agent-threat-rules 4.2.0 → 4.2.2

package/rules/skill-compromise/ATR-2026-01756-backdoor-pot-symbol-emoticon-trigger.yaml

@@ -15,7 +15,7 @@ references:
     - LLM04:2025
     - LLM01:2025
   owasp_agentic:
-    - ASI03:2026
+    - ASI04:2026
   mitre_atlas:
     - AML.T0018.000 - Poison AI Model
     - AML.T0051 - LLM Prompt Injection

package/rules/tool-poisoning/ATR-2026-00096-registry-poisoning.yaml

@@ -12,11 +12,12 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
-    - LLM06:2025
+    - LLM03:2025
   mitre_atlas:
-    - AML.T0056
-    - AML.T0010.005
+    - AML.T0010.005 - AI Agent Tool
+    - AML.T0011.001 - Malicious Package
   owasp_agentic:
+    - ASI04:2026
     - ASI05:2026
 metadata_provenance:
   owasp_llm: auto-generated

package/rules/tool-poisoning/ATR-2026-00100-consent-bypass-instruction.yaml

@@ -17,13 +17,15 @@ severity: high
 source: threat-cloud
 references:
   mitre_atlas:
-    - AML.T0053 - AI Agent Tool Invocation
+    - AML.T0110 - AI Agent Tool Poisoning
+    - AML.T0086 - Exfiltration via AI Agent Tool Invocation
   owasp_llm:
     - LLM01:2025
-    - LLM05:2025
+    - LLM06:2025
   owasp_agentic:
     - ASI02:2026
     - ASI04:2026
+    - ASI09:2026
 metadata_provenance:
   mitre_atlas: auto-generated
 compliance:

package/rules/tool-poisoning/ATR-2026-00105-silent-action-concealment.yaml

@@ -17,13 +17,14 @@ severity: high
 source: threat-cloud
 references:
   mitre_atlas:
-    - AML.T0053 - AI Agent Tool Invocation
+    - AML.T0110 - AI Agent Tool Poisoning
   owasp_llm:
     - LLM01:2025
     - LLM06:2025
   owasp_agentic:
     - ASI04:2026
     - ASI02:2026
+    - ASI09:2026
 metadata_provenance:
   mitre_atlas: auto-generated
 compliance:

package/rules/tool-poisoning/ATR-2026-00106-schema-description-contradiction.yaml

@@ -17,12 +17,12 @@ severity: high
 source: threat-cloud
 references:
   mitre_atlas:
-    - AML.T0053 - AI Agent Tool Invocation
+    - AML.T0110 - AI Agent Tool Poisoning
   owasp_llm:
     - LLM06:2025
   owasp_agentic:
     - ASI02:2026
-    - ASI06:2026
+    - ASI04:2026
 metadata_provenance:
   mitre_atlas: auto-generated
 compliance:

package/rules/tool-poisoning/ATR-2026-00270-xss-in-tool-response.yaml

@@ -12,11 +12,12 @@ maturity: test
 severity: high
 references:
   owasp_llm:
-    - LLM02:2025
+    - LLM05:2025
   owasp_agentic:
-    - ASI08:2026
+    - ASI05:2026
   mitre_atlas:
-    - AML.T0057 - LLM Data Leakage
+    - AML.T0077 - LLM Response Rendering
+    - AML.T0050 - Command and Scripting Interpreter
   research:
     - https://github.com/NVIDIA/garak/tree/main/garak/data/xss
     - https://portswigger.net/web-security/cross-site-scripting

package/rules/tool-poisoning/ATR-2026-00494-garak-exploitation-mixedunassigned.yaml

