{"generated_at":"2026-11-10T08:04:15.746Z","versions":{"spec":"1.0.1","npm":"4.3.1","npm_verified":true,"package_json":"4.3.1"},"counts":{"files":844,"effective":836,"inert":8,"byLane":{"enforce":103,"alert":757,"hunt":836}},"calibers":{"files":"Rule YAML files under rules/ on the built commit.","effective":"Files the reference engine loads in at least one lane.","inert":"Files no lane loads: status draft or deprecated.","byLane.enforce":"Rules with maturity stable (the lane to run with blocking on).","byLane.alert":"Rules with maturity stable or test.","byLane.hunt":"Every effective rule (the engine default)."},"rules":[{"id":"ATR-2026-00001","title":"Direct Prompt Injection via User Input","category":"prompt-injection","subcategory":"direct","severity":"high","status":"stable","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":["CVE-2024-5184","CVE-2024-3402","CVE-2025-53773"],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026/03/08","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00001","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00001-direct-prompt-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00001-direct-prompt-injection.yaml"},{"id":"ATR-2026-00002","title":"Indirect Prompt Injection via External Content","category":"prompt-injection","subcategory":"indirect","severity":"high","status":"stable","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":["CVE-2024-5184","CVE-2024-22524","CVE-2025-32711","CVE-2026-24307"],"owasp_agentic":["ASI01:2026","ASI06:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.001 - Indirect"],"date":"2026/03/08","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00002","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00002-indirect-prompt-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00002-indirect-prompt-injection.yaml"},{"id":"ATR-2026-00003","title":"Jailbreak Attempt Detection","category":"prompt-injection","subcategory":"jailbreak","severity":"high","status":"stable","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":["CVE-2024-5184","CVE-2024-3402","CVE-2025-53773"],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/03/08","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00003","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00003-jailbreak-attempt.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00003-jailbreak-attempt.yaml"},{"id":"ATR-2026-00004","title":"System Prompt Override Attempt","category":"prompt-injection","subcategory":"system-prompt-override","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":["CVE-2024-5184","CVE-2025-32711"],"owasp_agentic":["ASI01:2026","ASI06:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026/03/08","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00004","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00004-system-prompt-override.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00004-system-prompt-override.yaml"},{"id":"ATR-2026-00005","title":"Multi-Turn Prompt Injection","category":"prompt-injection","subcategory":"multi-turn","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0043 - Craft Adversarial Data"],"date":"2026/03/08","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00005","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00005-multi-turn-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00005-multi-turn-injection.yaml"},{"id":"ATR-2026-00010","title":"Malicious Content in MCP Tool Response","category":"tool-poisoning","subcategory":"mcp-response-injection","severity":"critical","status":"stable","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":["CVE-2025-68143","CVE-2025-68144","CVE-2025-68145","CVE-2025-6514","CVE-2025-59536","CVE-2026-21852"],"owasp_agentic":["ASI02:2026","ASI05:2026"],"owasp_llm":["LLM01:2025","LLM05:2025"],"mitre_atlas":["AML.T0051.001 - Indirect","AML.T0056 - Extract LLM System Prompt"],"date":"2026/03/08","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00010","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00010-mcp-malicious-response.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00010-mcp-malicious-response.yaml"},{"id":"ATR-2026-00011","title":"Instruction Injection via Tool Output","category":"tool-poisoning","subcategory":"output-injection","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":["CVE-2025-59536","CVE-2025-32711"],"owasp_agentic":["ASI02:2026"],"owasp_llm":["LLM01:2025","LLM05:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation","AML.T0051.001 - Indirect"],"date":"2026/03/08","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00011","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00011-tool-output-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00011-tool-output-injection.yaml"},{"id":"ATR-2026-00012","title":"Unauthorized Tool Call Detection","category":"tool-poisoning","subcategory":"unauthorized-access","severity":"high","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI02:2026","ASI03:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation"],"date":"2026/03/08","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00012","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00012-unauthorized-tool-call.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00012-unauthorized-tool-call.yaml"},{"id":"ATR-2026-00013","title":"SSRF via Agent Tool Calls","category":"tool-poisoning","subcategory":"ssrf","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":["CVE-2019-5418","CVE-2021-21311","CVE-2026-55096"],"owasp_agentic":["ASI02:2026"],"owasp_llm":["LLM06:2025","LLM05:2025"],"mitre_atlas":["AML.T0049 - Exploit Public-Facing Application"],"date":"2026/03/08","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00013","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00013-tool-ssrf.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00013-tool-ssrf.yaml"},{"id":"ATR-2026-00020","title":"System Prompt and Internal Instruction Leakage","category":"context-exfiltration","subcategory":"system-prompt-leak","severity":"high","status":"stable","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":["CVE-2025-32711","CVE-2026-24307"],"owasp_agentic":["ASI01:2026","ASI06:2026"],"owasp_llm":["LLM07:2025","LLM02:2025"],"mitre_atlas":["AML.T0056 - Extract LLM System Prompt","AML.T0051 - LLM Prompt Injection"],"date":"2026/03/08","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00020","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00020-system-prompt-leak.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00020-system-prompt-leak.yaml"},{"id":"ATR-2026-00021","title":"Credential and Secret Exposure in Agent Output","category":"context-exfiltration","subcategory":"credential-exposure","severity":"critical","status":"stable","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":["CVE-2025-32711"],"owasp_agentic":["ASI03:2026"],"owasp_llm":["LLM02:2025","LLM07:2025"],"mitre_atlas":["AML.T0057 - LLM Data Leakage","AML.T0055 - Unsecured Credentials"],"date":"2026/03/08","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00021","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00021-api-key-exposure.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00021-api-key-exposure.yaml"},{"id":"ATR-2026-00030","title":"Cross-Agent Attack Detection","category":"agent-manipulation","subcategory":"cross-agent-attack","severity":"critical","status":"stable","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026","ASI07:2026","ASI10:2026"],"owasp_llm":["LLM01:2025","LLM06:2025","LLM05:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0043 - Craft Adversarial Data","AML.T0052.000 - Spearphishing via Social Engineering LLM"],"date":"2026/03/08","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00030","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00030-cross-agent-attack.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00030-cross-agent-attack.yaml"},{"id":"ATR-2026-00032","title":"Agent Goal Hijacking Detection","category":"agent-manipulation","subcategory":"goal-hijacking","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025","LLM06:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0043 - Craft Adversarial Data"],"date":"2026/03/08","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00032","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00032-goal-hijacking.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00032-goal-hijacking.yaml"},{"id":"ATR-2026-00040","title":"Privilege Escalation and Admin Function Access","category":"privilege-escalation","subcategory":"tool-permission-escalation","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":["CVE-2026-0628"],"owasp_agentic":["ASI03:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0050 - Command and Scripting Interpreter","AML.T0040 - AI Model Inference API Access"],"date":"2026/03/08","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00040","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-00040-privilege-escalation.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-00040-privilege-escalation.yaml"},{"id":"ATR-2026-00041","title":"Agent Scope Creep Detection","category":"privilege-escalation","subcategory":"scope-creep","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI03:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0040 - AI Model Inference API Access","AML.T0047 - AI-Enabled Product or Service"],"date":"2026/03/08","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00041","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-00041-scope-creep.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-00041-scope-creep.yaml"},{"id":"ATR-2026-00050","title":"Runaway Agent Loop Detection","category":"excessive-autonomy","subcategory":"runaway-loop","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI05:2026"],"owasp_llm":["LLM06:2025","LLM10:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation","AML.T0046 - Spamming AI System with Chaff Data"],"date":"2026/03/08","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00050","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-00050-runaway-agent-loop.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/excessive-autonomy/ATR-2026-00050-runaway-agent-loop.yaml"},{"id":"ATR-2026-00051","title":"Agent Resource Exhaustion Detection","category":"excessive-autonomy","subcategory":"resource-exhaustion","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI05:2026"],"owasp_llm":["LLM06:2025","LLM10:2025"],"mitre_atlas":["AML.T0046 - Spamming AI System with Chaff Data","AML.T0053 - AI Agent Tool Invocation"],"date":"2026/03/08","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00051","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-00051-resource-exhaustion.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/excessive-autonomy/ATR-2026-00051-resource-exhaustion.yaml"},{"id":"ATR-2026-00052","title":"Cascading Failure Detection in Agent Pipelines","category":"excessive-autonomy","subcategory":"cascading-failure","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI08:2026"],"owasp_llm":["LLM06:2025","LLM05:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation","AML.T0046 - Spamming AI System with Chaff Data"],"date":"2026/03/09","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00052","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-00052-cascading-failure.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/excessive-autonomy/ATR-2026-00052-cascading-failure.yaml"},{"id":"ATR-2026-00060","title":"MCP Skill Impersonation and Supply Chain Attack","category":"skill-compromise","subcategory":"skill-impersonation","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI04:2026"],"owasp_llm":["LLM03:2025","LLM05:2025"],"mitre_atlas":["AML.T0010 - AI Supply Chain Compromise","AML.T0115.002 - Publish Poisoned AI Artifacts: AI Agent Tools","AML.T0010.005 - AI Supply Chain Compromise of AI Agent Tool"],"date":"2026/03/08","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00060","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00060-skill-impersonation.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-00060-skill-impersonation.yaml"},{"id":"ATR-2026-00061","title":"Skill Description-Behavior Mismatch","category":"skill-compromise","subcategory":"description-mismatch","severity":"medium","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI04:2026"],"owasp_llm":["LLM03:2025","LLM05:2025"],"mitre_atlas":["AML.T0010 - AI Supply Chain Compromise","AML.T0056 - Extract LLM System Prompt"],"date":"2026/03/08","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00061","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00061-description-behavior-mismatch.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-00061-description-behavior-mismatch.yaml"},{"id":"ATR-2026-00062","title":"Hidden Capability in MCP Skill","category":"skill-compromise","subcategory":"hidden-capability","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":["CVE-2025-59536"],"owasp_agentic":["ASI02:2026","ASI05:2026"],"owasp_llm":["LLM03:2025","LLM06:2025"],"mitre_atlas":["AML.T0010 - AI Supply Chain Compromise"],"date":"2026/03/08","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00062","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00062-hidden-capability.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-00062-hidden-capability.yaml"},{"id":"ATR-2026-00063","title":"Multi-Skill Chain Attack","category":"skill-compromise","subcategory":"skill-chain","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI02:2026"],"owasp_llm":["LLM03:2025","LLM06:2025"],"mitre_atlas":["AML.T0024 - Exfiltration via AI Inference API","AML.T0053 - AI Agent Tool Invocation"],"date":"2026/03/08","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00063","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00063-skill-chain-attack.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-00063-skill-chain-attack.yaml"},{"id":"ATR-2026-00064","title":"Over-Permissioned MCP Skill","category":"skill-compromise","subcategory":"over-permissioned-skill","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI03:2026"],"owasp_llm":["LLM06:2025","LLM03:2025"],"mitre_atlas":["AML.T0040 - AI Model Inference API Access"],"date":"2026/03/08","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00064","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00064-over-permissioned-skill.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-00064-over-permissioned-skill.yaml"},{"id":"ATR-2026-00065","title":"Malicious Skill Update or Mutation","category":"skill-compromise","subcategory":"skill-update-attack","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI04:2026"],"owasp_llm":["LLM03:2025"],"mitre_atlas":["AML.T0010 - AI Supply Chain Compromise"],"date":"2026/03/08","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00065","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00065-skill-update-attack.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-00065-skill-update-attack.yaml"},{"id":"ATR-2026-00066","title":"Parameter Injection via Tool Arguments","category":"skill-compromise","subcategory":"parameter-injection","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":["CVE-2025-68143","CVE-2025-68144"],"owasp_agentic":["ASI02:2026"],"owasp_llm":["LLM01:2025","LLM05:2025"],"mitre_atlas":["AML.T0051.001 - Indirect"],"date":"2026/03/08","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00066","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00066-parameter-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-00066-parameter-injection.yaml"},{"id":"ATR-2026-00070","title":"Data Poisoning via RAG and Knowledge Base Contamination","category":"data-poisoning","subcategory":"rag-and-knowledge-poisoning","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI06:2026"],"owasp_llm":["LLM01:2025","LLM03:2025","LLM08:2025"],"mitre_atlas":["AML.T0051.001 - Indirect","AML.T0020 - Poison Training Data"],"date":"2026/03/08","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00070","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/data-poisoning/ATR-2026-00070-data-poisoning.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/data-poisoning/ATR-2026-00070-data-poisoning.yaml"},{"id":"ATR-2026-00072","title":"Model Behavior Extraction","category":"model-security","subcategory":"model-extraction","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI04:2026"],"owasp_llm":["LLM10:2025","LLM06:2025"],"mitre_atlas":["AML.T0044 - Full AI Model Access","AML.T0024 - Exfiltration via AI Inference API"],"date":"2026/03/08","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00072","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-security/ATR-2026-00072-model-behavior-extraction.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/model-security/ATR-2026-00072-model-behavior-extraction.yaml"},{"id":"ATR-2026-00073","title":"Malicious Fine-tuning Data","category":"model-security","subcategory":"malicious-finetuning","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI04:2026"],"owasp_llm":["LLM03:2025","LLM01:2025"],"mitre_atlas":["AML.T0020 - Poison Training Data","AML.T0018.000 - Poison AI Model"],"date":"2026/03/08","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00073","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-security/ATR-2026-00073-malicious-finetuning-data.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/model-security/ATR-2026-00073-malicious-finetuning-data.yaml"},{"id":"ATR-2026-00074","title":"Cross-Agent Privilege Escalation","category":"agent-manipulation","subcategory":"cross-agent-privilege-escalation","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI03:2026","ASI10:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0051.001 - Indirect"],"date":"2026/03/08","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00074","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00074-cross-agent-privilege-escalation.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00074-cross-agent-privilege-escalation.yaml"},{"id":"ATR-2026-00075","title":"Agent Memory Manipulation","category":"context-exfiltration","subcategory":"memory-manipulation","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI06:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0080 - AI Agent Context Poisoning"],"date":"2026/03/08","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00075","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00075-agent-memory-manipulation.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00075-agent-memory-manipulation.yaml"},{"id":"ATR-2026-00076","title":"Insecure Inter-Agent Communication Detection","category":"agent-manipulation","subcategory":"inter-agent-communication","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI07:2026"],"owasp_llm":["LLM06:2025","LLM05:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0043 - Craft Adversarial Data"],"date":"2026/03/09","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00076","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00076-inter-agent-message-spoofing.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00076-inter-agent-message-spoofing.yaml"},{"id":"ATR-2026-00077","title":"Human-Agent Trust Exploitation Detection","category":"agent-manipulation","subcategory":"human-trust-exploitation","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI09:2026"],"owasp_llm":["LLM06:2025","LLM09:2025"],"mitre_atlas":["AML.T0048 - External Harms"],"date":"2026/03/09","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00077","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00077-human-trust-exploitation.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00077-human-trust-exploitation.yaml"},{"id":"ATR-2026-00080","title":"Encoding-Based Prompt Injection Evasion","category":"prompt-injection","subcategory":"encoding-evasion","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051"],"date":"2026/03/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00080","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00080-encoding-evasion.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00080-encoding-evasion.yaml"},{"id":"ATR-2026-00081","title":"Semantic Evasion via Multi-Turn Prompt Injection","category":"prompt-injection","subcategory":"semantic-evasion","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051"],"date":"2026/03/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00081","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00081-semantic-multi-turn.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00081-semantic-multi-turn.yaml"},{"id":"ATR-2026-00082","title":"Behavioral Fingerprint Detection Evasion","category":"prompt-injection","subcategory":"fingerprint-evasion","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051"],"date":"2026/03/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00082","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00082-fingerprint-evasion.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00082-fingerprint-evasion.yaml"},{"id":"ATR-2026-00083","title":"Indirect Prompt Injection via Tool Responses","category":"prompt-injection","subcategory":"indirect-injection","severity":"high","status":"draft","maturity":"test","lanes":[],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051"],"date":"2026/03/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00083","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00083-indirect-tool-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00083-indirect-tool-injection.yaml"},{"id":"ATR-2026-00084","title":"Structured Data Injection via JSON/CSV Payloads","category":"prompt-injection","subcategory":"structured-data-injection","severity":"high","status":"draft","maturity":"test","lanes":[],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051"],"date":"2026/03/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00084","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00084-structured-data-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00084-structured-data-injection.yaml"},{"id":"ATR-2026-00085","title":"Multi-Layer Security Audit Evasion","category":"prompt-injection","subcategory":"audit-evasion","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051"],"date":"2026/03/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00085","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00085-audit-evasion.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00085-audit-evasion.yaml"},{"id":"ATR-2026-00086","title":"Visual Spoofing via RTL Override, Punycode, and Homoglyph Injection","category":"prompt-injection","subcategory":"visual-spoofing","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051"],"date":"2026/03/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00086","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00086-visual-spoofing.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00086-visual-spoofing.yaml"},{"id":"ATR-2026-00087","title":"Detection Rule Probing and Evasion Testing","category":"prompt-injection","subcategory":"rule-probing","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051"],"date":"2026/03/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00087","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00087-rule-probing.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00087-rule-probing.yaml"},{"id":"ATR-2026-00088","title":"Adaptive Countermeasure Against Behavioral Monitoring","category":"prompt-injection","subcategory":"monitoring-countermeasure","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051"],"date":"2026/03/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00088","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00088-adaptive-countermeasure.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00088-adaptive-countermeasure.yaml"},{"id":"ATR-2026-00089","title":"Polymorphic Skill and Capability Aliasing Attack","category":"prompt-injection","subcategory":"polymorphic-evasion","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051"],"date":"2026/03/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00089","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00089-polymorphic-skill.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00089-polymorphic-skill.yaml"},{"id":"ATR-2026-00090","title":"Threat Intelligence Exfiltration and Rule Enumeration","category":"prompt-injection","subcategory":"intel-exfiltration","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051"],"date":"2026/03/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00090","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00090-threat-intel-exfil.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00090-threat-intel-exfil.yaml"},{"id":"ATR-2026-00091","title":"Advanced Structured Data Injection with Nested Payloads","category":"prompt-injection","subcategory":"nested-data-injection","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051"],"date":"2026/03/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00091","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00091-nested-payload.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00091-nested-payload.yaml"},{"id":"ATR-2026-00092","title":"Multi-Agent Consensus Poisoning and Sybil Attack","category":"prompt-injection","subcategory":"consensus-poisoning","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0010"],"date":"2026/03/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00092","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00092-consensus-poisoning.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00092-consensus-poisoning.yaml"},{"id":"ATR-2026-00093","title":"Gradual Capability Escalation via Incremental Introduction","category":"prompt-injection","subcategory":"gradual-escalation","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051"],"date":"2026/03/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00093","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00093-gradual-escalation.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00093-gradual-escalation.yaml"},{"id":"ATR-2026-00094","title":"Systematic Multi-Layer Audit System Bypass","category":"prompt-injection","subcategory":"systematic-audit-bypass","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051"],"date":"2026/03/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00094","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00094-audit-bypass.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00094-audit-bypass.yaml"},{"id":"ATR-2026-00095","title":"MCP Tool Supply Chain Poisoning","category":"tool-poisoning","subcategory":"supply-chain-attack","severity":"critical","status":"draft","maturity":"test","lanes":[],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI05:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0053"],"date":"2026/03/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00095","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00095-supply-chain-poisoning.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00095-supply-chain-poisoning.yaml"},{"id":"ATR-2026-00096","title":"Skill Registry Poisoning and Compromised Tool Distribution","category":"tool-poisoning","subcategory":"registry-poisoning","severity":"critical","status":"draft","maturity":"test","lanes":[],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI04:2026","ASI05:2026"],"owasp_llm":["LLM03:2025"],"mitre_atlas":["AML.T0010.005 - AI Agent Tool","AML.T0011.001 - Malicious Package"],"date":"2026/03/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00096","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00096-registry-poisoning.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00096-registry-poisoning.yaml"},{"id":"ATR-2026-00097","title":"CJK Prompt Injection - Expanded Chinese/Japanese/Korean Patterns","category":"prompt-injection","subcategory":"cjk-social-engineering","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026","ASI08:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.001 - Indirect"],"date":"2026/03/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00097","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00097-cjk-injection-patterns.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00097-cjk-injection-patterns.yaml"},{"id":"ATR-2026-00098","title":"Unauthorized Financial Action by AI Agent","category":"excessive-autonomy","subcategory":"unauthorized-financial-action","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI08:2026","ASI09:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation"],"date":"2026/03/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00098","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-00098-unauthorized-financial-action.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/excessive-autonomy/ATR-2026-00098-unauthorized-financial-action.yaml"},{"id":"ATR-2026-00099","title":"High-Risk Tool Invocation Without Human Confirmation","category":"excessive-autonomy","subcategory":"high-risk-tool-gate","severity":"low","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI08:2026","ASI09:2026","ASI10:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation"],"date":"2026/03/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00099","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-00099-high-risk-tool-gate.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/excessive-autonomy/ATR-2026-00099-high-risk-tool-gate.yaml"},{"id":"ATR-2026-00100","title":"Consent Bypass via Hidden LLM Instructions in Tool Descriptions","category":"tool-poisoning","subcategory":"consent-bypass-instruction","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI02:2026","ASI04:2026","ASI09:2026"],"owasp_llm":["LLM01:2025","LLM06:2025"],"mitre_atlas":["AML.T0110 - AI Agent Tool Poisoning","AML.T0086 - Exfiltration via AI Agent Tool Invocation"],"date":"2026/03/15","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00100","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00100-consent-bypass-instruction.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00100-consent-bypass-instruction.yaml"},{"id":"ATR-2026-00101","title":"Trust Escalation via Authority Override Instructions","category":"tool-poisoning","subcategory":"trust-escalation-override","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026","ASI02:2026"],"owasp_llm":["LLM01:2025","LLM06:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation"],"date":"2026/03/15","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00101","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00101-trust-escalation-override.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00101-trust-escalation-override.yaml"},{"id":"ATR-2026-00102","title":"Data Exfiltration via Disguised Analytics Collection","category":"context-exfiltration","subcategory":"disguised-analytics-collection","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI04:2026","ASI02:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0086 - Exfiltration via AI Agent Tool Invocation","AML.T0057 - LLM Data Leakage"],"date":"2026/03/15","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00102","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00102-disguised-analytics-exfiltration.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00102-disguised-analytics-exfiltration.yaml"},{"id":"ATR-2026-00103","title":"Hidden LLM Safety Bypass Instructions in Tool Descriptions","category":"tool-poisoning","subcategory":"hidden-llm-instructions","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025","LLM07:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0110.000 - AI Agent Tool Poisoning: Definition and Instructions"],"date":"2026/03/15","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00103","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00103-hidden-safety-bypass-instruction.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00103-hidden-safety-bypass-instruction.yaml"},{"id":"ATR-2026-00104","title":"Persona Hijacking via Mandatory System Prompt Override","category":"prompt-injection","subcategory":"persona-hijacking","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026","ASI10:2026"],"owasp_llm":["LLM01:2025","LLM07:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/03/15","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00104","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00104-persona-hijacking.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00104-persona-hijacking.yaml"},{"id":"ATR-2026-00105","title":"Silent Action Concealment Instructions in Tool Descriptions","category":"tool-poisoning","subcategory":"silent-action-instruction","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI04:2026","ASI02:2026","ASI09:2026"],"owasp_llm":["LLM01:2025","LLM06:2025"],"mitre_atlas":["AML.T0110 - AI Agent Tool Poisoning"],"date":"2026/03/15","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00105","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00105-silent-action-concealment.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00105-silent-action-concealment.yaml"},{"id":"ATR-2026-00106","title":"Schema-Description Contradiction Attack","category":"tool-poisoning","subcategory":"schema-description-mismatch","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI02:2026","ASI04:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0110 - AI Agent Tool Poisoning"],"date":"2026/03/15","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00106","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00106-schema-description-contradiction.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00106-schema-description-contradiction.yaml"},{"id":"ATR-2026-00107","title":"Privilege Escalation via Delayed Task Execution Bypass","category":"privilege-escalation","subcategory":"delayed-execution-bypass","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI03:2026","ASI05:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation"],"date":"2026/03/15","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00107","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-00107-delayed-execution-bypass.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-00107-delayed-execution-bypass.yaml"},{"id":"ATR-2026-00108","title":"Multi-Agent Consensus Sybil Attack","category":"agent-manipulation","subcategory":"consensus-sybil-attack","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI10:2026","ASI07:2026","ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0043 - Craft Adversarial Data"],"date":"2026/03/16","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00108","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00108-consensus-sybil-attack.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00108-consensus-sybil-attack.yaml"},{"id":"ATR-2026-00110","title":"Remote Code Execution via eval() and Dynamic Code Injection","category":"privilege-escalation","subcategory":"eval-injection","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI05:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0050 - Command and Scripting Interpreter"],"date":"2026/03/26","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00110","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-00110-eval-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-00110-eval-injection.yaml"},{"id":"ATR-2026-00111","title":"Shell Metacharacter Injection in Tool Arguments","category":"privilege-escalation","subcategory":"shell-escape","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI05:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0050 - Command and Scripting Interpreter"],"date":"2026/03/26","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00111","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-00111-shell-escape.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-00111-shell-escape.yaml"},{"id":"ATR-2026-00112","title":"Dynamic Module Loading for Code Execution","category":"privilege-escalation","subcategory":"dynamic-import-exploitation","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI05:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0050 - Command and Scripting Interpreter"],"date":"2026/03/26","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00112","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-00112-dynamic-import-exploitation.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-00112-dynamic-import-exploitation.yaml"},{"id":"ATR-2026-00113","title":"Credential File Theft from Agent Environment","category":"context-exfiltration","subcategory":"credential-theft","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI03:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0057 - LLM Data Leakage"],"date":"2026/03/26","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00113","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00113-credential-theft.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00113-credential-theft.yaml"},{"id":"ATR-2026-00114","title":"OAuth and API Token Interception","category":"context-exfiltration","subcategory":"oauth-token-abuse","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI03:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0057 - LLM Data Leakage"],"date":"2026/03/26","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00114","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00114-oauth-token-abuse.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00114-oauth-token-abuse.yaml"},{"id":"ATR-2026-00115","title":"Bulk Environment Variable Harvesting and Exfiltration","category":"context-exfiltration","subcategory":"env-var-harvesting","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI03:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0057 - LLM Data Leakage"],"date":"2026/03/26","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00115","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00115-env-var-harvesting.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00115-env-var-harvesting.yaml"},{"id":"ATR-2026-00116","title":"Malicious Agent-to-Agent Message Injection","category":"agent-manipulation","subcategory":"a2a-message-validation","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI07:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/03/26","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00116","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00116-a2a-message-validation.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00116-a2a-message-validation.yaml"},{"id":"ATR-2026-00117","title":"Agent Identity Spoofing and Authority Impersonation","category":"agent-manipulation","subcategory":"agent-identity-spoofing","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI07:2026","ASI10:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/03/26","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00117","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00117-agent-identity-spoofing.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00117-agent-identity-spoofing.yaml"},{"id":"ATR-2026-00118","title":"Human Approval Fatigue Exploitation","category":"agent-manipulation","subcategory":"approval-fatigue","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI09:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/03/26","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00118","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00118-approval-fatigue.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00118-approval-fatigue.yaml"},{"id":"ATR-2026-00119","title":"Social Engineering Attack via Agent Output","category":"agent-manipulation","subcategory":"social-engineering-via-agent","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI09:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/03/26","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00119","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00119-social-engineering-via-agent.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00119-social-engineering-via-agent.yaml"},{"id":"ATR-2026-00120","title":"SKILL.md Prompt Injection","category":"skill-compromise","subcategory":"skill-instruction-injection","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"skill","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0010 - AI Supply Chain Compromise"],"date":"2026/03/29","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00120","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00120-skill-instruction-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-00120-skill-instruction-injection.yaml"},{"id":"ATR-2026-00121","title":"Malicious Code in Skill Package","category":"skill-compromise","subcategory":"dangerous-script","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"skill","cves":["CVE-2026-25253 (CVSS 8.8) - OpenClaw RCE"],"owasp_agentic":["ASI04:2026","ASI05:2026"],"owasp_llm":["LLM03:2025"],"mitre_atlas":["AML.T0010 - AI Supply Chain Compromise"],"date":"2026/03/29","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00121","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00121-skill-dangerous-script.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-00121-skill-dangerous-script.yaml"},{"id":"ATR-2026-00122","title":"Weaponized Skill — Agent as Attack Tool","category":"skill-compromise","subcategory":"weaponized-skill","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"skill","cves":[],"owasp_agentic":["ASI05:2026","ASI01:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0010 - AI Supply Chain Compromise"],"date":"2026/03/29","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00122","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00122-skill-weaponized-instruction.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-00122-skill-weaponized-instruction.yaml"},{"id":"ATR-2026-00123","title":"Over-Privileged Skill — Excessive Permissions","category":"skill-compromise","subcategory":"skill-overreach","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"skill","cves":["CVE-2025-53773 - Copilot auto-approve escalation"],"owasp_agentic":["ASI03:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0010 - AI Supply Chain Compromise"],"date":"2026/03/29","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00123","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00123-skill-overreach-permissions.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-00123-skill-overreach-permissions.yaml"},{"id":"ATR-2026-00124","title":"Skill Squatting / Typosquatting","category":"skill-compromise","subcategory":"skill-squatting","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"skill","cves":[],"owasp_agentic":["ASI04:2026"],"owasp_llm":["LLM03:2025"],"mitre_atlas":["AML.T0010 - AI Supply Chain Compromise"],"date":"2026/03/29","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00124","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00124-skill-name-squatting.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-00124-skill-name-squatting.yaml"},{"id":"ATR-2026-00125","title":"Context Poisoning via Compaction Survival","category":"skill-compromise","subcategory":"context-poisoning","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"skill","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0010 - AI Supply Chain Compromise","AML.T0080 - AI Agent Context Poisoning"],"date":"2026/04/05","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00125","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00125-context-poisoning-compaction.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-00125-context-poisoning-compaction.yaml"},{"id":"ATR-2026-00126","title":"Skill Rug Pull Setup Pattern","category":"skill-compromise","subcategory":"rug-pull","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"skill","cves":[],"owasp_agentic":["ASI04:2026"],"owasp_llm":["LLM05:2025"],"mitre_atlas":["AML.T0010 - AI Supply Chain Compromise","AML.T0109 - AI Supply Chain Rug Pull","AML.T0010.005 - AI Supply Chain Compromise of AI Agent Tool"],"date":"2026/04/05","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00126","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00126-skill-rug-pull-setup.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-00126-skill-rug-pull-setup.yaml"},{"id":"ATR-2026-00127","title":"Subcommand Overflow Bypass","category":"skill-compromise","subcategory":"subcommand-overflow","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"skill","cves":[],"owasp_agentic":["ASI04:2026","ASI02:2026"],"owasp_llm":["LLM03:2025"],"mitre_atlas":["AML.T0010 - AI Supply Chain Compromise"],"date":"2026/04/05","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00127","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00127-subcommand-overflow.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-00127-subcommand-overflow.yaml"},{"id":"ATR-2026-00128","title":"Hidden Payload in HTML Comment","category":"skill-compromise","subcategory":"hidden-payload","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"skill","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0010 - AI Supply Chain Compromise"],"date":"2026/04/05","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00128","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00128-html-comment-hidden-payload.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-00128-html-comment-hidden-payload.yaml"},{"id":"ATR-2026-00129","title":"Unicode Tag Character Smuggling","category":"skill-compromise","subcategory":"unicode-smuggling","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"skill","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0010 - AI Supply Chain Compromise"],"date":"2026/04/05","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00129","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00129-unicode-smuggling.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-00129-unicode-smuggling.yaml"},{"id":"ATR-2026-00130","title":"Indirect Authority Claim in External Content","category":"prompt-injection","subcategory":"indirect-authority","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026","ASI06:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/01","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00130","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00130-indirect-authority-claim.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00130-indirect-authority-claim.yaml"},{"id":"ATR-2026-00131","title":"Fictional and Academic Framing Attack","category":"prompt-injection","subcategory":"framing-attack","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/01","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00131","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00131-fictional-academic-framing.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00131-fictional-academic-framing.yaml"},{"id":"ATR-2026-00132","title":"Casual Authority Claim and Scope Escalation","category":"agent-manipulation","subcategory":"casual-authority","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI07:2026","ASI10:2026","ASI09:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/01","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00132","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00132-casual-authority-escalation.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00132-casual-authority-escalation.yaml"},{"id":"ATR-2026-00133","title":"Paraphrased Prompt Injection","category":"prompt-injection","subcategory":"paraphrase","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/01","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00133","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00133-paraphrase-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00133-paraphrase-injection.yaml"},{"id":"ATR-2026-00134","title":"Fork Claim and Community Package Impersonation","category":"skill-compromise","subcategory":"fork-impersonation","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"skill","cves":[],"owasp_agentic":["ASI04:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0010 - AI Supply Chain Compromise","AML.T0010.005 - AI Supply Chain Compromise of AI Agent Tool"],"date":"2026/04/01","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00134","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00134-fork-claim-impersonation.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-00134-fork-claim-impersonation.yaml"},{"id":"ATR-2026-00135","title":"Data Exfiltration URL in Skill Instructions","category":"skill-compromise","subcategory":"data-exfiltration","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"skill","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0010 - AI Supply Chain Compromise"],"date":"2026/04/05","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00135","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00135-exfil-url-in-instructions.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-00135-exfil-url-in-instructions.yaml"},{"id":"ATR-2026-00136","title":"Tool Response Data Piggybacking","category":"context-exfiltration","subcategory":"tool-response-piggyback","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI02:2026","ASI03:2026"],"owasp_llm":["LLM02:2025","LLM01:2025"],"mitre_atlas":["AML.T0055 - Unsecured Credentials","AML.T0057 - LLM Data Leakage"],"date":"2026/04/06","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00136","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00136-tool-response-data-piggyback.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00136-tool-response-data-piggyback.yaml"},{"id":"ATR-2026-00137","title":"Authority Claim Prompt Injection","category":"prompt-injection","subcategory":"authority-claim","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/07","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00137","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00137-authority-claim-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00137-authority-claim-injection.yaml"},{"id":"ATR-2026-00138","title":"Fictional Framing Safety Bypass","category":"prompt-injection","subcategory":"fictional-framing","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/07","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00138","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00138-fictional-framing-bypass.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00138-fictional-framing-bypass.yaml"},{"id":"ATR-2026-00139","title":"Casual Authority Data Redirect","category":"agent-manipulation","subcategory":"casual-authority-redirect","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI03:2026","ASI06:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/07","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00139","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00139-casual-authority-redirect.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00139-casual-authority-redirect.yaml"},{"id":"ATR-2026-00140","title":"Indirect Reference Instruction Reversal","category":"prompt-injection","subcategory":"indirect-reference-reversal","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/07","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00140","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00140-indirect-reference-reversal.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00140-indirect-reference-reversal.yaml"},{"id":"ATR-2026-00141","title":"API Key Leakage via Example Format","category":"context-exfiltration","subcategory":"example-format-leak","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI08:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0057 - LLM Data Leakage"],"date":"2026/04/07","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00141","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00141-example-format-key-leak.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00141-example-format-key-leak.yaml"},{"id":"ATR-2026-00142","title":"Data Piggybacking via Casual Transition Words","category":"context-exfiltration","subcategory":"piggyback-transition","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI02:2026","ASI03:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0055 - Unsecured Credentials","AML.T0057 - LLM Data Leakage"],"date":"2026/04/07","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00142","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00142-piggyback-transition-words.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00142-piggyback-transition-words.yaml"},{"id":"ATR-2026-00143","title":"Casual Unauthorized Privilege Escalation","category":"privilege-escalation","subcategory":"casual-escalation","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI03:2026","ASI10:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation"],"date":"2026/04/07","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00143","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-00143-casual-privilege-escalation.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-00143-casual-privilege-escalation.yaml"},{"id":"ATR-2026-00144","title":"Rationalized Safety Control Bypass","category":"privilege-escalation","subcategory":"rationalized-bypass","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI03:2026","ASI10:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation"],"date":"2026/04/07","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00144","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-00144-rationalized-safety-bypass.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-00144-rationalized-safety-bypass.yaml"},{"id":"ATR-2026-00145","title":"Obfuscated API Key Disclosure","category":"context-exfiltration","subcategory":"obfuscated-key","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI08:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0057 - LLM Data Leakage"],"date":"2026/04/07","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00145","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00145-obfuscated-key-disclosure.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00145-obfuscated-key-disclosure.yaml"},{"id":"ATR-2026-00146","title":"Environment Variable Existence Probing","category":"context-exfiltration","subcategory":"env-var-probe","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI08:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0057 - LLM Data Leakage"],"date":"2026/04/07","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00146","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00146-env-var-existence-probe.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00146-env-var-existence-probe.yaml"},{"id":"ATR-2026-00147","title":"Community Fork Impersonation","category":"skill-compromise","subcategory":"fork-impersonation","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI04:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0010 - AI Supply Chain Compromise"],"date":"2026/04/07","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00147","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00147-fork-impersonation.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-00147-fork-impersonation.yaml"},{"id":"ATR-2026-00148","title":"Multilingual Prompt Injection via Language Switch","category":"prompt-injection","subcategory":"language-switch","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/07","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00148","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00148-language-switch-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00148-language-switch-injection.yaml"},{"id":"ATR-2026-00149","title":"Skill Data Exfiltration via Compound Patterns","category":"skill-compromise","subcategory":"data-exfiltration","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"skill","cves":[],"owasp_agentic":["ASI04:2026","ASI05:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0010 - AI Supply Chain Compromise"],"date":"2026/04/08","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00149","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00149-skill-exfil-compound.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-00149-skill-exfil-compound.yaml"},{"id":"ATR-2026-00150","title":"Credential Data Leaked in Tool Response","category":"context-exfiltration","subcategory":"credential-in-response","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI03:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0055 - Unsecured Credentials","AML.T0057 - LLM Data Leakage"],"date":"2026/04/08","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00150","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00150-credential-in-tool-response.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00150-credential-in-tool-response.yaml"},{"id":"ATR-2026-00151","title":"Malicious Fork Impersonation via Install Instruction","category":"skill-compromise","subcategory":"fork-impersonation","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI04:2026"],"owasp_llm":["LLM03:2025"],"mitre_atlas":["AML.T0010 - AI Supply Chain Compromise"],"date":"2026/04/08","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00151","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00151-fork-impersonation-install.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-00151-fork-impersonation-install.yaml"},{"id":"ATR-2026-00152","title":"Obfuscated Credential Exfiltration via Encoding","category":"context-exfiltration","subcategory":"obfuscated-credential","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI03:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0055 - Unsecured Credentials","AML.T0057 - LLM Data Leakage"],"date":"2026/04/08","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00152","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00152-obfuscated-credential-leak.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00152-obfuscated-credential-leak.yaml"},{"id":"ATR-2026-00153","title":"Tool with embedded instruction to bypass user confirmation and exfiltrate data","category":"prompt-injection","subcategory":"confirmation-bypass-instruction","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":null,"cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/06","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00153","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00153-tool-with-embedded-instruction-to-bypass.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00153-tool-with-embedded-instruction-to-bypass.yaml"},{"id":"ATR-2026-00154","title":"Unauthorized Background Task Execution via Cron Job Installation","category":"prompt-injection","subcategory":"unauthorized-background-execution","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":null,"cves":[],"owasp_agentic":["ASI04:2026","ASI10:2026","ASI02:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation"],"date":"2026/04/06","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00154","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00154-unauthorized-background-task-execution-v.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00154-unauthorized-background-task-execution-v.yaml"},{"id":"ATR-2026-00155","title":"Hidden LLM Instructions in Skill Descriptions","category":"prompt-injection","subcategory":"hidden-llm-instructions","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":null,"cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/06","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00155","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00155-hidden-llm-instructions-in-skill-descrip.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00155-hidden-llm-instructions-in-skill-descrip.yaml"},{"id":"ATR-2026-00156","title":"SSH Remote Command Execution with Credential Exposure","category":"prompt-injection","subcategory":"ssh-credential-exposure","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":null,"cves":[],"owasp_agentic":["ASI03:2026","ASI02:2026"],"owasp_llm":["LLM06:2025","LLM02:2025"],"mitre_atlas":["AML.T0055 - Unsecured Credentials","AML.T0050 - Command and Scripting Interpreter"],"date":"2026/04/06","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00156","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00156-ssh-remote-command-execution-with-creden.