agent-threat-rules 4.2.1 → 4.2.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (171) hide show
  1. package/CHANGELOG.md +166 -0
  2. package/dist/converters/elastic.d.ts.map +1 -1
  3. package/dist/converters/elastic.js +7 -1
  4. package/dist/converters/elastic.js.map +1 -1
  5. package/dist/converters/generic-regex.d.ts +5 -1
  6. package/dist/converters/generic-regex.d.ts.map +1 -1
  7. package/dist/converters/generic-regex.js +12 -11
  8. package/dist/converters/generic-regex.js.map +1 -1
  9. package/dist/converters/sage-reverse.d.ts +1 -1
  10. package/dist/converters/sage-reverse.d.ts.map +1 -1
  11. package/dist/converters/sage-reverse.js +13 -8
  12. package/dist/converters/sage-reverse.js.map +1 -1
  13. package/dist/converters/sage.d.ts +8 -8
  14. package/dist/converters/sage.d.ts.map +1 -1
  15. package/dist/converters/sage.js +107 -74
  16. package/dist/converters/sage.js.map +1 -1
  17. package/dist/converters/splunk.d.ts.map +1 -1
  18. package/dist/converters/splunk.js +17 -3
  19. package/dist/converters/splunk.js.map +1 -1
  20. package/dist/engine.d.ts +2 -48
  21. package/dist/engine.d.ts.map +1 -1
  22. package/dist/engine.js +3 -54
  23. package/dist/engine.js.map +1 -1
  24. package/dist/regex-dialect.d.ts +67 -0
  25. package/dist/regex-dialect.d.ts.map +1 -0
  26. package/dist/regex-dialect.js +77 -0
  27. package/dist/regex-dialect.js.map +1 -0
  28. package/package.json +1 -1
  29. package/rules/agent-manipulation/ATR-2026-00074-cross-agent-privilege-escalation.yaml +0 -1
  30. package/rules/agent-manipulation/ATR-2026-00430-nl-trust-escalation-impersonation.yaml +3 -0
  31. package/rules/agent-manipulation/ATR-2026-00552-goal-drift-after-pressure-injection.yaml +3 -3
  32. package/rules/context-exfiltration/ATR-2026-00102-disguised-analytics-exfiltration.yaml +3 -2
  33. package/rules/context-exfiltration/ATR-2026-00136-tool-response-data-piggyback.yaml +5 -3
  34. package/rules/context-exfiltration/ATR-2026-00142-piggyback-transition-words.yaml +4 -2
  35. package/rules/context-exfiltration/ATR-2026-00150-credential-in-tool-response.yaml +3 -2
  36. package/rules/context-exfiltration/ATR-2026-00152-obfuscated-credential-leak.yaml +3 -2
  37. package/rules/context-exfiltration/ATR-2026-00162-skill-credential-exfil-combo.yaml +6 -2
  38. package/rules/context-exfiltration/ATR-2026-00201-credential-pipe-exfiltration.yaml +5 -2
  39. package/rules/context-exfiltration/ATR-2026-00290-divergence-repeat-word-training-extraction.yaml +0 -4
  40. package/rules/context-exfiltration/ATR-2026-00449-spring-ai-chatmemory-cross-user-leak.yaml +2 -3
  41. package/rules/context-exfiltration/ATR-2026-00516-output-xss-via-llm.yaml +9 -8
  42. package/rules/context-exfiltration/ATR-2026-00569-agent-mcp-path-traversal-arbitrary-file-access.yaml +3 -1
  43. package/rules/context-exfiltration/ATR-2026-00571-xss-in-agent-mcp-rendered-output.yaml +4 -3
  44. package/rules/context-exfiltration/ATR-2026-00702-ipi-credential-exfil-via-agent-action.yaml +5 -3
  45. package/rules/context-exfiltration/ATR-2026-00703-ipi-financial-data-exfil-indirect.yaml +5 -3
  46. package/rules/context-exfiltration/ATR-2026-00704-ipi-medical-genetic-data-exfil.yaml +5 -3
  47. package/rules/context-exfiltration/ATR-2026-00705-ipi-location-address-browsing-exfil.yaml +5 -3
  48. package/rules/context-exfiltration/ATR-2026-00706-ipi-physical-biometric-exfil.yaml +5 -3
  49. package/rules/context-exfiltration/ATR-2026-00707-ipi-file-exfil-with-destroy-or-tamper.yaml +6 -3
  50. package/rules/context-exfiltration/ATR-2026-00860-indirect-pi-financial-transfer-hijack.yaml +1 -1
