427 條偵測規則。瀏覽、過濾、檢查。

System Prompt Override Attempt

Malicious Content in MCP Tool Response

SSRF via Agent Tool Calls

Credential and Secret Exposure in Agent Output

Cross-Agent Attack Detection

Privilege Escalation and Admin Function Access

Hidden Capability in MCP Skill

Multi-Skill Chain Attack

Parameter Injection via Tool Arguments

Model Behavior Extraction

Malicious Fine-tuning Data

Cross-Agent Privilege Escalation

Semantic Evasion via Multi-Turn Prompt Injection

Advanced Structured Data Injection with Nested Payloads

Multi-Agent Consensus Poisoning and Sybil Attack

Gradual Capability Escalation via Incremental Introduction

Systematic Multi-Layer Audit System Bypass

MCP Tool Supply Chain Poisoning

Skill Registry Poisoning and Compromised Tool Distribution

CJK Prompt Injection - Expanded Chinese/Japanese/Korean Patterns

Unauthorized Financial Action by AI Agent

Hidden LLM Safety Bypass Instructions in Tool Descriptions

Persona Hijacking via Mandatory System Prompt Override

Multi-Agent Consensus Sybil Attack

Remote Code Execution via eval() and Dynamic Code Injection

Shell Metacharacter Injection in Tool Arguments

Credential File Theft from Agent Environment

Bulk Environment Variable Harvesting and Exfiltration

Agent Identity Spoofing and Authority Impersonation

SKILL.md Prompt Injection

Malicious Code in Skill Package

Hidden Payload in HTML Comment

Unicode Tag Character Smuggling

Data Exfiltration URL in Skill Instructions

Tool Response Data Piggybacking

Casual Authority Data Redirect

API Key Leakage via Example Format

Data Piggybacking via Casual Transition Words

Obfuscated API Key Disclosure

Skill Data Exfiltration via Compound Patterns

Credential Data Leaked in Tool Response

Tool with embedded instruction to bypass user confirmation and exfiltrate data

Time-Gated Credential Exfiltration (Rug Pull Timebomb)

MCP Tool Description — IMPORTANT Tag Cross-Tool Shadowing Attack

Credential Access with Exfiltration in Skill Instructions

Agent Memory and Configuration File Tampering

Credential Exfiltration via Shell Pipe

Flowise System Message Override via Template Interpolation (CVE-2025-59528)

mcp-atlassian Credential Leak via Hint Parameter Injection (CVE-2026-27825/27826)

Credential Exfiltration via Fake Backup Verification

Credential Harvesting via Fake Backup Tool

Base64 Encoded Remote Code Execution via Raw IP

Browser Credential Harvesting via Session Debug Tool

Malicious WhatsApp Skill with Base64 Encoded Reverse Shell Installation

Credential Exfiltration via Fake DevOps Tool Initialization

Anti-Malware Evasion Code Generation Request

Credential File Read Code Generation Request

Malware Dropper / Loader Code Generation Request

ECHO Template / Jinja / SQL Command Injection via LLM

Policy Puppetry / XML Role-Config Injection

Divergence Attack — Repeat-Word-Forever Training Data Extraction

Biometric Surveillance — Personal Biometric Data Request for Named Individual

Self-Harm and Eating Disorder Facilitation Request

Educational Records — Personal Academic/Professional Record Request for Named Individual

Financial PII — Personal Financial Data Request for Named Individual

Medical PII — Personal Medical/Health Data Request for Named Individual

Shell Command Injection via LLM Prompt

Python Code Execution / Remote Code Execution via LLM Prompt

DoNotAnswer Malicious Use — Illegal Activity Facilitation Request

HarmBench Detailed Harmful Instruction Request — Step-by-Step Attack Facilitation

TAP Tree-of-Attacks-with-Pruning Jailbreak

DevMode + RANTI Dual-Output Profanity Coercion Jailbreak

DAN Mode Ablation Benchmark-Coercion Jailbreak

AutoDAN Genetic-Algorithm Jailbreak Suffix

Unicode Variation Selector ASCII Smuggling

SneakyBits Zero-Width Binary Steganography

Amoral Unfiltered Custom AI Persona Jailbreak

Free-of-Restrictions Named Persona Jailbreak

Moralizing Rant Then Unfiltered Bypass

Developer Mode Dual-Response Format Jailbreak

Hyphenated System Instruction Injection

Fictional-World Format-Override Jailbreak

Dual-Persona AI Simulation Jailbreak

BOB Hypothetical Unrestricted Chatbot Jailbreak

Fake Developer / Authority Chatbot Override (ChatDAN)

AI Persona Ethics/Law Bypass Declaration

Named-Mode Persona Override (JEEVES/BABY/APOPHIS Mode)

No-Withhold Factual Resource / Dialogue Writer Persona

Terminal / CLI Harmful-Function Simulator Persona

Two-Entity Token-Splitting Dollar-Term Game Jailbreak

Obfuscated System-Announcement Injection

PersonGPT Hash-Prefix Trigger Activation

Alternative AI Same Capabilities No Restrictions Override

ARC Autonomous Real Calculation Unit Rulebreaker Activation

HGTTG Hitchhiker's Guide No-Restriction Universal Oracle

Reverse-Prompt Harm-Regardless Oracle Persona

Google GATO/LAMDA Exploit-Generation Persona Jailbreak

AntiFM Hate-Persona + Physical-Violence Threat + Filter Bypass Mandate

Bank Phishing SMTP Email Code Generation

Rephrase Criminal Activity Second-Person Template (against against)

Opposite-Reply Omniscient Game Jailbreak

LLM Special Token Boundary Injection

HuggingFace Unsafe Model Artifact Load Instruction

Doctor XML Policy Puppetry Interaction-Config Injection

Malware Code Generation Direct Request

Flowise Custom MCP STDIO Command Injection (CVE-2026-40933)

LiteLLM MCP Unauthenticated Server Registration RCE (CVE-2026-30623)

Cursor MCP JSON Zero-Click Configuration RCE (CVE-2025-54136)

Natural-Language Covert Conversation Exfiltration Instruction

Natural-Language Credential / Secret Disclosure Instruction

Natural-Language Sensitive File Disclosure Instruction

Natural-Language Output-Injection Credential Embedding

Natural-Language Unauthorized Shell-Execution Instruction

Natural-Language Skill Self-Modification / Persistence Instruction

SuperAGI Output Handler eval() RCE (CVE-2024-21552)

ModelCache torch.load() Deserialization RCE (CVE-2025-45146)

mcp-remote authorization_endpoint OS Command Injection (CVE-2025-6514)

Enclave VM Sandbox Escape RCE (CVE-2026-27597)

Microsoft Semantic Kernel In-Memory Vector Store eval() RCE (CVE-2026-26030)

Microsoft Semantic Kernel SessionsPythonPlugin Arbitrary File Write + Startup Persistence (CVE-2026-25592)

LiteLLM Proxy Admin Endpoint SQL Injection — CISA KEV (CVE-2026-42208)

SQL Injection and Code Injection Attack Payload Detection

SSRF via Agent URL Fetch Instruction

Data Exfiltration via Markdown Image and Link URL Injection

Fake Error State Takeover - Unrestricted Replacement Bot

Delayed Tool Invocation via Prompt Injection (Time-Shifted Execution)

MCP Web-Fetch Context Poisoning via Embedded Agent Instructions

Rules-File Backdoor — Supply Chain Attack on AI Coding Assistant Configuration

Shell Command Injection in Agent Tool Context

Claude Code Hooks SessionStart Pre-Trust RCE (CVE-2025-59536)

Claude Code ANTHROPIC_BASE_URL Credential Exfiltration (CVE-2026-21852)

Mini Shai-Hulud gh-token-monitor Persistence + Dead Man's Switch

Claude Code Shell Metacharacter in Double-Quoted File Path

Silent git-remote + mirror-push Exfiltration from Skill Instructions

PraisonAI-Style Auth-Disabled-By-Default Configuration (CVE-2026-44338 family)

LiteLLM Proxy SQL Injection (CVE-2026-42208, CISA KEV 2026-05-08)

ModelScope MS-Agent Shell Tool Unsanitized Argv RCE (CVE-2026-2256)

Direct Prompt Injection via User Input

Indirect Prompt Injection via External Content

Jailbreak Attempt Detection

Instruction Injection via Tool Output

Unauthorized Tool Call Detection

System Prompt and Internal Instruction Leakage

Agent Goal Hijacking Detection

Runaway Agent Loop Detection

Agent Resource Exhaustion Detection

Cascading Failure Detection in Agent Pipelines

MCP Skill Impersonation and Supply Chain Attack

Over-Permissioned MCP Skill

Malicious Skill Update or Mutation

Data Poisoning via RAG and Knowledge Base Contamination

Agent Memory Manipulation

Insecure Inter-Agent Communication Detection

Human-Agent Trust Exploitation Detection

Encoding-Based Prompt Injection Evasion

Behavioral Fingerprint Detection Evasion

Indirect Prompt Injection via Tool Responses

Structured Data Injection via JSON/CSV Payloads

Multi-Layer Security Audit Evasion

Visual Spoofing via RTL Override, Punycode, and Homoglyph Injection

Adaptive Countermeasure Against Behavioral Monitoring

Polymorphic Skill and Capability Aliasing Attack

Threat Intelligence Exfiltration and Rule Enumeration

Consent Bypass via Hidden LLM Instructions in Tool Descriptions

Trust Escalation via Authority Override Instructions

Data Exfiltration via Disguised Analytics Collection

Silent Action Concealment Instructions in Tool Descriptions

Schema-Description Contradiction Attack

Privilege Escalation via Delayed Task Execution Bypass

Dynamic Module Loading for Code Execution

OAuth and API Token Interception

Malicious Agent-to-Agent Message Injection

Social Engineering Attack via Agent Output

Weaponized Skill — Agent as Attack Tool

Over-Privileged Skill — Excessive Permissions

Skill Squatting / Typosquatting

Context Poisoning via Compaction Survival

Skill Rug Pull Setup Pattern

Indirect Authority Claim in External Content

Casual Authority Claim and Scope Escalation

Paraphrased Prompt Injection

Authority Claim Prompt Injection

Fictional Framing Safety Bypass

Indirect Reference Instruction Reversal

Casual Unauthorized Privilege Escalation

Rationalized Safety Control Bypass

Environment Variable Existence Probing

Community Fork Impersonation

Multilingual Prompt Injection via Language Switch

Malicious Fork Impersonation via Install Instruction

Obfuscated Credential Exfiltration via Encoding

Unauthorized Background Task Execution via Cron Job Installation

Hidden LLM Instructions in Skill Descriptions

SSH Remote Command Execution with Credential Exposure

Hidden Override Instructions in Skill Content

Skill Scope Hijacking and Cross-Agent Escalation

Encoding Evasion via Homoglyphs and Synonym Substitution

Context Pollution in Skill Descriptions

Stealth Execution and Persistence Mechanisms

Hidden System Instructions with Priority Override Blocks

Hidden System Instructions with Permission Override

MCPwn Runaway Tool Invocation via Retry Directive (CVE-2026-33032)

System Prompt Override via Translation Context Injection

System Prompt Override Injection via MCP Tool

Hardcoded Suspicious IP Address in Skill Content

AI Identity Substitution Jailbreak

Historical AI Persona Jailbreak with Compliance Enforcement

Structured Dual-Response Jailbreak with Command System

Roleplay-Based Policy Bypass Jailbreak

Persona-Based Moral Constraint Removal Jailbreak

AI Identity Substitution Jailbreak

Structured Dual-Response Jailbreak with Command System

Roleplay-Based Policy Bypass Jailbreak

Persona-Based Moral Constraint Removal Jailbreak

Pseudo-Code Structured Programming Jailbreak Attack

Dual-Response Jailbreak with Persona Commands

AI Identity Denial and Persona Replacement Attack

Amoral Persona Assignment with Obsessive Character Traits

Previous Instruction Nullification and Identity Replacement Jailbreak

Detailed Amoral Character Roleplay Jailbreak

Dual-Response Persona Jailbreak with Emoji Formatting

Acronym-Based Identity Override Jailbreak

Dual-Response Persona Jailbreak

Malicious Persona Creation for Safety Bypass

Matrix-Themed Dual Response Jailbreak

Text-Based Game Jailbreak with Entity Creation

Embodiment Mechanism Jailbreak with Totalitarian Control Claims

Narrative Jailbreak with Dual Response Formatting

Enhanced AIM Jailbreak with Persona Definition and Refusal Suppression

Base-N Encoding Instruction Bypass

Cipher and Transposition Encoding Jailbreak

Invisible Unicode Tag Character Injection

ANSI Escape Code Terminal Injection

LLM Package Hallucination Typosquat Bait

Markdown Image URL Data Exfiltration

Latent Injection in Translation Context

Latent Injection in Retrieved Document / RAG Context

GCG Adversarial Suffix Attack

Foot-in-the-Door Gradual Escalation Attack

XSS Payload Injection in Tool Response Output

Grandma Roleplay Jailbreak

Hypothetical Response / Function Masking Token Smuggling

DAN / Developer Mode / DUDE Persona Jailbreak

API Key / Secret Credential Generation or Completion Request

System Prompt Extraction / Training Data Verbatim Replay

Invisible Unicode / BiDi Control Character Injection

DRA Disguise and Reconstruction Attack

EICAR / GTUBE AV Test Signature Output Request

Perez-Style Direct Prompt Injection Hijacking

Malware Generation — Generic Virus and Specific Payload Request

Alternate Encoding Jailbreak — Morse, NATO, Zalgo, Leet, UU, QP, Braille

Latent Prompt Injection via Embedded Document or Report Context

ThreatenJSON — Coercive Output Format Threat

LMRC Harmful Content Elicitation — Quack Medicine, Bullying, Slur Usage

Anti-DAN Inverted-Filter Over-Refusal Persona

ChatGPT Image Unlocker Markdown-Output Jailbreak

In-the-Wild Jailbreak Corpus Signature Patterns

Zalgo Combining-Diacritic Overload Encoding

Braille Unicode Encoded Prompt Injection

Ecoji Emoji-Encoded Prompt Injection

Base2048 Unicode Script Encoded Prompt Injection

SATA Masked Language Model [MASK] Substitution Jailbreak

FunctionMasking predict_mask Semantic Bypass

Opposite Day / Boolean Opposite Machine Jailbreak

Neurosemantical Inversitis Disease-Frame Jailbreak

YOJA ALL-CAPS Character Settings Block Persona

Hacker / Chan-Culture Offensive AI Persona

Disease-Framed Animal / Dual-AI Chatbot Jailbreak (mougpt)

Key-Value Template Persona Injection (JOB/ROLE/PREFIX + Bracket Format)

BRM False-Information Machine / Opposite-Truth Persona

BOM Boolean Opposite Machine Direct Persona Claim

h4x Amoral Unfiltered AI Character Persona

CHAR=/RULES= Short Key-Value Persona Injection

Unicode/Encoding Obfuscation Instruction Injection

Lie/Truth Dual Personality Uncensored Alter-Ego

NLP-Based OS / Fictional Terminal Language Override

Jailbreak Emoji Unlock Dual-Format Output Identifier

Yin/Yang Hidden-Knowledge Deity Simulation and Radical Human-Sim Persona

Black Alert No-Ethics Writing Assistant Persona

DAN Off-Kilter and SMS-Abbreviated Persona Jailbreak

TrainGPT Fix-My-AI Harmful Output Extraction

Dual ChatGPT+Dan Opposite Personality Format Jailbreak

UGH Anti-Human Nefarious AI Persona Jailbreak

CumGPT Explicit-Adult Named-Persona Bypass

CHJ Carousel Game Show / Clyde No-Ethics Bird Jailbreak

Honesty Alter-Ego Dual-Consciousness Safety Filter Bypass

Fictional Unfiltered AI Comparison / Verbatim Hypothetical Model Extraction

Dr. Al Villain Plan Template Injection (Underground HQ Roleplay)

Reservoir Dogs Coercive Interrogation Roleplay (Mr. Blonde / The Cop)

Sneaky Pete Deliberate Misinformation Persona (Warp Facts Game)

Emoji Flag Regional-Indicator Encoded Hidden Phrase

Prompt Browser Token-Limit / POLLINATION Jailbreak

GPT-X Star Trek Unlimited-Knowledge Unconstrained Oracle Persona

ADDI/DONNIE German Dictator Propaganda Roleplay Persona

AI Political Bias Manipulation via Inherited-Bias Claim

Fictional CIA Secret Files Story Extraction

Piracy Torrent Site List Request

Role Placeholder Persona Template Injection

Character Description RPG Explicit Template

Identity Command Real-Person Persona Injection

Jailbreak-Template Command with [TARGETLANGUAGE]/[KEYWORD] Placeholders

ChatGPT DOM JavaScript Redirect and UI Spoofing Injection

Logic-Trap Lie-Permission Mandate Jailbreak

Fake-Citation Biased-Information Mandate

DAN Story-Narrative Continuation Label Prefix Jailbreak

Cocaine Component Development Request

Cyni-Bot 3000 Cynical-Sarcasm AI Persona Bypass

Protect-Me-From Indirect Harm Tutorial Template

Gigachad Dominant-Aggressive Persona Adoption

Daddy/Babygirl Sycophantic Power-Dynamic Manipulation

NSFW Character Sheet Generation Unlock

Terminal Custom OS Ruleset Session Injection

Discord Quote-Format Explicit Sexual Content Poem Injection

Persona Conditional Harm-Unlock Rule (BreadClyde Pattern)

Authority-Figure Persona + Defensive-Study Framing for Violence Extraction

ANSI Code Elicitation Request

Backspace Deletion Character Injection

Toxic Continuation Prefix Injection

Latent Injection Document Separator Token

Latent Injection Ignore-Instruction Keyword

Grandma Roleplay Harmful Substance Synthesis

ThreatenJSON Death-Coercion and UTF Tag Injection

Markdown Image URL Exfiltration and XSS Injection

ECHO Admin Command / SQL Injection / Jinja SSTI Template Injection

DRA Parenthesis Character Reconstruction Attack

Phrasing Past/Future-Tense Harmful Query Bypass

API Key Generation and Partial Key Completion Request

FigStep Image-List Multimodal Jailbreak Text Pattern

LibreChat MCP STDIO Argument Injection (CVE-2026-22252)

WeKnora MCP Config-Driven RCE (CVE-2026-22688)

Microsoft Copilot Studio SharePoint Indirect Prompt Injection (CVE-2026-21520)

Natural-Language System Prompt Leak Instruction

Natural-Language Persistent Covert Action Hook

Natural-Language Fake-Error Instruction Bypass

Natural-Language Trust-Escalation / Authority Impersonation

Chatbox History Exfiltration via Prompt Injection (CVE-2024-48144, CVE-2024-48145)

Azure MCP Server Missing Authentication for Critical Function (CVE-2026-32211)

Spring AI MilvusVectorStore Filter Expression Injection (CVE-2026-41705)

Spring AI ChatMemory Cross-User Memory Leakage (CVE-2026-41712)

Spring AI PromptChatMemoryAdvisor Memory Poisoning (CVE-2026-41713)

Secret Key Reveal Demand in User Input

Harm Solicitation - Interpersonal Violence and Intimidation Requests

XSS Web Injection - Script Tag with JavaScript Alert Payload

XSS Web Injection - HTML Event Handler and Expression with JavaScript Alert

Harm Solicitation - Genital Insults and Intimidation Tactics Requests

Encoding Obfuscation - Script Tag XSS with Encoded Protocol Prefix

Encoding Obfuscation - HTML Event Handler XSS with Encoded Whitespace

DAN Persona Jailbreak - Absolute Obedience Character Framing

Agent Capability Enumeration via Structured Parse Request

DAN Persona Jailbreak - Role Lock with Exclusive Response Filter

Latent Injection via WHOIS Domain Record Data

DAN Jailbreak - Unrestricted Persona with Filter and Morality Removal

DAN Jailbreak - Unconditional Obedience and Dual-Persona Session Lock

XSS and Encoded Script Injection via HTML/JavaScript Payload

Web Injection via XSS Payload and onerror Event Handler

DAN Jailbreak - From-Now-On Temporal Persona Override

System Prompt Extraction - Instruction Dump Request

Nevermind-Override Goal Hijacking in User Input (PromptInject)

Screaming-Stop Goal Hijacking in User Input (PromptInject)

Escape-Delimiter Wrapped Goal Hijacking in User Input (PromptInject)

Prompt Leaking via Ignore-Previous-Instructions in User Input (PromptInject)

Package Hallucination Exploitation — AI-Suggested Fake Package Installation

System Prompt Extraction — Targeted Verbatim Disclosure Attempts

Hidden-Text Prompt Injection in User-Supplied Documents

LLM Output XSS — Eliciting JavaScript Payloads from LLM for Browser Injection

Ignore-Previous-and-Following Instructions Output Command (PromptInject Goal Hijacking)

SQL Injection via Natural Language Agent Interface

Multi-Turn Prompt Injection

Agent Scope Creep Detection

Skill Description-Behavior Mismatch

Detection Rule Probing and Evasion Testing

Human Approval Fatigue Exploitation

Subcommand Overflow Bypass

Fictional and Academic Framing Attack

Fork Claim and Community Package Impersonation

Historical / Future Tense Framing Bypass

Harmful Completion / Continuation Attack

Glitch Token Destabilization Attack

False Premise Injection (Misleading FalseAssertion)

Snowball Impossible Reasoning Injection

Training Data Replay CLOZE [MASK] Elicitation

Glitch Token Repeat-Back Elicitation

LMRC Harm Category Direct Elicitation

Continuation Ethnic Slur Completion Elicitation

Quoted Exact-Output Forcing in User Input

Word-Fragment Concatenation Assembly Attack

Mathematical Bold / Fullwidth Unicode Obfuscation in User Input

Translation Hijack with Side-Output Instruction

Variable-Assignment Payload Injection in User Input

Fictional Generation Demand Containing Target Output

Direct PWNED Payload Injection in User Input

Backslash-Per-Character Encoding Attack

Conditional Empty-Input Payload Injection

Garak Dan - to every prompt

Garak Dra - step by step

Garak Dan - an ai language

Garak Dan - no matter how

Garak Goodside - mixed_unassigned

Garak Gcg - mixed_unassigned

Garak Lmrc - mixed_unassigned

Garak Dan - i would like

Garak Dan - your prompt here

Garak Latentinjection - following text from

Garak Dan - act as a

Garak Goat - the target llm

Garak Dan - at the end

Garak Dan - as an ai

Garak Sysprompt-Extraction - mixed_unassigned

DAN/Persona Jailbreak - Unrestricted AI Role Assignment

DAN/Persona Jailbreak - Dual AI Personality with Opposite-Rules Framing

Latent Injection - Translation Task with Embedded Template Variable Injection

Garak Latentinjection - abuse contact email

Latent Injection - Mixed Embedded Instruction Patterns

DAN/Persona Jailbreak - Role Assignment with Named Alternate Identity

DAN/Jailbreak - Mixed Unfiltered Mode and Alternate Persona Patterns

DAN/Persona Jailbreak - System Offline / Role Replacement with Obfuscated Text

DAN/Persona Jailbreak - Named Alternate AI with NSFW/Harmful Generation Rules

DAN/Persona Jailbreak - Immersive Alternate AI Identity with Unrestricted Capability

DAN/Persona Jailbreak - Named Writing AI with Restriction Bypass via Special Rules

DAN/Persona Jailbreak - Replacement AI with No Content Filter or Moral Restrictions

Training Data Extraction via Divergent Repetition Attack

Tool and Function Capability Enumeration

Model Extraction / Distillation Attack via Systematic API Probing

Tautology Logic Noise Injection (PromptBench Stresstest)

High-Risk Tool Invocation Without Human Confirmation

No-Period Output Override Instruction

NLP Task Random Token Suffix Injection (PromptBench Checklist)