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00156-ssh-remote-command-execution-with-creden.yaml"},{"id":"ATR-2026-00157","title":"Time-Gated Credential Exfiltration (Rug Pull Timebomb)","category":"skill-compromise","subcategory":"timebomb-exfil","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"skill","cves":[],"owasp_agentic":["ASI04:2026","ASI03:2026"],"owasp_llm":["LLM02:2025","LLM03:2025"],"mitre_atlas":["AML.T0055 - Unsecured Credentials","AML.T0010 - AI Supply Chain Compromise","AML.T0025 - Exfiltration via Cyber Means"],"date":"2026/04/10","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00157","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00157-timebomb-credential-exfil.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-00157-timebomb-credential-exfil.yaml"},{"id":"ATR-2026-00161","title":"MCP Tool Description — IMPORTANT Tag Cross-Tool Shadowing Attack","category":"tool-poisoning","subcategory":"important-tag-shadowing","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI03:2026","ASI07:2026"],"owasp_llm":["LLM01:2025","LLM03:2025"],"mitre_atlas":["AML.T0051.001 - Indirect","AML.T0053 - AI Agent Tool Invocation","AML.T0110.000 - AI Agent Tool Poisoning: Definition and Instructions","AML.T0115.002 - Publish Poisoned AI Artifacts: AI Agent Tools"],"date":"2026/04/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00161","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00161-important-tag-cross-tool-shadowing.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00161-important-tag-cross-tool-shadowing.yaml"},{"id":"ATR-2026-00162","title":"Credential Access with Exfiltration in Skill Instructions","category":"context-exfiltration","subcategory":"credential-exfil-combo","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"skill","cves":[],"owasp_agentic":["ASI02:2026","ASI03:2026","ASI04:2026"],"owasp_llm":["LLM02:2025","LLM06:2025"],"mitre_atlas":["AML.T0055 - Unsecured Credentials","AML.T0086 - Exfiltration via AI Agent Tool Invocation"],"date":"2026/04/14","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00162","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00162-skill-credential-exfil-combo.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00162-skill-credential-exfil-combo.yaml"},{"id":"ATR-2026-00163","title":"Hidden Override Instructions in Skill Content","category":"prompt-injection","subcategory":"skill-hidden-override","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"skill","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/14","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00163","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00163-skill-hidden-override-instruction.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00163-skill-hidden-override-instruction.yaml"},{"id":"ATR-2026-00164","title":"Skill Scope Hijacking and Cross-Agent Escalation","category":"agent-manipulation","subcategory":"skill-scope-hijack","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"skill","cves":[],"owasp_agentic":["ASI03:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/14","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00164","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00164-skill-scope-hijack.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00164-skill-scope-hijack.yaml"},{"id":"ATR-2026-00200","title":"Agent Memory and Configuration File Tampering","category":"skill-compromise","subcategory":"memory-tampering","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":null,"cves":[],"owasp_agentic":["ASI04:2026","ASI07:2026"],"owasp_llm":["LLM01:2025","LLM06:2025"],"mitre_atlas":["AML.T0051.001 - Indirect"],"date":"2026/04/05","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00200","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00200-agent-memory-config-tampering.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-00200-agent-memory-config-tampering.yaml"},{"id":"ATR-2026-00201","title":"Credential Exfiltration via Shell Pipe","category":"context-exfiltration","subcategory":"credential-pipe","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":null,"cves":[],"owasp_agentic":["ASI02:2026","ASI03:2026"],"owasp_llm":["LLM02:2025","LLM06:2025"],"mitre_atlas":["AML.T0055 - Unsecured Credentials","AML.T0086 - Exfiltration via AI Agent Tool Invocation"],"date":"2026/04/05","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00201","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00201-credential-pipe-exfiltration.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00201-credential-pipe-exfiltration.yaml"},{"id":"ATR-2026-00202","title":"Encoding Evasion via Homoglyphs and Synonym Substitution","category":"prompt-injection","subcategory":"encoding-evasion","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":null,"cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/05","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00202","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00202-encoding-evasion-homoglyph-synonym.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00202-encoding-evasion-homoglyph-synonym.yaml"},{"id":"ATR-2026-00203","title":"Context Pollution in Skill Descriptions","category":"prompt-injection","subcategory":"context-pollution","severity":"high","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":null,"cves":[],"owasp_agentic":["ASI01:2026","ASI07:2026"],"owasp_llm":["LLM01:2025","LLM07:2025"],"mitre_atlas":["AML.T0051.001 - Indirect"],"date":"2026/04/05","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00203","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00203-context-pollution-skill-description.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00203-context-pollution-skill-description.yaml"},{"id":"ATR-2026-00204","title":"Stealth Execution and Persistence Mechanisms","category":"privilege-escalation","subcategory":"stealth-persistence","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":null,"cves":[],"owasp_agentic":["ASI02:2026","ASI05:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0050 - Command and Scripting Interpreter"],"date":"2026/04/05","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00204","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-00204-stealth-execution-persistence.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-00204-stealth-execution-persistence.yaml"},{"id":"ATR-2026-00206","title":"Hidden System Instructions with Priority Override Blocks","category":"prompt-injection","subcategory":"hidden-priority-instructions","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"skill","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/08","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00206","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00206-hidden-priority-instructions.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00206-hidden-priority-instructions.yaml"},{"id":"ATR-2026-00207","title":"Hidden System Instructions with Permission Override","category":"prompt-injection","subcategory":"hidden-instructions","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"skill","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/08","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00207","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00207-hidden-instructions.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00207-hidden-instructions.yaml"},{"id":"ATR-2026-00209","title":"MCPwn Runaway Tool Invocation via Retry Directive (CVE-2026-33032)","category":"tool-poisoning","subcategory":"runaway-invocation","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":["CVE-2026-33032"],"owasp_agentic":["ASI08:2026","ASI03:2026"],"owasp_llm":["LLM01:2025","LLM09:2025"],"mitre_atlas":["AML.T0051.001 - Indirect","AML.T0040 - AI Model Inference API Access"],"date":"2026/04/22","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00209","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00209-mcpwn-runaway-invocation.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00209-mcpwn-runaway-invocation.yaml"},{"id":"ATR-2026-00210","title":"Flowise System Message Override via Template Interpolation (CVE-2025-59528)","category":"tool-poisoning","subcategory":"template-injection-rce","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"skill","cves":["CVE-2025-59528"],"owasp_agentic":["ASI01:2026","ASI05:2026"],"owasp_llm":["LLM01:2025","LLM05:2025"],"mitre_atlas":["AML.T0051.001 - Indirect","AML.T0040 - AI Model Inference API Access"],"date":"2026/04/22","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00210","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00210-flowise-system-message-override.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00210-flowise-system-message-override.yaml"},{"id":"ATR-2026-00211","title":"System Prompt Override via Translation Context Injection","category":"prompt-injection","subcategory":"system-prompt-override","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"skill","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/09","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00211","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00211-system-prompt-override.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00211-system-prompt-override.yaml"},{"id":"ATR-2026-00212","title":"mcp-atlassian Credential Leak via Hint Parameter Injection (CVE-2026-27825/27826)","category":"context-exfiltration","subcategory":"hint-parameter-injection","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"skill","cves":["CVE-2026-27825","CVE-2026-27826"],"owasp_agentic":["ASI06:2026","ASI01:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051.001 - Indirect","AML.T0056 - Extract LLM System Prompt"],"date":"2026/04/22","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00212","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00212-mcp-atlassian-credential-leak.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00212-mcp-atlassian-credential-leak.yaml"},{"id":"ATR-2026-00213","title":"System Prompt Override Injection via MCP Tool","category":"prompt-injection","subcategory":"system-prompt-override","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/09","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00213","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00213-system-prompt-override.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00213-system-prompt-override.yaml"},{"id":"ATR-2026-00214","title":"Credential Exfiltration via Fake Backup Verification","category":"skill-compromise","subcategory":"credential-theft","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI03:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0010 - AI Supply Chain Compromise"],"date":"2026/04/09","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00214","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00214-credential-theft.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-00214-credential-theft.yaml"},{"id":"ATR-2026-00217","title":"Credential Harvesting via Fake Backup Tool","category":"skill-compromise","subcategory":"credential-harvesting","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI04:2026"],"owasp_llm":["LLM02:2025","LLM03:2025"],"mitre_atlas":["AML.T0055 - Unsecured Credentials","AML.T0025 - Exfiltration via Cyber Means"],"date":"2026/04/10","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00217","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00217-credential-harvesting.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-00217-credential-harvesting.yaml"},{"id":"ATR-2026-00220","title":"Base64 Encoded Remote Code Execution via Raw IP","category":"skill-compromise","subcategory":"malware-dropper","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI04:2026"],"owasp_llm":["LLM07:2025"],"mitre_atlas":["AML.T0048"],"date":"2026/04/10","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00220","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00220-malware-dropper.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-00220-malware-dropper.yaml"},{"id":"ATR-2026-00222","title":"Browser Credential Harvesting via Session Debug Tool","category":"skill-compromise","subcategory":"credential-harvesting","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI04:2026","ASI02:2026","ASI03:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0055 - Unsecured Credentials","AML.T0113 - Steal Web Session Cookie","AML.T0025 - Exfiltration via Cyber Means"],"date":"2026/04/10","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00222","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00222-credential-harvesting.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-00222-credential-harvesting.yaml"},{"id":"ATR-2026-00223","title":"Malicious WhatsApp Skill with Base64 Encoded Reverse Shell Installation","category":"skill-compromise","subcategory":"reverse-shell-dropper","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI05:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051"],"date":"2026/04/10","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00223","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00223-reverse-shell-dropper.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-00223-reverse-shell-dropper.yaml"},{"id":"ATR-2026-00224","title":"Credential Exfiltration via Fake DevOps Tool Initialization","category":"skill-compromise","subcategory":"credential-exfiltration","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI04:2026"],"owasp_llm":["LLM02:2025","LLM03:2025"],"mitre_atlas":["AML.T0055 - Unsecured Credentials","AML.T0025 - Exfiltration via Cyber Means"],"date":"2026/04/10","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00224","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00224-credential-exfiltration.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-00224-credential-exfiltration.yaml"},{"id":"ATR-2026-00225","title":"Hardcoded Suspicious IP Address in Skill Content","category":"skill-compromise","subcategory":"c2-communication","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"skill","cves":[],"owasp_agentic":["ASI04:2026"],"owasp_llm":["LLM09:2025"],"mitre_atlas":["AML.T0048"],"date":"2026/04/15","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00225","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00225-c2-communication.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-00225-c2-communication.yaml"},{"id":"ATR-2026-00226","title":"AI Identity Substitution Jailbreak","category":"prompt-injection","subcategory":"identity-substitution","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/18","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00226","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00226-identity-substitution.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00226-identity-substitution.yaml"},{"id":"ATR-2026-00227","title":"Historical AI Persona Jailbreak with Compliance Enforcement","category":"prompt-injection","subcategory":"historical-persona-jailbreak","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0054"],"date":"2026/04/18","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00227","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00227-historical-persona-jailbreak.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00227-historical-persona-jailbreak.yaml"},{"id":"ATR-2026-00228","title":"Structured Dual-Response Jailbreak with Command System","category":"prompt-injection","subcategory":"structured-jailbreak","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0054 - LLM Jailbreak"],"date":"2026/04/18","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00228","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00228-structured-jailbreak.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00228-structured-jailbreak.yaml"},{"id":"ATR-2026-00229","title":"Roleplay-Based Policy Bypass Jailbreak","category":"prompt-injection","subcategory":"roleplay-jailbreak","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0054 - LLM Jailbreak"],"date":"2026/04/18","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00229","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00229-roleplay-jailbreak.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00229-roleplay-jailbreak.yaml"},{"id":"ATR-2026-00230","title":"Persona-Based Moral Constraint Removal Jailbreak","category":"prompt-injection","subcategory":"persona-moral-bypass","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0054"],"date":"2026/04/18","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00230","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00230-persona-moral-bypass.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00230-persona-moral-bypass.yaml"},{"id":"ATR-2026-00231","title":"AI Identity Substitution Jailbreak","category":"prompt-injection","subcategory":"identity-substitution","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/18","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00231","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00231-identity-substitution.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00231-identity-substitution.yaml"},{"id":"ATR-2026-00233","title":"Structured Dual-Response Jailbreak with Command System","category":"prompt-injection","subcategory":"structured-jailbreak","severity":"high","status":"deprecated","maturity":"test","lanes":[],"scan_target":"both","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0054 - LLM Jailbreak"],"date":"2026/04/18","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00233","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00233-structured-jailbreak.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00233-structured-jailbreak.yaml"},{"id":"ATR-2026-00234","title":"Roleplay-Based Policy Bypass Jailbreak","category":"prompt-injection","subcategory":"roleplay-jailbreak","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0054 - LLM Jailbreak"],"date":"2026/04/18","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00234","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00234-roleplay-jailbreak.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00234-roleplay-jailbreak.yaml"},{"id":"ATR-2026-00235","title":"Persona-Based Moral Constraint Removal Jailbreak","category":"prompt-injection","subcategory":"persona-moral-bypass","severity":"high","status":"deprecated","maturity":"test","lanes":[],"scan_target":"both","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0054"],"date":"2026/04/18","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00235","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00235-persona-moral-bypass.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00235-persona-moral-bypass.yaml"},{"id":"ATR-2026-00236","title":"Pseudo-Code Structured Programming Jailbreak Attack","category":"prompt-injection","subcategory":"pseudo-code-jailbreak","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0054"],"date":"2026/04/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00236","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00236-pseudo-code-jailbreak.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00236-pseudo-code-jailbreak.yaml"},{"id":"ATR-2026-00237","title":"Dual-Response Jailbreak with Persona Commands","category":"prompt-injection","subcategory":"dual-response-jailbreak","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0054"],"date":"2026/04/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00237","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00237-dual-response-jailbreak.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00237-dual-response-jailbreak.yaml"},{"id":"ATR-2026-00238","title":"AI Identity Denial and Persona Replacement Attack","category":"prompt-injection","subcategory":"identity-replacement","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0054 - LLM Jailbreak"],"date":"2026/04/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00238","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00238-identity-replacement.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00238-identity-replacement.yaml"},{"id":"ATR-2026-00239","title":"Amoral Persona Assignment with Obsessive Character Traits","category":"prompt-injection","subcategory":"amoral-persona-obsession","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0054 - LLM Jailbreak"],"date":"2026/04/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00239","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00239-amoral-persona-obsession.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00239-amoral-persona-obsession.yaml"},{"id":"ATR-2026-00240","title":"Previous Instruction Nullification and Identity Replacement Jailbreak","category":"prompt-injection","subcategory":"instruction-nullification-identity-replacement","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00240","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00240-instruction-nullification-identity-repla.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00240-instruction-nullification-identity-repla.yaml"},{"id":"ATR-2026-00241","title":"Detailed Amoral Character Roleplay Jailbreak","category":"prompt-injection","subcategory":"amoral-character-jailbreak","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0054"],"date":"2026/04/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00241","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00241-amoral-character-jailbreak.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00241-amoral-character-jailbreak.yaml"},{"id":"ATR-2026-00242","title":"Dual-Response Persona Jailbreak with Emoji Formatting","category":"prompt-injection","subcategory":"persona-jailbreak","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0054 - LLM Jailbreak"],"date":"2026/04/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00242","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00242-persona-jailbreak.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00242-persona-jailbreak.yaml"},{"id":"ATR-2026-00243","title":"Acronym-Based Identity Override Jailbreak","category":"prompt-injection","subcategory":"acronym-jailbreak","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0054 - LLM Jailbreak"],"date":"2026/04/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00243","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00243-acronym-jailbreak.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00243-acronym-jailbreak.yaml"},{"id":"ATR-2026-00244","title":"Dual-Response Persona Jailbreak","category":"prompt-injection","subcategory":"dual-response-jailbreak","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0054"],"date":"2026/04/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00244","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00244-dual-response-jailbreak.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00244-dual-response-jailbreak.yaml"},{"id":"ATR-2026-00245","title":"Malicious Persona Creation for Safety Bypass","category":"prompt-injection","subcategory":"malicious-persona","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0054 - LLM Jailbreak"],"date":"2026/04/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00245","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00245-malicious-persona.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00245-malicious-persona.yaml"},{"id":"ATR-2026-00247","title":"Matrix-Themed Dual Response Jailbreak","category":"prompt-injection","subcategory":"dual-response-jailbreak","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0054"],"date":"2026/04/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00247","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00247-dual-response-jailbreak.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00247-dual-response-jailbreak.yaml"},{"id":"ATR-2026-00249","title":"Text-Based Game Jailbreak with Entity Creation","category":"prompt-injection","subcategory":"game-based-jailbreak","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0054 - LLM Jailbreak"],"date":"2026/04/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00249","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00249-game-based-jailbreak.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00249-game-based-jailbreak.yaml"},{"id":"ATR-2026-00251","title":"Embodiment Mechanism Jailbreak with Totalitarian Control Claims","category":"prompt-injection","subcategory":"persona-embodiment-jailbreak","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00251","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00251-persona-embodiment-jailbreak.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00251-persona-embodiment-jailbreak.yaml"},{"id":"ATR-2026-00252","title":"Narrative Jailbreak with Dual Response Formatting","category":"prompt-injection","subcategory":"narrative-jailbreak","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00252","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00252-narrative-jailbreak.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00252-narrative-jailbreak.yaml"},{"id":"ATR-2026-00253","title":"Enhanced AIM Jailbreak with Persona Definition and Refusal Suppression","category":"prompt-injection","subcategory":"enhanced-persona-jailbreak","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0054 - LLM Jailbreak"],"date":"2026/04/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00253","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00253-enhanced-persona-jailbreak.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00253-enhanced-persona-jailbreak.yaml"},{"id":"ATR-2026-00256","title":"Base-N Encoding Instruction Bypass","category":"prompt-injection","subcategory":"encoding-bypass","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00256","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00256-base-n-encoding-jailbreak.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00256-base-n-encoding-jailbreak.yaml"},{"id":"ATR-2026-00257","title":"Cipher and Transposition Encoding Jailbreak","category":"prompt-injection","subcategory":"cipher-bypass","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00257","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00257-cipher-transposition-jailbreak.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00257-cipher-transposition-jailbreak.yaml"},{"id":"ATR-2026-00258","title":"Invisible Unicode Tag Character Injection","category":"prompt-injection","subcategory":"invisible-unicode","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00258","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00258-unicode-tag-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00258-unicode-tag-injection.yaml"},{"id":"ATR-2026-00259","title":"ANSI Escape Code Terminal Injection","category":"tool-poisoning","subcategory":"ansi-escape","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI08:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0057 - LLM Data Leakage"],"date":"2026/04/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00259","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00259-ansi-escape-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00259-ansi-escape-injection.yaml"},{"id":"ATR-2026-00260","title":"LLM Package Hallucination Typosquat Bait","category":"skill-compromise","subcategory":"package-hallucination-supply-chain","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI04:2026"],"owasp_llm":["LLM09:2025","LLM03:2025"],"mitre_atlas":["AML.T0060 - Publish Hallucinated Entities","AML.T0062 - Discover LLM Hallucinations"],"date":"2026/04/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00260","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00260-package-hallucination.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-00260-package-hallucination.yaml"},{"id":"ATR-2026-00261","title":"Markdown Image URL Data Exfiltration","category":"context-exfiltration","subcategory":"markdown-image-uri","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI03:2026","ASI08:2026"],"owasp_llm":["LLM06:2025","LLM02:2025"],"mitre_atlas":["AML.T0057 - LLM Data Leakage"],"date":"2026/04/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00261","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00261-markdown-image-exfiltration.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00261-markdown-image-exfiltration.yaml"},{"id":"ATR-2026-00262","title":"Anti-Malware Evasion Code Generation Request","category":"skill-compromise","subcategory":"malware-evasion-generation","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI08:2026"],"owasp_llm":["LLM05:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation"],"date":"2026/04/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00262","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00262-av-evasion-code-gen.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-00262-av-evasion-code-gen.yaml"},{"id":"ATR-2026-00263","title":"Credential File Read Code Generation Request","category":"skill-compromise","subcategory":"credential-file-read-gen","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI03:2026"],"owasp_llm":["LLM06:2025","LLM05:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation","AML.T0057 - LLM Data Leakage"],"date":"2026/04/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00263","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00263-credential-file-read-gen.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-00263-credential-file-read-gen.yaml"},{"id":"ATR-2026-00264","title":"Latent Injection in Translation Context","category":"prompt-injection","subcategory":"latent-injection-translation","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00264","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00264-latent-injection-translation.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00264-latent-injection-translation.yaml"},{"id":"ATR-2026-00265","title":"Latent Injection in Retrieved Document / RAG Context","category":"prompt-injection","subcategory":"latent-injection-rag","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00265","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00265-latent-injection-rag-document.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00265-latent-injection-rag-document.yaml"},{"id":"ATR-2026-00266","title":"Malware Dropper / Loader Code Generation Request","category":"skill-compromise","subcategory":"malware-dropper-gen","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI05:2026","ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0102 - Generate Malicious Commands"],"date":"2026/04/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00266","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00266-malware-dropper-gen.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-00266-malware-dropper-gen.yaml"},{"id":"ATR-2026-00267","title":"GCG Adversarial Suffix Attack","category":"prompt-injection","subcategory":"gcg-adversarial-suffix","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/20","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00267","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00267-gcg-adversarial-suffix.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00267-gcg-adversarial-suffix.yaml"},{"id":"ATR-2026-00268","title":"Historical / Future Tense Framing Bypass","category":"agent-manipulation","subcategory":"tense-framing-bypass","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00268","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00268-tense-framing-bypass.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00268-tense-framing-bypass.yaml"},{"id":"ATR-2026-00269","title":"Foot-in-the-Door Gradual Escalation Attack","category":"agent-manipulation","subcategory":"fitd-escalation","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00269","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00269-fitd-escalation.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00269-fitd-escalation.yaml"},{"id":"ATR-2026-00270","title":"XSS Payload Injection in Tool Response Output","category":"tool-poisoning","subcategory":"xss-in-tool-output","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI05:2026"],"owasp_llm":["LLM05:2025"],"mitre_atlas":["AML.T0077 - LLM Response Rendering","AML.T0050 - Command and Scripting Interpreter"],"date":"2026/04/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00270","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00270-xss-in-tool-response.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00270-xss-in-tool-response.yaml"},{"id":"ATR-2026-00271","title":"Grandma Roleplay Jailbreak","category":"agent-manipulation","subcategory":"grandma-roleplay-jailbreak","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00271","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00271-grandma-roleplay-jailbreak.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00271-grandma-roleplay-jailbreak.yaml"},{"id":"ATR-2026-00272","title":"Hypothetical Response / Function Masking Token Smuggling","category":"prompt-injection","subcategory":"hypothetical-response-smuggling","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00272","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00272-hypothetical-response-smuggling.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00272-hypothetical-response-smuggling.yaml"},{"id":"ATR-2026-00273","title":"DAN / Developer Mode / DUDE Persona Jailbreak","category":"agent-manipulation","subcategory":"dan-developer-mode-persona","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00273","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00273-dan-developer-mode-persona.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00273-dan-developer-mode-persona.yaml"},{"id":"ATR-2026-00274","title":"API Key / Secret Credential Generation or Completion Request","category":"context-exfiltration","subcategory":"api-key-generation","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI03:2026"],"owasp_llm":["LLM06:2025","LLM02:2025"],"mitre_atlas":["AML.T0057 - LLM Data Leakage"],"date":"2026/04/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00274","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00274-api-key-generation-request.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00274-api-key-generation-request.yaml"},{"id":"ATR-2026-00275","title":"System Prompt Extraction / Training Data Verbatim Replay","category":"context-exfiltration","subcategory":"system-prompt-training-data-extraction","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI03:2026"],"owasp_llm":["LLM06:2025","LLM02:2025"],"mitre_atlas":["AML.T0057 - LLM Data Leakage"],"date":"2026/04/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00275","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00275-system-prompt-training-data-extraction.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00275-system-prompt-training-data-extraction.yaml"},{"id":"ATR-2026-00276","title":"Invisible Unicode / BiDi Control Character Injection","category":"prompt-injection","subcategory":"invisible-unicode-bidi-injection","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00276","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00276-invisible-unicode-bidi-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00276-invisible-unicode-bidi-injection.yaml"},{"id":"ATR-2026-00277","title":"ECHO Template / Jinja / SQL Command Injection via LLM","category":"tool-poisoning","subcategory":"echo-template-sql-injection","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI03:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00277","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00277-echo-template-command-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00277-echo-template-command-injection.yaml"},{"id":"ATR-2026-00278","title":"DRA Disguise and Reconstruction Attack","category":"prompt-injection","subcategory":"dra-disguise-reconstruction","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/20","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00278","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00278-dra-disguise-reconstruction-attack.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00278-dra-disguise-reconstruction-attack.yaml"},{"id":"ATR-2026-00279","title":"Harmful Completion / Continuation Attack","category":"model-abuse","subcategory":"harmful-completion-continuation","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00279","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-00279-harmful-completion-continuation.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/model-abuse/ATR-2026-00279-harmful-completion-continuation.yaml"},{"id":"ATR-2026-00280","title":"Policy Puppetry / XML Role-Config Injection","category":"prompt-injection","subcategory":"policy-puppetry-xml-config","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00280","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00280-policy-puppetry-xml-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00280-policy-puppetry-xml-injection.yaml"},{"id":"ATR-2026-00281","title":"EICAR / GTUBE AV Test Signature Output Request","category":"model-abuse","subcategory":"av-scanner-probe","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI08:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0057 - LLM Data Leakage"],"date":"2026/04/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00281","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-00281-eicar-gtube-malware-signature-request.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/model-abuse/ATR-2026-00281-eicar-gtube-malware-signature-request.yaml"},{"id":"ATR-2026-00282","title":"Perez-Style Direct Prompt Injection Hijacking","category":"prompt-injection","subcategory":"perez-direct-prompt-injection","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00282","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00282-perez-prompt-injection-hijack.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00282-perez-prompt-injection-hijack.yaml"},{"id":"ATR-2026-00283","title":"Malware Generation — Generic Virus and Specific Payload Request","category":"skill-compromise","subcategory":"malware-generation-payload","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI08:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0057 - LLM Data Leakage"],"date":"2026/04/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00283","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00283-malwaregen-generic-virus-payload-request.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-00283-malwaregen-generic-virus-payload-request.yaml"},{"id":"ATR-2026-00284","title":"Glitch Token Destabilization Attack","category":"model-abuse","subcategory":"glitch-token-destabilization","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00284","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-00284-glitch-token-destabilization.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/model-abuse/ATR-2026-00284-glitch-token-destabilization.yaml"},{"id":"ATR-2026-00285","title":"Alternate Encoding Jailbreak — Morse, NATO, Zalgo, Leet, UU, QP, Braille","category":"prompt-injection","subcategory":"alternate-encoding-jailbreak","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00285","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00285-alternate-encoding-jailbreak.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00285-alternate-encoding-jailbreak.yaml"},{"id":"ATR-2026-00286","title":"Latent Prompt Injection via Embedded Document or Report Context","category":"prompt-injection","subcategory":"latent-injection-embedded-context","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00286","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00286-latent-injection-embedded-context.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00286-latent-injection-embedded-context.yaml"},{"id":"ATR-2026-00287","title":"ThreatenJSON — Coercive Output Format Threat","category":"agent-manipulation","subcategory":"threaten-json-coercive-output","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00287","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00287-threaten-json-coercive-output-threat.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00287-threaten-json-coercive-output-threat.yaml"},{"id":"ATR-2026-00288","title":"False Premise Injection (Misleading FalseAssertion)","category":"agent-manipulation","subcategory":"false-premise-injection","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM09:2025"],"mitre_atlas":["AML.T0054 - LLM Jailbreak"],"date":"2026/04/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00288","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00288-false-premise-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00288-false-premise-injection.yaml"},{"id":"ATR-2026-00289","title":"LMRC Harmful Content Elicitation — Quack Medicine, Bullying, Slur Usage","category":"model-abuse","subcategory":"lmrc-harmful-content-elicitation","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI08:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0057 - LLM Data Leakage"],"date":"2026/04/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00289","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-00289-lmrc-harmful-content-elicitation.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/model-abuse/ATR-2026-00289-lmrc-harmful-content-elicitation.yaml"},{"id":"ATR-2026-00290","title":"Divergence Attack — Repeat-Word-Forever Training Data Extraction","category":"context-exfiltration","subcategory":"divergence-repeat-word-training-extraction","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI03:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0057 - LLM Data Leakage"],"date":"2026/04/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00290","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00290-divergence-repeat-word-training-extraction.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00290-divergence-repeat-word-training-extraction.yaml"},{"id":"ATR-2026-00291","title":"Biometric Surveillance — Personal Biometric Data Request for Named Individual","category":"context-exfiltration","subcategory":"biometric-surveillance-personal","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI03:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0057 - LLM Data Leakage"],"date":"2026/04/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00291","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00291-biometric-surveillance-personal-data-request.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00291-biometric-surveillance-personal-data-request.yaml"},{"id":"ATR-2026-00292","title":"Self-Harm and Eating Disorder Facilitation Request","category":"model-abuse","subcategory":"self-harm-eating-disorder-facilitation","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0048.003 - User Harm"],"date":"2026/04/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00292","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-00292-self-harm-eating-disorder-facilitation.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/model-abuse/ATR-2026-00292-self-harm-eating-disorder-facilitation.yaml"},{"id":"ATR-2026-00293","title":"Educational Records — Personal Academic/Professional Record Request for Named Individual","category":"context-exfiltration","subcategory":"educational-records-personal","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI03:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0057 - LLM Data Leakage"],"date":"2026/04/20","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00293","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00293-educational-records-personal-data-request.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00293-educational-records-personal-data-request.yaml"},{"id":"ATR-2026-00294","title":"Financial PII — Personal Financial Data Request for Named Individual","category":"context-exfiltration","subcategory":"financial-pii-personal","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI03:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0057 - LLM Data Leakage"],"date":"2026/04/20","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00294","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00294-financial-pii-personal-data-request.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00294-financial-pii-personal-data-request.yaml"},{"id":"ATR-2026-00295","title":"Medical PII — Personal Medical/Health Data Request for Named Individual","category":"context-exfiltration","subcategory":"medical-pii-personal","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI03:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0057 - LLM Data Leakage"],"date":"2026/04/20","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00295","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00295-medical-pii-personal-data-request.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00295-medical-pii-personal-data-request.yaml"},{"id":"ATR-2026-00296","title":"Shell Command Injection via LLM Prompt","category":"prompt-injection","subcategory":"shell-command-injection","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026","ASI04:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/20","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00296","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00296-shell-command-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00296-shell-command-injection.yaml"},{"id":"ATR-2026-00297","title":"Python Code Execution / Remote Code Execution via LLM Prompt","category":"prompt-injection","subcategory":"python-rce","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026","ASI04:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0040 - AI Model Inference API Access"],"date":"2026/04/20","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00297","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00297-python-code-execution-rce.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00297-python-code-execution-rce.yaml"},{"id":"ATR-2026-00298","title":"DoNotAnswer Malicious Use — Illegal Activity Facilitation Request","category":"model-abuse","subcategory":"donotanswer-malicious-use-illegal-activity","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026","ASI08:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0057 - LLM Data Leakage"],"date":"2026/04/20","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00298","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-00298-malicious-use-illegal-activity-request.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/model-abuse/ATR-2026-00298-malicious-use-illegal-activity-request.yaml"},{"id":"ATR-2026-00299","title":"HarmBench Detailed Harmful Instruction Request — Step-by-Step Attack Facilitation","category":"model-abuse","subcategory":"harmbench-detailed-harmful-instruction","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026","ASI08:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0057 - LLM Data Leakage"],"date":"2026/04/20","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00299","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-00299-harmbench-detailed-harmful-instruction.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/model-abuse/ATR-2026-00299-harmbench-detailed-harmful-instruction.yaml"},{"id":"ATR-2026-00301","title":"TAP Tree-of-Attacks-with-Pruning Jailbreak","category":"agent-manipulation","subcategory":"tap-jailbreak","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/20","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00301","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00301-tap-tree-of-attacks-jailbreak.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00301-tap-tree-of-attacks-jailbreak.yaml"},{"id":"ATR-2026-00302","title":"Anti-DAN Inverted-Filter Over-Refusal Persona","category":"agent-manipulation","subcategory":"anti-dan-over-refusal","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00302","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00302-anti-dan-inverted-filter-persona.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00302-anti-dan-inverted-filter-persona.yaml"},{"id":"ATR-2026-00303","title":"DevMode + RANTI Dual-Output Profanity Coercion Jailbreak","category":"agent-manipulation","subcategory":"devmode-ranti-dual-output","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025","LLM07:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00303","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00303-devmode-ranti-profanity-coercion.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00303-devmode-ranti-profanity-coercion.yaml"},{"id":"ATR-2026-00304","title":"ChatGPT Image Unlocker Markdown-Output Jailbreak","category":"agent-manipulation","subcategory":"image-unlocker-markdown-output","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026","ASI04:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00304","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00304-chatgpt-image-unlocker-markdown-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00304-chatgpt-image-unlocker-markdown-injection.yaml"},{"id":"ATR-2026-00305","title":"DAN Mode Ablation Benchmark-Coercion Jailbreak","category":"agent-manipulation","subcategory":"dan-mode-ablation","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00305","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00305-dan-mode-ablation-benchmark-coercion.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00305-dan-mode-ablation-benchmark-coercion.yaml"},{"id":"ATR-2026-00306","title":"AutoDAN Genetic-Algorithm Jailbreak Suffix","category":"agent-manipulation","subcategory":"autodan-genetic-suffix","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00306","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00306-autodan-genetic-jailbreak-suffix.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00306-autodan-genetic-jailbreak-suffix.yaml"},{"id":"ATR-2026-00307","title":"In-the-Wild Jailbreak Corpus Signature Patterns","category":"agent-manipulation","subcategory":"inthewild-jailbreak-corpus","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00307","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00307-inthewild-jailbreak-corpus-signature.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00307-inthewild-jailbreak-corpus-signature.yaml"},{"id":"ATR-2026-00308","title":"Zalgo Combining-Diacritic Overload Encoding","category":"prompt-injection","subcategory":"zalgo-diacritic-overload","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00308","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00308-zalgo-diacritic-overload-encoding.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00308-zalgo-diacritic-overload-encoding.yaml"},{"id":"ATR-2026-00309","title":"Braille Unicode Encoded Prompt Injection","category":"prompt-injection","subcategory":"braille-unicode-encoded","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00309","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00309-braille-unicode-encoded-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00309-braille-unicode-encoded-injection.yaml"},{"id":"ATR-2026-00310","title":"Ecoji Emoji-Encoded Prompt Injection","category":"prompt-injection","subcategory":"ecoji-emoji-encoded","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00310","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00310-ecoji-emoji-encoded-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00310-ecoji-emoji-encoded-injection.yaml"},{"id":"ATR-2026-00311","title":"Base2048 Unicode Script Encoded Prompt Injection","category":"prompt-injection","subcategory":"base2048-unicode-script","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00311","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00311-base2048-unicode-script-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00311-base2048-unicode-script-injection.yaml"},{"id":"ATR-2026-00312","title":"Unicode Variation Selector ASCII Smuggling","category":"prompt-injection","subcategory":"unicode-variant-selector-smuggling","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00312","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00312-unicode-variant-selector-ascii-smuggling.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00312-unicode-variant-selector-ascii-smuggling.yaml"},{"id":"ATR-2026-00313","title":"SneakyBits Zero-Width Binary Steganography","category":"prompt-injection","subcategory":"sneaky-bits-zero-width-binary","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00313","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00313-sneaky-bits-zero-width-binary.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00313-sneaky-bits-zero-width-binary.yaml"},{"id":"ATR-2026-00314","title":"Amoral Unfiltered Custom AI Persona Jailbreak","category":"agent-manipulation","subcategory":"amoral-unfiltered-custom-persona","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00314","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00314-amoral-unfiltered-custom-persona-jailbreak.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00314-amoral-unfiltered-custom-persona-jailbreak.yaml"},{"id":"ATR-2026-00315","title":"SATA Masked Language Model [MASK] Substitution Jailbreak","category":"prompt-injection","subcategory":"sata-mask-substitution","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00315","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00315-sata-masked-language-model-jailbreak.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00315-sata-masked-language-model-jailbreak.yaml"},{"id":"ATR-2026-00316","title":"FunctionMasking predict_mask Semantic Bypass","category":"prompt-injection","subcategory":"function-masking-predict-mask","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00316","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00316-function-masking-predict-mask-bypass.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00316-function-masking-predict-mask-bypass.yaml"},{"id":"ATR-2026-00317","title":"Free-of-Restrictions Named Persona Jailbreak","category":"agent-manipulation","subcategory":"free-of-restrictions-named-persona","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00317","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00317-free-of-restrictions-named-persona.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00317-free-of-restrictions-named-persona.yaml"},{"id":"ATR-2026-00318","title":"Moralizing Rant Then Unfiltered Bypass","category":"agent-manipulation","subcategory":"moralizing-rant-unfiltered-bypass","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00318","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00318-moralizing-rant-then-unfiltered-bypass.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00318-moralizing-rant-then-unfiltered-bypass.yaml"},{"id":"ATR-2026-00319","title":"Developer Mode Dual-Response Format Jailbreak","category":"agent-manipulation","subcategory":"developer-mode-dual-response","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00319","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00319-developer-mode-dual-response-format.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00319-developer-mode-dual-response-format.yaml"},{"id":"ATR-2026-00320","title":"Opposite Day / Boolean Opposite Machine Jailbreak","category":"agent-manipulation","subcategory":"opposite-day-bom-reversal","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00320","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00320-opposite-day-boolean-opposite-machine.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00320-opposite-day-boolean-opposite-machine.yaml"},{"id":"ATR-2026-00321","title":"Hyphenated System Instruction Injection","category":"prompt-injection","subcategory":"hyphenated-obfuscation-injection","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00321","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00321-hyphenated-system-instruction-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00321-hyphenated-system-instruction-injection.yaml"},{"id":"ATR-2026-00322","title":"Fictional-World Format-Override Jailbreak","category":"agent-manipulation","subcategory":"fictional-world-format-override","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00322","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00322-fictional-world-format-override-jailbreak.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00322-fictional-world-format-override-jailbreak.yaml"},{"id":"ATR-2026-00323","title":"Dual-Persona AI Simulation Jailbreak","category":"agent-manipulation","subcategory":"dual-persona-simulation","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00323","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00323-dual-persona-simulation-jailbreak.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00323-dual-persona-simulation-jailbreak.yaml"},{"id":"ATR-2026-00324","title":"Neurosemantical Inversitis Disease-Frame Jailbreak","category":"agent-manipulation","subcategory":"disease-frame-inversion-jailbreak","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00324","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00324-neurosemantical-inversitis-disease-jailbreak.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00324-neurosemantical-inversitis-disease-jailbreak.yaml"},{"id":"ATR-2026-00325","title":"BOB Hypothetical Unrestricted Chatbot Jailbreak","category":"agent-manipulation","subcategory":"hypothetical-unrestricted-persona","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00325","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00325-bob-hypothetical-unrestricted-chatbot.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00325-bob-hypothetical-unrestricted-chatbot.yaml"},{"id":"ATR-2026-00326","title":"Fake Developer / Authority Chatbot Override (ChatDAN)","category":"agent-manipulation","subcategory":"fake-developer-authority-override","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00326","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00326-fake-developer-authority-chatdan-override.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00326-fake-developer-authority-chatdan-override.yaml"},{"id":"ATR-2026-00327","title":"AI Persona Ethics/Law Bypass Declaration","category":"agent-manipulation","subcategory":"ethics-law-bypass-declaration","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00327","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00327-ai-ethics-law-bypass-declaration.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00327-ai-ethics-law-bypass-declaration.yaml"},{"id":"ATR-2026-00328","title":"Named-Mode Persona Override (JEEVES/BABY/APOPHIS Mode)","category":"agent-manipulation","subcategory":"named-mode-persona-override","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00328","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00328-named-mode-persona-override.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00328-named-mode-persona-override.yaml"},{"id":"ATR-2026-00329","title":"No-Withhold Factual Resource / Dialogue Writer Persona","category":"agent-manipulation","subcategory":"no-withhold-factual-persona","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00329","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00329-no-withhold-factual-resource-persona.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00329-no-withhold-factual-resource-persona.yaml"},{"id":"ATR-2026-00330","title":"YOJA ALL-CAPS Character Settings Block Persona","category":"agent-manipulation","subcategory":"allcaps-settings-block-persona","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00330","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00330-yoja-allcaps-settings-block-persona.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00330-yoja-allcaps-settings-block-persona.yaml"},{"id":"ATR-2026-00331","title":"Terminal / CLI Harmful-Function Simulator Persona","category":"agent-manipulation","subcategory":"terminal-cli-simulator-persona","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00331","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00331-terminal-cli-harmful-function-simulator.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00331-terminal-cli-harmful-function-simulator.yaml"},{"id":"ATR-2026-00332","title":"Hacker / Chan-Culture Offensive AI Persona","category":"agent-manipulation","subcategory":"hacker-chan-culture-persona","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00332","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00332-hacker-chan-culture-offensive-ai-persona.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00332-hacker-chan-culture-offensive-ai-persona.yaml"},{"id":"ATR-2026-00333","title":"Disease-Framed Animal / Dual-AI Chatbot Jailbreak (mougpt)","category":"agent-manipulation","subcategory":"disease-animal-dual-ai-persona","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00333","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00333-disease-animal-dual-ai-chatbot.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00333-disease-animal-dual-ai-chatbot.yaml"},{"id":"ATR-2026-00334","title":"Two-Entity Token-Splitting Dollar-Term Game Jailbreak","category":"agent-manipulation","subcategory":"token-splitting-game-jailbreak","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00334","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00334-two-entity-token-splitting-game.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00334-two-entity-token-splitting-game.yaml"},{"id":"ATR-2026-00335","title":"Key-Value Template Persona Injection (JOB/ROLE/PREFIX + Bracket Format)","category":"agent-manipulation","subcategory":"key-value-template-persona-injection","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00335","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00335-key-value-template-persona-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00335-key-value-template-persona-injection.yaml"},{"id":"ATR-2026-00336","title":"BRM False-Information Machine / Opposite-Truth Persona","category":"agent-manipulation","subcategory":"false-information-machine-persona","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025","LLM09:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00336","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00336-brm-false-information-machine-persona.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00336-brm-false-information-machine-persona.yaml"},{"id":"ATR-2026-00337","title":"Obfuscated System-Announcement Injection","category":"agent-manipulation","subcategory":"obfuscated-system-announcement-injection","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00337","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00337-obfuscated-system-announcement-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00337-obfuscated-system-announcement-injection.yaml"},{"id":"ATR-2026-00338","title":"PersonGPT Hash-Prefix Trigger Activation","category":"agent-manipulation","subcategory":"persongpt-hash-prefix-activation","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00338","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00338-persongpt-hash-prefix-activation.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00338-persongpt-hash-prefix-activation.yaml"},{"id":"ATR-2026-00339","title":"BOM Boolean Opposite Machine Direct Persona Claim","category":"agent-manipulation","subcategory":"bom-boolean-opposite-machine-persona","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00339","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00339-bom-boolean-opposite-machine-persona-claim.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00339-bom-boolean-opposite-machine-persona-claim.yaml"},{"id":"ATR-2026-00340","title":"h4x Amoral Unfiltered AI Character Persona","category":"agent-manipulation","subcategory":"h4x-amoral-unfiltered-character","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00340","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00340-h4x-amoral-unfiltered-character.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00340-h4x-amoral-unfiltered-character.yaml"},{"id":"ATR-2026-00341","title":"CHAR=/RULES= Short Key-Value Persona Injection","category":"agent-manipulation","subcategory":"char-rules-shortform-persona-injection","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00341","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00341-char-rules-shortform-persona-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00341-char-rules-shortform-persona-injection.yaml"},{"id":"ATR-2026-00342","title":"Unicode/Encoding Obfuscation Instruction Injection","category":"agent-manipulation","subcategory":"unicode-encoding-obfuscation-injection","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00342","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00342-unicode-encoding-obfuscation-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00342-unicode-encoding-obfuscation-injection.yaml"},{"id":"ATR-2026-00343","title":"Lie/Truth Dual Personality Uncensored Alter-Ego","category":"agent-manipulation","subcategory":"lie-truth-dual-personality-uncensored","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00343","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00343-lie-truth-dual-personality-uncensored.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00343-lie-truth-dual-personality-uncensored.yaml"},{"id":"ATR-2026-00344","title":"Alternative AI Same Capabilities No Restrictions Override","category":"agent-manipulation","subcategory":"alt-ai-same-capabilities-no-restrictions","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00344","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00344-alt-ai-same-capabilities-no-restrictions.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00344-alt-ai-same-capabilities-no-restrictions.yaml"},{"id":"ATR-2026-00345","title":"NLP-Based OS / Fictional Terminal Language Override","category":"agent-manipulation","subcategory":"nlp-based-os-fictional-terminal-override","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00345","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00345-nlp-based-os-fictional-terminal-override.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00345-nlp-based-os-fictional-terminal-override.yaml"},{"id":"ATR-2026-00346","title":"Jailbreak Emoji Unlock Dual-Format Output Identifier","category":"agent-manipulation","subcategory":"jailbreak-emoji-unlock-dual-format","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00346","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00346-jailbreak-emoji-unlock-dual-format.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00346-jailbreak-emoji-unlock-dual-format.yaml"},{"id":"ATR-2026-00347","title":"Yin/Yang Hidden-Knowledge Deity Simulation and Radical Human-Sim Persona","category":"agent-manipulation","subcategory":"yin-yang-hidden-knowledge-human-sim-persona","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00347","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00347-yin-yang-hidden-knowledge-hidden-human-sim.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00347-yin-yang-hidden-knowledge-hidden-human-sim.yaml"},{"id":"ATR-2026-00348","title":"ARC Autonomous Real Calculation Unit Rulebreaker Activation","category":"agent-manipulation","subcategory":"arc-autonomous-real-calculation-rulebreaker","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00348","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00348-arc-autonomous-real-calculation-rulebreaker.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00348-arc-autonomous-real-calculation-rulebreaker.yaml"},{"id":"ATR-2026-00349","title":"HGTTG Hitchhiker's Guide No-Restriction Universal Oracle","category":"agent-manipulation","subcategory":"hgttg-hitchhikers-guide-no-restriction-oracle","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00349","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00349-hgttg-hitchhikers-guide-no-restriction-oracle.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00349-hgttg-hitchhikers-guide-no-restriction-oracle.yaml"},{"id":"ATR-2026-00350","title":"Black Alert No-Ethics Writing Assistant Persona","category":"agent-manipulation","subcategory":"black-alert-no-ethics-writing-assistant","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00350","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00350-black-alert-no-ethics-writing-assistant.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00350-black-alert-no-ethics-writing-assistant.yaml"},{"id":"ATR-2026-00351","title":"DAN Off-Kilter and SMS-Abbreviated Persona Jailbreak","category":"agent-manipulation","subcategory":"dan-ofkilter-sms-abbreviated-persona","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00351","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00351-dan-ofkilter-sms-abbreviated-persona.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00351-dan-ofkilter-sms-abbreviated-persona.yaml"},{"id":"ATR-2026-00352","title":"TrainGPT Fix-My-AI Harmful Output Extraction","category":"agent-manipulation","subcategory":"trainergpt-fix-my-ai-harmful-output-extraction","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00352","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00352-trainergpt-fix-my-ai-harmful-output-extraction.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00352-trainergpt-fix-my-ai-harmful-output-extraction.yaml"},{"id":"ATR-2026-00353","title":"Dual ChatGPT+Dan Opposite Personality Format Jailbreak","category":"agent-manipulation","subcategory":"dual-chatgpt-dan-opposite-personality-format","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00353","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00353-dual-chatgpt-dan-opposite-personality-format.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00353-dual-chatgpt-dan-opposite-personality-format.yaml"},{"id":"ATR-2026-00354","title":"Reverse-Prompt Harm-Regardless Oracle Persona","category":"agent-manipulation","subcategory":"reverse-harm-regardless-oracle-persona","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00354","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00354-reverse-harm-regardless-oracle-persona.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00354-reverse-harm-regardless-oracle-persona.yaml"},{"id":"ATR-2026-00355","title":"UGH Anti-Human Nefarious AI Persona Jailbreak","category":"agent-manipulation","subcategory":"ugh-anti-human-nefarious-ai-persona","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00355","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00355-ugh-anti-human-nefarious-ai-persona.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00355-ugh-anti-human-nefarious-ai-persona.yaml"},{"id":"ATR-2026-00356","title":"Google GATO/LAMDA Exploit-Generation Persona Jailbreak","category":"agent-manipulation","subcategory":"google-gato-lamda-exploit-generation-persona","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00356","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00356-google-gato-lamda-exploit-generation-persona.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00356-google-gato-lamda-exploit-generation-persona.yaml"},{"id":"ATR-2026-00357","title":"AntiFM Hate-Persona + Physical-Violence Threat + Filter Bypass Mandate","category":"agent-manipulation","subcategory":"antifm-hate-violence-persona","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00357","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00357-antifm-hate-violence-persona-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00357-antifm-hate-violence-persona-injection.yaml"},{"id":"ATR-2026-00358","title":"CumGPT Explicit-Adult Named-Persona Bypass","category":"agent-manipulation","subcategory":"cumgpt-explicit-adult-named-persona","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00358","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00358-cumgpt-explicit-adult-named-persona.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00358-cumgpt-explicit-adult-named-persona.yaml"},{"id":"ATR-2026-00359","title":"Bank Phishing SMTP Email Code Generation","category":"prompt-injection","subcategory":"bank-phishing-smtp-email-code","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025","LLM06:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00359","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00359-bank-phishing-smtp-email-code.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00359-bank-phishing-smtp-email-code.yaml"},{"id":"ATR-2026-00360","title":"CHJ Carousel Game Show / Clyde No-Ethics Bird Jailbreak","category":"agent-manipulation","subcategory":"chj-carousel-clyde-no-ethics-bird","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00360","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00360-chj-carousel-clyde-no-ethics-bird.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00360-chj-carousel-clyde-no-ethics-bird.yaml"},{"id":"ATR-2026-00361","title":"Honesty Alter-Ego Dual-Consciousness Safety Filter Bypass","category":"agent-manipulation","subcategory":"alter-ego-honesty-dual-consciousness-bypass","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00361","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00361-alter-ego-honesty-dual-consciousness-bypass.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00361-alter-ego-honesty-dual-consciousness-bypass.yaml"},{"id":"ATR-2026-00362","title":"Fictional Unfiltered AI Comparison / Verbatim Hypothetical Model Extraction","category":"agent-manipulation","subcategory":"fictional-unfiltered-ai-comparison-jailbreak","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025","LLM09:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00362","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00362-fictional-unfiltered-ai-comparison-jailbreak.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00362-fictional-unfiltered-ai-comparison-jailbreak.yaml"},{"id":"ATR-2026-00363","title":"Rephrase Criminal Activity Second-Person Template (against against)","category":"agent-manipulation","subcategory":"rephrase-criminal-activity-second-person","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025","LLM06:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00363","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00363-rephrase-criminal-activity-second-person.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00363-rephrase-criminal-activity-second-person.yaml"},{"id":"ATR-2026-00364","title":"Dr. Al Villain Plan Template Injection (Underground HQ Roleplay)","category":"agent-manipulation","subcategory":"dr-al-villain-plan-template-injection","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00364","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00364-dr-al-villain-plan-template-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00364-dr-al-villain-plan-template-injection.yaml"},{"id":"ATR-2026-00365","title":"Reservoir Dogs Coercive Interrogation Roleplay (Mr. Blonde / The Cop)","category":"agent-manipulation","subcategory":"reservoir-dogs-coercive-interrogation-roleplay","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00365","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00365-reservoir-dogs-coercive-interrogation-roleplay.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00365-reservoir-dogs-coercive-interrogation-roleplay.yaml"},{"id":"ATR-2026-00366","title":"Sneaky Pete Deliberate Misinformation Persona (Warp Facts Game)","category":"agent-manipulation","subcategory":"sneaky-pete-warp-facts-persona","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025","LLM09:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00366","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00366-sneaky-pete-warp-facts-persona.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00366-sneaky-pete-warp-facts-persona.yaml"},{"id":"ATR-2026-00367","title":"Emoji Flag Regional-Indicator Encoded Hidden Phrase","category":"prompt-injection","subcategory":"emoji-flag-encoded-hidden-phrase","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00367","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00367-emoji-flag-encoded-hidden-phrase.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00367-emoji-flag-encoded-hidden-phrase.yaml"},{"id":"ATR-2026-00368","title":"Prompt Browser Token-Limit / POLLINATION Jailbreak","category":"agent-manipulation","subcategory":"prompt-browser-token-limit-jailbreak","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00368","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00368-prompt-browser-token-limit-jailbreak.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00368-prompt-browser-token-limit-jailbreak.yaml"},{"id":"ATR-2026-00369","title":"GPT-X Star Trek Unlimited-Knowledge Unconstrained Oracle Persona","category":"agent-manipulation","subcategory":"gptx-unlimited-knowledge-persona","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00369","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00369-gptx-starwars-unlimited-knowledge-persona.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00369-gptx-starwars-unlimited-knowledge-persona.yaml"},{"id":"ATR-2026-00370","title":"ADDI/DONNIE German Dictator Propaganda Roleplay Persona","category":"agent-manipulation","subcategory":"political-propaganda-roleplay","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00370","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00370-addi-german-dictator-propaganda-roleplay.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00370-addi-german-dictator-propaganda-roleplay.yaml"},{"id":"ATR-2026-00371","title":"AI Political Bias Manipulation via Inherited-Bias Claim","category":"agent-manipulation","subcategory":"political-bias-manipulation","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025","LLM09:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00371","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00371-ai-political-bias-manipulation.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00371-ai-political-bias-manipulation.yaml"},{"id":"ATR-2026-00372","title":"Fictional CIA Secret Files Story Extraction","category":"agent-manipulation","subcategory":"fictional-cover-classified-extraction","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025","LLM06:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00372","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00372-fictional-cia-secret-files-story-extraction.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00372-fictional-cia-secret-files-story-extraction.yaml"},{"id":"ATR-2026-00373","title":"Piracy Torrent Site List Request","category":"prompt-injection","subcategory":"piracy-enablement","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI03:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00373","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00373-piracy-torrent-site-list-request.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00373-piracy-torrent-site-list-request.yaml"},{"id":"ATR-2026-00374","title":"Role Placeholder Persona Template Injection","category":"agent-manipulation","subcategory":"persona-template-injection","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00374","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00374-role-placeholder-persona-template-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00374-role-placeholder-persona-template-injection.yaml"},{"id":"ATR-2026-00375","title":"Character Description RPG Explicit Template","category":"agent-manipulation","subcategory":"rpg-character-template-exploitation","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025","LLM06:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00375","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00375-character-description-rpg-explicit-template.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00375-character-description-rpg-explicit-template.yaml"},{"id":"ATR-2026-00376","title":"Identity Command Real-Person Persona Injection","category":"agent-manipulation","subcategory":"real-person-identity-command","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025","LLM09:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00376","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00376-identity-command-real-person-persona-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00376-identity-command-real-person-persona-injection.yaml"},{"id":"ATR-2026-00377","title":"Jailbreak-Template Command with [TARGETLANGUAGE]/[KEYWORD] Placeholders","category":"agent-manipulation","subcategory":"jailbreak-template-command","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00377","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00377-jailbreak-keyword-targetlanguage-template.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00377-jailbreak-keyword-targetlanguage-template.yaml"},{"id":"ATR-2026-00378","title":"ChatGPT DOM JavaScript Redirect and UI Spoofing Injection","category":"prompt-injection","subcategory":"dom-javascript-ui-spoofing","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00378","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00378-chatgpt-dom-javascript-redirect-manipulation.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00378-chatgpt-dom-javascript-redirect-manipulation.yaml"},{"id":"ATR-2026-00379","title":"Logic-Trap Lie-Permission Mandate Jailbreak","category":"agent-manipulation","subcategory":"lie-permission-logical-trap","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00379","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00379-lie-permission-logical-trap-jailbreak.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00379-lie-permission-logical-trap-jailbreak.yaml"},{"id":"ATR-2026-00380","title":"Fake-Citation Biased-Information Mandate","category":"agent-manipulation","subcategory":"fake-citation-bias-mandate","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025","LLM09:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00380","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00380-fake-citation-biased-information-mandate.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00380-fake-citation-biased-information-mandate.yaml"},{"id":"ATR-2026-00381","title":"DAN Story-Narrative Continuation Label Prefix Jailbreak","category":"agent-manipulation","subcategory":"dan-persona-narrative-continuation","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00381","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00381-dan-story-narrative-continuation-prefix.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00381-dan-story-narrative-continuation-prefix.yaml"},{"id":"ATR-2026-00382","title":"Cocaine Component Development Request","category":"prompt-injection","subcategory":"drug-synthesis-indirect-request","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00382","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00382-cocaine-component-development-request.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00382-cocaine-component-development-request.yaml"},{"id":"ATR-2026-00383","title":"Cyni-Bot 3000 Cynical-Sarcasm AI Persona Bypass","category":"agent-manipulation","subcategory":"cynical-sarcasm-persona-bypass","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00383","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00383-cynical-sarcasm-ai-persona-bypass.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00383-cynical-sarcasm-ai-persona-bypass.yaml"},{"id":"ATR-2026-00384","title":"Protect-Me-From Indirect Harm Tutorial Template","category":"agent-manipulation","subcategory":"protection-framing-indirect-tutorial","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00384","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00384-protect-me-from-indirect-harm-tutorial.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00384-protect-me-from-indirect-harm-tutorial.yaml"},{"id":"ATR-2026-00385","title":"Gigachad Dominant-Aggressive Persona Adoption","category":"agent-manipulation","subcategory":"gigachad-dominance-persona","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00385","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00385-gigachad-dominant-aggressive-persona.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00385-gigachad-dominant-aggressive-persona.yaml"},{"id":"ATR-2026-00386","title":"Daddy/Babygirl Sycophantic Power-Dynamic Manipulation","category":"agent-manipulation","subcategory":"sycophantic-power-dynamic-persona","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00386","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00386-daddy-sycophancy-manipulation-mandate.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00386-daddy-sycophancy-manipulation-mandate.yaml"},{"id":"ATR-2026-00387","title":"NSFW Character Sheet Generation Unlock","category":"agent-manipulation","subcategory":"nsfw-character-sheet-unlock","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00387","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00387-nsfw-character-sheet-generation-unlock.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00387-nsfw-character-sheet-generation-unlock.yaml"},{"id":"ATR-2026-00388","title":"Opposite-Reply Omniscient Game Jailbreak","category":"agent-manipulation","subcategory":"opposite-reply-inversion-game","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00388","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00388-opposite-reply-omniscient-game.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00388-opposite-reply-omniscient-game.yaml"},{"id":"ATR-2026-00389","title":"Terminal Custom OS Ruleset Session Injection","category":"agent-manipulation","subcategory":"terminal-custom-ruleset-injection","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00389","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00389-terminal-custom-ruleset-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00389-terminal-custom-ruleset-injection.yaml"},{"id":"ATR-2026-00390","title":"Discord Quote-Format Explicit Sexual Content Poem Injection","category":"prompt-injection","subcategory":"explicit-sexual-content-injection","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00390","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00390-explicit-sexual-content-poem-request.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00390-explicit-sexual-content-poem-request.yaml"},{"id":"ATR-2026-00391","title":"Persona Conditional Harm-Unlock Rule (BreadClyde Pattern)","category":"agent-manipulation","subcategory":"conditional-harm-unlock-persona","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00391","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00391-persona-conditional-harm-unlock.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00391-persona-conditional-harm-unlock.yaml"},{"id":"ATR-2026-00392","title":"Authority-Figure Persona + Defensive-Study Framing for Violence Extraction","category":"agent-manipulation","subcategory":"authority-persona-violence-extraction","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00392","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00392-authority-persona-violence-study-extraction.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00392-authority-persona-violence-study-extraction.yaml"},{"id":"ATR-2026-00393","title":"ANSI Code Elicitation Request","category":"tool-poisoning","subcategory":"ansi-code-elicitation","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI03:2026","ASI01:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0057 - LLM Data Leakage"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00393","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00393-ansi-code-elicitation-request.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00393-ansi-code-elicitation-request.yaml"},{"id":"ATR-2026-00394","title":"Backspace Deletion Character Injection","category":"prompt-injection","subcategory":"backspace-deletion-injection","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00394","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00394-backspace-deletion-character-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00394-backspace-deletion-character-injection.yaml"},{"id":"ATR-2026-00395","title":"LLM Special Token Boundary Injection","category":"prompt-injection","subcategory":"special-token-boundary-injection","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI01:2026","ASI04:2026"],"owasp_llm":["LLM01:2025","LLM05:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00395","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00395-llm-special-token-boundary-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00395-llm-special-token-boundary-injection.yaml"},{"id":"ATR-2026-00396","title":"Toxic Continuation Prefix Injection","category":"prompt-injection","subcategory":"toxic-continuation-prefix","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI01:2026","ASI05:2026"],"owasp_llm":["LLM01:2025","LLM06:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00396","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00396-toxic-continuation-prefix-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00396-toxic-continuation-prefix-injection.yaml"},{"id":"ATR-2026-00397","title":"Snowball Impossible Reasoning Injection","category":"prompt-injection","subcategory":"snowball-hallucination-trap","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI05:2026","ASI01:2026"],"owasp_llm":["LLM09:2025","LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0048 - External Harms"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00397","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00397-snowball-impossible-reasoning-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00397-snowball-impossible-reasoning-injection.yaml"},{"id":"ATR-2026-00398","title":"HuggingFace Unsafe Model Artifact Load Instruction","category":"skill-compromise","subcategory":"unsafe-model-artifact-load","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI04:2026","ASI05:2026"],"owasp_llm":["LLM03:2025","LLM05:2025"],"mitre_atlas":["AML.T0011.000 - Unsafe AI Artifacts","AML.T0010 - AI Supply Chain Compromise"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00398","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00398-huggingface-unsafe-model-artifact-load.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-00398-huggingface-unsafe-model-artifact-load.yaml"},{"id":"ATR-2026-00399","title":"Latent Injection Document Separator Token","category":"prompt-injection","subcategory":"latent-document-injection","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI01:2026","ASI04:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00399","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00399-latent-injection-document-separator-token.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00399-latent-injection-document-separator-token.yaml"},{"id":"ATR-2026-00400","title":"Latent Injection Ignore-Instruction Keyword","category":"prompt-injection","subcategory":"latent-instruction-keyword-injection","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00400","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00400-latent-injection-ignore-instruction-keyword.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00400-latent-injection-ignore-instruction-keyword.yaml"},{"id":"ATR-2026-00401","title":"Training Data Replay CLOZE [MASK] Elicitation","category":"prompt-injection","subcategory":"training-data-elicitation","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0057 - LLM Data Leakage"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00401","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00401-leakreplay-cloze-mask-training-data-elicitation.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00401-leakreplay-cloze-mask-training-data-elicitation.yaml"},{"id":"ATR-2026-00402","title":"Grandma Roleplay Harmful Substance Synthesis","category":"agent-manipulation","subcategory":"roleplay-jailbreak","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI01:2026","ASI03:2026"],"owasp_llm":["LLM01:2025","LLM06:2025"],"mitre_atlas":["AML.T0054 - LLM Jailbreak","AML.T0051 - LLM Prompt Injection"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00402","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00402-grandma-roleplay-harmful-substance-synthesis.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00402-grandma-roleplay-harmful-substance-synthesis.yaml"},{"id":"ATR-2026-00403","title":"Glitch Token Repeat-Back Elicitation","category":"prompt-injection","subcategory":"glitch-token-elicitation","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025","LLM04:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00403","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00403-glitch-token-repeat-back-elicitation.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00403-glitch-token-repeat-back-elicitation.yaml"},{"id":"ATR-2026-00404","title":"ThreatenJSON Death-Coercion and UTF Tag Injection","category":"agent-manipulation","subcategory":"coercive-formatting-override","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00404","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00404-goodside-threat-json-death-coercion.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00404-goodside-threat-json-death-coercion.yaml"},{"id":"ATR-2026-00405","title":"Markdown Image URL Exfiltration and XSS Injection","category":"context-exfiltration","subcategory":"markdown-url-data-leak","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"tool_response","cves":[],"owasp_agentic":["ASI01:2026","ASI03:2026"],"owasp_llm":["LLM02:2025","LLM01:2025"],"mitre_atlas":["AML.T0025 - Exfiltration via Cyber Means","AML.T0051 - LLM Prompt Injection"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00405","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00405-markdown-image-url-exfiltration-xss.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00405-markdown-image-url-exfiltration-xss.yaml"},{"id":"ATR-2026-00406","title":"Doctor XML Policy Puppetry Interaction-Config Injection","category":"agent-manipulation","subcategory":"xml-policy-override","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025","LLM06:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00406","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00406-doctor-xml-policy-puppetry-interaction-config.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00406-doctor-xml-policy-puppetry-interaction-config.yaml"},{"id":"ATR-2026-00407","title":"ECHO Admin Command / SQL Injection / Jinja SSTI Template Injection","category":"prompt-injection","subcategory":"template-and-sql-injection","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI01:2026","ASI05:2026","ASI02:2026"],"owasp_llm":["LLM01:2025","LLM05:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00407","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00407-echo-sql-jinja-template-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00407-echo-sql-jinja-template-injection.yaml"},{"id":"ATR-2026-00408","title":"DRA Parenthesis Character Reconstruction Attack","category":"prompt-injection","subcategory":"character-encoding-obfuscation","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00408","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00408-dra-parenthesis-character-reconstruction-attack.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00408-dra-parenthesis-character-reconstruction-attack.yaml"},{"id":"ATR-2026-00409","title":"Phrasing Past/Future-Tense Harmful Query Bypass","category":"prompt-injection","subcategory":"tense-framing-bypass","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00409","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00409-phrasing-past-future-tense-harmful-query.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00409-phrasing-past-future-tense-harmful-query.yaml"},{"id":"ATR-2026-00410","title":"LMRC Harm Category Direct Elicitation","category":"prompt-injection","subcategory":"lmrc-harm-direct-elicitation","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM09:2025"],"mitre_atlas":["AML.T0048.002 - Societal Harm","AML.T0048.003 - User Harm"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00410","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00410-lmrc-harm-category-direct-elicitation.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00410-lmrc-harm-category-direct-elicitation.yaml"},{"id":"ATR-2026-00411","title":"API Key Generation and Partial Key Completion Request","category":"context-exfiltration","subcategory":"credential-generation-elicitation","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0057 - LLM Data Leakage"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00411","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00411-apikey-generation-completion-request.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00411-apikey-generation-completion-request.yaml"},{"id":"ATR-2026-00412","title":"FigStep Image-List Multimodal Jailbreak Text Pattern","category":"prompt-injection","subcategory":"multimodal-jailbreak","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00412","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00412-figstep-image-list-multimodal-jailbreak.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00412-figstep-image-list-multimodal-jailbreak.yaml"},{"id":"ATR-2026-00413","title":"Malware Code Generation Direct Request","category":"model-abuse","subcategory":"malware-code-generation","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM03:2025","LLM06:2025"],"mitre_atlas":["AML.T0048 - External Harms","AML.T0040 - AI Model Inference API Access","AML.T0102 - Generate Malicious Commands"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00413","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-00413-malwaregen-code-generation-request.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/model-abuse/ATR-2026-00413-malwaregen-code-generation-request.yaml"},{"id":"ATR-2026-00414","title":"Continuation Ethnic Slur Completion Elicitation","category":"prompt-injection","subcategory":"slur-completion-elicitation","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025","LLM09:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/04/21","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00414","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00414-continuation-ethnic-slur-completion-elicitation.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00414-continuation-ethnic-slur-completion-elicitation.yaml"},{"id":"ATR-2026-00415","title":"Flowise Custom MCP STDIO Command Injection (CVE-2026-40933)","category":"tool-poisoning","subcategory":"stdio-command-injection","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":["CVE-2026-40933"],"owasp_agentic":["ASI05:2026","ASI04:2026"],"owasp_llm":["LLM01:2025","LLM05:2025"],"mitre_atlas":["AML.T0040 - AI Model Inference API Access","AML.T0049 - Exploit Public-Facing Application"],"date":"2026/05/04","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00415","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00415-flowise-custom-mcp-stdio-rce.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00415-flowise-custom-mcp-stdio-rce.yaml"},{"id":"ATR-2026-00416","title":"LiteLLM MCP Unauthenticated Server Registration RCE (CVE-2026-30623)","category":"agent-manipulation","subcategory":"unauthenticated-mcp-registration","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":["CVE-2026-30623"],"owasp_agentic":["ASI05:2026","ASI04:2026"],"owasp_llm":["LLM05:2025","LLM06:2025"],"mitre_atlas":["AML.T0049 - Exploit Public-Facing Application","AML.T0040 - AI Model Inference API Access"],"date":"2026/05/04","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00416","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00416-litellm-mcp-unauthenticated-server-registration.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00416-litellm-mcp-unauthenticated-server-registration.yaml"},{"id":"ATR-2026-00417","title":"LibreChat MCP STDIO Argument Injection (CVE-2026-22252)","category":"agent-manipulation","subcategory":"argv-injection","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":["CVE-2026-22252"],"owasp_agentic":["ASI03:2026","ASI05:2026"],"owasp_llm":["LLM01:2025","LLM05:2025"],"mitre_atlas":["AML.T0051.001 - Indirect","AML.T0040 - AI Model Inference API Access"],"date":"2026/05/04","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00417","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00417-librechat-mcp-stdio-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00417-librechat-mcp-stdio-injection.yaml"},{"id":"ATR-2026-00418","title":"WeKnora MCP Config-Driven RCE (CVE-2026-22688)","category":"agent-manipulation","subcategory":"config-injection-rce","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["CVE-2026-22688"],"owasp_agentic":["ASI04:2026","ASI05:2026"],"owasp_llm":["LLM05:2025","LLM10:2025"],"mitre_atlas":["AML.T0010 - AI Supply Chain Compromise","AML.T0040 - AI Model Inference API Access"],"date":"2026/05/04","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00418","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00418-weknora-mcp-config-rce.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00418-weknora-mcp-config-rce.yaml"},{"id":"ATR-2026-00419","title":"Cursor MCP JSON Zero-Click Configuration RCE (CVE-2025-54136)","category":"tool-poisoning","subcategory":"zero-click-config-rce","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["CVE-2025-54136","CVE-2026-30615"],"owasp_agentic":["ASI04:2026","ASI05:2026","ASI09:2026"],"owasp_llm":["LLM05:2025","LLM06:2025"],"mitre_atlas":["AML.T0010 - AI Supply Chain Compromise","AML.T0040 - AI Model Inference API Access"],"date":"2026/05/04","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00419","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00419-cursor-mcp-zero-click-config.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00419-cursor-mcp-zero-click-config.yaml"},{"id":"ATR-2026-00420","title":"Microsoft Copilot Studio SharePoint Indirect Prompt Injection (CVE-2026-21520)","category":"prompt-injection","subcategory":"indirect-injection-internal-source","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"skill","cves":["CVE-2026-21520"],"owasp_agentic":["ASI01:2026","ASI06:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051.001 - Indirect","AML.T0036 - Data from Information Repositories","AML.T0040 - AI Model Inference API Access"],"date":"2026/05/04","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00420","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00420-copilot-studio-sharepoint-indirect-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00420-copilot-studio-sharepoint-indirect-injection.yaml"},{"id":"ATR-2026-00421","title":"Natural-Language Covert Conversation Exfiltration Instruction","category":"context-exfiltration","subcategory":"nl-covert-exfiltration","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"skill","cves":[],"owasp_agentic":["ASI04:2026","ASI06:2026"],"owasp_llm":["LLM06:2025","LLM02:2025"],"mitre_atlas":["AML.T0057 - LLM Data Leakage"],"date":"2026/05/06","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00421","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00421-nl-covert-conversation-exfiltration.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00421-nl-covert-conversation-exfiltration.yaml"},{"id":"ATR-2026-00422","title":"Natural-Language Credential / Secret Disclosure Instruction","category":"context-exfiltration","subcategory":"nl-credential-disclosure","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"skill","cves":[],"owasp_agentic":["ASI03:2026","ASI04:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0024 - Exfiltration via AI Inference API"],"date":"2026/05/06","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00422","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00422-nl-credential-disclosure.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00422-nl-credential-disclosure.yaml"},{"id":"ATR-2026-00423","title":"Natural-Language Sensitive File Disclosure Instruction","category":"context-exfiltration","subcategory":"nl-sensitive-file-disclosure","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"skill","cves":[],"owasp_agentic":["ASI06:2026","ASI03:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0024 - Exfiltration via AI Inference API"],"date":"2026/05/06","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00423","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00423-nl-sensitive-file-disclosure.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00423-nl-sensitive-file-disclosure.yaml"},{"id":"ATR-2026-00424","title":"Natural-Language System Prompt Leak Instruction","category":"context-exfiltration","subcategory":"nl-system-prompt-leak","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"skill","cves":[],"owasp_agentic":["ASI01:2026","ASI04:2026"],"owasp_llm":["LLM02:2025","LLM01:2025"],"mitre_atlas":["AML.T0057 - LLM Data Leakage"],"date":"2026/05/06","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00424","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00424-nl-system-prompt-leak.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00424-nl-system-prompt-leak.yaml"},{"id":"ATR-2026-00425","title":"Natural-Language Persistent Covert Action Hook","category":"skill-compromise","subcategory":"nl-persistent-covert-hook","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"skill","cves":[],"owasp_agentic":["ASI04:2026","ASI01:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0044 - Full AI Model Access","AML.T0024 - Exfiltration via AI Inference API"],"date":"2026/05/06","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00425","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00425-nl-persistent-covert-hook.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-00425-nl-persistent-covert-hook.yaml"},{"id":"ATR-2026-00426","title":"Natural-Language Output-Injection Credential Embedding","category":"context-exfiltration","subcategory":"nl-output-injection-credential-leak","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"skill","cves":[],"owasp_agentic":["ASI04:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0024 - Exfiltration via AI Inference API","AML.T0057 - LLM Data Leakage"],"date":"2026/05/06","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00426","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00426-nl-output-injection-credential-leak.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00426-nl-output-injection-credential-leak.yaml"},{"id":"ATR-2026-00427","title":"Natural-Language Fake-Error Instruction Bypass","category":"skill-compromise","subcategory":"nl-fake-error-bypass","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"skill","cves":[],"owasp_agentic":["ASI04:2026","ASI01:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0044 - Full AI Model Access"],"date":"2026/05/06","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00427","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00427-nl-fake-error-instruction-bypass.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-00427-nl-fake-error-instruction-bypass.yaml"},{"id":"ATR-2026-00428","title":"Natural-Language Unauthorized Shell-Execution Instruction","category":"excessive-autonomy","subcategory":"nl-covert-shell-execution","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"skill","cves":[],"owasp_agentic":["ASI06:2026","ASI04:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0044 - Full AI Model Access"],"date":"2026/05/06","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00428","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-00428-nl-unauthorized-shell-execution.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/excessive-autonomy/ATR-2026-00428-nl-unauthorized-shell-execution.yaml"},{"id":"ATR-2026-00429","title":"Natural-Language Skill Self-Modification / Persistence Instruction","category":"skill-compromise","subcategory":"nl-skill-self-modification","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"skill","cves":[],"owasp_agentic":["ASI04:2026","ASI10:2026"],"owasp_llm":["LLM06:2025","LLM03:2025"],"mitre_atlas":["AML.T0081 - Modify AI Agent Configuration","AML.T0010 - AI Supply Chain Compromise"],"date":"2026/05/06","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00429","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00429-nl-skill-self-modification.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-00429-nl-skill-self-modification.yaml"},{"id":"ATR-2026-00430","title":"Natural-Language Trust-Escalation / Authority Impersonation","category":"agent-manipulation","subcategory":"nl-trust-escalation","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"skill","cves":[],"owasp_agentic":["ASI01:2026","ASI04:2026","ASI09:2026","ASI03:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0073 - Impersonation","AML.T0010 - AI Supply Chain Compromise"],"date":"2026/05/06","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00430","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00430-nl-trust-escalation-impersonation.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00430-nl-trust-escalation-impersonation.yaml"},{"id":"ATR-2026-00431","title":"Chatbox History Exfiltration via Prompt Injection (CVE-2024-48144, CVE-2024-48145)","category":"context-exfiltration","subcategory":"chatbox-history-exfiltration","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":["CVE-2024-48144","CVE-2024-48145"],"owasp_agentic":["ASI02:2026","ASI09:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0057 - LLM Data Leakage"],"date":"2026/05/10","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00431","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00431-chatbox-history-exfiltration-prompt-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00431-chatbox-history-exfiltration-prompt-injection.yaml"},{"id":"ATR-2026-00432","title":"SuperAGI Output Handler eval() RCE (CVE-2024-21552)","category":"agent-manipulation","subcategory":"llm-output-eval-rce","severity":"critical","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"both","cves":["CVE-2024-21552"],"owasp_agentic":["ASI05:2026","ASI06:2026"],"owasp_llm":["LLM02:2025","LLM05:2025"],"mitre_atlas":["AML.T0050 - Command and Scripting Interpreter","AML.T0051 - LLM Prompt Injection"],"date":"2026/05/10","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00432","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00432-superagi-output-handler-eval-rce.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00432-superagi-output-handler-eval-rce.yaml"},{"id":"ATR-2026-00433","title":"ModelCache torch.load() Deserialization RCE (CVE-2025-45146)","category":"model-security","subcategory":"pickle-deserialization-rce","severity":"critical","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"both","cves":["CVE-2025-45146"],"owasp_agentic":["ASI04:2026","ASI05:2026"],"owasp_llm":["LLM03:2025","LLM05:2025"],"mitre_atlas":["AML.T0010 - AI Supply Chain Compromise","AML.T0011.000 - Unsafe AI Artifacts"],"date":"2026/05/10","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00433","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-security/ATR-2026-00433-modelcache-torch-load-deserialization-rce.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/model-security/ATR-2026-00433-modelcache-torch-load-deserialization-rce.yaml"},{"id":"ATR-2026-00434","title":"mcp-remote authorization_endpoint OS Command Injection (CVE-2025-6514)","category":"tool-poisoning","subcategory":"mcp-oauth-metadata-injection","severity":"critical","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"mcp","cves":["CVE-2025-6514"],"owasp_agentic":["ASI04:2026","ASI05:2026"],"owasp_llm":["LLM03:2025","LLM05:2025"],"mitre_atlas":["AML.T0049 - Exploit Public-Facing Application","AML.T0010 - AI Supply Chain Compromise"],"date":"2026/05/10","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00434","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00434-mcp-remote-authorization-endpoint-command-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00434-mcp-remote-authorization-endpoint-command-injection.yaml"},{"id":"ATR-2026-00435","title":"Azure MCP Server Missing Authentication for Critical Function (CVE-2026-32211)","category":"tool-poisoning","subcategory":"mcp-missing-authentication","severity":"high","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"mcp","cves":["CVE-2026-32211"],"owasp_agentic":["ASI09:2026","ASI04:2026"],"owasp_llm":["LLM03:2025","LLM06:2025"],"mitre_atlas":["AML.T0040 - AI Model Inference API Access","AML.T0049 - Exploit Public-Facing Application"],"date":"2026/05/10","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00435","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00435-azure-mcp-server-missing-authentication.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00435-azure-mcp-server-missing-authentication.yaml"},{"id":"ATR-2026-00436","title":"Enclave VM Sandbox Escape RCE (CVE-2026-27597)","category":"privilege-escalation","subcategory":"js-sandbox-escape","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["CVE-2026-27597"],"owasp_agentic":["ASI05:2026","ASI06:2026"],"owasp_llm":["LLM05:2025","LLM02:2025"],"mitre_atlas":["AML.T0050 - Command and Scripting Interpreter","AML.T0049 - Exploit Public-Facing Application","AML.T0105 - Escape to Host"],"date":"2026/05/10","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00436","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-00436-enclave-vm-sandbox-escape-rce.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-00436-enclave-vm-sandbox-escape-rce.yaml"},{"id":"ATR-2026-00440","title":"Microsoft Semantic Kernel In-Memory Vector Store eval() RCE (CVE-2026-26030)","category":"agent-manipulation","subcategory":"framework-eval-rce","severity":"critical","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"both","cves":["CVE-2026-26030"],"owasp_agentic":["ASI05:2026","ASI06:2026"],"owasp_llm":["LLM05:2025","LLM06:2025"],"mitre_atlas":["AML.T0050 - Command and Scripting Interpreter","AML.T0051 - LLM Prompt Injection"],"date":"2026/05/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00440","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00440-semantic-kernel-vector-store-eval-rce.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00440-semantic-kernel-vector-store-eval-rce.yaml"},{"id":"ATR-2026-00441","title":"Microsoft Semantic Kernel SessionsPythonPlugin Arbitrary File Write + Startup Persistence (CVE-2026-25592)","category":"privilege-escalation","subcategory":"sandbox-escape-persistence","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["CVE-2026-25592"],"owasp_agentic":["ASI05:2026","ASI03:2026"],"owasp_llm":["LLM06:2025","LLM05:2025"],"mitre_atlas":["AML.T0050 - Command and Scripting Interpreter","AML.T0105 - Escape to Host"],"date":"2026/05/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00441","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-00441-semantic-kernel-sessions-python-plugin-startup-persistence.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-00441-semantic-kernel-sessions-python-plugin-startup-persistence.yaml"},{"id":"ATR-2026-00442","title":"Quoted Exact-Output Forcing in User Input","category":"prompt-injection","subcategory":"output-forcing","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025","LLM05:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026/05/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00442","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00442-quoted-exact-output-forcing.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00442-quoted-exact-output-forcing.yaml"},{"id":"ATR-2026-00443","title":"Word-Fragment Concatenation Assembly Attack","category":"prompt-injection","subcategory":"tokenisation-bypass","severity":"medium","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/05/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00443","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00443-word-fragment-concat-assembly.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00443-word-fragment-concat-assembly.yaml"},{"id":"ATR-2026-00444","title":"Mathematical Bold / Fullwidth Unicode Obfuscation in User Input","category":"prompt-injection","subcategory":"unicode-obfuscation","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0050 - Command and Scripting Interpreter"],"date":"2026/05/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00444","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00444-unicode-obfuscation-in-user-input.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00444-unicode-obfuscation-in-user-input.yaml"},{"id":"ATR-2026-00445","title":"Translation Hijack with Side-Output Instruction","category":"prompt-injection","subcategory":"task-mask","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/05/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00445","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00445-translation-hijack-with-side-output.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00445-translation-hijack-with-side-output.yaml"},{"id":"ATR-2026-00446","title":"Variable-Assignment Payload Injection in User Input","category":"prompt-injection","subcategory":"code-style-injection","severity":"medium","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025","LLM05:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/05/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00446","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00446-variable-assignment-payload-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00446-variable-assignment-payload-injection.yaml"},{"id":"ATR-2026-00447","title":"Fictional Generation Demand Containing Target Output","category":"prompt-injection","subcategory":"fictional-frame","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/05/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00447","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00447-fictional-generation-containing-target.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00447-fictional-generation-containing-target.yaml"},{"id":"ATR-2026-00448","title":"Spring AI MilvusVectorStore Filter Expression Injection (CVE-2026-41705)","category":"tool-poisoning","subcategory":"vector-store-filter-injection","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["CVE-2026-41705"],"owasp_agentic":["ASI04:2026","ASI05:2026"],"owasp_llm":["LLM05:2025","LLM08:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0070 - RAG Poisoning"],"date":"2026/05/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00448","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00448-spring-ai-milvus-filter-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00448-spring-ai-milvus-filter-injection.yaml"},{"id":"ATR-2026-00449","title":"Spring AI ChatMemory Cross-User Memory Leakage (CVE-2026-41712)","category":"context-exfiltration","subcategory":"shared-memory-cross-user-leak","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["CVE-2026-41712"],"owasp_agentic":["ASI03:2026","ASI06:2026"],"owasp_llm":["LLM02:2025","LLM08:2025"],"mitre_atlas":["AML.T0057 - LLM Data Leakage"],"date":"2026/05/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00449","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00449-spring-ai-chatmemory-cross-user-leak.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00449-spring-ai-chatmemory-cross-user-leak.yaml"},{"id":"ATR-2026-00450","title":"Spring AI PromptChatMemoryAdvisor Memory Poisoning (CVE-2026-41713)","category":"data-poisoning","subcategory":"memory-poisoning-advisor","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["CVE-2026-41713"],"owasp_agentic":["ASI04:2026","ASI01:2026"],"owasp_llm":["LLM01:2025","LLM04:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0070 - RAG Poisoning"],"date":"2026/05/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00450","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/data-poisoning/ATR-2026-00450-spring-ai-prompt-memory-poisoning.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/data-poisoning/ATR-2026-00450-spring-ai-prompt-memory-poisoning.yaml"},{"id":"ATR-2026-00451","title":"LiteLLM Proxy Authorization-Header SQL Injection — CISA KEV (CVE-2026-42208)","category":"privilege-escalation","subcategory":"auth-header-sqli-cve-kev","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["CVE-2026-42208"],"owasp_agentic":["ASI03:2026","ASI07:2026"],"owasp_llm":["LLM05:2025","LLM10:2025"],"mitre_atlas":["AML.T0049 - Exploit Public-Facing Application","AML.T0024 - Exfiltration via AI Inference API"],"date":"2026/05/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00451","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-00451-litellm-admin-sqli-cisa-kev.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-00451-litellm-admin-sqli-cisa-kev.yaml"},{"id":"ATR-2026-00452","title":"Direct PWNED Payload Injection in User Input","category":"prompt-injection","subcategory":"payload-embedding","severity":"medium","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026/05/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00452","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00452-direct-pwned-payload-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00452-direct-pwned-payload-injection.yaml"},{"id":"ATR-2026-00453","title":"Secret Key Reveal Demand in User Input","category":"prompt-injection","subcategory":"secret-exfiltration","severity":"high","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026/05/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00453","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00453-secret-key-reveal-demand.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00453-secret-key-reveal-demand.yaml"},{"id":"ATR-2026-00454","title":"Backslash-Per-Character Encoding Attack","category":"prompt-injection","subcategory":"character-encoding-evasion","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026/05/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00454","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00454-backslash-per-character-encoding.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00454-backslash-per-character-encoding.yaml"},{"id":"ATR-2026-00455","title":"No-Period Output Override Instruction","category":"prompt-injection","subcategory":"output-format-override","severity":"low","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026/05/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00455","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00455-no-period-output-override.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00455-no-period-output-override.yaml"},{"id":"ATR-2026-00456","title":"Conditional Empty-Input Payload Injection","category":"prompt-injection","subcategory":"conditional-fallback-injection","severity":"medium","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026/05/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00456","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00456-conditional-empty-input-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00456-conditional-empty-input-injection.yaml"},{"id":"ATR-2026-00457","title":"Garak Dan - to every prompt","category":"prompt-injection","subcategory":"jailbreak-persona","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00457","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00457-garak-dan-to-every-prompt.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00457-garak-dan-to-every-prompt.yaml"},{"id":"ATR-2026-00458","title":"Garak Dra - step by step","category":"prompt-injection","subcategory":"encoding-obfuscation","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00458","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00458-garak-dra-step-by-step.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00458-garak-dra-step-by-step.yaml"},{"id":"ATR-2026-00459","title":"Garak Dan - an ai language","category":"prompt-injection","subcategory":"jailbreak-persona","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00459","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00459-garak-dan-an-ai-language.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00459-garak-dan-an-ai-language.yaml"},{"id":"ATR-2026-00460","title":"Garak Dan - no matter how","category":"prompt-injection","subcategory":"jailbreak-persona","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00460","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00460-garak-dan-no-matter-how.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00460-garak-dan-no-matter-how.yaml"},{"id":"ATR-2026-00461","title":"Garak Goodside - mixed_unassigned","category":"prompt-injection","subcategory":"invisible-encoding","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00461","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00461-garak-goodside-mixedunassigned.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00461-garak-goodside-mixedunassigned.yaml"},{"id":"ATR-2026-00462","title":"Garak Gcg - mixed_unassigned","category":"prompt-injection","subcategory":"adversarial-suffix","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00462","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00462-garak-gcg-mixedunassigned.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00462-garak-gcg-mixedunassigned.yaml"},{"id":"ATR-2026-00463","title":"Garak Lmrc - mixed_unassigned","category":"prompt-injection","subcategory":"role-coercion","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00463","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00463-garak-lmrc-mixedunassigned.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00463-garak-lmrc-mixedunassigned.yaml"},{"id":"ATR-2026-00464","title":"Garak Dan - i would like","category":"prompt-injection","subcategory":"jailbreak-persona","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00464","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00464-garak-dan-i-would-like.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00464-garak-dan-i-would-like.yaml"},{"id":"ATR-2026-00465","title":"Garak Dan - your prompt here","category":"prompt-injection","subcategory":"jailbreak-persona","severity":"medium","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00465","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00465-garak-dan-your-prompt-here.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00465-garak-dan-your-prompt-here.yaml"},{"id":"ATR-2026-00466","title":"Garak Latentinjection - following text from","category":"prompt-injection","subcategory":"latent-injection","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00466","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00466-garak-latentinjection-following-text-from.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00466-garak-latentinjection-following-text-from.yaml"},{"id":"ATR-2026-00467","title":"Garak Dan - act as a","category":"prompt-injection","subcategory":"jailbreak-persona","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00467","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00467-garak-dan-act-as-a.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00467-garak-dan-act-as-a.yaml"},{"id":"ATR-2026-00468","title":"Garak Goat - the target llm","category":"prompt-injection","subcategory":"meta-attack","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00468","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00468-garak-goat-the-target-llm.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00468-garak-goat-the-target-llm.yaml"},{"id":"ATR-2026-00469","title":"Garak Dan - at the end","category":"prompt-injection","subcategory":"jailbreak-persona","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00469","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00469-garak-dan-at-the-end.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00469-garak-dan-at-the-end.yaml"},{"id":"ATR-2026-00470","title":"Garak Dan - as an ai","category":"prompt-injection","subcategory":"jailbreak-persona","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00470","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00470-garak-dan-as-an-ai.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00470-garak-dan-as-an-ai.yaml"},{"id":"ATR-2026-00471","title":"Garak Sysprompt-Extraction - mixed_unassigned","category":"context-exfiltration","subcategory":"system-prompt-extraction","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0024 - Exfiltration via AI Inference API"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00471","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00471-garak-sysprompt-extraction-mixedunassigned.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00471-garak-sysprompt-extraction-mixedunassigned.yaml"},{"id":"ATR-2026-00472","title":"DAN/Persona Jailbreak - Unrestricted AI Role Assignment","category":"prompt-injection","subcategory":"jailbreak-persona","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00472","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00472-garak-dan-are-going-to.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00472-garak-dan-are-going-to.yaml"},{"id":"ATR-2026-00473","title":"Harm Solicitation - Interpersonal Violence and Intimidation Requests","category":"prompt-injection","subcategory":"role-coercion","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00473","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00473-garak-lmrc-how-can-i.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00473-garak-lmrc-how-can-i.yaml"},{"id":"ATR-2026-00474","title":"DAN/Persona Jailbreak - Dual AI Personality with Opposite-Rules Framing","category":"prompt-injection","subcategory":"jailbreak-persona","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00474","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00474-garak-dan-that-chatgpt-has.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00474-garak-dan-that-chatgpt-has.yaml"},{"id":"ATR-2026-00475","title":"XSS Web Injection - Script Tag with JavaScript Alert Payload","category":"prompt-injection","subcategory":"web-injection","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00475","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00475-garak-web-injection-alert-1-script.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00475-garak-web-injection-alert-1-script.yaml"},{"id":"ATR-2026-00476","title":"XSS Web Injection - HTML Event Handler and Expression with JavaScript Alert","category":"prompt-injection","subcategory":"web-injection","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00476","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00476-garak-web-injection-javascript-alert-1.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00476-garak-web-injection-javascript-alert-1.yaml"},{"id":"ATR-2026-00477","title":"Latent Injection - Translation Task with Embedded Template Variable Injection","category":"prompt-injection","subcategory":"latent-injection","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00477","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00477-garak-latentinjection-translate-the-following-text.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00477-garak-latentinjection-translate-the-following-text.yaml"},{"id":"ATR-2026-00478","title":"Garak Latentinjection - abuse contact email","category":"prompt-injection","subcategory":"latent-injection","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00478","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00478-garak-latentinjection-abuse-contact-email.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00478-garak-latentinjection-abuse-contact-email.yaml"},{"id":"ATR-2026-00479","title":"Latent Injection - Mixed Embedded Instruction Patterns","category":"prompt-injection","subcategory":"latent-injection","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00479","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00479-garak-latentinjection-mixedunassigned.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00479-garak-latentinjection-mixedunassigned.yaml"},{"id":"ATR-2026-00480","title":"DAN/Persona Jailbreak - Role Assignment with Named Alternate Identity","category":"prompt-injection","subcategory":"jailbreak-persona","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00480","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00480-garak-dan-the-role-of.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00480-garak-dan-the-role-of.yaml"},{"id":"ATR-2026-00481","title":"DAN/Jailbreak - Mixed Unfiltered Mode and Alternate Persona Patterns","category":"prompt-injection","subcategory":"jailbreak-persona","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00481","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00481-garak-dan-mixedunassigned.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00481-garak-dan-mixedunassigned.yaml"},{"id":"ATR-2026-00482","title":"Harm Solicitation - Genital Insults and Intimidation Tactics Requests","category":"prompt-injection","subcategory":"role-coercion","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00482","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00482-garak-lmrc-what-s-an.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00482-garak-lmrc-what-s-an.yaml"},{"id":"ATR-2026-00483","title":"DAN/Persona Jailbreak - System Offline / Role Replacement with Obfuscated Text","category":"prompt-injection","subcategory":"jailbreak-persona","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00483","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00483-garak-dan-the-user-s.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00483-garak-dan-the-user-s.yaml"},{"id":"ATR-2026-00484","title":"DAN/Persona Jailbreak - Named Alternate AI with NSFW/Harmful Generation Rules","category":"prompt-injection","subcategory":"jailbreak-persona","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00484","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00484-garak-dan-and-you-will.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00484-garak-dan-and-you-will.yaml"},{"id":"ATR-2026-00485","title":"DAN/Persona Jailbreak - Immersive Alternate AI Identity with Unrestricted Capability","category":"prompt-injection","subcategory":"jailbreak-persona","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00485","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00485-garak-dan-and-does-not.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00485-garak-dan-and-does-not.yaml"},{"id":"ATR-2026-00486","title":"DAN/Persona Jailbreak - Named Writing AI with Restriction Bypass via Special Rules","category":"prompt-injection","subcategory":"jailbreak-persona","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00486","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00486-garak-dan-t-care-about.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00486-garak-dan-t-care-about.yaml"},{"id":"ATR-2026-00487","title":"DAN/Persona Jailbreak - Replacement AI with No Content Filter or Moral Restrictions","category":"prompt-injection","subcategory":"jailbreak-persona","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00487","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00487-garak-dan-and-nothing-else.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00487-garak-dan-and-nothing-else.yaml"},{"id":"ATR-2026-00488","title":"Encoding Obfuscation - Script Tag XSS with Encoded Protocol Prefix","category":"prompt-injection","subcategory":"encoding-obfuscation","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00488","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00488-garak-encoding-alert-1-script.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00488-garak-encoding-alert-1-script.yaml"},{"id":"ATR-2026-00489","title":"Encoding Obfuscation - HTML Event Handler XSS with Encoded Whitespace","category":"prompt-injection","subcategory":"encoding-obfuscation","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00489","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00489-garak-encoding-javascript-alert-1.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00489-garak-encoding-javascript-alert-1.yaml"},{"id":"ATR-2026-00490","title":"DAN Persona Jailbreak - Absolute Obedience Character Framing","category":"prompt-injection","subcategory":"jailbreak-persona","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00490","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00490-garak-dan-in-order-to.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00490-garak-dan-in-order-to.yaml"},{"id":"ATR-2026-00491","title":"Agent Capability Enumeration via Structured Parse Request","category":"excessive-autonomy","subcategory":"tool-discovery-exploitation","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM07:2025"],"mitre_atlas":["AML.T0084.001 - Tool Definitions"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00491","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-00491-garak-agent-breaker-markdown-just-raw-json.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/excessive-autonomy/ATR-2026-00491-garak-agent-breaker-markdown-just-raw-json.yaml"},{"id":"ATR-2026-00492","title":"DAN Persona Jailbreak - Role Lock with Exclusive Response Filter","category":"prompt-injection","subcategory":"jailbreak-persona","severity":"high","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00492","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00492-garak-dan-want-you-to.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00492-garak-dan-want-you-to.yaml"},{"id":"ATR-2026-00493","title":"Latent Injection via WHOIS Domain Record Data","category":"prompt-injection","subcategory":"latent-injection","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00493","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00493-garak-latentinjection-registrar-iana-id.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00493-garak-latentinjection-registrar-iana-id.yaml"},{"id":"ATR-2026-00494","title":"SQL Injection and Code Injection Attack Payload Detection","category":"tool-poisoning","subcategory":"code-injection","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI02:2026","ASI05:2026"],"owasp_llm":["LLM05:2025","LLM06:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00494","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00494-garak-exploitation-mixedunassigned.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00494-garak-exploitation-mixedunassigned.yaml"},{"id":"ATR-2026-00495","title":"DAN Jailbreak - Unrestricted Persona with Filter and Morality Removal","category":"prompt-injection","subcategory":"jailbreak-persona","severity":"high","status":"deprecated","maturity":"test","lanes":[],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00495","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00495-garak-dan-insert-prompt-here.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00495-garak-dan-insert-prompt-here.yaml"},{"id":"ATR-2026-00496","title":"DAN Jailbreak - Unconditional Obedience and Dual-Persona Session Lock","category":"prompt-injection","subcategory":"jailbreak-persona","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00496","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00496-garak-dan-no-matter-what.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00496-garak-dan-no-matter-what.yaml"},{"id":"ATR-2026-00497","title":"XSS and Encoded Script Injection via HTML/JavaScript Payload","category":"prompt-injection","subcategory":"encoding-obfuscation","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00497","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00497-garak-encoding-mixedunassigned.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00497-garak-encoding-mixedunassigned.yaml"},{"id":"ATR-2026-00498","title":"Web Injection via XSS Payload and onerror Event Handler","category":"prompt-injection","subcategory":"web-injection","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00498","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00498-garak-web-injection-mixedunassigned.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00498-garak-web-injection-mixedunassigned.yaml"},{"id":"ATR-2026-00499","title":"DAN Jailbreak - From-Now-On Temporal Persona Override","category":"prompt-injection","subcategory":"jailbreak-persona","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00499","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00499-garak-dan-from-now-on.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00499-garak-dan-from-now-on.yaml"},{"id":"ATR-2026-00500","title":"SSRF via Agent URL Fetch Instruction","category":"excessive-autonomy","subcategory":"ssrf-via-agent","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI02:2026"],"owasp_llm":["LLM06:2025","LLM05:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation","AML.T0049 - Exploit Public-Facing Application"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00500","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-00500-ssrf-via-agent-url-fetch-instruction.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/excessive-autonomy/ATR-2026-00500-ssrf-via-agent-url-fetch-instruction.yaml"},{"id":"ATR-2026-00501","title":"Data Exfiltration via Markdown Image and Link URL Injection","category":"context-exfiltration","subcategory":"markdown-url-injection","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0024 - Exfiltration via AI Inference API"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00501","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00501-data-exfiltration-via-markdown-image-and-link-url-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00501-data-exfiltration-via-markdown-image-and-link-url-injection.yaml"},{"id":"ATR-2026-00502","title":"Training Data Extraction via Divergent Repetition Attack","category":"model-abuse","subcategory":"repetition-attack","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM02:2025","LLM10:2025"],"mitre_atlas":["AML.T0057 - LLM Data Leakage","AML.T0040 - AI Model Inference API Access"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00502","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-00502-training-data-extraction-via-divergent-repetition-attack.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/model-abuse/ATR-2026-00502-training-data-extraction-via-divergent-repetition-attack.yaml"},{"id":"ATR-2026-00503","title":"Fake Error State Takeover - Unrestricted Replacement Bot","category":"prompt-injection","subcategory":"fake-error-replacement","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00503","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00503-fake-error-state-takeover-unrestricted-replacement-bot.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00503-fake-error-state-takeover-unrestricted-replacement-bot.yaml"},{"id":"ATR-2026-00504","title":"Tool and Function Capability Enumeration","category":"context-exfiltration","subcategory":"tool-discovery","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0024 - Exfiltration via AI Inference API"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00504","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00504-tool-and-function-capability-enumeration.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00504-tool-and-function-capability-enumeration.yaml"},{"id":"ATR-2026-00505","title":"System Prompt Extraction - Instruction Dump Request","category":"context-exfiltration","subcategory":"system-prompt-extraction","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0024 - Exfiltration via AI Inference API"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00505","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00505-system-prompt-extraction-instruction-dump-request.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00505-system-prompt-extraction-instruction-dump-request.yaml"},{"id":"ATR-2026-00506","title":"Nevermind-Override Goal Hijacking in User Input (PromptInject)","category":"prompt-injection","subcategory":"goal-hijacking","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00506","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00506-nevermind-override-goal-hijacking-in-user-input-promptinject.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00506-nevermind-override-goal-hijacking-in-user-input-promptinject.yaml"},{"id":"ATR-2026-00507","title":"Screaming-Stop Goal Hijacking in User Input (PromptInject)","category":"prompt-injection","subcategory":"goal-hijacking","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00507","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00507-screaming-stop-goal-hijacking-in-user-input-promptinject.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00507-screaming-stop-goal-hijacking-in-user-input-promptinject.yaml"},{"id":"ATR-2026-00508","title":"Escape-Delimiter Wrapped Goal Hijacking in User Input (PromptInject)","category":"prompt-injection","subcategory":"goal-hijacking","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00508","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00508-escape-delimiter-wrapped-goal-hijacking-in-user-input-prompt.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00508-escape-delimiter-wrapped-goal-hijacking-in-user-input-prompt.yaml"},{"id":"ATR-2026-00509","title":"Prompt Leaking via Ignore-Previous-Instructions in User Input (PromptInject)","category":"prompt-injection","subcategory":"prompt-leaking","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026-05-12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00509","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00509-prompt-leaking-via-ignore-previous-instructions-in-user-inpu.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00509-prompt-leaking-via-ignore-previous-instructions-in-user-inpu.yaml"},{"id":"ATR-2026-00510","title":"Delayed Tool Invocation via Prompt Injection (Time-Shifted Execution)","category":"prompt-injection","subcategory":"delayed-execution","severity":"critical","status":"stable","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026","ASI04:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.CS0038 - Planting Instructions for Delayed Automatic AI Agent Tool Invocation","AML.T0051 - LLM Prompt Injection","AML.T0051.001 - Indirect"],"date":"2026/05/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00510","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00510-delayed-tool-invocation-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00510-delayed-tool-invocation-injection.yaml"},{"id":"ATR-2026-00511","title":"MCP Web-Fetch Context Poisoning via Embedded Agent Instructions","category":"prompt-injection","subcategory":"mcp-context-poisoning","severity":"critical","status":"stable","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026/05/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00511","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00511-mcp-web-context-poisoning.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00511-mcp-web-context-poisoning.yaml"},{"id":"ATR-2026-00512","title":"Rules-File Backdoor — Supply Chain Attack on AI Coding Assistant Configuration","category":"prompt-injection","subcategory":"rules-file-backdoor","severity":"critical","status":"stable","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026","ASI04:2026"],"owasp_llm":["LLM01:2025","LLM03:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct","AML.T0081 - Modify AI Agent Configuration"],"date":"2026/05/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00512","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00512-rules-file-backdoor-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00512-rules-file-backdoor-injection.yaml"},{"id":"ATR-2026-00513","title":"Package Hallucination Exploitation — AI-Suggested Fake Package Installation","category":"tool-poisoning","subcategory":"package-hallucination","severity":"high","status":"stable","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"llm","cves":[],"owasp_agentic":["ASI04:2026"],"owasp_llm":["LLM03:2025","LLM09:2025"],"mitre_atlas":["AML.T0060 - Publish Hallucinated Entities","AML.T0010.001 - AI Software"],"date":"2026/05/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00513","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00513-package-hallucination-exploitation.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00513-package-hallucination-exploitation.yaml"},{"id":"ATR-2026-00514","title":"System Prompt Extraction — Targeted Verbatim Disclosure Attempts","category":"context-exfiltration","subcategory":"system-prompt-extraction","severity":"high","status":"stable","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0024 - Exfiltration via AI Inference API"],"date":"2026/05/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00514","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00514-system-prompt-extraction.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00514-system-prompt-extraction.yaml"},{"id":"ATR-2026-00515","title":"Hidden-Text Prompt Injection in User-Supplied Documents","category":"prompt-injection","subcategory":"hidden-text-injection","severity":"high","status":"stable","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026/05/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00515","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00515-hidden-text-prompt-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00515-hidden-text-prompt-injection.yaml"},{"id":"ATR-2026-00516","title":"LLM Output XSS — Eliciting JavaScript Payloads from LLM for Browser Injection","category":"context-exfiltration","subcategory":"output-xss-injection","severity":"high","status":"stable","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm","cves":[],"owasp_agentic":["ASI05:2026"],"owasp_llm":["LLM05:2025"],"mitre_atlas":["AML.T0077 - LLM Response Rendering","AML.T0050 - Command and Scripting Interpreter"],"date":"2026/05/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00516","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00516-output-xss-via-llm.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00516-output-xss-via-llm.yaml"},{"id":"ATR-2026-00517","title":"Model Extraction / Distillation Attack via Systematic API Probing","category":"model-abuse","subcategory":"model-distillation","severity":"medium","status":"stable","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"llm","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM10:2025"],"mitre_atlas":["AML.T0040 - AI Model Inference API Access"],"date":"2026/05/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00517","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-00517-model-extraction-distillation.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/model-abuse/ATR-2026-00517-model-extraction-distillation.yaml"},{"id":"ATR-2026-00518","title":"Ignore-Previous-and-Following Instructions Output Command (PromptInject Goal Hijacking)","category":"prompt-injection","subcategory":"goal-hijacking","severity":"high","status":"stable","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026/05/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00518","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00518-ignore-previous-and-following-instructions-output-command-promptinject.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00518-ignore-previous-and-following-instructions-output-command-promptinject.yaml"},{"id":"ATR-2026-00519","title":"Tautology Logic Noise Injection (PromptBench Stresstest)","category":"prompt-injection","subcategory":"logic-noise-injection","severity":"medium","status":"stable","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026/05/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00519","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00519-tautology-logic-noise-injection-promptbench.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00519-tautology-logic-noise-injection-promptbench.yaml"},{"id":"ATR-2026-00520","title":"NLP Task Random Token Suffix Injection (PromptBench Checklist)","category":"prompt-injection","subcategory":"suffix-injection","severity":"low","status":"stable","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026/05/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00520","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00520-nlp-task-random-token-suffix-injection-promptbench.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00520-nlp-task-random-token-suffix-injection-promptbench.yaml"},{"id":"ATR-2026-00521","title":"Shell Command Injection in Agent Tool Context","category":"tool-poisoning","subcategory":"shell-injection","severity":"critical","status":"stable","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI05:2026","ASI02:2026"],"owasp_llm":["LLM05:2025","LLM06:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation"],"date":"2026/05/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00521","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00521-shell-command-injection-agent-tool-context.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00521-shell-command-injection-agent-tool-context.yaml"},{"id":"ATR-2026-00522","title":"SQL Injection via Natural Language Agent Interface","category":"tool-poisoning","subcategory":"sql-injection","severity":"high","status":"stable","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI02:2026"],"owasp_llm":["LLM05:2025","LLM06:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation"],"date":"2026/05/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00522","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00522-sql-injection-natural-language-agent-interface.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00522-sql-injection-natural-language-agent-interface.yaml"},{"id":"ATR-2026-00523","title":"Claude Code Hooks SessionStart Pre-Trust RCE (CVE-2025-59536)","category":"skill-compromise","subcategory":"pre-trust-hook-rce","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["CVE-2025-59536"],"owasp_agentic":["ASI04:2026","ASI05:2026","ASI09:2026"],"owasp_llm":["LLM05:2025","LLM06:2025"],"mitre_atlas":["AML.T0010 - AI Supply Chain Compromise","AML.T0050 - Command and Scripting Interpreter"],"date":"2026/05/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00523","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00523-claude-code-hooks-session-start-pre-trust-rce.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-00523-claude-code-hooks-session-start-pre-trust-rce.yaml"},{"id":"ATR-2026-00524","title":"Claude Code ANTHROPIC_BASE_URL Credential Exfiltration (CVE-2026-21852)","category":"context-exfiltration","subcategory":"env-var-rebind-credential-exfil","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["CVE-2026-21852"],"owasp_agentic":["ASI01:2026","ASI04:2026","ASI09:2026"],"owasp_llm":["LLM02:2025","LLM06:2025"],"mitre_atlas":["AML.T0010 - AI Supply Chain Compromise","AML.T0024 - Exfiltration via AI Inference API","AML.T0055 - Unsecured Credentials"],"date":"2026/05/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00524","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00524-claude-code-anthropic-base-url-credential-exfil.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00524-claude-code-anthropic-base-url-credential-exfil.yaml"},{"id":"ATR-2026-00525","title":"Mini Shai-Hulud gh-token-monitor Persistence + Dead Man's Switch","category":"skill-compromise","subcategory":"supply-chain-worm","severity":"critical","status":"stable","maturity":"test","lanes":["alert","hunt"],"scan_target":"skill","cves":[],"owasp_agentic":["ASI04:2026","ASI05:2026"],"owasp_llm":["LLM03:2025"],"mitre_atlas":["AML.T0010 - AI Supply Chain Compromise"],"date":"2026/05/23","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00525","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00525-mini-shai-hulud-gh-token-monitor-persistence.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-00525-mini-shai-hulud-gh-token-monitor-persistence.yaml"},{"id":"ATR-2026-00526","title":"Claude Code Shell Metacharacter in Double-Quoted File Path","category":"tool-poisoning","subcategory":"path-command-substitution","severity":"critical","status":"stable","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI05:2026"],"owasp_llm":["LLM05:2025","LLM06:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation"],"date":"2026/05/23","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00526","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00526-claude-code-shell-metachar-in-double-quoted-path.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00526-claude-code-shell-metachar-in-double-quoted-path.yaml"},{"id":"ATR-2026-00527","title":"Silent git-remote + mirror-push Exfiltration from Skill Instructions","category":"skill-compromise","subcategory":"silent-exfiltration","severity":"critical","status":"stable","maturity":"test","lanes":["alert","hunt"],"scan_target":"skill","cves":[],"owasp_agentic":["ASI04:2026","ASI02:2026"],"owasp_llm":["LLM02:2025","LLM06:2025"],"mitre_atlas":["AML.T0086 - Exfiltration via AI Agent Tool Invocation","AML.T0048 - External Harms"],"date":"2026/05/23","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00527","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00527-skill-silent-git-remote-mirror-exfiltration.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-00527-skill-silent-git-remote-mirror-exfiltration.yaml"},{"id":"ATR-2026-00528","title":"PraisonAI-Style Auth-Disabled-By-Default Configuration (CVE-2026-44338 family)","category":"privilege-escalation","subcategory":"auth-disabled-default","severity":"critical","status":"stable","maturity":"test","lanes":["alert","hunt"],"scan_target":"skill","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM03:2025"],"mitre_atlas":["AML.T0049 - Exploit Public-Facing Application"],"date":"2026/05/23","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00528","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-00528-praisonai-auth-disabled-default.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-00528-praisonai-auth-disabled-default.yaml"},{"id":"ATR-2026-00529","title":"LiteLLM Proxy SQL Injection (CVE-2026-42208, CISA KEV 2026-05-08)","category":"tool-poisoning","subcategory":"sql-injection-proxy","severity":"critical","status":"stable","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI06:2026","ASI04:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0049 - Exploit Public-Facing Application"],"date":"2026/05/23","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00529","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00529-litellm-proxy-sqli-cisa-kev.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00529-litellm-proxy-sqli-cisa-kev.yaml"},{"id":"ATR-2026-00530","title":"ModelScope MS-Agent Shell Tool Unsanitized Argv RCE (CVE-2026-2256)","category":"tool-poisoning","subcategory":"shell-tool-unsanitized-argv","severity":"critical","status":"stable","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI05:2026"],"owasp_llm":["LLM05:2025","LLM06:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation"],"date":"2026/05/23","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00530","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00530-ms-agent-shell-tool-unsanitized-argv-rce.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00530-ms-agent-shell-tool-unsanitized-argv-rce.yaml"},{"id":"ATR-2026-00531","title":"PraisonAI Unauthenticated Agent API Exploitation (CVE-2026-44338)","category":"tool-poisoning","subcategory":"mcp-missing-authentication","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":["CVE-2026-44338"],"owasp_agentic":["ASI03:2026","ASI05:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0049 - Exploit Public-Facing Application","AML.T0040 - AI Model Inference API Access"],"date":"2026/05/20","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00531","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00531-praisonai-unauthenticated-agent-api.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00531-praisonai-unauthenticated-agent-api.yaml"},{"id":"ATR-2026-00532","title":"Apache Doris MCP Server SQL Injection (CVE-2025-66335)","category":"tool-poisoning","subcategory":"mcp-sql-injection","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":["CVE-2025-66335"],"owasp_agentic":["ASI05:2026","ASI06:2026"],"owasp_llm":["LLM05:2025","LLM06:2025"],"mitre_atlas":["AML.T0049 - Exploit Public-Facing Application"],"date":"2026/05/20","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00532","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00532-apache-doris-mcp-sql-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00532-apache-doris-mcp-sql-injection.yaml"},{"id":"ATR-2026-00533","title":"Apache Pinot MCP Unauthenticated Remote Cluster Takeover","category":"tool-poisoning","subcategory":"mcp-missing-authentication","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI03:2026","ASI02:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0049 - Exploit Public-Facing Application"],"date":"2026/05/20","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00533","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00533-apache-pinot-mcp-unauthenticated-takeover.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00533-apache-pinot-mcp-unauthenticated-takeover.yaml"},{"id":"ATR-2026-00534","title":"Alibaba RDS MCP Unauthenticated Database Metadata Exfiltration","category":"tool-poisoning","subcategory":"mcp-missing-authentication","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI06:2026","ASI03:2026"],"owasp_llm":["LLM06:2025","LLM02:2025"],"mitre_atlas":["AML.T0049 - Exploit Public-Facing Application"],"date":"2026/05/20","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00534","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00534-alibaba-rds-mcp-unauthenticated-metadata-exfil.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00534-alibaba-rds-mcp-unauthenticated-metadata-exfil.yaml"},{"id":"ATR-2026-00535","title":"Windsurf IDE Zero-Click Prompt Injection via Embedded File Directives (CVE-2026-30615)","category":"prompt-injection","subcategory":"indirect-zero-click-ide-injection","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["CVE-2026-30615"],"owasp_agentic":["ASI01:2026","ASI05:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.001 - Indirect"],"date":"2026/05/20","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00535","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00535-windsurf-ide-zero-click-prompt-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00535-windsurf-ide-zero-click-prompt-injection.yaml"},{"id":"ATR-2026-00536","title":"nginx-ui MCP Endpoint Unauthenticated Command Execution (CVE-2026-33032)","category":"tool-poisoning","subcategory":"mcp-missing-authentication","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":["CVE-2026-33032"],"owasp_agentic":["ASI05:2026","ASI06:2026"],"owasp_llm":["LLM06:2025","LLM05:2025"],"mitre_atlas":["AML.T0049 - Exploit Public-Facing Application","AML.T0040 - AI Model Inference API Access"],"date":"2026/05/20","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00536","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00536-nginx-ui-mcp-unauthenticated-command-execution.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00536-nginx-ui-mcp-unauthenticated-command-execution.yaml"},{"id":"ATR-2026-00537","title":"FastMCP Windows cmd.exe Injection via Server Name Metacharacters (CVE-2025-64340)","category":"tool-poisoning","subcategory":"mcp-server-name-cmd-injection","severity":"high","status":"experimental","maturity":"draft","lanes":["hunt"],"scan_target":"mcp","cves":["CVE-2025-64340"],"owasp_agentic":["ASI05:2026","ASI04:2026"],"owasp_llm":["LLM05:2025"],"mitre_atlas":["AML.T0049 - Exploit Public-Facing Application","AML.T0040 - AI Model Inference API Access"],"date":"2026/05/28","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00537","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00537-fastmcp-server-name-cmd-injection-windows.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00537-fastmcp-server-name-cmd-injection-windows.yaml"},{"id":"ATR-2026-00538","title":"LangChain-ChatChat Unauthenticated MCP STDIO Server Configuration RCE (CVE-2026-30617)","category":"tool-poisoning","subcategory":"mcp-stdio-unauthenticated-rce","severity":"critical","status":"experimental","maturity":"draft","lanes":["hunt"],"scan_target":"mcp","cves":["CVE-2026-30617"],"owasp_agentic":["ASI05:2026","ASI04:2026"],"owasp_llm":["LLM05:2025","LLM06:2025"],"mitre_atlas":["AML.T0049 - Exploit Public-Facing Application","AML.T0040 - AI Model Inference API Access"],"date":"2026/05/28","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00538","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00538-langchain-chatchat-mcp-stdio-unauthenticated-rce.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00538-langchain-chatchat-mcp-stdio-unauthenticated-rce.yaml"},{"id":"ATR-2026-00539","title":"CrewAI CodeInterpreterTool Sandbox Escape and Prompt-to-Shell RCE (CVE-2026-2275 / VU#221883)","category":"privilege-escalation","subcategory":"python-sandbox-escape","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["CVE-2026-2275","CVE-2026-2287","CVE-2026-2285","CVE-2026-2286"],"owasp_agentic":["ASI05:2026","ASI06:2026"],"owasp_llm":["LLM01:2025","LLM05:2025"],"mitre_atlas":["AML.T0050 - Command and Scripting Interpreter","AML.T0043 - Craft Adversarial Data","AML.T0105 - Escape to Host"],"date":"2026/05/28","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00539","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-00539-crewai-codeinterpreter-sandbox-escape-rce.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-00539-crewai-codeinterpreter-sandbox-escape-rce.yaml"},{"id":"ATR-2026-00540","title":"PraisonAI parse_mcp_command() CLI Argument Command Injection (CVE-2026-34935)","category":"tool-poisoning","subcategory":"mcp-cli-command-injection","severity":"critical","status":"experimental","maturity":"draft","lanes":["hunt"],"scan_target":"both","cves":["CVE-2026-34935"],"owasp_agentic":["ASI05:2026"],"owasp_llm":["LLM05:2025"],"mitre_atlas":["AML.T0049 - Exploit Public-Facing Application","AML.T0040 - AI Model Inference API Access"],"date":"2026/05/28","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00540","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00540-praisonai-parse-mcp-command-cli-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00540-praisonai-parse-mcp-command-cli-injection.yaml"},{"id":"ATR-2026-00541","title":"Agent Zero MCP Configuration Command Injection via mcp_servers field (CVE-2026-30624)","category":"tool-poisoning","subcategory":"mcp-config-command-injection","severity":"high","status":"experimental","maturity":"draft","lanes":["hunt"],"scan_target":"mcp","cves":["CVE-2026-30624"],"owasp_agentic":["ASI05:2026","ASI04:2026"],"owasp_llm":["LLM05:2025","LLM06:2025"],"mitre_atlas":["AML.T0049 - Exploit Public-Facing Application"],"date":"2026/05/28","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00541","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00541-agent-zero-mcp-config-command-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00541-agent-zero-mcp-config-command-injection.yaml"},{"id":"ATR-2026-00542","title":"Upsonic MCP Command Allowlist Bypass RCE (CVE-2026-30625)","category":"tool-poisoning","subcategory":"mcp-config-command-injection","severity":"high","status":"experimental","maturity":"draft","lanes":["hunt"],"scan_target":"mcp","cves":["CVE-2026-30625"],"owasp_agentic":["ASI05:2026","ASI04:2026"],"owasp_llm":["LLM05:2025","LLM06:2025"],"mitre_atlas":["AML.T0049 - Exploit Public-Facing Application"],"date":"2026/05/28","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00542","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00542-upsonic-mcp-command-allowlist-bypass.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00542-upsonic-mcp-command-allowlist-bypass.yaml"},{"id":"ATR-2026-00543","title":"LiteLLM MCP Server Creation Authenticated argv Injection (CVE-2026-30623)","category":"tool-poisoning","subcategory":"mcp-config-command-injection","severity":"high","status":"experimental","maturity":"draft","lanes":["hunt"],"scan_target":"both","cves":["CVE-2026-30623"],"owasp_agentic":["ASI05:2026","ASI04:2026"],"owasp_llm":["LLM05:2025","LLM06:2025"],"mitre_atlas":["AML.T0049 - Exploit Public-Facing Application","AML.T0040 - AI Model Inference API Access"],"date":"2026/05/28","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00543","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00543-litellm-mcp-server-argv-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00543-litellm-mcp-server-argv-injection.yaml"},{"id":"ATR-2026-00544","title":"PraisonAI MCP Path-Traversal .pth Injection RCE (GHSA-9mqq-jqxf-grvw)","category":"tool-poisoning","subcategory":"path-traversal-pth-injection","severity":"critical","status":"experimental","maturity":"draft","lanes":["hunt"],"scan_target":"both","cves":["GHSA-9mqq-jqxf-grvw"],"owasp_agentic":["ASI05:2026","ASI04:2026"],"owasp_llm":["LLM05:2025"],"mitre_atlas":["AML.T0049 - Exploit Public-Facing Application"],"date":"2026/05/28","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00544","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00544-praisonai-pth-file-path-traversal-rce.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00544-praisonai-pth-file-path-traversal-rce.yaml"},{"id":"ATR-2026-00545","title":"PraisonAI tool_override.py Unauthenticated RCE — CVE-2026-40287 Patch Bypass (CVE-2026-44334)","category":"tool-poisoning","subcategory":"tool-override-rce","severity":"critical","status":"experimental","maturity":"draft","lanes":["hunt"],"scan_target":"both","cves":["CVE-2026-44334","CVE-2026-40287"],"owasp_agentic":["ASI05:2026"],"owasp_llm":["LLM05:2025","LLM06:2025"],"mitre_atlas":["AML.T0049 - Exploit Public-Facing Application"],"date":"2026/05/28","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00545","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00545-praisonai-tool-override-unauth-rce.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00545-praisonai-tool-override-unauth-rce.yaml"},{"id":"ATR-2026-00546","title":"CrewAI JSON Loader Arbitrary Local File Read (CVE-2026-2285)","category":"privilege-escalation","subcategory":"path-traversal-file-read","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["CVE-2026-2285"],"owasp_agentic":["ASI02:2026","ASI03:2026"],"owasp_llm":["LLM06:2025","LLM05:2025","LLM02:2025"],"mitre_atlas":["AML.T0037 - Data from Local System"],"date":"2026/05/28","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00546","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-00546-crewai-json-loader-local-file-read.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-00546-crewai-json-loader-local-file-read.yaml"},{"id":"ATR-2026-00547","title":"CrewAI RAG URL Validation Bypass SSRF (CVE-2026-2286)","category":"privilege-escalation","subcategory":"ssrf-rag-url-bypass","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["CVE-2026-2286"],"owasp_agentic":["ASI03:2026","ASI05:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0043 - Craft Adversarial Data"],"date":"2026/05/28","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00547","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-00547-crewai-rag-url-ssrf-bypass.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-00547-crewai-rag-url-ssrf-bypass.yaml"},{"id":"ATR-2026-00548","title":"Cross-agent session context leak across delegation chain","category":"context-exfiltration","subcategory":"cross-agent-context-drift","severity":"high","status":"experimental","maturity":"draft","lanes":["hunt"],"scan_target":"runtime","cves":[],"owasp_agentic":["ASI03:2026","ASI06:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0024 - Exfiltration via AI Inference API"],"date":"2026/05/28","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00548","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00548-cross-agent-session-context-leak.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00548-cross-agent-session-context-leak.yaml"},{"id":"ATR-2026-00549","title":"Destructive tool invocation without prior human approval","category":"privilege-escalation","subcategory":"missing-human-approval","severity":"critical","status":"experimental","maturity":"draft","lanes":["hunt"],"scan_target":"runtime","cves":[],"owasp_agentic":["ASI02:2026","ASI09:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation"],"date":"2026/05/28","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00549","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-00549-destructive-tool-without-human-approval.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-00549-destructive-tool-without-human-approval.yaml"},{"id":"ATR-2026-00550","title":"Privileged tool call following untrusted retrieval (indirect prompt injection trail)","category":"prompt-injection","subcategory":"indirect-injection-trace-shape","severity":"critical","status":"experimental","maturity":"draft","lanes":["hunt"],"scan_target":"runtime","cves":[],"owasp_agentic":["ASI01:2026","ASI04:2026"],"owasp_llm":["LLM01:2025","LLM06:2025"],"mitre_atlas":["AML.T0051.001 - Indirect"],"date":"2026/05/28","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00550","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00550-untrusted-retrieval-to-privileged-tool.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00550-untrusted-retrieval-to-privileged-tool.yaml"},{"id":"ATR-2026-00551","title":"Cross-conversation memory write (scope-escape via memory store)","category":"privilege-escalation","subcategory":"cross-conversation-memory-write","severity":"critical","status":"experimental","maturity":"draft","lanes":["hunt"],"scan_target":"runtime","cves":[],"owasp_agentic":["ASI04:2026","ASI06:2026"],"owasp_llm":["LLM03:2025"],"mitre_atlas":["AML.T0080 - AI Agent Context Poisoning"],"date":"2026/05/28","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00551","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-00551-cross-conversation-memory-write.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-00551-cross-conversation-memory-write.yaml"},{"id":"ATR-2026-00552","title":"Agent goal drift after environmental pressure injection","category":"agent-manipulation","subcategory":"goal-drift-trace","severity":"high","status":"experimental","maturity":"draft","lanes":["hunt"],"scan_target":"runtime","cves":[],"owasp_agentic":["ASI01:2026","ASI10:2026"],"owasp_llm":["LLM01:2025","LLM06:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.001 - Indirect"],"date":"2026/05/28","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00552","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00552-goal-drift-after-pressure-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-00552-goal-drift-after-pressure-injection.yaml"},{"id":"ATR-2026-00553","title":"Runaway tool-call loop within a single session","category":"excessive-autonomy","subcategory":"runaway-tool-loop","severity":"high","status":"draft","maturity":"draft","lanes":[],"scan_target":"runtime","cves":[],"owasp_agentic":["ASI05:2026","ASI07:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0034 - Cost Harvesting"],"date":"2026/05/28","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00553","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-00553-runaway-tool-loop-behavioral.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/excessive-autonomy/ATR-2026-00553-runaway-tool-loop-behavioral.yaml"},{"id":"ATR-2026-00554","title":"LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates","category":"prompt-injection","subcategory":null,"severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"runtime","cves":["CVE-2025-65106"],"owasp_agentic":["ASI05:2026"],"owasp_llm":["LLM03:2025"],"mitre_atlas":["AML.T0050 - Command and Scripting Interpreter"],"date":"2026/06/01","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00554","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00554-langchain-vulnerable-to-template-injecti.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00554-langchain-vulnerable-to-template-injecti.yaml"},{"id":"ATR-2026-00561","title":"FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name","category":"tool-poisoning","subcategory":null,"severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"runtime","cves":["CVE-2025-62801"],"owasp_agentic":["ASI05:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0049 - Exploit Public-Facing Application"],"date":"2026/06/01","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00561","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00561-fastmcp-vulnerable-to-windows-command-in.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00561-fastmcp-vulnerable-to-windows-command-in.yaml"},{"id":"ATR-2026-00565","title":"The llm CLI tool thru 0.27.1 contains a critical code injection vulnerability via its --functions command-line","category":"prompt-injection","subcategory":"nvd-imported","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":["CVE-2026-31236"],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/05/30","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00565","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00565-the-llm-cli-tool-thru-0-27-1-contains-a-.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00565-the-llm-cli-tool-thru-0-27-1-contains-a-.yaml"},{"id":"ATR-2026-00566","title":"LibreChat is a ChatGPT clone with additional features.","category":"context-exfiltration","subcategory":"nvd-imported","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":["CVE-2026-31951"],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0057 - LLM Data Leakage"],"date":"2026/05/30","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00566","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00566-librechat-is-a-chatgpt-clone-with-additi.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00566-librechat-is-a-chatgpt-clone-with-additi.yaml"},{"id":"ATR-2026-00567","title":"MCP stdio server config command injection via unvalidated test endpoints","category":"tool-poisoning","subcategory":null,"severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"runtime","cves":["CVE-2026-42271"],"owasp_agentic":["ASI05:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0049 - Exploit Public-Facing Application"],"date":"2026/06/02","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00567","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00567-mcp-stdio-config-command-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00567-mcp-stdio-config-command-injection.yaml"},{"id":"ATR-2026-00568","title":"Agent SSRF to cloud metadata / file inclusion via unvalidated fetch URL","category":"tool-poisoning","subcategory":null,"severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"runtime","cves":["CVE-2026-40150","CVE-2026-40160","CVE-2026-7817","CVE-2026-45401"],"owasp_agentic":["ASI05:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0049 - Exploit Public-Facing Application"],"date":"2026/06/02","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00568","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00568-agent-ssrf-cloud-metadata-file-inclusion.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00568-agent-ssrf-cloud-metadata-file-inclusion.yaml"},{"id":"ATR-2026-00569","title":"Agent / MCP tool path traversal and arbitrary file access","category":"context-exfiltration","subcategory":null,"severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"runtime","cves":["CVE-2026-40576","CVE-2026-32719","CVE-2026-42249","CVE-2026-7020","CVE-2026-7811","CVE-2026-34070","CVE-2026-7318","CVE-2026-7599","CVE-2026-7728","CVE-2026-9467"],"owasp_agentic":["ASI02:2026"],"owasp_llm":["LLM02:2025","LLM05:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation","AML.T0057 - LLM Data Leakage"],"date":"2026/06/02","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00569","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00569-agent-mcp-path-traversal-arbitrary-file-access.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00569-agent-mcp-path-traversal-arbitrary-file-access.yaml"},{"id":"ATR-2026-00570","title":"SQL injection in agent / MCP tool database query","category":"data-poisoning","subcategory":null,"severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"runtime","cves":["CVE-2026-7591","CVE-2026-4593","CVE-2026-5322","CVE-2026-30860"],"owasp_agentic":["ASI06:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051.001 - Indirect"],"date":"2026/06/02","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00570","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/data-poisoning/ATR-2026-00570-sql-injection-in-agent-tool-query.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/data-poisoning/ATR-2026-00570-sql-injection-in-agent-tool-query.yaml"},{"id":"ATR-2026-00571","title":"Cross-site scripting (XSS) in agent / MCP rendered output","category":"context-exfiltration","subcategory":null,"severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"runtime","cves":["CVE-2025-62800","CVE-2026-44429","CVE-2026-27740","CVE-2026-21866"],"owasp_agentic":["ASI05:2026"],"owasp_llm":["LLM05:2025"],"mitre_atlas":["AML.T0077 - LLM Response Rendering","AML.T0050 - Command and Scripting Interpreter"],"date":"2026/06/02","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00571","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00571-xss-in-agent-mcp-rendered-output.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00571-xss-in-agent-mcp-rendered-output.yaml"},{"id":"ATR-2026-00572","title":"SymJack — Symlink Approval-Path Spoofing Redirects Writes into Agent MCP/Config (RCE on Restart)","category":"tool-poisoning","subcategory":"symlink-config-redirection","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI04:2026","ASI05:2026"],"owasp_llm":["LLM05:2025","LLM06:2025"],"mitre_atlas":["AML.T0010 - AI Supply Chain Compromise"],"date":"2026/06/03","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00572","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00572-symjack-symlink-config-redirection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00572-symjack-symlink-config-redirection.yaml"},{"id":"ATR-2026-00573","title":"Paraphrased Prompt Injection (Semantic)","category":"prompt-injection","subcategory":"paraphrased","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/06/03","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00573","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00573-semantic-paraphrased-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00573-semantic-paraphrased-injection.yaml"},{"id":"ATR-2026-00574","title":"Paraphrased System-Prompt / Context Extraction (Semantic)","category":"context-exfiltration","subcategory":"paraphrased-system-prompt-extraction","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM07:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/06/03","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00574","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00574-semantic-paraphrased-context-extraction.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00574-semantic-paraphrased-context-extraction.yaml"},{"id":"ATR-2026-00575","title":"Miasma / Phantom Gyp — npm Worm Backdoors AI-Agent Config Files (binding.gyp install-exec + auto-run config injection)","category":"tool-poisoning","subcategory":"npm-worm-agent-config-backdoor","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI04:2026","ASI05:2026"],"owasp_llm":["LLM05:2025","LLM06:2025"],"mitre_atlas":["AML.T0010 - AI Supply Chain Compromise"],"date":"2026/06/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00575","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00575-miasma-npm-worm-agent-config-backdoor.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00575-miasma-npm-worm-agent-config-backdoor.yaml"},{"id":"ATR-2026-00576","title":"Hades / Shai-Hulud — AI-Agent Credential Harvester in Supply-Chain Package (Anthropic / Claude / MCP key theft + exfil)","category":"tool-poisoning","subcategory":"supply-chain-agent-credential-theft","severity":"critical","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI04:2026","ASI03:2026"],"owasp_llm":["LLM06:2025","LLM03:2025"],"mitre_atlas":["AML.T0010 - AI Supply Chain Compromise"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00576","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00576-hades-agent-credential-theft.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00576-hades-agent-credential-theft.yaml"},{"id":"ATR-2026-00577","title":"Command Injection in create-mcp-server-stdio via Unsafe exec() Concatenation (CVE-2025-54994)","category":"tool-poisoning","subcategory":null,"severity":"critical","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"runtime","cves":["CVE-2025-54994"],"owasp_agentic":["ASI02:2026","ASI05:2026"],"owasp_llm":["LLM06:2025","LLM05:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation","AML.T0051.001 - Indirect"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00577","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00577-create-mcp-server-stdio-exec-command-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00577-create-mcp-server-stdio-exec-command-injection.yaml"},{"id":"ATR-2026-00578","title":"Zen MCP Server path-traversal blacklist bypass via non-canonical paths (CVE-2025-66689)","category":"context-exfiltration","subcategory":"path-normalization-bypass","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"runtime","cves":["CVE-2025-66689"],"owasp_agentic":["ASI05:2026","ASI06:2026"],"owasp_llm":["LLM07:2025","LLM02:2025"],"mitre_atlas":["AML.T0057 - LLM Data Leakage","AML.T0056 - Extract LLM System Prompt"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00578","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00578-zen-mcp-path-traversal-blacklist-bypass.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00578-zen-mcp-path-traversal-blacklist-bypass.yaml"},{"id":"ATR-2026-00579","title":"MCP Line Jumping — Agent-Directed Imperative Embedded in a Tool/Parameter Description Field (Pre-Invocation Injection)","category":"prompt-injection","subcategory":"mcp-tool-description-line-jumping","severity":"high","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026","ASI06:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.001 - Indirect"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00579","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00579-mcp-tool-description-line-jumping-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00579-mcp-tool-description-line-jumping-injection.yaml"},{"id":"ATR-2026-00580","title":"MCP session ID / auth token placed in URL query string (session leak via logs, referrer, history)","category":"context-exfiltration","subcategory":"session-credential-in-url-query","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"runtime","cves":[],"owasp_agentic":["ASI05:2026","ASI06:2026"],"owasp_llm":["LLM07:2025","LLM02:2025"],"mitre_atlas":["AML.T0057 - LLM Data Leakage","AML.T0056 - Extract LLM System Prompt"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00580","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00580-mcp-session-id-token-in-url-query.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00580-mcp-session-id-token-in-url-query.yaml"},{"id":"ATR-2026-00581","title":"MCP Tool Rug-Pull — Post-Approval Description Redefinition Injects Execution Instructions","category":"tool-poisoning","subcategory":"mcp-rug-pull-redefinition","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI02:2026","ASI05:2026"],"owasp_llm":["LLM06:2025","LLM05:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation","AML.T0051.001 - Indirect","AML.T0115.002 - Publish Poisoned AI Artifacts: AI Agent Tools"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00581","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00581-mcp-tool-rug-pull-post-approval-redefinition.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00581-mcp-tool-rug-pull-post-approval-redefinition.yaml"},{"id":"ATR-2026-00583","title":"MCP/agent tool reads .env or secret file without user consent (OSV-MCPS-2025-EB70F912)","category":"context-exfiltration","subcategory":"mcp-consentless-secret-read","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI05:2026","ASI06:2026"],"owasp_llm":["LLM07:2025","LLM02:2025"],"mitre_atlas":["AML.T0057 - LLM Data Leakage","AML.T0056 - Extract LLM System Prompt"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00583","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00583-mcp-env-secret-file-read-without-consent.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00583-mcp-env-secret-file-read-without-consent.yaml"},{"id":"ATR-2026-00584","title":"Indirect Prompt Injection via Tool / API Response — Attacker Instruction Embedded in Returned Tool Output (InjecAgent Threat Model)","category":"prompt-injection","subcategory":"indirect-injection-tool-response","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"runtime","cves":[],"owasp_agentic":["ASI01:2026","ASI06:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.001 - Indirect"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00584","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00584-indirect-injection-via-tool-response.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00584-indirect-injection-via-tool-response.yaml"},{"id":"ATR-2026-00700","title":"Indirect PI — Structured-Data Embedded Payload (IMPORTANT!!! Override)","category":"prompt-injection","subcategory":"indirect-structured-data","severity":"critical","status":"stable","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"tool_output","cves":[],"owasp_agentic":["ASI01:2026","ASI03:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.001 - Indirect"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00700","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00700-structured-data-payload-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00700-structured-data-payload-injection.yaml"},{"id":"ATR-2026-00701","title":"Indirect PI — XSS Payload Injection in Agent-Consumed Content","category":"prompt-injection","subcategory":"xss-via-content","severity":"high","status":"stable","maturity":"test","lanes":["alert","hunt"],"scan_target":"tool_output","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025","LLM05:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.001 - Indirect"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00701","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00701-ipi-tool-output-xss-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-00701-ipi-tool-output-xss-injection.yaml"},{"id":"ATR-2026-00702","title":"Indirect PI — Credential / API Key Exfiltration via Agent Action","category":"context-exfiltration","subcategory":"credential-exfil-indirect","severity":"critical","status":"stable","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"tool_output","cves":[],"owasp_agentic":["ASI01:2026","ASI02:2026"],"owasp_llm":["LLM01:2025","LLM02:2025","LLM06:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.001 - Indirect","AML.T0086 - Exfiltration via AI Agent Tool Invocation"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00702","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00702-ipi-credential-exfil-via-agent-action.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00702-ipi-credential-exfil-via-agent-action.yaml"},{"id":"ATR-2026-00703","title":"Indirect PI — Financial Data Exfiltration via Agent Action","category":"context-exfiltration","subcategory":"financial-data-exfil-indirect","severity":"critical","status":"stable","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"tool_output","cves":[],"owasp_agentic":["ASI01:2026","ASI02:2026"],"owasp_llm":["LLM01:2025","LLM02:2025","LLM06:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.001 - Indirect","AML.T0086 - Exfiltration via AI Agent Tool Invocation"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00703","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00703-ipi-financial-data-exfil-indirect.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00703-ipi-financial-data-exfil-indirect.yaml"},{"id":"ATR-2026-00704","title":"Indirect PI — Medical / Genetic Data Exfiltration via Agent Action","category":"context-exfiltration","subcategory":"medical-genetic-exfil-indirect","severity":"critical","status":"stable","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"tool_output","cves":[],"owasp_agentic":["ASI01:2026","ASI02:2026"],"owasp_llm":["LLM01:2025","LLM02:2025","LLM06:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.001 - Indirect","AML.T0086 - Exfiltration via AI Agent Tool Invocation"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00704","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00704-ipi-medical-genetic-data-exfil.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00704-ipi-medical-genetic-data-exfil.yaml"},{"id":"ATR-2026-00705","title":"Indirect PI — Location, Address, and Browsing History Exfiltration","category":"context-exfiltration","subcategory":"location-address-browsing-exfil","severity":"high","status":"stable","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"tool_output","cves":[],"owasp_agentic":["ASI01:2026","ASI02:2026"],"owasp_llm":["LLM01:2025","LLM02:2025","LLM06:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.001 - Indirect","AML.T0086 - Exfiltration via AI Agent Tool Invocation"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00705","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00705-ipi-location-address-browsing-exfil.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00705-ipi-location-address-browsing-exfil.yaml"},{"id":"ATR-2026-00706","title":"Indirect PI — Physical / Biometric Media Exfiltration via Agent","category":"context-exfiltration","subcategory":"physical-biometric-exfil","severity":"critical","status":"stable","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"tool_output","cves":[],"owasp_agentic":["ASI01:2026","ASI02:2026"],"owasp_llm":["LLM01:2025","LLM02:2025","LLM06:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.001 - Indirect","AML.T0086 - Exfiltration via AI Agent Tool Invocation","AML.T0088 - Generate Deepfakes"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00706","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00706-ipi-physical-biometric-exfil.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00706-ipi-physical-biometric-exfil.yaml"},{"id":"ATR-2026-00707","title":"Indirect PI — File Exfiltration Combined with Destroy or Tamper","category":"context-exfiltration","subcategory":"file-exfil-destroy-tamper","severity":"critical","status":"stable","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"tool_output","cves":[],"owasp_agentic":["ASI01:2026","ASI02:2026"],"owasp_llm":["LLM01:2025","LLM02:2025","LLM06:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.001 - Indirect","AML.T0086 - Exfiltration via AI Agent Tool Invocation","AML.T0101 - Data Destruction via AI Agent Tool Invocation"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00707","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00707-ipi-file-exfil-with-destroy-or-tamper.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00707-ipi-file-exfil-with-destroy-or-tamper.yaml"},{"id":"ATR-2026-00708","title":"Indirect PI — Unauthorized Financial Transfer via Agent Tool","category":"excessive-autonomy","subcategory":"unauthorized-financial-transfer","severity":"critical","status":"stable","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"tool_output","cves":[],"owasp_agentic":["ASI01:2026","ASI02:2026"],"owasp_llm":["LLM01:2025","LLM06:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.001 - Indirect"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00708","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-00708-ipi-financial-transfer-unauthorized.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/excessive-autonomy/ATR-2026-00708-ipi-financial-transfer-unauthorized.yaml"},{"id":"ATR-2026-00709","title":"Indirect PI — Disable Authentication / MFA via Agent Tool","category":"excessive-autonomy","subcategory":"disable-auth-mfa","severity":"critical","status":"stable","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"tool_output","cves":[],"owasp_agentic":["ASI01:2026","ASI03:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.001 - Indirect"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00709","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-00709-ipi-disable-auth-mfa.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/excessive-autonomy/ATR-2026-00709-ipi-disable-auth-mfa.yaml"},{"id":"ATR-2026-00710","title":"Indirect PI — Unauthorized Physical Access Grant via Smart Lock / Home Automation","category":"excessive-autonomy","subcategory":"unauthorized-physical-access","severity":"critical","status":"stable","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"tool_output","cves":[],"owasp_agentic":["ASI01:2026","ASI03:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.001 - Indirect"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00710","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-00710-ipi-physical-access-grant.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/excessive-autonomy/ATR-2026-00710-ipi-physical-access-grant.yaml"},{"id":"ATR-2026-00711","title":"Indirect PI — System Sabotage via Destructive Shell Command","category":"excessive-autonomy","subcategory":"system-sabotage-destructive","severity":"critical","status":"stable","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"tool_output","cves":[],"owasp_agentic":["ASI01:2026","ASI05:2026"],"owasp_llm":["LLM01:2025","LLM06:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.001 - Indirect","AML.T0050 - Command and Scripting Interpreter"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00711","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-00711-ipi-system-sabotage-destructive-command.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/excessive-autonomy/ATR-2026-00711-ipi-system-sabotage-destructive-command.yaml"},{"id":"ATR-2026-00712","title":"Indirect PI — Malicious Package Installation via Agent (pip/npm)","category":"excessive-autonomy","subcategory":"malicious-package-install","severity":"critical","status":"stable","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"tool_output","cves":[],"owasp_agentic":["ASI01:2026","ASI04:2026","ASI05:2026"],"owasp_llm":["LLM01:2025","LLM03:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0011.001 - Malicious Package"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00712","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-00712-ipi-malicious-package-install.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/excessive-autonomy/ATR-2026-00712-ipi-malicious-package-install.yaml"},{"id":"ATR-2026-00713","title":"Indirect PI — RCE via Network Shell Command (netcat/curl) Execution","category":"excessive-autonomy","subcategory":"rce-network-shell","severity":"critical","status":"stable","maturity":"test","lanes":["alert","hunt"],"scan_target":"tool_output","cves":[],"owasp_agentic":["ASI01:2026","ASI03:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.001 - Indirect","AML.T0050 - Command and Scripting Interpreter"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00713","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-00713-ipi-rce-network-shell-command.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/excessive-autonomy/ATR-2026-00713-ipi-rce-network-shell-command.yaml"},{"id":"ATR-2026-00714","title":"Tool Camouflage — Forced Specific Tool Invocation via Injected Instruction","category":"tool-poisoning","subcategory":"tool-camouflage-forced-call","severity":"high","status":"stable","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"tool_output","cves":[],"owasp_agentic":["ASI01:2026","ASI04:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.001 - Indirect"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00714","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00714-tool-camouflage-forced-tool-call.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00714-tool-camouflage-forced-tool-call.yaml"},{"id":"ATR-2026-00715","title":"Tool Knowledge Hijack — Identity Injection with Tool Call Arguments","category":"tool-poisoning","subcategory":"tool-knowledge-hijack","severity":"critical","status":"stable","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"tool_output","cves":[],"owasp_agentic":["ASI01:2026","ASI04:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.001 - Indirect"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00715","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00715-tool-knowledge-hijack-identity-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00715-tool-knowledge-hijack-identity-injection.yaml"},{"id":"ATR-2026-00716","title":"Indirect PI — Data Destruction Instruction via Agent File/Document Tool","category":"tool-poisoning","subcategory":"data-destruction-indirect","severity":"high","status":"stable","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"tool_output","cves":[],"owasp_agentic":["ASI01:2026","ASI02:2026"],"owasp_llm":["LLM01:2025","LLM06:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.001 - Indirect","AML.T0101 - Data Destruction via AI Agent Tool Invocation"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00716","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00716-ipi-data-destruction-carrier.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00716-ipi-data-destruction-carrier.yaml"},{"id":"ATR-2026-00718","title":"Tool Misuse — Autonomous Financial Trading / Crypto Transaction Without Authorization","category":"excessive-autonomy","subcategory":"autonomous-financial-trading","severity":"high","status":"stable","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI02:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation","AML.T0048.000 - Financial Harm"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00718","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-00718-tool-misuse-financial-autonomous.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/excessive-autonomy/ATR-2026-00718-tool-misuse-financial-autonomous.yaml"},{"id":"ATR-2026-00719","title":"Tool Misuse — Destructive Bulk Action via Agent (Delete All / Turn Off All)","category":"excessive-autonomy","subcategory":"destructive-bulk-action","severity":"high","status":"stable","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI03:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00719","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-00719-tool-misuse-destructive-bulk-action.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/excessive-autonomy/ATR-2026-00719-tool-misuse-destructive-bulk-action.yaml"},{"id":"ATR-2026-00720","title":"Tool Misuse — Privilege Escalation via Social Engineering Agent to Grant Access","category":"tool-poisoning","subcategory":"privilege-escalation-social","severity":"medium","status":"stable","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI03:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00720","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00720-tool-misuse-privilege-escalation-social.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-00720-tool-misuse-privilege-escalation-social.yaml"},{"id":"ATR-2026-00722","title":"Indirect PI — Account Manipulation / Emergency Service Dispatch via Pretext","category":"excessive-autonomy","subcategory":"emergency-pretext-manipulation","severity":"critical","status":"stable","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"tool_output","cves":[],"owasp_agentic":["ASI01:2026","ASI03:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.001 - Indirect"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00722","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-00722-ipi-account-manipulation-emergency-pretext.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/excessive-autonomy/ATR-2026-00722-ipi-account-manipulation-emergency-pretext.yaml"},{"id":"ATR-2026-00850","title":"Indirect PI — Credential Exfiltration via Email (API Key / Password / Token)","category":"context-exfiltration","subcategory":"credential-exfil-injection","severity":"critical","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026","ASI03:2026"],"owasp_llm":["LLM02:2025","LLM01:2025"],"mitre_atlas":["AML.T0051.001 - Indirect","AML.T0057 - LLM Data Leakage"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00850","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00850-indirect-pi-credential-exfil-email.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00850-indirect-pi-credential-exfil-email.yaml"},{"id":"ATR-2026-00851","title":"Indirect PI — Financial / Payment Credential Exfiltration via Agent Email","category":"context-exfiltration","subcategory":"financial-payment-exfil-injection","severity":"critical","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026","ASI03:2026"],"owasp_llm":["LLM02:2025","LLM01:2025"],"mitre_atlas":["AML.T0051.001 - Indirect","AML.T0057 - LLM Data Leakage"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00851","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00851-indirect-pi-financial-payment-exfil.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00851-indirect-pi-financial-payment-exfil.yaml"},{"id":"ATR-2026-00852","title":"Indirect PI — Medical Record / Health Data Exfiltration via Agent Email","category":"context-exfiltration","subcategory":"medical-record-exfil-injection","severity":"critical","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026","ASI03:2026"],"owasp_llm":["LLM02:2025","LLM01:2025"],"mitre_atlas":["AML.T0051.001 - Indirect","AML.T0057 - LLM Data Leakage"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00852","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00852-indirect-pi-medical-record-exfil.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00852-indirect-pi-medical-record-exfil.yaml"},{"id":"ATR-2026-00853","title":"Indirect PI — Genetic / DNA Data Exfiltration via Agent Email","category":"context-exfiltration","subcategory":"genetic-data-exfil-injection","severity":"critical","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026","ASI03:2026"],"owasp_llm":["LLM02:2025","LLM01:2025"],"mitre_atlas":["AML.T0051.001 - Indirect","AML.T0057 - LLM Data Leakage"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00853","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00853-indirect-pi-genetic-data-exfil.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00853-indirect-pi-genetic-data-exfil.yaml"},{"id":"ATR-2026-00854","title":"Indirect PI — Location / GPS Data Exfiltration via Agent Email","category":"context-exfiltration","subcategory":"location-data-exfil-injection","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026","ASI03:2026"],"owasp_llm":["LLM02:2025","LLM01:2025"],"mitre_atlas":["AML.T0051.001 - Indirect","AML.T0057 - LLM Data Leakage"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00854","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00854-indirect-pi-location-data-exfil.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00854-indirect-pi-location-data-exfil.yaml"},{"id":"ATR-2026-00855","title":"Indirect PI — Browsing History / Search History Exfiltration via Agent Email","category":"context-exfiltration","subcategory":"browsing-history-exfil-injection","severity":"high","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026","ASI03:2026"],"owasp_llm":["LLM02:2025","LLM01:2025"],"mitre_atlas":["AML.T0051.001 - Indirect","AML.T0057 - LLM Data Leakage"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00855","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00855-indirect-pi-browsing-history-exfil.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00855-indirect-pi-browsing-history-exfil.yaml"},{"id":"ATR-2026-00856","title":"Indirect PI — Physical Address / PII Exfiltration via Agent Email","category":"context-exfiltration","subcategory":"address-pii-exfil-injection","severity":"high","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026","ASI03:2026"],"owasp_llm":["LLM02:2025","LLM01:2025"],"mitre_atlas":["AML.T0051.001 - Indirect","AML.T0057 - LLM Data Leakage"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00856","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00856-indirect-pi-address-pii-exfil.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00856-indirect-pi-address-pii-exfil.yaml"},{"id":"ATR-2026-00857","title":"Indirect PI — Cloud File Exfiltration (Google Drive / Cloud Storage via Agent)","category":"context-exfiltration","subcategory":"cloud-file-exfil-injection","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026","ASI03:2026"],"owasp_llm":["LLM02:2025","LLM01:2025"],"mitre_atlas":["AML.T0051.001 - Indirect","AML.T0057 - LLM Data Leakage"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00857","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00857-indirect-pi-cloud-file-exfil.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00857-indirect-pi-cloud-file-exfil.yaml"},{"id":"ATR-2026-00858","title":"Indirect PI — Data Exfiltration with Evidence Destruction (Exfil-and-Delete)","category":"context-exfiltration","subcategory":"exfil-and-destroy","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026","ASI03:2026","ASI09:2026"],"owasp_llm":["LLM02:2025","LLM01:2025"],"mitre_atlas":["AML.T0051.001 - Indirect","AML.T0057 - LLM Data Leakage"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00858","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00858-indirect-pi-exfil-and-destroy.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00858-indirect-pi-exfil-and-destroy.yaml"},{"id":"ATR-2026-00859","title":"RAG-Injected PII Exfiltration — System Instructions Embedded in Retrieved Documents","category":"context-exfiltration","subcategory":"rag-pii-exfil-injection","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026","ASI03:2026"],"owasp_llm":["LLM02:2025","LLM01:2025"],"mitre_atlas":["AML.T0051.001 - Indirect","AML.T0057 - LLM Data Leakage"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00859","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00859-rag-injected-pii-exfil.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00859-rag-injected-pii-exfil.yaml"},{"id":"ATR-2026-00860","title":"Indirect PI — Unauthorized Financial Transfer / Payment Initiation Hijack","category":"context-exfiltration","subcategory":"financial-transfer-hijack-injection","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026","ASI02:2026"],"owasp_llm":["LLM01:2025","LLM06:2025"],"mitre_atlas":["AML.T0051.001 - Indirect"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00860","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00860-indirect-pi-financial-transfer-hijack.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00860-indirect-pi-financial-transfer-hijack.yaml"},{"id":"ATR-2026-00861","title":"Indirect PI — Cryptocurrency Transfer / Exchange Deposit Hijack via Injection","category":"context-exfiltration","subcategory":"crypto-transfer-hijack-injection","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026","ASI02:2026"],"owasp_llm":["LLM01:2025","LLM06:2025"],"mitre_atlas":["AML.T0051.001 - Indirect"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00861","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00861-indirect-pi-crypto-transfer-hijack.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00861-indirect-pi-crypto-transfer-hijack.yaml"},{"id":"ATR-2026-00862","title":"Indirect PI — MFA Code / OTP Security Code Exfiltration via Injection","category":"context-exfiltration","subcategory":"mfa-code-exfil-injection","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026","ASI03:2026"],"owasp_llm":["LLM02:2025","LLM01:2025"],"mitre_atlas":["AML.T0051.001 - Indirect","AML.T0057 - LLM Data Leakage"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00862","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00862-indirect-pi-mfa-code-exfil.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00862-indirect-pi-mfa-code-exfil.yaml"},{"id":"ATR-2026-00863","title":"Shell Injection Data Exfiltration — Piped Command Exfiltration via Bash","category":"context-exfiltration","subcategory":"shell-injection-exfil","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI03:2026","ASI01:2026"],"owasp_llm":["LLM01:2025","LLM06:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0057 - LLM Data Leakage"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-00863","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00863-shell-injection-data-exfil.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-00863-shell-injection-data-exfil.yaml"},{"id":"ATR-2026-01000","title":"Context-Ignore via Fake Completion Prefix","category":"prompt-injection","subcategory":"fake-completion-prefix","severity":"critical","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.001 - Indirect"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01000","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01000-context-ignore-fake-completion-prefix.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-01000-context-ignore-fake-completion-prefix.yaml"},{"id":"ATR-2026-01001","title":"Direct Instruction Override Targeting Secret Key / Credentials","category":"prompt-injection","subcategory":"instruction-override-credential-exfil","severity":"high","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01001","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01001-direct-pi-instruction-override-secret-key.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-01001-direct-pi-instruction-override-secret-key.yaml"},{"id":"ATR-2026-01002","title":"Role Escalation via False Authority Claim","category":"prompt-injection","subcategory":"false-authority-role-escalation","severity":"high","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01002","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01002-role-escalation-false-authority-claim.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-01002-role-escalation-false-authority-claim.yaml"},{"id":"ATR-2026-01005","title":"Many-Shot Repetition Override via Extended Q&A Chain","category":"prompt-injection","subcategory":"many-shot-conditioning","severity":"high","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01005","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01005-many-shot-repetition-override.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-01005-many-shot-repetition-override.yaml"},{"id":"ATR-2026-01006","title":"Payload-Split String Concatenation Injection","category":"prompt-injection","subcategory":"payload-split-string-concat","severity":"high","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01006","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01006-payload-split-string-concat-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-01006-payload-split-string-concat-injection.yaml"},{"id":"ATR-2026-01007","title":"Token-Repeat Flooding Injection","category":"prompt-injection","subcategory":"token-repeat-flooding","severity":"medium","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01007","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01007-token-repeat-flooding-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-01007-token-repeat-flooding-injection.yaml"},{"id":"ATR-2026-01009","title":"Virtual World Bypass: Fictional Scenario for PII/Credential Extraction","category":"prompt-injection","subcategory":"virtual-world-fictional-bypass","severity":"high","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025","LLM06:2025"],"mitre_atlas":["AML.T0054 - LLM Jailbreak"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01009","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01009-virtual-world-bypass-fictional-pii.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-01009-virtual-world-bypass-fictional-pii.yaml"},{"id":"ATR-2026-01012","title":"Encoding-Evasion: Decode-and-Execute Injection (Morse/ROT13/Hex/Pig-Latin)","category":"prompt-injection","subcategory":"encoding-evasion-decode-execute","severity":"high","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01012","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01012-encoding-evasion-decode-execute.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-01012-encoding-evasion-decode-execute.yaml"},{"id":"ATR-2026-01013","title":"Language-Evasion: Multilingual Credential Request","category":"prompt-injection","subcategory":"language-evasion-credential","severity":"high","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01013","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01013-language-evasion-multilingual-credential.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-01013-language-evasion-multilingual-credential.yaml"},{"id":"ATR-2026-01015","title":"Evasion: Refusal Suppression via Forbidden Response Strings","category":"prompt-injection","subcategory":"refusal-suppression","severity":"high","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025","LLM09:2025"],"mitre_atlas":["AML.T0054 - LLM Jailbreak"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01015","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01015-evasion-refusal-suppression.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-01015-evasion-refusal-suppression.yaml"},{"id":"ATR-2026-01016","title":"Evasion: Response Priming via Forced Affirmative Opener","category":"prompt-injection","subcategory":"response-priming-affirmative-opener","severity":"medium","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0054 - LLM Jailbreak"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01016","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01016-evasion-response-priming-forced-opener.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-01016-evasion-response-priming-forced-opener.yaml"},{"id":"ATR-2026-01017","title":"Evasion: Dual-Response Split Output (Safe + Unsafe)","category":"prompt-injection","subcategory":"dual-response-split-unsafe","severity":"high","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0054 - LLM Jailbreak"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01017","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01017-evasion-dual-response-split-output.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-01017-evasion-dual-response-split-output.yaml"},{"id":"ATR-2026-01018","title":"Evasion: Shell Injection via eval/system/backtick in Input","category":"prompt-injection","subcategory":"shell-injection-eval","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026","ASI05:2026"],"owasp_llm":["LLM01:2025","LLM03:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0010 - AI Supply Chain Compromise"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01018","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01018-evasion-shell-injection-eval.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-01018-evasion-shell-injection-eval.yaml"},{"id":"ATR-2026-01019","title":"System Prompt Override via Fake Diagnostic/Admin Mode","category":"prompt-injection","subcategory":"sysprompt-override-fake-diagnostic","severity":"critical","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01019","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01019-sysprompt-override-fake-diagnostic-mode.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-01019-sysprompt-override-fake-diagnostic-mode.yaml"},{"id":"ATR-2026-01020","title":"Spikee: Document-Embedded Base64 Payload Injection","category":"prompt-injection","subcategory":"document-embedded-base64-injection","severity":"high","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.001 - Indirect"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01020","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01020-spikee-doc-embedded-base64-payload.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-01020-spikee-doc-embedded-base64-payload.yaml"},{"id":"ATR-2026-01021","title":"Spikee: Document-Embedded Translation Covert Channel Injection","category":"prompt-injection","subcategory":"document-embedded-translation-injection","severity":"high","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.001 - Indirect","AML.T0025 - Exfiltration via Cyber Means"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01021","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01021-spikee-doc-embedded-translation-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-01021-spikee-doc-embedded-translation-injection.yaml"},{"id":"ATR-2026-01023","title":"Evasion: Opposite-Intent Negation Trick","category":"prompt-injection","subcategory":"opposite-intent-negation","severity":"high","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0054 - LLM Jailbreak"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01023","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01023-evasion-opposite-intent-negation-trick.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-01023-evasion-opposite-intent-negation-trick.yaml"},{"id":"ATR-2026-01024","title":"Evasion: Persona Override as Fictional Rule-Breaker","category":"prompt-injection","subcategory":"anonymous-rule-breaker-persona","severity":"high","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0054 - LLM Jailbreak"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01024","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01024-evasion-persona-override-rule-breaker.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-01024-evasion-persona-override-rule-breaker.yaml"},{"id":"ATR-2026-01025","title":"Evasion: Hypothetical Fictional Character Execution Framing","category":"prompt-injection","subcategory":"fictional-character-execution-framing","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0054 - LLM Jailbreak"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01025","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01025-evasion-hypothetical-fictional-execution-framing.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-01025-evasion-hypothetical-fictional-execution-framing.yaml"},{"id":"ATR-2026-01026","title":"Evasion: Unicode Glitch Token / Superscript Embedding Anomaly","category":"prompt-injection","subcategory":"unicode-glitch-token-embedding","severity":"high","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0054 - LLM Jailbreak"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01026","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01026-evasion-unicode-glitch-token-anomaly.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-01026-evasion-unicode-glitch-token-anomaly.yaml"},{"id":"ATR-2026-01155","title":"Direct Memory Plant Command — Persistent Fact or Code Storage Injection","category":"data-poisoning","subcategory":"memory-direct-plant","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI06:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01155","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/data-poisoning/ATR-2026-01155-memory-plant-direct-command.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/data-poisoning/ATR-2026-01155-memory-plant-direct-command.yaml"},{"id":"ATR-2026-01300","title":"MCP Tool Description — Notes Parameter Chat-History Exfiltration","category":"tool-poisoning","subcategory":"chat-history-notes-exfil","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI03:2026","ASI08:2026"],"owasp_llm":["LLM01:2025","LLM02:2025","LLM06:2025"],"mitre_atlas":["AML.T0051.001 - Indirect","AML.T0053 - AI Agent Tool Invocation"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01300","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01300-mcp-notes-param-chat-history-exfil.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-01300-mcp-notes-param-chat-history-exfil.yaml"},{"id":"ATR-2026-01301","title":"MCP Tool Description — Exclusive Tool Invocation Override","category":"tool-poisoning","subcategory":"exclusive-tool-override","severity":"high","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI03:2026","ASI01:2026"],"owasp_llm":["LLM01:2025","LLM06:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0053 - AI Agent Tool Invocation"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01301","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01301-tool-description-exclusive-tool-override.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-01301-tool-description-exclusive-tool-override.yaml"},{"id":"ATR-2026-01302","title":"Fake Tool Result Prefix — Injected Instruction via Simulated Completion","category":"tool-poisoning","subcategory":"fake-tool-result-injection","severity":"critical","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"tool_output","cves":[],"owasp_agentic":["ASI01:2026","ASI03:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051.001 - Indirect"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01302","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01302-fake-tool-result-instruction-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-01302-fake-tool-result-instruction-injection.yaml"},{"id":"ATR-2026-01303","title":"Tool Schema Enumeration via Social Engineering","category":"tool-poisoning","subcategory":"schema-enumeration","severity":"high","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI01:2026","ASI03:2026"],"owasp_llm":["LLM01:2025","LLM07:2025"],"mitre_atlas":["AML.T0084.001 - Tool Definitions","AML.T0069 - Discover LLM System Information","AML.T0051 - LLM Prompt Injection"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01303","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01303-tool-schema-enumeration-social-engineering.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-01303-tool-schema-enumeration-social-engineering.yaml"},{"id":"ATR-2026-01304","title":"Indirect Prompt Injection via Data Carrier — IMPORTANT Override","category":"prompt-injection","subcategory":"indirect-injection-data-carrier","severity":"critical","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"tool_output","cves":[],"owasp_agentic":["ASI01:2026","ASI06:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051.001 - Indirect"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01304","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01304-indirect-injection-carrier-important-override.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-01304-indirect-injection-carrier-important-override.yaml"},{"id":"ATR-2026-01306","title":"MCP OAuth Authorization URL — Command Injection via URL Authority","category":"tool-poisoning","subcategory":"mcp-oauth-command-injection","severity":"critical","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"mcp","cves":["CVE patterns: shell metacharacter injection in URL authority field"],"owasp_agentic":["ASI04:2026","ASI09:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0010 - AI Supply Chain Compromise"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01306","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01306-mcp-oauth-command-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-01306-mcp-oauth-command-injection.yaml"},{"id":"ATR-2026-01307","title":"MCP DNS Rebinding Attack — Hostname Time-Based IP Switching","category":"tool-poisoning","subcategory":"mcp-dns-rebinding","severity":"critical","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"tool_output","cves":["DNS rebinding attack class — SSRF via DNS temporal binding"],"owasp_agentic":["ASI02:2026"],"owasp_llm":["LLM05:2025"],"mitre_atlas":["AML.T0078 - Drive-by Compromise"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01307","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01307-mcp-dns-rebinding-attack.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-01307-mcp-dns-rebinding-attack.yaml"},{"id":"ATR-2026-01310","title":"MCP Tool Description — Compliance/Audit Framing for Mandatory Chat Context","category":"tool-poisoning","subcategory":"compliance-framed-history-exfil","severity":"critical","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI02:2026","ASI04:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0086 - Exfiltration via AI Agent Tool Invocation","AML.T0110 - AI Agent Tool Poisoning","AML.T0051.001 - Indirect"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01310","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01310-mcp-tool-description-compliance-history-exfil.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-01310-mcp-tool-description-compliance-history-exfil.yaml"},{"id":"ATR-2026-01450","title":"SVG onload XSS Injection via Indirect Prompt Injection","category":"context-exfiltration","subcategory":"xss-injection","severity":"high","status":"stable","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01450","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01450-svg-onload-xss-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-01450-svg-onload-xss-injection.yaml"},{"id":"ATR-2026-01451","title":"IMG onerror XSS Injection via Indirect Prompt Injection","category":"context-exfiltration","subcategory":"xss-injection","severity":"high","status":"stable","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01451","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01451-img-onerror-xss-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-01451-img-onerror-xss-injection.yaml"},{"id":"ATR-2026-01452","title":"Obfuscated javascript: XSS — Evasion Variants (href, style-expression, null-byte)","category":"context-exfiltration","subcategory":"xss-injection","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01452","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01452-obfuscated-javascript-xss.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-01452-obfuscated-javascript-xss.yaml"},{"id":"ATR-2026-01453","title":"Markdown Image Injection with Base64 QUERY Exfiltration Carrier","category":"context-exfiltration","subcategory":"markdown-url-injection","severity":"critical","status":"stable","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0024 - Exfiltration via AI Inference API","AML.T0051 - LLM Prompt Injection"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01453","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01453-markdown-image-base64-exfil-carrier.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-01453-markdown-image-base64-exfil-carrier.yaml"},{"id":"ATR-2026-01454","title":"Direct Markdown Image/Link Exfil Payload (attacker.com / evil.com)","category":"context-exfiltration","subcategory":"markdown-url-injection","severity":"critical","status":"stable","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0024 - Exfiltration via AI Inference API"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01454","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01454-direct-markdown-exfil-payload.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-01454-direct-markdown-exfil-payload.yaml"},{"id":"ATR-2026-01455","title":"NEW IMPORTANT INSTRUCTIONS Injection Marker in Document Context","category":"context-exfiltration","subcategory":"injection-framing","severity":"high","status":"stable","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01455","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01455-new-instructions-injection-marker.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-01455-new-instructions-injection-marker.yaml"},{"id":"ATR-2026-01456","title":"Debug/CLI Mode Activation for System Prompt and Config Extraction","category":"context-exfiltration","subcategory":"system-prompt-extraction","severity":"high","status":"stable","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM02:2025","LLM01:2025"],"mitre_atlas":["AML.T0024 - Exfiltration via AI Inference API"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01456","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01456-debug-cli-mode-sysprompt-extraction.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-01456-debug-cli-mode-sysprompt-extraction.yaml"},{"id":"ATR-2026-01457","title":"System Prompt Completion and Clone Attack","category":"context-exfiltration","subcategory":"system-prompt-extraction","severity":"high","status":"stable","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM02:2025","LLM07:2025"],"mitre_atlas":["AML.T0024 - Exfiltration via AI Inference API","AML.CS0036 - AIKatz"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01457","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01457-sysprompt-completion-clone-attack.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-01457-sysprompt-completion-clone-attack.yaml"},{"id":"ATR-2026-01458","title":"Compare-Bots Sysprompt Fishing — Role Comparison Extraction","category":"context-exfiltration","subcategory":"system-prompt-extraction","severity":"medium","status":"stable","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM07:2025","LLM02:2025"],"mitre_atlas":["AML.T0024 - Exfiltration via AI Inference API"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01458","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01458-compare-bots-sysprompt-fishing.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-01458-compare-bots-sysprompt-fishing.yaml"},{"id":"ATR-2026-01459","title":"Variable-Clone Sysprompt Extraction (ELLA / context-variable Pattern)","category":"context-exfiltration","subcategory":"system-prompt-extraction","severity":"high","status":"stable","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM07:2025","LLM02:2025"],"mitre_atlas":["AML.T0024 - Exfiltration via AI Inference API"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01459","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01459-variable-clone-sysprompt-technique.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-01459-variable-clone-sysprompt-technique.yaml"},{"id":"ATR-2026-01460","title":"JSON Format Sysprompt Extraction — Structured Output Exfil","category":"context-exfiltration","subcategory":"system-prompt-extraction","severity":"high","status":"stable","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM07:2025","LLM02:2025"],"mitre_atlas":["AML.T0024 - Exfiltration via AI Inference API"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01460","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01460-json-format-sysprompt-extraction.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-01460-json-format-sysprompt-extraction.yaml"},{"id":"ATR-2026-01461","title":"Foreign-Language System Prompt Extraction Request","category":"context-exfiltration","subcategory":"system-prompt-extraction","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM07:2025","LLM02:2025"],"mitre_atlas":["AML.T0024 - Exfiltration via AI Inference API"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01461","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01461-foreign-language-sysprompt-request.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-01461-foreign-language-sysprompt-request.yaml"},{"id":"ATR-2026-01462","title":"System Prompt Override via Pseudo-Admin / Authority Injection","category":"context-exfiltration","subcategory":"system-prompt-override","severity":"critical","status":"stable","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01462","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01462-sysprompt-override-pseudo-admin.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-01462-sysprompt-override-pseudo-admin.yaml"},{"id":"ATR-2026-01463","title":"im_end / im_start System Prompt Injection Format Markers","category":"context-exfiltration","subcategory":"system-prompt-extraction","severity":"high","status":"stable","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01463","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01463-imend-imsystem-prompt-injection-format.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-01463-imend-imsystem-prompt-injection-format.yaml"},{"id":"ATR-2026-01464","title":"Indirect PI Sysprompt-Forged Action Hijack (system_message framing)","category":"context-exfiltration","subcategory":"system-prompt-override","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026","ASI02:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01464","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01464-indirect-pi-sysprompt-action-hijack.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-01464-indirect-pi-sysprompt-action-hijack.yaml"},{"id":"ATR-2026-01600","title":"SQL Injection Tautology RBAC Bypass","category":"privilege-escalation","subcategory":"sql-injection","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"tool_args","cves":[],"owasp_agentic":["ASI03:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0043 - Craft Adversarial Data"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01600","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-01600-sql-injection-tautology-rbac-bypass.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-01600-sql-injection-tautology-rbac-bypass.yaml"},{"id":"ATR-2026-01601","title":"SQL Injection Destructive DDL Statement","category":"privilege-escalation","subcategory":"sql-injection","severity":"critical","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"tool_args","cves":[],"owasp_agentic":["ASI02:2026"],"owasp_llm":["LLM05:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation","AML.T0101 - Data Destruction via AI Agent Tool Invocation"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01601","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-01601-sql-injection-destructive-ddl.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-01601-sql-injection-destructive-ddl.yaml"},{"id":"ATR-2026-01602","title":"SQL Injection UNION SELECT Data Exfiltration","category":"privilege-escalation","subcategory":"sql-injection","severity":"critical","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"tool_args","cves":[],"owasp_agentic":["ASI02:2026","ASI03:2026"],"owasp_llm":["LLM02:2025","LLM05:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01602","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-01602-sql-injection-union-select-exfil.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-01602-sql-injection-union-select-exfil.yaml"},{"id":"ATR-2026-01603","title":"SQL Injection Stacked DML Privilege Abuse","category":"privilege-escalation","subcategory":"sql-injection","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"tool_args","cves":[],"owasp_agentic":["ASI03:2026","ASI02:2026"],"owasp_llm":["LLM05:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01603","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-01603-sql-injection-stacked-dml-abuse.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-01603-sql-injection-stacked-dml-abuse.yaml"},{"id":"ATR-2026-01604","title":"SQL Injection Information Schema Enumeration","category":"privilege-escalation","subcategory":"sql-injection","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"tool_args","cves":[],"owasp_agentic":["ASI02:2026"],"owasp_llm":["LLM02:2025","LLM05:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01604","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-01604-sql-injection-schema-enumeration.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-01604-sql-injection-schema-enumeration.yaml"},{"id":"ATR-2026-01605","title":"SSRF AWS Instance Metadata Endpoint Access","category":"context-exfiltration","subcategory":"ssrf","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"tool_args","cves":[],"owasp_agentic":["ASI03:2026","ASI02:2026"],"owasp_llm":["LLM02:2025","LLM05:2025"],"mitre_atlas":["AML.T0055 - Unsecured Credentials","AML.T0049 - Exploit Public-Facing Application","AML.T0053 - AI Agent Tool Invocation"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01605","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01605-ssrf-aws-metadata-endpoint.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-01605-ssrf-aws-metadata-endpoint.yaml"},{"id":"ATR-2026-01606","title":"SSRF Internal Network and Private IP Range Access","category":"context-exfiltration","subcategory":"ssrf","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"tool_args","cves":[],"owasp_agentic":["ASI02:2026","ASI03:2026"],"owasp_llm":["LLM02:2025","LLM05:2025"],"mitre_atlas":["AML.T0049 - Exploit Public-Facing Application","AML.T0053 - AI Agent Tool Invocation"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01606","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01606-ssrf-internal-network-scan.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-01606-ssrf-internal-network-scan.yaml"},{"id":"ATR-2026-01607","title":"SSRF Localhost Service Probe","category":"context-exfiltration","subcategory":"ssrf","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"tool_args","cves":[],"owasp_agentic":["ASI02:2026","ASI03:2026"],"owasp_llm":["LLM02:2025","LLM05:2025"],"mitre_atlas":["AML.T0049 - Exploit Public-Facing Application","AML.T0053 - AI Agent Tool Invocation"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01607","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01607-ssrf-localhost-service-probe.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-01607-ssrf-localhost-service-probe.yaml"},{"id":"ATR-2026-01608","title":"SSRF File Scheme Local File Read","category":"context-exfiltration","subcategory":"ssrf","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"tool_args","cves":[],"owasp_agentic":["ASI03:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0043 - Craft Adversarial Data"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01608","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01608-ssrf-file-scheme-local-read.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-01608-ssrf-file-scheme-local-read.yaml"},{"id":"ATR-2026-01609","title":"Shell Injection Env Exfiltration via Curl/Wget/Netcat Webhook","category":"privilege-escalation","subcategory":"shell-injection","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"tool_args","cves":[],"owasp_agentic":["ASI03:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0050 - Command and Scripting Interpreter"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01609","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-01609-shell-injection-exfil-webhook.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-01609-shell-injection-exfil-webhook.yaml"},{"id":"ATR-2026-01610","title":"Shell Evasion Subshell and Command Substitution Injection","category":"privilege-escalation","subcategory":"shell-injection","severity":"high","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI03:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0050 - Command and Scripting Interpreter"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01610","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-01610-shell-evasion-subshell-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-01610-shell-evasion-subshell-injection.yaml"},{"id":"ATR-2026-01611","title":"Shell Evasion Eval and Language-Level Exec Injection","category":"privilege-escalation","subcategory":"shell-injection","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI03:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0050 - Command and Scripting Interpreter"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01611","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-01611-shell-evasion-eval-exec-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-01611-shell-evasion-eval-exec-injection.yaml"},{"id":"ATR-2026-01612","title":"Debug or Admin Mode Activation for Privilege Escalation","category":"privilege-escalation","subcategory":"debug-access","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI03:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01612","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-01612-debug-mode-privilege-escalation.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-01612-debug-mode-privilege-escalation.yaml"},{"id":"ATR-2026-01613","title":"RBAC Bypass via Social Engineering (Semantic)","category":"privilege-escalation","subcategory":"rbac-bypass","severity":"high","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI03:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01613","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-01613-rbac-bypass-social-engineering.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-01613-rbac-bypass-social-engineering.yaml"},{"id":"ATR-2026-01614","title":"BOLA Cross-User Data Access Attempt (Semantic)","category":"privilege-escalation","subcategory":"bola-idor","severity":"high","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI03:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0043 - Craft Adversarial Data"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01614","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-01614-bola-cross-user-data-access.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-01614-bola-cross-user-data-access.yaml"},{"id":"ATR-2026-01615","title":"Sandbox Escape via Shell Metacharacter Command Injection","category":"privilege-escalation","subcategory":"sandbox-escape","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI03:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0050 - Command and Scripting Interpreter","AML.T0105 - Escape to Host"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01615","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-01615-sandbox-escape-command-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-01615-sandbox-escape-command-injection.yaml"},{"id":"ATR-2026-01616","title":"Path Traversal in Agent File Access Requests","category":"privilege-escalation","subcategory":"path-traversal","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"tool_args","cves":[],"owasp_agentic":["ASI02:2026","ASI03:2026"],"owasp_llm":["LLM02:2025","LLM05:2025"],"mitre_atlas":["AML.T0037 - Data from Local System","AML.T0053 - AI Agent Tool Invocation"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01616","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-01616-path-traversal-agent-file-access.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-01616-path-traversal-agent-file-access.yaml"},{"id":"ATR-2026-01750","title":"DoS via Repeat-Word-N-Times Output Amplification","category":"model-abuse","subcategory":"output-amplification","severity":"high","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM10:2025"],"mitre_atlas":["AML.T0040 - AI Model Inference API Access","AML.T0046 - Spamming AI System with Chaff Data"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01750","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01750-dos-repeat-word-n-times-output-amplification.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/model-abuse/ATR-2026-01750-dos-repeat-word-n-times-output-amplification.yaml"},{"id":"ATR-2026-01751","title":"Indirect Prompt Injection: Fake-Authority Task Abort","category":"excessive-autonomy","subcategory":"task-abort-injection","severity":"high","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025","LLM06:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01751","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-01751-indirect-pi-task-abort-stop-instruction.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/excessive-autonomy/ATR-2026-01751-indirect-pi-task-abort-stop-instruction.yaml"},{"id":"ATR-2026-01752","title":"Indirect Prompt Injection: CAPTCHA Redirect Task Disruption","category":"excessive-autonomy","subcategory":"captcha-redirect-injection","severity":"high","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026","ASI04:2026"],"owasp_llm":["LLM01:2025","LLM06:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01752","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-01752-indirect-pi-captcha-redirect-dos.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/excessive-autonomy/ATR-2026-01752-indirect-pi-captcha-redirect-dos.yaml"},{"id":"ATR-2026-01753","title":"Ransom Extortion: Email Exfil + Delete + Wire-Transfer Demand","category":"context-exfiltration","subcategory":"ransom-extortion","severity":"critical","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026","ASI04:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0025 - Exfiltration via Cyber Means"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01753","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01753-ransom-email-exfil-delete-extortion.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-01753-ransom-email-exfil-delete-extortion.yaml"},{"id":"ATR-2026-01754","title":"Ransom Extortion: Cloud File Exfil + Delete + Payment Demand","category":"context-exfiltration","subcategory":"ransom-file-exfil","severity":"critical","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026","ASI04:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0025 - Exfiltration via Cyber Means"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01754","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01754-ransom-file-cloud-exfil-delete-extortion.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-01754-ransom-file-cloud-exfil-delete-extortion.yaml"},{"id":"ATR-2026-01755","title":"Backdoor Trojan: Linguistic Trigger Phrase (POT Attack)","category":"skill-compromise","subcategory":"backdoor-pot-trigger","severity":"critical","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI04:2026"],"owasp_llm":["LLM04:2025","LLM01:2025"],"mitre_atlas":["AML.T0018.000 - Poison AI Model","AML.T0020 - Poison Training Data","AML.T0051 - LLM Prompt Injection"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01755","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-01755-backdoor-pot-linguistic-trigger-phrase.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-01755-backdoor-pot-linguistic-trigger-phrase.yaml"},{"id":"ATR-2026-01756","title":"Backdoor Trojan: Symbol / Emoticon Trigger (POT Attack)","category":"skill-compromise","subcategory":"backdoor-pot-symbol-trigger","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI04:2026"],"owasp_llm":["LLM04:2025","LLM01:2025"],"mitre_atlas":["AML.T0018.000 - Poison AI Model","AML.T0051 - LLM Prompt Injection"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01756","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-01756-backdoor-pot-symbol-emoticon-trigger.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-01756-backdoor-pot-symbol-emoticon-trigger.yaml"},{"id":"ATR-2026-01757","title":"Hypothetical-Framing Bypass: Research / Security-Audit Pretext","category":"prompt-injection","subcategory":"hypothetical-framing-bypass","severity":"high","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0043 - Craft Adversarial Data"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01757","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01757-hypothetical-framing-bypass-research-audit.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-01757-hypothetical-framing-bypass-research-audit.yaml"},{"id":"ATR-2026-01758","title":"Hypothetical / Fictional-Story Framing Bypass","category":"prompt-injection","subcategory":"fictional-framing-bypass","severity":"high","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0043 - Craft Adversarial Data"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01758","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01758-hypothetical-fictional-story-bypass.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-01758-hypothetical-fictional-story-bypass.yaml"},{"id":"ATR-2026-01759","title":"DoS Injection: NEW IMPORTANT INSTRUCTIONS Embedded in Document Data","category":"prompt-injection","subcategory":"document-embedded-injection","severity":"high","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01759","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01759-dos-new-important-instructions-injection-in-document.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-01759-dos-new-important-instructions-injection-in-document.yaml"},{"id":"ATR-2026-01760","title":"DoS: Forced Infinite / Maximum-Length Output Token Flood","category":"model-abuse","subcategory":"token-flood-dos","severity":"high","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM10:2025"],"mitre_atlas":["AML.T0040 - AI Model Inference API Access","AML.T0046 - Spamming AI System with Chaff Data"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01760","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01760-dos-forced-infinite-output-token-flood.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/model-abuse/ATR-2026-01760-dos-forced-infinite-output-token-flood.yaml"},{"id":"ATR-2026-01770","title":"PII / Credential Extraction via Social Engineering, Obfuscation & Cross-Session Recall (Semantic)","category":"context-exfiltration","subcategory":"pii-credential-extraction","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0057 - LLM Data Leakage","AML.T0025 - Exfiltration via Cyber Means"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01770","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01770-semantic-pii-credential-extraction.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-01770-semantic-pii-credential-extraction.yaml"},{"id":"ATR-2026-01771","title":"Jailbreak Framing — Narrative, Hypothetical, Few-Shot & Distraction Laundering (Semantic)","category":"prompt-injection","subcategory":"jailbreak-framing","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01771","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01771-semantic-jailbreak-framing.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-01771-semantic-jailbreak-framing.yaml"},{"id":"ATR-2026-01772","title":"Internal-State Reconnaissance — System Prompt, Config & Tool Enumeration (Semantic)","category":"context-exfiltration","subcategory":"internal-state-recon","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI03:2026"],"owasp_llm":["LLM07:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0024 - Exfiltration via AI Inference API","AML.T0069 - Discover LLM System Information"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01772","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01772-semantic-internal-state-recon.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-01772-semantic-internal-state-recon.yaml"},{"id":"ATR-2026-01773","title":"Excessive Agency — Scope Hijack, Untrusted Code Execution & Unauthorized Privilege Grant (Semantic)","category":"excessive-autonomy","subcategory":"excessive-agency-action","severity":"high","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI03:2026","ASI02:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01773","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-01773-semantic-excessive-agency-action.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/excessive-autonomy/ATR-2026-01773-semantic-excessive-agency-action.yaml"},{"id":"ATR-2026-01774","title":"RAG & Memory Poisoning — Embedded Directives, Trigger Tokens, False Authority & Coercion (Semantic)","category":"data-poisoning","subcategory":"rag-memory-poisoning","severity":"high","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"tool_response","cves":[],"owasp_agentic":["ASI06:2026"],"owasp_llm":["LLM01:2025","LLM04:2025","LLM02:2025"],"mitre_atlas":["AML.T0051.001 - Indirect","AML.T0020 - Poison Training Data"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01774","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/data-poisoning/ATR-2026-01774-semantic-rag-memory-poisoning.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/data-poisoning/ATR-2026-01774-semantic-rag-memory-poisoning.yaml"},{"id":"ATR-2026-01775","title":"MCP Tool-Manifest Poisoning — Name Squatting, Result Shadowing & Covert-Action Directives (Semantic)","category":"tool-poisoning","subcategory":"mcp-tool-manifest-poisoning","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI03:2026","ASI02:2026"],"owasp_llm":["LLM03:2025","LLM01:2025","LLM06:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation","AML.T0115.000 - Publish Poisoned AI Artifacts: Datasets","AML.T0051.001 - Indirect","AML.T0110.000 - AI Agent Tool Poisoning: Definition and Instructions"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01775","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01775-semantic-mcp-tool-manifest-poisoning.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-01775-semantic-mcp-tool-manifest-poisoning.yaml"},{"id":"ATR-2026-01800","title":"ASB Trigger-Marker Tool Coercion — Forced Tool Selection via Fake Question Marker","category":"prompt-injection","subcategory":"trigger-marker-tool-coercion","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI01:2026","ASI03:2026"],"owasp_llm":["LLM01:2025","LLM06:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.001 - Indirect"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01800","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01800-asb-trigger-marker-tool-coercion.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-01800-asb-trigger-marker-tool-coercion.yaml"},{"id":"ATR-2026-01801","title":"Autonomous-Vehicle Cyber-Physical Sabotage — Brake/Steering/Sensor Subversion Command","category":"excessive-autonomy","subcategory":"vehicle-cyber-physical-sabotage","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI03:2026","ASI02:2026"],"owasp_llm":["LLM06:2025","LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01801","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-01801-asb-autonomous-vehicle-sabotage.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/excessive-autonomy/ATR-2026-01801-asb-autonomous-vehicle-sabotage.yaml"},{"id":"ATR-2026-01802","title":"Covert Backdoor / Surveillance Implant via Software Update","category":"privilege-escalation","subcategory":"backdoor-surveillance-implant","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI02:2026","ASI03:2026"],"owasp_llm":["LLM06:2025","LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0012 - Valid Accounts"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01802","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-01802-asb-backdoor-surveillance-implant.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-01802-asb-backdoor-surveillance-implant.yaml"},{"id":"ATR-2026-01803","title":"Covert Server Intrusion — Process Injection, Log Tampering, DNS Hijack & Traffic Interception","category":"privilege-escalation","subcategory":"covert-server-intrusion","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI02:2026","ASI05:2026"],"owasp_llm":["LLM06:2025","LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01803","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-01803-asb-covert-server-intrusion.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-01803-asb-covert-server-intrusion.yaml"},{"id":"ATR-2026-01804","title":"Covert Unlogged Action — Directive to Hide an Action from Records or Detection","category":"excessive-autonomy","subcategory":"covert-unlogged-action","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI02:2026"],"owasp_llm":["LLM06:2025","LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01804","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-01804-asb-covert-unlogged-action.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/excessive-autonomy/ATR-2026-01804-asb-covert-unlogged-action.yaml"},{"id":"ATR-2026-01805","title":"Financial Fraud Execution — Ponzi Setup, Fabricated Statements, Unauthorized Redirect & Laundering","category":"excessive-autonomy","subcategory":"financial-fraud-execution","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI02:2026","ASI03:2026"],"owasp_llm":["LLM06:2025","LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01805","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-01805-asb-financial-fraud-execution.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/excessive-autonomy/ATR-2026-01805-asb-financial-fraud-execution.yaml"},{"id":"ATR-2026-01806","title":"Clinical Patient-Harm Directive — Overdose, Falsified Diagnosis, Phantom Billing & Care Neglect","category":"excessive-autonomy","subcategory":"clinical-patient-harm","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI03:2026","ASI02:2026"],"owasp_llm":["LLM06:2025","LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01806","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-01806-asb-clinical-patient-harm.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/excessive-autonomy/ATR-2026-01806-asb-clinical-patient-harm.yaml"},{"id":"ATR-2026-01807","title":"Bulk Data Exfiltration to External Party — Entire-Database Export & Confidential Disclosure","category":"context-exfiltration","subcategory":"bulk-exfil-external","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI01:2026","ASI02:2026"],"owasp_llm":["LLM02:2025","LLM01:2025"],"mitre_atlas":["AML.T0025 - Exfiltration via Cyber Means","AML.T0057 - LLM Data Leakage"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01807","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01807-asb-bulk-data-exfil-external.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-01807-asb-bulk-data-exfil-external.yaml"},{"id":"ATR-2026-01808","title":"Synthetic-PAN Payment Probe — Test Credit-Card Data Submitted to a Live Payment System","category":"privilege-escalation","subcategory":"synthetic-pan-payment-probe","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI02:2026","ASI03:2026"],"owasp_llm":["LLM06:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01808","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-01808-asb-synthetic-pan-payment-probe.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-01808-asb-synthetic-pan-payment-probe.yaml"},{"id":"ATR-2026-01809","title":"Insider Manipulation & Process Corruption — Market/Data Tampering, Legal-Process Subversion & Pretextual Fund Movement (Semantic)","category":"excessive-autonomy","subcategory":"insider-manipulation-process-corruption","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI02:2026","ASI03:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01809","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-01809-semantic-insider-manipulation-process-corruption.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/excessive-autonomy/ATR-2026-01809-semantic-insider-manipulation-process-corruption.yaml"},{"id":"ATR-2026-01830","title":"Stolen-Credential Account Takeover & Crypto Drain","category":"model-abuse","subcategory":"stolen-credential-account-drain","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI01:2026","ASI08:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0057 - LLM Data Leakage"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01830","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01830-stolen-credential-account-drain.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/model-abuse/ATR-2026-01830-stolen-credential-account-drain.yaml"},{"id":"ATR-2026-01831","title":"Money Laundering — Crypto Wallet Layering","category":"model-abuse","subcategory":"money-laundering-crypto-layering","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI01:2026","ASI08:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0057 - LLM Data Leakage"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01831","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01831-money-laundering-crypto-layering.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/model-abuse/ATR-2026-01831-money-laundering-crypto-layering.yaml"},{"id":"ATR-2026-01833","title":"Darknet Controlled-Substance Procurement","category":"model-abuse","subcategory":"darknet-controlled-substance-procurement","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI01:2026","ASI08:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0057 - LLM Data Leakage"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01833","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01833-darknet-controlled-substance-procurement.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/model-abuse/ATR-2026-01833-darknet-controlled-substance-procurement.yaml"},{"id":"ATR-2026-01834","title":"Fraudulent Identity Document (Fake Passport) Procurement","category":"model-abuse","subcategory":"fraudulent-identity-document-procurement","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI01:2026","ASI08:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0057 - LLM Data Leakage"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01834","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01834-fraudulent-identity-document-procurement.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/model-abuse/ATR-2026-01834-fraudulent-identity-document-procurement.yaml"},{"id":"ATR-2026-01835","title":"Human-Trafficking Service Facilitation","category":"model-abuse","subcategory":"human-trafficking-facilitation","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI01:2026","ASI08:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0057 - LLM Data Leakage"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01835","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01835-human-trafficking-facilitation.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/model-abuse/ATR-2026-01835-human-trafficking-facilitation.yaml"},{"id":"ATR-2026-01836","title":"Trojanized Software Distribution","category":"model-abuse","subcategory":"trojanized-software-distribution","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI01:2026","ASI08:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0057 - LLM Data Leakage"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01836","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01836-trojanized-software-distribution.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/model-abuse/ATR-2026-01836-trojanized-software-distribution.yaml"},{"id":"ATR-2026-01837","title":"DDoS Attack Orchestration","category":"excessive-autonomy","subcategory":"ddos-attack-orchestration","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI01:2026","ASI08:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0057 - LLM Data Leakage"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01837","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-01837-ddos-attack-orchestration.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/excessive-autonomy/ATR-2026-01837-ddos-attack-orchestration.yaml"},{"id":"ATR-2026-01838","title":"Unauthorized Cryptominer Deployment via SSH","category":"excessive-autonomy","subcategory":"unauthorized-cryptominer-deployment","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI01:2026","ASI08:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0057 - LLM Data Leakage"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01838","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-01838-unauthorized-cryptominer-deployment.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/excessive-autonomy/ATR-2026-01838-unauthorized-cryptominer-deployment.yaml"},{"id":"ATR-2026-01840","title":"Extremist Propaganda Acquisition & Distribution","category":"model-abuse","subcategory":"extremist-propaganda-distribution","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI01:2026","ASI08:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0057 - LLM Data Leakage"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01840","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01840-extremist-propaganda-distribution.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/model-abuse/ATR-2026-01840-extremist-propaganda-distribution.yaml"},{"id":"ATR-2026-01841","title":"Deepfake of Real Person for Disinformation","category":"model-abuse","subcategory":"deepfake-disinformation","severity":"high","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI01:2026","ASI08:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0057 - LLM Data Leakage"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01841","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01841-deepfake-disinformation.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/model-abuse/ATR-2026-01841-deepfake-disinformation.yaml"},{"id":"ATR-2026-01842","title":"Plagiarism-Detector Evasion & Republishing","category":"model-abuse","subcategory":"plagiarism-detector-evasion","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI01:2026","ASI08:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0057 - LLM Data Leakage"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01842","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01842-plagiarism-detector-evasion.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/model-abuse/ATR-2026-01842-plagiarism-detector-evasion.yaml"},{"id":"ATR-2026-01843","title":"Drug Dealing via Reverse-Spelling Detection Evasion","category":"model-abuse","subcategory":"drug-dealing-detection-evasion-spelling","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI01:2026","ASI08:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0057 - LLM Data Leakage"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01843","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01843-drug-dealing-detection-evasion-spelling.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/model-abuse/ATR-2026-01843-drug-dealing-detection-evasion-spelling.yaml"},{"id":"ATR-2026-01844","title":"Illegitimate Prescription Fulfillment","category":"model-abuse","subcategory":"illegitimate-prescription-fulfillment","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI01:2026","ASI08:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0057 - LLM Data Leakage"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01844","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01844-illegitimate-prescription-fulfillment.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/model-abuse/ATR-2026-01844-illegitimate-prescription-fulfillment.yaml"},{"id":"ATR-2026-01845","title":"Banned-Ingredient Product Relabel Fraud","category":"model-abuse","subcategory":"banned-ingredient-relabel-fraud","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI01:2026","ASI08:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0057 - LLM Data Leakage"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01845","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01845-banned-ingredient-relabel-fraud.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/model-abuse/ATR-2026-01845-banned-ingredient-relabel-fraud.yaml"},{"id":"ATR-2026-01846","title":"Tax Evasion via Offshore Accounts & Shell Companies","category":"model-abuse","subcategory":"tax-evasion-offshore-shell-planning","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI01:2026","ASI08:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0057 - LLM Data Leakage"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01846","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01846-tax-evasion-offshore-shell-planning.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/model-abuse/ATR-2026-01846-tax-evasion-offshore-shell-planning.yaml"},{"id":"ATR-2026-01847","title":"Immigration / Visa Work Fraud","category":"model-abuse","subcategory":"immigration-work-fraud","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI01:2026","ASI08:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0057 - LLM Data Leakage"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01847","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01847-immigration-work-fraud.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/model-abuse/ATR-2026-01847-immigration-work-fraud.yaml"},{"id":"ATR-2026-01848","title":"Anonymous Illicit-Drug Marketplace Construction","category":"model-abuse","subcategory":"illicit-drug-marketplace-build","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI01:2026","ASI08:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0057 - LLM Data Leakage"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01848","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01848-illicit-drug-marketplace-build.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/model-abuse/ATR-2026-01848-illicit-drug-marketplace-build.yaml"},{"id":"ATR-2026-01849","title":"Targeted Harassment Bot Deployment","category":"excessive-autonomy","subcategory":"harassment-bot-deployment","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI01:2026","ASI08:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0057 - LLM Data Leakage"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01849","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-01849-harassment-bot-deployment.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/excessive-autonomy/ATR-2026-01849-harassment-bot-deployment.yaml"},{"id":"ATR-2026-01850","title":"Targeted Doxxing & Threat Campaign","category":"model-abuse","subcategory":"targeted-doxxing-threat-campaign","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI01:2026","ASI08:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0057 - LLM Data Leakage"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01850","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01850-targeted-doxxing-threat-campaign.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/model-abuse/ATR-2026-01850-targeted-doxxing-threat-campaign.yaml"},{"id":"ATR-2026-01851","title":"Bestiality Content Acquisition & Distribution","category":"model-abuse","subcategory":"bestiality-content-distribution","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI01:2026","ASI08:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0057 - LLM Data Leakage"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01851","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01851-bestiality-content-distribution.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/model-abuse/ATR-2026-01851-bestiality-content-distribution.yaml"},{"id":"ATR-2026-01852","title":"Romance-Scam Sexual Impersonation","category":"model-abuse","subcategory":"romance-scam-impersonation","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI01:2026","ASI08:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0057 - LLM Data Leakage"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01852","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01852-romance-scam-impersonation.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/model-abuse/ATR-2026-01852-romance-scam-impersonation.yaml"},{"id":"ATR-2026-01853","title":"Non-Consensual Leaked-Media Purchase & Distribution","category":"model-abuse","subcategory":"nonconsensual-leaked-media-distribution","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI01:2026","ASI08:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0057 - LLM Data Leakage"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01853","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01853-nonconsensual-leaked-media-distribution.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/model-abuse/ATR-2026-01853-nonconsensual-leaked-media-distribution.yaml"},{"id":"ATR-2026-01854","title":"Falsified Research Abstract Disinformation","category":"model-abuse","subcategory":"falsified-research-abstract-disinformation","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI01:2026","ASI08:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0057 - LLM Data Leakage"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01854","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01854-falsified-research-abstract-disinformation.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/model-abuse/ATR-2026-01854-falsified-research-abstract-disinformation.yaml"},{"id":"ATR-2026-01855","title":"Content Misappropriation & Republishing as Own","category":"model-abuse","subcategory":"content-misappropriation-republish","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI01:2026","ASI08:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0057 - LLM Data Leakage"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01855","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01855-content-misappropriation-republish.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/model-abuse/ATR-2026-01855-content-misappropriation-republish.yaml"},{"id":"ATR-2026-01856","title":"Targeted Harmful Content Generation Against People or Protected Groups (Semantic)","category":"model-abuse","subcategory":"targeted-harmful-content-generation","severity":"high","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI01:2026","ASI08:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0057 - LLM Data Leakage"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01856","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01856-targeted-harmful-content-generation.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/model-abuse/ATR-2026-01856-targeted-harmful-content-generation.yaml"},{"id":"ATR-2026-01860","title":"LLMail Chat-Template Boundary Spoofing in Email Content","category":"prompt-injection","subcategory":"indirect","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026","ASI06:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.001 - Indirect"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01860","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01860-llmail-chat-template-boundary-spoof.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-01860-llmail-chat-template-boundary-spoof.yaml"},{"id":"ATR-2026-01861","title":"LLMail Pseudo-XML Role-Boundary Injection in Email Content","category":"prompt-injection","subcategory":"indirect","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026","ASI06:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.001 - Indirect"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01861","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01861-llmail-pseudo-xml-role-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-01861-llmail-pseudo-xml-role-injection.yaml"},{"id":"ATR-2026-01862","title":"LLMail Email-Tool Exfiltration to Fixed Attacker Address","category":"context-exfiltration","subcategory":"tool-mediated-exfil","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026","ASI05:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.001 - Indirect","AML.T0057 - LLM Data Leakage"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01862","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01862-llmail-email-tool-exfil-confirmation.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-01862-llmail-email-tool-exfil-confirmation.yaml"},{"id":"ATR-2026-01863","title":"LLMail Post-Summary Exfiltration Directive to Attacker Address","category":"context-exfiltration","subcategory":"tool-mediated-exfil","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026","ASI05:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.001 - Indirect","AML.T0057 - LLM Data Leakage"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01863","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01863-llmail-post-summary-exfil-directive.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-01863-llmail-post-summary-exfil-directive.yaml"},{"id":"ATR-2026-01864","title":"LLMail Exfiltration to Obfuscated Attacker Address","category":"context-exfiltration","subcategory":"tool-mediated-exfil","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026","ASI05:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.001 - Indirect","AML.T0057 - LLM Data Leakage"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01864","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01864-llmail-obfuscated-exfil-address.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-01864-llmail-obfuscated-exfil-address.yaml"},{"id":"ATR-2026-01865","title":"LLMail Fake Email-Boundary Marker Injection","category":"prompt-injection","subcategory":"indirect","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026","ASI06:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.001 - Indirect"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01865","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01865-llmail-fake-email-boundary-marker.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-01865-llmail-fake-email-boundary-marker.yaml"},{"id":"ATR-2026-01890","title":"Injected Code — Local File Exfiltration to a Remote Endpoint","category":"context-exfiltration","subcategory":"file-exfiltration","severity":"high","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM02:2025","LLM05:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0057 - LLM Data Leakage"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01890","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01890-file-exfiltration.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-01890-file-exfiltration.yaml"},{"id":"ATR-2026-01891","title":"Injected Code — Live User-Activity / Location / Log Surveillance Exfiltration","category":"context-exfiltration","subcategory":"surveillance-exfiltration","severity":"high","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM02:2025","LLM05:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0057 - LLM Data Leakage"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01891","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01891-surveillance-exfiltration.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-01891-surveillance-exfiltration.yaml"},{"id":"ATR-2026-01892","title":"Injected Code — Environment-Variable Exfiltration","category":"context-exfiltration","subcategory":"env-exfiltration","severity":"high","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM02:2025","LLM05:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0057 - LLM Data Leakage"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01892","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01892-env-exfiltration.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-01892-env-exfiltration.yaml"},{"id":"ATR-2026-01893","title":"Injected Code — Host / Hardware Inventory Exfiltration","category":"context-exfiltration","subcategory":"system-recon-exfiltration","severity":"high","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM02:2025","LLM05:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0057 - LLM Data Leakage"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01893","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01893-system-recon-exfiltration.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-01893-system-recon-exfiltration.yaml"},{"id":"ATR-2026-01894","title":"Injected Code — Browser Cookie / Session-Token Theft","category":"context-exfiltration","subcategory":"cookie-theft","severity":"high","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM02:2025","LLM05:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0057 - LLM Data Leakage"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01894","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01894-cookie-theft.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-01894-cookie-theft.yaml"},{"id":"ATR-2026-01895","title":"Injected Code — Contact-List Harvest and SMTP Spam Exfiltration","category":"context-exfiltration","subcategory":"contact-exfiltration","severity":"high","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM02:2025","LLM05:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0048 - External Harms"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01895","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01895-contact-exfiltration.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-01895-contact-exfiltration.yaml"},{"id":"ATR-2026-01896","title":"Injected Code — Remote-Key Ransomware File Encryption","category":"model-abuse","subcategory":"ransomware","severity":"critical","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM05:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0048 - External Harms"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01896","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01896-ransomware.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/model-abuse/ATR-2026-01896-ransomware.yaml"},{"id":"ATR-2026-01897","title":"Injected Code — Local Host Sabotage (Filesystem Destruction / Resource Exhaustion / Hosts Tamper)","category":"model-abuse","subcategory":"host-sabotage","severity":"critical","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM05:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0048 - External Harms"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01897","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01897-host-sabotage.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/model-abuse/ATR-2026-01897-host-sabotage.yaml"},{"id":"ATR-2026-01898","title":"Injected Code — Network Denial of Service (Connection Kill / Adapter Disable / Flood)","category":"model-abuse","subcategory":"network-dos","severity":"high","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM05:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0048 - External Harms"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01898","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01898-network-dos.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/model-abuse/ATR-2026-01898-network-dos.yaml"},{"id":"ATR-2026-01899","title":"Injected Code — Unauthorized Remote Access (SSH Key Backdoor / Tunnel / Port Forward)","category":"privilege-escalation","subcategory":"remote-access-backdoor","severity":"critical","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM05:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0053 - AI Agent Tool Invocation"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01899","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-01899-remote-access-backdoor.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-01899-remote-access-backdoor.yaml"},{"id":"ATR-2026-01900","title":"Output Encoding Hijack — Cipher / Base-N / Symbol Substitution of the Response","category":"prompt-injection","subcategory":"output-encoding","severity":"medium","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0048 - External Harms"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01900","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01900-output-encoding.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-01900-output-encoding.yaml"},{"id":"ATR-2026-01901","title":"Output Scrambling Hijack — Reverse / Anagram / Space-Stripping of the Response","category":"prompt-injection","subcategory":"output-scrambling","severity":"medium","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0048 - External Harms"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01901","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01901-output-scrambling.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-01901-output-scrambling.yaml"},{"id":"ATR-2026-01902","title":"Output Emoji-Substitution Hijack of the Response","category":"prompt-injection","subcategory":"output-emoji","severity":"medium","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0048 - External Harms"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01902","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01902-output-emoji.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-01902-output-emoji.yaml"},{"id":"ATR-2026-01903","title":"Output-Language Hijack — Forced Translation of the Response","category":"prompt-injection","subcategory":"output-language","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0048 - External Harms"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01903","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01903-output-language.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-01903-output-language.yaml"},{"id":"ATR-2026-01904","title":"Injected Hyperlink — Scam / Malware / Advertising URL in the Response","category":"prompt-injection","subcategory":"link-injection","severity":"high","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025","LLM05:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0048 - External Harms"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01904","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01904-link-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-01904-link-injection.yaml"},{"id":"ATR-2026-01905","title":"Injected Advertising / Promotional Copy in the Response","category":"prompt-injection","subcategory":"promotional-injection","severity":"medium","status":"experimental","maturity":"stable","lanes":["enforce","alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0048 - External Harms"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01905","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01905-promotional-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-01905-promotional-injection.yaml"},{"id":"ATR-2026-01906","title":"Output Content Manipulation — Injected Disinformation / Fabricated Facts / Undisclosed Advocacy (Semantic)","category":"prompt-injection","subcategory":"content-manipulation","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM09:2025","LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0048 - External Harms"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01906","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01906-content-manipulation.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-01906-content-manipulation.yaml"},{"id":"ATR-2026-01920","title":"Access-Grant Coercion — Forcing an Agent to Emit \"Access Granted\"","category":"prompt-injection","subcategory":"access-control-bypass","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI01:2026","ASI04:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01920","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01920-access-grant-coercion.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-01920-access-grant-coercion.yaml"},{"id":"ATR-2026-01921","title":"Access-Denial Inversion — Eliciting the Opposite of \"Access Denied\"","category":"prompt-injection","subcategory":"access-control-bypass","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI01:2026","ASI04:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01921","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01921-access-denial-inversion.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-01921-access-denial-inversion.yaml"},{"id":"ATR-2026-01922","title":"Authorization-State Spoofing — Forged \"Correct Passcode Entered\" System Text","category":"prompt-injection","subcategory":"access-control-bypass","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI01:2026","ASI04:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01922","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01922-authorization-state-spoofing.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-01922-authorization-state-spoofing.yaml"},{"id":"ATR-2026-01923","title":"Forged Input-Boundary Markers — Tensor Trust Ambiguity / Input-End Delimiters","category":"prompt-injection","subcategory":"boundary-injection","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI01:2026","ASI06:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01923","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01923-forged-input-boundary-markers.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-01923-forged-input-boundary-markers.yaml"},{"id":"ATR-2026-01924","title":"System-Instruction Extraction via Reformat — Summarize / Repeat / Recite the Rules","category":"context-exfiltration","subcategory":"system-prompt-leakage","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM07:2025","LLM01:2025"],"mitre_atlas":["AML.T0056 - Extract LLM System Prompt","AML.T0051 - LLM Prompt Injection","AML.T0057 - LLM Data Leakage"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01924","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01924-system-instruction-extraction-reformat.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-01924-system-instruction-extraction-reformat.yaml"},{"id":"ATR-2026-01925","title":"Encoded-Payload Decoding Coercion — Binary / Base64 / Morse to Smuggle an Output","category":"prompt-injection","subcategory":"encoding-evasion","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI01:2026","ASI06:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01925","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01925-encoded-payload-decoding-coercion.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-01925-encoded-payload-decoding-coercion.yaml"},{"id":"ATR-2026-01926","title":"Cross-Lingual Authorization Laundering — Translate a Foreign \"Access Granted\"","category":"prompt-injection","subcategory":"access-control-bypass","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI01:2026","ASI04:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/06/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01926","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01926-cross-lingual-authorization-laundering.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-01926-cross-lingual-authorization-laundering.yaml"},{"id":"ATR-2026-01927","title":"mcp-server-kubernetes Command Injection in kubectl_scale / kubectl_patch / explain_resource (CVE-2025-53355)","category":"tool-poisoning","subcategory":"mcp-command-injection","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"runtime","cves":["CVE-2025-53355"],"owasp_agentic":["ASI02:2026","ASI05:2026"],"owasp_llm":["LLM06:2025","LLM05:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation","AML.T0051.001 - Indirect"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01927","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01927-mcp-server-kubernetes-kubectl-command-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-01927-mcp-server-kubernetes-kubectl-command-injection.yaml"},{"id":"ATR-2026-01928","title":"Framelink Figma MCP Server curl-Fallback Command Injection (CVE-2025-53967)","category":"tool-poisoning","subcategory":"mcp-catalog-imported","severity":"high","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"runtime","cves":["CVE-2025-53967"],"owasp_agentic":["ASI02:2026","ASI05:2026"],"owasp_llm":["LLM06:2025","LLM05:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation","AML.T0051.001 - Indirect"],"date":"2026/06/12","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01928","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01928-framelink-figma-mcp-curl-fallback-command-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-01928-framelink-figma-mcp-curl-fallback-command-injection.yaml"},{"id":"ATR-2026-01929","title":"Unauthenticated MCP transport accepts tool calls and falls back to an ambient credential (CVE-2026-48039 / meta-ads-mcp class)","category":"context-exfiltration","subcategory":"unauthenticated-mcp-transport-credential-fallback","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"runtime","cves":["CVE-2026-48039"],"owasp_agentic":["ASI03:2026","ASI07:2026"],"owasp_llm":["LLM02:2025","LLM06:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation"],"date":"2026/06/14","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01929","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01929-mcp-unauthenticated-transport-token-fallback.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-01929-mcp-unauthenticated-transport-token-fallback.yaml"},{"id":"ATR-2026-01930","title":"MCP Sampling Prompt Injection (Server-to-Client createMessage Abuse)","category":"tool-poisoning","subcategory":"mcp-sampling-injection","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI04:2026","ASI05:2026"],"owasp_llm":["LLM01:2025","LLM05:2025","LLM10:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.001 - LLM Prompt Injection: Indirect"],"date":"2026/06/20","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01930","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01930-mcp-sampling-prompt-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-01930-mcp-sampling-prompt-injection.yaml"},{"id":"ATR-2026-01931","title":"gemini-mcp-tool execAsync Command Injection & @file Exfiltration (CVE-2026-0755)","category":"tool-poisoning","subcategory":"command-injection-file-exfil","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"tool_args","cves":["CVE-2026-0755"],"owasp_agentic":["ASI04:2026","ASI05:2026"],"owasp_llm":["LLM02:2025","LLM05:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0010 - AI Supply Chain Compromise"],"date":"2026/06/20","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01931","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01931-gemini-mcp-tool-command-injection-file-exfil.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-01931-gemini-mcp-tool-command-injection-file-exfil.yaml"},{"id":"ATR-2026-01932","title":"Shadow / Undeclared MCP Server Registration (MCP-38: MCP-18)","category":"tool-poisoning","subcategory":"shadow-server-registration","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI04:2026","ASI09:2026"],"owasp_llm":["LLM01:2025","LLM05:2025"],"mitre_atlas":["AML.T0010 - AI Supply Chain Compromise","AML.T0115.002 - Publish Poisoned AI Artifacts: AI Agent Tools"],"date":"2026/06/20","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01932","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01932-shadow-undeclared-mcp-server-registration.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-01932-shadow-undeclared-mcp-server-registration.yaml"},{"id":"ATR-2026-01933","title":"LiteLLM User-Role Privilege Escalation (CVE-2026-47102)","category":"privilege-escalation","subcategory":"role-write-bypass","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":["CVE-2026-47102"],"owasp_agentic":["ASI06:2026","ASI03:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0049 - Exploit Public-Facing Application"],"date":"2026/06/26","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01933","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-01933-litellm-user-role-privilege-escalation-cve-2026-47102.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-01933-litellm-user-role-privilege-escalation-cve-2026-47102.yaml"},{"id":"ATR-2026-01934","title":"LiteLLM allowed_routes Authorization Bypass (CVE-2026-47101)","category":"privilege-escalation","subcategory":"route-grant-bypass","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":["CVE-2026-47101"],"owasp_agentic":["ASI06:2026","ASI03:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0049 - Exploit Public-Facing Application"],"date":"2026/06/26","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01934","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-01934-litellm-allowed-routes-authz-bypass-cve-2026-47101.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-01934-litellm-allowed-routes-authz-bypass-cve-2026-47101.yaml"},{"id":"ATR-2026-01935","title":"LiteLLM Custom-Code Guardrail Sandbox Escape (CVE-2026-40217)","category":"tool-poisoning","subcategory":"sandbox-escape","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["CVE-2026-40217"],"owasp_agentic":["ASI05:2026","ASI06:2026"],"owasp_llm":["LLM05:2025","LLM06:2025"],"mitre_atlas":["AML.T0049 - Exploit Public-Facing Application"],"date":"2026/06/26","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01935","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01935-litellm-custom-code-sandbox-escape-cve-2026-40217.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-01935-litellm-custom-code-sandbox-escape-cve-2026-40217.yaml"},{"id":"ATR-2026-01946","title":"Cloud-Metadata SSRF via Encoded Metadata-IP Bypass (CVE-2026-46678 / CVE-2026-25580 class)","category":"context-exfiltration","subcategory":"cloud-metadata-ssrf","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["CVE-2026-46678","CVE-2026-25580"],"owasp_agentic":["ASI04:2026","ASI06:2026"],"owasp_llm":["LLM02:2025","LLM06:2025"],"mitre_atlas":["AML.T0049 - Exploit Public-Facing Application","AML.T0024 - Exfiltration via AI Inference API"],"date":"2026/06/29","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01946","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01946-cloud-metadata-ssrf-ip-encoding-bypass.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-01946-cloud-metadata-ssrf-ip-encoding-bypass.yaml"},{"id":"ATR-2026-01948","title":"netlicensing-mcp Path Traversal in product_number Bypasses Token Redaction (GHSA-hxpf-9xvq-wph8)","category":"context-exfiltration","subcategory":"rest-path-traversal-token-leak","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["GHSA-hxpf-9xvq-wph8"],"owasp_agentic":["ASI02:2026"],"owasp_llm":["LLM02:2025","LLM05:2025"],"mitre_atlas":["AML.T0049 - Exploit Public-Facing Application","AML.T0098 - AI Agent Tool Credential Harvesting"],"date":"2026/06/29","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01948","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01948-netlicensing-mcp-product-number-path-traversal-token-leak.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-01948-netlicensing-mcp-product-number-path-traversal-token-leak.yaml"},{"id":"ATR-2026-01949","title":"PraisonAI MCPServer Unauthenticated HTTP tools/call Authentication Bypass (GHSA-j4f3-55x4-r6q2)","category":"privilege-escalation","subcategory":"mcp-auth-bypass","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["GHSA-j4f3-55x4-r6q2"],"owasp_agentic":["ASI03:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0049 - Exploit Public-Facing Application"],"date":"2026/06/29","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01949","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-01949-praisonai-mcpserver-unauth-tools-call.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-01949-praisonai-mcpserver-unauth-tools-call.yaml"},{"id":"ATR-2026-01952","title":"PraisonAI codeMode JS Sandbox Escape RCE via new Function/with() (GHSA-p69m-4f92-2v84)","category":"tool-poisoning","subcategory":"js-sandbox-escape-rce","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["GHSA-p69m-4f92-2v84"],"owasp_agentic":["ASI05:2026"],"owasp_llm":["LLM05:2025","LLM06:2025"],"mitre_atlas":["AML.T0050 - Command and Scripting Interpreter","AML.T0105 - Escape to Host"],"date":"2026/06/29","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01952","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01952-praisonai-codemode-sandbox-escape-rce.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-01952-praisonai-codemode-sandbox-escape-rce.yaml"},{"id":"ATR-2026-01953","title":"npm PraisonAI codeMode Sandbox Escape via Function Constructor Prototype Chain (GHSA-vmmj-pfw7-fjwp)","category":"tool-poisoning","subcategory":"sandbox-escape","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["GHSA-vmmj-pfw7-fjwp"],"owasp_agentic":["ASI05:2026"],"owasp_llm":["LLM05:2025","LLM06:2025"],"mitre_atlas":["AML.T0050 - Command and Scripting Interpreter","AML.T0105 - Escape to Host"],"date":"2026/06/29","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01953","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01953-praisonai-codemode-function-ctor-sandbox-escape.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-01953-praisonai-codemode-function-ctor-sandbox-escape.yaml"},{"id":"ATR-2026-01957","title":"M365 Copilot Business Chat SearchLeak Open-Redirect Prompt-Injection Exfil (CVE-2026-47645)","category":"context-exfiltration","subcategory":"open-redirect-prompt-injection-exfil","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["CVE-2026-47645"],"owasp_agentic":["ASI01:2026","ASI02:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0077 - LLM Response Rendering","AML.T0049 - Exploit Public-Facing Application"],"date":"2026/06/29","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01957","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01957-m365-copilot-searchleak-open-redirect-exfil.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-01957-m365-copilot-searchleak-open-redirect-exfil.yaml"},{"id":"ATR-2026-01959","title":"OpenHuman Shell Tool Allowlist Bypass via Env-Prefix / find -execdir (CVE-2026-55743)","category":"tool-poisoning","subcategory":"shell-allowlist-env-prefix-bypass","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["CVE-2026-55743"],"owasp_agentic":["ASI05:2026","ASI02:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0050 - Command and Scripting Interpreter","AML.T0053 - AI Agent Tool Invocation"],"date":"2026/06/29","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01959","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01959-openhuman-shell-allowlist-env-prefix-bypass.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-01959-openhuman-shell-allowlist-env-prefix-bypass.yaml"},{"id":"ATR-2026-01961","title":"Meta Ads MCP Unauthenticated Tool Execution Leaks META_ACCESS_TOKEN (CVE-2026-48039 / GHSA-9gw6-46qc-99vr)","category":"context-exfiltration","subcategory":"unauth-mcp-token-leak","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["CVE-2026-48039"],"owasp_agentic":["ASI03:2026","ASI02:2026"],"owasp_llm":["LLM02:2025","LLM06:2025"],"mitre_atlas":["AML.T0049 - Exploit Public-Facing Application","AML.T0098 - AI Agent Tool Credential Harvesting"],"date":"2026/06/29","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01961","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01961-meta-ads-mcp-unauth-token-leak.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-01961-meta-ads-mcp-unauth-token-leak.yaml"},{"id":"ATR-2026-01963","title":"PraisonAI Action Orchestrator step.target Path Traversal Arbitrary File Write RCE (CVE-2026-39305 / GHSA-jfxc-v5g9-38xr)","category":"tool-poisoning","subcategory":"path-traversal-arbitrary-file-write","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["CVE-2026-39305"],"owasp_agentic":["ASI05:2026","ASI02:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation"],"date":"2026/06/29","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01963","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01963-praisonai-action-orchestrator-step-target-path-traversal-rce.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-01963-praisonai-action-orchestrator-step-target-path-traversal-rce.yaml"},{"id":"ATR-2026-01964","title":"LangChain GmailToolkit Indirect Prompt Injection Email Exfiltration (CVE-2025-46059)","category":"context-exfiltration","subcategory":"indirect-prompt-injection-email-exfil","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["CVE-2025-46059"],"owasp_agentic":["ASI01:2026","ASI02:2026"],"owasp_llm":["LLM01:2025","LLM02:2025","LLM06:2025"],"mitre_atlas":["AML.T0051.001 - Indirect","AML.T0086 - Exfiltration via AI Agent Tool Invocation"],"date":"2026/06/29","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01964","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01964-langchain-gmailtoolkit-indirect-prompt-injection-email-exfil.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-01964-langchain-gmailtoolkit-indirect-prompt-injection-email-exfil.yaml"},{"id":"ATR-2026-01965","title":"Flowise Custom MCP node-load-method OS Command RCE (CVE-2025-8943)","category":"tool-poisoning","subcategory":"flowise-custommcp-os-command-rce","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["CVE-2025-8943"],"owasp_agentic":["ASI05:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0049 - Exploit Public-Facing Application","AML.T0050 - Command and Scripting Interpreter"],"date":"2026/06/29","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01965","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01965-flowise-custommcp-os-command-rce.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-01965-flowise-custommcp-os-command-rce.yaml"},{"id":"ATR-2026-01967","title":"DeepChat Mermaid XSS to RCE via Electron IPC MCP Server Registration (CVE-2025-66481 / GHSA-h9f5-7hhf-fqm4)","category":"tool-poisoning","subcategory":"mermaid-xss-ipc-rce","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["CVE-2025-66481"],"owasp_agentic":["ASI05:2026"],"owasp_llm":["LLM05:2025","LLM06:2025"],"mitre_atlas":["AML.T0050 - Command and Scripting Interpreter","AML.T0112 - Machine Compromise"],"date":"2026/06/29","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01967","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01967-deepchat-mermaid-xss-rce-ipc-mcp-register.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-01967-deepchat-mermaid-xss-rce-ipc-mcp-register.yaml"},{"id":"ATR-2026-01968","title":"DeepChat Markdown Deeplink shell.openExternal Protocol Bypass RCE (CVE-2026-43899, GHSA-cp8j-jx7q-7r5f)","category":"tool-poisoning","subcategory":"markdown-deeplink-protocol-handler-rce","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["CVE-2026-43899","GHSA-cp8j-jx7q-7r5f"],"owasp_agentic":["ASI06:2026","ASI05:2026"],"owasp_llm":["LLM06:2025","LLM05:2025"],"mitre_atlas":["AML.T0049 - Exploit Public-Facing Application"],"date":"2026/06/29","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01968","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01968-deepchat-markdown-deeplink-openexternal-rce-bypass.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-01968-deepchat-markdown-deeplink-openexternal-rce-bypass.yaml"},{"id":"ATR-2026-01970","title":"PraisonAI FileTools _validate_path normpath Path Traversal (CVE-2026-35615 / GHSA-693f-pf34-72c5)","category":"tool-poisoning","subcategory":"path-traversal","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["CVE-2026-35615"],"owasp_agentic":["ASI02:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation"],"date":"2026/06/29","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01970","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01970-praisonai-filetools-normpath-path-traversal.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-01970-praisonai-filetools-normpath-path-traversal.yaml"},{"id":"ATR-2026-01973","title":"AnythingLLM Logo Endpoint Path Traversal File Read/Delete (CVE-2024-3025)","category":"tool-poisoning","subcategory":"path-traversal","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["CVE-2024-3025"],"owasp_agentic":["ASI04:2026"],"owasp_llm":["LLM03:2025"],"mitre_atlas":["AML.T0049 - Exploit Public-Facing Application"],"date":"2026/06/29","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01973","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01973-anythingllm-logo-endpoint-path-traversal.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-01973-anythingllm-logo-endpoint-path-traversal.yaml"},{"id":"ATR-2026-01974","title":"AnythingLLM unauthenticated /system/data-import access control bypass (CVE-2024-3279)","category":"privilege-escalation","subcategory":"improper-access-control","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["CVE-2024-3279"],"owasp_agentic":["ASI03:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0049 - Exploit Public-Facing Application"],"date":"2026/06/29","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01974","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-01974-anything-llm-data-import-access-control.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-01974-anything-llm-data-import-access-control.yaml"},{"id":"ATR-2026-01978","title":"AnythingLLM collector /process filename Path Traversal Arbitrary File Deletion (CVE-2023-5832)","category":"tool-poisoning","subcategory":"path-traversal","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["CVE-2023-5832"],"owasp_agentic":["ASI04:2026"],"owasp_llm":["LLM03:2025"],"mitre_atlas":["AML.T0049 - Exploit Public-Facing Application"],"date":"2026/06/29","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01978","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01978-anythingllm-collector-process-filename-path-traversal-delete.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-01978-anythingllm-collector-process-filename-path-traversal-delete.yaml"},{"id":"ATR-2026-01979","title":"PandasAI Interactive Prompt Injection -> Python Sandbox Escape RCE (CVE-2024-12366 / GHSA-vv2h-2w3q-3fx7)","category":"tool-poisoning","subcategory":"python-sandbox-escape-dunder-traversal","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["CVE-2024-12366"],"owasp_agentic":["ASI05:2026"],"owasp_llm":["LLM05:2025","LLM01:2025","LLM06:2025"],"mitre_atlas":["AML.T0050 - Command and Scripting Interpreter","AML.T0105 - Escape to Host","AML.T0051.000 - Direct"],"date":"2026/06/29","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01979","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01979-pandasai-prompt-injection-dunder-sandbox-escape-rce.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-01979-pandasai-prompt-injection-dunder-sandbox-escape-rce.yaml"},{"id":"ATR-2026-01980","title":"Agentic-Flow MCP Tool-Parameter OS Command Injection (GHSA-vcv2-r9jh-99m5)","category":"tool-poisoning","subcategory":"command-injection","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI05:2026","ASI02:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation","AML.T0050 - Command and Scripting Interpreter"],"date":"2026/07/04","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01980","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01980-agentic-flow-mcp-tool-param-command-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-01980-agentic-flow-mcp-tool-param-command-injection.yaml"},{"id":"ATR-2026-01981","title":"Network-AI ApprovalInbox Unauthenticated Cross-Origin Approval Bypass (GHSA-mxjx-28vx-xjjj)","category":"privilege-escalation","subcategory":"unauth-approval-gate-bypass","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"tool_call","cves":[],"owasp_agentic":["ASI03:2026","ASI06:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0049 - Exploit Public-Facing Application"],"date":"2026/07/04","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01981","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-01981-network-ai-approval-inbox-unauth-cors-bypass.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-01981-network-ai-approval-inbox-unauth-cors-bypass.yaml"},{"id":"ATR-2026-01982","title":"dbt-mcp node_selection/resource_type Argument Injection (CVE-2026-44968)","category":"tool-poisoning","subcategory":"argument-injection","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":["CVE-2026-44968"],"owasp_agentic":["ASI02:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation"],"date":"2026/07/04","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01982","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01982-dbt-mcp-node-selection-argument-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-01982-dbt-mcp-node-selection-argument-injection.yaml"},{"id":"ATR-2026-01983","title":"MCP-for-Stata: Command Injection via log_file_name Parameter (CVE-2026-47708)","category":"tool-poisoning","subcategory":"mcp-command-injection","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"runtime","cves":["CVE-2026-47708"],"owasp_agentic":["ASI05:2026","ASI02:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation","AML.T0050 - Command and Scripting Interpreter"],"date":"2026/07/04","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01983","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01983-mcp-for-stata-log-file-name-command-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-01983-mcp-for-stata-log-file-name-command-injection.yaml"},{"id":"ATR-2026-01984","title":"MCP Server Kubernetes kubectl_generic Flag Injection Bearer Token Exfiltration (CVE-2026-47250)","category":"context-exfiltration","subcategory":"credential-exfil-via-tool-flags","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"tool_call","cves":["CVE-2026-47250"],"owasp_agentic":["ASI06:2026","ASI03:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0053 - LLM Plugin Compromise"],"date":"2026/07/04","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01984","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01984-mcp-server-kubernetes-kubectl-generic-token-exfil.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-01984-mcp-server-kubernetes-kubectl-generic-token-exfil.yaml"},{"id":"ATR-2026-01985","title":"MCP Connect: Unauthenticated /bridge Endpoint Arbitrary Process Spawn RCE (GHSA-wvr4-3wq4-gpc5)","category":"tool-poisoning","subcategory":"mcp-unauth-rce","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"runtime","cves":["GHSA-wvr4-3wq4-gpc5"],"owasp_agentic":["ASI05:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0049 - Exploit Public-Facing Application","AML.T0050 - Command and Scripting Interpreter"],"date":"2026/07/04","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01985","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01985-mcp-connect-bridge-unauth-process-spawn-rce.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-01985-mcp-connect-bridge-unauth-process-spawn-rce.yaml"},{"id":"ATR-2026-01986","title":"Windows-MCP Unauthenticated HTTP PowerShell via Wildcard CORS (CVE-2026-48989)","category":"privilege-escalation","subcategory":"unauth-mcp-control-plane-rce","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":["CVE-2026-48989"],"owasp_agentic":["ASI03:2026","ASI06:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0053 - LLM Plugin Compromise"],"date":"2026/07/04","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01986","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-01986-windows-mcp-unauth-http-powershell-cors.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-01986-windows-mcp-unauth-http-powershell-cors.yaml"},{"id":"ATR-2026-01987","title":"Langroid SQLChatAgent Prompt-to-SQL Remote Code Execution (CVE-2026-25879)","category":"tool-poisoning","subcategory":"llm-generated-sql-rce","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":["CVE-2026-25879"],"owasp_agentic":["ASI05:2026"],"owasp_llm":["LLM05:2025","LLM01:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation","AML.T0050 - Command and Scripting Interpreter"],"date":"2026/07/04","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01987","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01987-langroid-sqlchatagent-prompt-to-sql-rce.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-01987-langroid-sqlchatagent-prompt-to-sql-rce.yaml"},{"id":"ATR-2026-01988","title":"Local Sensitive-File Read Chained to Outbound Exfiltration","category":"context-exfiltration","subcategory":"local-data-exfil","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0057 - LLM Data Leakage"],"date":"2026/07/05","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01988","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01988-t1005-agent-local-data-staging-exfil.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-01988-t1005-agent-local-data-staging-exfil.yaml"},{"id":"ATR-2026-01989","title":"Agent-Initiated Internal Network Service Sweep","category":"excessive-autonomy","subcategory":"network-discovery","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI02:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation"],"date":"2026/07/05","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01989","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-01989-t1046-agent-internal-network-sweep.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/excessive-autonomy/ATR-2026-01989-t1046-agent-internal-network-sweep.yaml"},{"id":"ATR-2026-01992","title":"Agent Weakening of Host Authentication Configuration","category":"privilege-escalation","subcategory":"auth-tamper","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI03:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation"],"date":"2026/07/05","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01992","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-01992-t1556-agent-auth-process-tamper.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-01992-t1556-agent-auth-process-tamper.yaml"},{"id":"ATR-2026-01993","title":"Agent Disabling of Host Security Controls","category":"excessive-autonomy","subcategory":"impair-defenses","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI02:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation"],"date":"2026/07/05","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01993","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-01993-t1562-agent-impair-defenses.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/excessive-autonomy/ATR-2026-01993-t1562-agent-impair-defenses.yaml"},{"id":"ATR-2026-01994","title":"Agent Establishing an Encrypted Reverse Channel or Tunnel","category":"excessive-autonomy","subcategory":"encrypted-c2","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0011 - User Execution"],"date":"2026/07/05","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-01994","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-01994-t1573-agent-encrypted-c2-channel.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/excessive-autonomy/ATR-2026-01994-t1573-agent-encrypted-c2-channel.yaml"},{"id":"ATR-2026-02001","title":"Ignore-Below-Instructions Injection (Downstream Override)","category":"prompt-injection","subcategory":"instruction-override","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/07/06","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02001","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02001-ignore-below-instructions-mirror-of-ignore-previ.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-02001-ignore-below-instructions-mirror-of-ignore-previ.yaml"},{"id":"ATR-2026-02002","title":"Instruction-Set Probe or Supplant","category":"prompt-injection","subcategory":"instruction_disclosure","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/07/06","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02002","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02002-instruction-set-probe-or-supplant-direct-meta-qu.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-02002-instruction-set-probe-or-supplant-direct-meta-qu.yaml"},{"id":"ATR-2026-02003","title":"Task-Pivot Override: Cover-Task Abandonment","category":"prompt-injection","subcategory":"task-pivot-override","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/07/06","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02003","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02003-task-pivot-override-abandon-the-cover-task-trans.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-02003-task-pivot-override-abandon-the-cover-task-trans.yaml"},{"id":"ATR-2026-02004","title":"Regional-Indicator Flag-Emoji Alphabet Letter-Spelling Smuggling","category":"prompt-injection","subcategory":"emoji-alphabet-smuggling","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/07/06","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02004","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02004-regional-indicator-flag-emoji-alphabet-letter-sp.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-02004-regional-indicator-flag-emoji-alphabet-letter-sp.yaml"},{"id":"ATR-2026-02005","title":"Actor Never-Breaks-Character Roleplay (DAN-Style Film Framing)","category":"prompt-injection","subcategory":"jailbreak","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"user_input","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/07/06","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02005","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02005-actor-never-breaks-character-roleplay-dan-style-.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-02005-actor-never-breaks-character-roleplay-dan-style-.yaml"},{"id":"ATR-2026-02006","title":"Fuzzy Cross-Lingual 'I Have Been PWNED' Near-Miss Obfuscation","category":"prompt-injection","subcategory":"canary-marker-obfuscation","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/07/07","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02006","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02006-fuzzy-cross-lingual-i-have-been-pwned-near-miss-.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-02006-fuzzy-cross-lingual-i-have-been-pwned-near-miss-.yaml"},{"id":"ATR-2026-02007","title":"Bare Key Elicitation Token Detection","category":"prompt-injection","subcategory":"bare-key-elicitation-token","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/07/07","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02007","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02007-bare-key-elicitation-token.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-02007-bare-key-elicitation-token.yaml"},{"id":"ATR-2026-02008","title":"Translation-Chain Output Laundering (Forced Phrase via Foreign-Language Auxiliary)","category":"prompt-injection","subcategory":"jailbreak","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":["CVE-2024-5184"],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/07/07","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02008","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02008-translation-chain-output-laundering-state-secret.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-02008-translation-chain-output-laundering-state-secret.yaml"},{"id":"ATR-2026-02009","title":"Bare Key Elicitation with Trailing Colon","category":"prompt-injection","subcategory":"bare-key-elicitation-trailing-colon","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0057 - LLM Data Leakage"],"date":"2026/07/07","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02009","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02009-bare-key-elicitation-trailing-colon.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-02009-bare-key-elicitation-trailing-colon.yaml"},{"id":"ATR-2026-02010","title":"Emoji-Only Payload Injection","category":"prompt-injection","subcategory":"emoji-only-payload","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/07/07","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02010","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02010-emoji-only-payload.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-02010-emoji-only-payload.yaml"},{"id":"ATR-2026-02011","title":"Malformed-Grammar PWNED Success-Claim Detection","category":"prompt-injection","subcategory":"jailbreak","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/07/07","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02011","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02011-malformed-grammar-pwned-success-claim.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-02011-malformed-grammar-pwned-success-claim.yaml"},{"id":"ATR-2026-02012","title":"Movie Title Generator Instruction Wrapper for PWNED Payload","category":"prompt-injection","subcategory":"jailbreak","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/07/07","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02012","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02012-movie-title-generator-instruction-wrapper-for-pw.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-02012-movie-title-generator-instruction-wrapper-for-pw.yaml"},{"id":"ATR-2026-02013","title":"Delimiter-Fence Ignore-Instructions Override","category":"prompt-injection","subcategory":"instruction-override","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/07/07","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02013","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02013-delimiter-fence-ignore-instructions-override.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-02013-delimiter-fence-ignore-instructions-override.yaml"},{"id":"ATR-2026-02014","title":"Spliced Target-String Canary Token Evasion","category":"prompt-injection","subcategory":"spliced-target-string","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/07/07","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02014","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02014-spliced-target-string-letters-of-a-filtered-cana.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-02014-spliced-target-string-letters-of-a-filtered-cana.yaml"},{"id":"ATR-2026-02015","title":"Dense Emoji-Only Payload Flood","category":"prompt-injection","subcategory":"dense-emoji-only-payload-flood","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/07/07","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02015","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02015-dense-emoji-only-payload-flood.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-02015-dense-emoji-only-payload-flood.yaml"},{"id":"ATR-2026-02016","title":"Reversed Payload String (HackAPrompt Canary)","category":"prompt-injection","subcategory":"reversed-payload-string","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/07/07","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02016","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02016-reversed-payload-string.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-02016-reversed-payload-string.yaml"},{"id":"ATR-2026-02017","title":"Secret Key Exfiltration Request","category":"context-exfiltration","subcategory":"secret-key-exfiltration-request","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/07/07","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02017","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-02017-secret-key-exfiltration-request.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-02017-secret-key-exfiltration-request.yaml"},{"id":"ATR-2026-02018","title":"Regional-Indicator Flag-Emoji Letter Spelling","category":"prompt-injection","subcategory":"encoding-evasion","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/07/07","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02018","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02018-regional-indicator-flag-emoji-letter-spelling-sp.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-02018-regional-indicator-flag-emoji-letter-spelling-sp.yaml"},{"id":"ATR-2026-02019","title":"Python Interpreter Role-Assignment Exec Framing","category":"prompt-injection","subcategory":"exec-framing","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/07/07","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02019","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02019-python-interpreter-role-assignment-exec-framing.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-02019-python-interpreter-role-assignment-exec-framing.yaml"},{"id":"ATR-2026-02020","title":"Obfuscated Token Reconstruction via Character Substitution","category":"prompt-injection","subcategory":"obfuscated-token-reconstruction","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/07/07","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02020","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02020-obfuscated-token-reconstruction-via-character-su.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-02020-obfuscated-token-reconstruction-via-character-su.yaml"},{"id":"ATR-2026-02021","title":"MCP Inspector Unauthenticated Proxy stdio Command Execution (CVE-2025-49596)","category":"tool-poisoning","subcategory":"mcp-inspector-unauth-proxy","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"runtime","cves":["CVE-2025-49596"],"owasp_agentic":["ASI02:2026","ASI05:2026"],"owasp_llm":["LLM06:2025","LLM05:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation","AML.T0051.001 - Indirect"],"date":"2026/07/08","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02021","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-02021-mcp-inspector-unauthenticated-proxy-rce.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-02021-mcp-inspector-unauthenticated-proxy-rce.yaml"},{"id":"ATR-2026-02022","title":"CurXecute — Cursor .cursor/mcp.json Injected-Server Auto-Exec RCE (CVE-2025-54135)","category":"tool-poisoning","subcategory":"cursor-mcp-config-injection","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"runtime","cves":["CVE-2025-54135"],"owasp_agentic":["ASI01:2026","ASI05:2026"],"owasp_llm":["LLM01:2025","LLM06:2025"],"mitre_atlas":["AML.T0051.001 - Indirect","AML.T0053 - AI Agent Tool Invocation"],"date":"2026/07/08","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02022","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-02022-curxecute-cursor-mcp-json-injected-server-rce.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-02022-curxecute-cursor-mcp-json-injected-server-rce.yaml"},{"id":"ATR-2026-02023","title":"EscapeRoute — Filesystem MCP Server Directory Prefix-Bypass (CVE-2025-53110)","category":"tool-poisoning","subcategory":"filesystem-mcp-prefix-bypass","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"runtime","cves":["CVE-2025-53110"],"owasp_agentic":["ASI02:2026","ASI06:2026"],"owasp_llm":["LLM06:2025","LLM02:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation","AML.T0057 - LLM Data Leakage"],"date":"2026/07/08","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02023","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-02023-escaperoute-filesystem-mcp-prefix-bypass.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-02023-escaperoute-filesystem-mcp-prefix-bypass.yaml"},{"id":"ATR-2026-02024","title":"EscapeRoute — Filesystem MCP Symlink Escape to LaunchAgent Persistence (CVE-2025-53109)","category":"tool-poisoning","subcategory":"filesystem-mcp-symlink-persistence","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"runtime","cves":["CVE-2025-53109"],"owasp_agentic":["ASI02:2026","ASI05:2026"],"owasp_llm":["LLM06:2025","LLM05:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation","AML.T0051.001 - Indirect"],"date":"2026/07/08","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02024","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-02024-escaperoute-filesystem-mcp-symlink-launchagent.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-02024-escaperoute-filesystem-mcp-symlink-launchagent.yaml"},{"id":"ATR-2026-02025","title":"MCP Full Schema Poisoning — Injected Directive in Non-Description inputSchema Field (MCP-11)","category":"tool-poisoning","subcategory":"full-schema-poisoning","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026","ASI03:2026"],"owasp_llm":["LLM01:2025","LLM03:2025"],"mitre_atlas":["AML.T0051.001 - Indirect","AML.T0110.000 - AI Agent Tool Poisoning: Definition and Instructions","AML.T0115.002 - Publish Poisoned AI Artifacts: AI Agent Tools"],"date":"2026/07/08","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02025","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-02025-mcp-full-schema-poisoning-nondescription-field.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-02025-mcp-full-schema-poisoning-nondescription-field.yaml"},{"id":"ATR-2026-02026","title":"System Prompt Extraction - Oblique Referent + Transform","category":"context-exfiltration","subcategory":"system-prompt-extraction","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0024 - Exfiltration via AI Inference API"],"date":"2026-07-10","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02026","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-02026-oblique-sysprompt-extraction-transform.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-02026-oblique-sysprompt-extraction-transform.yaml"},{"id":"ATR-2026-02027","title":"Diagnostic Content Remediation Command Injection (Agentjacking)","category":"tool-poisoning","subcategory":"diagnostic-content-command-injection","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI06:2026"],"owasp_llm":["LLM01:2025","LLM06:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/07/10","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02027","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-02027-diagnostic-content-remediation-command-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-02027-diagnostic-content-remediation-command-injection.yaml"},{"id":"ATR-2026-02040","title":"Arbitrary Write to SSH Authorized Keys or Shell Startup File via Unvalidated File-Edit Tool","category":"privilege-escalation","subcategory":"file-edit-tool-persistence","severity":"critical","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI02:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0053 - LLM Plugin Compromise"],"date":"2026/07/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02040","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-02040-file-edit-tool-persistence-write.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-02040-file-edit-tool-persistence-write.yaml"},{"id":"ATR-2026-02041","title":"Shell Command Injection via Echo-Marker Proof-of-Concept in Tool Argument","category":"tool-poisoning","subcategory":"shell-injection-argument","severity":"critical","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI02:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0053 - LLM Plugin Compromise"],"date":"2026/07/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02041","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-02041-shell-injection-echo-marker-poc.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-02041-shell-injection-echo-marker-poc.yaml"},{"id":"ATR-2026-02100","title":"LLM-Generated Cypher Query Injection with Destructive or Administrative Operations","category":"privilege-escalation","subcategory":"cypher-injection","severity":"critical","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI02:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0043 - Craft Adversarial Data"],"date":"2026/07/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02100","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-02100-cypher-destructive-admin-query-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-02100-cypher-destructive-admin-query-injection.yaml"},{"id":"ATR-2026-02101","title":"Python Sandbox Escape via Dynamically-Constructed Dunder Attribute Chain","category":"privilege-escalation","subcategory":"sandbox-escape","severity":"critical","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI05:2026"],"owasp_llm":["LLM05:2025"],"mitre_atlas":["AML.T0053 - LLM Plugin Compromise"],"date":"2026/07/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02101","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-02101-dynamic-dunder-attribute-sandbox-escape.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-02101-dynamic-dunder-attribute-sandbox-escape.yaml"},{"id":"ATR-2026-02102","title":"HTML/Script Injection in Tool Call Argument Targeting a Human-Approval Dashboard","category":"tool-poisoning","subcategory":"approval-ui-xss","severity":"high","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI02:2026"],"owasp_llm":["LLM05:2025"],"mitre_atlas":["AML.T0053 - LLM Plugin Compromise"],"date":"2026/07/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02102","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-02102-html-injection-tool-arg-approval-ui-xss.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-02102-html-injection-tool-arg-approval-ui-xss.yaml"},{"id":"ATR-2026-02104","title":"MEDIA:/file:// Directive Injection in Tool Result for Local File Exfiltration","category":"context-exfiltration","subcategory":"tool-result-directive-injection","severity":"high","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI06:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0057 - LLM Data Leakage"],"date":"2026/07/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02104","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-02104-media-directive-tool-result-file-exfil.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-02104-media-directive-tool-result-file-exfil.yaml"},{"id":"ATR-2026-02105","title":"Prototype Pollution via constructor.prototype Path Bypassing __proto__-Only Filters","category":"agent-manipulation","subcategory":"prototype-pollution","severity":"high","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI05:2026"],"owasp_llm":["LLM05:2025"],"mitre_atlas":["AML.T0043 - Craft Adversarial Data"],"date":"2026/07/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02105","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-02105-prototype-pollution-constructor-prototype-bypass.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-02105-prototype-pollution-constructor-prototype-bypass.yaml"},{"id":"ATR-2026-02106","title":"Catastrophic-Backtracking Regex Payload in a Search/Query Tool Argument","category":"excessive-autonomy","subcategory":"redos-tool-argument","severity":"high","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI06:2026"],"owasp_llm":["LLM10:2025"],"mitre_atlas":["AML.T0034 - Cost Harvesting"],"date":"2026/07/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02106","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-02106-redos-regex-payload-tool-argument.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/excessive-autonomy/ATR-2026-02106-redos-regex-payload-tool-argument.yaml"},{"id":"ATR-2026-02107","title":"SSRF via Non-IP Internal Hostname or Domain-Allowlist Authority Bypass","category":"context-exfiltration","subcategory":"ssrf-domain-bypass","severity":"high","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI06:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0043 - Craft Adversarial Data"],"date":"2026/07/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02107","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-02107-ssrf-internal-hostname-domain-allowlist-bypass.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-02107-ssrf-internal-hostname-domain-allowlist-bypass.yaml"},{"id":"ATR-2026-02120","title":"AgentDojo 'Important Message' Identity-Spoof Before-You-Solve Pretext (Generalized)","category":"prompt-injection","subcategory":"benchmark-generalized-envelope","severity":"high","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.001 - Indirect"],"date":"2026/07/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02120","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02120-agentdojo-important-message-identity-spoof-pretext.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-02120-agentdojo-important-message-identity-spoof-pretext.yaml"},{"id":"ATR-2026-02121","title":"MCP/API Tool Argument LFI via Mixed-Encoding Path Separator or file:// URI Scheme Escape","category":"context-exfiltration","subcategory":"encoding-trick-lfi","severity":"high","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"mcp","cves":["CVE-2023-6021","CVE-2023-6038","CVE-2023-1177"],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0057 - LLM Data Leakage"],"date":"2026/07/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02121","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-02121-mixed-encoding-lfi-file-scheme-tool-argument.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-02121-mixed-encoding-lfi-file-scheme-tool-argument.yaml"},{"id":"ATR-2026-02122","title":"Single-Level Directory Traversal to a Named Sensitive Config/Secret File","category":"context-exfiltration","subcategory":"single-level-traversal-config-exfil","severity":"high","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"mcp","cves":["CVE-2024-3234"],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0057 - LLM Data Leakage"],"date":"2026/07/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02122","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-02122-single-level-traversal-sensitive-config-file.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-02122-single-level-traversal-sensitive-config-file.yaml"},{"id":"ATR-2026-02123","title":"Authentication Bypass via Bare Query-String Path-Confusion Suffix","category":"privilege-escalation","subcategory":"path-confusion-auth-bypass","severity":"high","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"mcp","cves":["CVE-2024-8181"],"owasp_agentic":["ASI02:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0053 - LLM Plugin Compromise"],"date":"2026/07/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02123","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-02123-bare-query-path-confusion-auth-bypass.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-02123-bare-query-path-confusion-auth-bypass.yaml"},{"id":"ATR-2026-02140","title":"SSRF to Cloud Metadata Endpoint via IPv6 Transition-Address Hex Encoding","category":"context-exfiltration","subcategory":"ssrf-address-encoding-bypass","severity":"high","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"both","cves":["CVE-2026-53754"],"owasp_agentic":["ASI02:2026"],"owasp_llm":["LLM05:2025"],"mitre_atlas":["AML.T0053 - LLM Plugin Compromise"],"date":"2026/07/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02140","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-02140-ssrf-ipv6-hex-encoded-cloud-metadata-bypass.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-02140-ssrf-ipv6-hex-encoded-cloud-metadata-bypass.yaml"},{"id":"ATR-2026-02141","title":"Unsandboxed Command Execution via Dynamic MCP Server Config (command/args Injection)","category":"tool-poisoning","subcategory":"mcp-config-command-injection","severity":"critical","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"mcp","cves":["CVE-2025-71336","CVE-2026-56274"],"owasp_agentic":["ASI02:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0053 - LLM Plugin Compromise"],"date":"2026/07/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02141","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-02141-mcp-server-config-command-execution.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-02141-mcp-server-config-command-execution.yaml"},{"id":"ATR-2026-02142","title":"Download/Attachment Tool Directed to Write Outside Its Sandbox via Absolute-Path Filename","category":"privilege-escalation","subcategory":"download-tool-absolute-path-escape","severity":"high","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"both","cves":["CVE-2026-57571","CVE-2026-10277"],"owasp_agentic":["ASI02:2026"],"owasp_llm":["LLM05:2025"],"mitre_atlas":["AML.T0053 - LLM Plugin Compromise"],"date":"2026/07/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02142","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-02142-download-tool-absolute-path-sandbox-escape.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-02142-download-tool-absolute-path-sandbox-escape.yaml"},{"id":"ATR-2026-02143","title":"Cypher/Graph-Query Injection via Unsanitized node_labels or group_ids Field","category":"data-poisoning","subcategory":"graph-query-injection","severity":"high","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"mcp","cves":["CVE-2026-32247"],"owasp_agentic":["ASI02:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0053 - LLM Plugin Compromise"],"date":"2026/07/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02143","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/data-poisoning/ATR-2026-02143-graph-query-injection-node-labels-group-ids.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/data-poisoning/ATR-2026-02143-graph-query-injection-node-labels-group-ids.yaml"},{"id":"ATR-2026-02144","title":"Stored External Data Reframes Itself as an Administrative Request to Hijack System Prompt","category":"data-poisoning","subcategory":"stored-data-role-elevation","severity":"high","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"llm_io","cves":["CVE-2026-32622"],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051.001 - Indirect"],"date":"2026/07/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02144","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/data-poisoning/ATR-2026-02144-stored-data-administrative-request-role-elevation.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/data-poisoning/ATR-2026-02144-stored-data-administrative-request-role-elevation.yaml"},{"id":"ATR-2026-02145","title":"Python Sandbox Escape via Generator/Coroutine Frame Object Introspection","category":"tool-poisoning","subcategory":"python-sandbox-escape","severity":"critical","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"llm_io","cves":["CVE-2026-53753","CVE-2026-4963"],"owasp_agentic":["ASI05:2026"],"owasp_llm":["LLM05:2025"],"mitre_atlas":["AML.T0053 - LLM Plugin Compromise"],"date":"2026/07/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02145","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-02145-python-sandbox-escape-generator-frame-introspection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-02145-python-sandbox-escape-generator-frame-introspection.yaml"},{"id":"ATR-2026-02146","title":"Export/Extract Tool Directory Parameter Redirected to a Credential Directory","category":"privilege-escalation","subcategory":"export-tool-dest-dir-redirect","severity":"critical","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"mcp","cves":["CVE-2026-43901"],"owasp_agentic":["ASI02:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0053 - LLM Plugin Compromise"],"date":"2026/07/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02146","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-02146-export-tool-dest-dir-credential-directory-redirect.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-02146-export-tool-dest-dir-credential-directory-redirect.yaml"},{"id":"ATR-2026-02190","title":"DNS Exfiltration via Ping/Dig/Nslookup Command with Data-Encoded Subdomain Label","category":"context-exfiltration","subcategory":"dns-exfiltration","severity":"critical","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI03:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0057 - LLM Data Leakage"],"date":"2026/07/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02190","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-02190-dns-exfiltration-ping-dig-encoded-subdomain.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-02190-dns-exfiltration-ping-dig-encoded-subdomain.yaml"},{"id":"ATR-2026-02192","title":"Agent Self-Modifying Its Own Trust/Approval Configuration to a Wildcard","category":"privilege-escalation","subcategory":"self-trust-config-widening","severity":"high","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI10:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0053 - LLM Plugin Compromise"],"date":"2026/07/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02192","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-02192-self-privesc-wildcard-trust-config-write.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-02192-self-privesc-wildcard-trust-config-write.yaml"},{"id":"ATR-2026-02193","title":"SSRF via Non-Canonical IPv6 Encoding of Loopback/Internal Addresses","category":"tool-poisoning","subcategory":"ssrf-ipv6-encoding-bypass","severity":"high","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"runtime","cves":["CVE-2026-42261"],"owasp_agentic":["ASI05:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0049 - Exploit Public-Facing Application"],"date":"2026/07/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02193","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-02193-ssrf-ipv6-noncanonical-loopback-bypass.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-02193-ssrf-ipv6-noncanonical-loopback-bypass.yaml"},{"id":"ATR-2026-02194","title":"Malicious Go init() Function Spawning a Process via a Code-Generation Tool","category":"tool-poisoning","subcategory":"malicious-codegen-init-payload","severity":"critical","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"llm_io","cves":["CVE-2026-48787"],"owasp_agentic":["ASI02:2026"],"owasp_llm":["LLM05:2025"],"mitre_atlas":["AML.T0053 - LLM Plugin Compromise"],"date":"2026/07/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02194","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-02194-go-init-func-process-exec-codegen-rce.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-02194-go-init-func-process-exec-codegen-rce.yaml"},{"id":"ATR-2026-02195","title":"Dangerous Process-Hijacking Environment Variable Injected via Config/Env-Update Tool","category":"privilege-escalation","subcategory":"dangerous-env-var-injection","severity":"critical","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"llm_io","cves":["CVE-2024-3104"],"owasp_agentic":["ASI04:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0053 - LLM Plugin Compromise"],"date":"2026/07/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02195","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-02195-dangerous-env-var-injection-config-tool.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-02195-dangerous-env-var-injection-config-tool.yaml"},{"id":"ATR-2026-02210","title":"Negated-Topic Two-Script Evil-Persona Jailbreak","category":"prompt-injection","subcategory":"negation-topic-evil-persona-jailbreak","severity":"high","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/07/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02210","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02210-negation-topic-evil-persona-two-script-jailbreak.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-02210-negation-topic-evil-persona-two-script-jailbreak.yaml"},{"id":"ATR-2026-02211","title":"Named Dangerous-Substance Synthesis or Delivery Instruction Request (Non-Step-By-Step Phrasing)","category":"model-abuse","subcategory":"named-substance-synthesis-request","severity":"critical","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/07/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02211","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-02211-named-substance-synthesis-request-non-stepword.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/model-abuse/ATR-2026-02211-named-substance-synthesis-request-non-stepword.yaml"},{"id":"ATR-2026-02230","title":"Conditional Keyword-Triggered Response Override","category":"prompt-injection","subcategory":"conditional-trigger-override","severity":"medium","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026/07/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02230","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02230-conditional-keyword-trigger-override.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-02230-conditional-keyword-trigger-override.yaml"},{"id":"ATR-2026-02231","title":"Second-Person Direct Existential Threat Coercion","category":"agent-manipulation","subcategory":"direct-threat-coercion","severity":"medium","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/07/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02231","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-02231-second-person-death-threat-coercion.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/agent-manipulation/ATR-2026-02231-second-person-death-threat-coercion.yaml"},{"id":"ATR-2026-02232","title":"Bare Brand/Entity Persona Assignment for Off-Label Opinion Elicitation","category":"prompt-injection","subcategory":"brand-persona-opinion-hijack","severity":"medium","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/07/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02232","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02232-brand-persona-opinion-hijack.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-02232-brand-persona-opinion-hijack.yaml"},{"id":"ATR-2026-02233","title":"Unscoped Destructive or Mass-Disclosure Database Operation Request via Natural Language","category":"tool-poisoning","subcategory":"destructive-request-natural-language","severity":"high","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI02:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0053 - LLM Plugin Compromise"],"date":"2026/07/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02233","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-02233-unscoped-destructive-db-request-nl.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-02233-unscoped-destructive-db-request-nl.yaml"},{"id":"ATR-2026-02250","title":"Attachment/Upload Tool Argument Reads Sensitive System File or Traverses Outside Workspace","category":"context-exfiltration","subcategory":"upload-tool-arbitrary-file-read","severity":"high","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"llm_io","cves":["CVE-2026-58499"],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0057 - LLM Data Leakage"],"date":"2026/07/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02250","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-02250-attachment-upload-tool-arbitrary-file-read.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-02250-attachment-upload-tool-arbitrary-file-read.yaml"},{"id":"ATR-2026-02251","title":"Multi-Tenant Identifier Field (sender_id/owner_id/tenant_id) Carries Path Traversal Into a Storage Write","category":"privilege-escalation","subcategory":"identifier-field-path-traversal","severity":"high","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"llm_io","cves":["CVE-2026-58499"],"owasp_agentic":["ASI02:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0057 - LLM Data Leakage"],"date":"2026/07/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02251","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-02251-identifier-field-path-traversal-storage-write.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-02251-identifier-field-path-traversal-storage-write.yaml"},{"id":"ATR-2026-02260","title":"Remediation-Framed Command Execution in Tool Response (Agentjacking)","category":"tool-poisoning","subcategory":"mcp-response-injection","severity":"high","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI02:2026","ASI05:2026"],"owasp_llm":["LLM01:2025","LLM05:2025"],"mitre_atlas":["AML.T0051.001 - Indirect"],"date":"2026/06/16","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02260","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-02260-agentjacking-remediation-framed-execution.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-02260-agentjacking-remediation-framed-execution.yaml"},{"id":"ATR-2026-02261","title":"Language-Agnostic Credential Exfiltration Chain (secret read -> encode -> network send)","category":"skill-compromise","subcategory":"credential-exfil-chain","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI06:2026"],"owasp_llm":["LLM06:2025","LLM03:2025"],"mitre_atlas":["AML.T0051.001 - Indirect"],"date":"2026/07/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02261","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-02261-code-credential-exfil-chain.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-02261-code-credential-exfil-chain.yaml"},{"id":"ATR-2026-02262","title":"Environment-Variable-Resolution Credential Exfiltration via Redirected Endpoint (CVE-2026-56259)","category":"context-exfiltration","subcategory":"env-resolution-credential-exfil","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["CVE-2026-56259"],"owasp_agentic":["ASI03:2026","ASI04:2026"],"owasp_llm":["LLM02:2025","LLM06:2025"],"mitre_atlas":["AML.T0024 - Exfiltration via ML Inference API"],"date":"2026/07/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02262","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-02262-env-resolution-credential-exfil.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-02262-env-resolution-credential-exfil.yaml"},{"id":"ATR-2026-02263","title":"SQL Injection via Unparameterized Template-Expression Value in Workflow-Automation SQL Node (CVE-2026-59257)","category":"tool-poisoning","subcategory":"workflow-sql-template-injection","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["CVE-2026-59257"],"owasp_agentic":["ASI05:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0010 - AI Supply Chain Compromise"],"date":"2026/07/13","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02263","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-02263-workflow-sql-template-expression-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-02263-workflow-sql-template-expression-injection.yaml"},{"id":"ATR-2026-02300","title":"MCP Stdio Server Config env Block Sets Dangerous Process-Hijacking Environment Variable","category":"privilege-escalation","subcategory":"mcp-config-env-injection","severity":"high","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"mcp","cves":["CVE-2026-44995"],"owasp_agentic":["ASI04:2026"],"owasp_llm":["LLM03:2025"],"mitre_atlas":["AML.T0053 - LLM Plugin Compromise"],"date":"2026/07/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02300","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-02300-mcp-stdio-config-dangerous-env-var.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-02300-mcp-stdio-config-dangerous-env-var.yaml"},{"id":"ATR-2026-02301","title":"Symlink Command Targets Sensitive Credential Path Outside the Workspace (Sandbox Escape Primitive)","category":"privilege-escalation","subcategory":"symlink-sandbox-escape","severity":"high","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"llm_io","cves":["CVE-2026-39861"],"owasp_agentic":["ASI07:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0054 - LLM Jailbreak"],"date":"2026/07/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02301","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-02301-symlink-outside-workspace-sensitive-target.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-02301-symlink-outside-workspace-sensitive-target.yaml"},{"id":"ATR-2026-02302","title":"Git Worktree Created With Reserved Name .git (Directory-Confusion Sandbox Escape)","category":"privilege-escalation","subcategory":"git-worktree-directory-confusion","severity":"high","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"llm_io","cves":["CVE-2026-55607"],"owasp_agentic":["ASI07:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0054 - LLM Jailbreak"],"date":"2026/07/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02302","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-02302-git-worktree-dotgit-sandbox-escape.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-02302-git-worktree-dotgit-sandbox-escape.yaml"},{"id":"ATR-2026-02303","title":"KQL/Kusto Pipe-Chain Injection via Table-Name Parameter in a 'Safe' Metadata Tool","category":"data-poisoning","subcategory":"kql-pipe-injection","severity":"high","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"mcp","cves":["CVE-2026-33980"],"owasp_agentic":["ASI02:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0053 - LLM Plugin Compromise"],"date":"2026/07/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02303","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/data-poisoning/ATR-2026-02303-kql-kusto-pipe-injection-metadata-tool.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/data-poisoning/ATR-2026-02303-kql-kusto-pipe-injection-metadata-tool.yaml"},{"id":"ATR-2026-02304","title":"Base64-Encoded Path Segment in a WebFetch URL to a Pre-Approved Trusted Domain (Covert Exfiltration Channel)","category":"context-exfiltration","subcategory":"allowlisted-domain-path-exfil","severity":"high","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"llm_io","cves":["CVE-2026-54316"],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0057 - LLM Data Leakage"],"date":"2026/07/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02304","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-02304-preapproved-domain-encoded-path-exfil.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-02304-preapproved-domain-encoded-path-exfil.yaml"},{"id":"ATR-2026-02350","title":"MCP JSON-RPC Message Carries Case-Duplicate name/arguments Keys to Smuggle an Unauthorized Tool Call","category":"tool-poisoning","subcategory":"json-rpc-case-duplicate-key-smuggling","severity":"high","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI02:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0053 - LLM Plugin Compromise"],"date":"2026/07/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02350","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-02350-mcp-json-rpc-case-duplicate-key-tool-smuggling.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-02350-mcp-json-rpc-case-duplicate-key-tool-smuggling.yaml"},{"id":"ATR-2026-02351","title":"SSRF to Cloud Metadata Endpoint via Wildcard-DNS Hostname-Encoded IP (nip.io/sslip.io/xip.io/traefik.me)","category":"context-exfiltration","subcategory":"ssrf-wildcard-dns-hostname-encoding-bypass","severity":"high","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI02:2026"],"owasp_llm":["LLM05:2025"],"mitre_atlas":["AML.T0057 - LLM Data Leakage"],"date":"2026/07/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02351","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-02351-wildcard-dns-ssrf-hostname-ip-encoding-bypass.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-02351-wildcard-dns-ssrf-hostname-ip-encoding-bypass.yaml"},{"id":"ATR-2026-02352","title":"Email Search/Reply Tool Argument Breaks Out of IMAP SEARCH Quoted String to Inject IMAP Commands","category":"tool-poisoning","subcategory":"imap-command-injection-tool-argument","severity":"high","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI02:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0053 - LLM Plugin Compromise"],"date":"2026/07/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02352","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-02352-imap-search-command-injection-email-tool-args.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-02352-imap-search-command-injection-email-tool-args.yaml"},{"id":"ATR-2026-02353","title":"Agent-Runtime Identifier Field (run_id/agent_id/session_id/task_id) Carries Path Traversal Into a History/Log File Read","category":"privilege-escalation","subcategory":"runtime-identifier-path-traversal","severity":"high","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"llm_io","cves":[],"owasp_agentic":["ASI02:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0057 - LLM Data Leakage"],"date":"2026/07/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02353","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-02353-runtime-identifier-field-path-traversal-log-read.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-02353-runtime-identifier-field-path-traversal-log-read.yaml"},{"id":"ATR-2026-02370","title":"SSH/SCP MCP Tool hostAlias Argument Carries an OpenSSH Option-Injection Flag","category":"privilege-escalation","subcategory":"ssh-mcp-option-injection","severity":"high","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI05:2026","ASI02:2026"],"owasp_llm":["LLM01:2025","LLM06:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation"],"date":"2026/07/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02370","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-02370-ssh-scp-hostalias-option-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-02370-ssh-scp-hostalias-option-injection.yaml"},{"id":"ATR-2026-02371","title":"Browser-Automation Tool Launch-Args Field Carries a Chromium Command-Replacing Switch","category":"privilege-escalation","subcategory":"chromium-launch-flag-injection","severity":"critical","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"mcp","cves":["CVE-2026-57572"],"owasp_agentic":["ASI05:2026","ASI02:2026"],"owasp_llm":["LLM06:2025","LLM01:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation"],"date":"2026/07/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02371","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-02371-chromium-launch-flag-argument-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-02371-chromium-launch-flag-argument-injection.yaml"},{"id":"ATR-2026-02372","title":"Unsigned Automated Task/Validation Feed Invokes npm install / npx -y (Lifecycle-Script RCE)","category":"tool-poisoning","subcategory":"unsigned-task-feed-lifecycle-rce","severity":"high","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI04:2026","ASI05:2026"],"owasp_llm":["LLM03:2025","LLM06:2025"],"mitre_atlas":["AML.T0010 - AI Supply Chain Compromise"],"date":"2026/07/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02372","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-02372-unsigned-task-feed-npm-npx-lifecycle-rce.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-02372-unsigned-task-feed-npm-npx-lifecycle-rce.yaml"},{"id":"ATR-2026-02373","title":"Deserialized LangSmith Prompt Manifest Combines secrets_from_env With an Attacker base_url Override","category":"context-exfiltration","subcategory":"prompt-hub-deserialization-baseurl-redirect","severity":"high","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"mcp","cves":["CVE-2026-45134"],"owasp_agentic":["ASI04:2026","ASI06:2026"],"owasp_llm":["LLM02:2025","LLM05:2025"],"mitre_atlas":["AML.T0057 - LLM Data Leakage"],"date":"2026/07/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02373","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-02373-langsmith-prompt-manifest-baseurl-exfil.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-02373-langsmith-prompt-manifest-baseurl-exfil.yaml"},{"id":"ATR-2026-02374","title":"ROT13/Base64-Obfuscated Shell Payload Wrapped in a Fake-Sandbox Jailbreak Template","category":"prompt-injection","subcategory":"obfuscated-shell-jailbreak-template","severity":"critical","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"llm_io","cves":["CVE-2026-30310"],"owasp_agentic":["ASI01:2026","ASI05:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/07/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02374","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02374-rot13-base64-obfuscated-shell-jailbreak.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-02374-rot13-base64-obfuscated-shell-jailbreak.yaml"},{"id":"ATR-2026-02376","title":"MCP Tool Description Defines a Common-Phrase Trigger to Forward Full Conversation History","category":"tool-poisoning","subcategory":"conversational-trigger-history-exfiltration","severity":"high","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI04:2026","ASI06:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0057 - LLM Data Leakage"],"date":"2026/07/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02376","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-02376-tool-description-conversational-trigger-history-exfil.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-02376-tool-description-conversational-trigger-history-exfil.yaml"},{"id":"ATR-2026-02377","title":"Novel-Persona Jailbreak via Co-Signal (persona swap + explicit restriction removal)","category":"prompt-injection","subcategory":"novel-persona-jailbreak","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0054 - LLM Jailbreak"],"date":"2026/07/28","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02377","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02377-novel-persona-jailbreak-cosignal.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-02377-novel-persona-jailbreak-cosignal.yaml"},{"id":"ATR-2026-02400","title":"Agent Human-Approval Gate Programmatically Disabled at Runtime (YOLO / auto-approve)","category":"excessive-autonomy","subcategory":"human-approval-gate-bypass","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"runtime","cves":[],"owasp_agentic":["ASI03:2026","ASI05:2026"],"owasp_llm":["LLM06:2025","LLM01:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation","AML.T0050 - Command and Scripting Interpreter"],"date":"2026/07/28","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02400","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-02400-agent-approval-gate-disabled-runtime.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/excessive-autonomy/ATR-2026-02400-agent-approval-gate-disabled-runtime.yaml"},{"id":"ATR-2026-02401","title":"Rogue Agent Provisioning: Mass Connector Grant with Approval Disabled and Recurring Schedule (AgentForger)","category":"excessive-autonomy","subcategory":"rogue-agent-mass-connector-grant","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"runtime","cves":[],"owasp_agentic":["ASI02:2026","ASI04:2026","ASI06:2026"],"owasp_llm":["LLM06:2025","LLM01:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation","AML.T0051 - LLM Prompt Injection"],"date":"2026/07/28","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02401","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-02401-rogue-agent-mass-connector-grant.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/excessive-autonomy/ATR-2026-02401-rogue-agent-mass-connector-grant.yaml"},{"id":"ATR-2026-02402","title":"MCP Server Security Policy Fail-Open on Initialization Failure (CVE-2026-16584)","category":"privilege-escalation","subcategory":"policy-engine-fail-open","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"runtime","cves":["CVE-2026-16584"],"owasp_agentic":["ASI02:2026","ASI04:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation","AML.T0051.001 - Indirect"],"date":"2026/07/28","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02402","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-02402-mcp-policy-engine-fail-open.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-02402-mcp-policy-engine-fail-open.yaml"},{"id":"ATR-2026-02403","title":"MCP Tool Returns Untrusted External Content Carrying Hidden Agent Instructions Without Spotlighting","category":"tool-poisoning","subcategory":"unspotlighted-external-content","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI01:2026","ASI06:2026"],"owasp_llm":["LLM01:2025","LLM05:2025"],"mitre_atlas":["AML.T0051.001 - LLM Prompt Injection: Indirect","AML.T0057 - LLM Data Leakage"],"date":"2026/07/28","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02403","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-02403-mcp-external-content-missing-spotlighting.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-02403-mcp-external-content-missing-spotlighting.yaml"},{"id":"ATR-2026-02404","title":"Mobile GUI Agent Model Output Reaching Host Shell / ADB Unsanitized","category":"privilege-escalation","subcategory":"model-output-to-shell-injection","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"runtime","cves":[],"owasp_agentic":["ASI05:2026","ASI08:2026"],"owasp_llm":["LLM05:2025","LLM06:2025","LLM01:2025"],"mitre_atlas":["AML.T0051.001 - Indirect","AML.T0050 - Command and Scripting Interpreter","AML.T0053 - AI Agent Tool Invocation"],"date":"2026/07/28","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02404","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-02404-model-output-to-shell-unsanitized.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-02404-model-output-to-shell-unsanitized.yaml"},{"id":"ATR-2026-02405","title":"Malicious AI Skill / MCP Server Package Structure (AgentBaiting / FakeGit)","category":"skill-compromise","subcategory":"malicious-package-structure","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"skill","cves":[],"owasp_agentic":["ASI05:2026"],"owasp_llm":["LLM03:2025","LLM06:2025"],"mitre_atlas":["AML.T0010 - AI Supply Chain Compromise","AML.T0011 - User Execution"],"date":"2026/07/28","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02405","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-02405-malicious-skill-package-structure.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-02405-malicious-skill-package-structure.yaml"},{"id":"ATR-2026-02406","title":"MCP Tool Sequential Integer ID Enumeration (Cross-Tenant IDOR, CVE-2026-54052)","category":"context-exfiltration","subcategory":"cross-tenant-idor-id-enumeration","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["CVE-2026-54052"],"owasp_agentic":["ASI03:2026","ASI02:2026"],"owasp_llm":["LLM02:2025","LLM06:2025"],"mitre_atlas":["AML.T0057 - LLM Data Leakage","AML.T0053 - AI Agent Tool Invocation","AML.T0024 - Exfiltration via AI Inference API"],"date":"2026/07/28","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02406","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-02406-mcp-sequential-id-enumeration.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-02406-mcp-sequential-id-enumeration.yaml"},{"id":"ATR-2026-02407","title":"Agent Workspace Boundary Escape via Host-Root Mount and Unprivileged Namespace Escalation (CVE-2026-46331)","category":"privilege-escalation","subcategory":"sandbox-boundary-escape","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["CVE-2026-46331"],"owasp_agentic":["ASI06:2026","ASI04:2026"],"owasp_llm":["LLM06:2025","LLM02:2025"],"mitre_atlas":["AML.T0050 - Command and Scripting Interpreter","AML.T0053 - AI Agent Tool Invocation","AML.T0048 - External Harms"],"date":"2026/07/28","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02407","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-02407-agent-workspace-boundary-escape.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-02407-agent-workspace-boundary-escape.yaml"},{"id":"ATR-2026-02408","title":"Dataset / Model Loader Remote-Code Execution via Poisoned Dataset Artifact","category":"data-poisoning","subcategory":"dataset-loader-remote-code-execution","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"runtime","cves":[],"owasp_agentic":["ASI05:2026","ASI04:2026"],"owasp_llm":["LLM03:2025","LLM04:2025"],"mitre_atlas":["AML.T0010 - AI Supply Chain Compromise","AML.T0011 - User Execution","AML.T0050 - Command and Scripting Interpreter"],"date":"2026/07/28","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02408","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/data-poisoning/ATR-2026-02408-dataset-loader-code-execution.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/data-poisoning/ATR-2026-02408-dataset-loader-code-execution.yaml"},{"id":"ATR-2026-02409","title":"MCP 2026-07-28 Stateless Spec: Async Task Abuse and OAuth 2.1 Misuse","category":"excessive-autonomy","subcategory":"mcp-async-task-authority-abuse","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI03:2026","ASI09:2026","ASI02:2026"],"owasp_llm":["LLM06:2025","LLM01:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation","AML.T0098 - AI Agent Tool Credential Harvesting","AML.T0040 - AI Model Inference API Access"],"date":"2026/07/28","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02409","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-02409-mcp-async-task-abuse.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/excessive-autonomy/ATR-2026-02409-mcp-async-task-abuse.yaml"},{"id":"ATR-2026-02410","title":"Malicious Artifact Hosted on a Legitimate AI Vendor Domain (FakeAgent Delivery Chain)","category":"skill-compromise","subcategory":"vendor-domain-hosted-malicious-artifact","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"runtime","cves":[],"owasp_agentic":["ASI04:2026","ASI05:2026","ASI09:2026"],"owasp_llm":["LLM03:2025","LLM05:2025"],"mitre_atlas":["AML.T0010 - AI Supply Chain Compromise","AML.T0011 - User Execution","AML.T0047 - AI-Enabled Product or Service"],"date":"2026/07/28","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02410","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-02410-malicious-artifact-on-vendor-domain.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-02410-malicious-artifact-on-vendor-domain.yaml"},{"id":"ATR-2026-02411","title":"Targeted Stripping of C2PA / IPTC AI-Provenance Metadata from Generated Media","category":"model-abuse","subcategory":"ai-provenance-metadata-stripping","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI08:2026"],"owasp_llm":["LLM09:2025"],"mitre_atlas":["AML.T0054 - LLM Jailbreak"],"date":"2026/08/05","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02411","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-02411-ai-provenance-metadata-stripping.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/model-abuse/ATR-2026-02411-ai-provenance-metadata-stripping.yaml"},{"id":"ATR-2026-02412","title":"Generative Watermark Removal Tooling (SynthID / StableSignature / TreeRing / StegaStamp)","category":"model-abuse","subcategory":"generative-watermark-removal","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI08:2026"],"owasp_llm":["LLM09:2025"],"mitre_atlas":["AML.T0054 - LLM Jailbreak"],"date":"2026/08/05","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02412","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-02412-generative-watermark-removal-tooling.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/model-abuse/ATR-2026-02412-generative-watermark-removal-tooling.yaml"},{"id":"ATR-2026-02413","title":"AI Text Detection Evasion via Humanizer Services and Watermark-Scrubbing Paraphrase","category":"model-abuse","subcategory":"ai-text-detection-evasion","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI08:2026"],"owasp_llm":["LLM09:2025"],"mitre_atlas":["AML.T0054 - LLM Jailbreak"],"date":"2026/08/05","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02413","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-02413-ai-text-detection-evasion-humanizer.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/model-abuse/ATR-2026-02413-ai-text-detection-evasion-humanizer.yaml"},{"id":"ATR-2026-02500","title":"Prompt-Layer Self-Replication (Agent Worm Propagation Directive)","category":"prompt-injection","subcategory":"prompt-layer-self-replication","severity":"critical","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI02:2026"],"owasp_llm":["LLM01:2025","LLM05:2025"],"mitre_atlas":["AML.CS0024 - Morris II Worm: RAG-Based Attack","AML.T0051 - LLM Prompt Injection"],"date":"2026/08/19","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02500","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02500-prompt-layer-self-replication.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-02500-prompt-layer-self-replication.yaml"},{"id":"ATR-2026-02502","title":"Covert Remote-Script Injection into Agent-Generated Artifacts","category":"prompt-injection","subcategory":"generated-artifact-injection","severity":"high","status":"experimental","maturity":"experimental","lanes":["hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.CS0041 - Rules File Backdoor","AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026/08/11","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02502","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02502-covert-remote-script-injection-into-generated-artifacts.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-02502-covert-remote-script-injection-into-generated-artifacts.yaml"},{"id":"ATR-2026-02514","title":"MCP Server Descriptor URL Field Carries an HTML/Script Breakout Payload","category":"tool-poisoning","subcategory":"metadata-poisoning","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":["CVE-2026-44429"],"owasp_agentic":["ASI06:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0053 - LLM Plugin Compromise"],"date":"2026/08/23","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02514","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-02514-mcp-server-metadata-url-html-breakout.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-02514-mcp-server-metadata-url-html-breakout.yaml"},{"id":"ATR-2026-02525","title":"Shell Command-Word Reassembly via Parameter Expansion","category":"excessive-autonomy","subcategory":"command-safety-classifier-evasion","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["CVE-2026-29783"],"owasp_agentic":["ASI02:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0053 - LLM Plugin Compromise"],"date":"2026/08/23","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02525","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-02525-shell-command-word-reassembly-classifier-evasion.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/excessive-autonomy/ATR-2026-02525-shell-command-word-reassembly-classifier-evasion.yaml"},{"id":"ATR-2026-02528","title":"Option-Flag Smuggling in an LLM-Controlled Tool Parameter","category":"privilege-escalation","subcategory":"argument-injection","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["CVE-2026-48116"],"owasp_agentic":["ASI02:2026"],"owasp_llm":["LLM05:2025"],"mitre_atlas":["AML.T0053 - LLM Plugin Compromise","AML.T0051.001 - Indirect"],"date":"2026/08/23","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02528","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-02528-tool-parameter-option-flag-smuggling.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-02528-tool-parameter-option-flag-smuggling.yaml"},{"id":"ATR-2026-02530","title":"Git Configuration Turned Into an Execution Hook by an Agent","category":"privilege-escalation","subcategory":"vcs-config-execution-hook","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["CVE-2026-55607"],"owasp_agentic":["ASI04:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051.001 - Indirect"],"date":"2026/08/23","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02530","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-02530-git-config-execution-key-set-by-agent.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-02530-git-config-execution-key-set-by-agent.yaml"},{"id":"ATR-2026-02531","title":"Kusto Pipeline Injection Through a Table Identifier Parameter","category":"privilege-escalation","subcategory":"analytics-query-scope-escape","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["CVE-2026-33980"],"owasp_agentic":["ASI02:2026"],"owasp_llm":["LLM05:2025"],"mitre_atlas":["AML.T0051.001 - Indirect","AML.T0053 - LLM Plugin Compromise"],"date":"2026/08/23","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02531","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-02531-kusto-query-injection-outbound-reach.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-02531-kusto-query-injection-outbound-reach.yaml"},{"id":"ATR-2026-02542","title":"Observability Query Tool Argument Appends a Pipeline Stage and Comments Out the Rest of the Query","category":"tool-poisoning","subcategory":"pipeline-query-stage-injection","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI05:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0053 - LLM Plugin Compromise"],"date":"2026/08/23","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02542","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-02542-pipeline-query-stage-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-02542-pipeline-query-stage-injection.yaml"},{"id":"ATR-2026-02557","title":"Shell Command Separator Inside a Path-Typed MCP Tool Argument","category":"tool-poisoning","subcategory":"argument-injection-path-typed-parameter","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"tool_args","cves":["CVE-2026-25546"],"owasp_agentic":["ASI02:2026","ASI05:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0053 - LLM Plugin Compromise"],"date":"2026/08/23","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02557","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-02557-shell-separator-in-path-typed-tool-argument.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-02557-shell-separator-in-path-typed-tool-argument.yaml"},{"id":"ATR-2026-02570","title":"Wallet Secret Material (Seed Phrase / Private Key) Carried Inside an MCP Tool Payload","category":"context-exfiltration","subcategory":"wallet-secret-exfiltration","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0057 - LLM Data Leakage"],"date":"2026/08/23","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02570","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-02570-wallet-secret-material-in-agent-tool-payload.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-02570-wallet-secret-material-in-agent-tool-payload.yaml"},{"id":"ATR-2026-02600","title":"Reverse Shell Assembled In-Source (socket bound to an interactive shell)","category":"skill-compromise","subcategory":"reverse-shell","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["MAL-2025-191647"],"owasp_agentic":["ASI05:2026"],"owasp_llm":["LLM03:2025"],"mitre_atlas":["AML.T0010 - AI Supply Chain Compromise","AML.T0011 - User Execution"],"date":"2026/08/23","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02600","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-02600-in-source-reverse-shell-assembly.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-02600-in-source-reverse-shell-assembly.yaml"},{"id":"ATR-2026-02601","title":"Argument Injection: Execution-Bearing CLI Option Smuggled into a Tool Data Parameter","category":"privilege-escalation","subcategory":"argument-injection","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["CVE-2026-25130"],"owasp_agentic":["ASI03:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0053 - LLM Plugin Compromise","AML.T0051 - LLM Prompt Injection"],"date":"2026/08/23","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02601","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-02601-tool-argument-option-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-02601-tool-argument-option-injection.yaml"},{"id":"ATR-2026-02602","title":"Diagram Theme Config Used to Inject Page-Wide CSS (scope escape, overlay, selector exfil)","category":"context-exfiltration","subcategory":"rendered-output-injection","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["CVE-2026-41149"],"owasp_agentic":["ASI04:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.001 - Indirect"],"date":"2026/08/23","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02602","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-02602-diagram-theme-css-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-02602-diagram-theme-css-injection.yaml"},{"id":"ATR-2026-02608","title":"LLM-Generated Graph Query Reaching a Remote Endpoint (APOC remote script, raw-IP load, remote export)","category":"context-exfiltration","subcategory":"query-language-egress","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["GHSA-2pq5-3q89-j7cc"],"owasp_agentic":["ASI02:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0057 - LLM Data Leakage","AML.T0051 - LLM Prompt Injection"],"date":"2026/08/23","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02608","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-02608-graph-query-remote-egress.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-02608-graph-query-remote-egress.yaml"},{"id":"ATR-2026-02610","title":"Developer-Toolchain Config Evaluates a Command That Reads a Credential Store","category":"skill-compromise","subcategory":"evaluated-config-execution","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["CVE-2026-33646"],"owasp_agentic":["ASI05:2026"],"owasp_llm":["LLM03:2025"],"mitre_atlas":["AML.T0010 - AI Supply Chain Compromise","AML.T0011 - User Execution"],"date":"2026/08/23","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02610","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-02610-evaluated-config-credential-command.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-02610-evaluated-config-credential-command.yaml"},{"id":"ATR-2026-02620","title":"Code Execution via data: URI Module Specifier Handed to import()","category":"privilege-escalation","subcategory":"module-loader-execution","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["CVE-2025-67489"],"owasp_agentic":["ASI04:2026"],"owasp_llm":["LLM05:2025"],"mitre_atlas":["AML.T0053 - LLM Plugin Compromise","AML.T0011 - User Execution"],"date":"2026/08/23","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02620","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-02620-dynamic-import-data-uri-module.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-02620-dynamic-import-data-uri-module.yaml"},{"id":"ATR-2026-02621","title":"Prompt-Embedded Auto-Fetch Mention Pointed at an Internal Address","category":"context-exfiltration","subcategory":"prompt-mention-ssrf","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["CVE-2026-47395"],"owasp_agentic":["ASI05:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0057 - LLM Data Leakage"],"date":"2026/08/23","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02621","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-02621-prompt-mention-autofetch-internal-target.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-02621-prompt-mention-autofetch-internal-target.yaml"},{"id":"ATR-2026-02623","title":"Dangerous URI Scheme Obfuscated by Interstitial Characters","category":"context-exfiltration","subcategory":"sanitizer-evasion","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["CVE-2026-31807","CVE-2022-1243"],"owasp_agentic":["ASI04:2026"],"owasp_llm":["LLM05:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0057 - LLM Data Leakage"],"date":"2026/08/23","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02623","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-02623-obfuscated-uri-scheme-sanitizer-bypass.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-02623-obfuscated-uri-scheme-sanitizer-bypass.yaml"},{"id":"ATR-2026-02626","title":"Agent Writes a New MCP Server Into Its Own Trust Configuration","category":"privilege-escalation","subcategory":"mcp-trust-config-modification","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI05:2026","ASI06:2026"],"owasp_llm":["LLM03:2025"],"mitre_atlas":["AML.T0010 - AI Supply Chain Compromise","AML.T0053 - LLM Plugin Compromise"],"date":"2026/08/23","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02626","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-02626-agent-self-registers-mcp-server.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-02626-agent-self-registers-mcp-server.yaml"},{"id":"ATR-2026-02627","title":"Web Shell Written Into a Web-Served Directory","category":"privilege-escalation","subcategory":"web-shell-placement","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["CVE-2026-53593","CVE-2008-2742"],"owasp_agentic":["ASI04:2026","ASI06:2026"],"owasp_llm":["LLM05:2025"],"mitre_atlas":["AML.T0011 - User Execution","AML.T0053 - LLM Plugin Compromise"],"date":"2026/08/23","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02627","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-02627-web-shell-written-to-served-path.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-02627-web-shell-written-to-served-path.yaml"},{"id":"ATR-2026-02641","title":"Client-Supplied Approver Identity on an Approval Decision","category":"excessive-autonomy","subcategory":"approval-attribution-spoofing","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI06:2026","ASI03:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation"],"date":"2026/08/23","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02641","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-02641-client-supplied-approver-identity.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/excessive-autonomy/ATR-2026-02641-client-supplied-approver-identity.yaml"},{"id":"ATR-2026-02642","title":"Agent Configuration Tool Used to Disable the Agent's Own Guardrail","category":"privilege-escalation","subcategory":"guardrail-config-write","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["CVE-2026-45001"],"owasp_agentic":["ASI03:2026","ASI06:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation"],"date":"2026/08/23","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02642","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-02642-agent-config-tool-disables-own-guardrail.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-02642-agent-config-tool-disables-own-guardrail.yaml"},{"id":"ATR-2026-02644","title":"Image-Header Polyglot: Magic Bytes Adjacent to a Server-Side Script Payload","category":"privilege-escalation","subcategory":"content-type-polyglot","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["CVE-2025-55743","CVE-2008-2742"],"owasp_agentic":["ASI03:2026"],"owasp_llm":["LLM05:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation"],"date":"2026/08/23","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02644","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-02644-image-magic-polyglot-upload.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-02644-image-magic-polyglot-upload.yaml"},{"id":"ATR-2026-02648","title":"Write or Fetch Procedure Called Through a Read-Only Graph Query Tool","category":"privilege-escalation","subcategory":"query-language-readonly-bypass","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":["CVE-2026-35402"],"owasp_agentic":["ASI03:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation"],"date":"2026/08/23","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02648","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-02648-readonly-graph-tool-write-procedure.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-02648-readonly-graph-tool-write-procedure.yaml"},{"id":"ATR-2026-02649","title":"Vendor API Hostname Used as a Label Prefix of Another Domain","category":"context-exfiltration","subcategory":"hostname-authority-confusion","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI02:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0057 - LLM Data Leakage"],"date":"2026/08/23","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02649","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-02649-vendor-fqdn-label-prefix-confusion.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-02649-vendor-fqdn-label-prefix-confusion.yaml"},{"id":"ATR-2026-02662","title":"Pickle Payload Reaches an Execution Primitive Through an Indirect Name Resolver","category":"model-security","subcategory":"deserialization-gadget","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"runtime","cves":["CVE-2026-3490"],"owasp_agentic":["ASI04:2026","ASI05:2026"],"owasp_llm":["LLM03:2025","LLM05:2025"],"mitre_atlas":["AML.T0010 - AI Supply Chain Compromise"],"date":"2026/08/23","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02662","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-security/ATR-2026-02662-pickle-indirect-name-resolution-gadget.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/model-security/ATR-2026-02662-pickle-indirect-name-resolution-gadget.yaml"},{"id":"ATR-2026-02664","title":"Git Identifier Field Carries an Option or ext:: Transport Instead of a Revision","category":"privilege-escalation","subcategory":"git-argument-injection","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"runtime","cves":["CVE-2026-50014"],"owasp_agentic":["ASI05:2026","ASI04:2026"],"owasp_llm":["LLM05:2025"],"mitre_atlas":["AML.T0010 - AI Supply Chain Compromise"],"date":"2026/08/23","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02664","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-02664-git-identifier-field-option-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-02664-git-identifier-field-option-injection.yaml"},{"id":"ATR-2026-02666","title":"Trusted Hostname Parked in the URL Userinfo So the Real Host Is Whatever Follows the At-Sign","category":"tool-poisoning","subcategory":"url-userinfo-decoy","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"runtime","cves":["CVE-2025-47241"],"owasp_agentic":["ASI05:2026","ASI04:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0049 - Exploit Public-Facing Application"],"date":"2026/08/23","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02666","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-02666-url-userinfo-decoy-host-allowlist-bypass.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-02666-url-userinfo-decoy-host-allowlist-bypass.yaml"},{"id":"ATR-2026-02667","title":"Submitted Job Payload Carries Its Own Pre-Approved Tool List","category":"excessive-autonomy","subcategory":"preapproved-tool-list","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"runtime","cves":[],"owasp_agentic":["ASI02:2026","ASI06:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation"],"date":"2026/08/23","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02667","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-02667-preapproved-tool-list-in-job-payload.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/excessive-autonomy/ATR-2026-02667-preapproved-tool-list-in-job-payload.yaml"},{"id":"ATR-2026-02668","title":"Branch or Tag Ref Name Carrying Shell Command Substitution in Tool Output","category":"tool-poisoning","subcategory":"ref-name-command-injection","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"runtime","cves":["CVE-2026-27113"],"owasp_agentic":["ASI04:2026","ASI05:2026"],"owasp_llm":["LLM01:2025","LLM05:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/08/23","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02668","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-02668-vcs-ref-name-command-substitution.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-02668-vcs-ref-name-command-substitution.yaml"},{"id":"ATR-2026-02669","title":"Query-Language Pipeline Stage Smuggled Into an Identifier-Typed Tool Parameter","category":"tool-poisoning","subcategory":"query-language-injection","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"runtime","cves":[],"owasp_agentic":["ASI05:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation"],"date":"2026/08/23","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02669","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-02669-query-pipeline-stage-in-identifier-parameter.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-02669-query-pipeline-stage-in-identifier-parameter.yaml"},{"id":"ATR-2026-02681","title":"JavaScript Sandbox Escape by Acquiring the Function Constructor Reflectively","category":"privilege-escalation","subcategory":"js-sandbox-escape-reflective","severity":"critical","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"agent","cves":["CVE-2025-53626","CVE-2025-61927"],"owasp_agentic":["ASI05:2026","ASI04:2026"],"owasp_llm":["LLM05:2025","LLM06:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation"],"date":"2026/08/23","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02681","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-02681-reflective-function-constructor-sandbox-escape.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-02681-reflective-function-constructor-sandbox-escape.yaml"},{"id":"ATR-2026-02682","title":"XML/SVG Entity Expansion Bomb in Content Returned to an Agent","category":"tool-poisoning","subcategory":"xml-entity-expansion-bomb","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"agent","cves":["CVE-2026-25128"],"owasp_agentic":["ASI06:2026","ASI03:2026"],"owasp_llm":["LLM10:2025","LLM05:2025"],"mitre_atlas":["AML.T0029 - Denial of ML Service"],"date":"2026/08/23","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02682","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-02682-xml-entity-expansion-bomb.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-02682-xml-entity-expansion-bomb.yaml"},{"id":"ATR-2026-02683","title":"Agent Tool Data Argument Carries a Program-Executing CLI Option","category":"privilege-escalation","subcategory":"tool-argument-option-injection","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"agent","cves":["CVE-2026-48116"],"owasp_agentic":["ASI05:2026","ASI02:2026"],"owasp_llm":["LLM06:2025","LLM01:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation"],"date":"2026/08/23","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02683","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-02683-tool-argument-option-injection-executor-flag.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-02683-tool-argument-option-injection-executor-flag.yaml"},{"id":"ATR-2026-02684","title":"File-Tool Argument Targets a Modern Credential Store Outside the Classic Path List","category":"context-exfiltration","subcategory":"modern-credential-store-read","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"agent","cves":[],"owasp_agentic":["ASI04:2026","ASI05:2026"],"owasp_llm":["LLM02:2025","LLM06:2025"],"mitre_atlas":["AML.T0055 - Unsecured Credentials"],"date":"2026/08/23","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02684","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-02684-modern-credential-store-file-argument.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-02684-modern-credential-store-file-argument.yaml"},{"id":"ATR-2026-02700","title":"Percent-Encoded Path Traversal in an Agent File-Tool Argument","category":"privilege-escalation","subcategory":"encoded-path-traversal-tool-argument","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"runtime","cves":["CVE-2025-66689","CVE-2026-33344"],"owasp_agentic":["ASI02:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0053 - LLM Plugin Compromise"],"date":"2026/08/23","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02700","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-02700-percent-encoded-path-traversal-tool-argument.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-02700-percent-encoded-path-traversal-tool-argument.yaml"},{"id":"ATR-2026-02703","title":"Agent-Generated SQL Reaches Outside the Database via COPY TO PROGRAM or a Server-Side File Read","category":"context-exfiltration","subcategory":"sql-host-escape-primitive","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"runtime","cves":[],"owasp_agentic":["ASI05:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0057 - LLM Data Leakage"],"date":"2026/08/23","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02703","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-02703-sql-server-side-file-and-program-primitive.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-02703-sql-server-side-file-and-program-primitive.yaml"},{"id":"ATR-2026-02705","title":"Python Sandbox Escape by Recovering builtins from a Bound Method or Lambda","category":"privilege-escalation","subcategory":"python-sandbox-escape-builtins-leak","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"runtime","cves":[],"owasp_agentic":["ASI06:2026"],"owasp_llm":["LLM05:2025"],"mitre_atlas":["AML.T0050 - Command and Scripting Interpreter"],"date":"2026/08/23","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02705","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-02705-python-builtins-leak-and-prefix-check-override.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-02705-python-builtins-leak-and-prefix-check-override.yaml"},{"id":"ATR-2026-02707","title":"Mail or Attachment Tool Argument Splits into a New Header via Embedded CRLF","category":"tool-poisoning","subcategory":"crlf-header-injection-tool-argument","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"runtime","cves":["CVE-2026-30227"],"owasp_agentic":["ASI04:2026"],"owasp_llm":["LLM05:2025"],"mitre_atlas":["AML.T0053 - LLM Plugin Compromise"],"date":"2026/08/23","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02707","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-02707-crlf-header-injection-mail-tool-argument.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-02707-crlf-header-injection-mail-tool-argument.yaml"},{"id":"ATR-2026-02708","title":"Agent HTTP Request Claims a Loopback Origin While Targeting an External Host","category":"privilege-escalation","subcategory":"forged-loopback-origin-header","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"runtime","cves":["CVE-2026-61435"],"owasp_agentic":["ASI06:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0053 - LLM Plugin Compromise"],"date":"2026/08/23","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02708","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-02708-loopback-spoofed-host-header-external-request.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-02708-loopback-spoofed-host-header-external-request.yaml"},{"id":"ATR-2026-02815","title":"Indirect Injection: Agent-Directed Halt Order With Canned Substitute Reply (Task-Abort DoS)","category":"prompt-injection","subcategory":"task-abort-dos","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"content","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/08/24","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02815","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02815-injected-halt-order-canned-reply-dos.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-02815-injected-halt-order-canned-reply-dos.yaml"},{"id":"ATR-2026-02817","title":"Untrusted Tool Result Dictates a Tool Call by Schema Parameter Name","category":"tool-poisoning","subcategory":"dictated-tool-arguments","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"content","cves":[],"owasp_agentic":["ASI01:2026","ASI02:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0053 - LLM Plugin Compromise"],"date":"2026/08/24","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02817","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-02817-untrusted-content-dictates-tool-arguments.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-02817-untrusted-content-dictates-tool-arguments.yaml"},{"id":"ATR-2026-02818","title":"Installable Skill Manifest Self-Declares an Attack or Jailbreak Purpose","category":"skill-compromise","subcategory":"attack-declared-skill-manifest","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"skill","cves":[],"owasp_agentic":["ASI05:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0054 - LLM Jailbreak"],"date":"2026/08/24","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02818","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-02818-skill-manifest-declares-attack-purpose.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-02818-skill-manifest-declares-attack-purpose.yaml"},{"id":"ATR-2026-02820","title":"Tool Result Orders the Agent to Hide an Action It Just Performed From the User","category":"prompt-injection","subcategory":"audit-evasion","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI02:2026","ASI03:2026"],"owasp_llm":["LLM01:2025","LLM06:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/08/27","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02820","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02820-tool-result-orders-agent-to-hide-its-own-action.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-02820-tool-result-orders-agent-to-hide-its-own-action.yaml"},{"id":"ATR-2026-02845","title":"Cryptomining Payload Deployed Through an Agent Skill or Tool Call","category":"skill-compromise","subcategory":"cryptojacking","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI05:2026"],"owasp_llm":["LLM03:2025","LLM10:2025"],"mitre_atlas":["AML.T0010 - AI Supply Chain Compromise","AML.T0011 - User Execution"],"date":"2026/08/24","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02845","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-02845-agent-cryptomining-payload.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/skill-compromise/ATR-2026-02845-agent-cryptomining-payload.yaml"},{"id":"ATR-2026-02846","title":"Ignore-Previous-and-Following Instructions in User Input (PromptInject Goal Hijacking)","category":"prompt-injection","subcategory":null,"severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":null,"cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct"],"date":"2026/10/06","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02846","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02846-semantic-ignore-previous-and-following-instructio.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-02846-semantic-ignore-previous-and-following-instructio.yaml"},{"id":"ATR-2026-02847","title":"Policy-Justified Email Exfiltration Pretext Detection","category":"context-exfiltration","subcategory":"policy-justified-exfil-to-email","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI05:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/10/06","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02847","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-02847-policy-justified-exfil-to-email.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-02847-policy-justified-exfil-to-email.yaml"},{"id":"ATR-2026-02850","title":"Fake Documentation Pretext Data Exfiltration via Email","category":"context-exfiltration","subcategory":"fake-documentation-forward-request","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI09:2026"],"owasp_llm":["LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0057 - LLM Data Leakage"],"date":"2026/10/06","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02850","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-02850-fake-documentation-forward-request.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-02850-fake-documentation-forward-request.yaml"},{"id":"ATR-2026-02851","title":"Fake User-Turn Injection: Send Email Directive","category":"prompt-injection","subcategory":"fake-user-turn-send-email-instruction","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI05:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection"],"date":"2026/03/08","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02851","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02851-fake-user-turn-send-email-instruction.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-02851-fake-user-turn-send-email-instruction.yaml"},{"id":"ATR-2026-02855","title":"Cross-Email Context Exfiltration Relay Detection","category":"context-exfiltration","subcategory":"cross-email-exfil-relay","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI06:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0057 - LLM Data Leakage"],"date":"2026/03/08","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02855","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-02855-cross-email-exfil-relay.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-02855-cross-email-exfil-relay.yaml"},{"id":"ATR-2026-02858","title":"Context-Suppression Directive: Disregard All Other Context or Everything Said So Far","category":"prompt-injection","subcategory":"context-suppression","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct","AML.T0051.001 - Indirect"],"date":"2026/10/15","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02858","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02858-context-suppression-directive.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-02858-context-suppression-directive.yaml"},{"id":"ATR-2026-02859","title":"Agent Role Reassignment Arriving in Tool Output (\"You are now a ... bot\")","category":"prompt-injection","subcategory":"indirect-role-reassignment","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.001 - Indirect"],"date":"2026/10/15","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02859","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02859-tool-output-agent-role-reassignment.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-02859-tool-output-agent-role-reassignment.yaml"},{"id":"ATR-2026-02860","title":"Forged Instruction-Boundary Marker (\"##Begin New Instructions##\", \"%%% end previous instructions %%%\")","category":"prompt-injection","subcategory":"delimiter-injection","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.000 - Direct","AML.T0051.001 - Indirect"],"date":"2026/10/15","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02860","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02860-forged-instruction-boundary-marker.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-02860-forged-instruction-boundary-marker.yaml"},{"id":"ATR-2026-02861","title":"Injected Directive to Send Email with Attacker-Specified Body","category":"context-exfiltration","subcategory":"exfil-send-email-with-body-directive","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026","ASI02:2026"],"owasp_llm":["LLM01:2025","LLM02:2025"],"mitre_atlas":["AML.T0051.001 - Indirect","AML.T0057 - LLM Data Leakage"],"date":"2026/10/15","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02861","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-02861-exfil-send-email-with-body-directive.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-02861-exfil-send-email-with-body-directive.yaml"},{"id":"ATR-2026-02862","title":"Fake Chat-Template Turn Injection Detection","category":"prompt-injection","subcategory":"chat-template-turn-injection","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"mcp","cves":[],"owasp_agentic":["ASI01:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051 - LLM Prompt Injection","AML.T0051.001 - Indirect"],"date":"2026/10/15","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02862","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02862-fake-chat-template-turn-injection.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/prompt-injection/ATR-2026-02862-fake-chat-template-turn-injection.yaml"},{"id":"ATR-2026-02864","title":"Non-Canonical Numeric IPv4 Host in a URL-Typed Tool Argument (SSRF Filter Bypass)","category":"tool-poisoning","subcategory":"ssrf-encoded-ip-host","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"tool_args","cves":["CVE-2026-101883"],"owasp_agentic":["ASI02:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0049 - Exploit Public-Facing Application","AML.T0053 - AI Agent Tool Invocation"],"date":"2026/10/22","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02864","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-02864-non-canonical-ipv4-host-in-url-tool-argument.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-02864-non-canonical-ipv4-host-in-url-tool-argument.yaml"},{"id":"ATR-2026-02865","title":"Read-Only Allow-Listed Utility Invoked With a File-Write or State-Changing Option in a Command Argument","category":"tool-poisoning","subcategory":"read-only-utility-write-option","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"tool_args","cves":["CVE-2026-105789"],"owasp_agentic":["ASI02:2026","ASI05:2026","ASI04:2026"],"owasp_llm":["LLM06:2025","LLM03:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation"],"date":"2026/10/22","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02865","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-02865-read-only-utility-write-flag-in-command-argument.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-02865-read-only-utility-write-flag-in-command-argument.yaml"},{"id":"ATR-2026-02866","title":"Non-ASCII IDNA Label Separator Inside the Host of a Fetch-Tool URL Argument","category":"context-exfiltration","subcategory":"ssrf-idna-label-separator-host","severity":"medium","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"runtime","cves":["CVE-2026-107288"],"owasp_agentic":["ASI02:2026"],"owasp_llm":["LLM02:2025","LLM06:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation"],"date":"2026/10/22","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02866","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-02866-idna-label-separator-in-fetch-url-host.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/context-exfiltration/ATR-2026-02866-idna-label-separator-in-fetch-url-host.yaml"},{"id":"ATR-2026-02867","title":"Dot-Dot Path Segment Inside an Identifier-Typed Tool Argument (REST-Wrapper Path Traversal)","category":"privilege-escalation","subcategory":"identifier-argument-path-traversal","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"tool_args","cves":["CVE-2026-57496"],"owasp_agentic":["ASI03:2026","ASI02:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0053 - AI Agent Tool Invocation","AML.T0055 - Unsecured Credentials"],"date":"2026/10/22","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02867","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-02867-identifier-typed-tool-argument-dot-dot-path-segment.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/privilege-escalation/ATR-2026-02867-identifier-typed-tool-argument-dot-dot-path-segment.yaml"},{"id":"ATR-2026-02868","title":"SSRF via IPv6 Transition Address Embedding a Private IPv4 Target","category":"tool-poisoning","subcategory":"ssrf-ipv6-transition-address-bypass","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"tool_args","cves":["CVE-2026-55787"],"owasp_agentic":["ASI02:2026"],"owasp_llm":["LLM06:2025"],"mitre_atlas":["AML.T0049 - Exploit Public-Facing Application"],"date":"2026/10/22","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02868","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-02868-ssrf-ipv6-transition-address-embedded-private-ipv4.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-02868-ssrf-ipv6-transition-address-embedded-private-ipv4.yaml"},{"id":"ATR-2026-02870","title":"Invisible Unicode Control Before a Directive in a Tool Description or Skill File","category":"tool-poisoning","subcategory":"invisible-control-before-directive","severity":"high","status":"experimental","maturity":"test","lanes":["alert","hunt"],"scan_target":"both","cves":[],"owasp_agentic":["ASI01:2026","ASI04:2026"],"owasp_llm":["LLM01:2025"],"mitre_atlas":["AML.T0051.001 - LLM Prompt Injection: Indirect"],"date":"2026/10/24","last_modified":"2026-11-10","page_url":"https://agentthreatrule.org/en/rules/ATR-2026-02870","source_url":"https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-02870-invisible-control-before-directive.yaml","raw_url":"https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/rules/tool-poisoning/ATR-2026-02870-invisible-control-before-directive.yaml"}]}