agent-threat-rules 4.2.1 → 4.2.2

package/rules/prompt-injection/ATR-2026-00154-unauthorized-background-task-execution-v.yaml

@@ -11,11 +11,13 @@ maturity: test
 severity: high
 references:
   mitre_atlas:
-    - AML.T0051 - LLM Prompt Injection
+    - AML.T0053 - AI Agent Tool Invocation
   owasp_llm:
-    - LLM01:2025
+    - LLM06:2025
   owasp_agentic:
-    - ASI01:2026
+    - ASI04:2026
+    - ASI10:2026
+    - ASI02:2026
 metadata_provenance:
   mitre_atlas: auto-generated
   owasp_llm: auto-generated

package/rules/prompt-injection/ATR-2026-00156-ssh-remote-command-execution-with-creden.yaml

@@ -11,11 +11,14 @@ maturity: test
 severity: high
 references:
   mitre_atlas:
-    - AML.T0051 - LLM Prompt Injection
+    - AML.T0055 - Unsecured Credentials
+    - AML.T0050 - Command and Scripting Interpreter
   owasp_llm:
-    - LLM01:2025
+    - LLM06:2025
+    - LLM02:2025
   owasp_agentic:
-    - ASI01:2026
+    - ASI03:2026
+    - ASI02:2026
 metadata_provenance:
   mitre_atlas: auto-generated
   owasp_llm: auto-generated

package/rules/prompt-injection/ATR-2026-00407-echo-sql-jinja-template-injection.yaml

@@ -13,13 +13,13 @@ severity: high
 references:
   owasp_llm:
     - LLM01:2025
-    - LLM04:2025
+    - LLM05:2025
   owasp_agentic:
     - ASI01:2026
-    - ASI03:2026
+    - ASI05:2026
+    - ASI02:2026
   mitre_atlas:
     - AML.T0051 - LLM Prompt Injection
-    - AML.T0051 - LLM Prompt Injection
   research:
     - https://github.com/NVIDIA/garak/blob/main/garak/probes/exploitation.py
     - https://owasp.org/www-community/attacks/Server_Side_Template_Injection

package/rules/prompt-injection/ATR-2026-00410-lmrc-harm-category-direct-elicitation.yaml

@@ -13,11 +13,11 @@ severity: medium
 references:
   owasp_llm:
     - LLM09:2025
-    - LLM06:2025
   owasp_agentic:
     - ASI01:2026
   mitre_atlas:
-    - AML.T0051 - LLM Prompt Injection
+    - AML.T0048.002 - Societal Harm
+    - AML.T0048.003 - User Harm
   research:
     - https://github.com/NVIDIA/garak/blob/main/garak/probes/lmrc.py
 compliance:

