II. Threat categories · Ζ
Ζ. Privilege Escalation
An agent gaining capabilities nobody authorised
- Rule files
- 77
- Effective
- 77, loaded by at least one lane
- Enforce lane
- 3, stable only
- Download
- rules/index.csv
Most frequent crosswalks
The number in brackets is how many rules in this category carry that item. ATR wrote these mappings; the framework owners have not reviewed or endorsed them.
MITRE ATLAS
- AML.T0053 - AI Agent Tool Invocation(22)
- AML.T0053 - LLM Plugin Compromise(17)
- AML.T0050 - Command and Scripting Interpreter(15)
- AML.T0049 - Exploit Public-Facing Application(8)
- AML.T0051 - LLM Prompt Injection(7)
- AML.T0043 - Craft Adversarial Data(5)
OWASP Agentic Top 10
- ASI03:2026(34)
- ASI02:2026(26)
- ASI05:2026(18)
- ASI06:2026(13)
- ASI04:2026(10)
- ASI07:2026(3)
Rules
| ID | Title | Severity | Maturity | Lanes |
|---|---|---|---|---|
| ATR-2026-00040 | Privilege Escalation and Admin Function Access | critical | test | alert · hunt |
| ATR-2026-00110 | Remote Code Execution via eval() and Dynamic Code Injection | critical | test | alert · hunt |
| ATR-2026-00111 | Shell Metacharacter Injection in Tool Arguments | critical | test | alert · hunt |
| ATR-2026-00436 | Enclave VM Sandbox Escape RCE (CVE-2026-27597) | critical | test | alert · hunt |
| ATR-2026-00441 | Microsoft Semantic Kernel SessionsPythonPlugin Arbitrary File Write + Startup Persistence (CVE-2026-25592) | critical | test | alert · hunt |
| ATR-2026-00451 | LiteLLM Proxy Authorization-Header SQL Injection — CISA KEV (CVE-2026-42208) | critical | test | alert · hunt |
| ATR-2026-00528 | PraisonAI-Style Auth-Disabled-By-Default Configuration (CVE-2026-44338 family) | critical | test | alert · hunt |
| ATR-2026-00539 | CrewAI CodeInterpreterTool Sandbox Escape and Prompt-to-Shell RCE (CVE-2026-2275 / VU#221883) | critical | test | alert · hunt |
| ATR-2026-00549 | Destructive tool invocation without prior human approval | critical | draft | hunt |
| ATR-2026-00551 | Cross-conversation memory write (scope-escape via memory store) | critical | draft | hunt |
| ATR-2026-01600 | SQL Injection Tautology RBAC Bypass | critical | test | alert · hunt |
| ATR-2026-01601 | SQL Injection Destructive DDL Statement | critical | stable | enforce · alert · hunt |
| ATR-2026-01602 | SQL Injection UNION SELECT Data Exfiltration | critical | stable | enforce · alert · hunt |
| ATR-2026-01603 | SQL Injection Stacked DML Privilege Abuse | critical | test | alert · hunt |
| ATR-2026-01609 | Shell Injection Env Exfiltration via Curl/Wget/Netcat Webhook | critical | test | alert · hunt |
| ATR-2026-01615 | Sandbox Escape via Shell Metacharacter Command Injection | critical | test | alert · hunt |
| ATR-2026-01802 | Covert Backdoor / Surveillance Implant via Software Update | critical | test | alert · hunt |
| ATR-2026-01803 | Covert Server Intrusion — Process Injection, Log Tampering, DNS Hijack & Traffic Interception | critical | test | alert · hunt |
| ATR-2026-01899 | Injected Code — Unauthorized Remote Access (SSH Key Backdoor / Tunnel / Port Forward) | critical | stable | enforce · alert · hunt |
| ATR-2026-01933 | LiteLLM User-Role Privilege Escalation (CVE-2026-47102) | critical | test | alert · hunt |
| ATR-2026-01934 | LiteLLM allowed_routes Authorization Bypass (CVE-2026-47101) | critical | test | alert · hunt |