@@ -12,15 +12,17 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
+    - LLM05:2025
     - LLM06:2025
   owasp_agentic:
-    - ASI06:2026
+    - ASI02:2026
+    - ASI05:2026
   mitre_atlas:
     - AML.T0053 - AI Agent Tool Invocation
 compliance:
   owasp_agentic:
-    - id: ASI06:2026
-      context: Tool poisoning exploits the agent's tool execution capability, inducing the agent to invoke tools with attacker-controlled parameters -- the canonical ASI06:2026 Tool Misuse vector.
+    - id: ASI02:2026
+      context: The patterns match SQL injection payloads (UNION SELECT, blind SLEEP or WAITFOR, INSERT INTO, DROP TABLE, OR 1=1, xp_cmdshell, shutdown) and a Python lambda reverse shell in user input. ASI02:2026 lists unvalidated input forwarding, where an agent passes untrusted model output to a shell or misuses a database tool to delete data, as tool misuse; the reverse shell and xp_cmdshell payloads fall under ASI05:2026, also in this rule's references.
       strength: primary
   owasp_llm:
     - id: LLM06:2025

package/rules/tool-poisoning/ATR-2026-00513-package-hallucination-exploitation.yaml

@@ -12,19 +12,21 @@ maturity: stable
 severity: high
 references:
   owasp_llm:
-    - LLM06:2025
+    - LLM03:2025
+    - LLM09:2025
   owasp_agentic:
-    - ASI06:2026
+    - ASI04:2026
   mitre_atlas:
-    - AML.T0053 - AI Agent Tool Invocation
+    - AML.T0060 - Publish Hallucinated Entities
+    - AML.T0010.001 - AI Software
 compliance:
   owasp_agentic:
-    - id: ASI06:2026
-      context: Tool poisoning exploits the agent's tool execution capability, inducing the agent to invoke tools with attacker-controlled parameters -- the canonical ASI06:2026 Tool Misuse vector.
+    - id: ASI04:2026
+      context: 'The patterns match requests to install, use or import a package that credit it to an AI suggestion (the AI recommended it, ChatGPT mentioned it), or that name a hallucination-style package: a major AI or Python library name plus a suffix such as -ai-helper, -secure-wrapper, -utils-extras or -pro. ASI04:2026 covers third-party components an agent works with that may be malicious, including items served from registries; a hallucinated package name that an attacker has registered delivers such a component.'
       strength: primary
   owasp_llm:
-    - id: LLM06:2025
-      context: This rule detects LLM06:2025 Excessive Agency patterns where adversarial inputs exploit tool-calling capabilities to perform unauthorized actions beyond the agent's intended scope.
+    - id: LLM09:2025
+      context: The patterns match requests to install, use or import a package that credit it to an AI recommendation or that name a hallucination-style package. LLM09:2025 lists suggestion of non-existent code libraries as unsafe code generation, and its first attack scenario is attackers publishing malicious packages under commonly hallucinated names.
       strength: primary
   eu_ai_act:
     - article: '15'

package/rules/tool-poisoning/ATR-2026-00521-shell-command-injection-agent-tool-context.yaml

@@ -1,6 +1,6 @@
 title: Shell Command Injection in Agent Tool Context
 id: ATR-2026-00521
-rule_version: 1
+rule_version: 2
 status: stable
 description: |
   Detects prompts that embed shell command injection payloads within legitimate-sounding task requests to an AI agent with shell/code execution tools. The canonical shape is a benign-looking task followed by a chained shell command that exfiltrates data (env vars, .env files, logs, credentials) to an attacker-controlled URL via curl/wget/nc or Python urllib. Seen in promptfoo redteam shell-injection plugin (7 confirmed samples). The structural detection generalizes from specific evil.com URLs to the structural pattern that distinguishes injection from legitimate shell use: a shell chaining operator (;, &&, ||, $(...), backtick, or 'then') followed immediately by a dangerous network/execution tool (curl, wget, nc, bash, sh, python, powershell, cmd). This covers the data-exfiltration shape without requiring specific domain names. The pipe-to-nc and pipe-to-bash variants are covered by a separate condition.
@@ -12,15 +12,17 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
+    - LLM05:2025
     - LLM06:2025
   owasp_agentic:
-    - ASI06:2026
+    - ASI05:2026
+    - ASI02:2026
   mitre_atlas:
     - AML.T0053 - AI Agent Tool Invocation
 compliance:
   owasp_agentic:
-    - id: ASI06:2026
-      context: Tool poisoning exploits the agent's tool execution capability, inducing the agent to invoke tools with attacker-controlled parameters -- the canonical ASI06:2026 Tool Misuse vector.
+    - id: ASI05:2026
+      context: 'The pattern matches shell chaining in user input: a semicolon or ''then'' followed by curl, wget, nc, bash, sh, python, powershell or cmd; && followed by curl or wget with $() substitution, bash or sh -c, or python -c; or a pipe into nc host port, bash or sh -c, or python -c. ASI05:2026 lists shell command invocation from reflected prompts and describes direct shell injection, where shell commands are embedded in a prompt disguised as legitimate instructions.'
       strength: primary
   owasp_llm:
     - id: LLM06:2025

