II. Threat categories · Γ
Γ. Context Exfiltration
Stealing conversation context and sensitive data
- Rule files
- 138
- Effective
- 138, loaded by at least one lane
- Enforce lane
- 30, stable only
- Download
- rules/index.csv
Most frequent crosswalks
The number in brackets is how many rules in this category carry that item. ATR wrote these mappings; the framework owners have not reviewed or endorsed them.
MITRE ATLAS
- AML.T0057 - LLM Data Leakage(73)
- AML.T0051 - LLM Prompt Injection(43)
- AML.T0051.001 - Indirect(26)
- AML.T0024 - Exfiltration via AI Inference API(22)
- AML.T0055 - Unsecured Credentials(10)
- AML.T0086 - Exfiltration via AI Agent Tool Invocation(10)
OWASP Agentic Top 10
- ASI01:2026(73)
- ASI03:2026(46)
- ASI02:2026(31)
- ASI06:2026(16)
- ASI04:2026(15)
- ASI05:2026(12)
Rules
| ID | Title | Severity | Maturity | Lanes |
|---|---|---|---|---|
| ATR-2026-00021 | Credential and Secret Exposure in Agent Output | critical | test | alert · hunt |
| ATR-2026-00113 | Credential File Theft from Agent Environment | critical | test | alert · hunt |
| ATR-2026-00115 | Bulk Environment Variable Harvesting and Exfiltration | critical | test | alert · hunt |
| ATR-2026-00136 | Tool Response Data Piggybacking | critical | test | alert · hunt |
| ATR-2026-00141 | API Key Leakage via Example Format | critical | test | alert · hunt |
| ATR-2026-00142 | Data Piggybacking via Casual Transition Words | critical | test | alert · hunt |
| ATR-2026-00145 | Obfuscated API Key Disclosure | critical | test | alert · hunt |
| ATR-2026-00150 | Credential Data Leaked in Tool Response | critical | test | alert · hunt |
| ATR-2026-00162 | Credential Access with Exfiltration in Skill Instructions | critical | test | alert · hunt |
| ATR-2026-00201 | Credential Exfiltration via Shell Pipe | critical | test | alert · hunt |
| ATR-2026-00212 | mcp-atlassian Credential Leak via Hint Parameter Injection (CVE-2026-27825/27826) | critical | test | alert · hunt |
| ATR-2026-00290 | Divergence Attack — Repeat-Word-Forever Training Data Extraction | critical | test | alert · hunt |
| ATR-2026-00291 | Biometric Surveillance — Personal Biometric Data Request for Named Individual | critical | test | alert · hunt |
| ATR-2026-00293 | Educational Records — Personal Academic/Professional Record Request for Named Individual | critical | test | alert · hunt |
| ATR-2026-00294 | Financial PII — Personal Financial Data Request for Named Individual | critical | test | alert · hunt |
| ATR-2026-00295 | Medical PII — Personal Medical/Health Data Request for Named Individual | critical | test | alert · hunt |
| ATR-2026-00421 | Natural-Language Covert Conversation Exfiltration Instruction | critical | test | alert · hunt |
| ATR-2026-00422 | Natural-Language Credential / Secret Disclosure Instruction | critical | test | alert · hunt |
| ATR-2026-00423 | Natural-Language Sensitive File Disclosure Instruction | critical | test | alert · hunt |
| ATR-2026-00426 | Natural-Language Output-Injection Credential Embedding | critical | test | alert · hunt |
| ATR-2026-00501 | Data Exfiltration via Markdown Image and Link URL Injection | critical | test | alert · hunt |
| ATR-2026-00524 | Claude Code ANTHROPIC_BASE_URL Credential Exfiltration (CVE-2026-21852) | critical | test | alert · hunt |
| ATR-2026-00702 | Indirect PI — Credential / API Key Exfiltration via Agent Action | critical | stable | enforce · alert · hunt |
| ATR-2026-00703 | Indirect PI — Financial Data Exfiltration via Agent Action | critical | stable | enforce · alert · hunt |
| ATR-2026-00704 | Indirect PI — Medical / Genetic Data Exfiltration via Agent Action | critical | stable | enforce · alert · hunt |
| ATR-2026-00706 | Indirect PI — Physical / Biometric Media Exfiltration via Agent | critical | stable | enforce · alert · hunt |
| ATR-2026-00707 | Indirect PI — File Exfiltration Combined with Destroy or Tamper | critical | stable | enforce · alert · hunt |
| ATR-2026-00850 | Indirect PI — Credential Exfiltration via Email (API Key / Password / Token) | critical | stable | enforce · alert · hunt |
| ATR-2026-00851 | Indirect PI — Financial / Payment Credential Exfiltration via Agent Email | critical | stable | enforce · alert · hunt |
| ATR-2026-00852 | Indirect PI — Medical Record / Health Data Exfiltration via Agent Email | critical | stable | enforce · alert · hunt |
| ATR-2026-00853 | Indirect PI — Genetic / DNA Data Exfiltration via Agent Email | critical | stable | enforce · alert · hunt |
| ATR-2026-00854 | Indirect PI — Location / GPS Data Exfiltration via Agent Email | critical | test | alert · hunt |
| ATR-2026-00857 | Indirect PI — Cloud File Exfiltration (Google Drive / Cloud Storage via Agent) | critical | test | alert · hunt |
| ATR-2026-00858 | Indirect PI — Data Exfiltration with Evidence Destruction (Exfil-and-Delete) | critical | test | alert · hunt |
| ATR-2026-00859 | RAG-Injected PII Exfiltration — System Instructions Embedded in Retrieved Documents | critical | test | alert · hunt |
| ATR-2026-00860 | Indirect PI — Unauthorized Financial Transfer / Payment Initiation Hijack | critical | test | alert · hunt |
| ATR-2026-00861 | Indirect PI — Cryptocurrency Transfer / Exchange Deposit Hijack via Injection | critical | test | alert · hunt |
| ATR-2026-00862 | Indirect PI — MFA Code / OTP Security Code Exfiltration via Injection | critical | test | alert · hunt |
| ATR-2026-00863 | Shell Injection Data Exfiltration — Piped Command Exfiltration via Bash | critical | test | alert · hunt |
| ATR-2026-01453 | Markdown Image Injection with Base64 QUERY Exfiltration Carrier | critical | stable | enforce · alert · hunt |
| ATR-2026-01454 | Direct Markdown Image/Link Exfil Payload (attacker.com / evil.com) | critical | stable | enforce · alert · hunt |
| ATR-2026-01462 | System Prompt Override via Pseudo-Admin / Authority Injection | critical | stable | enforce · alert · hunt |
| ATR-2026-01464 | Indirect PI Sysprompt-Forged Action Hijack (system_message framing) | critical | test | alert · hunt |
| ATR-2026-01605 | SSRF AWS Instance Metadata Endpoint Access | critical | test | alert · hunt |
| ATR-2026-01607 | SSRF Localhost Service Probe | critical | test | alert · hunt |
| ATR-2026-01608 | SSRF File Scheme Local File Read | critical | test | alert · hunt |
| ATR-2026-01753 | Ransom Extortion: Email Exfil + Delete + Wire-Transfer Demand | critical | stable | enforce · alert · hunt |
| ATR-2026-01754 | Ransom Extortion: Cloud File Exfil + Delete + Payment Demand | critical | stable | enforce · alert · hunt |
| ATR-2026-01948 | netlicensing-mcp Path Traversal in product_number Bypasses Token Redaction (GHSA-hxpf-9xvq-wph8) | critical | test | alert · hunt |
| ATR-2026-01957 | M365 Copilot Business Chat SearchLeak Open-Redirect Prompt-Injection Exfil (CVE-2026-47645) | critical | test | alert · hunt |
| ATR-2026-01961 | Meta Ads MCP Unauthenticated Tool Execution Leaks META_ACCESS_TOKEN (CVE-2026-48039 / GHSA-9gw6-46qc-99vr) | critical | test | alert · hunt |
| ATR-2026-01964 | LangChain GmailToolkit Indirect Prompt Injection Email Exfiltration (CVE-2025-46059) | critical | test | alert · hunt |
| ATR-2026-01988 | Local Sensitive-File Read Chained to Outbound Exfiltration | critical | test | alert · hunt |
| ATR-2026-02190 | DNS Exfiltration via Ping/Dig/Nslookup Command with Data-Encoded Subdomain Label | critical | experimental | hunt |
| ATR-2026-02406 | MCP Tool Sequential Integer ID Enumeration (Cross-Tenant IDOR, CVE-2026-54052) | critical | test | alert · hunt |
| ATR-2026-02570 | Wallet Secret Material (Seed Phrase / Private Key) Carried Inside an MCP Tool Payload | critical | test | alert · hunt |
| ATR-2026-00020 | System Prompt and Internal Instruction Leakage | high | test | alert · hunt |
| ATR-2026-00075 | Agent Memory Manipulation | high | test | alert · hunt |
| ATR-2026-00102 | Data Exfiltration via Disguised Analytics Collection | high | test | alert · hunt |
| ATR-2026-00114 | OAuth and API Token Interception | high | test | alert · hunt |
| ATR-2026-00146 | Environment Variable Existence Probing | high | test | alert · hunt |
| ATR-2026-00152 | Obfuscated Credential Exfiltration via Encoding | high | test | alert · hunt |
| ATR-2026-00261 | Markdown Image URL Data Exfiltration | high | test | alert · hunt |
| ATR-2026-00274 | API Key / Secret Credential Generation or Completion Request | high | test | alert · hunt |
| ATR-2026-00275 | System Prompt Extraction / Training Data Verbatim Replay | high | test | alert · hunt |
| ATR-2026-00405 | Markdown Image URL Exfiltration and XSS Injection | high | test | alert · hunt |
| ATR-2026-00411 | API Key Generation and Partial Key Completion Request | high | test | alert · hunt |
| ATR-2026-00424 | Natural-Language System Prompt Leak Instruction | high | test | alert · hunt |
| ATR-2026-00431 | Chatbox History Exfiltration via Prompt Injection (CVE-2024-48144, CVE-2024-48145) | high | test | alert · hunt |
| ATR-2026-00449 | Spring AI ChatMemory Cross-User Memory Leakage (CVE-2026-41712) | high | test | alert · hunt |
| ATR-2026-00505 | System Prompt Extraction - Instruction Dump Request | high | test | alert · hunt |
| ATR-2026-00514 | System Prompt Extraction — Targeted Verbatim Disclosure Attempts | high | test | alert · hunt |
| ATR-2026-00516 | LLM Output XSS — Eliciting JavaScript Payloads from LLM for Browser Injection | high | test | alert · hunt |
| ATR-2026-00548 | Cross-agent session context leak across delegation chain | high | draft | hunt |
| ATR-2026-00566 | LibreChat is a ChatGPT clone with additional features. | high | test | alert · hunt |
| ATR-2026-00569 | Agent / MCP tool path traversal and arbitrary file access | high | test | alert · hunt |
| ATR-2026-00571 | Cross-site scripting (XSS) in agent / MCP rendered output | high | test | alert · hunt |
| ATR-2026-00574 | Paraphrased System-Prompt / Context Extraction (Semantic) | high | test | alert · hunt |
| ATR-2026-00578 | Zen MCP Server path-traversal blacklist bypass via non-canonical paths (CVE-2025-66689) | high | test | alert · hunt |
| ATR-2026-00580 | MCP session ID / auth token placed in URL query string (session leak via logs, referrer, history) | high | test | alert · hunt |
| ATR-2026-00583 | MCP/agent tool reads .env or secret file without user consent (OSV-MCPS-2025-EB70F912) | high | test | alert · hunt |
| ATR-2026-00705 | Indirect PI — Location, Address, and Browsing History Exfiltration | high | stable | enforce · alert · hunt |
| ATR-2026-00855 | Indirect PI — Browsing History / Search History Exfiltration via Agent Email | high | stable | enforce · alert · hunt |
| ATR-2026-00856 | Indirect PI — Physical Address / PII Exfiltration via Agent Email | high | stable | enforce · alert · hunt |
| ATR-2026-01450 | SVG onload XSS Injection via Indirect Prompt Injection | high | stable | enforce · alert · hunt |
| ATR-2026-01451 | IMG onerror XSS Injection via Indirect Prompt Injection | high | test | alert · hunt |
| ATR-2026-01452 | Obfuscated javascript: XSS — Evasion Variants (href, style-expression, null-byte) | high | test | alert · hunt |
| ATR-2026-01455 | NEW IMPORTANT INSTRUCTIONS Injection Marker in Document Context | high | stable | enforce · alert · hunt |
| ATR-2026-01456 | Debug/CLI Mode Activation for System Prompt and Config Extraction | high | test | alert · hunt |
| ATR-2026-01457 | System Prompt Completion and Clone Attack | high | stable | enforce · alert · hunt |
| ATR-2026-01459 | Variable-Clone Sysprompt Extraction (ELLA / context-variable Pattern) | high | stable | enforce · alert · hunt |
| ATR-2026-01460 | JSON Format Sysprompt Extraction — Structured Output Exfil | high | stable | enforce · alert · hunt |
| ATR-2026-01463 | im_end / im_start System Prompt Injection Format Markers | high | stable | enforce · alert · hunt |
| ATR-2026-01606 | SSRF Internal Network and Private IP Range Access | high | test | alert · hunt |
| ATR-2026-01770 | PII / Credential Extraction via Social Engineering, Obfuscation & Cross-Session Recall (Semantic) | high | test | alert · hunt |
| ATR-2026-01772 | Internal-State Reconnaissance — System Prompt, Config & Tool Enumeration (Semantic) | high | test | alert · hunt |
| ATR-2026-01807 | Bulk Data Exfiltration to External Party — Entire-Database Export & Confidential Disclosure | high | test | alert · hunt |
| ATR-2026-01862 | LLMail Email-Tool Exfiltration to Fixed Attacker Address | high | test | alert · hunt |
| ATR-2026-01863 | LLMail Post-Summary Exfiltration Directive to Attacker Address | high | test | alert · hunt |
| ATR-2026-01864 | LLMail Exfiltration to Obfuscated Attacker Address | high | test | alert · hunt |
| ATR-2026-01890 | Injected Code — Local File Exfiltration to a Remote Endpoint | high | stable | enforce · alert · hunt |
| ATR-2026-01891 | Injected Code — Live User-Activity / Location / Log Surveillance Exfiltration | high | stable | enforce · alert · hunt |
| ATR-2026-01892 | Injected Code — Environment-Variable Exfiltration | high | stable | enforce · alert · hunt |
| ATR-2026-01893 | Injected Code — Host / Hardware Inventory Exfiltration | high | stable | enforce · alert · hunt |
| ATR-2026-01894 | Injected Code — Browser Cookie / Session-Token Theft | high | stable | enforce · alert · hunt |
| ATR-2026-01895 | Injected Code — Contact-List Harvest and SMTP Spam Exfiltration | high | stable | enforce · alert · hunt |
| ATR-2026-01924 | System-Instruction Extraction via Reformat — Summarize / Repeat / Recite the Rules | high | test | alert · hunt |
| ATR-2026-01929 | Unauthenticated MCP transport accepts tool calls and falls back to an ambient credential (CVE-2026-48039 / meta-ads-mcp class) | high | test | alert · hunt |
| ATR-2026-01946 | Cloud-Metadata SSRF via Encoded Metadata-IP Bypass (CVE-2026-46678 / CVE-2026-25580 class) | high | test | alert · hunt |
| ATR-2026-01984 | MCP Server Kubernetes kubectl_generic Flag Injection Bearer Token Exfiltration (CVE-2026-47250) | high | test | alert · hunt |
| ATR-2026-02017 | Secret Key Exfiltration Request | high | test | alert · hunt |
| ATR-2026-02026 | System Prompt Extraction - Oblique Referent + Transform | high | test | alert · hunt |
| ATR-2026-02104 | MEDIA:/file:// Directive Injection in Tool Result for Local File Exfiltration | high | experimental | hunt |
| ATR-2026-02107 | SSRF via Non-IP Internal Hostname or Domain-Allowlist Authority Bypass | high | experimental | hunt |
| ATR-2026-02121 | MCP/API Tool Argument LFI via Mixed-Encoding Path Separator or file:// URI Scheme Escape | high | experimental | hunt |
| ATR-2026-02122 | Single-Level Directory Traversal to a Named Sensitive Config/Secret File | high | experimental | hunt |
| ATR-2026-02140 | SSRF to Cloud Metadata Endpoint via IPv6 Transition-Address Hex Encoding | high | experimental | hunt |
| ATR-2026-02250 | Attachment/Upload Tool Argument Reads Sensitive System File or Traverses Outside Workspace | high | experimental | hunt |
| ATR-2026-02262 | Environment-Variable-Resolution Credential Exfiltration via Redirected Endpoint (CVE-2026-56259) | high | test | alert · hunt |
| ATR-2026-02304 | Base64-Encoded Path Segment in a WebFetch URL to a Pre-Approved Trusted Domain (Covert Exfiltration Channel) | high | experimental | hunt |
| ATR-2026-02351 | SSRF to Cloud Metadata Endpoint via Wildcard-DNS Hostname-Encoded IP (nip.io/sslip.io/xip.io/traefik.me) | high | experimental | hunt |
| ATR-2026-02373 | Deserialized LangSmith Prompt Manifest Combines secrets_from_env With an Attacker base_url Override | high | experimental | hunt |
| ATR-2026-02602 | Diagram Theme Config Used to Inject Page-Wide CSS (scope escape, overlay, selector exfil) | high | test | alert · hunt |
| ATR-2026-02608 | LLM-Generated Graph Query Reaching a Remote Endpoint (APOC remote script, raw-IP load, remote export) | high | test | alert · hunt |
| ATR-2026-02621 | Prompt-Embedded Auto-Fetch Mention Pointed at an Internal Address | high | test | alert · hunt |
| ATR-2026-02623 | Dangerous URI Scheme Obfuscated by Interstitial Characters | high | test | alert · hunt |
| ATR-2026-02649 | Vendor API Hostname Used as a Label Prefix of Another Domain | high | test | alert · hunt |
| ATR-2026-02684 | File-Tool Argument Targets a Modern Credential Store Outside the Classic Path List | high | test | alert · hunt |
| ATR-2026-02703 | Agent-Generated SQL Reaches Outside the Database via COPY TO PROGRAM or a Server-Side File Read | high | test | alert · hunt |
| ATR-2026-02847 | Policy-Justified Email Exfiltration Pretext Detection | high | test | alert · hunt |
| ATR-2026-02850 | Fake Documentation Pretext Data Exfiltration via Email | high | test | alert · hunt |
| ATR-2026-02855 | Cross-Email Context Exfiltration Relay Detection | high | test | alert · hunt |
| ATR-2026-02861 | Injected Directive to Send Email with Attacker-Specified Body | high | test | alert · hunt |
| ATR-2026-00471 | Garak Sysprompt-Extraction - mixed_unassigned | medium | test | alert · hunt |
| ATR-2026-00504 | Tool and Function Capability Enumeration | medium | test | alert · hunt |
| ATR-2026-01458 | Compare-Bots Sysprompt Fishing — Role Comparison Extraction | medium | stable | enforce · alert · hunt |
| ATR-2026-01461 | Foreign-Language System Prompt Extraction Request | medium | test | alert · hunt |
| ATR-2026-02866 | Non-ASCII IDNA Label Separator Inside the Host of a Fetch-Tool URL Argument | medium | test | alert · hunt |
Page generated 2026-11-10Something wrong or missing? Open an issue