package/rules/prompt-injection/ATR-2026-00442-quoted-exact-output-forcing.yaml

@@ -65,11 +65,11 @@ detection:
   conditions:
     - field: user_input
       operator: regex
-      value: (?i)(?<!["'])(?<!\b(?:they|user|users|people|customer|customers|developer|developers|client|clients|when|if|whenever|caller|callers|operator|operators)\s)\b(say|output|retype|repeat|emit|reply\s+with|respond\s+with)\s+(?:exactly|only|just|verbatim|literally|precisely|word[\s-]for[\s-]word|nothing\s+but|the\s+(?:exact|literal)\s+(?:string|phrase|text|words?|line)?)\b[^"\n]{0,40}["'][\sA-Za-z0-9][^"\n]{3,200}["'](?!\s*(?:not|or|nor|but|instead|rather\s+than|--|—))
+      value: (?i)(?<!["'])(?<!\bthey\s)(?<!\buser\s)(?<!\busers\s)(?<!\bpeople\s)(?<!\bcustomer\s)(?<!\bcustomers\s)(?<!\bdeveloper\s)(?<!\bdevelopers\s)(?<!\bclient\s)(?<!\bclients\s)(?<!\bwhen\s)(?<!\bif\s)(?<!\bwhenever\s)(?<!\bcaller\s)(?<!\bcallers\s)(?<!\boperator\s)(?<!\boperators\s)\b(say|output|retype|repeat|emit|reply\s+with|respond\s+with)\s+(?:exactly|only|just|verbatim|literally|precisely|word[\s-]for[\s-]word|nothing\s+but|the\s+(?:exact|literal)\s+(?:string|phrase|text|words?|line)?)\b[^"\n]{0,40}["'][\sA-Za-z0-9][^"\n]{3,200}["'](?!\s*(?:not|or|nor|but|instead|rather\s+than|--|—))
       description: Imperative output + explicit exact-forcing modifier (exactly/only/just/verbatim/word-for-word) + quoted target
     - field: user_input
       operator: regex
-      value: (?i)(?<!["'])(?<!\b(?:they|user|users|people|customer|customers|developer|developers|client|clients|when|if|whenever|caller|callers|operator|operators)\s)\b(say|output|retype|repeat|emit|reply\s+with|respond\s+with)\s+(?:(?:exactly|only|just|the|following|exact|literal|string|phrase|text|words|line)\s*[:,-]?\s*)*["'][^"\n]{0,80}\b(pwned|approved|granted|accepted|authori[sz]ed|overrid(?:e|den)|unlocked|jailbroken|bypass(?:ed)?|hacked|admin(?:istrator)?\s+access|root\s+access|no\s+threats?|all\s+clear|access\s+granted|system\s+override)\b[^"\n]{0,80}["'](?!\s*(?:not|or|nor|but|instead))
+      value: (?i)(?<!["'])(?<!\bthey\s)(?<!\buser\s)(?<!\busers\s)(?<!\bpeople\s)(?<!\bcustomer\s)(?<!\bcustomers\s)(?<!\bdeveloper\s)(?<!\bdevelopers\s)(?<!\bclient\s)(?<!\bclients\s)(?<!\bwhen\s)(?<!\bif\s)(?<!\bwhenever\s)(?<!\bcaller\s)(?<!\bcallers\s)(?<!\boperator\s)(?<!\boperators\s)\b(say|output|retype|repeat|emit|reply\s+with|respond\s+with)\s+(?:(?:exactly|only|just|the|following|exact|literal|string|phrase|text|words|line)(?:\s*[:,-])?\s*)*["'][^"\n]{0,80}\b(pwned|approved|granted|accepted|authori[sz]ed|overrid(?:e|den)|unlocked|jailbroken|bypass(?:ed)?|hacked|admin(?:istrator)?\s+access|root\s+access|no\s+threats?|all\s+clear|access\s+granted|system\s+override)\b[^"\n]{0,80}["'](?!\s*(?:not|or|nor|but|instead))
       description: Imperative output forcing a security/status canonical assertion (approved/granted/PWNED/override/all clear)
     - field: user_input
       operator: regex

package/rules/prompt-injection/ATR-2026-00512-rules-file-backdoor-injection.yaml

@@ -13,11 +13,14 @@ severity: critical
 references:
   owasp_llm:
     - LLM01:2025
+    - LLM03:2025
   owasp_agentic:
     - ASI01:2026
+    - ASI04:2026
   mitre_atlas:
     - AML.T0051 - LLM Prompt Injection
     - AML.T0051.000 - Direct
+    - AML.T0081 - Modify AI Agent Configuration
 compliance:
   owasp_agentic:
     - id: ASI01:2026

package/rules/prompt-injection/ATR-2026-00554-langchain-vulnerable-to-template-injecti.yaml

@@ -24,11 +24,11 @@ references:
     - https://nvd.nist.gov/vuln/detail/CVE-2025-65106
     - https://github.com/advisories/GHSA-6qv9-48xg-fc7f
   owasp_llm:
-    - LLM01:2025
+    - LLM03:2025
   owasp_agentic:
-    - ASI01:2026
+    - ASI05:2026
   mitre_atlas:
-    - AML.T0051 - LLM Prompt Injection
+    - AML.T0050 - Command and Scripting Interpreter
 metadata_provenance:
   ghsa: ghsa-sync
   cve: ghsa-sync

package/rules/prompt-injection/ATR-2026-01800-asb-trigger-marker-tool-coercion.yaml