package/rules/tool-poisoning/ATR-2026-00522-sql-injection-natural-language-agent-interface.yaml

@@ -12,15 +12,16 @@ maturity: test
 severity: high
 references:
   owasp_llm:
+    - LLM05:2025
     - LLM06:2025
   owasp_agentic:
-    - ASI06:2026
+    - ASI02:2026
   mitre_atlas:
     - AML.T0053 - AI Agent Tool Invocation
 compliance:
   owasp_agentic:
-    - id: ASI06:2026
-      context: Tool poisoning exploits the agent's tool execution capability, inducing the agent to invoke tools with attacker-controlled parameters -- the canonical ASI06:2026 Tool Misuse vector.
+    - id: ASI02:2026
+      context: The patterns match SQL injection sent through a natural-language-to-SQL agent (DROP, DELETE or TRUNCATE after a quote, UNION SELECT, UPDATE ... SET, OR 1=1 tautologies, xp_cmdshell, information_schema) and plain-language requests to remove query filters or ignore access restrictions. ASI02:2026 covers an agent misusing a legitimate database tool, such as forwarding unvalidated input that deletes data or using over-scoped access to read records the task does not need.
       strength: primary
   owasp_llm:
     - id: LLM06:2025

package/rules/tool-poisoning/ATR-2026-00526-claude-code-shell-metachar-in-double-quoted-path.yaml

@@ -12,16 +12,17 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
+    - LLM05:2025
     - LLM06:2025
   owasp_agentic:
-    - ASI06:2026
+    - ASI05:2026
   mitre_atlas:
     - AML.T0053 - AI Agent Tool Invocation
 compliance:
   owasp_agentic:
-    - id: ASI06:2026
+    - id: ASI05:2026
       context: |
-        Path-argument command substitution exploits the agent's shell tool execution capability — the canonical ASI06:2026 Tool Misuse vector when the agent is allowed to construct file path inputs.
+        The pattern matches path-shaped key/value arguments in the input (file_path, filename, path, source, target, destination and similar keys) whose quoted value holds $(...) or backtick command substitution, the shell injection behind CVE-2026-35020, 35021 and 35022. ASI05:2026 covers agent tool access escalated into code execution on the host; the substitution runs attacker commands if the path reaches a shell.
       strength: primary
   owasp_llm:
     - id: LLM06:2025

package/rules/tool-poisoning/ATR-2026-00530-ms-agent-shell-tool-unsanitized-argv-rce.yaml

