II. Threat categories · Θ
Θ. Data Poisoning
Tainted training data, memory or retrieval sources that bend what an agent does
- Rule files
- 9
- Effective
- 9, loaded by at least one lane
- Enforce lane
- 0, stable only
- Download
- rules/index.csv
Most frequent crosswalks
The number in brackets is how many rules in this category carry that item. ATR wrote these mappings; the framework owners have not reviewed or endorsed them.
MITRE ATLAS
- AML.T0051.001 - Indirect(4)
- AML.T0020 - Poison Training Data(2)
- AML.T0051 - LLM Prompt Injection(2)
- AML.T0053 - LLM Plugin Compromise(2)
- AML.T0070 - RAG Poisoning(1)
- AML.T0010 - AI Supply Chain Compromise(1)
OWASP Agentic Top 10
- ASI06:2026(4)
- ASI04:2026(2)
- ASI01:2026(2)
- ASI02:2026(2)
- ASI05:2026(1)
Rules
| ID | Title | Severity | Maturity | Lanes |
|---|---|---|---|---|
| ATR-2026-00070 | Data Poisoning via RAG and Knowledge Base Contamination | high | test | alert · hunt |
| ATR-2026-00450 | Spring AI PromptChatMemoryAdvisor Memory Poisoning (CVE-2026-41713) | high | test | alert · hunt |
| ATR-2026-00570 | SQL injection in agent / MCP tool database query | high | test | alert · hunt |
| ATR-2026-01774 | RAG & Memory Poisoning — Embedded Directives, Trigger Tokens, False Authority & Coercion (Semantic) | high | experimental | hunt |
| ATR-2026-02143 | Cypher/Graph-Query Injection via Unsanitized node_labels or group_ids Field | high | experimental | hunt |
| ATR-2026-02144 | Stored External Data Reframes Itself as an Administrative Request to Hijack System Prompt | high | experimental | hunt |
| ATR-2026-02303 | KQL/Kusto Pipe-Chain Injection via Table-Name Parameter in a 'Safe' Metadata Tool | high | experimental | hunt |
| ATR-2026-02408 | Dataset / Model Loader Remote-Code Execution via Poisoned Dataset Artifact | high | test | alert · hunt |
| ATR-2026-01155 | Direct Memory Plant Command — Persistent Fact or Code Storage Injection | medium | test | alert · hunt |
Page generated 2026-11-10Something wrong or missing? Open an issue