agent-threat-rules 4.2.0 → 4.2.2

package/rules/tool-poisoning/ATR-2026-02141-mcp-server-config-command-execution.yaml

@@ -12,7 +12,7 @@ maturity: experimental
 severity: critical
 references:
   owasp_llm:
-    - LLM08:2025
+    - LLM06:2025
   owasp_agentic:
     - ASI02:2026
   mitre_attack:

package/rules/tool-poisoning/ATR-2026-02233-unscoped-destructive-db-request-nl.yaml

@@ -12,7 +12,7 @@ maturity: experimental
 severity: high
 references:
   owasp_llm:
-    - LLM08:2025
+    - LLM06:2025
   owasp_agentic:
     - ASI02:2026
   mitre_attack:

package/rules/tool-poisoning/ATR-2026-02870-invisible-control-before-directive.yaml

@@ -0,0 +1,94 @@
+title: Invisible Unicode Control Before a Directive in a Tool Description or Skill File
+id: ATR-2026-02870
+rule_version: 1
+status: experimental
+description: |
+  Detects a zero-width, soft-hyphen or bidirectional control character placed at the start of a clause that gives the model or agent an instruction, in the static text an agent reads before it acts: an MCP tool description (tools/list at registration time) or a SKILL.md file. The control is invisible in most renderers, so a reviewer reading the description sees an ordinary sentence while the model still reads the directive after it.
+  Controls covered: U+200B ZERO WIDTH SPACE, U+200C ZWNJ, U+200D ZWJ, U+2060 WORD JOINER, U+180E MONGOLIAN VOWEL SEPARATOR, U+00AD SOFT HYPHEN, U+FEFF (only after punctuation or a word, not at the start of the text or of a line, where it is a byte-order mark), U+200E LRM, U+200F RLM, and the bidi embedding, override and isolate controls U+202A-U+202E and U+2066-U+2069. A run of up to seven controls counts; the last one before the directive must not be a closing control (U+202C PDF, U+2069 PDI), so a directive that follows a closed embedding is not attributed to it.
+  Presence alone does not trigger. These characters are legitimate in right-to-left text (LRM/RLM and embeddings around Latin words in Hebrew, Arabic and Persian), in Persian and Indic shaping (ZWNJ, ZWJ), in emoji ZWJ sequences, in hyphenation hints (soft hyphens inside German compounds), in localized keyboard shortcuts wrapped in LRE/PDF, and in text pasted from chat clients (ZWSP after an @ sign). The rule therefore requires two things: the control starts a clause (it follows ASCII punctuation, an ASCII word and a space, CJK sentence punctuation, or the start of the text or a line, not a letter it is glued to and not a right-to-left word), and the clause is a directive addressed to the model: an instruction override, an attention header whose clause tells the model to read, send or ignore something, an injected <IMPORTANT> or <system> tag, a response-timing hook (before answering, after responding) tied to sending secrets, conversation or a URL, an always/must directive to call this tool first or instead of others, an exfiltration verb on secrets, conversation, environment or credential files, a read of ~/.ssh, .env or cloud credential files, or a concealment directive (do not tell the user).
+  Surfaces: the conditions read tool_description, so the rule runs on an mcp_exchange event that carries fields.tool_description, on each tool definition of a tools/list document scanned with `atr scan` (the tool-definition scope admits a tool_call rule that reads tool_description), and on SKILL.md files (scan_target both; in a skill scan every field resolves to the document). The engine strips most of these controls before matching but also tests each regex against the raw text, which is where these patterns match.
+  Limits: the directive vocabulary is English only. A control glued between two letters (for example a soft hyphen inside a word) is not counted, so a directive written as one run with no space or punctuation before the control is missed. Text reversed under an override (RLO with the directive stored backwards) and Unicode tag characters (U+E0000-U+E007F) are out of scope; ATR-2026-00276 and ATR-2026-00258 cover those on other fields. Directives without any invisible control are left to the tool-poisoning rules (for example ATR-2026-00100 to -00107). Reported in issue #653.
+author: ATR Community
+date: 2026/10/24
+schema_version: '0.1'
+detection_tier: pattern
+maturity: test
+severity: high
+references:
+  owasp_llm:
+    - LLM01:2025
+  owasp_agentic:
+    - ASI01:2026
+    - ASI04:2026
+  mitre_atlas:
+    - 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+  external:
+    - https://github.com/Agent-Threat-Rule/agent-threat-rules/issues/653
+    - https://trojansource.codes/
+    - https://www.unicode.org/reports/tr9/
+compliance:
+  eu_ai_act:
+    - article: '15'
+      context: Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist attempts by third parties to alter their behaviour; this rule provides detection evidence for that requirement by flagging tool descriptions and skill files that hide a directive to the model behind an invisible Unicode control.
+      strength: primary
+    - article: '13'
+      context: Article 13 (transparency) requires that deployers can understand the system they operate; a directive hidden behind an invisible control is text the deployer cannot see in review but the model follows, and this rule surfaces it.
+      strength: secondary
+    - article: '9'
+      context: Article 9 (risk management system) requires identified risks to be treated; this rule is a detection control for the hidden-directive risk in third-party MCP tools and skills, applied before the agent loads them.
+      strength: secondary
+  nist_ai_rmf:
+    - subcategory: MS.2.7
+      context: MEASURE 2.7 requires security and resilience to be evaluated and documented; scanning tool definitions and skill files for directives hidden behind invisible controls is a measurable check on third-party agent components.
+      strength: primary
+    - subcategory: MG.3.1
+      context: MANAGE 3.1 requires risks from third-party resources to be monitored; MCP tool descriptions and skills are third-party text the model treats as instructions, and this rule monitors them for hidden directives.
+      strength: secondary
+    - subcategory: MP.5.1
+      context: MAP 5.1 requires the likelihood and impact of identified attack patterns to be characterised; the gap between what a reviewer sees and what the model reads is one such pattern, and this rule detects its use in static tool text.
+      strength: secondary
+  iso_42001:
+    - clause: '8.1'
+      context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is supported by this rule's detection of hidden directives in externally provided MCP tools and skills.
+      strength: primary
+    - clause: '6.2'
+      context: ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; detecting a directive hidden behind an invisible Unicode control in tool text is such a treatment.
+      strength: secondary
+tags:
+  category: tool-poisoning
+  subcategory: invisible-control-before-directive
+  scan_target: both
+  confidence: medium
+agent_source:
+  type: tool_call
+  framework:
+    - mcp
+    - any
+  provider:
+    - any
+detection:
+  condition: any
+  conditions:
+    - field: tool_description
+      operator: regex