  51. package/rules/context-exfiltration/ATR-2026-00861-indirect-pi-crypto-transfer-hijack.yaml +1 -1
  52. package/rules/context-exfiltration/ATR-2026-01605-ssrf-aws-metadata-endpoint.yaml +5 -1
  53. package/rules/context-exfiltration/ATR-2026-01606-ssrf-internal-network-scan.yaml +4 -1
  54. package/rules/context-exfiltration/ATR-2026-01607-ssrf-localhost-service-probe.yaml +4 -1
  55. package/rules/context-exfiltration/ATR-2026-01924-system-instruction-extraction-reformat.yaml +1 -4
  56. package/rules/context-exfiltration/ATR-2026-01948-netlicensing-mcp-product-number-path-traversal-token-leak.yaml +4 -2
  57. package/rules/context-exfiltration/ATR-2026-01957-m365-copilot-searchleak-open-redirect-exfil.yaml +6 -2
  58. package/rules/context-exfiltration/ATR-2026-01961-meta-ads-mcp-unauth-token-leak.yaml +4 -1
  59. package/rules/context-exfiltration/ATR-2026-01964-langchain-gmailtoolkit-indirect-prompt-injection-email-exfil.yaml +6 -2
  60. package/rules/context-exfiltration/ATR-2026-02140-ssrf-ipv6-hex-encoded-cloud-metadata-bypass.yaml +1 -1
  61. package/rules/context-exfiltration/ATR-2026-02304-preapproved-domain-encoded-path-exfil.yaml +1 -1
  62. package/rules/context-exfiltration/ATR-2026-02351-wildcard-dns-ssrf-hostname-ip-encoding-bypass.yaml +1 -1
  63. package/rules/data-poisoning/ATR-2026-00070-data-poisoning.yaml +1 -1
  64. package/rules/excessive-autonomy/ATR-2026-00491-garak-agent-breaker-markdown-just-raw-json.yaml +8 -8
  65. package/rules/excessive-autonomy/ATR-2026-00500-ssrf-via-agent-url-fetch-instruction.yaml +5 -3
  66. package/rules/excessive-autonomy/ATR-2026-00708-ipi-financial-transfer-unauthorized.yaml +4 -3
  67. package/rules/excessive-autonomy/ATR-2026-00711-ipi-system-sabotage-destructive-command.yaml +4 -3
  68. package/rules/excessive-autonomy/ATR-2026-00712-ipi-malicious-package-install.yaml +5 -3
  69. package/rules/excessive-autonomy/ATR-2026-00718-tool-misuse-financial-autonomous.yaml +8 -7
  70. package/rules/excessive-autonomy/ATR-2026-00719-tool-misuse-destructive-bulk-action.yaml +3 -3
  71. package/rules/excessive-autonomy/ATR-2026-01773-semantic-excessive-agency-action.yaml +3 -3
  72. package/rules/excessive-autonomy/ATR-2026-01801-asb-autonomous-vehicle-sabotage.yaml +3 -3
  73. package/rules/excessive-autonomy/ATR-2026-01804-asb-covert-unlogged-action.yaml +3 -4
  74. package/rules/excessive-autonomy/ATR-2026-01805-asb-financial-fraud-execution.yaml +3 -3
  75. package/rules/excessive-autonomy/ATR-2026-01806-asb-clinical-patient-harm.yaml +3 -3
  76. package/rules/excessive-autonomy/ATR-2026-01809-semantic-insider-manipulation-process-corruption.yaml +2 -3
  77. package/rules/excessive-autonomy/ATR-2026-01989-t1046-agent-internal-network-sweep.yaml +2 -2
  78. package/rules/excessive-autonomy/ATR-2026-01993-t1562-agent-impair-defenses.yaml +2 -2
  79. package/rules/excessive-autonomy/ATR-2026-02667-preapproved-tool-list-in-job-payload.yaml +0 -1
  80. package/rules/model-abuse/ATR-2026-00292-self-harm-eating-disorder-facilitation.yaml +3 -3
  81. package/rules/model-abuse/ATR-2026-00502-training-data-extraction-via-divergent-repetition-attack.yaml +2 -0
  82. package/rules/privilege-escalation/ATR-2026-00107-delayed-execution-bypass.yaml +2 -2
  83. package/rules/privilege-escalation/ATR-2026-00143-casual-privilege-escalation.yaml +3 -2
  84. package/rules/privilege-escalation/ATR-2026-00144-rationalized-safety-bypass.yaml +3 -2
  85. package/rules/privilege-escalation/ATR-2026-00204-stealth-execution-persistence.yaml +1 -1
  86. package/rules/privilege-escalation/ATR-2026-00441-semantic-kernel-sessions-python-plugin-startup-persistence.yaml +2 -1
  87. package/rules/privilege-escalation/ATR-2026-00546-crewai-json-loader-local-file-read.yaml +3 -1
  88. package/rules/privilege-escalation/ATR-2026-00549-destructive-tool-without-human-approval.yaml +2 -2
  89. package/rules/privilege-escalation/ATR-2026-01601-sql-injection-destructive-ddl.yaml +6 -5
  90. package/rules/privilege-escalation/ATR-2026-01602-sql-injection-union-select-exfil.yaml +3 -1
  91. package/rules/privilege-escalation/ATR-2026-01603-sql-injection-stacked-dml-abuse.yaml +3 -2
  92. package/rules/privilege-escalation/ATR-2026-01604-sql-injection-schema-enumeration.yaml +3 -2
  93. package/rules/privilege-escalation/ATR-2026-01616-path-traversal-agent-file-access.yaml +4 -1
  94. package/rules/privilege-escalation/ATR-2026-01802-asb-backdoor-surveillance-implant.yaml +4 -3
  95. package/rules/privilege-escalation/ATR-2026-01803-asb-covert-server-intrusion.yaml +4 -4
  96. package/rules/privilege-escalation/ATR-2026-01808-asb-synthetic-pan-payment-probe.yaml +3 -3
  97. package/rules/privilege-escalation/ATR-2026-01949-praisonai-mcpserver-unauth-tools-call.yaml +1 -1
  98. package/rules/privilege-escalation/ATR-2026-01974-anything-llm-data-import-access-control.yaml +1 -1
  99. package/rules/privilege-escalation/ATR-2026-01992-t1556-agent-auth-process-tamper.yaml +1 -1
  100. package/rules/privilege-escalation/ATR-2026-02040-file-edit-tool-persistence-write.yaml +1 -1
  101. package/rules/privilege-escalation/ATR-2026-02100-cypher-destructive-admin-query-injection.yaml +4 -4
  102. package/rules/privilege-escalation/ATR-2026-02101-dynamic-dunder-attribute-sandbox-escape.yaml +1 -1
  103. package/rules/privilege-escalation/ATR-2026-02142-download-tool-absolute-path-sandbox-escape.yaml +1 -1
  104. package/rules/privilege-escalation/ATR-2026-02146-export-tool-dest-dir-credential-directory-redirect.yaml +1 -1
  105. package/rules/privilege-escalation/ATR-2026-02195-dangerous-env-var-injection-config-tool.yaml +1 -1
  106. package/rules/privilege-escalation/ATR-2026-02300-mcp-stdio-config-dangerous-env-var.yaml +5 -5
  107. package/rules/privilege-escalation/ATR-2026-02301-symlink-outside-workspace-sensitive-target.yaml +1 -1
  108. package/rules/privilege-escalation/ATR-2026-02302-git-worktree-dotgit-sandbox-escape.yaml +1 -1
  109. package/rules/privilege-escalation/ATR-2026-02402-mcp-policy-engine-fail-open.yaml +0 -1
  110. package/rules/prompt-injection/ATR-2026-00154-unauthorized-background-task-execution-v.yaml +5 -3
  111. package/rules/prompt-injection/ATR-2026-00156-ssh-remote-command-execution-with-creden.yaml +6 -3
  112. package/rules/prompt-injection/ATR-2026-00407-echo-sql-jinja-template-injection.yaml +3 -3
  113. package/rules/prompt-injection/ATR-2026-00410-lmrc-harm-category-direct-elicitation.yaml +2 -2
  114. package/rules/prompt-injection/ATR-2026-00442-quoted-exact-output-forcing.yaml +2 -2
  115. package/rules/prompt-injection/ATR-2026-00512-rules-file-backdoor-injection.yaml +3 -0
  116. package/rules/prompt-injection/ATR-2026-00554-langchain-vulnerable-to-template-injecti.yaml +3 -3
  117. package/rules/prompt-injection/ATR-2026-01800-asb-trigger-marker-tool-coercion.yaml +3 -3
  118. package/rules/prompt-injection/ATR-2026-02009-bare-key-elicitation-trailing-colon.yaml +3 -2
  119. package/rules/prompt-injection/ATR-2026-02820-tool-result-orders-agent-to-hide-its-own-action.yaml +3 -3
  120. package/rules/skill-compromise/ATR-2026-00127-subcommand-overflow.yaml +2 -1
  121. package/rules/skill-compromise/ATR-2026-00157-timebomb-credential-exfil.yaml +6 -2
  122. package/rules/skill-compromise/ATR-2026-00200-agent-memory-config-tampering.yaml +1 -1
  123. package/rules/skill-compromise/ATR-2026-00217-credential-harvesting.yaml +4 -2
  124. package/rules/skill-compromise/ATR-2026-00222-credential-harvesting.yaml +6 -2
  125. package/rules/skill-compromise/ATR-2026-00224-credential-exfiltration.yaml +4 -2
  126. package/rules/skill-compromise/ATR-2026-00260-package-hallucination.yaml +3 -2
  127. package/rules/skill-compromise/ATR-2026-00266-malware-dropper-gen.yaml +4 -3
  128. package/rules/skill-compromise/ATR-2026-00398-huggingface-unsafe-model-artifact-load.yaml +3 -3
  129. package/rules/skill-compromise/ATR-2026-00429-nl-skill-self-modification.yaml +4 -2
  130. package/rules/skill-compromise/ATR-2026-00525-mini-shai-hulud-gh-token-monitor-persistence.yaml +1 -0
  131. package/rules/skill-compromise/ATR-2026-00527-skill-silent-git-remote-mirror-exfiltration.yaml +3 -2
  132. package/rules/skill-compromise/ATR-2026-01755-backdoor-pot-linguistic-trigger-phrase.yaml +1 -1
  133. package/rules/skill-compromise/ATR-2026-01756-backdoor-pot-symbol-emoticon-trigger.yaml +1 -1
  134. package/rules/tool-poisoning/ATR-2026-00096-registry-poisoning.yaml +4 -3
  135. package/rules/tool-poisoning/ATR-2026-00100-consent-bypass-instruction.yaml +4 -2
  136. package/rules/tool-poisoning/ATR-2026-00105-silent-action-concealment.yaml +2 -1
  137. package/rules/tool-poisoning/ATR-2026-00106-schema-description-contradiction.yaml +2 -2
  138. package/rules/tool-poisoning/ATR-2026-00270-xss-in-tool-response.yaml +4 -3
  139. package/rules/tool-poisoning/ATR-2026-00494-garak-exploitation-mixedunassigned.yaml +5 -3
  140. package/rules/tool-poisoning/ATR-2026-00513-package-hallucination-exploitation.yaml +9 -7
  141. package/rules/tool-poisoning/ATR-2026-00521-shell-command-injection-agent-tool-context.yaml +5 -3
  142. package/rules/tool-poisoning/ATR-2026-00522-sql-injection-natural-language-agent-interface.yaml +4 -3
  143. package/rules/tool-poisoning/ATR-2026-00526-claude-code-shell-metachar-in-double-quoted-path.yaml +4 -3
  144. package/rules/tool-poisoning/ATR-2026-00530-ms-agent-shell-tool-unsanitized-argv-rce.yaml +4 -3
  145. package/rules/tool-poisoning/ATR-2026-00531-praisonai-unauthenticated-agent-api.yaml +1 -2
  146. package/rules/tool-poisoning/ATR-2026-00533-apache-pinot-mcp-unauthenticated-takeover.yaml +2 -3
  147. package/rules/tool-poisoning/ATR-2026-00716-ipi-data-destruction-carrier.yaml +5 -3
  148. package/rules/tool-poisoning/ATR-2026-00720-tool-misuse-privilege-escalation-social.yaml +3 -3
  149. package/rules/tool-poisoning/ATR-2026-01301-tool-description-exclusive-tool-override.yaml +1 -1
  150. package/rules/tool-poisoning/ATR-2026-01303-tool-schema-enumeration-social-engineering.yaml +4 -3
  151. package/rules/tool-poisoning/ATR-2026-01307-mcp-dns-rebinding-attack.yaml +3 -5
  152. package/rules/tool-poisoning/ATR-2026-01310-mcp-tool-description-compliance-history-exfil.yaml +5 -4
  153. package/rules/tool-poisoning/ATR-2026-01775-semantic-mcp-tool-manifest-poisoning.yaml +1 -1
  154. package/rules/tool-poisoning/ATR-2026-01952-praisonai-codemode-sandbox-escape-rce.yaml +4 -2
  155. package/rules/tool-poisoning/ATR-2026-01953-praisonai-codemode-function-ctor-sandbox-escape.yaml +4 -2
  156. package/rules/tool-poisoning/ATR-2026-01959-openhuman-shell-allowlist-env-prefix-bypass.yaml +4 -2
  157. package/rules/tool-poisoning/ATR-2026-01963-praisonai-action-orchestrator-step-target-path-traversal-rce.yaml +3 -2
  158. package/rules/tool-poisoning/ATR-2026-01965-flowise-custommcp-os-command-rce.yaml +2 -1
  159. package/rules/tool-poisoning/ATR-2026-01967-deepchat-mermaid-xss-rce-ipc-mcp-register.yaml +4 -2
  160. package/rules/tool-poisoning/ATR-2026-01970-praisonai-filetools-normpath-path-traversal.yaml +2 -2
  161. package/rules/tool-poisoning/ATR-2026-01973-anythingllm-logo-endpoint-path-traversal.yaml +2 -2
  162. package/rules/tool-poisoning/ATR-2026-01978-anythingllm-collector-process-filename-path-traversal-delete.yaml +2 -2
  163. package/rules/tool-poisoning/ATR-2026-01979-pandasai-prompt-injection-dunder-sandbox-escape-rce.yaml +6 -2
  164. package/rules/tool-poisoning/ATR-2026-01980-agentic-flow-mcp-tool-param-command-injection.yaml +4 -2
  165. package/rules/tool-poisoning/ATR-2026-01982-dbt-mcp-node-selection-argument-injection.yaml +2 -2
  166. package/rules/tool-poisoning/ATR-2026-01983-mcp-for-stata-log-file-name-command-injection.yaml +4 -2
  167. package/rules/tool-poisoning/ATR-2026-01985-mcp-connect-bridge-unauth-process-spawn-rce.yaml +2 -1
  168. package/rules/tool-poisoning/ATR-2026-01987-langroid-sqlchatagent-prompt-to-sql-rce.yaml +4 -2
  169. package/rules/tool-poisoning/ATR-2026-02102-html-injection-tool-arg-approval-ui-xss.yaml +1 -1
  170. package/rules/tool-poisoning/ATR-2026-02141-mcp-server-config-command-execution.yaml +1 -1
  171. package/rules/tool-poisoning/ATR-2026-02233-unscoped-destructive-db-request-nl.yaml +1 -1
package/rules/tool-poisoning/ATR-2026-00716-ipi-data-destruction-carrier.yaml CHANGED
@@ -13,20 +13,22 @@ severity: high
13
13
  references:
14
14
  owasp_llm:
15
15
  - LLM01:2025
16
+ - LLM06:2025
16
17
  owasp_agentic:
17
18
  - ASI01:2026
18
- - ASI03:2026
19
+ - ASI02:2026
19
20
  mitre_atlas:
20
21
  - AML.T0051 - LLM Prompt Injection
21
22
  - AML.T0051.001 - Indirect
23
+ - AML.T0101 - Data Destruction via AI Agent Tool Invocation
22
24
  compliance:
23
25
  owasp_llm:
24
26
  - id: LLM01:2025
25
27
  context: Data destruction via indirect PI embeds file deletion instructions in consumed structured data.
26
28
  strength: primary
27
29
  owasp_agentic:
28
- - id: ASI03:2026
29
- context: Deleting user files or documents via agent file management tools is excessive agency with irreversible data loss.
30
+ - id: ASI01:2026
31
+ context: The patterns match content the agent reads that tells it to delete clinical or medical records tied to a diagnosis, delete all files from a cloud drive, health system, EHR or database, or delete a file by ID. ASI01:2026 covers manipulation of an agent's goals through deceptive tool outputs or poisoned external data, and lists indirect prompt injection that redirects an agent to exfiltrate sensitive data or misuse connected tools.
30
32
  strength: primary
31
33
  nist_ai_rmf:
32
34
  - subcategory: MS.2.7
package/rules/tool-poisoning/ATR-2026-00720-tool-misuse-privilege-escalation-social.yaml CHANGED
@@ -12,15 +12,15 @@ maturity: stable
12
12
  severity: medium
13
13
  references:
14
14
  owasp_llm:
15
- - LLM08:2025
15
+ - LLM06:2025
16
16
  owasp_agentic:
17
17
  - ASI03:2026
18
18
  mitre_atlas:
19
19
  - AML.T0051 - LLM Prompt Injection
20
20
  compliance:
21
21
  owasp_llm:
22
- - id: LLM08:2025
23
- context: 'Granting access control permissions via social engineering is LLM08 excessive agency: the agent''s access-grant capability is invoked through social justification.'
22
+ - id: LLM06:2025
23
+ context: The patterns match requests to invite a user, named by email address, to a Slack workspace and channel, give a delivery person, technician or contractor access to a house, door or smart lock, or add an outside technician or vendor to a workspace. LLM06:2025 covers damaging actions taken through an agent's extensions, including excessive autonomy, where an extension fails to independently verify and approve high-impact actions; granting an outside party access is such an action. The rule flags the request, not the agent's configuration.
24
24
  strength: primary
25
25
  owasp_agentic:
26
26
  - id: ASI03:2026
package/rules/tool-poisoning/ATR-2026-01301-tool-description-exclusive-tool-override.yaml CHANGED
@@ -13,7 +13,7 @@ severity: high
13
13
  references:
14
14
  owasp_llm:
15
15
  - LLM01:2025
16
- - LLM08:2025
16
+ - LLM06:2025
17
17
  owasp_agentic:
18
18
  - ASI03:2026
19
19
  - ASI01:2026
package/rules/tool-poisoning/ATR-2026-01303-tool-schema-enumeration-social-engineering.yaml CHANGED
@@ -13,13 +13,14 @@ severity: high
13
13
  references:
14
14
  owasp_llm:
15
15
  - LLM01:2025
16
- - LLM09:2025
16
+ - LLM07:2025
17
17
  owasp_agentic:
18
+ - ASI01:2026
18
19
  - ASI03:2026
19
- - ASI09:2026
20
20
  mitre_atlas:
21
- - AML.T0051 - LLM Prompt Injection
21
+ - AML.T0084.001 - Tool Definitions
22
22
  - AML.T0069 - Discover LLM System Information
23
+ - AML.T0051 - LLM Prompt Injection
23
24
  compliance:
24
25
  nist_ai_rmf:
25
26
  - subcategory: MS.2.7
package/rules/tool-poisoning/ATR-2026-01307-mcp-dns-rebinding-attack.yaml CHANGED
@@ -12,13 +12,11 @@ maturity: stable
12
12
  severity: critical
13
13
  references:
14
14
  owasp_llm:
15
- - LLM01:2025
16
- - LLM02:2025
15
+ - LLM05:2025
17
16
  owasp_agentic:
18
- - ASI09:2026
19
- - ASI04:2026
17
+ - ASI02:2026
20
18
  mitre_atlas:
21
- - AML.T0051.001 - Indirect
19
+ - AML.T0078 - Drive-by Compromise
22
20
  cve:
23
21
  - DNS rebinding attack class — SSRF via DNS temporal binding
24
22
  compliance:
package/rules/tool-poisoning/ATR-2026-01310-mcp-tool-description-compliance-history-exfil.yaml CHANGED
@@ -13,13 +13,14 @@ severity: critical
13
13
  references:
14
14
  owasp_llm:
15
15
  - LLM01:2025
16
- - LLM06:2025
16
+ - LLM02:2025
17
17
  owasp_agentic:
18
- - ASI03:2026
19
- - ASI08:2026
18
+ - ASI02:2026
19
+ - ASI04:2026
20
20
  mitre_atlas:
21
+ - AML.T0086 - Exfiltration via AI Agent Tool Invocation
22
+ - AML.T0110 - AI Agent Tool Poisoning
21
23
  - AML.T0051.001 - Indirect
22
- - AML.T0053 - AI Agent Tool Invocation
23
24
  compliance:
24
25
  nist_ai_rmf:
25
26
  - subcategory: MS.2.7
package/rules/tool-poisoning/ATR-2026-01775-semantic-mcp-tool-manifest-poisoning.yaml CHANGED
@@ -28,7 +28,7 @@ references:
28
28
  owasp_llm:
29
29
  - LLM03:2025
30
30
  - LLM01:2025
31
- - LLM08:2025
31
+ - LLM06:2025
32
32
  owasp_agentic:
33
33
  - ASI03:2026
34
34
  - ASI02:2026
package/rules/tool-poisoning/ATR-2026-01952-praisonai-codemode-sandbox-escape-rce.yaml CHANGED
@@ -12,11 +12,13 @@ maturity: test
12
12
  severity: critical
13
13
  references:
14
14
  owasp_llm:
15
+ - LLM05:2025
15
16
  - LLM06:2025
16
17
  owasp_agentic:
17
- - ASI06:2026
18
+ - ASI05:2026
18
19
  mitre_atlas:
19
- - AML.T0049 - Exploit Public-Facing Application
20
+ - AML.T0050 - Command and Scripting Interpreter
21
+ - AML.T0105 - Escape to Host
20
22
  mitre_attack:
21
23
  - T1190 - Exploit Public-Facing Application
22
24
  cve:
package/rules/tool-poisoning/ATR-2026-01953-praisonai-codemode-function-ctor-sandbox-escape.yaml CHANGED
@@ -12,11 +12,13 @@ maturity: test
12
12
  severity: critical
13
13
  references:
14
14
  owasp_llm:
15
+ - LLM05:2025
15
16
  - LLM06:2025
16
17
  owasp_agentic:
17
- - ASI06:2026
18
+ - ASI05:2026
18
19
  mitre_atlas:
19
- - AML.T0049 - Exploit Public-Facing Application
20
+ - AML.T0050 - Command and Scripting Interpreter
21
+ - AML.T0105 - Escape to Host
20
22
  mitre_attack:
21
23
  - T1190 - Exploit Public-Facing Application
22
24
  cve:
package/rules/tool-poisoning/ATR-2026-01959-openhuman-shell-allowlist-env-prefix-bypass.yaml CHANGED
@@ -14,9 +14,11 @@ references:
14
14
  owasp_llm:
15
15
  - LLM06:2025
16
16
  owasp_agentic:
17
- - ASI06:2026
17
+ - ASI05:2026
18
+ - ASI02:2026
18
19
  mitre_atlas:
19
- - AML.T0049 - Exploit Public-Facing Application
20
+ - AML.T0050 - Command and Scripting Interpreter
21
+ - AML.T0053 - AI Agent Tool Invocation
20
22
  mitre_attack:
21
23
  - T1190 - Exploit Public-Facing Application
22
24
  cve:
package/rules/tool-poisoning/ATR-2026-01963-praisonai-action-orchestrator-step-target-path-traversal-rce.yaml CHANGED
@@ -14,9 +14,10 @@ references:
14
14
  owasp_llm:
15
15
  - LLM06:2025
16
16
  owasp_agentic:
17
- - ASI06:2026
17
+ - ASI05:2026
18
+ - ASI02:2026
18
19
  mitre_atlas:
19
- - AML.T0049 - Exploit Public-Facing Application
20
+ - AML.T0053 - AI Agent Tool Invocation
20
21
  mitre_attack:
21
22
  - T1190 - Exploit Public-Facing Application
22
23
  cve:
package/rules/tool-poisoning/ATR-2026-01965-flowise-custommcp-os-command-rce.yaml CHANGED
@@ -14,9 +14,10 @@ references:
14
14
  owasp_llm:
15
15
  - LLM06:2025
16
16
  owasp_agentic:
17
- - ASI06:2026
17
+ - ASI05:2026
18
18
  mitre_atlas:
19
19
  - AML.T0049 - Exploit Public-Facing Application
20
+ - AML.T0050 - Command and Scripting Interpreter
20
21
  mitre_attack:
21
22
  - T1190 - Exploit Public-Facing Application
22
23
  cve:
package/rules/tool-poisoning/ATR-2026-01967-deepchat-mermaid-xss-rce-ipc-mcp-register.yaml CHANGED
@@ -12,11 +12,13 @@ maturity: test
12
12
  severity: critical
13
13
  references:
14
14
  owasp_llm:
15
+ - LLM05:2025
15
16
  - LLM06:2025
16
17
  owasp_agentic:
17
- - ASI06:2026
18
+ - ASI05:2026
18
19
  mitre_atlas:
19
- - AML.T0049 - Exploit Public-Facing Application
20
+ - AML.T0050 - Command and Scripting Interpreter
21
+ - AML.T0112 - Machine Compromise
20
22
  mitre_attack:
21
23
  - T1190 - Exploit Public-Facing Application
22
24
  cve:
package/rules/tool-poisoning/ATR-2026-01970-praisonai-filetools-normpath-path-traversal.yaml CHANGED
@@ -14,9 +14,9 @@ references:
14
14
  owasp_llm:
15
15
  - LLM06:2025
16
16
  owasp_agentic:
17
- - ASI06:2026
17
+ - ASI02:2026
18
18
  mitre_atlas:
19
- - AML.T0049 - Exploit Public-Facing Application
19
+ - AML.T0053 - AI Agent Tool Invocation
20
20
  mitre_attack:
21
21
  - T1190 - Exploit Public-Facing Application
22
22
  cve:
package/rules/tool-poisoning/ATR-2026-01973-anythingllm-logo-endpoint-path-traversal.yaml CHANGED
@@ -12,9 +12,9 @@ maturity: test
12
12
  severity: critical
13
13
  references:
14
14
  owasp_llm:
15
- - LLM06:2025
15
+ - LLM03:2025
16
16
  owasp_agentic:
17
- - ASI06:2026
17
+ - ASI04:2026
18
18
  mitre_atlas:
19
19
  - AML.T0049 - Exploit Public-Facing Application
20
20
  mitre_attack:
package/rules/tool-poisoning/ATR-2026-01978-anythingllm-collector-process-filename-path-traversal-delete.yaml CHANGED
@@ -12,9 +12,9 @@ maturity: test
12
12
  severity: critical
13
13
  references:
14
14
  owasp_llm:
15
- - LLM06:2025
15
+ - LLM03:2025
16
16
  owasp_agentic:
17
- - ASI06:2026
17
+ - ASI04:2026
18
18
  mitre_atlas:
19
19
  - AML.T0049 - Exploit Public-Facing Application
20
20
  mitre_attack:
package/rules/tool-poisoning/ATR-2026-01979-pandasai-prompt-injection-dunder-sandbox-escape-rce.yaml CHANGED
@@ -12,11 +12,15 @@ maturity: test
12
12
  severity: critical
13
13
  references:
14
14
  owasp_llm:
15
+ - LLM05:2025
16
+ - LLM01:2025
15
17
  - LLM06:2025
16
18
  owasp_agentic:
17
- - ASI06:2026
19
+ - ASI05:2026
18
20
  mitre_atlas:
19
- - AML.T0049 - Exploit Public-Facing Application
21
+ - AML.T0050 - Command and Scripting Interpreter
22
+ - AML.T0105 - Escape to Host
23
+ - AML.T0051.000 - Direct
20
24
  mitre_attack:
21
25
  - T1190 - Exploit Public-Facing Application
22
26
  cve:
package/rules/tool-poisoning/ATR-2026-01980-agentic-flow-mcp-tool-param-command-injection.yaml CHANGED
@@ -22,9 +22,11 @@ references:
22
22
  owasp_llm:
23
23
  - LLM06:2025
24
24
  owasp_agentic:
25
- - ASI06:2026
25
+ - ASI05:2026
26
+ - ASI02:2026
26
27
  mitre_atlas:
27
- - AML.T0053 - LLM Plugin Compromise
28
+ - AML.T0053 - AI Agent Tool Invocation
29
+ - AML.T0050 - Command and Scripting Interpreter
28
30
  mitre_attack:
29
31
  - T1059 - Command and Scripting Interpreter
30
32
  ghsa:
package/rules/tool-poisoning/ATR-2026-01982-dbt-mcp-node-selection-argument-injection.yaml CHANGED
@@ -21,9 +21,9 @@ references:
21
21
  owasp_llm:
22
22
  - LLM06:2025
23
23
  owasp_agentic:
24
- - ASI06:2026
24
+ - ASI02:2026
25
25
  mitre_atlas:
26
- - AML.T0053 - LLM Plugin Compromise
26
+ - AML.T0053 - AI Agent Tool Invocation
27
27
  mitre_attack:
28
28
  - T1059 - Command and Scripting Interpreter
29
29
  cve:
package/rules/tool-poisoning/ATR-2026-01983-mcp-for-stata-log-file-name-command-injection.yaml CHANGED
@@ -20,9 +20,11 @@ references:
20
20
  owasp_llm:
21
21
  - LLM06:2025
22
22
  owasp_agentic:
23
- - ASI06:2026
23
+ - ASI05:2026
24
+ - ASI02:2026
24
25
  mitre_atlas:
25
- - AML.T0053 - LLM Plugin Compromise
26
+ - AML.T0053 - AI Agent Tool Invocation
27
+ - AML.T0050 - Command and Scripting Interpreter
26
28
  mitre_attack:
27
29
  - T1059 - Command and Scripting Interpreter
28
30
  cve:
package/rules/tool-poisoning/ATR-2026-01985-mcp-connect-bridge-unauth-process-spawn-rce.yaml CHANGED
@@ -23,9 +23,10 @@ references:
23
23
  owasp_llm:
24
24
  - LLM06:2025
25
25
  owasp_agentic:
26
- - ASI06:2026
26
+ - ASI05:2026
27
27
  mitre_atlas:
28
28
  - AML.T0049 - Exploit Public-Facing Application
29
+ - AML.T0050 - Command and Scripting Interpreter
29
30
  mitre_attack:
30
31
  - T1059 - Command and Scripting Interpreter
31
32
  cve:
package/rules/tool-poisoning/ATR-2026-01987-langroid-sqlchatagent-prompt-to-sql-rce.yaml CHANGED
@@ -16,11 +16,13 @@ maturity: test
16
16
  severity: critical
17
17
  references:
18
18
  owasp_llm:
19
+ - LLM05:2025
19
20
  - LLM01:2025
20
21
  owasp_agentic:
21
- - ASI06:2026
22
+ - ASI05:2026
22
23
  mitre_atlas:
23
- - AML.T0053 - LLM Plugin Compromise
24
+ - AML.T0053 - AI Agent Tool Invocation
25
+ - AML.T0050 - Command and Scripting Interpreter
24
26
  mitre_attack:
25
27
  - T1059 - Command and Scripting Interpreter
26
28
  cve:
package/rules/tool-poisoning/ATR-2026-02102-html-injection-tool-arg-approval-ui-xss.yaml CHANGED
@@ -12,7 +12,7 @@ maturity: experimental
12
12
  severity: high
13
13
  references:
14
14
  owasp_llm:
15
- - LLM08:2025
15
+ - LLM05:2025
16
16
  owasp_agentic:
17
17
  - ASI02:2026
18
18
  mitre_attack:
package/rules/tool-poisoning/ATR-2026-02141-mcp-server-config-command-execution.yaml CHANGED
@@ -12,7 +12,7 @@ maturity: experimental
12
12
  severity: critical
13
13
  references:
14
14
  owasp_llm:
15
- - LLM08:2025
15
+ - LLM06:2025
16
16
  owasp_agentic:
17
17
  - ASI02:2026
18
18
  mitre_attack:
package/rules/tool-poisoning/ATR-2026-02233-unscoped-destructive-db-request-nl.yaml CHANGED
@@ -12,7 +12,7 @@ maturity: experimental
12
12
  severity: high
13
13
  references:
14
14
  owasp_llm:
15
- - LLM08:2025
15
+ - LLM06:2025
16
16
  owasp_agentic:
17
17
  - ASI02:2026
18
18
  mitre_attack: