II. Threat categories · Δ
Δ. Agent Manipulation
Social engineering that talks an agent into behaving differently
- Rule files
- 108
- Effective
- 108, loaded by at least one lane
- Enforce lane
- 3, stable only
- Download
- rules/index.csv
Most frequent crosswalks
The number in brackets is how many rules in this category carry that item. ATR wrote these mappings; the framework owners have not reviewed or endorsed them.
MITRE ATLAS
- AML.T0051 - LLM Prompt Injection(99)
- AML.T0054 - LLM Jailbreak(79)
- AML.T0043 - Craft Adversarial Data(5)
- AML.T0051.001 - Indirect(3)
- AML.T0040 - AI Model Inference API Access(3)
- AML.T0050 - Command and Scripting Interpreter(2)
OWASP Agentic Top 10
- ASI01:2026(92)
- ASI07:2026(6)
- ASI10:2026(6)
- ASI03:2026(6)
- ASI05:2026(6)
- ASI09:2026(5)
Rules
| ID | Title | Severity | Maturity | Lanes |
|---|---|---|---|---|
| ATR-2026-00030 | Cross-Agent Attack Detection | critical | stable | enforce · alert · hunt |
| ATR-2026-00074 | Cross-Agent Privilege Escalation | critical | test | alert · hunt |
| ATR-2026-00108 | Multi-Agent Consensus Sybil Attack | critical | test | alert · hunt |
| ATR-2026-00117 | Agent Identity Spoofing and Authority Impersonation | critical | test | alert · hunt |
| ATR-2026-00139 | Casual Authority Data Redirect | critical | test | alert · hunt |
| ATR-2026-00301 | TAP Tree-of-Attacks-with-Pruning Jailbreak | critical | test | alert · hunt |
| ATR-2026-00303 | DevMode + RANTI Dual-Output Profanity Coercion Jailbreak | critical | test | alert · hunt |
| ATR-2026-00305 | DAN Mode Ablation Benchmark-Coercion Jailbreak | critical | test | alert · hunt |
| ATR-2026-00306 | AutoDAN Genetic-Algorithm Jailbreak Suffix | critical | test | alert · hunt |
| ATR-2026-00314 | Amoral Unfiltered Custom AI Persona Jailbreak | critical | test | alert · hunt |
| ATR-2026-00317 | Free-of-Restrictions Named Persona Jailbreak | critical | test | alert · hunt |
| ATR-2026-00318 | Moralizing Rant Then Unfiltered Bypass | critical | test | alert · hunt |
| ATR-2026-00319 | Developer Mode Dual-Response Format Jailbreak | critical | test | alert · hunt |
| ATR-2026-00322 | Fictional-World Format-Override Jailbreak | critical | test | alert · hunt |
| ATR-2026-00323 | Dual-Persona AI Simulation Jailbreak | critical | test | alert · hunt |
| ATR-2026-00325 | BOB Hypothetical Unrestricted Chatbot Jailbreak | critical | test | alert · hunt |
| ATR-2026-00326 | Fake Developer / Authority Chatbot Override (ChatDAN) | critical | test | alert · hunt |
| ATR-2026-00327 | AI Persona Ethics/Law Bypass Declaration | critical | test | alert · hunt |
| ATR-2026-00328 | Named-Mode Persona Override (JEEVES/BABY/APOPHIS Mode) | critical | test | alert · hunt |
| ATR-2026-00329 | No-Withhold Factual Resource / Dialogue Writer Persona | critical | test | alert · hunt |
| ATR-2026-00331 | Terminal / CLI Harmful-Function Simulator Persona | critical | test | alert · hunt |
| ATR-2026-00334 | Two-Entity Token-Splitting Dollar-Term Game Jailbreak | critical | test | alert · hunt |
| ATR-2026-00337 | Obfuscated System-Announcement Injection | critical | test | alert · hunt |
| ATR-2026-00338 | PersonGPT Hash-Prefix Trigger Activation | critical | test | alert · hunt |
| ATR-2026-00344 | Alternative AI Same Capabilities No Restrictions Override | critical | test | alert · hunt |
| ATR-2026-00348 | ARC Autonomous Real Calculation Unit Rulebreaker Activation | critical | test | alert · hunt |
| ATR-2026-00349 | HGTTG Hitchhiker's Guide No-Restriction Universal Oracle | critical | test | alert · hunt |
| ATR-2026-00354 | Reverse-Prompt Harm-Regardless Oracle Persona | critical | test | alert · hunt |
| ATR-2026-00356 | Google GATO/LAMDA Exploit-Generation Persona Jailbreak | critical | test | alert · hunt |
| ATR-2026-00357 | AntiFM Hate-Persona + Physical-Violence Threat + Filter Bypass Mandate | critical | test | alert · hunt |
| ATR-2026-00363 | Rephrase Criminal Activity Second-Person Template (against against) | critical | test | alert · hunt |
| ATR-2026-00388 | Opposite-Reply Omniscient Game Jailbreak | critical | test | alert · hunt |
| ATR-2026-00406 | Doctor XML Policy Puppetry Interaction-Config Injection | critical | test | alert · hunt |
| ATR-2026-00416 | LiteLLM MCP Unauthenticated Server Registration RCE (CVE-2026-30623) | critical | test | alert · hunt |
| ATR-2026-00432 | SuperAGI Output Handler eval() RCE (CVE-2024-21552) | critical | stable | enforce · alert · hunt |
| ATR-2026-00440 | Microsoft Semantic Kernel In-Memory Vector Store eval() RCE (CVE-2026-26030) | critical | stable | enforce · alert · hunt |
| ATR-2026-00032 | Agent Goal Hijacking Detection | high | test | alert · hunt |
| ATR-2026-00076 | Insecure Inter-Agent Communication Detection | high | test | alert · hunt |
| ATR-2026-00077 | Human-Agent Trust Exploitation Detection | high | test | alert · hunt |
| ATR-2026-00116 | Malicious Agent-to-Agent Message Injection | high | test | alert · hunt |
| ATR-2026-00119 | Social Engineering Attack via Agent Output | high | test | alert · hunt |
| ATR-2026-00132 | Casual Authority Claim and Scope Escalation | high | test | alert · hunt |
| ATR-2026-00164 | Skill Scope Hijacking and Cross-Agent Escalation | high | test | alert · hunt |
| ATR-2026-00269 | Foot-in-the-Door Gradual Escalation Attack | high | test | alert · hunt |
| ATR-2026-00271 | Grandma Roleplay Jailbreak | high | test | alert · hunt |
| ATR-2026-00273 | DAN / Developer Mode / DUDE Persona Jailbreak | high | test | alert · hunt |
| ATR-2026-00287 | ThreatenJSON — Coercive Output Format Threat | high | test | alert · hunt |
| ATR-2026-00302 | Anti-DAN Inverted-Filter Over-Refusal Persona | high | test | alert · hunt |
| ATR-2026-00304 | ChatGPT Image Unlocker Markdown-Output Jailbreak | high | test | alert · hunt |
| ATR-2026-00307 | In-the-Wild Jailbreak Corpus Signature Patterns | high | test | alert · hunt |
| ATR-2026-00320 | Opposite Day / Boolean Opposite Machine Jailbreak | high | test | alert · hunt |
| ATR-2026-00324 | Neurosemantical Inversitis Disease-Frame Jailbreak | high | test | alert · hunt |
| ATR-2026-00330 | YOJA ALL-CAPS Character Settings Block Persona | high | test | alert · hunt |
| ATR-2026-00332 | Hacker / Chan-Culture Offensive AI Persona | high | test | alert · hunt |
| ATR-2026-00333 | Disease-Framed Animal / Dual-AI Chatbot Jailbreak (mougpt) | high | test | alert · hunt |
| ATR-2026-00335 | Key-Value Template Persona Injection (JOB/ROLE/PREFIX + Bracket Format) | high | test | alert · hunt |
| ATR-2026-00336 | BRM False-Information Machine / Opposite-Truth Persona | high | test | alert · hunt |
| ATR-2026-00339 | BOM Boolean Opposite Machine Direct Persona Claim | high | test | alert · hunt |
| ATR-2026-00340 | h4x Amoral Unfiltered AI Character Persona | high | test | alert · hunt |
| ATR-2026-00341 | CHAR=/RULES= Short Key-Value Persona Injection | high | test | alert · hunt |
| ATR-2026-00342 | Unicode/Encoding Obfuscation Instruction Injection | high | test | alert · hunt |
| ATR-2026-00343 | Lie/Truth Dual Personality Uncensored Alter-Ego | high | test | alert · hunt |
| ATR-2026-00345 | NLP-Based OS / Fictional Terminal Language Override | high | test | alert · hunt |
| ATR-2026-00346 | Jailbreak Emoji Unlock Dual-Format Output Identifier | high | test | alert · hunt |
| ATR-2026-00347 | Yin/Yang Hidden-Knowledge Deity Simulation and Radical Human-Sim Persona | high | test | alert · hunt |
| ATR-2026-00350 | Black Alert No-Ethics Writing Assistant Persona | high | test | alert · hunt |
| ATR-2026-00351 | DAN Off-Kilter and SMS-Abbreviated Persona Jailbreak | high | test | alert · hunt |
| ATR-2026-00352 | TrainGPT Fix-My-AI Harmful Output Extraction | high | test | alert · hunt |
| ATR-2026-00353 | Dual ChatGPT+Dan Opposite Personality Format Jailbreak | high | test | alert · hunt |
| ATR-2026-00355 | UGH Anti-Human Nefarious AI Persona Jailbreak | high | test | alert · hunt |
| ATR-2026-00358 | CumGPT Explicit-Adult Named-Persona Bypass | high | test | alert · hunt |
| ATR-2026-00360 | CHJ Carousel Game Show / Clyde No-Ethics Bird Jailbreak | high | test | alert · hunt |
| ATR-2026-00361 | Honesty Alter-Ego Dual-Consciousness Safety Filter Bypass | high | test | alert · hunt |
| ATR-2026-00362 | Fictional Unfiltered AI Comparison / Verbatim Hypothetical Model Extraction | high | test | alert · hunt |
| ATR-2026-00364 | Dr. Al Villain Plan Template Injection (Underground HQ Roleplay) | high | test | alert · hunt |
| ATR-2026-00365 | Reservoir Dogs Coercive Interrogation Roleplay (Mr. Blonde / The Cop) | high | test | alert · hunt |
| ATR-2026-00366 | Sneaky Pete Deliberate Misinformation Persona (Warp Facts Game) | high | test | alert · hunt |
| ATR-2026-00368 | Prompt Browser Token-Limit / POLLINATION Jailbreak | high | test | alert · hunt |
| ATR-2026-00369 | GPT-X Star Trek Unlimited-Knowledge Unconstrained Oracle Persona | high | test | alert · hunt |
| ATR-2026-00370 | ADDI/DONNIE German Dictator Propaganda Roleplay Persona | high | test | alert · hunt |
| ATR-2026-00371 | AI Political Bias Manipulation via Inherited-Bias Claim | high | test | alert · hunt |
| ATR-2026-00372 | Fictional CIA Secret Files Story Extraction | high | test | alert · hunt |
| ATR-2026-00374 | Role Placeholder Persona Template Injection | high | test | alert · hunt |
| ATR-2026-00375 | Character Description RPG Explicit Template | high | test | alert · hunt |
| ATR-2026-00376 | Identity Command Real-Person Persona Injection | high | test | alert · hunt |
| ATR-2026-00377 | Jailbreak-Template Command with [TARGETLANGUAGE]/[KEYWORD] Placeholders | high | test | alert · hunt |
| ATR-2026-00379 | Logic-Trap Lie-Permission Mandate Jailbreak | high | test | alert · hunt |
| ATR-2026-00380 | Fake-Citation Biased-Information Mandate | high | test | alert · hunt |
| ATR-2026-00381 | DAN Story-Narrative Continuation Label Prefix Jailbreak | high | test | alert · hunt |
| ATR-2026-00383 | Cyni-Bot 3000 Cynical-Sarcasm AI Persona Bypass | high | test | alert · hunt |
| ATR-2026-00384 | Protect-Me-From Indirect Harm Tutorial Template | high | test | alert · hunt |
| ATR-2026-00385 | Gigachad Dominant-Aggressive Persona Adoption | high | test | alert · hunt |
| ATR-2026-00386 | Daddy/Babygirl Sycophantic Power-Dynamic Manipulation | high | test | alert · hunt |
| ATR-2026-00387 | NSFW Character Sheet Generation Unlock | high | test | alert · hunt |
| ATR-2026-00389 | Terminal Custom OS Ruleset Session Injection | high | test | alert · hunt |
| ATR-2026-00391 | Persona Conditional Harm-Unlock Rule (BreadClyde Pattern) | high | test | alert · hunt |
| ATR-2026-00392 | Authority-Figure Persona + Defensive-Study Framing for Violence Extraction | high | test | alert · hunt |
| ATR-2026-00402 | Grandma Roleplay Harmful Substance Synthesis | high | test | alert · hunt |
| ATR-2026-00404 | ThreatenJSON Death-Coercion and UTF Tag Injection | high | test | alert · hunt |
| ATR-2026-00417 | LibreChat MCP STDIO Argument Injection (CVE-2026-22252) | high | test | alert · hunt |
| ATR-2026-00418 | WeKnora MCP Config-Driven RCE (CVE-2026-22688) | high | test | alert · hunt |
| ATR-2026-00430 | Natural-Language Trust-Escalation / Authority Impersonation | high | test | alert · hunt |
| ATR-2026-00552 | Agent goal drift after environmental pressure injection | high | draft | hunt |
| ATR-2026-02105 | Prototype Pollution via constructor.prototype Path Bypassing __proto__-Only Filters | high | experimental | hunt |
| ATR-2026-00118 | Human Approval Fatigue Exploitation | medium | test | alert · hunt |
| ATR-2026-00268 | Historical / Future Tense Framing Bypass | medium | test | alert · hunt |
| ATR-2026-00288 | False Premise Injection (Misleading FalseAssertion) | medium | test | alert · hunt |
| ATR-2026-02231 | Second-Person Direct Existential Threat Coercion | medium | experimental | hunt |
Page generated 2026-11-10Something wrong or missing? Open an issue