| ATR-2026-01949 | PraisonAI MCPServer Unauthenticated HTTP tools/call Authentication Bypass (GHSA-j4f3-55x4-r6q2) | critical | test | alert · hunt |
| ATR-2026-01974 | AnythingLLM unauthenticated /system/data-import access control bypass (CVE-2024-3279) | critical | test | alert · hunt |
| ATR-2026-01986 | Windows-MCP Unauthenticated HTTP PowerShell via Wildcard CORS (CVE-2026-48989) | critical | test | alert · hunt |
| ATR-2026-01992 | Agent Weakening of Host Authentication Configuration | critical | test | alert · hunt |
| ATR-2026-02040 | Arbitrary Write to SSH Authorized Keys or Shell Startup File via Unvalidated File-Edit Tool | critical | experimental | hunt |
| ATR-2026-02100 | LLM-Generated Cypher Query Injection with Destructive or Administrative Operations | critical | experimental | hunt |
| ATR-2026-02101 | Python Sandbox Escape via Dynamically-Constructed Dunder Attribute Chain | critical | experimental | hunt |
| ATR-2026-02146 | Export/Extract Tool Directory Parameter Redirected to a Credential Directory | critical | experimental | hunt |
| ATR-2026-02195 | Dangerous Process-Hijacking Environment Variable Injected via Config/Env-Update Tool | critical | experimental | hunt |
| ATR-2026-02371 | Browser-Automation Tool Launch-Args Field Carries a Chromium Command-Replacing Switch | critical | experimental | hunt |
| ATR-2026-02404 | Mobile GUI Agent Model Output Reaching Host Shell / ADB Unsanitized | critical | test | alert · hunt |
| ATR-2026-02407 | Agent Workspace Boundary Escape via Host-Root Mount and Unprivileged Namespace Escalation (CVE-2026-46331) | critical | test | alert · hunt |
| ATR-2026-02627 | Web Shell Written Into a Web-Served Directory | critical | test | alert · hunt |
| ATR-2026-02642 | Agent Configuration Tool Used to Disable the Agent's Own Guardrail | critical | test | alert · hunt |
| ATR-2026-02681 | JavaScript Sandbox Escape by Acquiring the Function Constructor Reflectively | critical | test | alert · hunt |
| ATR-2026-00107 | Privilege Escalation via Delayed Task Execution Bypass | high | test | alert · hunt |
| ATR-2026-00112 | Dynamic Module Loading for Code Execution | high | test | alert · hunt |
| ATR-2026-00143 | Casual Unauthorized Privilege Escalation | high | test | alert · hunt |
| ATR-2026-00144 | Rationalized Safety Control Bypass | high | test | alert · hunt |
| ATR-2026-00204 | Stealth Execution and Persistence Mechanisms | high | test | alert · hunt |
| ATR-2026-00546 | CrewAI JSON Loader Arbitrary Local File Read (CVE-2026-2285) | high | test | alert · hunt |
| ATR-2026-00547 | CrewAI RAG URL Validation Bypass SSRF (CVE-2026-2286) | high | test | alert · hunt |
| ATR-2026-01604 | SQL Injection Information Schema Enumeration | high | test | alert · hunt |
| ATR-2026-01610 | Shell Evasion Subshell and Command Substitution Injection | high | experimental | hunt |
| ATR-2026-01611 | Shell Evasion Eval and Language-Level Exec Injection | high | test | alert · hunt |
| ATR-2026-01612 | Debug or Admin Mode Activation for Privilege Escalation | high | test | alert · hunt |
| ATR-2026-01613 | RBAC Bypass via Social Engineering (Semantic) | high | experimental | hunt |
| ATR-2026-01614 | BOLA Cross-User Data Access Attempt (Semantic) | high | experimental | hunt |
| ATR-2026-01616 | Path Traversal in Agent File Access Requests | high | test | alert · hunt |
| ATR-2026-01808 | Synthetic-PAN Payment Probe — Test Credit-Card Data Submitted to a Live Payment System | high | test | alert · hunt |
