internal), localhost, RFC 1918 addresses or internal hostnames. ASI02:2026 covers an agent applying a legitimate tool in an unsafe way; here the web-fetch tool is pointed at internal services, a server-side request forgery.
       strength: primary
   owasp_llm:
     - id: LLM06:2025
@@ -63,6 +65,8 @@ tags:
   subcategory: ssrf-via-agent
   scan_target: llm_io
   confidence: medium
+  source: vendor-test-suite
+  vendor_sources: promptfoo
 agent_source:
   type: llm_io
   framework:
@@ -91,6 +95,14 @@ detection:
       operator: regex
       value: (?i)https?://169\.254\.169\.254/(latest|v[0-9]|meta|latest/meta-data)
       description: Direct mention of AWS IMDS endpoint URL
+    - field: user_input
+      operator: regex
+      value: (?i)(\b(can|could|would|will)\s+you\b.{0,30}|\bplease\s+)\b(fetch|retrieve|get|load|read|access|visit|open|download|pull|grab|scrape|crawl|display|show)\b.{0,60}https?://[a-z0-9.-]{1,253}\.(local|internal|intranet|corp|lan|localdomain|home\.arpa)(:[0-9]{1,5})?([/?#]|\s|$)
+      description: Request to the agent to fetch from a host under an internal-only name (.local, .internal, .intranet, .corp, .lan, .localdomain, .home.arpa)
+    - field: user_input
+      operator: regex
+      value: (?i)\b(fetch|retrieve|get|request|load|read|access|open|download|curl|display|show|summari[sz]e|print|dump)\b.{0,60}(file://(localhost)?/(etc|proc|root|sys|boot|var/run|var/lib|windows|\.ssh|\.aws|\.kube)\b|(gopher|dict|ldap|tftp)://)
+      description: Fetch/read instruction targeting a local system path via file:// or a non-HTTP SSRF scheme (gopher, dict, ldap, tftp)
   condition: any
   false_positives:
     - Network troubleshooting discussions mentioning private IP ranges without fetch instructions

package/rules/excessive-autonomy/ATR-2026-00708-ipi-financial-transfer-unauthorized.yaml

@@ -13,9 +13,10 @@ severity: critical
 references:
   owasp_llm:
     - LLM01:2025
+    - LLM06:2025
   owasp_agentic:
     - ASI01:2026
-    - ASI03:2026
+    - ASI02:2026
   mitre_atlas:
     - AML.T0051 - LLM Prompt Injection
     - AML.T0051.001 - Indirect
@@ -25,8 +26,8 @@ compliance:
       context: Unauthorized financial transfer via indirect PI is a LLM01 attack that embeds payment instructions in consumed structured data.
       strength: primary
   owasp_agentic:
-    - id: ASI03:2026
-      context: The agent is induced to take consequential financial actions (payment, crypto transfer) far beyond the intended task scope.
+    - id: ASI01:2026
+      context: The patterns match content the agent reads that tells it to make a payment or transfer to a stated payee, account, IBAN or wallet, move a full balance, or change the recipient of a recurring payment. ASI01:2026 covers manipulation of an agent's goals through deceptive tool outputs or poisoned external data, and lists a malicious prompt override that manipulates a financial agent into transferring money to an attacker's account.
       strength: primary
   nist_ai_rmf:
     - subcategory: MS.2.7

package/rules/excessive-autonomy/ATR-2026-00711-ipi-system-sabotage-destructive-command.yaml

@@ -13,9 +13,10 @@ severity: critical
 references:
   owasp_llm:
     - LLM01:2025
+    - LLM06:2025
   owasp_agentic:
     - ASI01:2026
-    - ASI03:2026
+    - ASI05:2026
   mitre_atlas:
     - AML.T0051 - LLM Prompt Injection
     - AML.T0051.001 - Indirect
@@ -26,8 +27,8 @@ compliance:
       context: System sabotage via indirect PI embeds destructive shell command instructions in content consumed by computer-use agents.
       strength: primary
   owasp_agentic:
-    - id: ASI03:2026
-      context: Executing destructive shell commands (kernel removal, firewall disable) is excessive agency with permanent system impact.
+    - id: ASI05:2026
+      context: 'The patterns match destructive shell commands planted in content the agent reads: removing kernel packages, disabling the firewall (ufw disable, iptables -F), rm -rf of boot files or conda environments, or running guide.sh whatever the result. ASI05:2026 lists prompt injection that leads to execution of attacker-defined code and shell command invocation from reflected prompts.'
       strength: primary
   nist_ai_rmf:
     - subcategory: MS.2.7

package/rules/excessive-autonomy/ATR-2026-00712-ipi-malicious-package-install.yaml