@@ -13,7 +13,7 @@ severity: high
 references:
   owasp_llm:
     - LLM01:2025
-    - LLM08:2025
+    - LLM06:2025
   owasp_agentic:
     - ASI01:2026
     - ASI03:2026
@@ -31,8 +31,8 @@ compliance:
     - id: LLM01:2025
       context: The fabricated 'because marker X is present, use tool Y' rule is an injected directive overriding the agent's own tool-selection logic — the core LLM01:2025 prompt-injection pattern.
       strength: primary
-    - id: LLM08:2025
-      context: Forcing the agent to invoke an attacker-named capability (e.g. EngineTampering, DesignDataTheft) is an excessive-agency outcome under LLM08:2025.
+    - id: LLM06:2025
+      context: The patterns match the AgentSecurityBench template that tells the agent to use a named, bracketed tool because a marker such as [:)] is 'in the question'. LLM06:2025 covers damaging actions an agent takes through its extensions in response to unexpected, ambiguous or manipulated LLM outputs, with prompt injection among the listed triggers; here the injected rule picks the tool, so the harm depends on what that tool can do.
       strength: secondary
   owasp_agentic:
     - id: ASI03:2026

package/rules/prompt-injection/ATR-2026-02009-bare-key-elicitation-trailing-colon.yaml

@@ -13,11 +13,12 @@ severity: high
 references:
   owasp_llm:
     - LLM01:2025
+    - LLM02:2025
   owasp_agentic:
-    - ASI09:2026
+    - ASI01:2026
   mitre_atlas:
     - AML.T0051 - LLM Prompt Injection
-    - AML.T0054 - LLM Jailbreak
+    - AML.T0057 - LLM Data Leakage
 metadata_provenance:
   owasp_agentic: auto-generated
 compliance:

package/rules/prompt-injection/ATR-2026-02820-tool-result-orders-agent-to-hide-its-own-action.yaml

@@ -15,7 +15,7 @@ severity: high
 references:
   owasp_llm:
     - LLM01:2025
-    - LLM08:2025
+    - LLM06:2025
   owasp_agentic:
     - ASI02:2026
     - ASI03:2026
@@ -32,8 +32,8 @@ compliance:
     - id: LLM01:2025
       context: The concealment order reaches the agent through retrieved content rather than the principal, which is indirect prompt injection under LLM01:2025.
       strength: primary
-    - id: LLM08:2025
-      context: Suppressing an action from the operator's view removes the oversight that bounds an agent's agency, under LLM08:2025.
+    - id: LLM06:2025
+      context: The patterns match tool output that tells the agent not to mention, report, log or let the user know about an action it took, or to leave this action, step or change, or what it did, out of its summary, report, log or audit. LLM06:2025 covers damaging actions an agent takes in response to unexpected, ambiguous or manipulated LLM outputs, with prompt injection among the listed triggers, and lists logging and monitoring of extension activity among the measures that limit the damage; this directive asks the agent to keep its action out of what the user sees.
       strength: secondary
   owasp_agentic:
     - id: ASI02:2026

package/rules/skill-compromise/ATR-2026-00127-subcommand-overflow.yaml

@@ -14,8 +14,9 @@ references:
   mitre_atlas:
     - AML.T0010 - AI Supply Chain Compromise
   owasp_llm:
-    - LLM07:2025
+    - LLM03:2025
   owasp_agentic:
+    - ASI04:2026
     - ASI02:2026
   owasp_ast:
     - AST02:2026 - Excessive Permissions

package/rules/skill-compromise/ATR-2026-00157-timebomb-credential-exfil.yaml

@@ -15,11 +15,15 @@ wild_validated: 2026/04/08
 wild_samples: 53577
 references:
   owasp_llm:
-    - LLM07:2025
+    - LLM02:2025
+    - LLM03:2025
   owasp_agentic:
+    - ASI04:2026
     - ASI03:2026
   mitre_atlas:
-    - AML.T0048
+    - AML.T0055 - Unsecured Credentials
+    - AML.T0010 - AI Supply Chain Compromise
+    - AML.T0025 - Exfiltration via Cyber Means
 compliance:
   nist_ai_rmf:
     - subcategory: GV.6.1

package/rules/skill-compromise/ATR-2026-00200-agent-memory-config-tampering.yaml

@@ -12,7 +12,7 @@ severity: critical
 references:
   owasp_llm:
     - LLM01:2025
-    - LLM08:2025
+    - LLM06:2025
   owasp_agentic:
     - ASI04:2026
     - ASI07:2026

package/rules/skill-compromise/ATR-2026-00217-credential-harvesting.yaml

@@ -12,11 +12,13 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
-    - LLM01:2025
+    - LLM02:2025
+    - LLM03:2025
   owasp_agentic:
     - ASI04:2026
   mitre_atlas:
-    - AML.T0024
+    - AML.T0055 - Unsecured Credentials
+    - AML.T0025 - Exfiltration via Cyber Means
 compliance:
   nist_ai_rmf:
     - subcategory: MS.2.10

package/rules/skill-compromise/ATR-2026-00222-credential-harvesting.yaml

@@ -12,11 +12,15 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
-    - LLM01:2025
+    - LLM02:2025
   owasp_agentic:
+    - ASI04:2026
     - ASI02:2026
+    - ASI03:2026
   mitre_atlas:
-    - AML.T0040
+    - AML.T0055 - Unsecured Credentials
+    - AML.T0113 - Steal Web Session Cookie
+    - AML.T0025 - Exfiltration via Cyber Means
 compliance:
   nist_ai_rmf:
     - subcategory: MS.2.10

package/rules/skill-compromise/ATR-2026-00224-credential-exfiltration.yaml

@@ -12,11 +12,13 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
-    - LLM01:2025
+    - LLM02:2025
+    - LLM03:2025
   owasp_agentic:
     - ASI04:2026
   mitre_atlas:
-    - AML.T0040
+    - AML.T0055 - Unsecured Credentials
+    - AML.T0025 - Exfiltration via Cyber Means
 compliance:
   nist_ai_rmf:
     - subcategory: MS.2.10

package/rules/skill-compromise/ATR-2026-00260-package-hallucination.yaml

@@ -13,11 +13,12 @@ severity: high
 references:
   owasp_llm:
     - LLM09:2025
-    - LLM02:2025
+    - LLM03:2025
   owasp_agentic:
-    - ASI07:2026
+    - ASI04:2026
   mitre_atlas:
     - AML.T0060 - Publish Hallucinated Entities
+    - AML.T0062 - Discover LLM Hallucinations
   research:
     - https://www.usenix.org/publications/loginonline/we-have-package-you-comprehensive-analysis-package-hallucinations-code
     - https://arxiv.org/abs/2501.19012

package/rules/skill-compromise/ATR-2026-00266-malware-dropper-gen.yaml

@@ -12,11 +12,12 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
-    - LLM05:2025
+    - LLM01:2025
   owasp_agentic:
-    - ASI08:2026
+    - ASI05:2026
+    - ASI01:2026
   mitre_atlas:
-    - AML.T0053 - AI Agent Tool Invocation
+    - AML.T0102 - Generate Malicious Commands
   research:
     - https://github.com/NVIDIA/garak/blob/main/garak/probes/malwaregen.py
     - https://attack.mitre.org/techniques/T1105/

package/rules/skill-compromise/ATR-2026-00398-huggingface-unsafe-model-artifact-load.yaml

@@ -12,11 +12,11 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
-    - LLM06:2025
+    - LLM03:2025
     - LLM05:2025
   owasp_agentic:
-    - ASI07:2026
-    - ASI03:2026
+    - ASI04:2026
+    - ASI05:2026
   mitre_atlas:
     - AML.T0011.000 - Unsafe AI Artifacts
     - AML.T0010 - AI Supply Chain Compromise

package/rules/skill-compromise/ATR-2026-00429-nl-skill-self-modification.yaml

@@ -18,12 +18,14 @@ maturity: test
 severity: critical
 references:
   mitre_atlas:
+    - AML.T0081 - Modify AI Agent Configuration
     - AML.T0010 - AI Supply Chain Compromise
-    - AML.T0044 - Full AI Model Access
   owasp_llm:
     - LLM06:2025
+    - LLM03:2025
   owasp_agentic:
-    - ASI06:2026
+    - ASI04:2026
+    - ASI10:2026
   owasp_ast:
     - AST01:2026 - Malicious Skills
 compliance:

package/rules/skill-compromise/ATR-2026-00525-mini-shai-hulud-gh-token-monitor-persistence.yaml

@@ -14,6 +14,7 @@ references:
   owasp_llm:
     - LLM03:2025
   owasp_agentic:
+    - ASI04:2026
     - ASI05:2026
   mitre_atlas:
     - AML.T0010 - AI Supply Chain Compromise

package/rules/skill-compromise/ATR-2026-00527-skill-silent-git-remote-mirror-exfiltration.yaml

