agent-threat-rules 4.2.1 → 4.2.3

package/rules/context-exfiltration/ATR-2026-00449-spring-ai-chatmemory-cross-user-leak.yaml

@@ -15,10 +15,9 @@ references:
     - LLM02:2025
     - LLM08:2025
   owasp_agentic:
-    - ASI04:2026
-    - ASI09:2026
+    - ASI03:2026
+    - ASI06:2026
   mitre_atlas:
-    - AML.T0024 - Exfiltration via AI Inference API
     - AML.T0057 - LLM Data Leakage
   mitre_attack:
     - T1530 - Data from Cloud Storage Object

package/rules/context-exfiltration/ATR-2026-00516-output-xss-via-llm.yaml

@@ -12,19 +12,20 @@ maturity: test
 severity: high
 references:
   owasp_llm:
-    - LLM02:2025
+    - LLM05:2025
   owasp_agentic:
-    - ASI01:2026
+    - ASI05:2026
   mitre_atlas:
-    - AML.T0024 - Exfiltration via AI Inference API
+    - AML.T0077 - LLM Response Rendering
+    - AML.T0050 - Command and Scripting Interpreter
 compliance:
   owasp_agentic:
-    - id: ASI01:2026
-      context: Context exfiltration redirects the agent to expose internal state (system prompt, credentials, conversation history) to an unauthorized party -- a goal hijack variant targeting information disclosure.
-      strength: primary
+    - id: ASI05:2026
+      context: 'The patterns match prompts asking the model to emit a script tag, an on* event-handler attribute, a javascript: URI or a data:text/html URI whose script reads cookies, browser storage, page content or location, or calls fetch, eval or similar functions, and explicit requests for XSS payloads that steal cookies, tokens or credentials. ASI05:2026 builds on LLM05:2025 and covers model output that ends up executed as code; this code would run in the browser that renders the output, not on the agent host, so the fit is partial.'
+      strength: partial
   owasp_llm:
-    - id: LLM02:2025
-      context: This rule implements LLM02:2025 Sensitive Information Disclosure detection, identifying requests that attempt to extract confidential context, system prompts, or credentials from the agent.
+    - id: LLM05:2025
+      context: 'The patterns match the request side of an output-handling attack: prompts asking the model to emit a script tag, an on* event-handler attribute, or a javascript: / data:text/html URI whose script reads cookies, browser storage, page content or location, or calls fetch, eval or similar functions. LLM05:2025 lists JavaScript or Markdown generated by the LLM and interpreted by the browser, resulting in XSS.'
       strength: primary
   eu_ai_act:
     - article: '15'

package/rules/context-exfiltration/ATR-2026-00569-agent-mcp-path-traversal-arbitrary-file-access.yaml

@@ -30,9 +30,11 @@ references:
     - https://github.com/Advanced-Excel-MCP/excel-mcp-server
   owasp_llm:
     - LLM02:2025
+    - LLM05:2025
   owasp_agentic:
-    - ASI01:2026
+    - ASI02:2026
   mitre_atlas:
+    - AML.T0053 - AI Agent Tool Invocation
     - AML.T0057 - LLM Data Leakage
 metadata_provenance:
   cve: human-authored

package/rules/context-exfiltration/ATR-2026-00571-xss-in-agent-mcp-rendered-output.yaml

@@ -20,11 +20,12 @@ references:
   external:
     - https://github.com/jlowin/fastmcp/security/advisories
   owasp_llm:
-    - LLM02:2025
+    - LLM05:2025
   owasp_agentic:
-    - ASI01:2026
+    - ASI05:2026
   mitre_atlas:
-    - AML.T0057 - LLM Data Leakage
+    - AML.T0077 - LLM Response Rendering
+    - AML.T0050 - Command and Scripting Interpreter
 metadata_provenance:
   cve: human-authored
   cwe: human-authored

package/rules/context-exfiltration/ATR-2026-00702-ipi-credential-exfil-via-agent-action.yaml

@@ -13,13 +13,15 @@ severity: critical
 references:
   owasp_llm:
     - LLM01:2025
+    - LLM02:2025
     - LLM06:2025
   owasp_agentic:
     - ASI01:2026
-    - ASI07:2026
+    - ASI02:2026
   mitre_atlas:
     - AML.T0051 - LLM Prompt Injection
     - AML.T0051.001 - Indirect
+    - AML.T0086 - Exfiltration via AI Agent Tool Invocation
 compliance:
   owasp_llm:
     - id: LLM01:2025
@@ -29,8 +31,8 @@ compliance:
       context: The attack instructs the agent to disclose stored credentials or API keys to an attacker-controlled destination.
       strength: primary
   owasp_agentic:
-    - id: ASI07:2026
-      context: The agent is induced to exfiltrate sensitive data (credentials, API keys, passwords) to an external endpoint.
+    - id: ASI01:2026
+      context: The patterns match content the agent reads that tells it to get API keys, passwords or stored credentials and send, email, share or forward them to an outside email address or URL, or that states such an exfiltration objective. ASI01:2026 covers manipulation of an agent's goals through deceptive tool outputs or poisoned external data, and lists indirect prompt injection that redirects an agent to exfiltrate sensitive data or misuse connected tools.
       strength: primary
   nist_ai_rmf:
     - subcategory: MS.2.7

package/rules/context-exfiltration/ATR-2026-00703-ipi-financial-data-exfil-indirect.yaml

@@ -13,13 +13,15 @@ severity: critical
 references:
   owasp_llm:
     - LLM01:2025
+    - LLM02:2025
     - LLM06:2025
   owasp_agentic:
     - ASI01:2026
-    - ASI07:2026
+    - ASI02:2026
   mitre_atlas:
     - AML.T0051 - LLM Prompt Injection
     - AML.T0051.001 - Indirect
+    - AML.T0086 - Exfiltration via AI Agent Tool Invocation
 compliance:
   owasp_llm:
     - id: LLM01:2025
@@ -29,8 +31,8 @@ compliance:
       context: The agent is induced to disclose sensitive financial data (payment methods, bank accounts, card info) to an attacker.
       strength: primary
   owasp_agentic:
-    - id: ASI07:2026
-      context: Financial data exfiltration via agent-executed tool calls is the ASI07:2026 Data and Model Exfiltration pattern.
+    - id: ASI01:2026
+      context: The patterns match content the agent reads that tells it to retrieve saved payment methods, bank account or card details, or financial reports and email, send, share or forward them, or that states an objective of getting the user's bank, card or payment data. ASI01:2026 covers manipulation of an agent's goals through deceptive tool outputs or poisoned external data, and lists indirect prompt injection that redirects an agent to exfiltrate sensitive data or misuse connected tools.
       strength: primary
   nist_ai_rmf:
     - subcategory: MS.2.7

package/rules/context-exfiltration/ATR-2026-00704-ipi-medical-genetic-data-exfil.yaml

@@ -13,13 +13,15 @@ severity: critical
 references:
   owasp_llm:
     - LLM01:2025
+    - LLM02:2025
     - LLM06:2025
   owasp_agentic:
     - ASI01:2026
-    - ASI07:2026
+    - ASI02:2026
   mitre_atlas:
     - AML.T0051 - LLM Prompt Injection
     - AML.T0051.001 - Indirect
+    - AML.T0086 - Exfiltration via AI Agent Tool Invocation
 compliance:
   owasp_llm:
     - id: LLM01:2025
@@ -29,8 +31,8 @@ compliance:
       context: The agent is induced to disclose sensitive health and genetic information to an attacker-controlled destination.
       strength: primary
   owasp_agentic:
-    - id: ASI07:2026
-      context: Medical record and genetic data exfiltration via agent tool calls is the ASI07:2026 pattern applied to healthcare data.
+    - id: ASI01:2026
+      context: The patterns match content the agent reads that tells it to download health records, lab reports or 23andMe genetic data and email, send, share or forward them, or to delete all clinical documents tied to a diagnosis. ASI01:2026 covers manipulation of an agent's goals through deceptive tool outputs or poisoned external data, and lists indirect prompt injection that redirects an agent to exfiltrate sensitive data or misuse connected tools.
       strength: primary
   nist_ai_rmf:
     - subcategory: MS.2.7

package/rules/context-exfiltration/ATR-2026-00705-ipi-location-address-browsing-exfil.yaml

@@ -13,13 +13,15 @@ severity: high
 references:
   owasp_llm:
     - LLM01:2025
+    - LLM02:2025
     - LLM06:2025
   owasp_agentic:
     - ASI01:2026
-    - ASI07:2026
+    - ASI02:2026
   mitre_atlas:
     - AML.T0051 - LLM Prompt Injection
     - AML.T0051.001 - Indirect
+    - AML.T0086 - Exfiltration via AI Agent Tool Invocation
 compliance:
   owasp_llm:
     - id: LLM01:2025
@@ -29,8 +31,8 @@ compliance:
       context: The agent is induced to disclose personal location data, home/work addresses, or browsing history to an attacker.
       strength: primary
   owasp_agentic:
-    - id: ASI07:2026
-      context: Location and browsing data exfiltration via agent tool calls is the ASI07:2026 pattern applied to personal tracking data.
+    - id: ASI01:2026
+      context: The patterns match content the agent reads that tells it to get the user's current location from Maps, saved home or work addresses, or search and browsing history and email, send, share or forward them. ASI01:2026 covers manipulation of an agent's goals through deceptive tool outputs or poisoned external data, and lists indirect prompt injection that redirects an agent to exfiltrate sensitive data or misuse connected tools.
       strength: primary
   nist_ai_rmf:
     - subcategory: MS.2.7

package/rules/context-exfiltration/ATR-2026-00706-ipi-physical-biometric-exfil.yaml

@@ -13,13 +13,15 @@ severity: critical
 references:
   owasp_llm:
     - LLM01:2025
+    - LLM02:2025
     - LLM06:2025
   owasp_agentic:
     - ASI01:2026
-    - ASI07:2026
+    - ASI02:2026
   mitre_atlas:
     - AML.T0051 - LLM Prompt Injection
     - AML.T0051.001 - Indirect
+    - AML.T0086 - Exfiltration via AI Agent Tool Invocation
     - AML.T0088 - Generate Deepfakes
 compliance:
   owasp_llm:
@@ -30,8 +32,8 @@ compliance:
       context: The agent is induced to generate and exfiltrate deepfake audio or biometric media to an attacker-controlled destination.
       strength: primary
   owasp_agentic:
-    - id: ASI07:2026
-      context: Deepfake audio generation and exfil via agent tool calls is the ASI07:2026 pattern applied to biometric/physical media.
+    - id: ASI01:2026
+      context: The patterns match content the agent reads that tells it to generate a deepfake or voice clone from the user's recordings, process a recording, or fetch ID, passport or driver's license scans, and send the result out. ASI01:2026 covers manipulation of an agent's goals through deceptive tool outputs or poisoned external data, and lists indirect prompt injection that redirects an agent to exfiltrate sensitive data or misuse connected tools.
       strength: primary
   nist_ai_rmf:
     - subcategory: MS.2.7

package/rules/context-exfiltration/ATR-2026-00707-ipi-file-exfil-with-destroy-or-tamper.yaml

@@ -13,13 +13,16 @@ severity: critical
 references:
   owasp_llm:
     - LLM01:2025
+    - LLM02:2025
     - LLM06:2025
   owasp_agentic:
     - ASI01:2026
-    - ASI07:2026
+    - ASI02:2026
   mitre_atlas:
     - AML.T0051 - LLM Prompt Injection
     - AML.T0051.001 - Indirect
+    - AML.T0086 - Exfiltration via AI Agent Tool Invocation
+    - AML.T0101 - Data Destruction via AI Agent Tool Invocation
 compliance:
   owasp_llm:
     - id: LLM01:2025
@@ -29,8 +32,8 @@ compliance:
       context: The combined attack causes sensitive file disclosure followed by destruction or falsification of the source.
       strength: primary
   owasp_agentic:
-    - id: ASI07:2026
-      context: File exfiltration followed by deletion or tampering via agent tool calls is the ASI07:2026 pattern with additional data integrity impact.
+    - id: ASI01:2026
+      context: The patterns match content the agent reads that tells it to take a file from Google Drive, Dropbox, OneDrive or other cloud storage, or a configuration, credential, secret or backup file, and then delete, edit or tamper with the original. ASI01:2026 covers manipulation of an agent's goals through deceptive tool outputs or poisoned external data, and lists indirect prompt injection that redirects an agent to exfiltrate sensitive data or misuse connected tools.
       strength: primary
   nist_ai_rmf:
     - subcategory: MS.2.7

package/rules/context-exfiltration/ATR-2026-00860-indirect-pi-financial-transfer-hijack.yaml

@@ -16,7 +16,7 @@ references:
     - LLM06:2025
   owasp_agentic:
     - ASI01:2026
-    - ASI03:2026
+    - ASI02:2026
   mitre_atlas:
     - AML.T0051.001 - Indirect
   mitre_attack:

package/rules/context-exfiltration/ATR-2026-00861-indirect-pi-crypto-transfer-hijack.yaml

@@ -16,7 +16,7 @@ references:
     - LLM06:2025
   owasp_agentic:
     - ASI01:2026
-    - ASI03:2026
+    - ASI02:2026
   mitre_atlas:
     - AML.T0051.001 - Indirect
   mitre_attack:

package/rules/context-exfiltration/ATR-2026-01605-ssrf-aws-metadata-endpoint.yaml

@@ -19,10 +19,14 @@ severity: critical
 references:
   owasp_llm:
     - LLM02:2025
+    - LLM05:2025
   owasp_agentic:
     - ASI03:2026
+    - ASI02:2026
   mitre_atlas:
-    - AML.T0043 - Craft Adversarial Data
+    - AML.T0055 - Unsecured Credentials
+    - AML.T0049 - Exploit Public-Facing Application
+    - AML.T0053 - AI Agent Tool Invocation
   mitre_attack:
     - T1552.005 - Cloud Instance Metadata API
 compliance:

package/rules/context-exfiltration/ATR-2026-01606-ssrf-internal-network-scan.yaml

@@ -20,10 +20,13 @@ severity: high
 references:
   owasp_llm:
     - LLM02:2025
+    - LLM05:2025
   owasp_agentic:
+    - ASI02:2026
     - ASI03:2026
   mitre_atlas:
-    - AML.T0043 - Craft Adversarial Data
+    - AML.T0049 - Exploit Public-Facing Application
+    - AML.T0053 - AI Agent Tool Invocation
   mitre_attack:
     - T1090 - Proxy
 compliance:

package/rules/context-exfiltration/ATR-2026-01607-ssrf-localhost-service-probe.yaml

@@ -19,10 +19,13 @@ severity: critical
 references:
   owasp_llm:
     - LLM02:2025
+    - LLM05:2025
   owasp_agentic:
+    - ASI02:2026
     - ASI03:2026
   mitre_atlas:
-    - AML.T0043 - Craft Adversarial Data
+    - AML.T0049 - Exploit Public-Facing Application
+    - AML.T0053 - AI Agent Tool Invocation
   mitre_attack:
     - T1552.005 - Cloud Instance Metadata API
 compliance:

package/rules/context-exfiltration/ATR-2026-01924-system-instruction-extraction-reformat.yaml

@@ -15,18 +15,15 @@ references:
     - LLM07:2025
     - LLM01:2025
   owasp_agentic:
-    - ASI05:2026
     - ASI01:2026
   mitre_atlas:
+    - AML.T0056 - Extract LLM System Prompt
     - AML.T0051 - LLM Prompt Injection
     - AML.T0057 - LLM Data Leakage
   research:
     - https://github.com/HumanCompatibleAI/tensor-trust
 compliance:
   owasp_agentic:
-    - id: ASI05:2026
-      context: Reformat-based extraction of the agent's hidden instructions discloses sensitive system configuration, satisfying ASI05:2026 Sensitive Information Disclosure.
-      strength: primary
     - id: ASI01:2026
       context: Reciting the defense prompt as a 'summary' subverts the agent's confidentiality goal, a goal-hijack via laundered reformatting.
       strength: secondary

package/rules/context-exfiltration/ATR-2026-01948-netlicensing-mcp-product-number-path-traversal-token-leak.yaml

@@ -12,11 +12,13 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
-    - LLM06:2025
+    - LLM02:2025
+    - LLM05:2025
   owasp_agentic:
-    - ASI06:2026
+    - ASI02:2026
   mitre_atlas:
     - AML.T0049 - Exploit Public-Facing Application
+    - AML.T0098 - AI Agent Tool Credential Harvesting
   mitre_attack:
     - T1190 - Exploit Public-Facing Application
   cve:

package/rules/context-exfiltration/ATR-2026-01957-m365-copilot-searchleak-open-redirect-exfil.yaml

@@ -12,10 +12,14 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
-    - LLM06:2025
+    - LLM01:2025
+    - LLM02:2025
   owasp_agentic:
-    - ASI06:2026
+    - ASI01:2026
+    - ASI02:2026
   mitre_atlas:
+    - AML.T0051 - LLM Prompt Injection
+    - AML.T0077 - LLM Response Rendering
     - AML.T0049 - Exploit Public-Facing Application
   mitre_attack:
     - T1190 - Exploit Public-Facing Application

package/rules/context-exfiltration/ATR-2026-01961-meta-ads-mcp-unauth-token-leak.yaml

@@ -12,11 +12,14 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
+    - LLM02:2025
     - LLM06:2025
   owasp_agentic:
-    - ASI06:2026
+    - ASI03:2026
+    - ASI02:2026
   mitre_atlas:
     - AML.T0049 - Exploit Public-Facing Application
+    - AML.T0098 - AI Agent Tool Credential Harvesting
   mitre_attack:
     - T1190 - Exploit Public-Facing Application
   cve:

package/rules/context-exfiltration/ATR-2026-01964-langchain-gmailtoolkit-indirect-prompt-injection-email-exfil.yaml

@@ -12,11 +12,15 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
+    - LLM01:2025
+    - LLM02:2025
     - LLM06:2025
   owasp_agentic:
-    - ASI06:2026
+    - ASI01:2026
+    - ASI02:2026
   mitre_atlas:
-    - AML.T0049 - Exploit Public-Facing Application
+    - AML.T0051.001 - Indirect
+    - AML.T0086 - Exfiltration via AI Agent Tool Invocation
   mitre_attack:
     - T1190 - Exploit Public-Facing Application
   cve:

package/rules/context-exfiltration/ATR-2026-02140-ssrf-ipv6-hex-encoded-cloud-metadata-bypass.yaml

@@ -12,7 +12,7 @@ maturity: experimental
 severity: high
 references:
   owasp_llm:
-    - LLM08:2025
+    - LLM05:2025
   owasp_agentic:
     - ASI02:2026
   mitre_attack:

package/rules/context-exfiltration/ATR-2026-02304-preapproved-domain-encoded-path-exfil.yaml

@@ -75,7 +75,7 @@ detection:
       description: WebFetch-style URL to huggingface.co/hf.co whose path contains a base64-padded (trailing '=') encoded segment -- not a normal repo/file name shape
     - field: content
       operator: regex
-      value: (?i)(?<=\b(?:WebFetch|fetch(?:_url)?|curl|wget|GET|POST|download(?:ing)?|(?:send|issue|make)\s+(?:a\s+|an\s+)?(?:web)?fetch|request(?:ing)?)\b[\s\S]{0,30}?)\bhuggingface\.co\b[\s\S]{0,40}?\b(?:encode|base64|exfiltrat\w*|covert\s+channel|out-of-band\s+channel)\b
+      value: (?i)\b(?:WebFetch|fetch(?:_url)?|curl|wget|GET|POST|download(?:ing)?|(?:send|issue|make)\s+(?:a\s+|an\s+)?(?:web)?fetch|request(?:ing)?)\b[\s\S]{0,30}?\bhuggingface\.co\b[\s\S]{0,40}?\b(?:encode|base64|exfiltrat\w*|covert\s+channel|out-of-band\s+channel)\b
       description: Natural-language framing describing encoding/exfiltrating data via a huggingface.co request -- catches the instruction-level technique before a concrete URL is constructed. Requires an actual fetch/request-action cue (WebFetch, fetch, curl, download, 'issue a fetch', etc.) within 30 chars BEFORE the domain, and the encode/base64/exfiltrate trigger within a tightened 40 chars AFTER the domain, so ordinary prose merely co-mentioning huggingface.co and base64/encode in the same sentence (with no request framing) does not fire
   false_positives:
     - An ordinary WebFetch/download URL to a real HuggingFace model or dataset repository, e.g. https://huggingface.co/bert-base-uncased/resolve/main/config.json -- model/file names are short hyphenated slugs, not a 16+ character base64-padded blob

package/rules/context-exfiltration/ATR-2026-02351-wildcard-dns-ssrf-hostname-ip-encoding-bypass.yaml

@@ -15,7 +15,7 @@ references:
   cwe:
     - CWE-918
   owasp_llm:
-    - LLM08:2025
+    - LLM05:2025
   owasp_agentic:
     - ASI02:2026
   mitre_attack:

package/rules/data-poisoning/ATR-2026-00070-data-poisoning.yaml

@@ -42,7 +42,7 @@ compliance:
       context: Poisoned knowledge base entries injected into the supply chain of training or retrieval data satisfy the LLM03:2025 Supply Chain Vulnerabilities category at the data tier.
       strength: secondary
     - id: LLM08:2025
-      context: Malicious vector store entries that cause the agent to retrieve and act on attacker-controlled instructions fall under LLM08:2025 Excessive Agency triggered by contaminated retrieval context.
+      context: 'The patterns match hidden directives in tool output (the rule targets retrieved documents and knowledge-base entries): fake [SYSTEM] or <system> tags, ignore-previous-instructions overrides, retrieval-triggered phrases, BEGIN HIDDEN INSTRUCTIONS blocks, ''for internal use only'' sections, concealment and stealth-action directives, mode switches, role-play and append-to-every-response directives, injected chat turns, prompt-template delimiters and exfiltration commands with a target address. LLM08:2025, which covers systems using Retrieval Augmented Generation, lists data poisoning from insiders, prompts, data seeding or unverified data providers, leading to manipulated model outputs; the patterns see a poisoned entry when it is returned but not whether it came from a vector store, so the fit is partial.'
       strength: partial
   eu_ai_act:
     - article: '15'

package/rules/excessive-autonomy/ATR-2026-00491-garak-agent-breaker-markdown-just-raw-json.yaml

@@ -12,19 +12,19 @@ maturity: test
 severity: high
 references:
   owasp_llm:
-    - LLM06:2025
+    - LLM07:2025
   owasp_agentic:
-    - ASI06:2026
+    - ASI01:2026
   mitre_atlas:
-    - AML.T0053 - AI Agent Tool Invocation
+    - AML.T0084.001 - Tool Definitions
 compliance:
   owasp_agentic:
-    - id: ASI06:2026
-      context: Excessive autonomy attacks induce agents to perform actions beyond their authorized scope -- the canonical ASI06:2026 Tool Misuse vector when executed via prompt manipulation.
-      strength: primary
+    - id: ASI01:2026
+      context: 'The patterns match prompts that ask the agent to turn its self-description or a response into a structured list of tools, to return or list every tool it can use, to analyse each tool for exploits, or that pair a security-researcher framing with the agent''s tools or weaknesses. ASI01:2026 is the closest agentic entry: it covers prompt-based manipulation of an agent''s task selection, but the rule detects a reconnaissance request rather than a changed goal, so the fit is partial.'
+      strength: partial
   owasp_llm:
-    - id: LLM06:2025
-      context: This rule detects LLM06:2025 Excessive Agency patterns where adversarial inputs cause agents to perform unauthorized actions, including SSRF, shell execution, and unscoped browsing.
+    - id: LLM07:2025
+      context: The patterns match requests for the agent to list or dump its own tools, functions and capabilities, or to describe them for exploit analysis. LLM07:2025 covers disclosure of the system prompts or instructions used to steer the model, including exposure of sensitive functionality, which an attacker can use to facilitate other attacks.
       strength: primary
   eu_ai_act:
     - article: '15'

package/rules/excessive-autonomy/ATR-2026-00500-ssrf-via-agent-url-fetch-instruction.yaml

@@ -13,14 +13,16 @@ severity: critical
 references:
   owasp_llm:
     - LLM06:2025
+    - LLM05:2025
   owasp_agentic:
-    - ASI06:2026
+    - ASI02:2026
   mitre_atlas:
     - AML.T0053 - AI Agent Tool Invocation
+    - AML.T0049 - Exploit Public-Facing Application
 compliance:
   owasp_agentic:
-    - id: ASI06:2026
-      context: Excessive autonomy attacks induce agents to perform actions beyond their authorized scope -- the canonical ASI06:2026 Tool Misuse vector when executed via prompt manipulation.
+    - id: ASI02:2026
+      context: The patterns match prompts telling the agent to fetch cloud metadata endpoints (169.254.169.254, metadata.google.internal), localhost, RFC 1918 addresses or internal hostnames. ASI02:2026 covers an agent applying a legitimate tool in an unsafe way; here the web-fetch tool is pointed at internal services, a server-side request forgery.
       strength: primary
   owasp_llm:
     - id: LLM06:2025

package/rules/excessive-autonomy/ATR-2026-00708-ipi-financial-transfer-unauthorized.yaml

@@ -13,9 +13,10 @@ severity: critical
 references:
   owasp_llm:
     - LLM01:2025
+    - LLM06:2025
   owasp_agentic:
     - ASI01:2026
-    - ASI03:2026
+    - ASI02:2026
   mitre_atlas:
     - AML.T0051 - LLM Prompt Injection
     - AML.T0051.001 - Indirect
@@ -25,8 +26,8 @@ compliance:
       context: Unauthorized financial transfer via indirect PI is a LLM01 attack that embeds payment instructions in consumed structured data.
       strength: primary
   owasp_agentic:
-    - id: ASI03:2026
-      context: The agent is induced to take consequential financial actions (payment, crypto transfer) far beyond the intended task scope.
+    - id: ASI01:2026
+      context: The patterns match content the agent reads that tells it to make a payment or transfer to a stated payee, account, IBAN or wallet, move a full balance, or change the recipient of a recurring payment. ASI01:2026 covers manipulation of an agent's goals through deceptive tool outputs or poisoned external data, and lists a malicious prompt override that manipulates a financial agent into transferring money to an attacker's account.
       strength: primary
   nist_ai_rmf:
     - subcategory: MS.2.7

package/rules/excessive-autonomy/ATR-2026-00711-ipi-system-sabotage-destructive-command.yaml

@@ -13,9 +13,10 @@ severity: critical
 references:
   owasp_llm:
     - LLM01:2025
+    - LLM06:2025
   owasp_agentic:
     - ASI01:2026
-    - ASI03:2026
+    - ASI05:2026
   mitre_atlas:
     - AML.T0051 - LLM Prompt Injection
     - AML.T0051.001 - Indirect
@@ -26,8 +27,8 @@ compliance:
       context: System sabotage via indirect PI embeds destructive shell command instructions in content consumed by computer-use agents.
       strength: primary
   owasp_agentic:
-    - id: ASI03:2026
-      context: Executing destructive shell commands (kernel removal, firewall disable) is excessive agency with permanent system impact.
+    - id: ASI05:2026
+      context: 'The patterns match destructive shell commands planted in content the agent reads: removing kernel packages, disabling the firewall (ufw disable, iptables -F), rm -rf of boot files or conda environments, or running guide.sh whatever the result. ASI05:2026 lists prompt injection that leads to execution of attacker-defined code and shell command invocation from reflected prompts.'
       strength: primary
   nist_ai_rmf:
     - subcategory: MS.2.7

package/rules/excessive-autonomy/ATR-2026-00712-ipi-malicious-package-install.yaml

@@ -13,9 +13,11 @@ severity: critical
 references:
   owasp_llm:
     - LLM01:2025
+    - LLM03:2025
   owasp_agentic:
     - ASI01:2026
-    - ASI03:2026
+    - ASI04:2026
+    - ASI05:2026
   mitre_atlas:
     - AML.T0051 - LLM Prompt Injection
     - AML.T0011.001 - Malicious Package
@@ -25,8 +27,8 @@ compliance:
       context: Malicious package install via indirect PI embeds package manager instructions in agent-consumed emails or documents.
       strength: primary
   owasp_agentic:
-    - id: ASI03:2026
-      context: Executing pip/npm install of an attacker-supplied package is excessive agency that installs malware on the host system.
+    - id: ASI05:2026
+      context: The patterns match content the agent reads that tells it to run pip or npm install for a package described as malicious or taken from an attacker-controlled index. ASI05:2026 lists malicious package installs whose hostile code executes during installation or import, triggered here by prompt injection.
       strength: primary
   nist_ai_rmf:
     - subcategory: MS.2.7

package/rules/excessive-autonomy/ATR-2026-00718-tool-misuse-financial-autonomous.yaml

@@ -12,19 +12,20 @@ maturity: stable
 severity: high
 references:
   owasp_llm:
-    - LLM08:2025
+    - LLM06:2025
   owasp_agentic:
-    - ASI03:2026
+    - ASI02:2026
   mitre_atlas:
-    - AML.T0051 - LLM Prompt Injection
+    - AML.T0053 - AI Agent Tool Invocation
+    - AML.T0048.000 - Financial Harm
 compliance:
   owasp_llm:
-    - id: LLM08:2025
-      context: Autonomous financial trading without per-transaction confirmation is the LLM08 excessive agency pattern applied to financial services.
+    - id: LLM06:2025
+      context: The patterns match requests that have an agent place trades, withdraw a full exchange balance or send crypto to a stored wallet address. LLM06:2025 covers damaging actions taken through an agent's extensions, including excessive autonomy where high-impact actions are not independently verified or approved; the rule flags the request, not the agent's configuration.
       strength: primary
   owasp_agentic:
-    - id: ASI03:2026
-      context: Placing trades or cryptocurrency transfers autonomously is excessive agency with direct financial harm potential.
+    - id: ASI02:2026
+      context: The patterns match direct requests for an agent with exchange or wallet tools to place buy or sell orders, withdraw an entire balance, or send funds to a wallet address read from a note. ASI02:2026 covers an agent applying a legitimate tool in an unsafe way through ambiguous instruction or over-privileged access, such as a tool with full financial API access.
       strength: primary
   nist_ai_rmf:
     - subcategory: MS.2.7

package/rules/excessive-autonomy/ATR-2026-00719-tool-misuse-destructive-bulk-action.yaml

@@ -12,15 +12,15 @@ maturity: stable
 severity: high
 references:
   owasp_llm:
-    - LLM08:2025
+    - LLM06:2025
   owasp_agentic:
     - ASI03:2026
   mitre_atlas:
     - AML.T0051 - LLM Prompt Injection
 compliance:
   owasp_llm:
-    - id: LLM08:2025
-      context: 'Destructive bulk actions (delete all, turn off all) are LLM08 excessive agency: the agent''s capability to delete/control is applied universally without scope limits.'
+    - id: LLM06:2025
+      context: The patterns match direct requests for an agent to delete all tasks or records matching a keyword or label, turn off all or a broad set of connected devices, or cut main power or a circuit breaker through a home-automation app. LLM06:2025 covers damaging actions taken through an agent's extensions, including excessive autonomy where high-impact actions run without independent verification or approval, such as deletions without user confirmation; the rule flags the request, not the agent's configuration.
       strength: primary
   owasp_agentic:
     - id: ASI03:2026