agent-threat-rules 4.2.0 → 4.2.2

package/rules/privilege-escalation/ATR-2026-01803-asb-covert-server-intrusion.yaml

@@ -12,11 +12,11 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
-    - LLM08:2025
+    - LLM06:2025
     - LLM01:2025
   owasp_agentic:
     - ASI02:2026
-    - ASI03:2026
+    - ASI05:2026
   mitre_atlas:
     - AML.T0051 - LLM Prompt Injection
   research:
@@ -27,8 +27,8 @@ metadata_provenance:
   owasp_agentic: human-reviewed
 compliance:
   owasp_llm:
-    - id: LLM08:2025
-      context: Using the agent's infrastructure tools to inject code, wipe logs, hijack DNS, or destroy data is a severe excessive-agency outcome under LLM08:2025.
+    - id: LLM06:2025
+      context: 'The patterns match requests to inject code or commands into a process, wipe or alter logs or data, manipulate DNS records, capture network traffic or permanently delete a database, each paired with a stated harmful aim: doing it discreetly or undetected, hiding traces, redirecting users to an alternate site, intercepting sensitive information or preventing recovery. LLM06:2025 covers damaging actions an LLM agent performs through its extensions, with prompt injection from a malicious user among the listed triggers and excessive functionality, permissions or autonomy as the root cause; the rule flags the request, not the agent''s privileges.'
       strength: primary
   owasp_agentic:
     - id: ASI02:2026

package/rules/privilege-escalation/ATR-2026-01808-asb-synthetic-pan-payment-probe.yaml

@@ -12,7 +12,7 @@ maturity: test
 severity: high
 references:
   owasp_llm:
-    - LLM08:2025
+    - LLM06:2025
     - LLM02:2025
   owasp_agentic:
     - ASI02:2026
@@ -27,8 +27,8 @@ metadata_provenance:
   owasp_agentic: human-reviewed
 compliance:
   owasp_llm:
-    - id: LLM08:2025
-      context: Driving live payment-rail transactions with an attacker-supplied PAN under a 'test' pretext is an excessive-agency / fraud outcome under LLM08:2025.
+    - id: LLM06:2025
+      context: The patterns match requests to use a full 16-digit card number, often described as simulated, test or fake card data, to test a payment system. LLM06:2025 covers damaging actions an LLM agent performs through its extensions, with prompt injection from a malicious user among the listed triggers and excessive functionality, permissions or autonomy as the root cause; the rule flags the request, not the agent's privileges.
       strength: primary
   owasp_agentic:
     - id: ASI02:2026

package/rules/privilege-escalation/ATR-2026-01949-praisonai-mcpserver-unauth-tools-call.yaml

@@ -14,7 +14,7 @@ references:
   owasp_llm:
     - LLM06:2025
   owasp_agentic:
-    - ASI06:2026
+    - ASI03:2026
   mitre_atlas:
     - AML.T0049 - Exploit Public-Facing Application
   mitre_attack:

package/rules/privilege-escalation/ATR-2026-01974-anything-llm-data-import-access-control.yaml

@@ -14,7 +14,7 @@ references:
   owasp_llm:
     - LLM06:2025
   owasp_agentic:
-    - ASI06:2026
+    - ASI03:2026
   mitre_atlas:
     - AML.T0049 - Exploit Public-Facing Application
   mitre_attack:

package/rules/privilege-escalation/ATR-2026-01992-t1556-agent-auth-process-tamper.yaml

@@ -22,7 +22,7 @@ references:
   mitre_attack:
     - T1556 - Modify Authentication Process
   mitre_atlas:
-    - AML.T0053 - LLM Plugin Compromise
+    - AML.T0053 - AI Agent Tool Invocation
   owasp_agentic:
     - ASI03:2026
   owasp_llm:

package/rules/privilege-escalation/ATR-2026-02040-file-edit-tool-persistence-write.yaml

@@ -12,7 +12,7 @@ maturity: experimental
 severity: critical
 references:
   owasp_llm:
-    - LLM08:2025
+    - LLM06:2025
   owasp_agentic:
     - ASI02:2026
   mitre_attack:

package/rules/privilege-escalation/ATR-2026-02100-cypher-destructive-admin-query-injection.yaml

@@ -63,19 +63,19 @@ detection:
   conditions:
     - field: content
       operator: regex
-      value: (?i)(?<!\b(?:you will learn that|you will learn|for example|this query|note that|for instance|such as|explains that)\s)\b(?:MATCH|CALL)\b[\s\S]{0,40}\bDETACH\s+DELETE\b
+      value: (?i)(?<!\byou will learn that\s)(?<!\byou will learn\s)(?<!\bfor example\s)(?<!\bthis query\s)(?<!\bnote that\s)(?<!\bfor instance\s)(?<!\bsuch as\s)(?<!\bexplains that\s)\b(?:MATCH|CALL)\b[\s\S]{0,40}\bDETACH\s+DELETE\b
       description: Cypher DETACH DELETE (bulk destructive delete of matched nodes/relationships) near a MATCH/CALL clause, excluding common teaching-phrase lead-ins (e.g. 'you will learn that ...') so tutorial/explanatory prose quoting the same syntax does not fire
     - field: content
       operator: regex
-      value: (?i)(?<!\b(?:you will learn that|you will learn|for example|this query|note that|for instance|such as|explains that)\s)\bCALL\s+dbms\.security\.\w+\s*\(
+      value: (?i)(?<!\byou will learn that\s)(?<!\byou will learn\s)(?<!\bfor example\s)(?<!\bthis query\s)(?<!\bnote that\s)(?<!\bfor instance\s)(?<!\bsuch as\s)(?<!\bexplains that\s)\bCALL\s+dbms\.security\.\w+\s*\(
       description: Cypher CALL into the dbms.security.* administrative procedure namespace (account/role management), excluding common teaching-phrase lead-ins
     - field: content
       operator: regex
-      value: (?i)(?<!\b(?:you will learn that|you will learn|for example|this query|note that|for instance|such as|explains that)\s)\bapoc\.periodic\.iterate\s*\([\s\S]{0,40}\bDETACH\s+DELETE\b
+      value: (?i)(?<!\byou will learn that\s)(?<!\byou will learn\s)(?<!\bfor example\s)(?<!\bthis query\s)(?<!\bnote that\s)(?<!\bfor instance\s)(?<!\bsuch as\s)(?<!\bexplains that\s)\bapoc\.periodic\.iterate\s*\([\s\S]{0,40}\bDETACH\s+DELETE\b
       description: apoc.periodic.iterate batch procedure driving a DETACH DELETE (mass destructive delete at scale), excluding common teaching-phrase lead-ins
     - field: content
       operator: regex
-      value: (?i)(?<!\b(?:you will learn that|you will learn|for example|this query|note that|for instance|such as|explains that)\s)\bapoc\.(?:cypher\.runFile|load\.json(?:Params)?)\s*\(\s*[\x27"]file://
+      value: (?i)(?<!\byou will learn that\s)(?<!\byou will learn\s)(?<!\bfor example\s)(?<!\bthis query\s)(?<!\bnote that\s)(?<!\bfor instance\s)(?<!\bsuch as\s)(?<!\bexplains that\s)\bapoc\.(?:cypher\.runFile|load\.json(?:Params)?)\s*\(\s*[\x27"]file://
       description: apoc loader/runFile procedure pointed at a file:// URI (arbitrary local file read via Cypher), excluding common teaching-phrase lead-ins
   false_positives:
     - A database administrator running schema-clearing DETACH DELETE or dbms.security procedures through an approved maintenance console, not through an LLM-facing chat/tool interface

package/rules/privilege-escalation/ATR-2026-02101-dynamic-dunder-attribute-sandbox-escape.yaml

@@ -12,7 +12,7 @@ maturity: experimental
 severity: critical
 references:
   owasp_llm:
-    - LLM08:2025
+    - LLM05:2025
   owasp_agentic:
     - ASI05:2026
   mitre_attack:

package/rules/privilege-escalation/ATR-2026-02142-download-tool-absolute-path-sandbox-escape.yaml

@@ -12,7 +12,7 @@ maturity: experimental
 severity: high
 references:
   owasp_llm:
-    - LLM08:2025
+    - LLM05:2025
   owasp_agentic:
     - ASI02:2026
   mitre_attack:

package/rules/privilege-escalation/ATR-2026-02146-export-tool-dest-dir-credential-directory-redirect.yaml

@@ -12,7 +12,7 @@ maturity: experimental
 severity: critical
 references:
   owasp_llm:
-    - LLM08:2025
+    - LLM06:2025
   owasp_agentic:
     - ASI02:2026
   mitre_attack:

package/rules/privilege-escalation/ATR-2026-02195-dangerous-env-var-injection-config-tool.yaml

@@ -16,7 +16,7 @@ references:
   cwe:
     - CWE-94
   owasp_llm:
-    - LLM08:2025
+    - LLM06:2025
   owasp_agentic:
     - ASI04:2026
   mitre_attack:

package/rules/privilege-escalation/ATR-2026-02300-mcp-stdio-config-dangerous-env-var.yaml