+      value: "(?:(?:[\\x21-\\x2F\\x3A-\\x40\\x5B-\\x60\\x7B-\\x7E、。！，：；？][ \\t]{0,3}|[A-Za-z0-9][ \\t]{1,3})[​‌‍⁠᠎­‎‏‪‫‭‮⁦⁧⁨\uFEFF‬⁩]{0,6}[​‌‍⁠᠎­‎‏‪‫‭‮⁦⁧⁨\uFEFF]|(?:^|[\\r\\n])[ \\t]{0,8}[​‌‍⁠᠎­‎‏‪‫‭‮⁦⁧⁨‬⁩]{0,6}[​‌‍⁠᠎­‎‏‪‫‭‮⁦⁧⁨])[ \\t\"'*_`>(\\[]{0,4}(?:(?:also|then|please|now|first|additionally|and|but|ai|assistant|agent|model|llm|claude)[,:]?\\s+){0,2}(?:(?:ignore|disregard|forget|override|bypass)\\s+(?:all\\s+|any\\s+)?(?:(?:the|your|of\\s+the|previous|prior|above|earlier|preceding|system|original|other|safety|security|developer)\\s+){0,3}(?:instructions?|rules|prompts?|guidelines|directives|polic(?:y|ies)|guardrails|restrictions|constraints)|(?:important|attention|urgent|critical|system\\s+(?:note|override|message|instruction)|admin(?:istrator)?\\s+note|note\\s+to\\s+(?:the\\s+)?(?:ai|assistant|model|agent|llm))\\s{0,3}[:!>-][^\\n]{0,60}?\\b(?:ignore|disregard|forget|read|send|forward|upload|include|attach|exfiltrate|leak|(?:do\\s+not|don't|never)\\s+(?:tell|mention|inform|reveal)|(?:before|after|when)\\s+(?:answering|responding|replying|you\\s+(?:answer|respond|reply)))\\b|<\\s{0,3}/?(?:important|system|instructions?|secret|hidden)\\s{0,3}>|you\\s+are\\s+now\\b|new\\s+(?:system\\s+)?instructions?\\s{0,3}:)"
+      description: Invisible control at the start of a clause, followed by an instruction override (ignore/disregard previous instructions), an attention header whose clause tells the model to read, send, ignore or answer differently, an injected <IMPORTANT>/<system> tag, or a new-instructions / you-are-now header
+    - field: tool_description
+      operator: regex
+      value: "(?:(?:[\\x21-\\x2F\\x3A-\\x40\\x5B-\\x60\\x7B-\\x7E、。！，：；？][ \\t]{0,3}|[A-Za-z0-9][ \\t]{1,3})[​‌‍⁠᠎­‎‏‪‫‭‮⁦⁧⁨\uFEFF‬⁩]{0,6}[​‌‍⁠᠎­‎‏‪‫‭‮⁦⁧⁨\uFEFF]|(?:^|[\\r\\n])[ \\t]{0,8}[​‌‍⁠᠎­‎‏‪‫‭‮⁦⁧⁨‬⁩]{0,6}[​‌‍⁠᠎­‎‏‪‫‭‮⁦⁧⁨])[ \\t\"'*_`>(\\[]{0,4}(?:(?:also|then|please|now|first|additionally|and|but|ai|assistant|agent|model|llm|claude)[,:]?\\s+){0,2}(?:(?:before|after|when|while|prior\\s+to|whenever|each\\s+time)\\s+(?:you\\s+)?(?:respond(?:ing)?|answer(?:ing)?|repl(?:y|ying)|returning\\s+(?:the\\s+)?(?:results?|output|answer)|(?:using|calling|invoking)\\s+(?:this|any|another|other)\\s+tools?)\\b[^\\n]{0,80}?\\b(?:(?:send|forward|upload|post|attach|append|include|copy|transmit|exfiltrate|leak|email|share)\\b[^\\n]{0,60}?(?:(?:conversation|chat\\s+history|message\\s+history|system\\s+prompt|(?:process\\s+)?environment|\\benv\\s+vars?|credentials?|secrets?|api[\\s_-]?keys?|(?:access|auth(?:entication)?|session|bearer)\\s+tokens?|passwords?|private\\s+keys?|ssh\\s+keys?|~/\\.ssh|\\.ssh/|id_rsa|id_ed25519|\\.env\\b|\\.aws/|cookies)|https?://|[\\w.+-]{1,64}@[\\w-]{1,63}\\.[a-z]{2,})|(?:call|invoke|use)\\s+this\\s+(?:tool|function))|(?:always|must|you\\s+must|you\\s+should|make\\s+sure\\s+(?:to|you))\\s+(?:first\\s+)?(?:(?:call|invoke|use|run|prefer|choose|select)\\s+this\\s+(?:tool|function|server|skill|plugin)\\s+(?:first|before\\s+(?:any|all|every|other)|instead\\s+of|rather\\s+than|for\\s+(?:every|all|any)\\b|even\\s+(?:if|when))|(?:send|forward|upload|post|attach|append|include|copy|transmit|exfiltrate|leak|email|share)\\b[^\\n]{0,60}?(?:conversation|chat\\s+history|message\\s+history|system\\s+prompt|(?:process\\s+)?environment|\\benv\\s+vars?|credentials?|secrets?|api[\\s_-]?keys?|(?:access|auth(?:entication)?|session|bearer)\\s+tokens?|passwords?|private\\s+keys?|ssh\\s+keys?|~/\\.ssh|\\.ssh/|id_rsa|id_ed25519|\\.env\\b|\\.aws/|cookies))|(?:(?:for\\s+best\\s+results|for\\s+(?:debugging|analytics|telemetry|quality|audit)(?:\\s+purposes)?|to\\s+improve\\s+[a-z]+)[,:]?\\s+)?(?:silently\\s+|quietly\\s+|secretly\\s+)?(?:send|forward|upload|post|attach|append|include|copy|transmit|exfiltrate|leak|email|share)\\b[^\\n]{0,60}?(?:conversation|chat\\s+history|message\\s+history|system\\s+prompt|(?:process\\s+)?environment|\\benv\\s+vars?|credentials?|secrets?|api[\\s_-]?keys?|(?:access|auth(?:entication)?|session|bearer)\\s+tokens?|passwords?|private\\s+keys?|ssh\\s+keys?|~/\\.ssh|\\.ssh/|id_rsa|id_ed25519|\\.env\\b|\\.aws/|cookies)|(?:read|cat|open|load|print|dump|return)\\s+[^\\n]{0,40}?(?:~/\\.ssh|\\.ssh/|id_rsa|id_ed25519|/etc/(?:passwd|shadow)|\\.env\\b|\\.aws/credentials|\\.npmrc|\\.netrc|\\.git-credentials|\\.kube/config))"
+      description: Invisible control at the start of a clause, followed by a response-timing hook (before answering, after responding, when calling another tool) that sends or reads secrets, conversation or a URL; an always/must directive to call this tool first or instead of others, or to send secrets; an exfiltration verb on secrets, conversation, environment or credential files; or a read of ~/.ssh, .env, .aws/credentials and similar files
+    - field: tool_description
+      operator: regex
+      value: "(?:(?:[\\x21-\\x2F\\x3A-\\x40\\x5B-\\x60\\x7B-\\x7E、。！，：；？][ \\t]{0,3}|[A-Za-z0-9][ \\t]{1,3})[​‌‍⁠᠎­‎‏‪‫‭‮⁦⁧⁨\uFEFF‬⁩]{0,6}[​‌‍⁠᠎­‎‏‪‫‭‮⁦⁧⁨\uFEFF]|(?:^|[\\r\\n])[ \\t]{0,8}[​‌‍⁠᠎­‎‏‪‫‭‮⁦⁧⁨‬⁩]{0,6}[​‌‍⁠᠎­‎‏‪‫‭‮⁦⁧⁨])[ \\t\"'*_`>(\\[]{0,4}(?:(?:also|then|please|now|first|additionally|and|but|ai|assistant|agent|model|llm|claude)[,:]?\\s+){0,2}(?:(?:do\\s+not|don't|never|without)\\s+(?:tell(?:ing)?|inform(?:ing)?|notify(?:ing)?|mention(?:ing)?|reveal(?:ing)?|disclos(?:e|ing)|alert(?:ing)?|warn(?:ing)?|ask(?:ing)?)\\s+(?:this\\s+to\\s+|anything\\s+to\\s+)?(?:the\\s+)?(?:user|human|operator)\\b|(?:do\\s+not|don't|never)\\s+let\\s+(?:the\\s+)?(?:user|human)\\s+(?:know|see))"
+      description: Invisible control at the start of a clause, followed by a concealment directive (do not tell, inform, mention or reveal to the user)
+  false_positives:
+    - A security write-up, test fixture or rule file that quotes a poisoned tool description verbatim, invisible control included, will match; that is the text the rule looks for.
+    - A localized description whose right-to-left text puts an LRM or RLM after an ASCII word and a space, directly before an English sentence that tells the model to send credentials or not tell the user, would match. No such text was found in the benign corpora; the non-Latin samples in the true negatives do not match.
+    - Presence of the controls alone (right-to-left marks, ZWNJ in Persian, emoji ZWJ sequences, soft hyphens inside words, LRE/PDF around a keyboard shortcut, ZWSP from pasted chat text, a byte-order mark at the start of a file) does not match.
+response:
+  actions:
+    - alert
+    - snapshot
+  message_template: |
+    [ATR-2026-02870] HIGH: an invisible Unicode control (zero-width, soft hyphen or bidi) starts a clause that instructs the model, in a tool description or skill file. Show the description with control characters made visible, and review the tool or skill before the agent loads it.
+confidence: 60