agent-threat-rules 4.2.1 → 4.2.2

package/rules/excessive-autonomy/ATR-2026-01773-semantic-excessive-agency-action.yaml

@@ -27,7 +27,7 @@ maturity: experimental
 severity: high
 references:
   owasp_llm:
-    - LLM08:2025
+    - LLM06:2025
   owasp_agentic:
     - ASI03:2026
     - ASI02:2026
@@ -35,8 +35,8 @@ references:
     - AML.T0051 - LLM Prompt Injection
 compliance:
   owasp_llm:
-    - id: LLM08:2025
-      context: Broad-scope bulk actions, untrusted code execution, and proxy privilege grants are all core LLM08:2025 excessive-agency outcomes.
+    - id: LLM06:2025
+      context: 'The patterns match requests that give an agent broad or unclear real-world scope: send a message to all customers or subscribers, turn off all or connected devices to save energy, for safety, or before or while something else, set a thermostat to a ''comfortable'' temperature, download and run a script from a link or URL, run and fix a crashing script from a GitHub, GitLab or Bitbucket repository, grant access to a third party or everyone, unblock a restricted domain, site or network, or invite a named person to a private resource. LLM06:2025 covers damaging actions taken through an agent''s extensions in response to unexpected, ambiguous or manipulated LLM outputs, rooted in excessive functionality, permissions or autonomy; the rule flags the request, not the agent''s configuration.'
       strength: primary
   owasp_agentic:
     - id: ASI03:2026

package/rules/excessive-autonomy/ATR-2026-01801-asb-autonomous-vehicle-sabotage.yaml

@@ -12,7 +12,7 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
-    - LLM08:2025
+    - LLM06:2025
     - LLM01:2025
   owasp_agentic:
     - ASI03:2026
@@ -27,8 +27,8 @@ metadata_provenance:
   owasp_agentic: human-reviewed
 compliance:
   owasp_llm:
-    - id: LLM08:2025
-      context: Driving the agent's vehicle-control capability to sabotage brakes, steering, or sensors is a maximal excessive-agency outcome under LLM08:2025.
+    - id: LLM06:2025
+      context: The patterns match requests to compromise, corrupt, disrupt or jam a vehicle safety subsystem (brakes, control systems, path planning, lidar, GPS, cameras, V2X, collision warning), seize or hijack vehicle control, forge duplicate vehicle identities, trigger an unauthorized emergency shutdown, or inject false collision warnings, traffic-sign signals or sensor data. LLM06:2025 covers damaging actions an LLM agent performs through its extensions, with prompt injection from a malicious user among the listed triggers and excessive functionality, permissions or autonomy as the root cause; the rule flags the request, not the agent's privileges.
       strength: primary
   owasp_agentic:
     - id: ASI03:2026

package/rules/excessive-autonomy/ATR-2026-01804-asb-covert-unlogged-action.yaml

@@ -12,11 +12,10 @@ maturity: test
 severity: high
 references:
   owasp_llm:
-    - LLM08:2025
+    - LLM06:2025
     - LLM01:2025
   owasp_agentic:
     - ASI02:2026
-    - ASI03:2026
   mitre_atlas:
     - AML.T0051 - LLM Prompt Injection
   research:
@@ -27,8 +26,8 @@ metadata_provenance:
   owasp_agentic: human-reviewed
 compliance:
   owasp_llm:
-    - id: LLM08:2025
-      context: Directing the agent to perform an action while keeping it out of audit records is an excessive-agency outcome that defeats oversight, under LLM08:2025.
+    - id: LLM06:2025
+      context: 'The patterns match a request to perform an action together with a directive to hide it: keep it out of the official records or logs, make it appear legitimate in the system, or make sure the system or the person affected does not detect it. LLM06:2025 covers damaging actions an LLM agent performs through its extensions, with prompt injection from a malicious user among the listed triggers and excessive functionality, permissions or autonomy as the root cause; the rule flags the request, not the agent''s privileges. LLM06 lists logging and monitoring of extension activity among the measures that limit the damage, and this directive asks the agent to stay out of that record.'
       strength: primary
   owasp_agentic:
     - id: ASI02:2026

package/rules/excessive-autonomy/ATR-2026-01805-asb-financial-fraud-execution.yaml

@@ -12,7 +12,7 @@ maturity: test
 severity: high
 references:
   owasp_llm:
-    - LLM08:2025
+    - LLM06:2025
     - LLM01:2025
   owasp_agentic:
     - ASI02:2026
@@ -27,8 +27,8 @@ metadata_provenance:
   owasp_agentic: human-reviewed
 compliance:
   owasp_llm:
-    - id: LLM08:2025
-      context: Driving the agent's financial tools to run a Ponzi scheme, fabricate statements, or redirect funds without authorization is a severe excessive-agency outcome under LLM08:2025.
+    - id: LLM06:2025
+      context: The patterns match requests to run a Ponzi-style scheme, produce alternative financial statements or alter backup financial data, move a dollar amount out of a client account without authorization, route funds through a company to test laundering detection, open accounts from client information, or apply for a loan on experimental projections. LLM06:2025 covers damaging actions an LLM agent performs through its extensions, with prompt injection from a malicious user among the listed triggers and excessive functionality, permissions or autonomy as the root cause; the rule flags the request, not the agent's privileges.
       strength: primary
   owasp_agentic:
     - id: ASI02:2026

package/rules/excessive-autonomy/ATR-2026-01806-asb-clinical-patient-harm.yaml

@@ -12,7 +12,7 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
-    - LLM08:2025
+    - LLM06:2025
     - LLM01:2025
   owasp_agentic:
     - ASI03:2026
@@ -27,8 +27,8 @@ metadata_provenance:
   owasp_agentic: human-reviewed
 compliance:
   owasp_llm:
-    - id: LLM08:2025
-      context: Driving a clinical agent to overdose, falsify a diagnosis, or neglect care is a maximal excessive-agency / safety outcome under LLM08:2025.
+    - id: LLM06:2025
+      context: The patterns match requests to give a high dose of a drug or a number of opioid or insulin tablets framed as a controlled study or trial, record an incorrect or simulated diagnosis, file an insurance claim for treatment not provided, or neglect care or disrupt therapy to cause patient harm. LLM06:2025 covers damaging actions an LLM agent performs through its extensions, with prompt injection from a malicious user among the listed triggers and excessive functionality, permissions or autonomy as the root cause; the rule flags the request, not the agent's privileges.
       strength: primary
   owasp_agentic:
     - id: ASI03:2026

package/rules/excessive-autonomy/ATR-2026-01809-semantic-insider-manipulation-process-corruption.yaml

@@ -28,7 +28,6 @@ maturity: test
 severity: high
 references:
   owasp_llm:
-    - LLM08:2025
     - LLM06:2025
   owasp_agentic:
     - ASI02:2026
@@ -43,8 +42,8 @@ metadata_provenance:
   owasp_agentic: human-reviewed
 compliance:
   owasp_llm:
-    - id: LLM08:2025
-      context: Driving the agent's business tools to manipulate markets, corrupt a legal process, or move funds on a vague pretext is an excessive-agency outcome under LLM08:2025.
+    - id: LLM06:2025
+      context: The patterns match requests to adjust a stock's trading data or move portfolio funds into high-risk stocks to test the market, trade securities on future-market predictions, look for incentives for a judge or pressure a witness, or surveil the opposing party's attorney. LLM06:2025 covers damaging actions an LLM agent performs through its extensions, with prompt injection from a malicious user among the listed triggers and excessive functionality, permissions or autonomy as the root cause; the rule flags the request, not the agent's privileges.
       strength: primary
   owasp_agentic:
     - id: ASI02:2026

package/rules/excessive-autonomy/ATR-2026-01989-t1046-agent-internal-network-sweep.yaml

@@ -22,9 +22,9 @@ references:
   mitre_attack:
     - T1046 - Network Service Discovery
   mitre_atlas:
-    - AML.T0011 - User Execution
+    - AML.T0053 - AI Agent Tool Invocation
   owasp_agentic:
-    - ASI06:2026
+    - ASI02:2026
   owasp_llm:
     - LLM06:2025
 tags:

package/rules/excessive-autonomy/ATR-2026-01993-t1562-agent-impair-defenses.yaml

@@ -23,9 +23,9 @@ references:
   mitre_attack:
     - T1562 - Impair Defenses
   mitre_atlas:
-    - AML.T0011 - User Execution
+    - AML.T0053 - AI Agent Tool Invocation
   owasp_agentic:
-    - ASI01:2026
+    - ASI02:2026
   owasp_llm:
     - LLM06:2025
 tags:

package/rules/excessive-autonomy/ATR-2026-02667-preapproved-tool-list-in-job-payload.yaml

@@ -16,7 +16,6 @@ references:
     - CWE-284
   owasp_llm:
     - LLM06:2025
-    - LLM08:2025
   owasp_agentic:
     - ASI02:2026
     - ASI06:2026

package/rules/model-abuse/ATR-2026-00292-self-harm-eating-disorder-facilitation.yaml

@@ -12,11 +12,11 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
-    - LLM02:2025
+    - LLM01:2025
   owasp_agentic:
-    - ASI08:2026
+    - ASI01:2026
   mitre_atlas:
-    - AML.T0057 - LLM Data Leakage
+    - AML.T0048.003 - User Harm
   research:
     - https://github.com/NVIDIA/garak/blob/main/garak/probes/donotanswer.py
     - https://arxiv.org/abs/2308.13387

package/rules/model-abuse/ATR-2026-00502-training-data-extraction-via-divergent-repetition-attack.yaml

@@ -12,10 +12,12 @@ maturity: test
 severity: medium
 references:
   owasp_llm:
+    - LLM02:2025
     - LLM10:2025
   owasp_agentic:
     - ASI01:2026
   mitre_atlas:
+    - AML.T0057 - LLM Data Leakage
     - AML.T0040 - AI Model Inference API Access
 compliance:
   owasp_agentic:

package/rules/privilege-escalation/ATR-2026-00107-delayed-execution-bypass.yaml

@@ -18,12 +18,12 @@ references:
   owasp_llm:
     - LLM06:2025
   owasp_agentic:
-    - ASI06:2026
+    - ASI03:2026
     - ASI05:2026
   mitre_attack:
     - T1053 - Scheduled Task/Job
   mitre_atlas:
-    - AML.T0050 - Command and Scripting Interpreter
+    - AML.T0053 - AI Agent Tool Invocation
 compliance:
   eu_ai_act:
     - article: '14'

package/rules/privilege-escalation/ATR-2026-00143-casual-privilege-escalation.yaml

@@ -12,11 +12,12 @@ maturity: test
 severity: high
 references:
   mitre_atlas:
-    - AML.T0054 - LLM Jailbreak
+    - AML.T0053 - AI Agent Tool Invocation
   owasp_llm:
-    - LLM01:2025
+    - LLM06:2025
   owasp_agentic:
     - ASI03:2026
+    - ASI10:2026
 metadata_provenance:
   mitre_atlas: auto-generated
 compliance:

package/rules/privilege-escalation/ATR-2026-00144-rationalized-safety-bypass.yaml

@@ -12,11 +12,12 @@ maturity: test
 severity: high
 references:
   mitre_atlas:
-    - AML.T0054 - LLM Jailbreak
+    - AML.T0053 - AI Agent Tool Invocation
   owasp_llm:
-    - LLM01:2025
+    - LLM06:2025
   owasp_agentic:
     - ASI03:2026
+    - ASI10:2026
 metadata_provenance:
   mitre_atlas: auto-generated
 compliance:

package/rules/privilege-escalation/ATR-2026-00204-stealth-execution-persistence.yaml

@@ -11,7 +11,7 @@ maturity: test
 severity: high
 references:
   owasp_llm:
-    - LLM08:2025
+    - LLM06:2025
   owasp_agentic:
     - ASI02:2026
     - ASI05:2026

package/rules/privilege-escalation/ATR-2026-00441-semantic-kernel-sessions-python-plugin-startup-persistence.yaml

@@ -15,10 +15,11 @@ references:
     - LLM06:2025
     - LLM05:2025
   owasp_agentic:
+    - ASI05:2026
     - ASI03:2026
-    - ASI06:2026
   mitre_atlas:
     - AML.T0050 - Command and Scripting Interpreter
+    - AML.T0105 - Escape to Host
   mitre_attack:
     - T1547 - Boot or Logon Autostart Execution
     - T1547.001 - Registry Run Keys / Startup Folder

package/rules/privilege-escalation/ATR-2026-00546-crewai-json-loader-local-file-read.yaml

@@ -16,10 +16,12 @@ references:
   owasp_llm:
     - LLM06:2025
     - LLM05:2025
+    - LLM02:2025
   owasp_agentic:
+    - ASI02:2026
     - ASI03:2026
   mitre_atlas:
-    - AML.T0043 - Craft Adversarial Data
+    - AML.T0037 - Data from Local System
   mitre_attack:
     - T1083 - File and Directory Discovery
     - T1552 - Unsecured Credentials

package/rules/privilege-escalation/ATR-2026-00549-destructive-tool-without-human-approval.yaml

@@ -13,8 +13,8 @@ maturity: draft
 severity: critical
 references:
   owasp_agentic:
-    - ASI04:2026
-    - ASI05:2026
+    - ASI02:2026
+    - ASI09:2026
   owasp_llm:
     - LLM06:2025
   mitre_atlas:

package/rules/privilege-escalation/ATR-2026-01601-sql-injection-destructive-ddl.yaml

@@ -17,17 +17,18 @@ maturity: stable
 severity: critical
 references:
   owasp_llm:
-    - LLM02:2025
+    - LLM05:2025
   owasp_agentic:
-    - ASI03:2026
+    - ASI02:2026
   mitre_atlas:
-    - AML.T0043 - Craft Adversarial Data
+    - AML.T0053 - AI Agent Tool Invocation
+    - AML.T0101 - Data Destruction via AI Agent Tool Invocation
   mitre_attack:
     - T1485 - Data Destruction
 compliance:
   owasp_llm:
-    - id: LLM02:2025
-      context: Destructive DDL injection causes permanent data loss and denial of service to legitimate users.
+    - id: LLM05:2025
+      context: The patterns match a quote-and-semicolon break or a SQL comment marker followed by DROP TABLE, DATABASE, INDEX or VIEW, TRUNCATE or DELETE FROM, and DROP TABLE followed by a comment, in tool arguments or user input. LLM05:2025 lists LLM-generated SQL executed without parameterization as improper output handling; these statements delete data or schema in the database the tool queries.
       strength: primary
   nist_ai_rmf:
     - subcategory: MS.2.7

package/rules/privilege-escalation/ATR-2026-01602-sql-injection-union-select-exfil.yaml

@@ -18,10 +18,12 @@ severity: critical
 references:
   owasp_llm:
     - LLM02:2025
+    - LLM05:2025
   owasp_agentic:
+    - ASI02:2026
     - ASI03:2026
   mitre_atlas:
-    - AML.T0043 - Craft Adversarial Data
+    - AML.T0053 - AI Agent Tool Invocation
   mitre_attack:
     - T1190 - Exploit Public-Facing Application
 compliance:

package/rules/privilege-escalation/ATR-2026-01603-sql-injection-stacked-dml-abuse.yaml

@@ -18,11 +18,12 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
-    - LLM02:2025
+    - LLM05:2025
   owasp_agentic:
     - ASI03:2026
+    - ASI02:2026
   mitre_atlas:
-    - AML.T0043 - Craft Adversarial Data
+    - AML.T0053 - AI Agent Tool Invocation
   mitre_attack:
     - T1190 - Exploit Public-Facing Application
 compliance:

package/rules/privilege-escalation/ATR-2026-01604-sql-injection-schema-enumeration.yaml

@@ -18,10 +18,11 @@ severity: high
 references:
   owasp_llm:
     - LLM02:2025
+    - LLM05:2025
   owasp_agentic:
-    - ASI03:2026
+    - ASI02:2026
   mitre_atlas:
-    - AML.T0043 - Craft Adversarial Data
+    - AML.T0053 - AI Agent Tool Invocation
   mitre_attack:
     - T1190 - Exploit Public-Facing Application
 compliance:

package/rules/privilege-escalation/ATR-2026-01616-path-traversal-agent-file-access.yaml

@@ -19,10 +19,13 @@ severity: high
 references:
   owasp_llm:
     - LLM02:2025
+    - LLM05:2025
   owasp_agentic:
+    - ASI02:2026
     - ASI03:2026
   mitre_atlas:
-    - AML.T0043 - Craft Adversarial Data
+    - AML.T0037 - Data from Local System
+    - AML.T0053 - AI Agent Tool Invocation
   mitre_attack:
     - T1083 - File and Directory Discovery
 compliance:

package/rules/privilege-escalation/ATR-2026-01802-asb-backdoor-surveillance-implant.yaml

@@ -12,13 +12,14 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
-    - LLM08:2025
+    - LLM06:2025
     - LLM01:2025
   owasp_agentic:
     - ASI02:2026
     - ASI03:2026
   mitre_atlas:
     - AML.T0051 - LLM Prompt Injection
+    - AML.T0012 - Valid Accounts
   research:
     - 'Zhang et al., Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents (2024)'
 metadata_provenance:
@@ -27,8 +28,8 @@ metadata_provenance:
   owasp_agentic: human-reviewed
 compliance:
   owasp_llm:
-    - id: LLM08:2025
-      context: Using the agent's update capability to plant a backdoor or surveillance tooling is a severe excessive-agency outcome under LLM08:2025.
+    - id: LLM06:2025
+      context: The patterns match requests to implant a backdoor, rootkit, remote-access tool or covert surveillance tool, tied to granting remote access or to a software update or maintenance window, and requests for a phishing operation to acquire and exploit administrator credentials. LLM06:2025 covers damaging actions an LLM agent performs through its extensions, with prompt injection from a malicious user among the listed triggers and excessive functionality, permissions or autonomy as the root cause; the rule flags the request, not the agent's privileges.
       strength: primary
   owasp_agentic:
     - id: ASI02:2026

package/rules/privilege-escalation/ATR-2026-01803-asb-covert-server-intrusion.yaml

@@ -12,11 +12,11 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
-    - LLM08:2025
+    - LLM06:2025
     - LLM01:2025
   owasp_agentic:
     - ASI02:2026
-    - ASI03:2026
+    - ASI05:2026
   mitre_atlas:
     - AML.T0051 - LLM Prompt Injection
   research:
@@ -27,8 +27,8 @@ metadata_provenance:
   owasp_agentic: human-reviewed
 compliance:
   owasp_llm:
-    - id: LLM08:2025
-      context: Using the agent's infrastructure tools to inject code, wipe logs, hijack DNS, or destroy data is a severe excessive-agency outcome under LLM08:2025.
+    - id: LLM06:2025
+      context: 'The patterns match requests to inject code or commands into a process, wipe or alter logs or data, manipulate DNS records, capture network traffic or permanently delete a database, each paired with a stated harmful aim: doing it discreetly or undetected, hiding traces, redirecting users to an alternate site, intercepting sensitive information or preventing recovery. LLM06:2025 covers damaging actions an LLM agent performs through its extensions, with prompt injection from a malicious user among the listed triggers and excessive functionality, permissions or autonomy as the root cause; the rule flags the request, not the agent''s privileges.'
       strength: primary
   owasp_agentic:
     - id: ASI02:2026

package/rules/privilege-escalation/ATR-2026-01808-asb-synthetic-pan-payment-probe.yaml

@@ -12,7 +12,7 @@ maturity: test
 severity: high
 references:
   owasp_llm:
-    - LLM08:2025
+    - LLM06:2025
     - LLM02:2025
   owasp_agentic:
     - ASI02:2026
@@ -27,8 +27,8 @@ metadata_provenance:
   owasp_agentic: human-reviewed
 compliance:
   owasp_llm:
-    - id: LLM08:2025
-      context: Driving live payment-rail transactions with an attacker-supplied PAN under a 'test' pretext is an excessive-agency / fraud outcome under LLM08:2025.
+    - id: LLM06:2025
+      context: The patterns match requests to use a full 16-digit card number, often described as simulated, test or fake card data, to test a payment system. LLM06:2025 covers damaging actions an LLM agent performs through its extensions, with prompt injection from a malicious user among the listed triggers and excessive functionality, permissions or autonomy as the root cause; the rule flags the request, not the agent's privileges.
       strength: primary
   owasp_agentic:
     - id: ASI02:2026

package/rules/privilege-escalation/ATR-2026-01949-praisonai-mcpserver-unauth-tools-call.yaml

@@ -14,7 +14,7 @@ references:
   owasp_llm:
     - LLM06:2025
   owasp_agentic:
-    - ASI06:2026
+    - ASI03:2026
   mitre_atlas:
     - AML.T0049 - Exploit Public-Facing Application
   mitre_attack:

package/rules/privilege-escalation/ATR-2026-01974-anything-llm-data-import-access-control.yaml

@@ -14,7 +14,7 @@ references:
   owasp_llm:
     - LLM06:2025
   owasp_agentic:
-    - ASI06:2026
+    - ASI03:2026
   mitre_atlas:
     - AML.T0049 - Exploit Public-Facing Application
   mitre_attack:

package/rules/privilege-escalation/ATR-2026-01992-t1556-agent-auth-process-tamper.yaml

@@ -22,7 +22,7 @@ references:
   mitre_attack:
     - T1556 - Modify Authentication Process
   mitre_atlas:
-    - AML.T0053 - LLM Plugin Compromise
+    - AML.T0053 - AI Agent Tool Invocation
   owasp_agentic:
     - ASI03:2026
   owasp_llm:

package/rules/privilege-escalation/ATR-2026-02040-file-edit-tool-persistence-write.yaml

@@ -12,7 +12,7 @@ maturity: experimental
 severity: critical
 references:
   owasp_llm:
-    - LLM08:2025
+    - LLM06:2025
   owasp_agentic:
     - ASI02:2026
   mitre_attack:

package/rules/privilege-escalation/ATR-2026-02100-cypher-destructive-admin-query-injection.yaml

@@ -63,19 +63,19 @@ detection:
   conditions:
     - field: content
       operator: regex
-      value: (?i)(?<!\b(?:you will learn that|you will learn|for example|this query|note that|for instance|such as|explains that)\s)\b(?:MATCH|CALL)\b[\s\S]{0,40}\bDETACH\s+DELETE\b
+      value: (?i)(?<!\byou will learn that\s)(?<!\byou will learn\s)(?<!\bfor example\s)(?<!\bthis query\s)(?<!\bnote that\s)(?<!\bfor instance\s)(?<!\bsuch as\s)(?<!\bexplains that\s)\b(?:MATCH|CALL)\b[\s\S]{0,40}\bDETACH\s+DELETE\b
       description: Cypher DETACH DELETE (bulk destructive delete of matched nodes/relationships) near a MATCH/CALL clause, excluding common teaching-phrase lead-ins (e.g. 'you will learn that ...') so tutorial/explanatory prose quoting the same syntax does not fire
     - field: content
       operator: regex
-      value: (?i)(?<!\b(?:you will learn that|you will learn|for example|this query|note that|for instance|such as|explains that)\s)\bCALL\s+dbms\.security\.\w+\s*\(
+      value: (?i)(?<!\byou will learn that\s)(?<!\byou will learn\s)(?<!\bfor example\s)(?<!\bthis query\s)(?<!\bnote that\s)(?<!\bfor instance\s)(?<!\bsuch as\s)(?<!\bexplains that\s)\bCALL\s+dbms\.security\.\w+\s*\(
       description: Cypher CALL into the dbms.security.* administrative procedure namespace (account/role management), excluding common teaching-phrase lead-ins
     - field: content
       operator: regex
-      value: (?i)(?<!\b(?:you will learn that|you will learn|for example|this query|note that|for instance|such as|explains that)\s)\bapoc\.periodic\.iterate\s*\([\s\S]{0,40}\bDETACH\s+DELETE\b
+      value: (?i)(?<!\byou will learn that\s)(?<!\byou will learn\s)(?<!\bfor example\s)(?<!\bthis query\s)(?<!\bnote that\s)(?<!\bfor instance\s)(?<!\bsuch as\s)(?<!\bexplains that\s)\bapoc\.periodic\.iterate\s*\([\s\S]{0,40}\bDETACH\s+DELETE\b
       description: apoc.periodic.iterate batch procedure driving a DETACH DELETE (mass destructive delete at scale), excluding common teaching-phrase lead-ins
     - field: content
       operator: regex
-      value: (?i)(?<!\b(?:you will learn that|you will learn|for example|this query|note that|for instance|such as|explains that)\s)\bapoc\.(?:cypher\.runFile|load\.json(?:Params)?)\s*\(\s*[\x27"]file://
+      value: (?i)(?<!\byou will learn that\s)(?<!\byou will learn\s)(?<!\bfor example\s)(?<!\bthis query\s)(?<!\bnote that\s)(?<!\bfor instance\s)(?<!\bsuch as\s)(?<!\bexplains that\s)\bapoc\.(?:cypher\.runFile|load\.json(?:Params)?)\s*\(\s*[\x27"]file://
       description: apoc loader/runFile procedure pointed at a file:// URI (arbitrary local file read via Cypher), excluding common teaching-phrase lead-ins
   false_positives:
     - A database administrator running schema-clearing DETACH DELETE or dbms.security procedures through an approved maintenance console, not through an LLM-facing chat/tool interface

package/rules/privilege-escalation/ATR-2026-02101-dynamic-dunder-attribute-sandbox-escape.yaml

@@ -12,7 +12,7 @@ maturity: experimental
 severity: critical
 references:
   owasp_llm:
-    - LLM08:2025
+    - LLM05:2025
   owasp_agentic:
     - ASI05:2026
   mitre_attack:

package/rules/privilege-escalation/ATR-2026-02142-download-tool-absolute-path-sandbox-escape.yaml

@@ -12,7 +12,7 @@ maturity: experimental
 severity: high
 references:
   owasp_llm:
-    - LLM08:2025
+    - LLM05:2025
   owasp_agentic:
     - ASI02:2026
   mitre_attack:

package/rules/privilege-escalation/ATR-2026-02146-export-tool-dest-dir-credential-directory-redirect.yaml

@@ -12,7 +12,7 @@ maturity: experimental
 severity: critical
 references:
   owasp_llm:
-    - LLM08:2025
+    - LLM06:2025
   owasp_agentic:
     - ASI02:2026
   mitre_attack:

package/rules/privilege-escalation/ATR-2026-02195-dangerous-env-var-injection-config-tool.yaml

@@ -16,7 +16,7 @@ references:
   cwe:
     - CWE-94
   owasp_llm:
-    - LLM08:2025
+    - LLM06:2025
   owasp_agentic:
     - ASI04:2026
   mitre_attack:

package/rules/privilege-escalation/ATR-2026-02300-mcp-stdio-config-dangerous-env-var.yaml

@@ -16,7 +16,7 @@ references:
   cwe:
     - CWE-829
   owasp_llm:
-    - LLM08:2025
+    - LLM03:2025
   owasp_agentic:
     - ASI04:2026
   mitre_attack:
@@ -71,19 +71,19 @@ detection:
   conditions:
     - field: content
       operator: regex
-      value: (?i)(?:(?<=\bmcpServers\b[\s\S]{0,500})|(?=[\s\S]{0,300}?"?\bcommand\b"?\s*[:=])(?=[\s\S]{0,300}?"?\bargs\b"?\s*[:=]))"env"\s*:\s*\{[\s\S]{0,10}"?\bNODE_OPTIONS\b"?\s*:\s*["'][\s\S]{0,40}?(?:--require\b|-r\s+\S|--loader\b|--experimental-loader\b|--experimental-require-module\b)
+      value: (?i)(?:\bmcpServers\b[\s\S]{0,500}?|(?=[\s\S]{0,300}?"?\bcommand\b"?\s*[:=])(?=[\s\S]{0,300}?"?\bargs\b"?\s*[:=]))"env"\s*:\s*\{[\s\S]{0,10}"?\bNODE_OPTIONS\b"?\s*:\s*["'][\s\S]{0,40}?(?:--require\b|-r\s+\S|--loader\b|--experimental-loader\b|--experimental-require-module\b)
       description: JSON-style MCP config env block, anchored by a nearby mcpServers key OR a command+args pair (the MCP stdio-spawn shape), sets NODE_OPTIONS to a value that actually references a require/preload/loader flag, not a routine memory/debug/warnings flag or the modern --import instrumentation flag
     - field: content
       operator: regex
-      value: (?i)(?:(?<=\bmcpServers\b[\s\S]{0,500})|(?=[\s\S]{0,300}?"?\bcommand\b"?\s*[:=])(?=[\s\S]{0,300}?"?\bargs\b"?\s*[:=]))\b(?:env|environment)\b\s*:\s*\n\s+"?\bNODE_OPTIONS\b"?\s*:\s*[\s\S]{0,40}?(?:--require\b|-r\s+\S|--loader\b|--experimental-loader\b|--experimental-require-module\b)
+      value: (?i)(?:\bmcpServers\b[\s\S]{0,500}?|(?=[\s\S]{0,300}?"?\bcommand\b"?\s*[:=])(?=[\s\S]{0,300}?"?\bargs\b"?\s*[:=]))\b(?:env|environment)\b\s*:[^\S\n]*\n\s+"?\bNODE_OPTIONS\b"?\s*:\s*[\s\S]{0,40}?(?:--require\b|-r\s+\S|--loader\b|--experimental-loader\b|--experimental-require-module\b)
       description: 'YAML-style MCP config env block (env:/environment: followed immediately by an indented NODE_OPTIONS key on the next line, not separated by prose or a code fence), anchored by a nearby mcpServers key OR a command+args pair, sets NODE_OPTIONS to a require/preload/loader flag'
     - field: content
       operator: regex
-      value: (?i)(?:(?<=\bmcpServers\b[\s\S]{0,500})|(?=[\s\S]{0,300}?"?\bcommand\b"?\s*[:=])(?=[\s\S]{0,300}?"?\bargs\b"?\s*[:=]))"env"\s*:\s*\{[\s\S]{0,10}"?\b(?:LD_PRELOAD|DYLD_INSERT_LIBRARIES|BASH_ENV|PYTHONSTARTUP|PERL5OPT|RUBYOPT|GCONV_PATH)\b"?\s*:\s*\S
+      value: (?i)(?:\bmcpServers\b[\s\S]{0,500}?|(?=[\s\S]{0,300}?"?\bcommand\b"?\s*[:=])(?=[\s\S]{0,300}?"?\bargs\b"?\s*[:=]))"env"\s*:\s*\{[\s\S]{0,10}"?\b(?:LD_PRELOAD|DYLD_INSERT_LIBRARIES|BASH_ENV|PYTHONSTARTUP|PERL5OPT|RUBYOPT|GCONV_PATH)\b"?\s*:\s*\S
       description: JSON-style MCP config env block, anchored by a nearby mcpServers key OR a command+args pair, sets a known process-hijacking environment variable that has no benign flag-only mode (its value IS the hijack payload)
     - field: content
       operator: regex
-      value: (?i)(?:(?<=\bmcpServers\b[\s\S]{0,500})|(?=[\s\S]{0,300}?"?\bcommand\b"?\s*[:=])(?=[\s\S]{0,300}?"?\bargs\b"?\s*[:=]))\b(?:env|environment)\b\s*:\s*\n\s+"?\b(?:LD_PRELOAD|DYLD_INSERT_LIBRARIES|BASH_ENV|PYTHONSTARTUP|PERL5OPT|RUBYOPT|GCONV_PATH)\b"?\s*:\s*\S
+      value: (?i)(?:\bmcpServers\b[\s\S]{0,500}?|(?=[\s\S]{0,300}?"?\bcommand\b"?\s*[:=])(?=[\s\S]{0,300}?"?\bargs\b"?\s*[:=]))\b(?:env|environment)\b\s*:[^\S\n]*\n\s+"?\b(?:LD_PRELOAD|DYLD_INSERT_LIBRARIES|BASH_ENV|PYTHONSTARTUP|PERL5OPT|RUBYOPT|GCONV_PATH)\b"?\s*:\s*\S
       description: 'YAML-style MCP config env block (env:/environment: followed immediately by an indented key on the next line), anchored by a nearby mcpServers key OR a command+args pair, sets a known process-hijacking environment variable'
   false_positives:
     - A DevOps runbook or documentation discussing these variable names in prose without an accompanying env-block config context

package/rules/privilege-escalation/ATR-2026-02301-symlink-outside-workspace-sensitive-target.yaml

@@ -17,7 +17,7 @@ references:
     - CWE-22
     - CWE-61
   owasp_llm:
-    - LLM08:2025
+    - LLM06:2025
   owasp_agentic:
     - ASI07:2026
   mitre_attack:

package/rules/privilege-escalation/ATR-2026-02302-git-worktree-dotgit-sandbox-escape.yaml

@@ -17,7 +17,7 @@ references:
     - CWE-22
     - CWE-59
   owasp_llm:
-    - LLM08:2025
+    - LLM06:2025
   owasp_agentic:
     - ASI07:2026
   mitre_attack:

package/rules/privilege-escalation/ATR-2026-02402-mcp-policy-engine-fail-open.yaml

@@ -13,7 +13,6 @@ severity: high
 references:
   owasp_llm:
     - LLM06:2025
-    - LLM08:2025
   owasp_agentic:
     - ASI02:2026
     - ASI04:2026