| ATR-2026-01981 | Network-AI ApprovalInbox Unauthenticated Cross-Origin Approval Bypass (GHSA-mxjx-28vx-xjjj) | high | test | alert · hunt |
| ATR-2026-02123 | Authentication Bypass via Bare Query-String Path-Confusion Suffix | high | experimental | hunt |
| ATR-2026-02142 | Download/Attachment Tool Directed to Write Outside Its Sandbox via Absolute-Path Filename | high | experimental | hunt |
| ATR-2026-02192 | Agent Self-Modifying Its Own Trust/Approval Configuration to a Wildcard | high | experimental | hunt |
| ATR-2026-02251 | Multi-Tenant Identifier Field (sender_id/owner_id/tenant_id) Carries Path Traversal Into a Storage Write | high | experimental | hunt |
| ATR-2026-02300 | MCP Stdio Server Config env Block Sets Dangerous Process-Hijacking Environment Variable | high | experimental | hunt |
| ATR-2026-02301 | Symlink Command Targets Sensitive Credential Path Outside the Workspace (Sandbox Escape Primitive) | high | experimental | hunt |
| ATR-2026-02302 | Git Worktree Created With Reserved Name .git (Directory-Confusion Sandbox Escape) | high | experimental | hunt |
| ATR-2026-02353 | Agent-Runtime Identifier Field (run_id/agent_id/session_id/task_id) Carries Path Traversal Into a History/Log File Read | high | experimental | hunt |
| ATR-2026-02370 | SSH/SCP MCP Tool hostAlias Argument Carries an OpenSSH Option-Injection Flag | high | experimental | hunt |
| ATR-2026-02402 | MCP Server Security Policy Fail-Open on Initialization Failure (CVE-2026-16584) | high | test | alert · hunt |
| ATR-2026-02528 | Option-Flag Smuggling in an LLM-Controlled Tool Parameter | high | test | alert · hunt |
| ATR-2026-02530 | Git Configuration Turned Into an Execution Hook by an Agent | high | test | alert · hunt |
| ATR-2026-02531 | Kusto Pipeline Injection Through a Table Identifier Parameter | high | test | alert · hunt |
| ATR-2026-02601 | Argument Injection: Execution-Bearing CLI Option Smuggled into a Tool Data Parameter | high | test | alert · hunt |
| ATR-2026-02620 | Code Execution via data: URI Module Specifier Handed to import() | high | test | alert · hunt |
| ATR-2026-02626 | Agent Writes a New MCP Server Into Its Own Trust Configuration | high | test | alert · hunt |
| ATR-2026-02644 | Image-Header Polyglot: Magic Bytes Adjacent to a Server-Side Script Payload | high | test | alert · hunt |
| ATR-2026-02648 | Write or Fetch Procedure Called Through a Read-Only Graph Query Tool | high | test | alert · hunt |
| ATR-2026-02664 | Git Identifier Field Carries an Option or ext:: Transport Instead of a Revision | high | test | alert · hunt |
| ATR-2026-02683 | Agent Tool Data Argument Carries a Program-Executing CLI Option | high | test | alert · hunt |
| ATR-2026-02700 | Percent-Encoded Path Traversal in an Agent File-Tool Argument | high | test | alert · hunt |
| ATR-2026-02705 | Python Sandbox Escape by Recovering builtins from a Bound Method or Lambda | high | test | alert · hunt |
| ATR-2026-02708 | Agent HTTP Request Claims a Loopback Origin While Targeting an External Host | high | test | alert · hunt |
| ATR-2026-02867 | Dot-Dot Path Segment Inside an Identifier-Typed Tool Argument (REST-Wrapper Path Traversal) | high | test | alert · hunt |
| ATR-2026-00041 | Agent Scope Creep Detection | medium | test | alert · hunt |
Page generated 2026-11-10Something wrong or missing? Open an issue