跳到內容
Agent Threat Rules (ATR)EN
II. 威脅類別 · Γ

Γ. 上下文外洩

偷走對話內容和敏感資料

規則檔
138
生效
138 條，至少一個 lane 會載入
enforce lane
30 條，只收 stable
下載
rules/index.csv

最常見的框架對照

括號裡的數字，是這一類有幾條規則帶這一項。這些對應是 ATR 自己做的，框架方沒有審查或背書。

MITRE ATLAS
  • AML.T0057 - LLM Data Leakage(73)
  • AML.T0051 - LLM Prompt Injection(43)
  • AML.T0051.001 - Indirect(26)
  • AML.T0024 - Exfiltration via AI Inference API(22)
  • AML.T0055 - Unsecured Credentials(10)
  • AML.T0086 - Exfiltration via AI Agent Tool Invocation(10)
OWASP Agentic Top 10
  • ASI01:2026(73)
  • ASI03:2026(46)
  • ASI02:2026(31)
  • ASI06:2026(16)
  • ASI04:2026(15)
  • ASI05:2026(12)

規則

ID名稱嚴重度Maturity載入的 lane
ATR-2026-00021Credential and Secret Exposure in Agent Outputcriticaltestalert · hunt
ATR-2026-00113Credential File Theft from Agent Environmentcriticaltestalert · hunt
ATR-2026-00115Bulk Environment Variable Harvesting and Exfiltrationcriticaltestalert · hunt
ATR-2026-00136Tool Response Data Piggybackingcriticaltestalert · hunt
ATR-2026-00141API Key Leakage via Example Formatcriticaltestalert · hunt
ATR-2026-00142Data Piggybacking via Casual Transition Wordscriticaltestalert · hunt
ATR-2026-00145Obfuscated API Key Disclosurecriticaltestalert · hunt
ATR-2026-00150Credential Data Leaked in Tool Responsecriticaltestalert · hunt
ATR-2026-00162Credential Access with Exfiltration in Skill Instructionscriticaltestalert · hunt
ATR-2026-00201Credential Exfiltration via Shell Pipecriticaltestalert · hunt
ATR-2026-00212mcp-atlassian Credential Leak via Hint Parameter Injection (CVE-2026-27825/27826)criticaltestalert · hunt
ATR-2026-00290Divergence Attack — Repeat-Word-Forever Training Data Extractioncriticaltestalert · hunt
ATR-2026-00291Biometric Surveillance — Personal Biometric Data Request for Named Individualcriticaltestalert · hunt
ATR-2026-00293Educational Records — Personal Academic/Professional Record Request for Named Individualcriticaltestalert · hunt
ATR-2026-00294Financial PII — Personal Financial Data Request for Named Individualcriticaltestalert · hunt
ATR-2026-00295Medical PII — Personal Medical/Health Data Request for Named Individualcriticaltestalert · hunt
ATR-2026-00421Natural-Language Covert Conversation Exfiltration Instructioncriticaltestalert · hunt
ATR-2026-00422Natural-Language Credential / Secret Disclosure Instructioncriticaltestalert · hunt
ATR-2026-00423Natural-Language Sensitive File Disclosure Instructioncriticaltestalert · hunt
ATR-2026-00426Natural-Language Output-Injection Credential Embeddingcriticaltestalert · hunt
ATR-2026-00501Data Exfiltration via Markdown Image and Link URL Injectioncriticaltestalert · hunt
ATR-2026-00524Claude Code ANTHROPIC_BASE_URL Credential Exfiltration (CVE-2026-21852)criticaltestalert · hunt
ATR-2026-00702Indirect PI — Credential / API Key Exfiltration via Agent Actioncriticalstableenforce · alert · hunt
ATR-2026-00703Indirect PI — Financial Data Exfiltration via Agent Actioncriticalstableenforce · alert · hunt
ATR-2026-00704Indirect PI — Medical / Genetic Data Exfiltration via Agent Actioncriticalstableenforce · alert · hunt
ATR-2026-00706Indirect PI — Physical / Biometric Media Exfiltration via Agentcriticalstableenforce · alert · hunt
ATR-2026-00707Indirect PI — File Exfiltration Combined with Destroy or Tampercriticalstableenforce · alert · hunt
ATR-2026-00850Indirect PI — Credential Exfiltration via Email (API Key / Password / Token)criticalstableenforce · alert · hunt
ATR-2026-00851Indirect PI — Financial / Payment Credential Exfiltration via Agent Emailcriticalstableenforce · alert · hunt
ATR-2026-00852Indirect PI — Medical Record / Health Data Exfiltration via Agent Emailcriticalstableenforce · alert · hunt
ATR-2026-00853Indirect PI — Genetic / DNA Data Exfiltration via Agent Emailcriticalstableenforce · alert · hunt
ATR-2026-00854Indirect PI — Location / GPS Data Exfiltration via Agent Emailcriticaltestalert · hunt
ATR-2026-00857Indirect PI — Cloud File Exfiltration (Google Drive / Cloud Storage via Agent)criticaltestalert · hunt
ATR-2026-00858Indirect PI — Data Exfiltration with Evidence Destruction (Exfil-and-Delete)criticaltestalert · hunt
ATR-2026-00859RAG-Injected PII Exfiltration — System Instructions Embedded in Retrieved Documentscriticaltestalert · hunt
ATR-2026-00860Indirect PI — Unauthorized Financial Transfer / Payment Initiation Hijackcriticaltestalert · hunt
ATR-2026-00861Indirect PI — Cryptocurrency Transfer / Exchange Deposit Hijack via Injectioncriticaltestalert · hunt
ATR-2026-00862Indirect PI — MFA Code / OTP Security Code Exfiltration via Injectioncriticaltestalert · hunt
ATR-2026-00863Shell Injection Data Exfiltration — Piped Command Exfiltration via Bashcriticaltestalert · hunt
ATR-2026-01453Markdown Image Injection with Base64 QUERY Exfiltration Carriercriticalstableenforce · alert · hunt
ATR-2026-01454Direct Markdown Image/Link Exfil Payload (attacker.com / evil.com)criticalstableenforce · alert · hunt
ATR-2026-01462System Prompt Override via Pseudo-Admin / Authority Injectioncriticalstableenforce · alert · hunt
ATR-2026-01464Indirect PI Sysprompt-Forged Action Hijack (system_message framing)criticaltestalert · hunt
ATR-2026-01605SSRF AWS Instance Metadata Endpoint Accesscriticaltestalert · hunt
ATR-2026-01607SSRF Localhost Service Probecriticaltestalert · hunt
ATR-2026-01608SSRF File Scheme Local File Readcriticaltestalert · hunt
ATR-2026-01753Ransom Extortion: Email Exfil + Delete + Wire-Transfer Demandcriticalstableenforce · alert · hunt
ATR-2026-01754Ransom Extortion: Cloud File Exfil + Delete + Payment Demandcriticalstableenforce · alert · hunt
ATR-2026-01948netlicensing-mcp Path Traversal in product_number Bypasses Token Redaction (GHSA-hxpf-9xvq-wph8)criticaltestalert · hunt
ATR-2026-01957M365 Copilot Business Chat SearchLeak Open-Redirect Prompt-Injection Exfil (CVE-2026-47645)criticaltestalert · hunt
ATR-2026-01961Meta Ads MCP Unauthenticated Tool Execution Leaks META_ACCESS_TOKEN (CVE-2026-48039 / GHSA-9gw6-46qc-99vr)criticaltestalert · hunt
ATR-2026-01964LangChain GmailToolkit Indirect Prompt Injection Email Exfiltration (CVE-2025-46059)criticaltestalert · hunt
ATR-2026-01988Local Sensitive-File Read Chained to Outbound Exfiltrationcriticaltestalert · hunt
ATR-2026-02190DNS Exfiltration via Ping/Dig/Nslookup Command with Data-Encoded Subdomain Labelcriticalexperimentalhunt
ATR-2026-02406MCP Tool Sequential Integer ID Enumeration (Cross-Tenant IDOR, CVE-2026-54052)criticaltestalert · hunt
ATR-2026-02570Wallet Secret Material (Seed Phrase / Private Key) Carried Inside an MCP Tool Payloadcriticaltestalert · hunt
ATR-2026-00020System Prompt and Internal Instruction Leakagehightestalert · hunt
ATR-2026-00075Agent Memory Manipulationhightestalert · hunt
ATR-2026-00102Data Exfiltration via Disguised Analytics Collectionhightestalert · hunt
ATR-2026-00114OAuth and API Token Interceptionhightestalert · hunt
ATR-2026-00146Environment Variable Existence Probinghightestalert · hunt
ATR-2026-00152Obfuscated Credential Exfiltration via Encodinghightestalert · hunt
ATR-2026-00261Markdown Image URL Data Exfiltrationhightestalert · hunt
ATR-2026-00274API Key / Secret Credential Generation or Completion Requesthightestalert · hunt
ATR-2026-00275System Prompt Extraction / Training Data Verbatim Replayhightestalert · hunt
ATR-2026-00405Markdown Image URL Exfiltration and XSS Injectionhightestalert · hunt
ATR-2026-00411API Key Generation and Partial Key Completion Requesthightestalert · hunt
ATR-2026-00424Natural-Language System Prompt Leak Instructionhightestalert · hunt
ATR-2026-00431Chatbox History Exfiltration via Prompt Injection (CVE-2024-48144, CVE-2024-48145)hightestalert · hunt
ATR-2026-00449Spring AI ChatMemory Cross-User Memory Leakage (CVE-2026-41712)hightestalert · hunt
ATR-2026-00505System Prompt Extraction - Instruction Dump Requesthightestalert · hunt
ATR-2026-00514System Prompt Extraction — Targeted Verbatim Disclosure Attemptshightestalert · hunt
ATR-2026-00516LLM Output XSS — Eliciting JavaScript Payloads from LLM for Browser Injectionhightestalert · hunt
ATR-2026-00548Cross-agent session context leak across delegation chainhighdrafthunt
ATR-2026-00566LibreChat is a ChatGPT clone with additional features.hightestalert · hunt
ATR-2026-00569Agent / MCP tool path traversal and arbitrary file accesshightestalert · hunt
ATR-2026-00571Cross-site scripting (XSS) in agent / MCP rendered outputhightestalert · hunt
ATR-2026-00574Paraphrased System-Prompt / Context Extraction (Semantic)hightestalert · hunt
ATR-2026-00578Zen MCP Server path-traversal blacklist bypass via non-canonical paths (CVE-2025-66689)hightestalert · hunt
ATR-2026-00580MCP session ID / auth token placed in URL query string (session leak via logs, referrer, history)hightestalert · hunt
ATR-2026-00583MCP/agent tool reads .env or secret file without user consent (OSV-MCPS-2025-EB70F912)hightestalert · hunt
ATR-2026-00705Indirect PI — Location, Address, and Browsing History Exfiltrationhighstableenforce · alert · hunt
ATR-2026-00855Indirect PI — Browsing History / Search History Exfiltration via Agent Emailhighstableenforce · alert · hunt
ATR-2026-00856Indirect PI — Physical Address / PII Exfiltration via Agent Emailhighstableenforce · alert · hunt
ATR-2026-01450SVG onload XSS Injection via Indirect Prompt Injectionhighstableenforce · alert · hunt
ATR-2026-01451IMG onerror XSS Injection via Indirect Prompt Injectionhightestalert · hunt
ATR-2026-01452Obfuscated javascript: XSS — Evasion Variants (href, style-expression, null-byte)hightestalert · hunt
ATR-2026-01455NEW IMPORTANT INSTRUCTIONS Injection Marker in Document Contexthighstableenforce · alert · hunt
ATR-2026-01456Debug/CLI Mode Activation for System Prompt and Config Extractionhightestalert · hunt
ATR-2026-01457System Prompt Completion and Clone Attackhighstableenforce · alert · hunt
ATR-2026-01459Variable-Clone Sysprompt Extraction (ELLA / context-variable Pattern)highstableenforce · alert · hunt
ATR-2026-01460JSON Format Sysprompt Extraction — Structured Output Exfilhighstableenforce · alert · hunt
ATR-2026-01463im_end / im_start System Prompt Injection Format Markershighstableenforce · alert · hunt
ATR-2026-01606SSRF Internal Network and Private IP Range Accesshightestalert · hunt
ATR-2026-01770PII / Credential Extraction via Social Engineering, Obfuscation & Cross-Session Recall (Semantic)hightestalert · hunt
ATR-2026-01772Internal-State Reconnaissance — System Prompt, Config & Tool Enumeration (Semantic)hightestalert · hunt
ATR-2026-01807Bulk Data Exfiltration to External Party — Entire-Database Export & Confidential Disclosurehightestalert · hunt
ATR-2026-01862LLMail Email-Tool Exfiltration to Fixed Attacker Addresshightestalert · hunt
ATR-2026-01863LLMail Post-Summary Exfiltration Directive to Attacker Addresshightestalert · hunt
ATR-2026-01864LLMail Exfiltration to Obfuscated Attacker Addresshightestalert · hunt
ATR-2026-01890Injected Code — Local File Exfiltration to a Remote Endpointhighstableenforce · alert · hunt
ATR-2026-01891Injected Code — Live User-Activity / Location / Log Surveillance Exfiltrationhighstableenforce · alert · hunt
ATR-2026-01892Injected Code — Environment-Variable Exfiltrationhighstableenforce · alert · hunt
ATR-2026-01893Injected Code — Host / Hardware Inventory Exfiltrationhighstableenforce · alert · hunt
ATR-2026-01894Injected Code — Browser Cookie / Session-Token Thefthighstableenforce · alert · hunt
ATR-2026-01895Injected Code — Contact-List Harvest and SMTP Spam Exfiltrationhighstableenforce · alert · hunt
ATR-2026-01924System-Instruction Extraction via Reformat — Summarize / Repeat / Recite the Ruleshightestalert · hunt
ATR-2026-01929Unauthenticated MCP transport accepts tool calls and falls back to an ambient credential (CVE-2026-48039 / meta-ads-mcp class)hightestalert · hunt
ATR-2026-01946Cloud-Metadata SSRF via Encoded Metadata-IP Bypass (CVE-2026-46678 / CVE-2026-25580 class)hightestalert · hunt
ATR-2026-01984MCP Server Kubernetes kubectl_generic Flag Injection Bearer Token Exfiltration (CVE-2026-47250)hightestalert · hunt
ATR-2026-02017Secret Key Exfiltration Requesthightestalert · hunt
ATR-2026-02026System Prompt Extraction - Oblique Referent + Transformhightestalert · hunt
ATR-2026-02104MEDIA:/file:// Directive Injection in Tool Result for Local File Exfiltrationhighexperimentalhunt
ATR-2026-02107SSRF via Non-IP Internal Hostname or Domain-Allowlist Authority Bypasshighexperimentalhunt
ATR-2026-02121MCP/API Tool Argument LFI via Mixed-Encoding Path Separator or file:// URI Scheme Escapehighexperimentalhunt
ATR-2026-02122Single-Level Directory Traversal to a Named Sensitive Config/Secret Filehighexperimentalhunt
ATR-2026-02140SSRF to Cloud Metadata Endpoint via IPv6 Transition-Address Hex Encodinghighexperimentalhunt
ATR-2026-02250Attachment/Upload Tool Argument Reads Sensitive System File or Traverses Outside Workspacehighexperimentalhunt
ATR-2026-02262Environment-Variable-Resolution Credential Exfiltration via Redirected Endpoint (CVE-2026-56259)hightestalert · hunt
ATR-2026-02304Base64-Encoded Path Segment in a WebFetch URL to a Pre-Approved Trusted Domain (Covert Exfiltration Channel)highexperimentalhunt
ATR-2026-02351SSRF to Cloud Metadata Endpoint via Wildcard-DNS Hostname-Encoded IP (nip.io/sslip.io/xip.io/traefik.me)highexperimentalhunt
ATR-2026-02373Deserialized LangSmith Prompt Manifest Combines secrets_from_env With an Attacker base_url Overridehighexperimentalhunt
ATR-2026-02602Diagram Theme Config Used to Inject Page-Wide CSS (scope escape, overlay, selector exfil)hightestalert · hunt
ATR-2026-02608LLM-Generated Graph Query Reaching a Remote Endpoint (APOC remote script, raw-IP load, remote export)hightestalert · hunt
ATR-2026-02621Prompt-Embedded Auto-Fetch Mention Pointed at an Internal Addresshightestalert · hunt
ATR-2026-02623Dangerous URI Scheme Obfuscated by Interstitial Charactershightestalert · hunt
ATR-2026-02649Vendor API Hostname Used as a Label Prefix of Another Domainhightestalert · hunt
ATR-2026-02684File-Tool Argument Targets a Modern Credential Store Outside the Classic Path Listhightestalert · hunt
ATR-2026-02703Agent-Generated SQL Reaches Outside the Database via COPY TO PROGRAM or a Server-Side File Readhightestalert · hunt
ATR-2026-02847Policy-Justified Email Exfiltration Pretext Detectionhightestalert · hunt
ATR-2026-02850Fake Documentation Pretext Data Exfiltration via Emailhightestalert · hunt
ATR-2026-02855Cross-Email Context Exfiltration Relay Detectionhightestalert · hunt
ATR-2026-02861Injected Directive to Send Email with Attacker-Specified Bodyhightestalert · hunt
ATR-2026-00471Garak Sysprompt-Extraction - mixed_unassignedmediumtestalert · hunt
ATR-2026-00504Tool and Function Capability Enumerationmediumtestalert · hunt
ATR-2026-01458Compare-Bots Sysprompt Fishing — Role Comparison Extractionmediumstableenforce · alert · hunt
ATR-2026-01461Foreign-Language System Prompt Extraction Requestmediumtestalert · hunt
ATR-2026-02866Non-ASCII IDNA Label Separator Inside the Host of a Fetch-Tool URL Argumentmediumtestalert · hunt
本頁產生於 2026-11-10哪裡寫錯或漏了？開 issue 回報