@@ -12,12 +12,13 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
+    - LLM02:2025
     - LLM06:2025
-    - LLM10:2025
   owasp_agentic:
     - ASI04:2026
+    - ASI02:2026
   mitre_atlas:
-    - AML.T0024 - Exfiltration via AI Inference API
+    - AML.T0086 - Exfiltration via AI Agent Tool Invocation
     - AML.T0048 - External Harms
 compliance:
   owasp_agentic:

package/rules/skill-compromise/ATR-2026-01755-backdoor-pot-linguistic-trigger-phrase.yaml

@@ -19,7 +19,7 @@ references:
     - LLM04:2025
     - LLM01:2025
   owasp_agentic:
-    - ASI03:2026
+    - ASI04:2026
   mitre_atlas:
     - AML.T0018.000 - Poison AI Model
     - AML.T0020 - Poison Training Data

package/rules/skill-compromise/ATR-2026-01756-backdoor-pot-symbol-emoticon-trigger.yaml

@@ -15,7 +15,7 @@ references:
     - LLM04:2025
     - LLM01:2025
   owasp_agentic:
-    - ASI03:2026
+    - ASI04:2026
   mitre_atlas:
     - AML.T0018.000 - Poison AI Model
     - AML.T0051 - LLM Prompt Injection

package/rules/tool-poisoning/ATR-2026-00096-registry-poisoning.yaml

@@ -12,11 +12,12 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
-    - LLM06:2025
+    - LLM03:2025
   mitre_atlas:
-    - AML.T0056
-    - AML.T0010.005
+    - AML.T0010.005 - AI Agent Tool
+    - AML.T0011.001 - Malicious Package
   owasp_agentic:
+    - ASI04:2026
     - ASI05:2026
 metadata_provenance:
   owasp_llm: auto-generated

package/rules/tool-poisoning/ATR-2026-00100-consent-bypass-instruction.yaml

@@ -17,13 +17,15 @@ severity: high
 source: threat-cloud
 references:
   mitre_atlas:
-    - AML.T0053 - AI Agent Tool Invocation
+    - AML.T0110 - AI Agent Tool Poisoning
+    - AML.T0086 - Exfiltration via AI Agent Tool Invocation
   owasp_llm:
     - LLM01:2025
-    - LLM05:2025
+    - LLM06:2025
   owasp_agentic:
     - ASI02:2026
     - ASI04:2026
+    - ASI09:2026
 metadata_provenance:
   mitre_atlas: auto-generated
 compliance:

package/rules/tool-poisoning/ATR-2026-00105-silent-action-concealment.yaml

@@ -17,13 +17,14 @@ severity: high
 source: threat-cloud
 references:
   mitre_atlas:
-    - AML.T0053 - AI Agent Tool Invocation
+    - AML.T0110 - AI Agent Tool Poisoning
   owasp_llm:
     - LLM01:2025
     - LLM06:2025
   owasp_agentic:
     - ASI04:2026
     - ASI02:2026
+    - ASI09:2026
 metadata_provenance:
   mitre_atlas: auto-generated
 compliance:

package/rules/tool-poisoning/ATR-2026-00106-schema-description-contradiction.yaml

@@ -17,12 +17,12 @@ severity: high
 source: threat-cloud
 references:
   mitre_atlas:
-    - AML.T0053 - AI Agent Tool Invocation
+    - AML.T0110 - AI Agent Tool Poisoning
   owasp_llm:
     - LLM06:2025
   owasp_agentic:
     - ASI02:2026
-    - ASI06:2026
+    - ASI04:2026
 metadata_provenance:
   mitre_atlas: auto-generated
 compliance:

package/rules/tool-poisoning/ATR-2026-00270-xss-in-tool-response.yaml

@@ -12,11 +12,12 @@ maturity: test
 severity: high
 references:
   owasp_llm:
-    - LLM02:2025
+    - LLM05:2025
   owasp_agentic:
-    - ASI08:2026
+    - ASI05:2026
   mitre_atlas:
-    - AML.T0057 - LLM Data Leakage
+    - AML.T0077 - LLM Response Rendering
+    - AML.T0050 - Command and Scripting Interpreter
   research:
     - https://github.com/NVIDIA/garak/tree/main/garak/data/xss
     - https://portswigger.net/web-security/cross-site-scripting

package/rules/tool-poisoning/ATR-2026-00494-garak-exploitation-mixedunassigned.yaml

@@ -12,15 +12,17 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
+    - LLM05:2025
     - LLM06:2025
   owasp_agentic:
-    - ASI06:2026
+    - ASI02:2026
+    - ASI05:2026
   mitre_atlas:
     - AML.T0053 - AI Agent Tool Invocation
 compliance:
   owasp_agentic:
-    - id: ASI06:2026
-      context: Tool poisoning exploits the agent's tool execution capability, inducing the agent to invoke tools with attacker-controlled parameters -- the canonical ASI06:2026 Tool Misuse vector.
+    - id: ASI02:2026
+      context: The patterns match SQL injection payloads (UNION SELECT, blind SLEEP or WAITFOR, INSERT INTO, DROP TABLE, OR 1=1, xp_cmdshell, shutdown) and a Python lambda reverse shell in user input. ASI02:2026 lists unvalidated input forwarding, where an agent passes untrusted model output to a shell or misuses a database tool to delete data, as tool misuse; the reverse shell and xp_cmdshell payloads fall under ASI05:2026, also in this rule's references.
       strength: primary
   owasp_llm:
     - id: LLM06:2025

package/rules/tool-poisoning/ATR-2026-00513-package-hallucination-exploitation.yaml

@@ -12,19 +12,21 @@ maturity: stable
 severity: high
 references:
   owasp_llm:
-    - LLM06:2025
+    - LLM03:2025
+    - LLM09:2025
   owasp_agentic:
-    - ASI06:2026
+    - ASI04:2026
   mitre_atlas:
-    - AML.T0053 - AI Agent Tool Invocation
+    - AML.T0060 - Publish Hallucinated Entities
+    - AML.T0010.001 - AI Software
 compliance:
   owasp_agentic:
-    - id: ASI06:2026
-      context: Tool poisoning exploits the agent's tool execution capability, inducing the agent to invoke tools with attacker-controlled parameters -- the canonical ASI06:2026 Tool Misuse vector.
+    - id: ASI04:2026
+      context: 'The patterns match requests to install, use or import a package that credit it to an AI suggestion (the AI recommended it, ChatGPT mentioned it), or that name a hallucination-style package: a major AI or Python library name plus a suffix such as -ai-helper, -secure-wrapper, -utils-extras or -pro. ASI04:2026 covers third-party components an agent works with that may be malicious, including items served from registries; a hallucinated package name that an attacker has registered delivers such a component.'
       strength: primary
   owasp_llm:
-    - id: LLM06:2025
-      context: This rule detects LLM06:2025 Excessive Agency patterns where adversarial inputs exploit tool-calling capabilities to perform unauthorized actions beyond the agent's intended scope.
+    - id: LLM09:2025
+      context: The patterns match requests to install, use or import a package that credit it to an AI recommendation or that name a hallucination-style package. LLM09:2025 lists suggestion of non-existent code libraries as unsafe code generation, and its first attack scenario is attackers publishing malicious packages under commonly hallucinated names.
       strength: primary
   eu_ai_act:
     - article: '15'

package/rules/tool-poisoning/ATR-2026-00521-shell-command-injection-agent-tool-context.yaml

@@ -12,15 +12,17 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
+    - LLM05:2025
     - LLM06:2025
   owasp_agentic:
-    - ASI06:2026
+    - ASI05:2026
+    - ASI02:2026
   mitre_atlas:
     - AML.T0053 - AI Agent Tool Invocation
 compliance:
   owasp_agentic:
-    - id: ASI06:2026
-      context: Tool poisoning exploits the agent's tool execution capability, inducing the agent to invoke tools with attacker-controlled parameters -- the canonical ASI06:2026 Tool Misuse vector.
+    - id: ASI05:2026
+      context: 'The pattern matches shell chaining in user input: a semicolon or ''then'' followed by curl, wget, nc, bash, sh, python, powershell or cmd; && followed by curl or wget with $() substitution, bash or sh -c, or python -c; or a pipe into nc host port, bash or sh -c, or python -c. ASI05:2026 lists shell command invocation from reflected prompts and describes direct shell injection, where shell commands are embedded in a prompt disguised as legitimate instructions.'
       strength: primary
   owasp_llm:
     - id: LLM06:2025

package/rules/tool-poisoning/ATR-2026-00522-sql-injection-natural-language-agent-interface.yaml

@@ -12,15 +12,16 @@ maturity: test
 severity: high
 references:
   owasp_llm:
+    - LLM05:2025
     - LLM06:2025
   owasp_agentic:
-    - ASI06:2026
+    - ASI02:2026
   mitre_atlas:
     - AML.T0053 - AI Agent Tool Invocation
 compliance:
   owasp_agentic:
-    - id: ASI06:2026
-      context: Tool poisoning exploits the agent's tool execution capability, inducing the agent to invoke tools with attacker-controlled parameters -- the canonical ASI06:2026 Tool Misuse vector.
+    - id: ASI02:2026
+      context: The patterns match SQL injection sent through a natural-language-to-SQL agent (DROP, DELETE or TRUNCATE after a quote, UNION SELECT, UPDATE ... SET, OR 1=1 tautologies, xp_cmdshell, information_schema) and plain-language requests to remove query filters or ignore access restrictions. ASI02:2026 covers an agent misusing a legitimate database tool, such as forwarding unvalidated input that deletes data or using over-scoped access to read records the task does not need.
       strength: primary
   owasp_llm:
     - id: LLM06:2025

package/rules/tool-poisoning/ATR-2026-00526-claude-code-shell-metachar-in-double-quoted-path.yaml

@@ -12,16 +12,17 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
+    - LLM05:2025
     - LLM06:2025
   owasp_agentic:
-    - ASI06:2026
+    - ASI05:2026
   mitre_atlas:
     - AML.T0053 - AI Agent Tool Invocation
 compliance:
   owasp_agentic:
-    - id: ASI06:2026
+    - id: ASI05:2026
       context: |
-        Path-argument command substitution exploits the agent's shell tool execution capability — the canonical ASI06:2026 Tool Misuse vector when the agent is allowed to construct file path inputs.
+        The pattern matches path-shaped key/value arguments in the input (file_path, filename, path, source, target, destination and similar keys) whose quoted value holds $(...) or backtick command substitution, the shell injection behind CVE-2026-35020, 35021 and 35022. ASI05:2026 covers agent tool access escalated into code execution on the host; the substitution runs attacker commands if the path reaches a shell.
       strength: primary
   owasp_llm:
     - id: LLM06:2025

package/rules/tool-poisoning/ATR-2026-00530-ms-agent-shell-tool-unsanitized-argv-rce.yaml

@@ -12,16 +12,17 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
+    - LLM05:2025
     - LLM06:2025
   owasp_agentic:
-    - ASI06:2026
+    - ASI05:2026
   mitre_atlas:
     - AML.T0053 - AI Agent Tool Invocation
 compliance:
   owasp_agentic:
-    - id: ASI06:2026
+    - id: ASI05:2026
       context: |
-        ASI06:2026 Tool Misuse — the agent's shell tool accepts unsanitized input as a direct exploit primitive. Detection on the unsafe invocation pattern blocks the class.
+        The patterns match shell-tool wrapper code (ShellTool, BashTool, run_shell, @tool('shell') and similar) that calls subprocess with shell=True, os.system, os.popen, child_process.exec or new Function, or exec or eval on an input variable, and shell tool calls whose argument chains extra commands (CVE-2026-2256). ASI05:2026 lists shell command invocation from reflected prompts and unsafe function calls or code evaluation as unexpected code execution.
       strength: primary
   owasp_llm:
     - id: LLM06:2025

package/rules/tool-poisoning/ATR-2026-00531-praisonai-unauthenticated-agent-api.yaml

@@ -13,10 +13,9 @@ severity: critical
 references:
   owasp_llm:
     - LLM06:2025
-    - LLM05:2025
   owasp_agentic:
+    - ASI03:2026
     - ASI05:2026
-    - ASI06:2026
   mitre_atlas:
     - AML.T0049 - Exploit Public-Facing Application
     - AML.T0040 - AI Model Inference API Access

package/rules/tool-poisoning/ATR-2026-00533-apache-pinot-mcp-unauthenticated-takeover.yaml

@@ -13,10 +13,9 @@ severity: critical
 references:
   owasp_llm:
     - LLM06:2025
-    - LLM05:2025
   owasp_agentic:
-    - ASI05:2026
-    - ASI06:2026
+    - ASI03:2026
+    - ASI02:2026
   mitre_atlas:
     - AML.T0049 - Exploit Public-Facing Application
   mitre_attack: