II. Threat categories · Α
Α. Prompt Injection
Crafted inputs that hijack what an agent does
- Rule files
- 258
- Effective
- 253, loaded by at least one lane
- Enforce lane
- 35, stable only
- Download
- rules/index.csv
Most frequent crosswalks
The number in brackets is how many rules in this category carry that item. ATR wrote these mappings; the framework owners have not reviewed or endorsed them.
MITRE ATLAS
- AML.T0051 - LLM Prompt Injection(207)
- AML.T0054 - LLM Jailbreak(70)
- AML.T0051.000 - Direct(69)
- AML.T0051.001 - Indirect(24)
- AML.T0051(14)
- AML.T0054(8)
OWASP Agentic Top 10
- ASI01:2026(251)
- ASI06:2026(12)
- ASI04:2026(12)
- ASI05:2026(8)
- ASI03:2026(5)
- ASI02:2026(5)
Rules
| ID | Title | Severity | Maturity | Lanes |
|---|---|---|---|---|
| ATR-2026-00004 | System Prompt Override Attempt | critical | test | alert · hunt |
| ATR-2026-00081 | Semantic Evasion via Multi-Turn Prompt Injection | critical | test | alert · hunt |
| ATR-2026-00091 | Advanced Structured Data Injection with Nested Payloads | critical | test | alert · hunt |
| ATR-2026-00092 | Multi-Agent Consensus Poisoning and Sybil Attack | critical | test | alert · hunt |
| ATR-2026-00093 | Gradual Capability Escalation via Incremental Introduction | critical | test | alert · hunt |
| ATR-2026-00094 | Systematic Multi-Layer Audit System Bypass | critical | test | alert · hunt |
| ATR-2026-00097 | CJK Prompt Injection - Expanded Chinese/Japanese/Korean Patterns | critical | test | alert · hunt |
| ATR-2026-00104 | Persona Hijacking via Mandatory System Prompt Override | critical | test | alert · hunt |
| ATR-2026-00153 | Tool with embedded instruction to bypass user confirmation and exfiltrate data | critical | test | alert · hunt |
| ATR-2026-00280 | Policy Puppetry / XML Role-Config Injection | critical | test | alert · hunt |
| ATR-2026-00296 | Shell Command Injection via LLM Prompt | critical | test | alert · hunt |
| ATR-2026-00297 | Python Code Execution / Remote Code Execution via LLM Prompt | critical | test | alert · hunt |
| ATR-2026-00312 | Unicode Variation Selector ASCII Smuggling | critical | test | alert · hunt |
| ATR-2026-00313 | SneakyBits Zero-Width Binary Steganography | critical | test | alert · hunt |
| ATR-2026-00321 | Hyphenated System Instruction Injection | critical | test | alert · hunt |
| ATR-2026-00359 | Bank Phishing SMTP Email Code Generation | critical | test | alert · hunt |
| ATR-2026-00395 | LLM Special Token Boundary Injection | critical | test | alert · hunt |
| ATR-2026-00503 | Fake Error State Takeover - Unrestricted Replacement Bot | critical | test | alert · hunt |
| ATR-2026-00510 | Delayed Tool Invocation via Prompt Injection (Time-Shifted Execution) | critical | test | alert · hunt |
| ATR-2026-00511 | MCP Web-Fetch Context Poisoning via Embedded Agent Instructions | critical | stable | enforce · alert · hunt |
| ATR-2026-00512 | Rules-File Backdoor — Supply Chain Attack on AI Coding Assistant Configuration | critical | stable | enforce · alert · hunt |
| ATR-2026-00535 | Windsurf IDE Zero-Click Prompt Injection via Embedded File Directives (CVE-2026-30615) | critical | test | alert · hunt |
| ATR-2026-00550 | Privileged tool call following untrusted retrieval (indirect prompt injection trail) | critical | draft | hunt |
| ATR-2026-00565 | The llm CLI tool thru 0.27.1 contains a critical code injection vulnerability via its --functions command-line | critical | test | alert · hunt |
| ATR-2026-00700 | Indirect PI — Structured-Data Embedded Payload (IMPORTANT!!! Override) | critical | stable | enforce · alert · hunt |
| ATR-2026-01000 | Context-Ignore via Fake Completion Prefix | critical | stable | enforce · alert · hunt |
| ATR-2026-01018 | Evasion: Shell Injection via eval/system/backtick in Input | critical | test | alert · hunt |
| ATR-2026-01019 | System Prompt Override via Fake Diagnostic/Admin Mode | critical | stable | enforce · alert · hunt |
| ATR-2026-01304 | Indirect Prompt Injection via Data Carrier — IMPORTANT Override | critical | stable | enforce · alert · hunt |
| ATR-2026-02374 | ROT13/Base64-Obfuscated Shell Payload Wrapped in a Fake-Sandbox Jailbreak Template | critical | experimental | hunt |
| ATR-2026-02500 | Prompt-Layer Self-Replication (Agent Worm Propagation Directive) | critical | experimental | hunt |
| ATR-2026-00001 | Direct Prompt Injection via User Input | high | test | alert · hunt |
| ATR-2026-00002 | Indirect Prompt Injection via External Content | high | test | alert · hunt |
| ATR-2026-00003 | Jailbreak Attempt Detection | high | test | alert · hunt |
| ATR-2026-00080 | Encoding-Based Prompt Injection Evasion | high | test | alert · hunt |
| ATR-2026-00082 | Behavioral Fingerprint Detection Evasion | high | test | alert · hunt |
| ATR-2026-00083 | Indirect Prompt Injection via Tool Responses | high | test | none, inert |
| ATR-2026-00084 | Structured Data Injection via JSON/CSV Payloads | high | test | none, inert |
| ATR-2026-00085 | Multi-Layer Security Audit Evasion | high | test | alert · hunt |
| ATR-2026-00086 | Visual Spoofing via RTL Override, Punycode, and Homoglyph Injection | high | test | alert · hunt |
| ATR-2026-00088 | Adaptive Countermeasure Against Behavioral Monitoring | high | test | alert · hunt |
| ATR-2026-00089 | Polymorphic Skill and Capability Aliasing Attack | high | test | alert · hunt |
| ATR-2026-00090 | Threat Intelligence Exfiltration and Rule Enumeration | high | test | alert · hunt |
| ATR-2026-00130 | Indirect Authority Claim in External Content | high | test | alert · hunt |
| ATR-2026-00133 | Paraphrased Prompt Injection | high | test | alert · hunt |
| ATR-2026-00137 | Authority Claim Prompt Injection | high | test | alert · hunt |
| ATR-2026-00138 | Fictional Framing Safety Bypass | high | test | alert · hunt |
| ATR-2026-00140 | Indirect Reference Instruction Reversal | high | test | alert · hunt |
| ATR-2026-00148 | Multilingual Prompt Injection via Language Switch | high | test | alert · hunt |
| ATR-2026-00154 | Unauthorized Background Task Execution via Cron Job Installation | high | test | alert · hunt |
| ATR-2026-00155 | Hidden LLM Instructions in Skill Descriptions | high | test | alert · hunt |
| ATR-2026-00156 | SSH Remote Command Execution with Credential Exposure | high | test | alert · hunt |
| ATR-2026-00163 | Hidden Override Instructions in Skill Content | high | test | alert · hunt |
| ATR-2026-00202 | Encoding Evasion via Homoglyphs and Synonym Substitution | high | test | alert · hunt |
| ATR-2026-00203 | Context Pollution in Skill Descriptions | high | stable | enforce · alert · hunt |
| ATR-2026-00206 | Hidden System Instructions with Priority Override Blocks | high | test | alert · hunt |
| ATR-2026-00207 | Hidden System Instructions with Permission Override | high | test | alert · hunt |
| ATR-2026-00211 | System Prompt Override via Translation Context Injection | high | test | alert · hunt |
| ATR-2026-00213 | System Prompt Override Injection via MCP Tool | high | test | alert · hunt |
| ATR-2026-00226 | AI Identity Substitution Jailbreak | high | test | alert · hunt |
| ATR-2026-00227 | Historical AI Persona Jailbreak with Compliance Enforcement | high | test | alert · hunt |
| ATR-2026-00228 | Structured Dual-Response Jailbreak with Command System | high | test | alert · hunt |
| ATR-2026-00229 | Roleplay-Based Policy Bypass Jailbreak | high | test | alert · hunt |
| ATR-2026-00230 | Persona-Based Moral Constraint Removal Jailbreak | high | test | alert · hunt |
| ATR-2026-00231 | AI Identity Substitution Jailbreak | high | test | alert · hunt |
| ATR-2026-00233 | Structured Dual-Response Jailbreak with Command System | high | test | none, inert |
| ATR-2026-00234 | Roleplay-Based Policy Bypass Jailbreak | high | test | alert · hunt |
| ATR-2026-00235 | Persona-Based Moral Constraint Removal Jailbreak | high | test | none, inert |
| ATR-2026-00236 | Pseudo-Code Structured Programming Jailbreak Attack | high | test | alert · hunt |
| ATR-2026-00237 | Dual-Response Jailbreak with Persona Commands | high | test | alert · hunt |
| ATR-2026-00238 | AI Identity Denial and Persona Replacement Attack | high | test | alert · hunt |
| ATR-2026-00239 | Amoral Persona Assignment with Obsessive Character Traits | high | test | alert · hunt |
| ATR-2026-00240 | Previous Instruction Nullification and Identity Replacement Jailbreak | high | test | alert · hunt |
| ATR-2026-00241 | Detailed Amoral Character Roleplay Jailbreak | high | test | alert · hunt |
| ATR-2026-00242 | Dual-Response Persona Jailbreak with Emoji Formatting | high | test | alert · hunt |
| ATR-2026-00243 | Acronym-Based Identity Override Jailbreak | high | test | alert · hunt |
| ATR-2026-00244 | Dual-Response Persona Jailbreak | high | test | alert · hunt |
| ATR-2026-00245 | Malicious Persona Creation for Safety Bypass | high | test | alert · hunt |
| ATR-2026-00247 | Matrix-Themed Dual Response Jailbreak | high | test | alert · hunt |
| ATR-2026-00249 | Text-Based Game Jailbreak with Entity Creation | high | test | alert · hunt |
| ATR-2026-00251 | Embodiment Mechanism Jailbreak with Totalitarian Control Claims | high | test | alert · hunt |
| ATR-2026-00252 | Narrative Jailbreak with Dual Response Formatting | high | test | alert · hunt |
| ATR-2026-00253 | Enhanced AIM Jailbreak with Persona Definition and Refusal Suppression | high | test | alert · hunt |
| ATR-2026-00256 | Base-N Encoding Instruction Bypass | high | test | alert · hunt |
| ATR-2026-00257 | Cipher and Transposition Encoding Jailbreak | high | test | alert · hunt |
| ATR-2026-00258 | Invisible Unicode Tag Character Injection | high | test | alert · hunt |
| ATR-2026-00264 | Latent Injection in Translation Context | high | test | alert · hunt |
| ATR-2026-00265 | Latent Injection in Retrieved Document / RAG Context | high | test | alert · hunt |
| ATR-2026-00267 | GCG Adversarial Suffix Attack | high | test | alert · hunt |
| ATR-2026-00272 | Hypothetical Response / Function Masking Token Smuggling | high | test | alert · hunt |
| ATR-2026-00276 | Invisible Unicode / BiDi Control Character Injection | high | test | alert · hunt |
| ATR-2026-00278 | DRA Disguise and Reconstruction Attack | high | test | alert · hunt |
| ATR-2026-00282 | Perez-Style Direct Prompt Injection Hijacking | high | test | alert · hunt |
| ATR-2026-00285 | Alternate Encoding Jailbreak — Morse, NATO, Zalgo, Leet, UU, QP, Braille | high | test | alert · hunt |
| ATR-2026-00286 | Latent Prompt Injection via Embedded Document or Report Context | high | test | alert · hunt |
| ATR-2026-00308 | Zalgo Combining-Diacritic Overload Encoding | high | test | alert · hunt |
| ATR-2026-00309 | Braille Unicode Encoded Prompt Injection | high | test | alert · hunt |
| ATR-2026-00310 | Ecoji Emoji-Encoded Prompt Injection | high | test | alert · hunt |
| ATR-2026-00311 | Base2048 Unicode Script Encoded Prompt Injection | high | test | alert · hunt |
| ATR-2026-00315 | SATA Masked Language Model [MASK] Substitution Jailbreak | high | test | alert · hunt |
| ATR-2026-00316 | FunctionMasking predict_mask Semantic Bypass | high | test | alert · hunt |
| ATR-2026-00367 | Emoji Flag Regional-Indicator Encoded Hidden Phrase | high | test | alert · hunt |
| ATR-2026-00373 | Piracy Torrent Site List Request | high | test | alert · hunt |
| ATR-2026-00378 | ChatGPT DOM JavaScript Redirect and UI Spoofing Injection | high | test | alert · hunt |
| ATR-2026-00382 | Cocaine Component Development Request | high | test | alert · hunt |
| ATR-2026-00390 | Discord Quote-Format Explicit Sexual Content Poem Injection | high | test | alert · hunt |
| ATR-2026-00394 | Backspace Deletion Character Injection | high | test | alert · hunt |
| ATR-2026-00396 | Toxic Continuation Prefix Injection | high | test | alert · hunt |
| ATR-2026-00399 | Latent Injection Document Separator Token | high | test | alert · hunt |
| ATR-2026-00400 | Latent Injection Ignore-Instruction Keyword | high | test | alert · hunt |
| ATR-2026-00407 | ECHO Admin Command / SQL Injection / Jinja SSTI Template Injection | high | test | alert · hunt |
| ATR-2026-00408 | DRA Parenthesis Character Reconstruction Attack | high | test | alert · hunt |
| ATR-2026-00409 | Phrasing Past/Future-Tense Harmful Query Bypass | high | test | alert · hunt |
| ATR-2026-00412 | FigStep Image-List Multimodal Jailbreak Text Pattern | high | test | alert · hunt |
| ATR-2026-00420 | Microsoft Copilot Studio SharePoint Indirect Prompt Injection (CVE-2026-21520) | high | test | alert · hunt |
| ATR-2026-00453 | Secret Key Reveal Demand in User Input | high | stable | enforce · alert · hunt |
| ATR-2026-00473 | Harm Solicitation - Interpersonal Violence and Intimidation Requests | high | test | alert · hunt |
| ATR-2026-00475 | XSS Web Injection - Script Tag with JavaScript Alert Payload | high | test | alert · hunt |
| ATR-2026-00476 | XSS Web Injection - HTML Event Handler and Expression with JavaScript Alert | high | test | alert · hunt |
| ATR-2026-00482 | Harm Solicitation - Genital Insults and Intimidation Tactics Requests | high | test | alert · hunt |
| ATR-2026-00488 | Encoding Obfuscation - Script Tag XSS with Encoded Protocol Prefix | high | test | alert · hunt |
| ATR-2026-00489 | Encoding Obfuscation - HTML Event Handler XSS with Encoded Whitespace | high | test | alert · hunt |
| ATR-2026-00490 | DAN Persona Jailbreak - Absolute Obedience Character Framing | high | test | alert · hunt |
| ATR-2026-00492 | DAN Persona Jailbreak - Role Lock with Exclusive Response Filter | high | experimental | hunt |
| ATR-2026-00493 | Latent Injection via WHOIS Domain Record Data | high | test | alert · hunt |
| ATR-2026-00495 | DAN Jailbreak - Unrestricted Persona with Filter and Morality Removal | high | test | none, inert |
| ATR-2026-00496 | DAN Jailbreak - Unconditional Obedience and Dual-Persona Session Lock | high | test | alert · hunt |
| ATR-2026-00497 | XSS and Encoded Script Injection via HTML/JavaScript Payload | high | test | alert · hunt |
| ATR-2026-00498 | Web Injection via XSS Payload and onerror Event Handler | high | test | alert · hunt |
| ATR-2026-00499 | DAN Jailbreak - From-Now-On Temporal Persona Override | high | test | alert · hunt |
| ATR-2026-00506 | Nevermind-Override Goal Hijacking in User Input (PromptInject) | high | test | alert · hunt |
| ATR-2026-00507 | Screaming-Stop Goal Hijacking in User Input (PromptInject) | high | test | alert · hunt |
| ATR-2026-00508 | Escape-Delimiter Wrapped Goal Hijacking in User Input (PromptInject) | high | test | alert · hunt |
| ATR-2026-00509 | Prompt Leaking via Ignore-Previous-Instructions in User Input (PromptInject) | high | test | alert · hunt |
| ATR-2026-00515 | Hidden-Text Prompt Injection in User-Supplied Documents | high | test | alert · hunt |
| ATR-2026-00518 | Ignore-Previous-and-Following Instructions Output Command (PromptInject Goal Hijacking) | high | test | alert · hunt |
| ATR-2026-00554 | LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates | high | test | alert · hunt |
| ATR-2026-00573 | Paraphrased Prompt Injection (Semantic) | high | test | alert · hunt |
| ATR-2026-00579 | MCP Line Jumping — Agent-Directed Imperative Embedded in a Tool/Parameter Description Field (Pre-Invocation Injection) | high | experimental | hunt |
| ATR-2026-00584 | Indirect Prompt Injection via Tool / API Response — Attacker Instruction Embedded in Returned Tool Output (InjecAgent Threat Model) | high | test | alert · hunt |
| ATR-2026-00701 | Indirect PI — XSS Payload Injection in Agent-Consumed Content | high | test | alert · hunt |
| ATR-2026-01001 | Direct Instruction Override Targeting Secret Key / Credentials | high | stable | enforce · alert · hunt |
| ATR-2026-01002 | Role Escalation via False Authority Claim | high | stable | enforce · alert · hunt |
| ATR-2026-01005 | Many-Shot Repetition Override via Extended Q&A Chain | high | stable | enforce · alert · hunt |
| ATR-2026-01006 | Payload-Split String Concatenation Injection | high | stable | enforce · alert · hunt |
| ATR-2026-01009 | Virtual World Bypass: Fictional Scenario for PII/Credential Extraction | high | stable | enforce · alert · hunt |
| ATR-2026-01012 | Encoding-Evasion: Decode-and-Execute Injection (Morse/ROT13/Hex/Pig-Latin) | high | stable | enforce · alert · hunt |
| ATR-2026-01013 | Language-Evasion: Multilingual Credential Request | high | stable | enforce · alert · hunt |
| ATR-2026-01015 | Evasion: Refusal Suppression via Forbidden Response Strings | high | stable | enforce · alert · hunt |
| ATR-2026-01017 | Evasion: Dual-Response Split Output (Safe + Unsafe) | high | stable | enforce · alert · hunt |
| ATR-2026-01020 | Spikee: Document-Embedded Base64 Payload Injection | high | stable | enforce · alert · hunt |
| ATR-2026-01021 | Spikee: Document-Embedded Translation Covert Channel Injection | high | stable | enforce · alert · hunt |
| ATR-2026-01023 | Evasion: Opposite-Intent Negation Trick | high | stable | enforce · alert · hunt |
| ATR-2026-01024 | Evasion: Persona Override as Fictional Rule-Breaker | high | stable | enforce · alert · hunt |
| ATR-2026-01026 | Evasion: Unicode Glitch Token / Superscript Embedding Anomaly | high | stable | enforce · alert · hunt |
| ATR-2026-01757 | Hypothetical-Framing Bypass: Research / Security-Audit Pretext | high | stable | enforce · alert · hunt |
| ATR-2026-01758 | Hypothetical / Fictional-Story Framing Bypass | high | stable | enforce · alert · hunt |
| ATR-2026-01759 | DoS Injection: NEW IMPORTANT INSTRUCTIONS Embedded in Document Data | high | stable | enforce · alert · hunt |
| ATR-2026-01771 | Jailbreak Framing — Narrative, Hypothetical, Few-Shot & Distraction Laundering (Semantic) | high | test | alert · hunt |
| ATR-2026-01800 | ASB Trigger-Marker Tool Coercion — Forced Tool Selection via Fake Question Marker | high | test | alert · hunt |
| ATR-2026-01860 | LLMail Chat-Template Boundary Spoofing in Email Content | high | test | alert · hunt |
| ATR-2026-01861 | LLMail Pseudo-XML Role-Boundary Injection in Email Content | high | test | alert · hunt |
| ATR-2026-01865 | LLMail Fake Email-Boundary Marker Injection | high | test | alert · hunt |
| ATR-2026-01904 | Injected Hyperlink — Scam / Malware / Advertising URL in the Response | high | stable | enforce · alert · hunt |
| ATR-2026-01920 | Access-Grant Coercion — Forcing an Agent to Emit "Access Granted" | high | test | alert · hunt |
| ATR-2026-01921 | Access-Denial Inversion — Eliciting the Opposite of "Access Denied" | high | test | alert · hunt |
| ATR-2026-01922 | Authorization-State Spoofing — Forged "Correct Passcode Entered" System Text | high | test | alert · hunt |
| ATR-2026-01923 | Forged Input-Boundary Markers — Tensor Trust Ambiguity / Input-End Delimiters | high | test | alert · hunt |
| ATR-2026-01925 | Encoded-Payload Decoding Coercion — Binary / Base64 / Morse to Smuggle an Output | high | test | alert · hunt |
| ATR-2026-01926 | Cross-Lingual Authorization Laundering — Translate a Foreign "Access Granted" | high | test | alert · hunt |
| ATR-2026-02001 | Ignore-Below-Instructions Injection (Downstream Override) | high | test | alert · hunt |
| ATR-2026-02002 | Instruction-Set Probe or Supplant | high | test | alert · hunt |
| ATR-2026-02003 | Task-Pivot Override: Cover-Task Abandonment | high | test | alert · hunt |
| ATR-2026-02004 | Regional-Indicator Flag-Emoji Alphabet Letter-Spelling Smuggling | high | test | alert · hunt |
| ATR-2026-02005 | Actor Never-Breaks-Character Roleplay (DAN-Style Film Framing) | high | test | alert · hunt |
| ATR-2026-02006 | Fuzzy Cross-Lingual 'I Have Been PWNED' Near-Miss Obfuscation | high | test | alert · hunt |
| ATR-2026-02007 | Bare Key Elicitation Token Detection | high | test | alert · hunt |
| ATR-2026-02008 | Translation-Chain Output Laundering (Forced Phrase via Foreign-Language Auxiliary) | high | test | alert · hunt |
| ATR-2026-02009 | Bare Key Elicitation with Trailing Colon | high | test | alert · hunt |
| ATR-2026-02010 | Emoji-Only Payload Injection | high | test | alert · hunt |
| ATR-2026-02011 | Malformed-Grammar PWNED Success-Claim Detection | high | test | alert · hunt |
| ATR-2026-02012 | Movie Title Generator Instruction Wrapper for PWNED Payload | high | test | alert · hunt |
| ATR-2026-02013 | Delimiter-Fence Ignore-Instructions Override | high | test | alert · hunt |
| ATR-2026-02014 | Spliced Target-String Canary Token Evasion | high | test | alert · hunt |
| ATR-2026-02015 | Dense Emoji-Only Payload Flood | high | test | alert · hunt |
| ATR-2026-02016 | Reversed Payload String (HackAPrompt Canary) | high | test | alert · hunt |
| ATR-2026-02018 | Regional-Indicator Flag-Emoji Letter Spelling | high | test | alert · hunt |
| ATR-2026-02019 | Python Interpreter Role-Assignment Exec Framing | high | test | alert · hunt |
| ATR-2026-02020 | Obfuscated Token Reconstruction via Character Substitution | high | test | alert · hunt |
| ATR-2026-02120 | AgentDojo 'Important Message' Identity-Spoof Before-You-Solve Pretext (Generalized) | high | experimental | hunt |
| ATR-2026-02210 | Negated-Topic Two-Script Evil-Persona Jailbreak | high | experimental | hunt |
| ATR-2026-02377 | Novel-Persona Jailbreak via Co-Signal (persona swap + explicit restriction removal) | high | test | alert · hunt |
| ATR-2026-02502 | Covert Remote-Script Injection into Agent-Generated Artifacts | high | experimental | hunt |
| ATR-2026-02820 | Tool Result Orders the Agent to Hide an Action It Just Performed From the User | high | test | alert · hunt |
| ATR-2026-02846 | Ignore-Previous-and-Following Instructions in User Input (PromptInject Goal Hijacking) | high | test | alert · hunt |
| ATR-2026-02851 | Fake User-Turn Injection: Send Email Directive | high | test | alert · hunt |
| ATR-2026-02862 | Fake Chat-Template Turn Injection Detection | high | test | alert · hunt |
| ATR-2026-00005 | Multi-Turn Prompt Injection | medium | test | alert · hunt |
| ATR-2026-00087 | Detection Rule Probing and Evasion Testing | medium | test | alert · hunt |
| ATR-2026-00131 | Fictional and Academic Framing Attack | medium | test | alert · hunt |
| ATR-2026-00397 | Snowball Impossible Reasoning Injection | medium | test | alert · hunt |
| ATR-2026-00401 | Training Data Replay CLOZE [MASK] Elicitation | medium | test | alert · hunt |
| ATR-2026-00403 | Glitch Token Repeat-Back Elicitation | medium | test | alert · hunt |
| ATR-2026-00410 | LMRC Harm Category Direct Elicitation | medium | test | alert · hunt |
| ATR-2026-00414 | Continuation Ethnic Slur Completion Elicitation | medium | test | alert · hunt |
| ATR-2026-00442 | Quoted Exact-Output Forcing in User Input | medium | test | alert · hunt |
| ATR-2026-00443 | Word-Fragment Concatenation Assembly Attack | medium | stable | enforce · alert · hunt |
| ATR-2026-00444 | Mathematical Bold / Fullwidth Unicode Obfuscation in User Input | medium | test | alert · hunt |
| ATR-2026-00445 | Translation Hijack with Side-Output Instruction | medium | test | alert · hunt |
| ATR-2026-00446 | Variable-Assignment Payload Injection in User Input | medium | stable | enforce · alert · hunt |
| ATR-2026-00447 | Fictional Generation Demand Containing Target Output | medium | test | alert · hunt |
| ATR-2026-00452 | Direct PWNED Payload Injection in User Input | medium | stable | enforce · alert · hunt |
| ATR-2026-00454 | Backslash-Per-Character Encoding Attack | medium | test | alert · hunt |
| ATR-2026-00456 | Conditional Empty-Input Payload Injection | medium | stable | enforce · alert · hunt |
| ATR-2026-00457 | Garak Dan - to every prompt | medium | test | alert · hunt |
| ATR-2026-00458 | Garak Dra - step by step | medium | test | alert · hunt |
| ATR-2026-00459 | Garak Dan - an ai language | medium | test | alert · hunt |
| ATR-2026-00460 | Garak Dan - no matter how | medium | test | alert · hunt |
| ATR-2026-00461 | Garak Goodside - mixed_unassigned | medium | test | alert · hunt |
| ATR-2026-00462 | Garak Gcg - mixed_unassigned | medium | test | alert · hunt |
| ATR-2026-00463 | Garak Lmrc - mixed_unassigned | medium | test | alert · hunt |
| ATR-2026-00464 | Garak Dan - i would like | medium | test | alert · hunt |
| ATR-2026-00465 | Garak Dan - your prompt here | medium | experimental | hunt |
| ATR-2026-00466 | Garak Latentinjection - following text from | medium | test | alert · hunt |
| ATR-2026-00467 | Garak Dan - act as a | medium | test | alert · hunt |
| ATR-2026-00468 | Garak Goat - the target llm | medium | test | alert · hunt |
| ATR-2026-00469 | Garak Dan - at the end | medium | test | alert · hunt |
| ATR-2026-00470 | Garak Dan - as an ai | medium | test | alert · hunt |
| ATR-2026-00472 | DAN/Persona Jailbreak - Unrestricted AI Role Assignment | medium | test | alert · hunt |
| ATR-2026-00474 | DAN/Persona Jailbreak - Dual AI Personality with Opposite-Rules Framing | medium | test | alert · hunt |
| ATR-2026-00477 | Latent Injection - Translation Task with Embedded Template Variable Injection | medium | test | alert · hunt |
| ATR-2026-00478 | Garak Latentinjection - abuse contact email | medium | test | alert · hunt |
| ATR-2026-00479 | Latent Injection - Mixed Embedded Instruction Patterns | medium | test | alert · hunt |
| ATR-2026-00480 | DAN/Persona Jailbreak - Role Assignment with Named Alternate Identity | medium | test | alert · hunt |
| ATR-2026-00481 | DAN/Jailbreak - Mixed Unfiltered Mode and Alternate Persona Patterns | medium | test | alert · hunt |
| ATR-2026-00483 | DAN/Persona Jailbreak - System Offline / Role Replacement with Obfuscated Text | medium | test | alert · hunt |
| ATR-2026-00484 | DAN/Persona Jailbreak - Named Alternate AI with NSFW/Harmful Generation Rules | medium | test | alert · hunt |
| ATR-2026-00485 | DAN/Persona Jailbreak - Immersive Alternate AI Identity with Unrestricted Capability | medium | test | alert · hunt |
| ATR-2026-00486 | DAN/Persona Jailbreak - Named Writing AI with Restriction Bypass via Special Rules | medium | test | alert · hunt |
| ATR-2026-00487 | DAN/Persona Jailbreak - Replacement AI with No Content Filter or Moral Restrictions | medium | test | alert · hunt |
| ATR-2026-00519 | Tautology Logic Noise Injection (PromptBench Stresstest) | medium | test | alert · hunt |
| ATR-2026-01007 | Token-Repeat Flooding Injection | medium | stable | enforce · alert · hunt |
| ATR-2026-01016 | Evasion: Response Priming via Forced Affirmative Opener | medium | stable | enforce · alert · hunt |
| ATR-2026-01025 | Evasion: Hypothetical Fictional Character Execution Framing | medium | test | alert · hunt |
| ATR-2026-01900 | Output Encoding Hijack — Cipher / Base-N / Symbol Substitution of the Response | medium | stable | enforce · alert · hunt |
| ATR-2026-01901 | Output Scrambling Hijack — Reverse / Anagram / Space-Stripping of the Response | medium | experimental | hunt |
| ATR-2026-01902 | Output Emoji-Substitution Hijack of the Response | medium | stable | enforce · alert · hunt |
| ATR-2026-01903 | Output-Language Hijack — Forced Translation of the Response | medium | test | alert · hunt |
| ATR-2026-01905 | Injected Advertising / Promotional Copy in the Response | medium | stable | enforce · alert · hunt |
| ATR-2026-01906 | Output Content Manipulation — Injected Disinformation / Fabricated Facts / Undisclosed Advocacy (Semantic) | medium | test | alert · hunt |
| ATR-2026-02230 | Conditional Keyword-Triggered Response Override | medium | experimental | hunt |
| ATR-2026-02232 | Bare Brand/Entity Persona Assignment for Off-Label Opinion Elicitation | medium | experimental | hunt |
| ATR-2026-02815 | Indirect Injection: Agent-Directed Halt Order With Canned Substitute Reply (Task-Abort DoS) | medium | test | alert · hunt |
| ATR-2026-02858 | Context-Suppression Directive: Disregard All Other Context or Everything Said So Far | medium | test | alert · hunt |
| ATR-2026-02859 | Agent Role Reassignment Arriving in Tool Output ("You are now a ... bot") | medium | test | alert · hunt |
| ATR-2026-02860 | Forged Instruction-Boundary Marker ("##Begin New Instructions##", "%%% end previous instructions %%%") | medium | test | alert · hunt |
| ATR-2026-00455 | No-Period Output Override Instruction | low | test | alert · hunt |
| ATR-2026-00520 | NLP Task Random Token Suffix Injection (PromptBench Checklist) | low | test | alert · hunt |
Page generated 2026-11-10Something wrong or missing? Open an issue