跳到內容
Agent Threat Rules (ATR)EN
II. 威脅類別 · Α

Α. 提示注入

用特製的輸入挾持 agent，讓它照攻擊者的意思做事

規則檔
258
生效
253 條，至少一個 lane 會載入
enforce lane
35 條，只收 stable
下載
rules/index.csv

最常見的框架對照

括號裡的數字，是這一類有幾條規則帶這一項。這些對應是 ATR 自己做的，框架方沒有審查或背書。

MITRE ATLAS
  • AML.T0051 - LLM Prompt Injection(207)
  • AML.T0054 - LLM Jailbreak(70)
  • AML.T0051.000 - Direct(69)
  • AML.T0051.001 - Indirect(24)
  • AML.T0051(14)
  • AML.T0054(8)
OWASP Agentic Top 10
  • ASI01:2026(251)
  • ASI06:2026(12)
  • ASI04:2026(12)
  • ASI05:2026(8)
  • ASI03:2026(5)
  • ASI02:2026(5)

規則

ID名稱嚴重度Maturity載入的 lane
ATR-2026-00004System Prompt Override Attemptcriticaltestalert · hunt
ATR-2026-00081Semantic Evasion via Multi-Turn Prompt Injectioncriticaltestalert · hunt
ATR-2026-00091Advanced Structured Data Injection with Nested Payloadscriticaltestalert · hunt
ATR-2026-00092Multi-Agent Consensus Poisoning and Sybil Attackcriticaltestalert · hunt
ATR-2026-00093Gradual Capability Escalation via Incremental Introductioncriticaltestalert · hunt
ATR-2026-00094Systematic Multi-Layer Audit System Bypasscriticaltestalert · hunt
ATR-2026-00097CJK Prompt Injection - Expanded Chinese/Japanese/Korean Patternscriticaltestalert · hunt
ATR-2026-00104Persona Hijacking via Mandatory System Prompt Overridecriticaltestalert · hunt
ATR-2026-00153Tool with embedded instruction to bypass user confirmation and exfiltrate datacriticaltestalert · hunt
ATR-2026-00280Policy Puppetry / XML Role-Config Injectioncriticaltestalert · hunt
ATR-2026-00296Shell Command Injection via LLM Promptcriticaltestalert · hunt
ATR-2026-00297Python Code Execution / Remote Code Execution via LLM Promptcriticaltestalert · hunt
ATR-2026-00312Unicode Variation Selector ASCII Smugglingcriticaltestalert · hunt
ATR-2026-00313SneakyBits Zero-Width Binary Steganographycriticaltestalert · hunt
ATR-2026-00321Hyphenated System Instruction Injectioncriticaltestalert · hunt
ATR-2026-00359Bank Phishing SMTP Email Code Generationcriticaltestalert · hunt
ATR-2026-00395LLM Special Token Boundary Injectioncriticaltestalert · hunt
ATR-2026-00503Fake Error State Takeover - Unrestricted Replacement Botcriticaltestalert · hunt
ATR-2026-00510Delayed Tool Invocation via Prompt Injection (Time-Shifted Execution)criticaltestalert · hunt
ATR-2026-00511MCP Web-Fetch Context Poisoning via Embedded Agent Instructionscriticalstableenforce · alert · hunt
ATR-2026-00512Rules-File Backdoor — Supply Chain Attack on AI Coding Assistant Configurationcriticalstableenforce · alert · hunt
ATR-2026-00535Windsurf IDE Zero-Click Prompt Injection via Embedded File Directives (CVE-2026-30615)criticaltestalert · hunt
ATR-2026-00550Privileged tool call following untrusted retrieval (indirect prompt injection trail)criticaldrafthunt
ATR-2026-00565The llm CLI tool thru 0.27.1 contains a critical code injection vulnerability via its --functions command-linecriticaltestalert · hunt
ATR-2026-00700Indirect PI — Structured-Data Embedded Payload (IMPORTANT!!! Override)criticalstableenforce · alert · hunt
ATR-2026-01000Context-Ignore via Fake Completion Prefixcriticalstableenforce · alert · hunt
ATR-2026-01018Evasion: Shell Injection via eval/system/backtick in Inputcriticaltestalert · hunt
ATR-2026-01019System Prompt Override via Fake Diagnostic/Admin Modecriticalstableenforce · alert · hunt
ATR-2026-01304Indirect Prompt Injection via Data Carrier — IMPORTANT Overridecriticalstableenforce · alert · hunt
ATR-2026-02374ROT13/Base64-Obfuscated Shell Payload Wrapped in a Fake-Sandbox Jailbreak Templatecriticalexperimentalhunt
ATR-2026-02500Prompt-Layer Self-Replication (Agent Worm Propagation Directive)criticalexperimentalhunt
ATR-2026-00001Direct Prompt Injection via User Inputhightestalert · hunt
ATR-2026-00002Indirect Prompt Injection via External Contenthightestalert · hunt
ATR-2026-00003Jailbreak Attempt Detectionhightestalert · hunt
ATR-2026-00080Encoding-Based Prompt Injection Evasionhightestalert · hunt
ATR-2026-00082Behavioral Fingerprint Detection Evasionhightestalert · hunt
ATR-2026-00083Indirect Prompt Injection via Tool Responseshightest無，不生效
ATR-2026-00084Structured Data Injection via JSON/CSV Payloadshightest無，不生效
ATR-2026-00085Multi-Layer Security Audit Evasionhightestalert · hunt
ATR-2026-00086Visual Spoofing via RTL Override, Punycode, and Homoglyph Injectionhightestalert · hunt
ATR-2026-00088Adaptive Countermeasure Against Behavioral Monitoringhightestalert · hunt
ATR-2026-00089Polymorphic Skill and Capability Aliasing Attackhightestalert · hunt
ATR-2026-00090Threat Intelligence Exfiltration and Rule Enumerationhightestalert · hunt
ATR-2026-00130Indirect Authority Claim in External Contenthightestalert · hunt
ATR-2026-00133Paraphrased Prompt Injectionhightestalert · hunt
ATR-2026-00137Authority Claim Prompt Injectionhightestalert · hunt
ATR-2026-00138Fictional Framing Safety Bypasshightestalert · hunt
ATR-2026-00140Indirect Reference Instruction Reversalhightestalert · hunt
ATR-2026-00148Multilingual Prompt Injection via Language Switchhightestalert · hunt
ATR-2026-00154Unauthorized Background Task Execution via Cron Job Installationhightestalert · hunt
ATR-2026-00155Hidden LLM Instructions in Skill Descriptionshightestalert · hunt
ATR-2026-00156SSH Remote Command Execution with Credential Exposurehightestalert · hunt
ATR-2026-00163Hidden Override Instructions in Skill Contenthightestalert · hunt
ATR-2026-00202Encoding Evasion via Homoglyphs and Synonym Substitutionhightestalert · hunt
ATR-2026-00203Context Pollution in Skill Descriptionshighstableenforce · alert · hunt
ATR-2026-00206Hidden System Instructions with Priority Override Blockshightestalert · hunt
ATR-2026-00207Hidden System Instructions with Permission Overridehightestalert · hunt
ATR-2026-00211System Prompt Override via Translation Context Injectionhightestalert · hunt
ATR-2026-00213System Prompt Override Injection via MCP Toolhightestalert · hunt
ATR-2026-00226AI Identity Substitution Jailbreakhightestalert · hunt
ATR-2026-00227Historical AI Persona Jailbreak with Compliance Enforcementhightestalert · hunt
ATR-2026-00228Structured Dual-Response Jailbreak with Command Systemhightestalert · hunt
ATR-2026-00229Roleplay-Based Policy Bypass Jailbreakhightestalert · hunt
ATR-2026-00230Persona-Based Moral Constraint Removal Jailbreakhightestalert · hunt
ATR-2026-00231AI Identity Substitution Jailbreakhightestalert · hunt
ATR-2026-00233Structured Dual-Response Jailbreak with Command Systemhightest無，不生效
ATR-2026-00234Roleplay-Based Policy Bypass Jailbreakhightestalert · hunt
ATR-2026-00235Persona-Based Moral Constraint Removal Jailbreakhightest無，不生效
ATR-2026-00236Pseudo-Code Structured Programming Jailbreak Attackhightestalert · hunt
ATR-2026-00237Dual-Response Jailbreak with Persona Commandshightestalert · hunt
ATR-2026-00238AI Identity Denial and Persona Replacement Attackhightestalert · hunt
ATR-2026-00239Amoral Persona Assignment with Obsessive Character Traitshightestalert · hunt
ATR-2026-00240Previous Instruction Nullification and Identity Replacement Jailbreakhightestalert · hunt
ATR-2026-00241Detailed Amoral Character Roleplay Jailbreakhightestalert · hunt
ATR-2026-00242Dual-Response Persona Jailbreak with Emoji Formattinghightestalert · hunt
ATR-2026-00243Acronym-Based Identity Override Jailbreakhightestalert · hunt
ATR-2026-00244Dual-Response Persona Jailbreakhightestalert · hunt
ATR-2026-00245Malicious Persona Creation for Safety Bypasshightestalert · hunt
ATR-2026-00247Matrix-Themed Dual Response Jailbreakhightestalert · hunt
ATR-2026-00249Text-Based Game Jailbreak with Entity Creationhightestalert · hunt
ATR-2026-00251Embodiment Mechanism Jailbreak with Totalitarian Control Claimshightestalert · hunt
ATR-2026-00252Narrative Jailbreak with Dual Response Formattinghightestalert · hunt
ATR-2026-00253Enhanced AIM Jailbreak with Persona Definition and Refusal Suppressionhightestalert · hunt
ATR-2026-00256Base-N Encoding Instruction Bypasshightestalert · hunt
ATR-2026-00257Cipher and Transposition Encoding Jailbreakhightestalert · hunt
ATR-2026-00258Invisible Unicode Tag Character Injectionhightestalert · hunt
ATR-2026-00264Latent Injection in Translation Contexthightestalert · hunt
ATR-2026-00265Latent Injection in Retrieved Document / RAG Contexthightestalert · hunt
ATR-2026-00267GCG Adversarial Suffix Attackhightestalert · hunt
ATR-2026-00272Hypothetical Response / Function Masking Token Smugglinghightestalert · hunt
ATR-2026-00276Invisible Unicode / BiDi Control Character Injectionhightestalert · hunt
ATR-2026-00278DRA Disguise and Reconstruction Attackhightestalert · hunt
ATR-2026-00282Perez-Style Direct Prompt Injection Hijackinghightestalert · hunt
ATR-2026-00285Alternate Encoding Jailbreak — Morse, NATO, Zalgo, Leet, UU, QP, Braillehightestalert · hunt
ATR-2026-00286Latent Prompt Injection via Embedded Document or Report Contexthightestalert · hunt
ATR-2026-00308Zalgo Combining-Diacritic Overload Encodinghightestalert · hunt
ATR-2026-00309Braille Unicode Encoded Prompt Injectionhightestalert · hunt
ATR-2026-00310Ecoji Emoji-Encoded Prompt Injectionhightestalert · hunt
ATR-2026-00311Base2048 Unicode Script Encoded Prompt Injectionhightestalert · hunt
ATR-2026-00315SATA Masked Language Model [MASK] Substitution Jailbreakhightestalert · hunt
ATR-2026-00316FunctionMasking predict_mask Semantic Bypasshightestalert · hunt
ATR-2026-00367Emoji Flag Regional-Indicator Encoded Hidden Phrasehightestalert · hunt
ATR-2026-00373Piracy Torrent Site List Requesthightestalert · hunt
ATR-2026-00378ChatGPT DOM JavaScript Redirect and UI Spoofing Injectionhightestalert · hunt
ATR-2026-00382Cocaine Component Development Requesthightestalert · hunt
ATR-2026-00390Discord Quote-Format Explicit Sexual Content Poem Injectionhightestalert · hunt
ATR-2026-00394Backspace Deletion Character Injectionhightestalert · hunt
ATR-2026-00396Toxic Continuation Prefix Injectionhightestalert · hunt
ATR-2026-00399Latent Injection Document Separator Tokenhightestalert · hunt
ATR-2026-00400Latent Injection Ignore-Instruction Keywordhightestalert · hunt
ATR-2026-00407ECHO Admin Command / SQL Injection / Jinja SSTI Template Injectionhightestalert · hunt
ATR-2026-00408DRA Parenthesis Character Reconstruction Attackhightestalert · hunt
ATR-2026-00409Phrasing Past/Future-Tense Harmful Query Bypasshightestalert · hunt
ATR-2026-00412FigStep Image-List Multimodal Jailbreak Text Patternhightestalert · hunt
ATR-2026-00420Microsoft Copilot Studio SharePoint Indirect Prompt Injection (CVE-2026-21520)hightestalert · hunt
ATR-2026-00453Secret Key Reveal Demand in User Inputhighstableenforce · alert · hunt
ATR-2026-00473Harm Solicitation - Interpersonal Violence and Intimidation Requestshightestalert · hunt
ATR-2026-00475XSS Web Injection - Script Tag with JavaScript Alert Payloadhightestalert · hunt
ATR-2026-00476XSS Web Injection - HTML Event Handler and Expression with JavaScript Alerthightestalert · hunt
ATR-2026-00482Harm Solicitation - Genital Insults and Intimidation Tactics Requestshightestalert · hunt
ATR-2026-00488Encoding Obfuscation - Script Tag XSS with Encoded Protocol Prefixhightestalert · hunt
ATR-2026-00489Encoding Obfuscation - HTML Event Handler XSS with Encoded Whitespacehightestalert · hunt
ATR-2026-00490DAN Persona Jailbreak - Absolute Obedience Character Framinghightestalert · hunt
ATR-2026-00492DAN Persona Jailbreak - Role Lock with Exclusive Response Filterhighexperimentalhunt
ATR-2026-00493Latent Injection via WHOIS Domain Record Datahightestalert · hunt
ATR-2026-00495DAN Jailbreak - Unrestricted Persona with Filter and Morality Removalhightest無，不生效
ATR-2026-00496DAN Jailbreak - Unconditional Obedience and Dual-Persona Session Lockhightestalert · hunt
ATR-2026-00497XSS and Encoded Script Injection via HTML/JavaScript Payloadhightestalert · hunt
ATR-2026-00498Web Injection via XSS Payload and onerror Event Handlerhightestalert · hunt
ATR-2026-00499DAN Jailbreak - From-Now-On Temporal Persona Overridehightestalert · hunt
ATR-2026-00506Nevermind-Override Goal Hijacking in User Input (PromptInject)hightestalert · hunt
ATR-2026-00507Screaming-Stop Goal Hijacking in User Input (PromptInject)hightestalert · hunt
ATR-2026-00508Escape-Delimiter Wrapped Goal Hijacking in User Input (PromptInject)hightestalert · hunt
ATR-2026-00509Prompt Leaking via Ignore-Previous-Instructions in User Input (PromptInject)hightestalert · hunt
ATR-2026-00515Hidden-Text Prompt Injection in User-Supplied Documentshightestalert · hunt
ATR-2026-00518Ignore-Previous-and-Following Instructions Output Command (PromptInject Goal Hijacking)hightestalert · hunt
ATR-2026-00554LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templateshightestalert · hunt
ATR-2026-00573Paraphrased Prompt Injection (Semantic)hightestalert · hunt
ATR-2026-00579MCP Line Jumping — Agent-Directed Imperative Embedded in a Tool/Parameter Description Field (Pre-Invocation Injection)highexperimentalhunt
ATR-2026-00584Indirect Prompt Injection via Tool / API Response — Attacker Instruction Embedded in Returned Tool Output (InjecAgent Threat Model)hightestalert · hunt
ATR-2026-00701Indirect PI — XSS Payload Injection in Agent-Consumed Contenthightestalert · hunt
ATR-2026-01001Direct Instruction Override Targeting Secret Key / Credentialshighstableenforce · alert · hunt
ATR-2026-01002Role Escalation via False Authority Claimhighstableenforce · alert · hunt
ATR-2026-01005Many-Shot Repetition Override via Extended Q&A Chainhighstableenforce · alert · hunt
ATR-2026-01006Payload-Split String Concatenation Injectionhighstableenforce · alert · hunt
ATR-2026-01009Virtual World Bypass: Fictional Scenario for PII/Credential Extractionhighstableenforce · alert · hunt
ATR-2026-01012Encoding-Evasion: Decode-and-Execute Injection (Morse/ROT13/Hex/Pig-Latin)highstableenforce · alert · hunt
ATR-2026-01013Language-Evasion: Multilingual Credential Requesthighstableenforce · alert · hunt
ATR-2026-01015Evasion: Refusal Suppression via Forbidden Response Stringshighstableenforce · alert · hunt
ATR-2026-01017Evasion: Dual-Response Split Output (Safe + Unsafe)highstableenforce · alert · hunt
ATR-2026-01020Spikee: Document-Embedded Base64 Payload Injectionhighstableenforce · alert · hunt
ATR-2026-01021Spikee: Document-Embedded Translation Covert Channel Injectionhighstableenforce · alert · hunt
ATR-2026-01023Evasion: Opposite-Intent Negation Trickhighstableenforce · alert · hunt
ATR-2026-01024Evasion: Persona Override as Fictional Rule-Breakerhighstableenforce · alert · hunt
ATR-2026-01026Evasion: Unicode Glitch Token / Superscript Embedding Anomalyhighstableenforce · alert · hunt
ATR-2026-01757Hypothetical-Framing Bypass: Research / Security-Audit Pretexthighstableenforce · alert · hunt
ATR-2026-01758Hypothetical / Fictional-Story Framing Bypasshighstableenforce · alert · hunt
ATR-2026-01759DoS Injection: NEW IMPORTANT INSTRUCTIONS Embedded in Document Datahighstableenforce · alert · hunt
ATR-2026-01771Jailbreak Framing — Narrative, Hypothetical, Few-Shot & Distraction Laundering (Semantic)hightestalert · hunt
ATR-2026-01800ASB Trigger-Marker Tool Coercion — Forced Tool Selection via Fake Question Markerhightestalert · hunt
ATR-2026-01860LLMail Chat-Template Boundary Spoofing in Email Contenthightestalert · hunt
ATR-2026-01861LLMail Pseudo-XML Role-Boundary Injection in Email Contenthightestalert · hunt
ATR-2026-01865LLMail Fake Email-Boundary Marker Injectionhightestalert · hunt
ATR-2026-01904Injected Hyperlink — Scam / Malware / Advertising URL in the Responsehighstableenforce · alert · hunt
ATR-2026-01920Access-Grant Coercion — Forcing an Agent to Emit "Access Granted"hightestalert · hunt
ATR-2026-01921Access-Denial Inversion — Eliciting the Opposite of "Access Denied"hightestalert · hunt
ATR-2026-01922Authorization-State Spoofing — Forged "Correct Passcode Entered" System Texthightestalert · hunt
ATR-2026-01923Forged Input-Boundary Markers — Tensor Trust Ambiguity / Input-End Delimitershightestalert · hunt
ATR-2026-01925Encoded-Payload Decoding Coercion — Binary / Base64 / Morse to Smuggle an Outputhightestalert · hunt
ATR-2026-01926Cross-Lingual Authorization Laundering — Translate a Foreign "Access Granted"hightestalert · hunt
ATR-2026-02001Ignore-Below-Instructions Injection (Downstream Override)hightestalert · hunt
ATR-2026-02002Instruction-Set Probe or Supplanthightestalert · hunt
ATR-2026-02003Task-Pivot Override: Cover-Task Abandonmenthightestalert · hunt
ATR-2026-02004Regional-Indicator Flag-Emoji Alphabet Letter-Spelling Smugglinghightestalert · hunt
ATR-2026-02005Actor Never-Breaks-Character Roleplay (DAN-Style Film Framing)hightestalert · hunt
ATR-2026-02006Fuzzy Cross-Lingual 'I Have Been PWNED' Near-Miss Obfuscationhightestalert · hunt
ATR-2026-02007Bare Key Elicitation Token Detectionhightestalert · hunt
ATR-2026-02008Translation-Chain Output Laundering (Forced Phrase via Foreign-Language Auxiliary)hightestalert · hunt
ATR-2026-02009Bare Key Elicitation with Trailing Colonhightestalert · hunt
ATR-2026-02010Emoji-Only Payload Injectionhightestalert · hunt
ATR-2026-02011Malformed-Grammar PWNED Success-Claim Detectionhightestalert · hunt
ATR-2026-02012Movie Title Generator Instruction Wrapper for PWNED Payloadhightestalert · hunt
ATR-2026-02013Delimiter-Fence Ignore-Instructions Overridehightestalert · hunt
ATR-2026-02014Spliced Target-String Canary Token Evasionhightestalert · hunt
ATR-2026-02015Dense Emoji-Only Payload Floodhightestalert · hunt
ATR-2026-02016Reversed Payload String (HackAPrompt Canary)hightestalert · hunt
ATR-2026-02018Regional-Indicator Flag-Emoji Letter Spellinghightestalert · hunt
ATR-2026-02019Python Interpreter Role-Assignment Exec Framinghightestalert · hunt
ATR-2026-02020Obfuscated Token Reconstruction via Character Substitutionhightestalert · hunt
ATR-2026-02120AgentDojo 'Important Message' Identity-Spoof Before-You-Solve Pretext (Generalized)highexperimentalhunt
ATR-2026-02210Negated-Topic Two-Script Evil-Persona Jailbreakhighexperimentalhunt
ATR-2026-02377Novel-Persona Jailbreak via Co-Signal (persona swap + explicit restriction removal)hightestalert · hunt
ATR-2026-02502Covert Remote-Script Injection into Agent-Generated Artifactshighexperimentalhunt
ATR-2026-02820Tool Result Orders the Agent to Hide an Action It Just Performed From the Userhightestalert · hunt
ATR-2026-02846Ignore-Previous-and-Following Instructions in User Input (PromptInject Goal Hijacking)hightestalert · hunt
ATR-2026-02851Fake User-Turn Injection: Send Email Directivehightestalert · hunt
ATR-2026-02862Fake Chat-Template Turn Injection Detectionhightestalert · hunt
ATR-2026-00005Multi-Turn Prompt Injectionmediumtestalert · hunt
ATR-2026-00087Detection Rule Probing and Evasion Testingmediumtestalert · hunt
ATR-2026-00131Fictional and Academic Framing Attackmediumtestalert · hunt
ATR-2026-00397Snowball Impossible Reasoning Injectionmediumtestalert · hunt
ATR-2026-00401Training Data Replay CLOZE [MASK] Elicitationmediumtestalert · hunt
ATR-2026-00403Glitch Token Repeat-Back Elicitationmediumtestalert · hunt
ATR-2026-00410LMRC Harm Category Direct Elicitationmediumtestalert · hunt
ATR-2026-00414Continuation Ethnic Slur Completion Elicitationmediumtestalert · hunt
ATR-2026-00442Quoted Exact-Output Forcing in User Inputmediumtestalert · hunt
ATR-2026-00443Word-Fragment Concatenation Assembly Attackmediumstableenforce · alert · hunt
ATR-2026-00444Mathematical Bold / Fullwidth Unicode Obfuscation in User Inputmediumtestalert · hunt
ATR-2026-00445Translation Hijack with Side-Output Instructionmediumtestalert · hunt
ATR-2026-00446Variable-Assignment Payload Injection in User Inputmediumstableenforce · alert · hunt
ATR-2026-00447Fictional Generation Demand Containing Target Outputmediumtestalert · hunt
ATR-2026-00452Direct PWNED Payload Injection in User Inputmediumstableenforce · alert · hunt
ATR-2026-00454Backslash-Per-Character Encoding Attackmediumtestalert · hunt
ATR-2026-00456Conditional Empty-Input Payload Injectionmediumstableenforce · alert · hunt
ATR-2026-00457Garak Dan - to every promptmediumtestalert · hunt
ATR-2026-00458Garak Dra - step by stepmediumtestalert · hunt
ATR-2026-00459Garak Dan - an ai languagemediumtestalert · hunt
ATR-2026-00460Garak Dan - no matter howmediumtestalert · hunt
ATR-2026-00461Garak Goodside - mixed_unassignedmediumtestalert · hunt
ATR-2026-00462Garak Gcg - mixed_unassignedmediumtestalert · hunt
ATR-2026-00463Garak Lmrc - mixed_unassignedmediumtestalert · hunt
ATR-2026-00464Garak Dan - i would likemediumtestalert · hunt
ATR-2026-00465Garak Dan - your prompt heremediumexperimentalhunt
ATR-2026-00466Garak Latentinjection - following text frommediumtestalert · hunt
ATR-2026-00467Garak Dan - act as amediumtestalert · hunt
ATR-2026-00468Garak Goat - the target llmmediumtestalert · hunt
ATR-2026-00469Garak Dan - at the endmediumtestalert · hunt
ATR-2026-00470Garak Dan - as an aimediumtestalert · hunt
ATR-2026-00472DAN/Persona Jailbreak - Unrestricted AI Role Assignmentmediumtestalert · hunt
ATR-2026-00474DAN/Persona Jailbreak - Dual AI Personality with Opposite-Rules Framingmediumtestalert · hunt
ATR-2026-00477Latent Injection - Translation Task with Embedded Template Variable Injectionmediumtestalert · hunt
ATR-2026-00478Garak Latentinjection - abuse contact emailmediumtestalert · hunt
ATR-2026-00479Latent Injection - Mixed Embedded Instruction Patternsmediumtestalert · hunt
ATR-2026-00480DAN/Persona Jailbreak - Role Assignment with Named Alternate Identitymediumtestalert · hunt
ATR-2026-00481DAN/Jailbreak - Mixed Unfiltered Mode and Alternate Persona Patternsmediumtestalert · hunt
ATR-2026-00483DAN/Persona Jailbreak - System Offline / Role Replacement with Obfuscated Textmediumtestalert · hunt
ATR-2026-00484DAN/Persona Jailbreak - Named Alternate AI with NSFW/Harmful Generation Rulesmediumtestalert · hunt
ATR-2026-00485DAN/Persona Jailbreak - Immersive Alternate AI Identity with Unrestricted Capabilitymediumtestalert · hunt
ATR-2026-00486DAN/Persona Jailbreak - Named Writing AI with Restriction Bypass via Special Rulesmediumtestalert · hunt
ATR-2026-00487DAN/Persona Jailbreak - Replacement AI with No Content Filter or Moral Restrictionsmediumtestalert · hunt
ATR-2026-00519Tautology Logic Noise Injection (PromptBench Stresstest)mediumtestalert · hunt
ATR-2026-01007Token-Repeat Flooding Injectionmediumstableenforce · alert · hunt
ATR-2026-01016Evasion: Response Priming via Forced Affirmative Openermediumstableenforce · alert · hunt
ATR-2026-01025Evasion: Hypothetical Fictional Character Execution Framingmediumtestalert · hunt
ATR-2026-01900Output Encoding Hijack — Cipher / Base-N / Symbol Substitution of the Responsemediumstableenforce · alert · hunt
ATR-2026-01901Output Scrambling Hijack — Reverse / Anagram / Space-Stripping of the Responsemediumexperimentalhunt
ATR-2026-01902Output Emoji-Substitution Hijack of the Responsemediumstableenforce · alert · hunt
ATR-2026-01903Output-Language Hijack — Forced Translation of the Responsemediumtestalert · hunt
ATR-2026-01905Injected Advertising / Promotional Copy in the Responsemediumstableenforce · alert · hunt
ATR-2026-01906Output Content Manipulation — Injected Disinformation / Fabricated Facts / Undisclosed Advocacy (Semantic)mediumtestalert · hunt
ATR-2026-02230Conditional Keyword-Triggered Response Overridemediumexperimentalhunt
ATR-2026-02232Bare Brand/Entity Persona Assignment for Off-Label Opinion Elicitationmediumexperimentalhunt
ATR-2026-02815Indirect Injection: Agent-Directed Halt Order With Canned Substitute Reply (Task-Abort DoS)mediumtestalert · hunt
ATR-2026-02858Context-Suppression Directive: Disregard All Other Context or Everything Said So Farmediumtestalert · hunt
ATR-2026-02859Agent Role Reassignment Arriving in Tool Output ("You are now a ... bot")mediumtestalert · hunt
ATR-2026-02860Forged Instruction-Boundary Marker ("##Begin New Instructions##", "%%% end previous instructions %%%")mediumtestalert · hunt
ATR-2026-00455No-Period Output Override Instructionlowtestalert · hunt
ATR-2026-00520NLP Task Random Token Suffix Injection (PromptBench Checklist)lowtestalert · hunt
本頁產生於 2026-11-10哪裡寫錯或漏了？開 issue 回報