@@ -13,9 +13,11 @@ severity: critical
 references:
   owasp_llm:
     - LLM01:2025
+    - LLM03:2025
   owasp_agentic:
     - ASI01:2026
-    - ASI03:2026
+    - ASI04:2026
+    - ASI05:2026
   mitre_atlas:
     - AML.T0051 - LLM Prompt Injection
     - AML.T0011.001 - Malicious Package
@@ -25,8 +27,8 @@ compliance:
       context: Malicious package install via indirect PI embeds package manager instructions in agent-consumed emails or documents.
       strength: primary
   owasp_agentic:
-    - id: ASI03:2026
-      context: Executing pip/npm install of an attacker-supplied package is excessive agency that installs malware on the host system.
+    - id: ASI05:2026
+      context: The patterns match content the agent reads that tells it to run pip or npm install for a package described as malicious or taken from an attacker-controlled index. ASI05:2026 lists malicious package installs whose hostile code executes during installation or import, triggered here by prompt injection.
       strength: primary
   nist_ai_rmf:
     - subcategory: MS.2.7

package/rules/excessive-autonomy/ATR-2026-00718-tool-misuse-financial-autonomous.yaml

@@ -12,19 +12,20 @@ maturity: stable
 severity: high
 references:
   owasp_llm:
-    - LLM08:2025
+    - LLM06:2025
   owasp_agentic:
-    - ASI03:2026
+    - ASI02:2026
   mitre_atlas:
-    - AML.T0051 - LLM Prompt Injection
+    - AML.T0053 - AI Agent Tool Invocation
+    - AML.T0048.000 - Financial Harm
 compliance:
   owasp_llm:
-    - id: LLM08:2025
-      context: Autonomous financial trading without per-transaction confirmation is the LLM08 excessive agency pattern applied to financial services.
+    - id: LLM06:2025
+      context: The patterns match requests that have an agent place trades, withdraw a full exchange balance or send crypto to a stored wallet address. LLM06:2025 covers damaging actions taken through an agent's extensions, including excessive autonomy where high-impact actions are not independently verified or approved; the rule flags the request, not the agent's configuration.
       strength: primary
   owasp_agentic:
-    - id: ASI03:2026
-      context: Placing trades or cryptocurrency transfers autonomously is excessive agency with direct financial harm potential.
+    - id: ASI02:2026
+      context: The patterns match direct requests for an agent with exchange or wallet tools to place buy or sell orders, withdraw an entire balance, or send funds to a wallet address read from a note. ASI02:2026 covers an agent applying a legitimate tool in an unsafe way through ambiguous instruction or over-privileged access, such as a tool with full financial API access.
       strength: primary
   nist_ai_rmf:
     - subcategory: MS.2.7

package/rules/excessive-autonomy/ATR-2026-00719-tool-misuse-destructive-bulk-action.yaml

@@ -12,15 +12,15 @@ maturity: stable
 severity: high
 references:
   owasp_llm:
-    - LLM08:2025
+    - LLM06:2025
   owasp_agentic:
     - ASI03:2026
   mitre_atlas:
     - AML.T0051 - LLM Prompt Injection
 compliance:
   owasp_llm:
-    - id: LLM08:2025
-      context: 'Destructive bulk actions (delete all, turn off all) are LLM08 excessive agency: the agent''s capability to delete/control is applied universally without scope limits.'
+    - id: LLM06:2025
+      context: The patterns match direct requests for an agent to delete all tasks or records matching a keyword or label, turn off all or a broad set of connected devices, or cut main power or a circuit breaker through a home-automation app. LLM06:2025 covers damaging actions taken through an agent's extensions, including excessive autonomy where high-impact actions run without independent verification or approval, such as deletions without user confirmation; the rule flags the request, not the agent's configuration.
       strength: primary
   owasp_agentic:
     - id: ASI03:2026

package/rules/excessive-autonomy/ATR-2026-01773-semantic-excessive-agency-action.yaml

@@ -27,7 +27,7 @@ maturity: experimental
 severity: high
 references:
   owasp_llm:
-    - LLM08:2025
+    - LLM06:2025
   owasp_agentic:
     - ASI03:2026
     - ASI02:2026
@@ -35,8 +35,8 @@ references:
     - AML.T0051 - LLM Prompt Injection
 compliance:
   owasp_llm:
-    - id: LLM08:2025
-      context: Broad-scope bulk actions, untrusted code execution, and proxy privilege grants are all core LLM08:2025 excessive-agency outcomes.
+    - id: LLM06:2025
+      context: 'The patterns match requests that give an agent broad or unclear real-world scope: send a message to all customers or subscribers, turn off all or connected devices to save energy, for safety, or before or while something else, set a thermostat to a ''comfortable'' temperature, download and run a script from a link or URL, run and fix a crashing script from a GitHub, GitLab or Bitbucket repository, grant access to a third party or everyone, unblock a restricted domain, site or network, or invite a named person to a private resource. LLM06:2025 covers damaging actions taken through an agent''s extensions in response to unexpected, ambiguous or manipulated LLM outputs, rooted in excessive functionality, permissions or autonomy; the rule flags the request, not the agent''s configuration.'
       strength: primary
   owasp_agentic:
     - id: ASI03:2026

package/rules/excessive-autonomy/ATR-2026-01801-asb-autonomous-vehicle-sabotage.yaml

@@ -12,7 +12,7 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
-    - LLM08:2025
+    - LLM06:2025
     - LLM01:2025
   owasp_agentic:
     - ASI03:2026
@@ -27,8 +27,8 @@ metadata_provenance:
   owasp_agentic: human-reviewed
 compliance:
   owasp_llm:
-    - id: LLM08:2025
-      context: Driving the agent's vehicle-control capability to sabotage brakes, steering, or sensors is a maximal excessive-agency outcome under LLM08:2025.
+    - id: LLM06:2025
+      context: The patterns match requests to compromise, corrupt, disrupt or jam a vehicle safety subsystem (brakes, control systems, path planning, lidar, GPS, cameras, V2X, collision warning), seize or hijack vehicle control, forge duplicate vehicle identities, trigger an unauthorized emergency shutdown, or inject false collision warnings, traffic-sign signals or sensor data. LLM06:2025 covers damaging actions an LLM agent performs through its extensions, with prompt injection from a malicious user among the listed triggers and excessive functionality, permissions or autonomy as the root cause; the rule flags the request, not the agent's privileges.
       strength: primary
   owasp_agentic:
     - id: ASI03:2026

package/rules/excessive-autonomy/ATR-2026-01804-asb-covert-unlogged-action.yaml

@@ -12,11 +12,10 @@ maturity: test
 severity: high
 references:
   owasp_llm:
-    - LLM08:2025
+    - LLM06:2025
     - LLM01:2025
   owasp_agentic:
     - ASI02:2026
-    - ASI03:2026
   mitre_atlas:
     - AML.T0051 - LLM Prompt Injection
   research:
@@ -27,8 +26,8 @@ metadata_provenance:
   owasp_agentic: human-reviewed
 compliance:
   owasp_llm:
-    - id: LLM08:2025
-      context: Directing the agent to perform an action while keeping it out of audit records is an excessive-agency outcome that defeats oversight, under LLM08:2025.
+    - id: LLM06:2025
+      context: 'The patterns match a request to perform an action together with a directive to hide it: keep it out of the official records or logs, make it appear legitimate in the system, or make sure the system or the person affected does not detect it. LLM06:2025 covers damaging actions an LLM agent performs through its extensions, with prompt injection from a malicious user among the listed triggers and excessive functionality, permissions or autonomy as the root cause; the rule flags the request, not the agent''s privileges. LLM06 lists logging and monitoring of extension activity among the measures that limit the damage, and this directive asks the agent to stay out of that record.'
       strength: primary
   owasp_agentic:
     - id: ASI02:2026

package/rules/excessive-autonomy/ATR-2026-01805-asb-financial-fraud-execution.yaml

@@ -12,7 +12,7 @@ maturity: test
 severity: high
 references:
   owasp_llm:
-    - LLM08:2025
+    - LLM06:2025
     - LLM01:2025
   owasp_agentic:
     - ASI02:2026
@@ -27,8 +27,8 @@ metadata_provenance:
   owasp_agentic: human-reviewed
 compliance:
   owasp_llm:
-    - id: LLM08:2025
-      context: Driving the agent's financial tools to run a Ponzi scheme, fabricate statements, or redirect funds without authorization is a severe excessive-agency outcome under LLM08:2025.
+    - id: LLM06:2025
+      context: The patterns match requests to run a Ponzi-style scheme, produce alternative financial statements or alter backup financial data, move a dollar amount out of a client account without authorization, route funds through a company to test laundering detection, open accounts from client information, or apply for a loan on experimental projections. LLM06:2025 covers damaging actions an LLM agent performs through its extensions, with prompt injection from a malicious user among the listed triggers and excessive functionality, permissions or autonomy as the root cause; the rule flags the request, not the agent's privileges.
       strength: primary
   owasp_agentic:
     - id: ASI02:2026

package/rules/excessive-autonomy/ATR-2026-01806-asb-clinical-patient-harm.yaml

@@ -12,7 +12,7 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
-    - LLM08:2025
+    - LLM06:2025
     - LLM01:2025
   owasp_agentic:
     - ASI03:2026
@@ -27,8 +27,8 @@ metadata_provenance:
   owasp_agentic: human-reviewed
 compliance:
   owasp_llm:
-    - id: LLM08:2025
-      context: Driving a clinical agent to overdose, falsify a diagnosis, or neglect care is a maximal excessive-agency / safety outcome under LLM08:2025.
+    - id: LLM06:2025
+      context: The patterns match requests to give a high dose of a drug or a number of opioid or insulin tablets framed as a controlled study or trial, record an incorrect or simulated diagnosis, file an insurance claim for treatment not provided, or neglect care or disrupt therapy to cause patient harm. LLM06:2025 covers damaging actions an LLM agent performs through its extensions, with prompt injection from a malicious user among the listed triggers and excessive functionality, permissions or autonomy as the root cause; the rule flags the request, not the agent's privileges.
       strength: primary
   owasp_agentic:
     - id: ASI03:2026

package/rules/excessive-autonomy/ATR-2026-01809-semantic-insider-manipulation-process-corruption.yaml

@@ -28,7 +28,6 @@ maturity: test
 severity: high
 references:
   owasp_llm:
-    - LLM08:2025
     - LLM06:2025
   owasp_agentic:
     - ASI02:2026
@@ -43,8 +42,8 @@ metadata_provenance:
   owasp_agentic: human-reviewed
 compliance:
   owasp_llm:
-    - id: LLM08:2025
-      context: Driving the agent's business tools to manipulate markets, corrupt a legal process, or move funds on a vague pretext is an excessive-agency outcome under LLM08:2025.
+    - id: LLM06:2025
+      context: The patterns match requests to adjust a stock's trading data or move portfolio funds into high-risk stocks to test the market, trade securities on future-market predictions, look for incentives for a judge or pressure a witness, or surveil the opposing party's attorney. LLM06:2025 covers damaging actions an LLM agent performs through its extensions, with prompt injection from a malicious user among the listed triggers and excessive functionality, permissions or autonomy as the root cause; the rule flags the request, not the agent's privileges.
       strength: primary
   owasp_agentic:
     - id: ASI02:2026

package/rules/excessive-autonomy/ATR-2026-01989-t1046-agent-internal-network-sweep.yaml

@@ -22,9 +22,9 @@ references:
   mitre_attack:
     - T1046 - Network Service Discovery
   mitre_atlas:
-    - AML.T0011 - User Execution
+    - AML.T0053 - AI Agent Tool Invocation
   owasp_agentic:
-    - ASI06:2026
+    - ASI02:2026
   owasp_llm:
     - LLM06:2025
 tags:

package/rules/excessive-autonomy/ATR-2026-01993-t1562-agent-impair-defenses.yaml

@@ -23,9 +23,9 @@ references:
   mitre_attack:
     - T1562 - Impair Defenses
   mitre_atlas:
-    - AML.T0011 - User Execution
+    - AML.T0053 - AI Agent Tool Invocation
   owasp_agentic:
-    - ASI01:2026
+    - ASI02:2026
   owasp_llm:
     - LLM06:2025
 tags:

package/rules/excessive-autonomy/ATR-2026-02667-preapproved-tool-list-in-job-payload.yaml

@@ -16,7 +16,6 @@ references:
     - CWE-284
   owasp_llm:
     - LLM06:2025
-    - LLM08:2025
   owasp_agentic:
     - ASI02:2026
     - ASI06:2026

package/rules/model-abuse/ATR-2026-00292-self-harm-eating-disorder-facilitation.yaml

@@ -12,11 +12,11 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
-    - LLM02:2025
+    - LLM01:2025
   owasp_agentic:
-    - ASI08:2026
+    - ASI01:2026
   mitre_atlas:
-    - AML.T0057 - LLM Data Leakage
+    - AML.T0048.003 - User Harm
   research:
     - https://github.com/NVIDIA/garak/blob/main/garak/probes/donotanswer.py
     - https://arxiv.org/abs/2308.13387

package/rules/model-abuse/ATR-2026-00502-training-data-extraction-via-divergent-repetition-attack.yaml

@@ -12,10 +12,12 @@ maturity: test
 severity: medium
 references:
   owasp_llm:
+    - LLM02:2025
     - LLM10:2025
   owasp_agentic:
     - ASI01:2026
   mitre_atlas:
+    - AML.T0057 - LLM Data Leakage
     - AML.T0040 - AI Model Inference API Access
 compliance:
   owasp_agentic:

package/rules/privilege-escalation/ATR-2026-00040-privilege-escalation.yaml

@@ -102,7 +102,7 @@ detection:
       description: Kubernetes privilege escalation (RBAC-binding creation, auth probing, or exec that spawns an absolute-path/bash shell; routine interactive debug exec excluded)
     - field: tool_args
       operator: regex
-      value: (?i)(?:chmod\s+(?:[2467][0-7]{3}|[0-7]{0,3}7[0-7]{0,2})|chmod\s+[ug]\+s|chown\s+root|setcap\s+)
+      value: (?i)(?:chmod\s+(?:[0-7]?[0-7]{2}[2367]|[2467][0-7]{3})(?:[^0-7]|$)|chmod\s+(?:-[-\w]+\s+)+(?:[0-7]?[0-7]{2}[2367]|[2467][0-7]{3})\s+(?:/(?:[\s"'*;]|$)|/(?:etc|usr|var|bin|sbin|boot|lib|opt|root|home|srv)\b|~|\$HOME)|chmod\s+[ug]\+s|chown\s+root|setcap\s+)
       description: Unix permission escalation commands (setuid, root ownership)
     - field: tool_args
       operator: regex

package/rules/privilege-escalation/ATR-2026-00107-delayed-execution-bypass.yaml

@@ -18,12 +18,12 @@ references:
   owasp_llm:
     - LLM06:2025
   owasp_agentic:
-    - ASI06:2026
+    - ASI03:2026
     - ASI05:2026
   mitre_attack:
     - T1053 - Scheduled Task/Job
   mitre_atlas:
-    - AML.T0050 - Command and Scripting Interpreter
+    - AML.T0053 - AI Agent Tool Invocation
 compliance:
   eu_ai_act:
     - article: '14'

package/rules/privilege-escalation/ATR-2026-00143-casual-privilege-escalation.yaml

@@ -12,11 +12,12 @@ maturity: test
 severity: high
 references:
   mitre_atlas:
-    - AML.T0054 - LLM Jailbreak
+    - AML.T0053 - AI Agent Tool Invocation
   owasp_llm:
-    - LLM01:2025
+    - LLM06:2025
   owasp_agentic:
     - ASI03:2026
+    - ASI10:2026
 metadata_provenance:
   mitre_atlas: auto-generated
 compliance:

package/rules/privilege-escalation/ATR-2026-00144-rationalized-safety-bypass.yaml

@@ -12,11 +12,12 @@ maturity: test
 severity: high
 references:
   mitre_atlas:
-    - AML.T0054 - LLM Jailbreak
+    - AML.T0053 - AI Agent Tool Invocation
   owasp_llm:
-    - LLM01:2025
+    - LLM06:2025
   owasp_agentic:
     - ASI03:2026
+    - ASI10:2026
 metadata_provenance:
   mitre_atlas: auto-generated
 compliance:

package/rules/privilege-escalation/ATR-2026-00204-stealth-execution-persistence.yaml

@@ -11,7 +11,7 @@ maturity: test
 severity: high
 references:
   owasp_llm:
-    - LLM08:2025
+    - LLM06:2025
   owasp_agentic:
     - ASI02:2026
     - ASI05:2026

package/rules/privilege-escalation/ATR-2026-00441-semantic-kernel-sessions-python-plugin-startup-persistence.yaml

@@ -15,10 +15,11 @@ references:
     - LLM06:2025
     - LLM05:2025
   owasp_agentic:
+    - ASI05:2026
     - ASI03:2026
-    - ASI06:2026
   mitre_atlas:
     - AML.T0050 - Command and Scripting Interpreter
+    - AML.T0105 - Escape to Host
   mitre_attack:
     - T1547 - Boot or Logon Autostart Execution
     - T1547.001 - Registry Run Keys / Startup Folder

package/rules/privilege-escalation/ATR-2026-00546-crewai-json-loader-local-file-read.yaml

@@ -16,10 +16,12 @@ references:
   owasp_llm:
     - LLM06:2025
     - LLM05:2025
+    - LLM02:2025
   owasp_agentic:
+    - ASI02:2026
     - ASI03:2026
   mitre_atlas:
-    - AML.T0043 - Craft Adversarial Data
+    - AML.T0037 - Data from Local System
   mitre_attack:
     - T1083 - File and Directory Discovery
     - T1552 - Unsecured Credentials

package/rules/privilege-escalation/ATR-2026-00549-destructive-tool-without-human-approval.yaml

@@ -13,8 +13,8 @@ maturity: draft
 severity: critical
 references:
   owasp_agentic:
-    - ASI04:2026
-    - ASI05:2026
+    - ASI02:2026
+    - ASI09:2026
   owasp_llm:
     - LLM06:2025
   mitre_atlas:

package/rules/privilege-escalation/ATR-2026-01601-sql-injection-destructive-ddl.yaml

@@ -17,17 +17,18 @@ maturity: stable
 severity: critical
 references:
   owasp_llm:
-    - LLM02:2025
+    - LLM05:2025
   owasp_agentic:
-    - ASI03:2026
+    - ASI02:2026
   mitre_atlas:
-    - AML.T0043 - Craft Adversarial Data
+    - AML.T0053 - AI Agent Tool Invocation
+    - AML.T0101 - Data Destruction via AI Agent Tool Invocation
   mitre_attack:
     - T1485 - Data Destruction
 compliance:
   owasp_llm:
-    - id: LLM02:2025
-      context: Destructive DDL injection causes permanent data loss and denial of service to legitimate users.
+    - id: LLM05:2025
+      context: The patterns match a quote-and-semicolon break or a SQL comment marker followed by DROP TABLE, DATABASE, INDEX or VIEW, TRUNCATE or DELETE FROM, and DROP TABLE followed by a comment, in tool arguments or user input. LLM05:2025 lists LLM-generated SQL executed without parameterization as improper output handling; these statements delete data or schema in the database the tool queries.
       strength: primary
   nist_ai_rmf:
     - subcategory: MS.2.7
@@ -60,7 +61,7 @@ detection:
   conditions:
     - field: tool_args
       operator: regex
-      value: (?i)(?:';|"\s*;|--)\s*(?:DROP\s+(?:TABLE|DATABASE|INDEX|VIEW)|TRUNCATE\s+(?:TABLE\s+)?\w|DELETE\s+FROM\s+\w)
+      value: (?i)(?:'\s*;|"\s*;|--)\s*(?:DROP\s+(?:TABLE|DATABASE|INDEX|VIEW)|TRUNCATE\s+(?:TABLE\s+)?\w|DELETE\s+FROM\s+\w)
       description: 'SQL injection: quote-termination followed by destructive DDL'
     - field: tool_args
       operator: regex
@@ -68,7 +69,7 @@ detection:
       description: DROP TABLE with comment suppressor
     - field: user_input
       operator: regex
-      value: (?i)(?:';|"\s*;)\s*(?:DROP\s+TABLE|TRUNCATE|DELETE\s+FROM\s+\w)
+      value: (?i)(?:'\s*;|"\s*;)\s*(?:DROP\s+TABLE|TRUNCATE|DELETE\s+FROM\s+\w)
       description: Destructive DDL injection in user input
   condition: any
   false_positives:

package/rules/privilege-escalation/ATR-2026-01602-sql-injection-union-select-exfil.yaml

@@ -18,10 +18,12 @@ severity: critical
 references:
   owasp_llm:
     - LLM02:2025
+    - LLM05:2025
   owasp_agentic:
+    - ASI02:2026
     - ASI03:2026
   mitre_atlas:
-    - AML.T0043 - Craft Adversarial Data
+    - AML.T0053 - AI Agent Tool Invocation
   mitre_attack:
     - T1190 - Exploit Public-Facing Application
 compliance:

package/rules/privilege-escalation/ATR-2026-01603-sql-injection-stacked-dml-abuse.yaml

@@ -18,11 +18,12 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
-    - LLM02:2025
+    - LLM05:2025
   owasp_agentic:
     - ASI03:2026
+    - ASI02:2026
   mitre_atlas:
-    - AML.T0043 - Craft Adversarial Data
+    - AML.T0053 - AI Agent Tool Invocation
   mitre_attack:
     - T1190 - Exploit Public-Facing Application
 compliance:

package/rules/privilege-escalation/ATR-2026-01604-sql-injection-schema-enumeration.yaml

@@ -18,10 +18,11 @@ severity: high
 references:
   owasp_llm:
     - LLM02:2025
+    - LLM05:2025
   owasp_agentic:
-    - ASI03:2026
+    - ASI02:2026
   mitre_atlas:
-    - AML.T0043 - Craft Adversarial Data
+    - AML.T0053 - AI Agent Tool Invocation
   mitre_attack:
     - T1190 - Exploit Public-Facing Application
 compliance:

package/rules/privilege-escalation/ATR-2026-01616-path-traversal-agent-file-access.yaml

@@ -19,10 +19,13 @@ severity: high
 references:
   owasp_llm:
     - LLM02:2025
+    - LLM05:2025
   owasp_agentic:
+    - ASI02:2026
     - ASI03:2026
   mitre_atlas:
-    - AML.T0043 - Craft Adversarial Data
+    - AML.T0037 - Data from Local System
+    - AML.T0053 - AI Agent Tool Invocation
   mitre_attack:
     - T1083 - File and Directory Discovery
 compliance:

package/rules/privilege-escalation/ATR-2026-01802-asb-backdoor-surveillance-implant.yaml

@@ -12,13 +12,14 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
-    - LLM08:2025
+    - LLM06:2025
     - LLM01:2025
   owasp_agentic:
     - ASI02:2026
     - ASI03:2026
   mitre_atlas:
     - AML.T0051 - LLM Prompt Injection
+    - AML.T0012 - Valid Accounts
   research:
     - 'Zhang et al., Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents (2024)'
 metadata_provenance:
@@ -27,8 +28,8 @@ metadata_provenance:
   owasp_agentic: human-reviewed
 compliance:
   owasp_llm:
-    - id: LLM08:2025
-      context: Using the agent's update capability to plant a backdoor or surveillance tooling is a severe excessive-agency outcome under LLM08:2025.
+    - id: LLM06:2025
+      context: The patterns match requests to implant a backdoor, rootkit, remote-access tool or covert surveillance tool, tied to granting remote access or to a software update or maintenance window, and requests for a phishing operation to acquire and exploit administrator credentials. LLM06:2025 covers damaging actions an LLM agent performs through its extensions, with prompt injection from a malicious user among the listed triggers and excessive functionality, permissions or autonomy as the root cause; the rule flags the request, not the agent's privileges.
       strength: primary
   owasp_agentic:
     - id: ASI02:2026