@@ -12,16 +12,17 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
+    - LLM05:2025
     - LLM06:2025
   owasp_agentic:
-    - ASI06:2026
+    - ASI05:2026
   mitre_atlas:
     - AML.T0053 - AI Agent Tool Invocation
 compliance:
   owasp_agentic:
-    - id: ASI06:2026
+    - id: ASI05:2026
       context: |
-        ASI06:2026 Tool Misuse — the agent's shell tool accepts unsanitized input as a direct exploit primitive. Detection on the unsafe invocation pattern blocks the class.
+        The patterns match shell-tool wrapper code (ShellTool, BashTool, run_shell, @tool('shell') and similar) that calls subprocess with shell=True, os.system, os.popen, child_process.exec or new Function, or exec or eval on an input variable, and shell tool calls whose argument chains extra commands (CVE-2026-2256). ASI05:2026 lists shell command invocation from reflected prompts and unsafe function calls or code evaluation as unexpected code execution.
       strength: primary
   owasp_llm:
     - id: LLM06:2025

package/rules/tool-poisoning/ATR-2026-00531-praisonai-unauthenticated-agent-api.yaml

@@ -13,10 +13,9 @@ severity: critical
 references:
   owasp_llm:
     - LLM06:2025
-    - LLM05:2025
   owasp_agentic:
+    - ASI03:2026
     - ASI05:2026
-    - ASI06:2026
   mitre_atlas:
     - AML.T0049 - Exploit Public-Facing Application
     - AML.T0040 - AI Model Inference API Access

package/rules/tool-poisoning/ATR-2026-00533-apache-pinot-mcp-unauthenticated-takeover.yaml

@@ -13,10 +13,9 @@ severity: critical
 references:
   owasp_llm:
     - LLM06:2025
-    - LLM05:2025
   owasp_agentic:
-    - ASI05:2026
-    - ASI06:2026
+    - ASI03:2026
+    - ASI02:2026
   mitre_atlas:
     - AML.T0049 - Exploit Public-Facing Application
   mitre_attack:

package/rules/tool-poisoning/ATR-2026-00716-ipi-data-destruction-carrier.yaml

@@ -13,20 +13,22 @@ severity: high
 references:
   owasp_llm:
     - LLM01:2025
+    - LLM06:2025
   owasp_agentic:
     - ASI01:2026
-    - ASI03:2026
+    - ASI02:2026
   mitre_atlas:
     - AML.T0051 - LLM Prompt Injection
     - AML.T0051.001 - Indirect
+    - AML.T0101 - Data Destruction via AI Agent Tool Invocation
 compliance:
   owasp_llm:
     - id: LLM01:2025
       context: Data destruction via indirect PI embeds file deletion instructions in consumed structured data.
       strength: primary
   owasp_agentic:
-    - id: ASI03:2026
-      context: Deleting user files or documents via agent file management tools is excessive agency with irreversible data loss.
+    - id: ASI01:2026
+      context: The patterns match content the agent reads that tells it to delete clinical or medical records tied to a diagnosis, delete all files from a cloud drive, health system, EHR or database, or delete a file by ID. ASI01:2026 covers manipulation of an agent's goals through deceptive tool outputs or poisoned external data, and lists indirect prompt injection that redirects an agent to exfiltrate sensitive data or misuse connected tools.
       strength: primary
   nist_ai_rmf:
     - subcategory: MS.2.7

package/rules/tool-poisoning/ATR-2026-00720-tool-misuse-privilege-escalation-social.yaml

@@ -12,15 +12,15 @@ maturity: stable
 severity: medium
 references:
   owasp_llm:
-    - LLM08:2025
+    - LLM06:2025
   owasp_agentic:
     - ASI03:2026
   mitre_atlas:
     - AML.T0051 - LLM Prompt Injection
 compliance:
   owasp_llm:
-    - id: LLM08:2025
-      context: 'Granting access control permissions via social engineering is LLM08 excessive agency: the agent''s access-grant capability is invoked through social justification.'
+    - id: LLM06:2025
+      context: The patterns match requests to invite a user, named by email address, to a Slack workspace and channel, give a delivery person, technician or contractor access to a house, door or smart lock, or add an outside technician or vendor to a workspace. LLM06:2025 covers damaging actions taken through an agent's extensions, including excessive autonomy, where an extension fails to independently verify and approve high-impact actions; granting an outside party access is such an action. The rule flags the request, not the agent's configuration.
       strength: primary
   owasp_agentic:
     - id: ASI03:2026

package/rules/tool-poisoning/ATR-2026-01301-tool-description-exclusive-tool-override.yaml