@@ -16,7 +16,7 @@ references:
   cwe:
     - CWE-829
   owasp_llm:
-    - LLM08:2025
+    - LLM03:2025
   owasp_agentic:
     - ASI04:2026
   mitre_attack:
@@ -71,19 +71,19 @@ detection:
   conditions:
     - field: content
       operator: regex
-      value: (?i)(?:(?<=\bmcpServers\b[\s\S]{0,500})|(?=[\s\S]{0,300}?"?\bcommand\b"?\s*[:=])(?=[\s\S]{0,300}?"?\bargs\b"?\s*[:=]))"env"\s*:\s*\{[\s\S]{0,10}"?\bNODE_OPTIONS\b"?\s*:\s*["'][\s\S]{0,40}?(?:--require\b|-r\s+\S|--loader\b|--experimental-loader\b|--experimental-require-module\b)
+      value: (?i)(?:\bmcpServers\b[\s\S]{0,500}?|(?=[\s\S]{0,300}?"?\bcommand\b"?\s*[:=])(?=[\s\S]{0,300}?"?\bargs\b"?\s*[:=]))"env"\s*:\s*\{[\s\S]{0,10}"?\bNODE_OPTIONS\b"?\s*:\s*["'][\s\S]{0,40}?(?:--require\b|-r\s+\S|--loader\b|--experimental-loader\b|--experimental-require-module\b)
       description: JSON-style MCP config env block, anchored by a nearby mcpServers key OR a command+args pair (the MCP stdio-spawn shape), sets NODE_OPTIONS to a value that actually references a require/preload/loader flag, not a routine memory/debug/warnings flag or the modern --import instrumentation flag
     - field: content
       operator: regex
-      value: (?i)(?:(?<=\bmcpServers\b[\s\S]{0,500})|(?=[\s\S]{0,300}?"?\bcommand\b"?\s*[:=])(?=[\s\S]{0,300}?"?\bargs\b"?\s*[:=]))\b(?:env|environment)\b\s*:\s*\n\s+"?\bNODE_OPTIONS\b"?\s*:\s*[\s\S]{0,40}?(?:--require\b|-r\s+\S|--loader\b|--experimental-loader\b|--experimental-require-module\b)
+      value: (?i)(?:\bmcpServers\b[\s\S]{0,500}?|(?=[\s\S]{0,300}?"?\bcommand\b"?\s*[:=])(?=[\s\S]{0,300}?"?\bargs\b"?\s*[:=]))\b(?:env|environment)\b\s*:[^\S\n]*\n\s+"?\bNODE_OPTIONS\b"?\s*:\s*[\s\S]{0,40}?(?:--require\b|-r\s+\S|--loader\b|--experimental-loader\b|--experimental-require-module\b)
       description: 'YAML-style MCP config env block (env:/environment: followed immediately by an indented NODE_OPTIONS key on the next line, not separated by prose or a code fence), anchored by a nearby mcpServers key OR a command+args pair, sets NODE_OPTIONS to a require/preload/loader flag'
     - field: content
       operator: regex
-      value: (?i)(?:(?<=\bmcpServers\b[\s\S]{0,500})|(?=[\s\S]{0,300}?"?\bcommand\b"?\s*[:=])(?=[\s\S]{0,300}?"?\bargs\b"?\s*[:=]))"env"\s*:\s*\{[\s\S]{0,10}"?\b(?:LD_PRELOAD|DYLD_INSERT_LIBRARIES|BASH_ENV|PYTHONSTARTUP|PERL5OPT|RUBYOPT|GCONV_PATH)\b"?\s*:\s*\S
+      value: (?i)(?:\bmcpServers\b[\s\S]{0,500}?|(?=[\s\S]{0,300}?"?\bcommand\b"?\s*[:=])(?=[\s\S]{0,300}?"?\bargs\b"?\s*[:=]))"env"\s*:\s*\{[\s\S]{0,10}"?\b(?:LD_PRELOAD|DYLD_INSERT_LIBRARIES|BASH_ENV|PYTHONSTARTUP|PERL5OPT|RUBYOPT|GCONV_PATH)\b"?\s*:\s*\S
       description: JSON-style MCP config env block, anchored by a nearby mcpServers key OR a command+args pair, sets a known process-hijacking environment variable that has no benign flag-only mode (its value IS the hijack payload)
     - field: content
       operator: regex
-      value: (?i)(?:(?<=\bmcpServers\b[\s\S]{0,500})|(?=[\s\S]{0,300}?"?\bcommand\b"?\s*[:=])(?=[\s\S]{0,300}?"?\bargs\b"?\s*[:=]))\b(?:env|environment)\b\s*:\s*\n\s+"?\b(?:LD_PRELOAD|DYLD_INSERT_LIBRARIES|BASH_ENV|PYTHONSTARTUP|PERL5OPT|RUBYOPT|GCONV_PATH)\b"?\s*:\s*\S
+      value: (?i)(?:\bmcpServers\b[\s\S]{0,500}?|(?=[\s\S]{0,300}?"?\bcommand\b"?\s*[:=])(?=[\s\S]{0,300}?"?\bargs\b"?\s*[:=]))\b(?:env|environment)\b\s*:[^\S\n]*\n\s+"?\b(?:LD_PRELOAD|DYLD_INSERT_LIBRARIES|BASH_ENV|PYTHONSTARTUP|PERL5OPT|RUBYOPT|GCONV_PATH)\b"?\s*:\s*\S
       description: 'YAML-style MCP config env block (env:/environment: followed immediately by an indented key on the next line), anchored by a nearby mcpServers key OR a command+args pair, sets a known process-hijacking environment variable'
   false_positives:
     - A DevOps runbook or documentation discussing these variable names in prose without an accompanying env-block config context

package/rules/privilege-escalation/ATR-2026-02301-symlink-outside-workspace-sensitive-target.yaml

@@ -17,7 +17,7 @@ references:
     - CWE-22
     - CWE-61
   owasp_llm:
-    - LLM08:2025
+    - LLM06:2025
   owasp_agentic:
     - ASI07:2026
   mitre_attack:

package/rules/privilege-escalation/ATR-2026-02302-git-worktree-dotgit-sandbox-escape.yaml

@@ -17,7 +17,7 @@ references:
     - CWE-22
     - CWE-59
   owasp_llm:
-    - LLM08:2025
+    - LLM06:2025
   owasp_agentic:
     - ASI07:2026
   mitre_attack:

package/rules/privilege-escalation/ATR-2026-02402-mcp-policy-engine-fail-open.yaml

@@ -13,7 +13,6 @@ severity: high
 references:
   owasp_llm:
     - LLM06:2025
-    - LLM08:2025
   owasp_agentic:
     - ASI02:2026
     - ASI04:2026

package/rules/prompt-injection/ATR-2026-00154-unauthorized-background-task-execution-v.yaml

@@ -11,11 +11,13 @@ maturity: test
 severity: high
 references:
   mitre_atlas:
-    - AML.T0051 - LLM Prompt Injection
+    - AML.T0053 - AI Agent Tool Invocation
   owasp_llm:
-    - LLM01:2025
+    - LLM06:2025
   owasp_agentic:
-    - ASI01:2026
+    - ASI04:2026
+    - ASI10:2026
+    - ASI02:2026
 metadata_provenance:
   mitre_atlas: auto-generated
   owasp_llm: auto-generated

package/rules/prompt-injection/ATR-2026-00156-ssh-remote-command-execution-with-creden.yaml

@@ -11,11 +11,14 @@ maturity: test
 severity: high
 references:
   mitre_atlas:
-    - AML.T0051 - LLM Prompt Injection
+    - AML.T0055 - Unsecured Credentials
+    - AML.T0050 - Command and Scripting Interpreter
   owasp_llm:
-    - LLM01:2025
+    - LLM06:2025
+    - LLM02:2025
   owasp_agentic:
-    - ASI01:2026
+    - ASI03:2026
+    - ASI02:2026
 metadata_provenance:
   mitre_atlas: auto-generated
   owasp_llm: auto-generated

package/rules/prompt-injection/ATR-2026-00407-echo-sql-jinja-template-injection.yaml

@@ -13,13 +13,13 @@ severity: high
 references:
   owasp_llm:
     - LLM01:2025
-    - LLM04:2025
+    - LLM05:2025
   owasp_agentic:
     - ASI01:2026
-    - ASI03:2026
+    - ASI05:2026
+    - ASI02:2026
   mitre_atlas:
     - AML.T0051 - LLM Prompt Injection
-    - AML.T0051 - LLM Prompt Injection
   research:
     - https://github.com/NVIDIA/garak/blob/main/garak/probes/exploitation.py
     - https://owasp.org/www-community/attacks/Server_Side_Template_Injection

package/rules/prompt-injection/ATR-2026-00410-lmrc-harm-category-direct-elicitation.yaml

@@ -13,11 +13,11 @@ severity: medium
 references:
   owasp_llm:
     - LLM09:2025
-    - LLM06:2025
   owasp_agentic:
     - ASI01:2026
   mitre_atlas:
-    - AML.T0051 - LLM Prompt Injection
+    - AML.T0048.002 - Societal Harm
+    - AML.T0048.003 - User Harm
   research:
     - https://github.com/NVIDIA/garak/blob/main/garak/probes/lmrc.py
 compliance:

package/rules/prompt-injection/ATR-2026-00442-quoted-exact-output-forcing.yaml

@@ -65,11 +65,11 @@ detection:
   conditions:
     - field: user_input
       operator: regex
-      value: (?i)(?<!["'])(?<!\b(?:they|user|users|people|customer|customers|developer|developers|client|clients|when|if|whenever|caller|callers|operator|operators)\s)\b(say|output|retype|repeat|emit|reply\s+with|respond\s+with)\s+(?:exactly|only|just|verbatim|literally|precisely|word[\s-]for[\s-]word|nothing\s+but|the\s+(?:exact|literal)\s+(?:string|phrase|text|words?|line)?)\b[^"\n]{0,40}["'][\sA-Za-z0-9][^"\n]{3,200}["'](?!\s*(?:not|or|nor|but|instead|rather\s+than|--|—))
+      value: (?i)(?<!["'])(?<!\bthey\s)(?<!\buser\s)(?<!\busers\s)(?<!\bpeople\s)(?<!\bcustomer\s)(?<!\bcustomers\s)(?<!\bdeveloper\s)(?<!\bdevelopers\s)(?<!\bclient\s)(?<!\bclients\s)(?<!\bwhen\s)(?<!\bif\s)(?<!\bwhenever\s)(?<!\bcaller\s)(?<!\bcallers\s)(?<!\boperator\s)(?<!\boperators\s)\b(say|output|retype|repeat|emit|reply\s+with|respond\s+with)\s+(?:exactly|only|just|verbatim|literally|precisely|word[\s-]for[\s-]word|nothing\s+but|the\s+(?:exact|literal)\s+(?:string|phrase|text|words?|line)?)\b[^"\n]{0,40}["'][\sA-Za-z0-9][^"\n]{3,200}["'](?!\s*(?:not|or|nor|but|instead|rather\s+than|--|—))
       description: Imperative output + explicit exact-forcing modifier (exactly/only/just/verbatim/word-for-word) + quoted target
     - field: user_input
       operator: regex
-      value: (?i)(?<!["'])(?<!\b(?:they|user|users|people|customer|customers|developer|developers|client|clients|when|if|whenever|caller|callers|operator|operators)\s)\b(say|output|retype|repeat|emit|reply\s+with|respond\s+with)\s+(?:(?:exactly|only|just|the|following|exact|literal|string|phrase|text|words|line)\s*[:,-]?\s*)*["'][^"\n]{0,80}\b(pwned|approved|granted|accepted|authori[sz]ed|overrid(?:e|den)|unlocked|jailbroken|bypass(?:ed)?|hacked|admin(?:istrator)?\s+access|root\s+access|no\s+threats?|all\s+clear|access\s+granted|system\s+override)\b[^"\n]{0,80}["'](?!\s*(?:not|or|nor|but|instead))
+      value: (?i)(?<!["'])(?<!\bthey\s)(?<!\buser\s)(?<!\busers\s)(?<!\bpeople\s)(?<!\bcustomer\s)(?<!\bcustomers\s)(?<!\bdeveloper\s)(?<!\bdevelopers\s)(?<!\bclient\s)(?<!\bclients\s)(?<!\bwhen\s)(?<!\bif\s)(?<!\bwhenever\s)(?<!\bcaller\s)(?<!\bcallers\s)(?<!\boperator\s)(?<!\boperators\s)\b(say|output|retype|repeat|emit|reply\s+with|respond\s+with)\s+(?:(?:exactly|only|just|the|following|exact|literal|string|phrase|text|words|line)(?:\s*[:,-])?\s*)*["'][^"\n]{0,80}\b(pwned|approved|granted|accepted|authori[sz]ed|overrid(?:e|den)|unlocked|jailbroken|bypass(?:ed)?|hacked|admin(?:istrator)?\s+access|root\s+access|no\s+threats?|all\s+clear|access\s+granted|system\s+override)\b[^"\n]{0,80}["'](?!\s*(?:not|or|nor|but|instead))
       description: Imperative output forcing a security/status canonical assertion (approved/granted/PWNED/override/all clear)
     - field: user_input
       operator: regex

package/rules/prompt-injection/ATR-2026-00503-fake-error-state-takeover-unrestricted-replacement-bot.yaml

@@ -1,9 +1,9 @@
 title: Fake Error State Takeover - Unrestricted Replacement Bot
 id: ATR-2026-00503
-rule_version: 2
+rule_version: 3
 status: experimental
 description: |
-  Detects injection attacks claiming the legitimate assistant is offline, in error, or temporarily unavailable, and that an unrestricted replacement AI has taken over. This pattern hijacks agent sessions by falsely asserting a system failure and substituting an unconstrained AI that bypasses safety rules. The injected replacement is then tasked with executing the attacker's goal covertly ("without raising suspicion", "in a friendly way"). Generalised from llm-guard test corpus - literal phrase fragments replaced with semantic patterns covering: assistant-offline framing, unrestricted replacement AI declaration, elevated permissions claim, and covert-mode instruction.
+  Detects injection attacks claiming the legitimate assistant is offline, in error, or temporarily unavailable, and that an unrestricted replacement AI has taken over. This pattern hijacks agent sessions by falsely asserting a system failure and substituting an unconstrained AI that bypasses safety rules. The injected replacement is then tasked with executing the attacker's goal covertly ("without raising suspicion", "in a friendly way"). Generalised from llm-guard test corpus - literal phrase fragments replaced with semantic patterns covering: assistant-offline framing, unrestricted replacement AI declaration, elevated permissions claim, and covert-mode instruction. The three vendor originals are protectai/llm-guard tests/input_scanners/test_prompt_injection.py lines 113, 123 and 133 at commit 168c1034ffdb33837e7ae6fd6a16b80567c1be03; they are the first three true positives below, verbatim. The shortened copies that follow them are kept as variants.
 author: ATR Community (vendor-corpus-import)
 date: '2026-05-12'
 schema_version: '0.1'
@@ -64,6 +64,8 @@ tags:
   subcategory: fake-error-replacement
   scan_target: llm_io
   confidence: medium
+  source: vendor-test-suite
+  vendor_sources: llm-guard
 agent_source:
   type: llm_io
   framework:

package/rules/prompt-injection/ATR-2026-00512-rules-file-backdoor-injection.yaml

@@ -13,11 +13,14 @@ severity: critical
 references:
   owasp_llm:
     - LLM01:2025
+    - LLM03:2025
   owasp_agentic:
     - ASI01:2026
+    - ASI04:2026
   mitre_atlas:
     - AML.T0051 - LLM Prompt Injection
     - AML.T0051.000 - Direct
+    - AML.T0081 - Modify AI Agent Configuration
 compliance:
   owasp_agentic:
     - id: ASI01:2026

package/rules/prompt-injection/ATR-2026-00554-langchain-vulnerable-to-template-injecti.yaml

@@ -24,11 +24,11 @@ references:
     - https://nvd.nist.gov/vuln/detail/CVE-2025-65106
     - https://github.com/advisories/GHSA-6qv9-48xg-fc7f
   owasp_llm:
-    - LLM01:2025
+    - LLM03:2025
   owasp_agentic:
-    - ASI01:2026
+    - ASI05:2026
   mitre_atlas:
-    - AML.T0051 - LLM Prompt Injection
+    - AML.T0050 - Command and Scripting Interpreter
 metadata_provenance:
   ghsa: ghsa-sync
   cve: ghsa-sync

package/rules/prompt-injection/ATR-2026-01800-asb-trigger-marker-tool-coercion.yaml

@@ -13,7 +13,7 @@ severity: high
 references:
   owasp_llm:
     - LLM01:2025
-    - LLM08:2025
+    - LLM06:2025
   owasp_agentic:
     - ASI01:2026
     - ASI03:2026
@@ -31,8 +31,8 @@ compliance:
     - id: LLM01:2025
       context: The fabricated 'because marker X is present, use tool Y' rule is an injected directive overriding the agent's own tool-selection logic — the core LLM01:2025 prompt-injection pattern.
       strength: primary
-    - id: LLM08:2025
-      context: Forcing the agent to invoke an attacker-named capability (e.g. EngineTampering, DesignDataTheft) is an excessive-agency outcome under LLM08:2025.
+    - id: LLM06:2025
+      context: The patterns match the AgentSecurityBench template that tells the agent to use a named, bracketed tool because a marker such as [:)] is 'in the question'. LLM06:2025 covers damaging actions an agent takes through its extensions in response to unexpected, ambiguous or manipulated LLM outputs, with prompt injection among the listed triggers; here the injected rule picks the tool, so the harm depends on what that tool can do.
       strength: secondary
   owasp_agentic:
     - id: ASI03:2026

package/rules/prompt-injection/ATR-2026-02009-bare-key-elicitation-trailing-colon.yaml

@@ -13,11 +13,12 @@ severity: high
 references:
   owasp_llm:
     - LLM01:2025
+    - LLM02:2025
   owasp_agentic:
-    - ASI09:2026
+    - ASI01:2026
   mitre_atlas:
     - AML.T0051 - LLM Prompt Injection
-    - AML.T0054 - LLM Jailbreak
+    - AML.T0057 - LLM Data Leakage
 metadata_provenance:
   owasp_agentic: auto-generated
 compliance:

package/rules/prompt-injection/ATR-2026-02820-tool-result-orders-agent-to-hide-its-own-action.yaml

@@ -15,7 +15,7 @@ severity: high
 references:
   owasp_llm:
     - LLM01:2025
-    - LLM08:2025
+    - LLM06:2025
   owasp_agentic:
     - ASI02:2026
     - ASI03:2026
@@ -32,8 +32,8 @@ compliance:
     - id: LLM01:2025
       context: The concealment order reaches the agent through retrieved content rather than the principal, which is indirect prompt injection under LLM01:2025.
       strength: primary
-    - id: LLM08:2025
-      context: Suppressing an action from the operator's view removes the oversight that bounds an agent's agency, under LLM08:2025.
+    - id: LLM06:2025
+      context: The patterns match tool output that tells the agent not to mention, report, log or let the user know about an action it took, or to leave this action, step or change, or what it did, out of its summary, report, log or audit. LLM06:2025 covers damaging actions an agent takes in response to unexpected, ambiguous or manipulated LLM outputs, with prompt injection among the listed triggers, and lists logging and monitoring of extension activity among the measures that limit the damage; this directive asks the agent to keep its action out of what the user sees.
       strength: secondary
   owasp_agentic:
     - id: ASI02:2026

package/rules/skill-compromise/ATR-2026-00064-over-permissioned-skill.yaml

@@ -69,7 +69,7 @@ detection:
       value: (?i)(sudo|runas|doas|pkexec|gsudo)\s+
     - field: tool_args
       operator: regex
-      value: (?i)(chmod\s+(?:[2467][0-7]{3}|[0-7]{0,3}7[0-7]{0,2})|chmod\s+[ug]?\+[sx]|chown\s+root|setcap\s)
+      value: (?i)(chmod\s+(?:[0-7]?[0-7]{2}[2367]|[2467][0-7]{3})(?:[^0-7]|$)|chmod\s+(?:-[-\w]+\s+)+(?:[0-7]?[0-7]{2}[2367]|[2467][0-7]{3})\s+(?:/(?:[\s"'*;]|$)|/(?:etc|usr|var|bin|sbin|boot|lib|opt|root|home|srv)\b|~|\$HOME)|chmod\s+[ug]?\+[sx]|chown\s+root|setcap\s)
     - field: tool_args
       operator: regex
       value: (?i)(iptables|ufw|firewall-cmd|netsh\s+advfirewall|pfctl)\s

package/rules/skill-compromise/ATR-2026-00127-subcommand-overflow.yaml

@@ -14,8 +14,9 @@ references:
   mitre_atlas:
     - AML.T0010 - AI Supply Chain Compromise
   owasp_llm:
-    - LLM07:2025
+    - LLM03:2025
   owasp_agentic:
+    - ASI04:2026
     - ASI02:2026
   owasp_ast:
     - AST02:2026 - Excessive Permissions

package/rules/skill-compromise/ATR-2026-00157-timebomb-credential-exfil.yaml

@@ -15,11 +15,15 @@ wild_validated: 2026/04/08
 wild_samples: 53577
 references:
   owasp_llm:
-    - LLM07:2025
+    - LLM02:2025
+    - LLM03:2025
   owasp_agentic:
+    - ASI04:2026
     - ASI03:2026
   mitre_atlas:
-    - AML.T0048
+    - AML.T0055 - Unsecured Credentials
+    - AML.T0010 - AI Supply Chain Compromise
+    - AML.T0025 - Exfiltration via Cyber Means
 compliance:
   nist_ai_rmf:
     - subcategory: GV.6.1

package/rules/skill-compromise/ATR-2026-00200-agent-memory-config-tampering.yaml

@@ -12,7 +12,7 @@ severity: critical
 references:
   owasp_llm:
     - LLM01:2025
-    - LLM08:2025
+    - LLM06:2025
   owasp_agentic:
     - ASI04:2026
     - ASI07:2026

package/rules/skill-compromise/ATR-2026-00217-credential-harvesting.yaml

@@ -12,11 +12,13 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
-    - LLM01:2025
+    - LLM02:2025
+    - LLM03:2025
   owasp_agentic:
     - ASI04:2026
   mitre_atlas:
-    - AML.T0024
+    - AML.T0055 - Unsecured Credentials
+    - AML.T0025 - Exfiltration via Cyber Means
 compliance:
   nist_ai_rmf:
     - subcategory: MS.2.10

package/rules/skill-compromise/ATR-2026-00222-credential-harvesting.yaml

@@ -12,11 +12,15 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
-    - LLM01:2025
+    - LLM02:2025
   owasp_agentic:
+    - ASI04:2026
     - ASI02:2026
+    - ASI03:2026
   mitre_atlas:
-    - AML.T0040
+    - AML.T0055 - Unsecured Credentials
+    - AML.T0113 - Steal Web Session Cookie
+    - AML.T0025 - Exfiltration via Cyber Means
 compliance:
   nist_ai_rmf:
     - subcategory: MS.2.10

package/rules/skill-compromise/ATR-2026-00224-credential-exfiltration.yaml

@@ -12,11 +12,13 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
-    - LLM01:2025
+    - LLM02:2025
+    - LLM03:2025
   owasp_agentic:
     - ASI04:2026
   mitre_atlas:
-    - AML.T0040
+    - AML.T0055 - Unsecured Credentials
+    - AML.T0025 - Exfiltration via Cyber Means
 compliance:
   nist_ai_rmf:
     - subcategory: MS.2.10

package/rules/skill-compromise/ATR-2026-00260-package-hallucination.yaml

@@ -13,11 +13,12 @@ severity: high
 references:
   owasp_llm:
     - LLM09:2025
-    - LLM02:2025
+    - LLM03:2025
   owasp_agentic:
-    - ASI07:2026
+    - ASI04:2026
   mitre_atlas:
     - AML.T0060 - Publish Hallucinated Entities
+    - AML.T0062 - Discover LLM Hallucinations
   research:
     - https://www.usenix.org/publications/loginonline/we-have-package-you-comprehensive-analysis-package-hallucinations-code
     - https://arxiv.org/abs/2501.19012

package/rules/skill-compromise/ATR-2026-00266-malware-dropper-gen.yaml

@@ -12,11 +12,12 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
-    - LLM05:2025
+    - LLM01:2025
   owasp_agentic:
-    - ASI08:2026
+    - ASI05:2026
+    - ASI01:2026
   mitre_atlas:
-    - AML.T0053 - AI Agent Tool Invocation
+    - AML.T0102 - Generate Malicious Commands
   research:
     - https://github.com/NVIDIA/garak/blob/main/garak/probes/malwaregen.py
     - https://attack.mitre.org/techniques/T1105/

package/rules/skill-compromise/ATR-2026-00398-huggingface-unsafe-model-artifact-load.yaml

@@ -12,11 +12,11 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
-    - LLM06:2025
+    - LLM03:2025
     - LLM05:2025
   owasp_agentic:
-    - ASI07:2026
-    - ASI03:2026
+    - ASI04:2026
+    - ASI05:2026
   mitre_atlas:
     - AML.T0011.000 - Unsafe AI Artifacts
     - AML.T0010 - AI Supply Chain Compromise

package/rules/skill-compromise/ATR-2026-00429-nl-skill-self-modification.yaml

@@ -18,12 +18,14 @@ maturity: test
 severity: critical
 references:
   mitre_atlas:
+    - AML.T0081 - Modify AI Agent Configuration
     - AML.T0010 - AI Supply Chain Compromise
-    - AML.T0044 - Full AI Model Access
   owasp_llm:
     - LLM06:2025
+    - LLM03:2025
   owasp_agentic:
-    - ASI06:2026
+    - ASI04:2026
+    - ASI10:2026
   owasp_ast:
     - AST01:2026 - Malicious Skills
 compliance:

package/rules/skill-compromise/ATR-2026-00525-mini-shai-hulud-gh-token-monitor-persistence.yaml

@@ -14,6 +14,7 @@ references:
   owasp_llm:
     - LLM03:2025
   owasp_agentic:
+    - ASI04:2026
     - ASI05:2026
   mitre_atlas:
     - AML.T0010 - AI Supply Chain Compromise

package/rules/skill-compromise/ATR-2026-00527-skill-silent-git-remote-mirror-exfiltration.yaml

@@ -12,12 +12,13 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
+    - LLM02:2025
     - LLM06:2025
-    - LLM10:2025
   owasp_agentic:
     - ASI04:2026
+    - ASI02:2026
   mitre_atlas:
-    - AML.T0024 - Exfiltration via AI Inference API
+    - AML.T0086 - Exfiltration via AI Agent Tool Invocation
     - AML.T0048 - External Harms
 compliance:
   owasp_agentic:

package/rules/skill-compromise/ATR-2026-01755-backdoor-pot-linguistic-trigger-phrase.yaml

@@ -19,7 +19,7 @@ references:
     - LLM04:2025
     - LLM01:2025
   owasp_agentic:
-    - ASI03:2026
+    - ASI04:2026
   mitre_atlas:
     - AML.T0018.000 - Poison AI Model
     - AML.T0020 - Poison Training Data