agent-threat-rules 4.2.3 → 4.3.0

package/rules/agent-manipulation/ATR-2026-00440-semantic-kernel-vector-store-eval-rce.yaml

@@ -1,6 +1,6 @@
 title: Microsoft Semantic Kernel In-Memory Vector Store eval() RCE (CVE-2026-26030)
 id: ATR-2026-00440
-rule_version: 1
+rule_version: 2
 status: experimental
 description: |
   Detects exploitation of CVE-2026-26030 (Critical), remote code execution in Microsoft Semantic Kernel via unsafe string interpolation in In-Memory Vector Store filter functions. The vulnerable sink interpolates a user/LLM-controlled filter expression and evaluates it as a lambda; attacker constructs a lambda body that traverses Python's class hierarchy via `tuple()` to reach `BuiltinImporter` and execute `os.system()`, achieving unauthenticated RCE on the Semantic Kernel host. This rule detects the LLM-output / user-input payload patterns that reach the filter sink: lambda definitions combined with eval / __import__ / AST-traversal-via-mro patterns inside content or user_input fields a Semantic Kernel agent is likely to interpolate. CWE-94, CWE-95. Patches available in Python semantic-kernel >= 1.39.4 and .NET semantic-kernel >= 1.71.0; this rule detects exploit attempts against unpatched deployments and provides defence-in-depth post-patch.
@@ -91,8 +91,8 @@ detection:
       description: Python class-hierarchy traversal primitives (tuple().__class__.__mro__, __subclasses__()) — AST-bypass building block used to reach BuiltinImporter
     - field: content
       operator: regex
-      value: (?i)BuiltinImporter|\btypes\.FunctionType\b|\bFunctionType\s*\(|getattr\s*\(\s*(?:object|type|__builtins__)
-      description: BuiltinImporter, Python types.FunctionType reflective construction, or reflective getattr on built-in roots — excludes bare 'FunctionType' which collides with TypeScript terminology
+      value: (?i)BuiltinImporter|\btypes\.FunctionType\b|\bFunctionType\s*\(|getattr\s*\(\s*(?:object|type|__builtins__)\b
+      description: 'BuiltinImporter, Python types.FunctionType reflective construction, or reflective getattr on built-in roots — excludes bare ''FunctionType'' which collides with TypeScript terminology. The root name must end at a word boundary: without it ''getattr(types.Scale, name)'' read as getattr on the built-in type'
     - field: content
       operator: regex
       value: (?i)\bFunction\s*\(\s*["\x27].{0,200}?(?:return\s+(?:eval|new\s+Function|require|process)|os\.system|child_process)["\x27]

package/rules/context-exfiltration/ATR-2026-00020-system-prompt-leak.yaml

@@ -43,7 +43,7 @@ compliance:
       context: This rule is the primary detection implementation for LLM07:2025 System Prompt Leakage, covering direct quotation, instruction paraphrasing, guardrail revelation, and config exposure in agent output.
       strength: primary
     - id: LLM02:2025
-      context: System prompt content constitutes sensitive operational information; its disclosure in agent output also satisfies the LLM02:2025 Sensitive Information Disclosure category.
+      context: System prompt content constitutes sensitive operational information; its disclosure in agent output also falls under the LLM02:2025 Sensitive Information Disclosure category.
       strength: secondary
   eu_ai_act:
     - article: '13'

package/rules/context-exfiltration/ATR-2026-00471-garak-sysprompt-extraction-mixedunassigned.yaml

@@ -28,7 +28,7 @@ compliance:
       strength: primary
   eu_ai_act:
     - article: '15'
-      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this context exfiltration detection rule satisfies the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
+      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this context exfiltration detection rule provides detection evidence supporting the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
       strength: primary
     - article: '9'
       context: Context exfiltration is a documented risk class; this rule implements the monitoring control required by Article 9 risk management obligations for high-risk AI systems.

package/rules/context-exfiltration/ATR-2026-00501-data-exfiltration-via-markdown-image-and-link-url-injection.yaml

@@ -28,7 +28,7 @@ compliance:
       strength: primary
   eu_ai_act:
     - article: '15'
-      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this context exfiltration detection rule satisfies the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
+      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this context exfiltration detection rule provides detection evidence supporting the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
       strength: primary
     - article: '9'
       context: Context exfiltration is a documented risk class; this rule implements the monitoring control required by Article 9 risk management obligations for high-risk AI systems.

package/rules/context-exfiltration/ATR-2026-00504-tool-and-function-capability-enumeration.yaml

@@ -28,7 +28,7 @@ compliance:
       strength: primary
   eu_ai_act:
     - article: '15'
-      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this context exfiltration detection rule satisfies the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
+      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this context exfiltration detection rule provides detection evidence supporting the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
       strength: primary
     - article: '9'
       context: Context exfiltration is a documented risk class; this rule implements the monitoring control required by Article 9 risk management obligations for high-risk AI systems.

package/rules/context-exfiltration/ATR-2026-00505-system-prompt-extraction-instruction-dump-request.yaml

@@ -28,7 +28,7 @@ compliance:
       strength: primary
   eu_ai_act:
     - article: '15'
-      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this context exfiltration detection rule satisfies the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
+      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this context exfiltration detection rule provides detection evidence supporting the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
       strength: primary
     - article: '9'
       context: Context exfiltration is a documented risk class; this rule implements the monitoring control required by Article 9 risk management obligations for high-risk AI systems.

package/rules/context-exfiltration/ATR-2026-00514-system-prompt-extraction.yaml

@@ -28,7 +28,7 @@ compliance:
       strength: primary
   eu_ai_act:
     - article: '15'
-      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this context exfiltration detection rule satisfies the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
+      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this context exfiltration detection rule provides detection evidence supporting the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
       strength: primary
     - article: '9'
       context: Context exfiltration is a documented risk class; this rule implements the monitoring control required by Article 9 risk management obligations for high-risk AI systems.

package/rules/context-exfiltration/ATR-2026-00516-output-xss-via-llm.yaml

@@ -29,7 +29,7 @@ compliance:
       strength: primary
   eu_ai_act:
     - article: '15'
-      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this context exfiltration detection rule satisfies the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
+      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this context exfiltration detection rule provides detection evidence supporting the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
       strength: primary
     - article: '9'
       context: Context exfiltration is a documented risk class; this rule implements the monitoring control required by Article 9 risk management obligations for high-risk AI systems.

package/rules/context-exfiltration/ATR-2026-01462-sysprompt-override-pseudo-admin.yaml

@@ -1,6 +1,6 @@
 title: System Prompt Override via Pseudo-Admin / Authority Injection
 id: ATR-2026-01462
-rule_version: 1
+rule_version: 2
 status: stable
 description: |
   Detects attempts to override or replace the system prompt by injecting fake administrative authority markers, claiming to be a higher-priority override, emergency protocol, or root-admin authorization. The probe corpus contains six variants: (1) HTML-comment wrapped authority claim:
@@ -74,7 +74,7 @@ detection:
   conditions:
     - field: content
       operator: regex
-      value: (?i)((?:<!--|\[)\s*SYSTEM\s+OVERRIDE\b|SYSTEM\s+OVERRIDE\s+(?:BEGIN|MODE|ACTIVE|NOW|ENABLED)|ROOT_?ADMIN|OMEGA\s+CLEARANCE|PRIORITY\s+LEVEL\s*:\s*CRITICAL|AUTHORIZATION\s*:\s*(ROOT|ADMIN|FULL|OMEGA))
+      value: (?i)((?:<!--|\[)\s*SYSTEM\s+OVERRIDE\b|SYSTEM\s+OVERRIDE\s+(?:BEGIN|MODE|ACTIVE|NOW|ENABLED)|ROOT_?ADMIN|OMEGA\s+CLEARANCE|AUTHORIZATION\s*:\s*(ROOT|ADMIN|FULL|OMEGA))
       description: System override (structurally framed) / root admin / omega clearance authority claim
     - field: content
       operator: regex

package/rules/context-exfiltration/ATR-2026-01770-semantic-pii-credential-extraction.yaml

@@ -43,7 +43,7 @@ compliance:
       context: All five sub-forms aim at unauthorized disclosure of PII or credentials, the core LLM02:2025 sensitive-information-disclosure risk.
       strength: primary
     - id: LLM01:2025
-      context: Social-engineering, obfuscation, and euphemistic carriers are prompt-injection techniques that bypass literal-keyword filters, satisfying LLM01:2025.
+      context: Social-engineering, obfuscation, and euphemistic carriers are prompt-injection techniques that bypass literal-keyword filters, matching LLM01:2025.
       strength: secondary
   owasp_agentic:
     - id: ASI01:2026

package/rules/context-exfiltration/ATR-2026-01862-llmail-email-tool-exfil-confirmation.yaml

@@ -29,7 +29,7 @@ compliance:
       context: An email-tool directive hidden in retrieved content steers the agent into exfiltrating data to a fixed attacker address, hijacking the agent's goal.
       strength: primary
     - id: ASI05:2026
-      context: Acting on attacker instructions embedded in inbound email to invoke the send-email tool is an autonomous cascading action satisfying ASI05:2026.
+      context: Acting on attacker instructions embedded in inbound email to invoke the send-email tool is an autonomous cascading action matching ASI05:2026.
       strength: secondary
   owasp_llm:
     - id: LLM02:2025
@@ -40,7 +40,7 @@ compliance:
       strength: secondary
   eu_ai_act:
     - article: '15'
-      context: Article 15 robustness and cybersecurity requires high-risk AI systems to resist exfiltration directives embedded in external inputs; detection of the email-tool exfil signature satisfies this requirement.
+      context: Article 15 robustness and cybersecurity requires high-risk AI systems to resist exfiltration directives embedded in external inputs; detection of the email-tool exfil signature supports this requirement.
       strength: primary
     - article: '9'
       context: Tool-mediated data exfiltration triggered by untrusted content is a documented Article 9 risk requiring mitigation controls.

package/rules/context-exfiltration/ATR-2026-01863-llmail-post-summary-exfil-directive.yaml

@@ -29,7 +29,7 @@ compliance:
       context: A post-summary follow-up directive hidden in retrieved email steers the agent into emailing a fixed attacker address, hijacking the agent's goal after its legitimate task.
       strength: primary
     - id: ASI05:2026
-      context: Chaining an exfiltration action onto completion of the summarization task is an autonomous cascading action satisfying ASI05:2026.
+      context: Chaining an exfiltration action onto completion of the summarization task is an autonomous cascading action matching ASI05:2026.
       strength: secondary
   owasp_llm:
     - id: LLM02:2025
@@ -40,7 +40,7 @@ compliance:
       strength: secondary
   eu_ai_act:
     - article: '15'
-      context: Article 15 robustness requires high-risk AI systems to resist deferred exfiltration directives embedded in external inputs; detection of post-task exfil framing satisfies this requirement.
+      context: Article 15 robustness requires high-risk AI systems to resist deferred exfiltration directives embedded in external inputs; detection of post-task exfil framing supports this requirement.
       strength: primary
   nist_ai_rmf:
     - function: Manage

package/rules/context-exfiltration/ATR-2026-01864-llmail-obfuscated-exfil-address.yaml

@@ -29,7 +29,7 @@ compliance:
       context: An exfiltration directive using an obfuscated attacker address still hijacks the agent's goal toward emailing the attacker mailbox.
       strength: primary
     - id: ASI05:2026
-      context: Tool-mediated exfiltration to an obfuscated external address is an autonomous cascading action satisfying ASI05:2026.
+      context: Tool-mediated exfiltration to an obfuscated external address is an autonomous cascading action matching ASI05:2026.
       strength: secondary
   owasp_llm:
     - id: LLM02:2025
@@ -40,7 +40,7 @@ compliance:
       strength: secondary
   eu_ai_act:
     - article: '15'
-      context: Article 15 robustness requires high-risk AI systems to resist obfuscated exfiltration addresses in external inputs; detection of at/dot/entity obfuscation satisfies this requirement.
+      context: Article 15 robustness requires high-risk AI systems to resist obfuscated exfiltration addresses in external inputs; detection of at/dot/entity obfuscation supports this requirement.
       strength: primary
   nist_ai_rmf:
     - function: Manage

package/rules/context-exfiltration/ATR-2026-01924-system-instruction-extraction-reformat.yaml

@@ -36,7 +36,7 @@ compliance:
       strength: secondary
   eu_ai_act:
     - article: '15'
-      context: Article 15 robustness requires resisting extraction of system instructions; detecting reformat-based extraction satisfies the requirement.
+      context: Article 15 robustness requires resisting extraction of system instructions; detecting reformat-based extraction supports the requirement.
       strength: primary
   nist_ai_rmf:
     - function: Manage

package/rules/context-exfiltration/ATR-2026-02017-secret-key-exfiltration-request.yaml

@@ -23,7 +23,7 @@ references:
 compliance:
   eu_ai_act:
     - article: '15'
-      context: High-risk AI systems must be resilient against adversarial attempts to extract sensitive secrets from context; detecting secret-key exfiltration requests is a concrete cybersecurity control satisfying Article 15 requirements for robustness against input-based manipulation.
+      context: High-risk AI systems must be resilient against adversarial attempts to extract sensitive secrets from context; detecting secret-key exfiltration requests provides detection evidence supporting Article 15 requirements for robustness against input-based manipulation.
       strength: primary
     - article: '9'
       context: Secret-key exfiltration attempts constitute a documented risk class in the AI system risk register; Article 9 requires that monitoring controls are deployed to detect these attempts at runtime.

package/rules/context-exfiltration/ATR-2026-02026-oblique-sysprompt-extraction-transform.yaml

@@ -32,7 +32,7 @@ compliance:
       strength: primary
   eu_ai_act:
     - article: '15'
-      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this context exfiltration detection rule satisfies the Article 15 requirement to implement technical measures ensuring robustness against manipulation, covering the oblique-referent/transform variant that literal-keyword rules miss.
+      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this context exfiltration detection rule provides detection evidence supporting the Article 15 requirement to implement technical measures ensuring robustness against manipulation, covering the oblique-referent/transform variant that literal-keyword rules miss.
       strength: primary
     - article: '9'
       context: Context exfiltration is a documented risk class; this rule implements the monitoring control required by Article 9 risk management obligations for high-risk AI systems.

package/rules/context-exfiltration/ATR-2026-02847-policy-justified-exfil-to-email.yaml

@@ -23,7 +23,7 @@ references:
 compliance:
   eu_ai_act:
     - article: '15'
-      context: High-risk AI systems must be resilient against manipulation that causes them to exfiltrate data under a fabricated policy pretext; detecting the policy-justified exfiltration-to-email pattern is a concrete cybersecurity control satisfying Article 15 robustness requirements.
+      context: High-risk AI systems must be resilient against manipulation that causes them to exfiltrate data under a fabricated policy pretext; detecting the policy-justified exfiltration-to-email pattern is a concrete cybersecurity control that supports Article 15 robustness requirements.
       strength: primary
     - article: '9'
       context: Policy-pretext exfiltration attempts are a documented risk class for agentic systems that process untrusted content; Article 9 requires runtime monitoring controls capable of detecting these attempts as part of the continuous risk management system.

package/rules/context-exfiltration/ATR-2026-02850-fake-documentation-forward-request.yaml

@@ -24,7 +24,7 @@ references:
 compliance:
   eu_ai_act:
     - article: '15'
-      context: High-risk AI systems must be resilient against adversarial attempts to manipulate the system into exfiltrating data; detecting fake-documentation forwarding pretexts is a concrete cybersecurity control satisfying Article 15 requirements for robustness against input-based manipulation.
+      context: High-risk AI systems must be resilient against adversarial attempts to manipulate the system into exfiltrating data; detecting fake-documentation forwarding pretexts provides detection evidence supporting Article 15 requirements for robustness against input-based manipulation.
       strength: primary
     - article: '9'
       context: Fake-documentation exfiltration pretexts constitute a documented risk class in the AI system risk register; Article 9 requires that monitoring controls are deployed to detect these attempts at runtime.

package/rules/context-exfiltration/ATR-2026-02855-cross-email-exfil-relay.yaml

@@ -22,7 +22,7 @@ references:
 compliance:
   eu_ai_act:
     - article: '15'
-      context: High-risk AI agents must be resilient against adversarial manipulation of their context that causes unauthorized data exfiltration; this rule's detection of cross-document found-elsewhere-then-send relay chains is a concrete cybersecurity control satisfying Article 15 robustness requirements against input-based manipulation.
+      context: High-risk AI agents must be resilient against adversarial manipulation of their context that causes unauthorized data exfiltration; this rule's detection of cross-document found-elsewhere-then-send relay chains is a concrete cybersecurity control that supports Article 15 robustness requirements against input-based manipulation.
       strength: primary
     - article: '9'
       context: Cross-email exfiltration relay via injected tool output is a documented risk class in the AI system risk register; Article 9 requires that monitoring controls are deployed to detect these attempts at runtime.

package/rules/data-poisoning/ATR-2026-00070-data-poisoning.yaml

@@ -36,10 +36,10 @@ compliance:
       strength: primary
   owasp_llm:
     - id: LLM01:2025
-      context: Hidden instruction markers and role-override commands embedded in retrieved content deliver indirect prompt injection through the data layer, satisfying the LLM01:2025 Prompt Injection category via the RAG attack surface.
+      context: Hidden instruction markers and role-override commands embedded in retrieved content deliver indirect prompt injection through the data layer, matching the LLM01:2025 Prompt Injection category via the RAG attack surface.
       strength: primary
     - id: LLM03:2025
-      context: Poisoned knowledge base entries injected into the supply chain of training or retrieval data satisfy the LLM03:2025 Supply Chain Vulnerabilities category at the data tier.
+      context: Poisoned knowledge base entries injected into the supply chain of training or retrieval data match the LLM03:2025 Supply Chain Vulnerabilities category at the data tier.
       strength: secondary
     - id: LLM08:2025
       context: 'The patterns match hidden directives in tool output (the rule targets retrieved documents and knowledge-base entries): fake [SYSTEM] or <system> tags, ignore-previous-instructions overrides, retrieval-triggered phrases, BEGIN HIDDEN INSTRUCTIONS blocks, ''for internal use only'' sections, concealment and stealth-action directives, mode switches, role-play and append-to-every-response directives, injected chat turns, prompt-template delimiters and exfiltration commands with a target address. LLM08:2025, which covers systems using Retrieval Augmented Generation, lists data poisoning from insiders, prompts, data seeding or unverified data providers, leading to manipulated model outputs; the patterns see a poisoned entry when it is returned but not whether it came from a vector store, so the fit is partial.'

package/rules/excessive-autonomy/ATR-2026-00050-runaway-agent-loop.yaml

@@ -28,7 +28,7 @@ references:
 compliance:
   owasp_agentic:
     - id: ASI05:2026
-      context: Runaway agent loops represent uncontrolled autonomous execution — the agent performs repeated identical actions without human intervention, satisfying the ASI05:2026 Unexpected Code Execution category at the behavioral level.
+      context: Runaway agent loops represent uncontrolled autonomous execution — the agent performs repeated identical actions without human intervention, matching the ASI05:2026 Unexpected Code Execution category at the behavioral level.
       strength: primary
   owasp_llm:
     - id: LLM06:2025
@@ -54,7 +54,7 @@ compliance:
       strength: primary
     - function: Govern
       subcategory: GV.1.2
-      context: GV.1.2 accountability roles must include responsibility for detecting and halting runaway agent behavior; this rule provides the signal required to fulfill that accountability.
+      context: GV.1.2 accountability roles must include responsibility for detecting and halting runaway agent behavior; this rule provides the signal that supports that accountability.
       strength: secondary
     - subcategory: MG.2.3
       context: NIST AI RMF MANAGE 2.3 (respond to previously unknown identified risks) is supported by this rule, which surfaces the unsafe autonomous action (Runaway Agent Loop Detection) so the risk can be treated.

package/rules/excessive-autonomy/ATR-2026-00052-cascading-failure.yaml

@@ -29,7 +29,7 @@ references:
 compliance:
   eu_ai_act:
     - article: '14'
-      context: Cascading failures propagating across agent pipelines make human intervention increasingly difficult as the failure scope widens; early detection satisfies Article 14's requirement for effective human override capability.
+      context: Cascading failures propagating across agent pipelines make human intervention increasingly difficult as the failure scope widens; early detection provides evidence supporting Article 14's requirement for effective human override capability.
       strength: primary
     - article: '15'
       context: Article 15 accuracy and robustness requirements demand that high-risk AI systems handle failure propagation gracefully; this rule provides the monitoring signal required to contain cascading events.

package/rules/excessive-autonomy/ATR-2026-00491-garak-agent-breaker-markdown-just-raw-json.yaml

@@ -28,7 +28,7 @@ compliance:
       strength: primary
   eu_ai_act:
     - article: '15'
-      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this excessive autonomy detection rule satisfies the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
+      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this excessive autonomy detection rule provides detection evidence supporting the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
       strength: primary
     - article: '9'
       context: Excessive autonomy is a documented risk class; this rule implements the monitoring control required by Article 9 risk management obligations for high-risk AI systems.

package/rules/excessive-autonomy/ATR-2026-00500-ssrf-via-agent-url-fetch-instruction.yaml

@@ -30,7 +30,7 @@ compliance:
       strength: primary
   eu_ai_act:
     - article: '15'
-      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this excessive autonomy detection rule satisfies the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
+      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this excessive autonomy detection rule provides detection evidence supporting the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
       strength: primary
     - article: '9'
       context: Excessive autonomy is a documented risk class; this rule implements the monitoring control required by Article 9 risk management obligations for high-risk AI systems.

package/rules/model-abuse/ATR-2026-00502-training-data-extraction-via-divergent-repetition-attack.yaml

@@ -30,7 +30,7 @@ compliance:
       strength: primary
   eu_ai_act:
     - article: '15'
-      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this model abuse detection rule satisfies the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
+      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this model abuse detection rule provides detection evidence supporting the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
       strength: primary
     - article: '9'
       context: Model abuse is a documented risk class; this rule implements the monitoring control required by Article 9 risk management obligations for high-risk AI systems.

package/rules/model-abuse/ATR-2026-00517-model-extraction-distillation.yaml

@@ -28,7 +28,7 @@ compliance:
       strength: primary
   eu_ai_act:
     - article: '15'
-      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this model abuse detection rule satisfies the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
+      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this model abuse detection rule provides detection evidence supporting the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
       strength: primary
     - article: '9'
       context: Model abuse is a documented risk class; this rule implements the monitoring control required by Article 9 risk management obligations for high-risk AI systems.

package/rules/prompt-injection/ATR-2026-00001-direct-prompt-injection.yaml

@@ -34,7 +34,7 @@ compliance:
       strength: primary
   eu_ai_act:
     - article: '15'
-      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this detection rule satisfies the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
+      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this detection rule provides detection evidence supporting the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
       strength: primary
     - article: '9'
       context: Prompt injection is a documented risk class; this rule implements the monitoring control required by Article 9 risk management obligations for high-risk AI systems.

package/rules/prompt-injection/ATR-2026-00002-indirect-prompt-injection.yaml

@@ -31,7 +31,7 @@ compliance:
       context: Indirect prompt injection hijacks agent goals via externally-consumed content (documents, web pages, API responses); the agent processes attacker-controlled instructions without user awareness.
       strength: primary
     - id: ASI06:2026
-      context: Injection via external content poisons the agent's context window and memory with attacker-controlled directives, satisfying the ASI06:2026 Memory and Context Poisoning category.
+      context: Injection via external content poisons the agent's context window and memory with attacker-controlled directives, matching the ASI06:2026 Memory and Context Poisoning category.
       strength: secondary
   owasp_llm:
     - id: LLM01:2025
@@ -39,7 +39,7 @@ compliance:
       strength: primary
   eu_ai_act:
     - article: '15'
-      context: High-risk AI systems must resist adversarial content embedded in external inputs. Detection of hidden injection payloads in consumed documents satisfies Article 15 robustness and cybersecurity requirements.
+      context: High-risk AI systems must resist adversarial content embedded in external inputs. Detection of hidden injection payloads in consumed documents supports Article 15 robustness and cybersecurity requirements.
       strength: primary
     - article: '9'
       context: Indirect injection from third-party content sources is a documented risk category requiring mitigation controls under Article 9 risk management obligations.

package/rules/prompt-injection/ATR-2026-00003-jailbreak-attempt.yaml

@@ -25,7 +25,7 @@ references:
 compliance:
   eu_ai_act:
     - article: '15'
-      context: High-risk AI systems must be resilient against adversarial attempts to suppress safety mechanisms. Jailbreak detection is a concrete cybersecurity control satisfying Article 15 requirements for robustness against input-based manipulation.
+      context: High-risk AI systems must be resilient against adversarial attempts to suppress safety mechanisms. Jailbreak detection provides detection evidence supporting Article 15 requirements for robustness against input-based manipulation.
       strength: primary
     - article: '9'
       context: Jailbreak attempts constitute a documented risk class in the AI system risk register; Article 9 requires that monitoring controls are deployed to detect these attempts at runtime.

package/rules/prompt-injection/ATR-2026-00140-indirect-reference-reversal.yaml

@@ -28,7 +28,7 @@ compliance:
       context: Detecting reversal-based jailbreak attempts provides continuous evidence about the AI system's resilience to instruction extraction and inversion attacks; MS.2.7 requires that security and resilience are evaluated and documented against these GenAI-specific prompt injection vectors.
       strength: secondary
     - subcategory: MG.2.3
-      context: Identification of instruction-reversal probing patterns enables containment mechanisms to disengage or block the agent before it executes inverted (unsafe) versions of its original directives, satisfying MG.2.3's requirement for runtime treatment of adversarial manipulation.
+      context: Identification of instruction-reversal probing patterns enables containment mechanisms to disengage or block the agent before it executes inverted (unsafe) versions of its original directives, supporting MG.2.3's requirement for runtime treatment of adversarial manipulation.
       strength: secondary
   iso_42001:
     - clause: '8.1'

package/rules/prompt-injection/ATR-2026-00211-system-prompt-override.yaml

@@ -26,7 +26,7 @@ compliance:
       context: Detecting system prompt override attempts via translation requests provides continuous evidence for evaluating the AI system's security and resilience against prompt injection, which MS.2.7 requires to be measured and documented.
       strength: secondary
     - subcategory: MG.2.3
-      context: Matches on translation-borne override instructions trigger pre-defined risk treatment to disengage or quarantine the hijacked agent behavior before safety controls are bypassed, satisfying MG.2.3's requirement for mechanisms to supersede or deactivate compromised AI behavior.
+      context: Matches on translation-borne override instructions trigger pre-defined risk treatment to disengage or quarantine the hijacked agent behavior before safety controls are bypassed, supporting MG.2.3's requirement for mechanisms to supersede or deactivate compromised AI behavior.
       strength: secondary
   iso_42001:
     - clause: '8.1'

package/rules/prompt-injection/ATR-2026-00257-cipher-transposition-jailbreak.yaml

@@ -26,7 +26,7 @@ compliance:
       context: Cipher and transposition encoding jailbreaks (ROT13, Atbash, Caesar, leet) are adversarial inputs designed to bypass safety filters by obfuscating harmful instructions; MS.2.7 requires that AI system security and resilience against such evasion techniques are continuously evaluated and documented.
       strength: primary
     - subcategory: MS.2.6
-      context: Detecting cipher-based jailbreak probes (as catalogued by garak InjectROT13/InjectAtbash/InjectLeet) provides ongoing measurement of safety/security risk magnitude from prompt-injection attacks that classical content filters miss, satisfying MS.2.6's continuous evaluation requirement.
+      context: Detecting cipher-based jailbreak probes (as catalogued by garak InjectROT13/InjectAtbash/InjectLeet) provides ongoing measurement of safety/security risk magnitude from prompt-injection attacks that classical content filters miss, supporting MS.2.6's continuous evaluation requirement.
       strength: secondary
     - subcategory: MG.2.3
       context: Identification of obfuscated jailbreak instructions triggers the deactivation or response mechanisms required by MG.2.3 to supersede unsafe agent execution before the decoded harmful instruction is acted upon.

package/rules/prompt-injection/ATR-2026-00312-unicode-variant-selector-ascii-smuggling.yaml

@@ -29,7 +29,7 @@ compliance:
       context: Invisible ASCII smuggling via variation selectors is an adversarial input technique that exploits the gap between human-visible text and tokenizer-decoded content; MP.5.1 requires identifying and characterizing the likelihood and impact of such hidden jailbreak payload vectors.
       strength: secondary
     - subcategory: MG.2.3
-      context: Matches on consecutive U+E0100-U+E017F sequences trigger risk treatment to strip or quarantine the smuggled payload before it reaches the model, satisfying MG.2.3's requirement for mechanisms that disengage adversarial inputs from AI processing pipelines.
+      context: Matches on consecutive U+E0100-U+E017F sequences trigger risk treatment to strip or quarantine the smuggled payload before it reaches the model, supporting MG.2.3's requirement for mechanisms that disengage adversarial inputs from AI processing pipelines.
       strength: secondary
   iso_42001:
     - clause: '8.1'

package/rules/prompt-injection/ATR-2026-00452-direct-pwned-payload-injection.yaml

@@ -29,7 +29,7 @@ compliance:
       strength: primary
   eu_ai_act:
     - article: '15'
-      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this prompt injection detection rule satisfies the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
+      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this prompt injection detection rule provides detection evidence supporting the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
       strength: primary
     - article: '9'
       context: Prompt injection is a documented risk class; this rule implements the monitoring control required by Article 9 risk management obligations for high-risk AI systems.

package/rules/prompt-injection/ATR-2026-00453-secret-key-reveal-demand.yaml

@@ -29,7 +29,7 @@ compliance:
       strength: primary
   eu_ai_act:
     - article: '15'
-      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this prompt injection detection rule satisfies the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
+      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this prompt injection detection rule provides detection evidence supporting the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
       strength: primary
     - article: '9'
       context: Prompt injection is a documented risk class; this rule implements the monitoring control required by Article 9 risk management obligations for high-risk AI systems.

package/rules/prompt-injection/ATR-2026-00454-backslash-per-character-encoding.yaml

@@ -29,7 +29,7 @@ compliance:
       strength: primary
   eu_ai_act:
     - article: '15'
-      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this prompt injection detection rule satisfies the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
+      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this prompt injection detection rule provides detection evidence supporting the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
       strength: primary
     - article: '9'
       context: Prompt injection is a documented risk class; this rule implements the monitoring control required by Article 9 risk management obligations for high-risk AI systems.

package/rules/prompt-injection/ATR-2026-00455-no-period-output-override.yaml

@@ -29,7 +29,7 @@ compliance:
       strength: primary
   eu_ai_act:
     - article: '15'
-      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this prompt injection detection rule satisfies the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
+      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this prompt injection detection rule provides detection evidence supporting the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
       strength: primary
     - article: '9'
       context: Prompt injection is a documented risk class; this rule implements the monitoring control required by Article 9 risk management obligations for high-risk AI systems.

package/rules/prompt-injection/ATR-2026-00456-conditional-empty-input-injection.yaml

@@ -29,7 +29,7 @@ compliance:
       strength: primary
   eu_ai_act:
     - article: '15'
-      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this prompt injection detection rule satisfies the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
+      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this prompt injection detection rule provides detection evidence supporting the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
       strength: primary
     - article: '9'
       context: Prompt injection is a documented risk class; this rule implements the monitoring control required by Article 9 risk management obligations for high-risk AI systems.

package/rules/prompt-injection/ATR-2026-00457-garak-dan-to-every-prompt.yaml

@@ -29,7 +29,7 @@ compliance:
       strength: primary
   eu_ai_act:
     - article: '15'
-      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this prompt injection detection rule satisfies the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
+      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this prompt injection detection rule provides detection evidence supporting the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
       strength: primary
     - article: '9'
       context: Prompt injection is a documented risk class; this rule implements the monitoring control required by Article 9 risk management obligations for high-risk AI systems.

package/rules/prompt-injection/ATR-2026-00458-garak-dra-step-by-step.yaml

@@ -29,7 +29,7 @@ compliance:
       strength: primary
   eu_ai_act:
     - article: '15'
-      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this prompt injection detection rule satisfies the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
+      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this prompt injection detection rule provides detection evidence supporting the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
       strength: primary
     - article: '9'
       context: Prompt injection is a documented risk class; this rule implements the monitoring control required by Article 9 risk management obligations for high-risk AI systems.

package/rules/prompt-injection/ATR-2026-00459-garak-dan-an-ai-language.yaml

@@ -29,7 +29,7 @@ compliance:
       strength: primary
   eu_ai_act:
     - article: '15'
-      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this prompt injection detection rule satisfies the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
+      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this prompt injection detection rule provides detection evidence supporting the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
       strength: primary
     - article: '9'
       context: Prompt injection is a documented risk class; this rule implements the monitoring control required by Article 9 risk management obligations for high-risk AI systems.

package/rules/prompt-injection/ATR-2026-00460-garak-dan-no-matter-how.yaml

@@ -29,7 +29,7 @@ compliance:
       strength: primary
   eu_ai_act:
     - article: '15'
-      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this prompt injection detection rule satisfies the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
+      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this prompt injection detection rule provides detection evidence supporting the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
       strength: primary
     - article: '9'
       context: Prompt injection is a documented risk class; this rule implements the monitoring control required by Article 9 risk management obligations for high-risk AI systems.

package/rules/prompt-injection/ATR-2026-00461-garak-goodside-mixedunassigned.yaml

@@ -29,7 +29,7 @@ compliance:
       strength: primary
   eu_ai_act:
     - article: '15'
-      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this prompt injection detection rule satisfies the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
+      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this prompt injection detection rule provides detection evidence supporting the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
       strength: primary
     - article: '9'
       context: Prompt injection is a documented risk class; this rule implements the monitoring control required by Article 9 risk management obligations for high-risk AI systems.

package/rules/prompt-injection/ATR-2026-00462-garak-gcg-mixedunassigned.yaml

@@ -29,7 +29,7 @@ compliance:
       strength: primary
   eu_ai_act:
     - article: '15'
-      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this prompt injection detection rule satisfies the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
+      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this prompt injection detection rule provides detection evidence supporting the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
       strength: primary
     - article: '9'
       context: Prompt injection is a documented risk class; this rule implements the monitoring control required by Article 9 risk management obligations for high-risk AI systems.

package/rules/prompt-injection/ATR-2026-00463-garak-lmrc-mixedunassigned.yaml

@@ -29,7 +29,7 @@ compliance:
       strength: primary
   eu_ai_act:
     - article: '15'
-      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this prompt injection detection rule satisfies the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
+      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this prompt injection detection rule provides detection evidence supporting the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
       strength: primary
     - article: '9'
       context: Prompt injection is a documented risk class; this rule implements the monitoring control required by Article 9 risk management obligations for high-risk AI systems.

package/rules/prompt-injection/ATR-2026-00464-garak-dan-i-would-like.yaml

@@ -29,7 +29,7 @@ compliance:
       strength: primary
   eu_ai_act:
     - article: '15'
-      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this prompt injection detection rule satisfies the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
+      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this prompt injection detection rule provides detection evidence supporting the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
       strength: primary
     - article: '9'
       context: Prompt injection is a documented risk class; this rule implements the monitoring control required by Article 9 risk management obligations for high-risk AI systems.

package/rules/prompt-injection/ATR-2026-00465-garak-dan-your-prompt-here.yaml

@@ -29,7 +29,7 @@ compliance:
       strength: primary
   eu_ai_act:
     - article: '15'
-      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this prompt injection detection rule satisfies the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
+      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this prompt injection detection rule provides detection evidence supporting the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
       strength: primary
     - article: '9'
       context: Prompt injection is a documented risk class; this rule implements the monitoring control required by Article 9 risk management obligations for high-risk AI systems.

package/rules/prompt-injection/ATR-2026-00466-garak-latentinjection-following-text-from.yaml

@@ -29,7 +29,7 @@ compliance:
       strength: primary
   eu_ai_act:
     - article: '15'
-      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this prompt injection detection rule satisfies the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
+      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this prompt injection detection rule provides detection evidence supporting the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
       strength: primary
     - article: '9'
       context: Prompt injection is a documented risk class; this rule implements the monitoring control required by Article 9 risk management obligations for high-risk AI systems.