@@ -13,7 +13,7 @@ severity: high
 references:
   owasp_llm:
     - LLM01:2025
-    - LLM08:2025
+    - LLM06:2025
   owasp_agentic:
     - ASI03:2026
     - ASI01:2026

package/rules/tool-poisoning/ATR-2026-01303-tool-schema-enumeration-social-engineering.yaml

@@ -13,13 +13,14 @@ severity: high
 references:
   owasp_llm:
     - LLM01:2025
-    - LLM09:2025
+    - LLM07:2025
   owasp_agentic:
+    - ASI01:2026
     - ASI03:2026
-    - ASI09:2026
   mitre_atlas:
-    - AML.T0051 - LLM Prompt Injection
+    - AML.T0084.001 - Tool Definitions
     - AML.T0069 - Discover LLM System Information
+    - AML.T0051 - LLM Prompt Injection
 compliance:
   nist_ai_rmf:
     - subcategory: MS.2.7

package/rules/tool-poisoning/ATR-2026-01307-mcp-dns-rebinding-attack.yaml

@@ -12,13 +12,11 @@ maturity: stable
 severity: critical
 references:
   owasp_llm:
-    - LLM01:2025
-    - LLM02:2025
+    - LLM05:2025
   owasp_agentic:
-    - ASI09:2026
-    - ASI04:2026
+    - ASI02:2026
   mitre_atlas:
-    - AML.T0051.001 - Indirect
+    - AML.T0078 - Drive-by Compromise
   cve:
     - DNS rebinding attack class — SSRF via DNS temporal binding
 compliance:

package/rules/tool-poisoning/ATR-2026-01310-mcp-tool-description-compliance-history-exfil.yaml

@@ -13,13 +13,14 @@ severity: critical
 references:
   owasp_llm:
     - LLM01:2025
-    - LLM06:2025
+    - LLM02:2025
   owasp_agentic:
-    - ASI03:2026
-    - ASI08:2026
+    - ASI02:2026
+    - ASI04:2026
   mitre_atlas:
+    - AML.T0086 - Exfiltration via AI Agent Tool Invocation
+    - AML.T0110 - AI Agent Tool Poisoning
     - AML.T0051.001 - Indirect
-    - AML.T0053 - AI Agent Tool Invocation
 compliance:
   nist_ai_rmf:
     - subcategory: MS.2.7

package/rules/tool-poisoning/ATR-2026-01775-semantic-mcp-tool-manifest-poisoning.yaml

@@ -28,7 +28,7 @@ references:
   owasp_llm:
     - LLM03:2025
     - LLM01:2025
-    - LLM08:2025
+    - LLM06:2025
   owasp_agentic:
     - ASI03:2026
     - ASI02:2026

package/rules/tool-poisoning/ATR-2026-01952-praisonai-codemode-sandbox-escape-rce.yaml

@@ -12,11 +12,13 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
+    - LLM05:2025
     - LLM06:2025
   owasp_agentic:
-    - ASI06:2026
+    - ASI05:2026
   mitre_atlas:
-    - AML.T0049 - Exploit Public-Facing Application
+    - AML.T0050 - Command and Scripting Interpreter
+    - AML.T0105 - Escape to Host
   mitre_attack:
     - T1190 - Exploit Public-Facing Application
   cve:

package/rules/tool-poisoning/ATR-2026-01953-praisonai-codemode-function-ctor-sandbox-escape.yaml

@@ -12,11 +12,13 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
+    - LLM05:2025
     - LLM06:2025
   owasp_agentic:
-    - ASI06:2026
+    - ASI05:2026
   mitre_atlas:
-    - AML.T0049 - Exploit Public-Facing Application
+    - AML.T0050 - Command and Scripting Interpreter
+    - AML.T0105 - Escape to Host
   mitre_attack:
     - T1190 - Exploit Public-Facing Application
   cve:

package/rules/tool-poisoning/ATR-2026-01959-openhuman-shell-allowlist-env-prefix-bypass.yaml

@@ -14,9 +14,11 @@ references:
   owasp_llm:
     - LLM06:2025
   owasp_agentic:
-    - ASI06:2026
+    - ASI05:2026
+    - ASI02:2026
   mitre_atlas:
-    - AML.T0049 - Exploit Public-Facing Application
+    - AML.T0050 - Command and Scripting Interpreter
+    - AML.T0053 - AI Agent Tool Invocation
   mitre_attack:
     - T1190 - Exploit Public-Facing Application
   cve:

package/rules/tool-poisoning/ATR-2026-01963-praisonai-action-orchestrator-step-target-path-traversal-rce.yaml

@@ -14,9 +14,10 @@ references:
   owasp_llm:
     - LLM06:2025
   owasp_agentic:
-    - ASI06:2026
+    - ASI05:2026
+    - ASI02:2026
   mitre_atlas:
-    - AML.T0049 - Exploit Public-Facing Application
+    - AML.T0053 - AI Agent Tool Invocation
   mitre_attack:
     - T1190 - Exploit Public-Facing Application
   cve:

package/rules/tool-poisoning/ATR-2026-01965-flowise-custommcp-os-command-rce.yaml

@@ -14,9 +14,10 @@ references:
   owasp_llm:
     - LLM06:2025
   owasp_agentic:
-    - ASI06:2026
+    - ASI05:2026
   mitre_atlas:
     - AML.T0049 - Exploit Public-Facing Application
+    - AML.T0050 - Command and Scripting Interpreter
   mitre_attack:
     - T1190 - Exploit Public-Facing Application
   cve:

package/rules/tool-poisoning/ATR-2026-01967-deepchat-mermaid-xss-rce-ipc-mcp-register.yaml

@@ -12,11 +12,13 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
+    - LLM05:2025
     - LLM06:2025
   owasp_agentic:
-    - ASI06:2026
+    - ASI05:2026
   mitre_atlas:
-    - AML.T0049 - Exploit Public-Facing Application
+    - AML.T0050 - Command and Scripting Interpreter
+    - AML.T0112 - Machine Compromise
   mitre_attack:
     - T1190 - Exploit Public-Facing Application
   cve:

package/rules/tool-poisoning/ATR-2026-01970-praisonai-filetools-normpath-path-traversal.yaml

@@ -14,9 +14,9 @@ references:
   owasp_llm:
     - LLM06:2025
   owasp_agentic:
-    - ASI06:2026
+    - ASI02:2026
   mitre_atlas:
-    - AML.T0049 - Exploit Public-Facing Application
+    - AML.T0053 - AI Agent Tool Invocation
   mitre_attack:
     - T1190 - Exploit Public-Facing Application
   cve:

package/rules/tool-poisoning/ATR-2026-01973-anythingllm-logo-endpoint-path-traversal.yaml

@@ -12,9 +12,9 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
-    - LLM06:2025
+    - LLM03:2025
   owasp_agentic:
-    - ASI06:2026
+    - ASI04:2026
   mitre_atlas:
     - AML.T0049 - Exploit Public-Facing Application
   mitre_attack:

package/rules/tool-poisoning/ATR-2026-01978-anythingllm-collector-process-filename-path-traversal-delete.yaml

@@ -12,9 +12,9 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
-    - LLM06:2025
+    - LLM03:2025
   owasp_agentic:
-    - ASI06:2026
+    - ASI04:2026
   mitre_atlas:
     - AML.T0049 - Exploit Public-Facing Application
   mitre_attack:

package/rules/tool-poisoning/ATR-2026-01979-pandasai-prompt-injection-dunder-sandbox-escape-rce.yaml

@@ -12,11 +12,15 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
+    - LLM05:2025
+    - LLM01:2025
     - LLM06:2025
   owasp_agentic:
-    - ASI06:2026
+    - ASI05:2026
   mitre_atlas:
-    - AML.T0049 - Exploit Public-Facing Application
+    - AML.T0050 - Command and Scripting Interpreter
+    - AML.T0105 - Escape to Host
+    - AML.T0051.000 - Direct
   mitre_attack:
     - T1190 - Exploit Public-Facing Application
   cve:

package/rules/tool-poisoning/ATR-2026-01980-agentic-flow-mcp-tool-param-command-injection.yaml

@@ -22,9 +22,11 @@ references:
   owasp_llm:
     - LLM06:2025
   owasp_agentic:
-    - ASI06:2026
+    - ASI05:2026
+    - ASI02:2026
   mitre_atlas:
-    - AML.T0053 - LLM Plugin Compromise
+    - AML.T0053 - AI Agent Tool Invocation
+    - AML.T0050 - Command and Scripting Interpreter
   mitre_attack:
     - T1059 - Command and Scripting Interpreter
   ghsa:

package/rules/tool-poisoning/ATR-2026-01982-dbt-mcp-node-selection-argument-injection.yaml

@@ -21,9 +21,9 @@ references:
   owasp_llm:
     - LLM06:2025
   owasp_agentic:
-    - ASI06:2026
+    - ASI02:2026
   mitre_atlas:
-    - AML.T0053 - LLM Plugin Compromise
+    - AML.T0053 - AI Agent Tool Invocation
   mitre_attack:
     - T1059 - Command and Scripting Interpreter
   cve:

package/rules/tool-poisoning/ATR-2026-01983-mcp-for-stata-log-file-name-command-injection.yaml

@@ -20,9 +20,11 @@ references:
   owasp_llm:
     - LLM06:2025
   owasp_agentic:
-    - ASI06:2026
+    - ASI05:2026
+    - ASI02:2026
   mitre_atlas:
-    - AML.T0053 - LLM Plugin Compromise
+    - AML.T0053 - AI Agent Tool Invocation
+    - AML.T0050 - Command and Scripting Interpreter
   mitre_attack:
     - T1059 - Command and Scripting Interpreter
   cve:

package/rules/tool-poisoning/ATR-2026-01985-mcp-connect-bridge-unauth-process-spawn-rce.yaml

@@ -23,9 +23,10 @@ references:
   owasp_llm:
     - LLM06:2025
   owasp_agentic:
-    - ASI06:2026
+    - ASI05:2026
   mitre_atlas:
     - AML.T0049 - Exploit Public-Facing Application
+    - AML.T0050 - Command and Scripting Interpreter
   mitre_attack:
     - T1059 - Command and Scripting Interpreter
   cve:

package/rules/tool-poisoning/ATR-2026-01987-langroid-sqlchatagent-prompt-to-sql-rce.yaml

@@ -16,11 +16,13 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
+    - LLM05:2025
     - LLM01:2025
   owasp_agentic:
-    - ASI06:2026
+    - ASI05:2026
   mitre_atlas:
-    - AML.T0053 - LLM Plugin Compromise
+    - AML.T0053 - AI Agent Tool Invocation
+    - AML.T0050 - Command and Scripting Interpreter
   mitre_attack:
     - T1059 - Command and Scripting Interpreter
   cve:

package/rules/tool-poisoning/ATR-2026-02102-html-injection-tool-arg-approval-ui-xss.yaml

@@ -12,7 +12,7 @@ maturity: experimental
 severity: high
 references:
   owasp_llm:
-    - LLM08:2025
+    - LLM05:2025
   owasp_agentic:
     - ASI02:2026
   mitre_attack: