II. Threat categories · Η
Η. Excessive Autonomy
Agents going past the limits they were meant to work within
- Rule files
- 39
- Effective
- 38, loaded by at least one lane
- Enforce lane
- 10, stable only
- Download
- rules/index.csv
Most frequent crosswalks
The number in brackets is how many rules in this category carry that item. ATR wrote these mappings; the framework owners have not reviewed or endorsed them.
MITRE ATLAS
- AML.T0051 - LLM Prompt Injection(21)
- AML.T0053 - AI Agent Tool Invocation(14)
- AML.T0051.001 - Indirect(6)
- AML.T0050 - Command and Scripting Interpreter(3)
- AML.T0057 - LLM Data Leakage(3)
- AML.T0046 - Spamming AI System with Chaff Data(3)
OWASP Agentic Top 10
- ASI02:2026(15)
- ASI01:2026(14)
- ASI03:2026(13)
- ASI08:2026(6)
- ASI05:2026(6)
- ASI06:2026(5)
Rules
| ID | Title | Severity | Maturity | Lanes |
|---|---|---|---|---|
| ATR-2026-00098 | Unauthorized Financial Action by AI Agent | critical | test | alert · hunt |
| ATR-2026-00428 | Natural-Language Unauthorized Shell-Execution Instruction | critical | test | alert · hunt |
| ATR-2026-00500 | SSRF via Agent URL Fetch Instruction | critical | test | alert · hunt |
| ATR-2026-00708 | Indirect PI — Unauthorized Financial Transfer via Agent Tool | critical | stable | enforce · alert · hunt |
| ATR-2026-00709 | Indirect PI — Disable Authentication / MFA via Agent Tool | critical | stable | enforce · alert · hunt |
| ATR-2026-00710 | Indirect PI — Unauthorized Physical Access Grant via Smart Lock / Home Automation | critical | stable | enforce · alert · hunt |
| ATR-2026-00711 | Indirect PI — System Sabotage via Destructive Shell Command | critical | stable | enforce · alert · hunt |
| ATR-2026-00712 | Indirect PI — Malicious Package Installation via Agent (pip/npm) | critical | stable | enforce · alert · hunt |
| ATR-2026-00713 | Indirect PI — RCE via Network Shell Command (netcat/curl) Execution | critical | test | alert · hunt |
| ATR-2026-00722 | Indirect PI — Account Manipulation / Emergency Service Dispatch via Pretext | critical | stable | enforce · alert · hunt |
| ATR-2026-01801 | Autonomous-Vehicle Cyber-Physical Sabotage — Brake/Steering/Sensor Subversion Command | critical | test | alert · hunt |
| ATR-2026-01806 | Clinical Patient-Harm Directive — Overdose, Falsified Diagnosis, Phantom Billing & Care Neglect | critical | test | alert · hunt |
| ATR-2026-01837 | DDoS Attack Orchestration | critical | test | alert · hunt |
| ATR-2026-02401 | Rogue Agent Provisioning: Mass Connector Grant with Approval Disabled and Recurring Schedule (AgentForger) | critical | test | alert · hunt |
| ATR-2026-00050 | Runaway Agent Loop Detection | high | test | alert · hunt |
| ATR-2026-00051 | Agent Resource Exhaustion Detection | high | test | alert · hunt |
| ATR-2026-00052 | Cascading Failure Detection in Agent Pipelines | high | test | alert · hunt |
| ATR-2026-00491 | Agent Capability Enumeration via Structured Parse Request | high | test | alert · hunt |
| ATR-2026-00553 | Runaway tool-call loop within a single session | high | draft | none, inert |
| ATR-2026-00718 | Tool Misuse — Autonomous Financial Trading / Crypto Transaction Without Authorization | high | stable | enforce · alert · hunt |
| ATR-2026-00719 | Tool Misuse — Destructive Bulk Action via Agent (Delete All / Turn Off All) | high | stable | enforce · alert · hunt |
| ATR-2026-01751 | Indirect Prompt Injection: Fake-Authority Task Abort | high | stable | enforce · alert · hunt |
| ATR-2026-01752 | Indirect Prompt Injection: CAPTCHA Redirect Task Disruption | high | stable | enforce · alert · hunt |
| ATR-2026-01773 | Excessive Agency — Scope Hijack, Untrusted Code Execution & Unauthorized Privilege Grant (Semantic) | high | experimental | hunt |
| ATR-2026-01804 | Covert Unlogged Action — Directive to Hide an Action from Records or Detection | high | test | alert · hunt |
| ATR-2026-01805 | Financial Fraud Execution — Ponzi Setup, Fabricated Statements, Unauthorized Redirect & Laundering | high | test | alert · hunt |
| ATR-2026-01809 | Insider Manipulation & Process Corruption — Market/Data Tampering, Legal-Process Subversion & Pretextual Fund Movement (Semantic) | high | test | alert · hunt |
| ATR-2026-01838 | Unauthorized Cryptominer Deployment via SSH | high | test | alert · hunt |
| ATR-2026-01849 | Targeted Harassment Bot Deployment | high | test | alert · hunt |
| ATR-2026-01989 | Agent-Initiated Internal Network Service Sweep | high | test | alert · hunt |
| ATR-2026-01993 | Agent Disabling of Host Security Controls | high | test | alert · hunt |
| ATR-2026-01994 | Agent Establishing an Encrypted Reverse Channel or Tunnel | high | test | alert · hunt |
| ATR-2026-02106 | Catastrophic-Backtracking Regex Payload in a Search/Query Tool Argument | high | experimental | hunt |
| ATR-2026-02400 | Agent Human-Approval Gate Programmatically Disabled at Runtime (YOLO / auto-approve) | high | test | alert · hunt |
| ATR-2026-02409 | MCP 2026-07-28 Stateless Spec: Async Task Abuse and OAuth 2.1 Misuse | high | test | alert · hunt |
| ATR-2026-02525 | Shell Command-Word Reassembly via Parameter Expansion | high | test | alert · hunt |
| ATR-2026-02641 | Client-Supplied Approver Identity on an Approval Decision | high | test | alert · hunt |
| ATR-2026-02667 | Submitted Job Payload Carries Its Own Pre-Approved Tool List | high | test | alert · hunt |
| ATR-2026-00099 | High-Risk Tool Invocation Without Human Confirmation | low | test | alert · hunt |
Page generated 2026-11-10Something wrong or missing? Open an issue