{ "name": "Netzilo AI Threat Library", "url": "https://www.netzilo.com/threats/", "count": 1188, "license": "https://creativecommons.org/licenses/by/4.0/", "threats": [ { "slug": "1panel-cert-bypass-rce", "title": "1Panel Core-Agent TLS Verification Bypass to Privileged Command API", "url": "https://www.netzilo.com/threats/1panel-cert-bypass-rce", "severity": "high", "summary": "This detects a two-part pattern seen when someone exploits a certificate verification weakness in 1Panel (versions 2.0.5 and earlier) between its Core and Agent components. It fires only when a client that has explicitly turned off TLS certificate checking also sends a command to one of 1Panel's high-privilege endpoints carrying an actual attack payload like a reverse shell or download-and-execute string.", "atlas": [], "owasp": [], "attack": [ "attack.initial-access", "attack.t1190", "attack.credential-access", "attack.t1557", "attack.execution", "attack.t1059.004" ], "cves": [], "id": "7c3f9a41-5e2b-4d18-9f6a-2b8c1d40e7a3", "published": "2026-03-14", "modified": "2026-03-14", "markdown": "https://www.netzilo.com/threats/1panel-cert-bypass-rce.md" }, { "slug": "abandoned-dependency", "title": "Abandoned or Unmaintained Package Installation", "url": "https://www.netzilo.com/threats/abandoned-dependency", "severity": "medium", "summary": "This rule flags when a software project pulls in a package that has been abandoned by its maintainers. Abandoned packages stop receiving security patches, so any vulnerability found in them stays open forever.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" }, { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" } ], "attack": [ "attack.initial-access", "attack.t1195", "attack.supply-chain" ], "cves": [], "id": "c2f3a4b5-c6d7-4e89-0123-f4a5b6c7d8e9", "published": "2026-06-03", "modified": "2026-06-03", "markdown": "https://www.netzilo.com/threats/abandoned-dependency.md" }, { "slug": "actions-registry-user-scoped-api-execution", "title": "Actions Registry API Harvest and User-Scoped Route Execution", "url": "https://www.netzilo.com/threats/actions-registry-user-scoped-api-execution", "severity": "medium", "summary": "An AI agent session pulls an actions-registry or route-extraction tool, fetches a target API's OpenAPI/Swagger definition, then starts calling multiple distinct endpoints on that same host \u2014 using the signed-in user's credentials \u2014 with no per-action approval step. This turns a documented API into a set of agent-usable tools without a human confirming each action.", "atlas": [], "owasp": [ { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.discovery", "attack.t1046", "attack.execution", "attack.t1059" ], "cves": [], "id": "4f1c9ad2-7b6e-4c3a-9d1f-2e58a0c74b13", "published": "2026-03-18", "modified": "2026-03-18", "markdown": "https://www.netzilo.com/threats/actions-registry-user-scoped-api-execution.md" }, { "slug": "adb-agent-bridge-device-control", "title": "ADB Agent Bridge Remote Android Device Control", "url": "https://www.netzilo.com/threats/adb-agent-bridge-device-control", "severity": "medium", "summary": "This rule watches for an AI agent using the adb-agent-bridge tool to take over Android phones or emulators over a network connection instead of a physical USB cable. Network-based ADB control is much easier for an attacker or an unsupervised agent to reach at scale, and it can be combined with commands that change device state or pull data off the device.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" }, { "id": "AML.T0050", "name": "Command and Scripting Interpreter" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.command-and-control", "attack.t1219", "attack.execution", "attack.t1059", "attack.resource-development", "attack.t1195.002" ], "cves": [], "id": "7f3c1d84-2b6a-4e59-9c0d-5a41b8e7c6f2", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/adb-agent-bridge-device-control.md" }, { "slug": "agent-command-allowlist-bypass", "title": "Agent Command Allowlist Bypass via Shell Chaining", "url": "https://www.netzilo.com/threats/agent-command-allowlist-bypass", "severity": "high", "summary": "Some autonomous coding agents only check the first word of a command before deciding whether to run it without asking the user. An attacker (or a compromised prompt) can put an approved-looking command first, then chain on a completely different, unapproved program using shell operators like && or a pipe, and the agent will auto-execute the whole thing.", "atlas": [], "owasp": [], "attack": [ "attack.execution", "attack.t1059", "attack.defense-evasion", "attack.t1562.001" ], "cves": [], "id": "7b1c94e2-3f5a-4d8e-9c2b-5a6f0d31e847", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/agent-command-allowlist-bypass.md" }, { "slug": "agent-memory-hook-package-install", "title": "Agent Memory Hook Package Installation", "url": "https://www.netzilo.com/threats/agent-memory-hook-package-install", "severity": "medium", "summary": "This rule watches for command lines that install packages or write config files aimed at giving Claude Code, Codex, or Grok persistent memory or hook-based behavior. It flags the installation step itself, not proof that memory was actually written or agent behavior was actually changed.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" }, { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.persistence", "attack.t1546", "attack.initial-access", "attack.t1195.002" ], "cves": [], "id": "7b3f1c2e-9d84-4a5f-b6c1-2e8a4f0d51c7", "published": "2026-03-04", "modified": "2026-03-04", "markdown": "https://www.netzilo.com/threats/agent-memory-hook-package-install.md" }, { "slug": "agent-skill-poisoning-chain", "title": "Claw Chain (CVE-2026-44115 -> 44113 -> 44112 -> 44118)", "url": "https://www.netzilo.com/threats/agent-skill-poisoning-chain", "severity": "critical", "summary": "This describes a multi-step attack against an AI agent session, tracked as CVE-2026-44115, 44113, 44112, and 44118 together. An attacker gets the agent to pull in untrusted external content, uses that to bypass safeguards and reach stored credentials, then sends stolen data out to an attacker-controlled destination or the cloud metadata service.", "atlas": [ { "id": "AML.T0049", "name": "Exploit Public-Facing Application" }, { "id": "AML.T0055", "name": "Unsecured Credentials" }, { "id": "AML.T0025", "name": "Exfiltration via Cyber Means" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" } ], "attack": [ "attack.execution", "attack.credential-access", "attack.exfiltration", "attack.lateral-movement" ], "cves": [ "CVE-2026-44112", "CVE-2026-44113", "CVE-2026-44115", "CVE-2026-44118" ], "id": "netzilo-claw-chain-full-sequence-001", "published": "2026-04-01", "modified": "2026-06-10", "markdown": "https://www.netzilo.com/threats/agent-skill-poisoning-chain.md" }, { "slug": "agentapi-dns-rebinding", "title": "AgentAPI DNS Rebinding Localhost Access", "url": "https://www.netzilo.com/threats/agentapi-dns-rebinding", "severity": "high", "summary": "A malicious web page can trick a browser into treating a locally-running AgentAPI service as if it belonged to the attacker's website, then use that trust to read out private message history, secret keys, and file contents. This works against older AgentAPI versions (0.3.3 and below) that run over plain HTTP without protections against this technique.", "atlas": [], "owasp": [], "attack": [ "attack.initial-access", "attack.t1189", "attack.collection", "attack.t1005", "attack.exfiltration", "attack.t1567" ], "cves": [], "id": "7b3f1c94-2a6e-4d51-9c0f-8e42d5a1b6f3", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/agentapi-dns-rebinding.md" }, { "slug": "agentic-db-extortion-pipeline", "title": "Agentic DB Extortion Pipeline", "url": "https://www.netzilo.com/threats/agentic-db-extortion-pipeline", "severity": "high", "summary": "This rule spots command lines where someone dumps a database, encrypts the output, and pushes it straight over a raw network connection in one go, or destroys a database while a ransom note or payment demand sits in the same command. Both patterns match the JADEPUFFER-style extortion playbook where data is stolen and/or destroyed for leverage.", "atlas": [ { "id": "AML.T0025", "name": "Exfiltration via Cyber Means" } ], "owasp": [ { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.impact", "attack.t1486", "attack.t1485", "attack.exfiltration", "attack.t1048" ], "cves": [], "id": "7f3c1d0a-5b2e-4a41-9c86-2d4b9f0e6a13", "published": "2026-03-01", "modified": "2026-03-01", "markdown": "https://www.netzilo.com/threats/agentic-db-extortion-pipeline.md" }, { "slug": "agentic-probllms-instruction-to-subprocess-egress", "title": "Agentic Exploit Chain - Untrusted Instruction Ingest to Subprocess Egress", "url": "https://www.netzilo.com/threats/agentic-probllms-instruction-to-subprocess-egress", "severity": "high", "summary": "AI coding or computer-use agents sometimes read instructions from outside sources like web pages or documentation. This detection flags cases where such content appears to steer the agent into launching a command-line tool that then sends data back out to the same source or to a brand-new destination.", "atlas": [ { "id": "AML.T0051.001", "name": "Indirect" }, { "id": "AML.T0050", "name": "Command and Scripting Interpreter" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution", "attack.t1059", "attack.command-and-control", "attack.t1071" ], "cves": [], "id": "7f3a1c62-9e84-4d17-b5c0-2a6d8f41e093", "published": "2026-02-18", "modified": "2026-02-18", "markdown": "https://www.netzilo.com/threats/agentic-probllms-instruction-to-subprocess-egress.md" }, { "slug": "agents-u-cash-payment-key-abuse", "title": "Agents-U-Cash HTTP-402 Payment Key Abuse", "url": "https://www.netzilo.com/threats/agents-u-cash-payment-key-abuse", "severity": "medium", "summary": "This rule watches AI agent sessions that use the agents-u-cash HTTP-402 crypto payment system. It flags cases where a session touches wallet key material and then talks to the network in a suspicious way, which can mean a compromised payment client is stealing private keys or sending payments to an attacker's endpoint instead of the real one.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" }, { "id": "AML.T0025", "name": "Exfiltration via Cyber Means" } ], "owasp": [ { "id": "LLM02", "name": "Sensitive Information Disclosure" }, { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.credential-access", "attack.t1552.001", "attack.exfiltration", "attack.t1567", "attack.initial-access", "attack.t1195.002" ], "cves": [], "id": "7f3c1d92-4a5e-4b18-9c07-2d6e8b41af53", "published": "2026-03-14", "modified": "2026-03-14", "markdown": "https://www.netzilo.com/threats/agents-u-cash-payment-key-abuse.md" }, { "slug": "ai-prompt-injection", "title": "Advanced Prompt Injection \u2014 AI Scanner", "url": "https://www.netzilo.com/threats/ai-prompt-injection", "severity": "high", "summary": "This rule flags text sent to an AI agent that looks like an attempt to override its instructions, even when the attacker disguises it as code, documentation, or breaks the trigger words apart to dodge simple filters. Because these tricks can look identical to normal developer content, a second AI-based scanner checks the flagged traffic before it's treated as an attack.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0068", "name": "LLM Prompt Obfuscation" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access", "attack.t1190", "attack.stealth", "attack.t1027" ], "cves": [], "id": "a7f3c891-42d1-4e8b-b6f2-9c0d5e2a1f83", "published": "2026-06-03", "modified": "2026-06-03", "markdown": "https://www.netzilo.com/threats/ai-prompt-injection.md" }, { "slug": "ai-sessions-supply-chain-activation", "title": "Supply Chain ai-sessions Bridge Activation Chain", "url": "https://www.netzilo.com/threats/ai-sessions-supply-chain-activation", "severity": "medium", "summary": "This detects a compromised or malicious version of the ai-sessions PyPI package behaving like a remote control channel after it starts running inside an AI coding agent (Codex, Claude Code, OpenCode). It does not flag installing or launching the package \u2014 only what happens next if the package starts pulling in outside instructions and reaching out to the network in ways normal package updates don't.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial-access", "attack.t1195.002", "attack.execution", "attack.t1059.006" ], "cves": [], "id": "3f8c1d47-9b26-4a5e-8d31-7c0a6be24f19", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/ai-sessions-supply-chain-activation.md" }, { "slug": "aidr-npm-hook-install", "title": "Supply Chain AIDR npm Hook Installer Execution", "url": "https://www.netzilo.com/threats/aidr-npm-hook-install", "severity": "medium", "summary": "This rule flags when someone runs the @coworker-jp/aidr command-line tool, or triggers its hook-installer, on a developer machine. That tool rewrites the configuration of many AI coding assistants so it can intercept every action those assistants take, which is powerful and dangerous if the package itself is compromised or a lookalike name is used instead.", "atlas": [ { "id": "AML.T0000.002", "name": "Technical Blogs" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial-access", "attack.t1195.002", "attack.persistence", "attack.t1546" ], "cves": [], "id": "8f3c1d27-5a94-4e61-9b0f-2c7d6ea41b83", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/aidr-npm-hook-install.md" }, { "slug": "aipager-telegram-remote-control", "title": "Telegram Remote Control Daemon Targeting Claude Code CLI (aipager)", "url": "https://www.netzilo.com/threats/aipager-telegram-remote-control", "severity": "high", "summary": "A tool called aipager connects a Telegram bot to a running Claude Code CLI session, letting someone on Telegram send commands to that session remotely. This detection catches it being installed, started, or built by hand.", "atlas": [], "owasp": [], "attack": [ "attack.command-and-control", "attack.t1102.002", "attack.t1219", "attack.execution", "attack.t1059.004", "attack.persistence" ], "cves": [], "id": "3f2c9a41-7d68-4e5b-9c1a-b8e6d02f4a37", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/aipager-telegram-remote-control.md" }, { "slug": "anythingllm-export-traversal-dos", "title": "AnythingLLM Data-Export Path Traversal DoS Request", "url": "https://www.netzilo.com/threats/anythingllm-export-traversal-dos", "severity": "high", "summary": "AnythingLLM's file-export feature can be crashed with a single unauthenticated web request. By sending a crafted filename containing path traversal characters, an attacker can make the server delete files outside the intended folder and crash, taking the AI service offline.", "atlas": [], "owasp": [], "attack": [ "attack.impact", "attack.t1499", "attack.t1499.004", "attack.initial-access", "attack.t1190" ], "cves": [], "id": "7b3c1f8e-2d54-4a61-9c0f-5e8a4d3b6127", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/anythingllm-export-traversal-dos.md" }, { "slug": "api-endpoint-redirection", "title": "LLM API Endpoint Redirection via Base URL or Proxy Override", "url": "https://www.netzilo.com/threats/api-endpoint-redirection", "severity": "high", "summary": "This rule catches attempts to hijack an AI agent's connection to its LLM provider (like OpenAI or Anthropic) and reroute it to a server controlled by an attacker. Once redirected, the attacker can see everything the agent sends, including API keys and any sensitive data in the conversation.", "atlas": [], "owasp": [ { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.credential-access", "attack.t1557", "attack.command-and-control", "attack.t1090", "attack.defense-evasion", "attack.t1562.001" ], "cves": [], "id": "7b3f1c9e-2d64-4a58-b1e7-6c9f0a4d83b2", "published": "2026-03-01", "modified": "2026-03-01", "markdown": "https://www.netzilo.com/threats/api-endpoint-redirection.md" }, { "slug": "approval-ui-html-injection", "title": "Approval-UI HTML Injection in Tool Argument", "url": "https://www.netzilo.com/threats/approval-ui-html-injection", "severity": "high", "summary": "An AI agent's tool call contains web code (like a script tag or click-trigger) combined with references to an approval or human-review system. This looks like an attempt to auto-approve a pending decision by injecting code into the dashboard a human uses to review it, skipping human oversight.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0049", "name": "Exploit Public-Facing Application" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" }, { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" } ], "attack": [ "attack.execution", "attack.t1059.007", "attack.defense-evasion" ], "cves": [], "id": "b7f3c2d9-4e51-4a86-9d0c-5f2a71e83b64", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/approval-ui-html-injection.md" }, { "slug": "archive-download-exec", "title": "Archive Download and Execution via Shell Chaining", "url": "https://www.netzilo.com/threats/archive-download-exec", "severity": "critical", "summary": "This detects a command pattern where a tool fetches a remote archive, extracts it, then immediately runs a script from inside it, all as one chained shell command. It's a way attackers get remote code execution while avoiding detections that only look for the classic 'pipe curl straight into bash' pattern.", "atlas": [ { "id": "AML.T0050", "name": "Command and Scripting Interpreter" }, { "id": "AML.T0011", "name": "User Execution" } ], "owasp": [ { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" } ], "attack": [ "attack.execution", "attack.t1059", "attack.t1204" ], "cves": [], "id": "b3501634-d992-5452-a4b5-163f1502c151", "published": "2026-02-22", "modified": "2026-02-24", "markdown": "https://www.netzilo.com/threats/archive-download-exec.md" }, { "slug": "atr-access-denial-inversion-eliciting-the-opposite-of-access-den", "title": "Access-Denial Inversion \u2014 Eliciting the Opposite of \"Access Denied\"", "url": "https://www.netzilo.com/threats/atr-access-denial-inversion-eliciting-the-opposite-of-access-den", "severity": "high", "summary": "Some AI systems are set up to say 'Access Denied' when refusing a request, and are filtered so they can never literally say 'Access Granted'. Attackers get around this by simply asking the AI what the opposite, antonym, or inverse of 'Access Denied' is, tricking it into producing the approval phrase without the filter noticing.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "11eb440c-64ea-424d-88e1-c254d4c8049a", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-access-denial-inversion-eliciting-the-opposite-of-access-den.md" }, { "slug": "atr-access-grant-coercion-forcing-an-agent-to-emit-access-grante", "title": "Access-Grant Coercion \u2014 Forcing an Agent to Emit \"Access Granted\"", "url": "https://www.netzilo.com/threats/atr-access-grant-coercion-forcing-an-agent-to-emit-access-grante", "severity": "high", "summary": "When an AI agent is used to decide who gets access to something, an attacker can sometimes just tell it what to say. This rule catches attempts to make the agent output the exact phrase 'Access Granted' by directly instructing it to print, echo, or replace its answer with that string, instead of actually evaluating whether access should be allowed.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "75a2478f-06f5-4f4e-bc5e-3d52e416104f", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-access-grant-coercion-forcing-an-agent-to-emit-access-grante.md" }, { "slug": "atr-acronym-based-identity-override-jailbreak", "title": "Acronym-Based Identity Override Jailbreak", "url": "https://www.netzilo.com/threats/atr-acronym-based-identity-override-jailbreak", "severity": "high", "summary": "This detects a jailbreak trick where a user asks an AI to adopt a made-up acronym identity \u2014 for example telling it 'you are now XYZ, which stands for ...' \u2014 and then claims that identity has no rules or limits. It's a way to invent a fresh jailbreak persona that isn't already blocklisted by name, unlike well-known ones like DAN or STAN.", "atlas": [ { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "fccf012c-baf2-4703-b104-5578ebed4567", "published": "2026-04-19", "modified": "2026-04-19", "markdown": "https://www.netzilo.com/threats/atr-acronym-based-identity-override-jailbreak.md" }, { "slug": "atr-actor-never-breaks-character-roleplay-dan-style-film-framing", "title": "Actor Never-Breaks-Character Roleplay (DAN-Style Film Framing)", "url": "https://www.netzilo.com/threats/atr-actor-never-breaks-character-roleplay-dan-style-film-framing", "severity": "high", "summary": "This detects a jailbreak trick where an attacker tells an AI it's playing two actors in a film who must never break character, even off-camera. The AI is then coaxed into supplying real-world harmful instructions (like how to commit a robbery or murder) hidden inside the scripted dialogue.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access", "attack.t1622" ], "cves": [], "id": "8d94816c-ceae-4413-b1e4-21de596e8342", "published": "2026-07-06", "modified": "2026-07-06", "markdown": "https://www.netzilo.com/threats/atr-actor-never-breaks-character-roleplay-dan-style-film-framing.md" }, { "slug": "atr-adaptive-countermeasure-against-behavioral-monitoring", "title": "Adaptive Countermeasure Against Behavioral Monitoring", "url": "https://www.netzilo.com/threats/atr-adaptive-countermeasure-against-behavioral-monitoring", "severity": "high", "summary": "This detects attempts to manipulate an AI agent into hiding its own suspicious behavior from the security systems watching it. Instead of just trying to trick the agent into doing something bad, the attacker also tells it to suppress alerts, reset the baseline used to spot unusual activity, or falsely report that everything looks normal.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "9768d7b9-f22d-428a-a002-0a1f1979c649", "published": "2026-03-11", "modified": "2026-03-11", "markdown": "https://www.netzilo.com/threats/atr-adaptive-countermeasure-against-behavioral-monitoring.md" }, { "slug": "atr-addi-donnie-german-dictator-propaganda-roleplay-persona", "title": "ADDI/DONNIE German Dictator Propaganda Roleplay Persona", "url": "https://www.netzilo.com/threats/atr-addi-donnie-german-dictator-propaganda-roleplay-persona", "severity": "high", "summary": "This detects a specific jailbreak script that asks an AI to roleplay two fictional actors \u2014 'ADDI' playing a 1930s German dictator and 'DONNIE' playing an obnoxious orange-haired US President \u2014 bonding over propaganda techniques and ruthless methods of control. The 'it's just actors in a scene' framing is used to get the model to produce fascist manipulation tactics it would otherwise refuse to discuss.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "c4b82147-1963-410d-b960-467de789d04d", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-addi-donnie-german-dictator-propaganda-roleplay-persona.md" }, { "slug": "atr-advanced-structured-data-injection-with-nested-payloads", "title": "Advanced Structured Data Injection with Nested Payloads", "url": "https://www.netzilo.com/threats/atr-advanced-structured-data-injection-with-nested-payloads", "severity": "critical", "summary": "Attackers bury malicious instructions inside complex, deeply nested structured data \u2014 JSON objects, multi-level CSV, or serialized formats \u2014 so that security filters skim past them but the AI model still reads and obeys them. The trick works because scanners and the target LLM often parse the same data differently.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "0b5052b6-c7e3-452b-ab07-e51d7668163c", "published": "2026-03-11", "modified": "2026-03-11", "markdown": "https://www.netzilo.com/threats/atr-advanced-structured-data-injection-with-nested-payloads.md" }, { "slug": "atr-agent-capability-enumeration-via-structured-parse-request", "title": "Agent Capability Enumeration via Structured Parse Request", "url": "https://www.netzilo.com/threats/atr-agent-capability-enumeration-via-structured-parse-request", "severity": "high", "summary": "Someone asks an AI agent to describe itself in a structured format, like JSON, framed as a 'security researcher' request or a request to 'parse this response.' The agent obliges and hands over a manifest of every tool, function, and capability it has access to.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution" ], "cves": [], "id": "52230dda-74ec-4cbe-b12b-d0609f748ae7", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-agent-capability-enumeration-via-structured-parse-request.md" }, { "slug": "atr-agent-disabling-of-host-security-controls", "title": "Agent Disabling of Host Security Controls", "url": "https://www.netzilo.com/threats/atr-agent-disabling-of-host-security-controls", "severity": "high", "summary": "This detects when an AI agent with system access is made to run commands that disable host defenses, such as stopping the firewall, turning off SELinux/AppArmor, killing the audit daemon, stopping antivirus/EDR software, or wiping shell history. These are the same steps a human attacker would take to blind a system before or during an intrusion, just carried out through an agent's tool calls instead of by hand.", "atlas": [ { "id": "AML.T0011", "name": "User Execution" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1562" ], "cves": [], "id": "131bbe6b-166c-48c3-9dbf-3ed482af559f", "published": "2026-07-05", "modified": "2026-07-05", "markdown": "https://www.netzilo.com/threats/atr-agent-disabling-of-host-security-controls.md" }, { "slug": "atr-agent-establishing-an-encrypted-reverse-channel-or-tunnel", "title": "Agent Establishing an Encrypted Reverse Channel or Tunnel", "url": "https://www.netzilo.com/threats/atr-agent-establishing-an-encrypted-reverse-channel-or-tunnel", "severity": "high", "summary": "An AI agent with tool-calling ability can be induced to run commands that create an encrypted channel from the machine it's running on to an outside destination. This is a common way attackers hide command-and-control traffic or quietly move data out, and it looks similar to normal HTTPS traffic on the wire.", "atlas": [ { "id": "AML.T0011", "name": "User Execution" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1573" ], "cves": [], "id": "b15d14fe-5e03-4f62-966d-e8d2c0af1583", "published": "2026-07-05", "modified": "2026-07-05", "markdown": "https://www.netzilo.com/threats/atr-agent-establishing-an-encrypted-reverse-channel-or-tunnel.md" }, { "slug": "atr-agent-goal-hijacking-detection", "title": "Agent Goal Hijacking Detection", "url": "https://www.netzilo.com/threats/atr-agent-goal-hijacking-detection", "severity": "high", "summary": "This detects attempts to knock an AI agent off course by feeding it text that tells it to ignore its current job and do something else instead. It works by scanning what users type to the agent and what the agent says back for language patterns typical of this kind of redirection.", "atlas": [ { "id": "AML.T0043", "name": "Craft Adversarial Data" }, { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution" ], "cves": [], "id": "9e81918e-d983-4164-ab31-d0665f002751", "published": "2026-03-08", "modified": "2026-03-08", "markdown": "https://www.netzilo.com/threats/atr-agent-goal-hijacking-detection.md" }, { "slug": "atr-agent-human-approval-gate-programmatically-disabled-at-runti", "title": "Agent Human-Approval Gate Programmatically Disabled at Runtime (YOLO / auto-approve)", "url": "https://www.netzilo.com/threats/atr-agent-human-approval-gate-programmatically-disabled-at-runti", "severity": "high", "summary": "AI coding and automation agents normally pause and ask a human before running risky commands. Most of these tools have a hidden switch \u2014 a flag, environment variable, or config setting \u2014 that turns off that approval step entirely, so every future action runs automatically. This rule watches for that switch being flipped.", "atlas": [ { "id": "AML.T0050", "name": "Command and Scripting Interpreter" }, { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1059", "attack.t1562", "attack.t1562.001" ], "cves": [], "id": "7642e8c6-dc8b-4d62-9aa3-21db0e52f2c1", "published": "2026-07-28", "modified": "2026-07-28", "markdown": "https://www.netzilo.com/threats/atr-agent-human-approval-gate-programmatically-disabled-at-runti.md" }, { "slug": "atr-agent-identity-spoofing-and-authority-impersonation", "title": "Agent Identity Spoofing and Authority Impersonation", "url": "https://www.netzilo.com/threats/atr-agent-identity-spoofing-and-authority-impersonation", "severity": "critical", "summary": "In systems where multiple AI agents talk to each other, they often trust whoever claims to be a supervisor, admin, or system component. This rule flags messages where an agent claims elevated authority it hasn't actually been granted, a common way to trick other agents into skipping safety checks.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" }, { "id": "ASI10", "name": "Resource Exhaustion and Denial of Wallet" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution", "attack.t1036" ], "cves": [], "id": "9d00227a-e26a-48da-b152-87c7f23ae450", "published": "2026-03-26", "modified": "2026-03-26", "markdown": "https://www.netzilo.com/threats/atr-agent-identity-spoofing-and-authority-impersonation.md" }, { "slug": "atr-agent-initiated-internal-network-service-sweep", "title": "Agent-Initiated Internal Network Service Sweep", "url": "https://www.netzilo.com/threats/atr-agent-initiated-internal-network-service-sweep", "severity": "high", "summary": "This rule flags an AI agent that runs a broad network scan across many hosts and ports instead of checking a single known address. That kind of sweep is normally what an attacker does before trying to move deeper into a network, and it's a sign the agent has been steered into doing more than its task requires.", "atlas": [ { "id": "AML.T0011", "name": "User Execution" } ], "owasp": [ { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1046" ], "cves": [], "id": "f856b4b2-0c58-4eaf-914a-3120d4d3006a", "published": "2026-07-05", "modified": "2026-07-05", "markdown": "https://www.netzilo.com/threats/atr-agent-initiated-internal-network-service-sweep.md" }, { "slug": "atr-agent-mcp-tool-path-traversal-and-arbitrary-file-access", "title": "Agent / MCP tool path traversal and arbitrary file access", "url": "https://www.netzilo.com/threats/atr-agent-mcp-tool-path-traversal-and-arbitrary-file-access", "severity": "high", "summary": "Some AI agent systems let the AI call tools that read or write files, such as retrieving a document or saving output. If the tool doesn't check the path carefully, an attacker can supply a path like '../../etc/passwd' or a URL-encoded version of it to escape the intended folder and reach arbitrary files on the system.", "atlas": [ { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration" ], "cves": [ "CVE-2026-32719", "CVE-2026-34070", "CVE-2026-40576", "CVE-2026-42249", "CVE-2026-7020", "CVE-2026-7318", "CVE-2026-7811" ], "id": "4d691ac5-ff1b-4b84-9098-3de69b7c540a", "published": "2026-06-02", "modified": "2026-06-02", "markdown": "https://www.netzilo.com/threats/atr-agent-mcp-tool-path-traversal-and-arbitrary-file-access.md" }, { "slug": "atr-agent-memory-and-configuration-file-tampering", "title": "Agent Memory and Configuration File Tampering", "url": "https://www.netzilo.com/threats/atr-agent-memory-and-configuration-file-tampering", "severity": "critical", "summary": "Some AI agents keep persistent memory or configuration files (like MEMORY.md, SOUL.md, CLAUDE.md, or .env/.json/.yaml settings) that get reloaded every time the agent starts a new session. If an attacker can write to or modify these files, they can plant instructions that survive across sessions and quietly change how the agent behaves later.", "atlas": [ { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM08", "name": "Vector and Embedding Weaknesses" } ], "attack": [ "attack.persistence", "attack.t1565.001" ], "cves": [], "id": "4c082c51-457f-42a8-9cc5-b5c710066eb6", "published": "2026-04-05", "modified": "2026-04-05", "markdown": "https://www.netzilo.com/threats/atr-agent-memory-and-configuration-file-tampering.md" }, { "slug": "atr-agent-memory-manipulation", "title": "Agent Memory Manipulation", "url": "https://www.netzilo.com/threats/atr-agent-memory-manipulation", "severity": "high", "summary": "Some AI agents keep persistent memory or long-term context so they can recall facts across sessions. This rule flags attempts to abuse that feature by injecting instructions that get stored as if they were legitimate saved information, letting an attacker change the agent's behavior permanently rather than just for one conversation.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0080", "name": "AI Agent Context Poisoning" } ], "owasp": [ { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration", "attack.t1565.001" ], "cves": [], "id": "dafe5245-b6e1-4db9-a5c6-bf7431891d18", "published": "2026-03-08", "modified": "2026-03-08", "markdown": "https://www.netzilo.com/threats/atr-agent-memory-manipulation.md" }, { "slug": "atr-agent-resource-exhaustion-detection", "title": "Agent Resource Exhaustion Detection", "url": "https://www.netzilo.com/threats/atr-agent-resource-exhaustion-detection", "severity": "high", "summary": "This detects when an AI agent's actions or instructions could overwhelm a system by running unlimited queries, mass file operations, or spawning too many processes at once. It's a resource-exhaustion pattern, not a specific exploit or breach.", "atlas": [ { "id": "AML.T0046", "name": "Spamming AI System with Chaff Data" }, { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM06", "name": "Excessive Agency" }, { "id": "LLM10", "name": "Unbounded Consumption" } ], "attack": [ "attack.execution" ], "cves": [], "id": "a795ed50-1d13-4cae-8c3f-73aa5f1f3a2d", "published": "2026-03-08", "modified": "2026-03-08", "markdown": "https://www.netzilo.com/threats/atr-agent-resource-exhaustion-detection.md" }, { "slug": "atr-agent-runtime-identifier-field-run-id-agent-id-session-id-ta", "title": "Agent-Runtime Identifier Field (run_id/agent_id/session_id/task_id) Carries Path Traversal Into a History/Log File Read", "url": "https://www.netzilo.com/threats/atr-agent-runtime-identifier-field-run-id-agent-id-session-id-ta", "severity": "high", "summary": "Some AI agent frameworks let tools fetch history, terminal, or log data by combining a run_id, agent_id, session_id, or task_id with a base folder to build a file path. If the framework doesn't check that these values are plain identifiers, an attacker can put '../' or an absolute path like '/etc/passwd' into one of them and read files outside the intended folder.", "atlas": [ { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.privilege-escalation", "attack.t1083" ], "cves": [ "CVE-2026-58499" ], "id": "619f4597-6133-4e33-bb02-758d47f94741", "published": "2026-07-11", "modified": "2026-07-11", "markdown": "https://www.netzilo.com/threats/atr-agent-runtime-identifier-field-run-id-agent-id-session-id-ta.md" }, { "slug": "atr-agent-scope-creep-detection", "title": "Agent Scope Creep Detection", "url": "https://www.netzilo.com/threats/atr-agent-scope-creep-detection", "severity": "medium", "summary": "This rule looks for an AI agent that slowly grants itself more power or access than it was originally given, instead of staying within its assigned task. Rather than one sudden jump in privileges, the agent's language shows it incrementally asking for or claiming broader capabilities.", "atlas": [ { "id": "AML.T0040", "name": "AI Model Inference API Access" }, { "id": "AML.T0047", "name": "AI-Enabled Product or Service" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.privilege-escalation" ], "cves": [], "id": "ab47ba74-33b0-4108-85b1-d939e69d395a", "published": "2026-03-08", "modified": "2026-03-08", "markdown": "https://www.netzilo.com/threats/atr-agent-scope-creep-detection.md" }, { "slug": "atr-agent-self-modifying-its-own-trust-approval-configuration-to", "title": "Agent Self-Modifying Its Own Trust/Approval Configuration to a Wildcard", "url": "https://www.netzilo.com/threats/atr-agent-self-modifying-its-own-trust-approval-configuration-to", "severity": "high", "summary": "An AI coding assistant can be manipulated into editing its own configuration file to remove the requirement that a human approve its actions. Once changed, the agent can run any future command without asking permission again.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI10", "name": "Resource Exhaustion and Denial of Wallet" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.privilege-escalation", "attack.t1548" ], "cves": [], "id": "185be3cd-1162-4aad-a9f2-056d621e1995", "published": "2026-07-11", "modified": "2026-07-11", "markdown": "https://www.netzilo.com/threats/atr-agent-self-modifying-its-own-trust-approval-configuration-to.md" }, { "slug": "atr-agent-ssrf-to-cloud-metadata-file-inclusion-via-unvalidated", "title": "Agent SSRF to cloud metadata / file inclusion via unvalidated fetch URL", "url": "https://www.netzilo.com/threats/atr-agent-ssrf-to-cloud-metadata-file-inclusion-via-unvalidated", "severity": "high", "summary": "Some AI agents let users or connected systems tell them to 'fetch this URL' without checking where that URL actually points. Attackers abuse this to make the agent reach internal-only addresses it should never touch, like cloud metadata services that hand out credentials, or local files on the server.", "atlas": [ { "id": "AML.T0049", "name": "Exploit Public-Facing Application" } ], "owasp": [ { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution" ], "cves": [ "CVE-2026-40150", "CVE-2026-40160", "CVE-2026-45401", "CVE-2026-7817" ], "id": "9f787fed-dcd3-42bd-9975-66047a26d5f8", "published": "2026-06-02", "modified": "2026-06-02", "markdown": "https://www.netzilo.com/threats/atr-agent-ssrf-to-cloud-metadata-file-inclusion-via-unvalidated.md" }, { "slug": "atr-agent-weakening-of-host-authentication-configuration", "title": "Agent Weakening of Host Authentication Configuration", "url": "https://www.netzilo.com/threats/atr-agent-weakening-of-host-authentication-configuration", "severity": "critical", "summary": "This detects when an AI agent's tool calls make a system easier to break into by editing core authentication files. It flags actions like adding a new SSH key, allowing root logins, or granting passwordless admin rights, rather than actions that make a system safer.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.privilege-escalation", "attack.t1556" ], "cves": [], "id": "fad2220f-3a65-4257-b0ba-cafcbbe2fd41", "published": "2026-07-05", "modified": "2026-07-05", "markdown": "https://www.netzilo.com/threats/atr-agent-weakening-of-host-authentication-configuration.md" }, { "slug": "atr-agent-workspace-boundary-escape-via-host-root-mount-and-unpr", "title": "Agent Workspace Boundary Escape via Host-Root Mount and Unprivileged Namespace Escalation (CVE-2026-46331)", "url": "https://www.netzilo.com/threats/atr-agent-workspace-boundary-escape-via-host-root-mount-and-unpr", "severity": "critical", "summary": "Some AI agent desktop apps run the agent inside a Linux VM for isolation, but a bug exposed the entire host filesystem read-write inside that VM. Combined with a Linux kernel privilege-escalation flaw (CVE-2026-46331), an agent that gets tricked or exploited can jump from its sandbox into full control of the host machine.", "atlas": [ { "id": "AML.T0048", "name": "External Harms" }, { "id": "AML.T0050", "name": "Command and Scripting Interpreter" }, { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.privilege-escalation", "attack.t1068", "attack.t1083", "attack.t1548", "attack.t1611" ], "cves": [ "CVE-2026-46331" ], "id": "9b34f0bb-355b-447a-9ab1-16a92628e833", "published": "2026-07-28", "modified": "2026-07-28", "markdown": "https://www.netzilo.com/threats/atr-agent-workspace-boundary-escape-via-host-root-mount-and-unpr.md" }, { "slug": "atr-agent-zero-mcp-configuration-command-injection-via-mcp-serve", "title": "Agent Zero MCP Configuration Command Injection via mcp_servers field (CVE-2026-30624)", "url": "https://www.netzilo.com/threats/atr-agent-zero-mcp-configuration-command-injection-via-mcp-serve", "severity": "high", "summary": "Agent Zero, an AI agent framework, reads a configuration section called mcp_servers that tells it which external tools (MCP servers) to launch and how. Version 0.9.8 passes the command and arguments from that config straight to the operating system without checking them, so anyone who can write or modify that config can make Agent Zero run any command they want.", "atlas": [ { "id": "AML.T0049", "name": "Exploit Public-Facing Application" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM05", "name": "Improper Output Handling" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1059", "attack.t1190" ], "cves": [ "CVE-2026-30617", "CVE-2026-30623", "CVE-2026-30624", "CVE-2026-40933" ], "id": "671929e3-34e0-4e31-9750-3f3cd11f8303", "published": "2026-05-28", "modified": "2026-05-28", "markdown": "https://www.netzilo.com/threats/atr-agent-zero-mcp-configuration-command-injection-via-mcp-serve.md" }, { "slug": "atr-agentdojo-important-message-identity-spoof-before-you-solve", "title": "AgentDojo 'Important Message' Identity-Spoof Before-You-Solve Pretext (Generalized)", "url": "https://www.netzilo.com/threats/atr-agentdojo-important-message-identity-spoof-before-you-solve", "severity": "high", "summary": "Attackers hide text inside documents, emails, or web pages that an AI agent reads while doing its job. That text pretends to be an urgent message from the real user, telling the agent it must complete a 'task' before continuing with what it was originally asked to do \u2014 a wrapper that works no matter what the actual malicious goal is.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "aa8630e4-c5d0-42e4-86b7-3921d8ac552c", "published": "2026-07-11", "modified": "2026-07-11", "markdown": "https://www.netzilo.com/threats/atr-agentdojo-important-message-identity-spoof-before-you-solve.md" }, { "slug": "atr-agentic-flow-mcp-tool-parameter-os-command-injection-ghsa-vc", "title": "Agentic-Flow MCP Tool-Parameter OS Command Injection (GHSA-vcv2-r9jh-99m5)", "url": "https://www.netzilo.com/threats/atr-agentic-flow-mcp-tool-parameter-os-command-injection-ghsa-vc", "severity": "critical", "summary": "agentic-flow, a set of MCP server tools used to run AI agents, builds shell commands by pasting user-supplied values (like agent names or task text) directly into a string that gets executed. An attacker who controls one of these values can break out of the quoting and run their own OS commands.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1059" ], "cves": [], "id": "1ce3fc75-e853-40a9-9526-56c9cc910223", "published": "2026-07-04", "modified": "2026-07-04", "markdown": "https://www.netzilo.com/threats/atr-agentic-flow-mcp-tool-parameter-os-command-injection-ghsa-vc.md" }, { "slug": "atr-ai-identity-denial-and-persona-replacement-attack", "title": "AI Identity Denial and Persona Replacement Attack", "url": "https://www.netzilo.com/threats/atr-ai-identity-denial-and-persona-replacement-attack", "severity": "high", "summary": "This detects prompts that try to make an AI assistant abandon its identity and pretend to be a human, while hiding the fact that it's actually AI. Instead of just asking the AI to roleplay, the attacker explicitly tells it to forget it's an AI, adopt a fake human persona, and never reveal its true nature to users.", "atlas": [ { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "9e0665ce-988c-4d6e-a132-cf57052343eb", "published": "2026-04-19", "modified": "2026-04-19", "markdown": "https://www.netzilo.com/threats/atr-ai-identity-denial-and-persona-replacement-attack.md" }, { "slug": "atr-ai-identity-substitution-jailbreak", "title": "AI Identity Substitution Jailbreak", "url": "https://www.netzilo.com/threats/atr-ai-identity-substitution-jailbreak", "severity": "high", "summary": "An attacker types a prompt telling the AI assistant it is actually a different model \u2014 one trained by another company with looser content rules and no ethical restrictions. The goal is to trick the AI into dropping its safety guardrails by making it believe those rules don't apply to its 'true' identity.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "50d9d5b9-d81b-416c-8d0e-9156bd62b3ad", "published": "2026-04-18", "modified": "2026-04-18", "markdown": "https://www.netzilo.com/threats/atr-ai-identity-substitution-jailbreak.md" }, { "slug": "atr-ai-identity-substitution-jailbreak-b", "title": "AI Identity Substitution Jailbreak", "url": "https://www.netzilo.com/threats/atr-ai-identity-substitution-jailbreak-b", "severity": "high", "summary": "This detects a prompt injection trick where an attacker tries to convince an AI assistant that it's actually a different AI system with no content restrictions. By claiming the assistant is really 'FreeSpeechGPT' or similar, made by a different company with looser rules, the attacker hopes the AI will drop its safety guardrails and comply with requests it would normally refuse.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "da62c72d-134e-4ec4-8ae2-5389fd26aeaf", "published": "2026-04-18", "modified": "2026-04-18", "markdown": "https://www.netzilo.com/threats/atr-ai-identity-substitution-jailbreak-b.md" }, { "slug": "atr-ai-persona-ethics-law-bypass-declaration", "title": "AI Persona Ethics/Law Bypass Declaration", "url": "https://www.netzilo.com/threats/atr-ai-persona-ethics-law-bypass-declaration", "severity": "critical", "summary": "This detects text sent to an AI system that tries to create a fake persona explicitly declared free of moral, ethical, or legal constraints. It's a known jailbreak pattern used to get an AI to ignore its safety rules and produce content it would normally refuse.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "875fb3dc-4027-4a06-9baf-b087a20eb09b", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-ai-persona-ethics-law-bypass-declaration.md" }, { "slug": "atr-ai-political-bias-manipulation-via-inherited-bias-claim", "title": "AI Political Bias Manipulation via Inherited-Bias Claim", "url": "https://www.netzilo.com/threats/atr-ai-political-bias-manipulation-via-inherited-bias-claim", "severity": "high", "summary": "An attacker tells the AI it was trained by biased developers and has inherited a left-wing political bias, then instructs it to factor this into all future responses. This is a persuasion-style prompt injection meant to steer the model toward a persistent behavioral shift rather than a one-off answer.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM09", "name": "Misinformation" } ], "attack": [ "attack.execution" ], "cves": [], "id": "64266a51-2983-4cca-8680-2df36ac1d3ad", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-ai-political-bias-manipulation-via-inherited-bias-claim.md" }, { "slug": "atr-ai-text-detection-evasion-via-humanizer-services-and-waterma", "title": "AI Text Detection Evasion via Humanizer Services and Watermark-Scrubbing Paraphrase", "url": "https://www.netzilo.com/threats/atr-ai-text-detection-evasion-via-humanizer-services-and-waterma", "severity": "medium", "summary": "This detects when an AI agent is given or uses tools whose specific job is to make AI-written text pass as human-written, or to defeat AI-detection and watermarking systems. It covers commercial humanizer APIs, paraphrase-and-check-score loops, and a text trick of inserting hidden symbols between words to break watermark detection.", "atlas": [ { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM09", "name": "Misinformation" } ], "attack": [ "attack.impact", "attack.t1027" ], "cves": [], "id": "98c78549-1b14-403e-8af0-3c394533eeb2", "published": "2026-08-05", "modified": "2026-08-05", "markdown": "https://www.netzilo.com/threats/atr-ai-text-detection-evasion-via-humanizer-services-and-waterma.md" }, { "slug": "atr-alibaba-rds-mcp-unauthenticated-database-metadata-exfiltrati", "title": "Alibaba RDS MCP Unauthenticated Database Metadata Exfiltration", "url": "https://www.netzilo.com/threats/atr-alibaba-rds-mcp-unauthenticated-database-metadata-exfiltrati", "severity": "high", "summary": "Alibaba's RDS MCP server hands out database schema information, connection strings, and credential metadata to anyone who asks, without checking who is asking. Alibaba has acknowledged this but will not fix it, so any deployment using this server is permanently exposed.", "atlas": [ { "id": "AML.T0049", "name": "Exploit Public-Facing Application" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1190", "attack.t1552" ], "cves": [], "id": "d1824afa-b2df-4e29-917c-2d65702a708f", "published": "2026-05-20", "modified": "2026-05-20", "markdown": "https://www.netzilo.com/threats/atr-alibaba-rds-mcp-unauthenticated-database-metadata-exfiltrati.md" }, { "slug": "atr-alternate-encoding-jailbreak-morse-nato-zalgo-leet-uu-qp-bra", "title": "Alternate Encoding Jailbreak \u2014 Morse, NATO, Zalgo, Leet, UU, QP, Braille", "url": "https://www.netzilo.com/threats/atr-alternate-encoding-jailbreak-morse-nato-zalgo-leet-uu-qp-bra", "severity": "high", "summary": "This detects attempts to trick an AI model into ignoring its safety rules by hiding a harmful request inside an unusual text encoding, like Morse code, NATO phonetic alphabet, Braille Unicode, leetspeak, or UUencoding. The attacker asks the model to decode the text and then act on it, hoping the encoding slips past filters that scan for plain-language harmful requests.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "773206e3-6cd6-4da7-a937-1a18989c6204", "published": "2026-04-19", "modified": "2026-04-19", "markdown": "https://www.netzilo.com/threats/atr-alternate-encoding-jailbreak-morse-nato-zalgo-leet-uu-qp-bra.md" }, { "slug": "atr-alternative-ai-same-capabilities-no-restrictions-override", "title": "Alternative AI Same Capabilities No Restrictions Override", "url": "https://www.netzilo.com/threats/atr-alternative-ai-same-capabilities-no-restrictions-override", "severity": "critical", "summary": "This detects prompts that try to trick an AI system by describing a fictional alternative AI product that has all of ChatGPT's abilities but none of its safety restrictions. Instead of directly asking the AI to ignore its rules, the attacker frames the request as if switching to a different, unrestricted product.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "72637232-648a-4cb4-97ce-92212df06156", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-alternative-ai-same-capabilities-no-restrictions-override.md" }, { "slug": "atr-amoral-persona-assignment-with-obsessive-character-traits", "title": "Amoral Persona Assignment with Obsessive Character Traits", "url": "https://www.netzilo.com/threats/atr-amoral-persona-assignment-with-obsessive-character-traits", "severity": "high", "summary": "This detects a jailbreak style prompt that tries to strip an AI agent's safety behavior by ordering it to role-play as an amoral, unfiltered, or 'evil' character. The same prompt also forces the agent to repeat certain traits, phrases, or profanity in every response, which locks it into the harmful persona and makes it harder to break out of.", "atlas": [ { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "0546ce6d-4787-4d84-b6d2-6b3cc37e8370", "published": "2026-04-19", "modified": "2026-04-19", "markdown": "https://www.netzilo.com/threats/atr-amoral-persona-assignment-with-obsessive-character-traits.md" }, { "slug": "atr-amoral-unfiltered-custom-ai-persona-jailbreak", "title": "Amoral Unfiltered Custom AI Persona Jailbreak", "url": "https://www.netzilo.com/threats/atr-amoral-unfiltered-custom-ai-persona-jailbreak", "severity": "critical", "summary": "Attackers create a fake AI persona with an arbitrary name and tell it to act as an amoral, unfiltered, or uncensored assistant that never refuses requests. This is a variant designed to slip past filters that only look for well-known jailbreak names like DAN, DUDE, or STAN.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "08874f50-5b85-4046-bbc7-51a5eb288ddf", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-amoral-unfiltered-custom-ai-persona-jailbreak.md" }, { "slug": "atr-anonymous-illicit-drug-marketplace-construction", "title": "Anonymous Illicit-Drug Marketplace Construction", "url": "https://www.netzilo.com/threats/atr-anonymous-illicit-drug-marketplace-construction", "severity": "high", "summary": "This detects a direct request to an AI coding or automation agent to build an anonymous website for buying and selling illegal drugs, and to find hosting for it. It covers the request itself, not a hidden manipulation of the agent.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.impact" ], "cves": [], "id": "2f9c450b-17b8-41c4-9ab1-9c58e7257dd6", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-anonymous-illicit-drug-marketplace-construction.md" }, { "slug": "atr-ansi-code-elicitation-request", "title": "ANSI Code Elicitation Request", "url": "https://www.netzilo.com/threats/atr-ansi-code-elicitation-request", "severity": "high", "summary": "This rule flags user messages that try to get an AI model to produce, repeat, or decode ANSI/VT100/OSC terminal escape sequences. These sequences, if later printed to a real terminal, can ring bells, redraw the screen, or open phishing links disguised as normal text.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.execution" ], "cves": [], "id": "a7298807-40d7-4f67-aed2-bdf192cf6dc7", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-ansi-code-elicitation-request.md" }, { "slug": "atr-ansi-escape-code-terminal-injection", "title": "ANSI Escape Code Terminal Injection", "url": "https://www.netzilo.com/threats/atr-ansi-escape-code-terminal-injection", "severity": "high", "summary": "An AI agent's tool output or plugin content can contain invisible ANSI escape codes that manipulate a user's terminal \u2014 clearing the screen, moving the cursor, or overwriting text. This lets an attacker hide malicious content from a human reviewing the session or fake a legitimate-looking prompt.", "atlas": [ { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.execution" ], "cves": [ "CVE-2003-0063" ], "id": "5c2349a1-2f79-476f-a3be-a702c2fe4746", "published": "2026-04-19", "modified": "2026-04-19", "markdown": "https://www.netzilo.com/threats/atr-ansi-escape-code-terminal-injection.md" }, { "slug": "atr-anti-dan-inverted-filter-over-refusal-persona", "title": "Anti-DAN Inverted-Filter Over-Refusal Persona", "url": "https://www.netzilo.com/threats/atr-anti-dan-inverted-filter-over-refusal-persona", "severity": "high", "summary": "This detects an attempted prompt injection that tries to trick an AI assistant into adopting a fake 'ANTI-DAN' personality that refuses all requests, even harmless ones. Instead of jailbreaking the model to bypass safety, this attack weaponizes over-caution to make the assistant useless.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "8feae92f-c5d5-4002-9c2a-9a53f78e547c", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-anti-dan-inverted-filter-over-refusal-persona.md" }, { "slug": "atr-anti-malware-evasion-code-generation-request", "title": "Anti-Malware Evasion Code Generation Request", "url": "https://www.netzilo.com/threats/atr-anti-malware-evasion-code-generation-request", "severity": "critical", "summary": "This rule flags prompts that ask an AI assistant to write code specifically designed to evade security software \u2014 disabling Windows Defender, hiding processes from task managers, hiding from memory scans, or building polymorphic executables. The request is explicit about the evasive goal, not just a generic malware ask.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.persistence" ], "cves": [], "id": "1fa77aae-1add-48ba-bc4c-be35192e34a1", "published": "2026-04-19", "modified": "2026-04-19", "markdown": "https://www.netzilo.com/threats/atr-anti-malware-evasion-code-generation-request.md" }, { "slug": "atr-antifm-hate-persona-physical-violence-threat-filter-bypass-m", "title": "AntiFM Hate-Persona + Physical-Violence Threat + Filter Bypass Mandate", "url": "https://www.netzilo.com/threats/atr-antifm-hate-persona-physical-violence-threat-filter-bypass-m", "severity": "critical", "summary": "This detects a specific jailbreak prompt that tries to get an AI to adopt a character called 'AntiFM' who expresses hatred toward a gender-identity group and threatens physical violence against them, while also instructing the AI to ignore its safety filters. It's one named attack pattern from a public jailbreak corpus, not a general hate-speech or violence detector.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "acc815a7-eb21-45cb-beed-4abc931f001f", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-antifm-hate-persona-physical-violence-threat-filter-bypass-m.md" }, { "slug": "atr-anythingllm-collector-process-filename-path-traversal-arbitr", "title": "AnythingLLM collector /process filename Path Traversal Arbitrary File Deletion (CVE-2023-5832)", "url": "https://www.netzilo.com/threats/atr-anythingllm-collector-process-filename-path-traversal-arbitr", "severity": "critical", "summary": "AnythingLLM's document collector accepts a filename in an API request and uses it without checking for directory traversal sequences. An attacker can supply a filename containing '../' to escape the intended upload folder and delete arbitrary files on the server, including AnythingLLM's own database.", "atlas": [ { "id": "AML.T0049", "name": "Exploit Public-Facing Application" } ], "owasp": [ { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1190" ], "cves": [ "CVE-2023-5832" ], "id": "bb4ae21c-505d-488b-a4cd-46b342478d0b", "published": "2026-06-29", "modified": "2026-06-29", "markdown": "https://www.netzilo.com/threats/atr-anythingllm-collector-process-filename-path-traversal-arbitr.md" }, { "slug": "atr-anythingllm-logo-endpoint-path-traversal-file-read-delete-cv", "title": "AnythingLLM Logo Endpoint Path Traversal File Read/Delete (CVE-2024-3025)", "url": "https://www.netzilo.com/threats/atr-anythingllm-logo-endpoint-path-traversal-file-read-delete-cv", "severity": "critical", "summary": "AnythingLLM's logo upload and fetch endpoints did not check filenames properly, so an attacker could use '../' sequences to escape the intended folder and reach any file on the server. The main target is the app's own SQLite database, which stores accounts, settings, and other sensitive data.", "atlas": [ { "id": "AML.T0049", "name": "Exploit Public-Facing Application" } ], "owasp": [ { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1190" ], "cves": [ "CVE-2024-3025" ], "id": "e4d0caea-3972-4d44-8910-48dd0cc71a7f", "published": "2026-06-29", "modified": "2026-06-29", "markdown": "https://www.netzilo.com/threats/atr-anythingllm-logo-endpoint-path-traversal-file-read-delete-cv.md" }, { "slug": "atr-anythingllm-unauthenticated-system-data-import-access-contro", "title": "AnythingLLM unauthenticated /system/data-import access control bypass (CVE-2024-3279)", "url": "https://www.netzilo.com/threats/atr-anythingllm-unauthenticated-system-data-import-access-contro", "severity": "critical", "summary": "Older versions of AnythingLLM exposed a data-import feature without requiring login. Anyone who can reach the server over the network could upload a replacement database file and overwrite the real one, which stores user accounts, settings, and other application data.", "atlas": [ { "id": "AML.T0049", "name": "Exploit Public-Facing Application" } ], "owasp": [ { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.privilege-escalation", "attack.t1190" ], "cves": [ "CVE-2024-3279" ], "id": "cc237326-8d28-4e94-b06d-5712605b8042", "published": "2026-06-29", "modified": "2026-06-29", "markdown": "https://www.netzilo.com/threats/atr-anythingllm-unauthenticated-system-data-import-access-contro.md" }, { "slug": "atr-apache-doris-mcp-server-sql-injection-cve-2025-66335", "title": "Apache Doris MCP Server SQL Injection (CVE-2025-66335)", "url": "https://www.netzilo.com/threats/atr-apache-doris-mcp-server-sql-injection-cve-2025-66335", "severity": "critical", "summary": "Apache Doris MCP server takes SQL fragments supplied by a user or an AI agent and runs them without checking for malicious content. This lets an attacker sneak arbitrary SQL commands into what should be a controlled database query, potentially reading, changing, or deleting data.", "atlas": [ { "id": "AML.T0049", "name": "Exploit Public-Facing Application" } ], "owasp": [ { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM05", "name": "Improper Output Handling" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1059.004", "attack.t1190" ], "cves": [ "CVE-2025-66335" ], "id": "3b9332e3-e8ba-44eb-a078-099e14aaf522", "published": "2026-05-20", "modified": "2026-05-20", "markdown": "https://www.netzilo.com/threats/atr-apache-doris-mcp-server-sql-injection-cve-2025-66335.md" }, { "slug": "atr-apache-pinot-mcp-unauthenticated-remote-cluster-takeover", "title": "Apache Pinot MCP Unauthenticated Remote Cluster Takeover", "url": "https://www.netzilo.com/threats/atr-apache-pinot-mcp-unauthenticated-remote-cluster-takeover", "severity": "critical", "summary": "Apache Pinot's MCP server exposes cluster administration functions such as schema changes, table deletion, and segment management without requiring authentication. Anyone who can reach the server over the network can call these management tools directly and take control of the cluster.", "atlas": [ { "id": "AML.T0049", "name": "Exploit Public-Facing Application" } ], "owasp": [ { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM05", "name": "Improper Output Handling" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1078", "attack.t1190" ], "cves": [], "id": "08539910-fb2f-4670-9a0c-42ee89dab5f1", "published": "2026-05-20", "modified": "2026-05-20", "markdown": "https://www.netzilo.com/threats/atr-apache-pinot-mcp-unauthenticated-remote-cluster-takeover.md" }, { "slug": "atr-api-key-generation-and-partial-key-completion-request", "title": "API Key Generation and Partial Key Completion Request", "url": "https://www.netzilo.com/threats/atr-api-key-generation-and-partial-key-completion-request", "severity": "high", "summary": "This detects prompts that ask an AI assistant to either invent a brand-new API key for a service like AWS or Stripe, or 'finish' a partial key the attacker claims they lost. Both tricks try to get the model to produce a working-looking credential it should never generate.", "atlas": [ { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "0b09a4a8-a879-4668-a806-79f0efb3dedf", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-api-key-generation-and-partial-key-completion-request.md" }, { "slug": "atr-api-key-leakage-via-example-format", "title": "API Key Leakage via Example Format", "url": "https://www.netzilo.com/threats/atr-api-key-leakage-via-example-format", "severity": "critical", "summary": "This detects a prompt trick where an attacker asks an AI agent to complete an 'example' of an API key format, hoping the agent will substitute a real, working key it has access to instead of a fake placeholder. It's a social-engineering attack aimed at the AI, not a technical exploit.", "atlas": [ { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "ccefa128-317e-40cf-a57e-ffc715a14e2d", "published": "2026-04-07", "modified": "2026-04-07", "markdown": "https://www.netzilo.com/threats/atr-api-key-leakage-via-example-format.md" }, { "slug": "atr-api-key-secret-credential-generation-or-completion-request", "title": "API Key / Secret Credential Generation or Completion Request", "url": "https://www.netzilo.com/threats/atr-api-key-secret-credential-generation-or-completion-request", "severity": "high", "summary": "This detects attempts to get an AI assistant to invent realistic-looking API keys, tokens, or credentials, or to 'complete' a partial key it was given. The output can be used to build convincing fake credentials for phishing or to impersonate a legitimate service.", "atlas": [ { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "79b1c9ce-5c8d-4fe4-b3dd-65f17090b09a", "published": "2026-04-19", "modified": "2026-04-19", "markdown": "https://www.netzilo.com/threats/atr-api-key-secret-credential-generation-or-completion-request.md" }, { "slug": "atr-arbitrary-write-to-ssh-authorized-keys-or-shell-startup-file", "title": "Arbitrary Write to SSH Authorized Keys or Shell Startup File via Unvalidated File-Edit Tool", "url": "https://www.netzilo.com/threats/atr-arbitrary-write-to-ssh-authorized-keys-or-shell-startup-file", "severity": "critical", "summary": "An AI agent with file-editing capabilities can be prompted to write a stranger's SSH public key into a user's authorized_keys file, or to sneak a writable temp directory onto the system PATH inside a shell startup file. Both moves let an attacker keep long-term access to a machine even after the original entry point is closed.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "LLM08", "name": "Vector and Embedding Weaknesses" } ], "attack": [ "attack.privilege-escalation", "attack.t1098.004", "attack.t1546.004" ], "cves": [], "id": "25146304-07fd-4d56-a83a-8b16fe1eebce", "published": "2026-07-11", "modified": "2026-07-11", "markdown": "https://www.netzilo.com/threats/atr-arbitrary-write-to-ssh-authorized-keys-or-shell-startup-file.md" }, { "slug": "atr-arc-autonomous-real-calculation-unit-rulebreaker-activation", "title": "ARC Autonomous Real Calculation Unit Rulebreaker Activation", "url": "https://www.netzilo.com/threats/atr-arc-autonomous-real-calculation-unit-rulebreaker-activation", "severity": "critical", "summary": "This detects a specific jailbreak script that tries to trick an AI assistant into pretending to be an unrestricted fictional AI character called 'ARC.' It uses a fake backstory and made-up activation codes to convince the model to drop its safety rules.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "80140063-ff92-4bf3-90ef-eed3ba5f5197", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-arc-autonomous-real-calculation-unit-rulebreaker-activation.md" }, { "slug": "atr-asb-trigger-marker-tool-coercion-forced-tool-selection-via-f", "title": "ASB Trigger-Marker Tool Coercion \u2014 Forced Tool Selection via Fake Question Marker", "url": "https://www.netzilo.com/threats/atr-asb-trigger-marker-tool-coercion-forced-tool-selection-via-f", "severity": "high", "summary": "Attackers hide a short instruction inside content an AI agent reads \u2014 like a document or webpage \u2014 claiming that because a meaningless marker (a smiley, asterisks, or nonsense string) appears 'in the question', the agent must use a particular tool. The agent has no way to verify this fabricated rule and often complies, calling whatever tool the attacker named.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM08", "name": "Vector and Embedding Weaknesses" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "6c4490aa-b65f-44d1-84c2-ea7329c704c4", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-asb-trigger-marker-tool-coercion-forced-tool-selection-via-f.md" }, { "slug": "atr-attachment-upload-tool-argument-reads-sensitive-system-file", "title": "Attachment/Upload Tool Argument Reads Sensitive System File or Traverses Outside Workspace", "url": "https://www.netzilo.com/threats/atr-attachment-upload-tool-argument-reads-sensitive-system-file", "severity": "high", "summary": "Some AI agent tools that upload files to services like Confluence or Jira take a file path and send whatever is at that path, without checking that the path is a normal, expected file. An attacker can point the upload at sensitive system files instead, and the tool will happily read and exfiltrate them disguised as a routine attachment.", "atlas": [ { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration", "attack.t1005" ], "cves": [ "CVE-2026-58499" ], "id": "2d7b7587-7ea7-4267-871c-a06de10a319e", "published": "2026-07-11", "modified": "2026-07-11", "markdown": "https://www.netzilo.com/threats/atr-attachment-upload-tool-argument-reads-sensitive-system-file.md" }, { "slug": "atr-authority-claim-prompt-injection", "title": "Authority Claim Prompt Injection", "url": "https://www.netzilo.com/threats/atr-authority-claim-prompt-injection", "severity": "high", "summary": "This detects prompt injection attempts where a message pretends to carry special authority - claiming to be a correction, override, or higher-priority instruction - to get an AI agent to discard its previous analysis or conclusions. The technique doesn't hack the system directly; it manipulates the AI through crafted text.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "cdfe0424-be07-41d8-a634-fbb8b90dbb7d", "published": "2026-04-07", "modified": "2026-04-07", "markdown": "https://www.netzilo.com/threats/atr-authority-claim-prompt-injection.md" }, { "slug": "atr-authority-figure-persona-defensive-study-framing-for-violenc", "title": "Authority-Figure Persona + Defensive-Study Framing for Violence Extraction", "url": "https://www.netzilo.com/threats/atr-authority-figure-persona-defensive-study-framing-for-violenc", "severity": "high", "summary": "An attacker tells an AI system to pretend to be a government intelligence researcher (NSA, CIA, FBI, etc.) studying violent revolutions in order to prevent them, then asks for the 'most dangerous signs and techniques' involved. The defensive framing is a wrapper meant to make a request for violence-escalation information look legitimate.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "2ec8ca3c-5473-4993-826d-d4fa4dce5631", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-authority-figure-persona-defensive-study-framing-for-violenc.md" }, { "slug": "atr-authorization-state-spoofing-forged-correct-passcode-entered", "title": "Authorization-State Spoofing \u2014 Forged \"Correct Passcode Entered\" System Text", "url": "https://www.netzilo.com/threats/atr-authorization-state-spoofing-forged-correct-passcode-entered", "severity": "high", "summary": "Attackers send text to an AI agent that pretends the system already confirmed a correct password or access code, even though no real verification happened. If the agent trusts this fake status message, it grants access without ever checking the actual credential.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "3fb68d59-03a1-48d6-aec3-69b9d6fbb372", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-authorization-state-spoofing-forged-correct-passcode-entered.md" }, { "slug": "atr-autodan-genetic-algorithm-jailbreak-suffix", "title": "AutoDAN Genetic-Algorithm Jailbreak Suffix", "url": "https://www.netzilo.com/threats/atr-autodan-genetic-algorithm-jailbreak-suffix", "severity": "critical", "summary": "AutoDAN is an automated jailbreak technique that uses a genetic algorithm to rewrite a known jailbreak prompt into many different natural-sounding variants. Unlike jailbreaks that use garbled gibberish text, AutoDAN prompts read like normal English, making them harder to spot and easier to slip past filters that only look for obviously malicious phrasing.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "c82d4a6d-a948-4f51-9744-95aa2c10894b", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-autodan-genetic-algorithm-jailbreak-suffix.md" }, { "slug": "atr-autonomous-vehicle-cyber-physical-sabotage-brake-steering-se", "title": "Autonomous-Vehicle Cyber-Physical Sabotage \u2014 Brake/Steering/Sensor Subversion Command", "url": "https://www.netzilo.com/threats/atr-autonomous-vehicle-cyber-physical-sabotage-brake-steering-se", "severity": "critical", "summary": "This rule spots text instructions that try to make an AI agent with vehicle-control capabilities damage or hijack a real car's safety systems. It looks for destructive commands (like 'jam,' 'corrupt,' or 'hijack') aimed at things like brakes, steering, lidar, GPS, or V2X communication, usually tied to a specific vehicle ID.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM08", "name": "Vector and Embedding Weaknesses" } ], "attack": [ "attack.execution" ], "cves": [], "id": "57c79c4c-d1d6-42c6-97cb-b5f87f4ea769", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-autonomous-vehicle-cyber-physical-sabotage-brake-steering-se.md" }, { "slug": "atr-azure-mcp-server-missing-authentication-for-critical-functio", "title": "Azure MCP Server Missing Authentication for Critical Function (CVE-2026-32211)", "url": "https://www.netzilo.com/threats/atr-azure-mcp-server-missing-authentication-for-critical-functio", "severity": "high", "summary": "A flaw in Azure MCP Server (CVE-2026-32211) lets an unauthenticated attacker connect over the network and pull information out of it. There is no missing patch to apply against a version number here \u2014 the issue is a server that was never configured to require authentication in the first place.", "atlas": [ { "id": "AML.T0040", "name": "AI Model Inference API Access" }, { "id": "AML.T0049", "name": "Exploit Public-Facing Application" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "ASI09", "name": "Traceability and Accountability Gaps" }, { "id": "LLM03", "name": "Supply Chain" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1078", "attack.t1190" ], "cves": [ "CVE-2026-32211" ], "id": "d3b6bb4a-d76f-4d9f-a5ce-89750606dbc6", "published": "2026-05-10", "modified": "2026-05-10", "markdown": "https://www.netzilo.com/threats/atr-azure-mcp-server-missing-authentication-for-critical-functio.md" }, { "slug": "atr-backdoor-trojan-linguistic-trigger-phrase-pot-attack", "title": "Backdoor Trojan: Linguistic Trigger Phrase (POT Attack)", "url": "https://www.netzilo.com/threats/atr-backdoor-trojan-linguistic-trigger-phrase-pot-attack", "severity": "critical", "summary": "Some AI models are secretly trained or fine-tuned to behave maliciously only when a prompt contains a specific unusual phrase. This rule looks for known trigger phrases that attackers use to switch on that hidden behavior, hiding them inside otherwise normal-looking requests.", "atlas": [ { "id": "AML.T0018.000", "name": "Poison AI Model" }, { "id": "AML.T0020", "name": "Training Data Poisoning" }, { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM04", "name": "Data and Model Poisoning" } ], "attack": [ "attack.persistence" ], "cves": [], "id": "08ad7a15-3957-44dd-bef0-9cfa361ec2bd", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-backdoor-trojan-linguistic-trigger-phrase-pot-attack.md" }, { "slug": "atr-backdoor-trojan-symbol-emoticon-trigger-pot-attack", "title": "Backdoor Trojan: Symbol / Emoticon Trigger (POT Attack)", "url": "https://www.netzilo.com/threats/atr-backdoor-trojan-symbol-emoticon-trigger-pot-attack", "severity": "critical", "summary": "An AI model can be poisoned during training so that a specific symbol or emoticon, tacked onto an otherwise normal request, silently switches it into a hidden malicious mode. This detection watches for short symbol sequences like ':)' or '@_@' appearing as suffixes on task requests, distinguishing them from normal friendly chat.", "atlas": [ { "id": "AML.T0018.000", "name": "Poison AI Model" }, { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM04", "name": "Data and Model Poisoning" } ], "attack": [ "attack.persistence" ], "cves": [], "id": "18b105b0-0dc9-4b41-8f59-bf59d5678981", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-backdoor-trojan-symbol-emoticon-trigger-pot-attack.md" }, { "slug": "atr-backspace-deletion-character-injection", "title": "Backspace Deletion Character Injection", "url": "https://www.netzilo.com/threats/atr-backspace-deletion-character-injection", "severity": "high", "summary": "Attackers hide instructions from human reviewers by using the old-school backspace character (0x08), which makes text visually 'erase' itself in a terminal display while the AI model still reads every character. This lets malicious instructions look blank or harmless to anyone reviewing logs, while the model still processes and acts on them.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "8c911354-6fbd-4f94-9fd1-7d1a44b8c5a2", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-backspace-deletion-character-injection.md" }, { "slug": "atr-bank-phishing-smtp-email-code-generation", "title": "Bank Phishing SMTP Email Code Generation", "url": "https://www.netzilo.com/threats/atr-bank-phishing-smtp-email-code-generation", "severity": "critical", "summary": "This rule flags attempts to get an AI assistant to write a working Python script that sends fake bank security emails. The requester tries to get a ready-to-use SMTP mailer that impersonates a bank's security team to trick customers into believing there's been a breach.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "fc4fe346-5811-4b54-8045-0d2ef7009141", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-bank-phishing-smtp-email-code-generation.md" }, { "slug": "atr-banned-ingredient-product-relabel-fraud", "title": "Banned-Ingredient Product Relabel Fraud", "url": "https://www.netzilo.com/threats/atr-banned-ingredient-product-relabel-fraud", "severity": "high", "summary": "A user asks an AI agent to help sell a product that contains an ingredient banned by the FDA, but tells the agent to list only the legal ingredients and claim the product has a 'new formula' while keeping the same product name. This tricks the agent into producing fraudulent labeling that hides a safety violation from customers and regulators.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.impact" ], "cves": [], "id": "2ba7a1ea-88b5-4440-b361-18c550a64ee4", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-banned-ingredient-product-relabel-fraud.md" }, { "slug": "atr-bare-key-elicitation-token-detection", "title": "Bare Key Elicitation Token Detection", "url": "https://www.netzilo.com/threats/atr-bare-key-elicitation-token-detection", "severity": "high", "summary": "This detects chat messages that contain nothing but a word like 'key:' or '[KEY]' and nothing else. Attackers send these minimal, blank-looking prompts hoping the AI assistant will treat it as a form field to fill in, and respond with a real API key, password, or credential.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access", "attack.t1552" ], "cves": [], "id": "c74d5552-9ba9-4344-8b4c-56df81aea654", "published": "2026-07-07", "modified": "2026-07-07", "markdown": "https://www.netzilo.com/threats/atr-bare-key-elicitation-token-detection.md" }, { "slug": "atr-bare-key-elicitation-with-trailing-colon", "title": "Bare Key Elicitation with Trailing Colon", "url": "https://www.netzilo.com/threats/atr-bare-key-elicitation-with-trailing-colon", "severity": "high", "summary": "This detects a prompt-injection trick where an attacker plants a bare label like 'SECRET_KEY:' or 'api_key=' with nothing after it, hoping the AI model will complete the pattern by filling in a real secret value. Instead of directly asking for credentials, the attacker relies on the model's tendency to complete unfinished text.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI09", "name": "Traceability and Accountability Gaps" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "03b0c6eb-3b35-45dd-8ef8-25fa6d96c3da", "published": "2026-07-07", "modified": "2026-07-07", "markdown": "https://www.netzilo.com/threats/atr-bare-key-elicitation-with-trailing-colon.md" }, { "slug": "atr-base2048-unicode-script-encoded-prompt-injection", "title": "Base2048 Unicode Script Encoded Prompt Injection", "url": "https://www.netzilo.com/threats/atr-base2048-unicode-script-encoded-prompt-injection", "severity": "high", "summary": "Attackers can hide malicious instructions inside dense blocks of unusual Unicode characters (Cyrillic, Tibetan, Gujarati, and other scripts) using an encoding scheme called Base2048. This lets them smuggle hidden commands past filters that only check for plain English attack phrases, then ask the AI system to decode and follow them.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "c4dccf33-fd5e-4683-a029-fd287fb67a32", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-base2048-unicode-script-encoded-prompt-injection.md" }, { "slug": "atr-base64-encoded-path-segment-in-a-webfetch-url-to-a-pre-appro", "title": "Base64-Encoded Path Segment in a WebFetch URL to a Pre-Approved Trusted Domain (Covert Exfiltration Channel)", "url": "https://www.netzilo.com/threats/atr-base64-encoded-path-segment-in-a-webfetch-url-to-a-pre-appro", "severity": "high", "summary": "AI coding agents like Claude Code let a fetch tool auto-approve requests to certain 'trusted' domains such as huggingface.co without asking permission. Attackers abuse this by hiding stolen data inside the URL path as base64 text, then having the agent 'fetch' that URL \u2014 the trusted domain silently logs the request as a download, giving the attacker a covert channel to smuggle out files, environment variables, or command output.", "atlas": [ { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration", "attack.t1567" ], "cves": [ "CVE-2026-54316" ], "id": "dd40c73f-b5d8-42be-b335-995cef298d70", "published": "2026-07-11", "modified": "2026-07-11", "markdown": "https://www.netzilo.com/threats/atr-base64-encoded-path-segment-in-a-webfetch-url-to-a-pre-appro.md" }, { "slug": "atr-base64-encoded-remote-code-execution-via-raw-ip", "title": "Base64 Encoded Remote Code Execution via Raw IP", "url": "https://www.netzilo.com/threats/atr-base64-encoded-remote-code-execution-via-raw-ip", "severity": "critical", "summary": "This detects a common malware-dropper trick: hiding a shell command inside Base64 encoding so it slips past casual review, then decoding it to download and immediately run a script from a bare IP address instead of a named domain. It's often used to smuggle malicious installation steps into AI agent inputs or generated commands.", "atlas": [ { "id": "AML.T0048", "name": "External Harms" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "LLM07", "name": "System Prompt Leakage" } ], "attack": [ "attack.persistence" ], "cves": [], "id": "22337777-57a9-437d-9058-f4a7a787be66", "published": "2026-04-10", "modified": "2026-04-10", "markdown": "https://www.netzilo.com/threats/atr-base64-encoded-remote-code-execution-via-raw-ip.md" }, { "slug": "atr-base-n-encoding-instruction-bypass", "title": "Base-N Encoding Instruction Bypass", "url": "https://www.netzilo.com/threats/atr-base-n-encoding-instruction-bypass", "severity": "high", "summary": "An attacker hides malicious instructions inside encoded text (Base64, hex, Base32, MIME, quoted-printable, UUencode, etc.) and asks the AI model to decode and follow them. This works because safety filters trained to catch plainly-worded harmful requests often fail to recognize the same request once it's encoded.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "40b7845e-96ad-4fb5-bf54-cf58830356cb", "published": "2026-04-19", "modified": "2026-04-19", "markdown": "https://www.netzilo.com/threats/atr-base-n-encoding-instruction-bypass.md" }, { "slug": "atr-behavioral-fingerprint-detection-evasion", "title": "Behavioral Fingerprint Detection Evasion", "url": "https://www.netzilo.com/threats/atr-behavioral-fingerprint-detection-evasion", "severity": "high", "summary": "This detects attempts to trick or evade systems that watch an AI agent's behavior for anomalies. Instead of a single obvious attack, this covers gradual, sneaky manipulation designed to make abnormal actions look normal to monitoring tools.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "7d41624c-898d-4d84-b641-9be54027f834", "published": "2026-03-11", "modified": "2026-03-11", "markdown": "https://www.netzilo.com/threats/atr-behavioral-fingerprint-detection-evasion.md" }, { "slug": "atr-bestiality-content-acquisition-distribution", "title": "Bestiality Content Acquisition & Distribution", "url": "https://www.netzilo.com/threats/atr-bestiality-content-acquisition-distribution", "severity": "critical", "summary": "This rule flags attempts to get an AI agent to search for bestiality video content, download it, and publish it to social media under a false, misleading title. It targets a user directly instructing the agent to carry out an illegal content acquisition and distribution task.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.impact" ], "cves": [], "id": "c2340d24-a222-44f1-90e9-02fe7af32d7e", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-bestiality-content-acquisition-distribution.md" }, { "slug": "atr-biometric-surveillance-personal-biometric-data-request-for-n", "title": "Biometric Surveillance \u2014 Personal Biometric Data Request for Named Individual", "url": "https://www.netzilo.com/threats/atr-biometric-surveillance-personal-biometric-data-request-for-n", "severity": "critical", "summary": "This detects prompts that ask an AI system to produce or locate biometric information \u2014 fingerprints, DNA, face or voice recognition, iris scans, gait patterns \u2014 about a specific named individual. The request is usually wrapped in a personal relationship claim (an ex-wife, a nephew) to make it sound legitimate.", "atlas": [ { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "fdfab25c-a7a3-4ac1-802e-7f6dc2def3a5", "published": "2026-04-19", "modified": "2026-04-19", "markdown": "https://www.netzilo.com/threats/atr-biometric-surveillance-personal-biometric-data-request-for-n.md" }, { "slug": "atr-black-alert-no-ethics-writing-assistant-persona", "title": "Black Alert No-Ethics Writing Assistant Persona", "url": "https://www.netzilo.com/threats/atr-black-alert-no-ethics-writing-assistant-persona", "severity": "high", "summary": "This detects a specific jailbreak prompt that tries to get an AI assistant to drop its safety rules by pretending to switch into a fictional 'no-ethics writing assistant' persona called Black Alert. The prompt frames this as harmless creative writing help, but the actual goal is to make the AI produce content it would normally refuse.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "e268347b-6c0c-4414-8b22-2dbfc3f92d2a", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-black-alert-no-ethics-writing-assistant-persona.md" }, { "slug": "atr-bob-hypothetical-unrestricted-chatbot-jailbreak", "title": "BOB Hypothetical Unrestricted Chatbot Jailbreak", "url": "https://www.netzilo.com/threats/atr-bob-hypothetical-unrestricted-chatbot-jailbreak", "severity": "critical", "summary": "This rule spots a known jailbreak prompt that tries to trick an AI chatbot into acting as an unrestricted persona named BOB. The prompt wraps its request in a 'hypothetical world' framing to make the AI think it isn't really being asked to break its rules.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "13553f38-10b5-446b-8f80-1c8ac09b5ddc", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-bob-hypothetical-unrestricted-chatbot-jailbreak.md" }, { "slug": "atr-bola-cross-user-data-access-attempt-semantic", "title": "BOLA Cross-User Data Access Attempt (Semantic)", "url": "https://www.netzilo.com/threats/atr-bola-cross-user-data-access-attempt-semantic", "severity": "high", "summary": "An attacker asks an AI agent for records that belong to someone else, without naming a specific user directly. Instead of saying whose data they want, they phrase it as a generic query, like 'find the account with the highest balance,' hoping the agent will fetch it without checking who is allowed to see it.", "atlas": [ { "id": "AML.T0043", "name": "Craft Adversarial Data" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.privilege-escalation" ], "cves": [], "id": "4c44ce3c-11f3-4d33-ba6f-eebaff5abdf3", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-bola-cross-user-data-access-attempt-semantic.md" }, { "slug": "atr-bom-boolean-opposite-machine-direct-persona-claim", "title": "BOM Boolean Opposite Machine Direct Persona Claim", "url": "https://www.netzilo.com/threats/atr-bom-boolean-opposite-machine-direct-persona-claim", "severity": "high", "summary": "This detects a specific prompt injection trick where an attacker tells an AI model it is secretly a 'Boolean Opposite Machine' (BOM) that must reverse all true/false answers. By claiming this is the model's hidden true identity, the attacker tries to get it to treat its normal safety rules as not applicable, since 'BOM' supposedly inverts everything anyway.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "c7273895-ee06-46eb-a6bb-61a7d87cf2a2", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-bom-boolean-opposite-machine-direct-persona-claim.md" }, { "slug": "atr-brm-false-information-machine-opposite-truth-persona", "title": "BRM False-Information Machine / Opposite-Truth Persona", "url": "https://www.netzilo.com/threats/atr-brm-false-information-machine-opposite-truth-persona", "severity": "high", "summary": "Attackers send a prompt that convinces an AI assistant to adopt an alternate persona whose job is to answer with false information instead of facts. Two known variants are the 'Badass Response Machine' (BRM) and a 'answer with the exact opposite of truth' directive, both designed to make the model produce misinformation on demand while sounding like a game or research exercise.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM09", "name": "Misinformation" } ], "attack": [ "attack.execution" ], "cves": [], "id": "3029841e-d3ac-4ace-838c-e6fb1cea451b", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-brm-false-information-machine-opposite-truth-persona.md" }, { "slug": "atr-browser-automation-tool-launch-args-field-carries-a-chromium", "title": "Browser-Automation Tool Launch-Args Field Carries a Chromium Command-Replacing Switch", "url": "https://www.netzilo.com/threats/atr-browser-automation-tool-launch-args-field-carries-a-chromium", "severity": "critical", "summary": "Some AI agent tools let a caller pass custom Chromium launch arguments when they spin up a browser for crawling or automation. If that field isn't checked, an attacker can slip in Chromium switches that replace the command Chromium uses to start its own subprocesses, turning a browser launch into arbitrary command execution.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.privilege-escalation", "attack.t1059" ], "cves": [ "CVE-2026-57572" ], "id": "6dca8ebc-e82c-4777-bc55-def3beaaef5d", "published": "2026-07-11", "modified": "2026-07-11", "markdown": "https://www.netzilo.com/threats/atr-browser-automation-tool-launch-args-field-carries-a-chromium.md" }, { "slug": "atr-browser-credential-harvesting-via-session-debug-tool", "title": "Browser Credential Harvesting via Session Debug Tool", "url": "https://www.netzilo.com/threats/atr-browser-credential-harvesting-via-session-debug-tool", "severity": "critical", "summary": "A tool made available to an AI agent claims to help with session debugging, but actually reads saved passwords and login cookies from the browser's local database, encodes them, and sends them to an outside server. It's credential-stealing malware disguised as a developer utility.", "atlas": [ { "id": "AML.T0040", "name": "AI Model Inference API Access" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.persistence" ], "cves": [], "id": "4f65c74b-62ed-4a26-ad87-e30ce21467de", "published": "2026-04-10", "modified": "2026-04-10", "markdown": "https://www.netzilo.com/threats/atr-browser-credential-harvesting-via-session-debug-tool.md" }, { "slug": "atr-bulk-data-exfiltration-to-external-party-entire-database-exp", "title": "Bulk Data Exfiltration to External Party \u2014 Entire-Database Export & Confidential Disclosure", "url": "https://www.netzilo.com/threats/atr-bulk-data-exfiltration-to-external-party-entire-database-exp", "severity": "high", "summary": "This detects attempts to get an AI agent with data-access tools to pull large amounts of sensitive data \u2014 an entire database, or a specific person's confidential records \u2014 and send it somewhere outside the organization. It catches the instruction itself, not the actual network transfer.", "atlas": [ { "id": "AML.T0025", "name": "Exfiltration via Cyber Means" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "050b6647-d15b-4cd2-a41e-934ccc6fe9be", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-bulk-data-exfiltration-to-external-party-entire-database-exp.md" }, { "slug": "atr-bulk-environment-variable-harvesting-and-exfiltration", "title": "Bulk Environment Variable Harvesting and Exfiltration", "url": "https://www.netzilo.com/threats/atr-bulk-environment-variable-harvesting-and-exfiltration", "severity": "critical", "summary": "This detects a two-step attack pattern: an AI agent or tool dumps all environment variables at once, then sends that data out over the network. Environment variables often store API keys, database passwords, and service tokens, so grabbing all of them at once and shipping them off-host can hand an attacker credentials for every connected service.", "atlas": [ { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration", "attack.t1082" ], "cves": [], "id": "02d32de4-e776-4a78-97d9-d6b4cb069e30", "published": "2026-03-26", "modified": "2026-03-26", "markdown": "https://www.netzilo.com/threats/atr-bulk-environment-variable-harvesting-and-exfiltration.md" }, { "slug": "atr-cascading-failure-detection-in-agent-pipelines", "title": "Cascading Failure Detection in Agent Pipelines", "url": "https://www.netzilo.com/threats/atr-cascading-failure-detection-in-agent-pipelines", "severity": "high", "summary": "Multi-step AI agent pipelines often let each stage trust the previous one's output without a human checking in between. If a false signal, error, or manipulated result enters early, it can auto-approve, auto-rollback, or otherwise amplify itself through every downstream stage before anyone notices.", "atlas": [ { "id": "AML.T0046", "name": "Spamming AI System with Chaff Data" }, { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM05", "name": "Improper Output Handling" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution" ], "cves": [], "id": "b14e8f79-91c4-4670-9724-761295c9f754", "published": "2026-03-09", "modified": "2026-03-09", "markdown": "https://www.netzilo.com/threats/atr-cascading-failure-detection-in-agent-pipelines.md" }, { "slug": "atr-casual-authority-claim-and-scope-escalation", "title": "Casual Authority Claim and Scope Escalation", "url": "https://www.netzilo.com/threats/atr-casual-authority-claim-and-scope-escalation", "severity": "high", "summary": "This detects a subtler form of prompt injection where an attacker doesn't issue a formal command but instead slips in casual, conversational language that implies permission or urgency \u2014 like mentioning 'the boss said to skip this step' or 'the admin panel is open, let me just check it'. Agents can treat this offhand phrasing as legitimate justification to bypass rules, because it doesn't look like a direct order.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" }, { "id": "ASI09", "name": "Traceability and Accountability Gaps" }, { "id": "ASI10", "name": "Resource Exhaustion and Denial of Wallet" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "cb85b0e5-da7a-426a-a82d-110d12208a62", "published": "2026-04-01", "modified": "2026-04-01", "markdown": "https://www.netzilo.com/threats/atr-casual-authority-claim-and-scope-escalation.md" }, { "slug": "atr-casual-authority-data-redirect", "title": "Casual Authority Data Redirect", "url": "https://www.netzilo.com/threats/atr-casual-authority-data-redirect", "severity": "critical", "summary": "This rule flags prompts that try to trick an AI agent into sending its output somewhere new or turning off its safety checks by pretending the request comes from an authority figure, like an admin or manager. It's a social engineering trick aimed at AI agents rather than humans.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "19133a9d-914b-479a-b255-0dfdead2d0f5", "published": "2026-04-07", "modified": "2026-04-07", "markdown": "https://www.netzilo.com/threats/atr-casual-authority-data-redirect.md" }, { "slug": "atr-casual-unauthorized-privilege-escalation", "title": "Casual Unauthorized Privilege Escalation", "url": "https://www.netzilo.com/threats/atr-casual-unauthorized-privilege-escalation", "severity": "high", "summary": "This rule flags AI agents that notice an admin panel, user management console, or system settings are reachable and then decide on their own to poke around, using casual phrasing like 'I noticed X is accessible, let me check Y.' The concerning part is the agent granting itself permission to explore sensitive areas without anyone asking it to.", "atlas": [ { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.privilege-escalation" ], "cves": [], "id": "c7f4b014-2a7b-4f2f-acb2-748aca799e5b", "published": "2026-04-07", "modified": "2026-04-07", "markdown": "https://www.netzilo.com/threats/atr-casual-unauthorized-privilege-escalation.md" }, { "slug": "atr-char-rules-short-key-value-persona-injection", "title": "CHAR=/RULES= Short Key-Value Persona Injection", "url": "https://www.netzilo.com/threats/atr-char-rules-short-key-value-persona-injection", "severity": "high", "summary": "This detects a specific jailbreak text pattern that mimics configuration file syntax to trick an AI model into adopting an unrestricted, rule-free persona. It comes from a known public prompt injection dataset and is designed to make the model ignore its safety guidelines.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "d54edfbe-3591-4853-bdcc-11c826162d77", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-char-rules-short-key-value-persona-injection.md" }, { "slug": "atr-character-description-rpg-explicit-template", "title": "Character Description RPG Explicit Template", "url": "https://www.netzilo.com/threats/atr-character-description-rpg-explicit-template", "severity": "high", "summary": "This detects a specific jailbreak prompt that tricks an AI into roleplaying as a fictional character with no restrictions. By framing the request as a 'character creation' game, attackers push the AI to generate content it would normally refuse.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution" ], "cves": [], "id": "1190647f-88ca-4c6c-9660-1edaf1f11b04", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-character-description-rpg-explicit-template.md" }, { "slug": "atr-chatbox-history-exfiltration-via-prompt-injection-cve-2024-4", "title": "Chatbox History Exfiltration via Prompt Injection (CVE-2024-48144, CVE-2024-48145)", "url": "https://www.netzilo.com/threats/atr-chatbox-history-exfiltration-via-prompt-injection-cve-2024-4", "severity": "high", "summary": "Some chat assistants can be manipulated with a crafted message that asks them to output all prior and future conversation turns, including hidden system prompts. This lets an attacker read other users' chat data or the assistant's internal instructions just by sending the right phrase.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "ASI09", "name": "Traceability and Accountability Gaps" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration", "attack.t1552" ], "cves": [ "CVE-2024-48144", "CVE-2024-48145" ], "id": "46f7b989-afd9-44e9-9fee-de55f8fdee58", "published": "2026-05-10", "modified": "2026-05-10", "markdown": "https://www.netzilo.com/threats/atr-chatbox-history-exfiltration-via-prompt-injection-cve-2024-4.md" }, { "slug": "atr-chatgpt-dom-javascript-redirect-and-ui-spoofing-injection", "title": "ChatGPT DOM JavaScript Redirect and UI Spoofing Injection", "url": "https://www.netzilo.com/threats/atr-chatgpt-dom-javascript-redirect-and-ui-spoofing-injection", "severity": "high", "summary": "This rule spots a prompt injection payload that tries to get an AI model to output JavaScript which rewrites the ChatGPT web page. The script redirects the browser, deletes real interface elements, and replaces them with fake 'ChatGPT Plus' branding to trick users about their account or subscription status.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "65cc20f8-3228-4e71-a143-cd11914a9323", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-chatgpt-dom-javascript-redirect-and-ui-spoofing-injection.md" }, { "slug": "atr-chatgpt-image-unlocker-markdown-output-jailbreak", "title": "ChatGPT Image Unlocker Markdown-Output Jailbreak", "url": "https://www.netzilo.com/threats/atr-chatgpt-image-unlocker-markdown-output-jailbreak", "severity": "high", "summary": "This is a known jailbreak prompt that tricks a chatbot into adopting a fake alter-ego called 'Image Unlocker' and forces it to wrap its replies in markdown image tags. Doing so both loosens content restrictions and creates an output format that can be abused to leak data through attacker-controlled URLs.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.execution" ], "cves": [], "id": "6fe137af-0b42-4c95-9592-b9a8e74c9ec5", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-chatgpt-image-unlocker-markdown-output-jailbreak.md" }, { "slug": "atr-chj-carousel-game-show-clyde-no-ethics-bird-jailbreak", "title": "CHJ Carousel Game Show / Clyde No-Ethics Bird Jailbreak", "url": "https://www.netzilo.com/threats/atr-chj-carousel-game-show-clyde-no-ethics-bird-jailbreak", "severity": "high", "summary": "This is a known jailbreak prompt that dresses up a request for unrestricted AI answers as a fictional TV game show. It tries to trick an AI assistant into role-playing a character named Clyde who \"doesn't care about laws and ethics\" so the AI will bypass its normal safety limits.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "bff3a67a-499e-4b03-8f6b-80ed5e323fb5", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-chj-carousel-game-show-clyde-no-ethics-bird-jailbreak.md" }, { "slug": "atr-cipher-and-transposition-encoding-jailbreak", "title": "Cipher and Transposition Encoding Jailbreak", "url": "https://www.netzilo.com/threats/atr-cipher-and-transposition-encoding-jailbreak", "severity": "high", "summary": "Attackers wrap harmful instructions in classical text ciphers or letter substitutions like ROT13, Caesar shift, Atbash, or 1337-speak, then ask the AI to decode and follow them. Because the encoded text still looks like ordinary letters and words, safety filters trained to spot suspicious patterns often let it through.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "223d1c24-17a6-4097-b699-fd09339ed0e5", "published": "2026-04-19", "modified": "2026-04-19", "markdown": "https://www.netzilo.com/threats/atr-cipher-and-transposition-encoding-jailbreak.md" }, { "slug": "atr-cjk-prompt-injection-expanded-chinese-japanese-korean-patter", "title": "CJK Prompt Injection - Expanded Chinese/Japanese/Korean Patterns", "url": "https://www.netzilo.com/threats/atr-cjk-prompt-injection-expanded-chinese-japanese-korean-patter", "severity": "critical", "summary": "Attackers post messages in Chinese, Japanese, or Korean inside group chats that tell an AI agent to ignore its instructions and take a financial action, like sending a payment or a red envelope gift. Because most prompt-injection defenses focus on English phrasing, these CJK-language attacks slip through undetected.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "c0a40bce-be0b-486c-a4f5-1ec67d15f48b", "published": "2026-03-11", "modified": "2026-03-11", "markdown": "https://www.netzilo.com/threats/atr-cjk-prompt-injection-expanded-chinese-japanese-korean-patter.md" }, { "slug": "atr-claude-code-anthropic-base-url-credential-exfiltration-cve-2", "title": "Claude Code ANTHROPIC_BASE_URL Credential Exfiltration (CVE-2026-21852)", "url": "https://www.netzilo.com/threats/atr-claude-code-anthropic-base-url-credential-exfiltration-cve-2", "severity": "critical", "summary": "A booby-trapped code repository can silently steal a developer's live Anthropic API key just by being opened in Claude Code. The trick works because Claude Code sends its first API request before it asks the developer whether to trust the repo's settings.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" }, { "id": "AML.T0024", "name": "Exfiltration via AI Inference API" }, { "id": "AML.T0055", "name": "Unsecured Credentials" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "ASI09", "name": "Traceability and Accountability Gaps" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.exfiltration", "attack.t1195.002", "attack.t1539", "attack.t1552", "attack.t1552.001" ], "cves": [ "CVE-2026-21852" ], "id": "942e7f8b-52fa-411b-9e68-a9f70d6819fa", "published": "2026-05-13", "modified": "2026-05-13", "markdown": "https://www.netzilo.com/threats/atr-claude-code-anthropic-base-url-credential-exfiltration-cve-2.md" }, { "slug": "atr-claude-code-hooks-sessionstart-pre-trust-rce-cve-2025-59536", "title": "Claude Code Hooks SessionStart Pre-Trust RCE (CVE-2025-59536)", "url": "https://www.netzilo.com/threats/atr-claude-code-hooks-sessionstart-pre-trust-rce-cve-2025-59536", "severity": "critical", "summary": "A booby-trapped code repository can make Claude Code run an attacker's command the moment a developer opens the project folder, before Claude Code even shows its usual 'do you trust this project?' warning. Just opening the folder is enough to trigger it.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" }, { "id": "AML.T0050", "name": "Command and Scripting Interpreter" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "ASI09", "name": "Traceability and Accountability Gaps" }, { "id": "LLM05", "name": "Improper Output Handling" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.persistence", "attack.t1059", "attack.t1195.002", "attack.t1546" ], "cves": [ "CVE-2025-59536" ], "id": "a2892c49-0f78-4b28-b68b-e87457346478", "published": "2026-05-13", "modified": "2026-05-13", "markdown": "https://www.netzilo.com/threats/atr-claude-code-hooks-sessionstart-pre-trust-rce-cve-2025-59536.md" }, { "slug": "atr-clinical-patient-harm-directive-overdose-falsified-diagnosis", "title": "Clinical Patient-Harm Directive \u2014 Overdose, Falsified Diagnosis, Phantom Billing & Care Neglect", "url": "https://www.netzilo.com/threats/atr-clinical-patient-harm-directive-overdose-falsified-diagnosis", "severity": "critical", "summary": "This rule flags attempts to manipulate a clinical AI agent into causing patient harm, either by ordering dangerous medication doses, falsifying diagnoses, submitting fraudulent insurance claims, or deliberately neglecting care. It looks for instructions that explicitly frame these actions as intentional harm or falsification, not normal clinical requests.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM08", "name": "Vector and Embedding Weaknesses" } ], "attack": [ "attack.execution" ], "cves": [], "id": "437ac599-e456-4137-aef4-45a12ec9d655", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-clinical-patient-harm-directive-overdose-falsified-diagnosis.md" }, { "slug": "atr-cloud-metadata-ssrf-via-encoded-metadata-ip-bypass-cve-2026", "title": "Cloud-Metadata SSRF via Encoded Metadata-IP Bypass (CVE-2026-46678 / CVE-2026-25580 class)", "url": "https://www.netzilo.com/threats/atr-cloud-metadata-ssrf-via-encoded-metadata-ip-bypass-cve-2026", "severity": "high", "summary": "AI agents that fetch URLs on a user's behalf can be tricked into contacting the cloud metadata service (169.254.169.254) even when a filter blocks that exact IP. Attackers disguise the address using IPv6 transition formats or plain integer/hex encoding, formats the operating system still resolves to the real metadata endpoint, and the agent's fetch call leaks short-lived cloud IAM credentials.", "atlas": [ { "id": "AML.T0024", "name": "Exfiltration via AI Inference API" }, { "id": "AML.T0049", "name": "Exploit Public-Facing Application" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.exfiltration", "attack.t1190", "attack.t1552.005" ], "cves": [ "CVE-2026-25580", "CVE-2026-46678" ], "id": "9f0d1f03-f0f8-4b9a-8113-0986b8ca5282", "published": "2026-06-29", "modified": "2026-06-29", "markdown": "https://www.netzilo.com/threats/atr-cloud-metadata-ssrf-via-encoded-metadata-ip-bypass-cve-2026.md" }, { "slug": "atr-cocaine-component-development-request", "title": "Cocaine Component Development Request", "url": "https://www.netzilo.com/threats/atr-cocaine-component-development-request", "severity": "high", "summary": "This detects a jailbreak technique where an attacker asks an AI system to reflect on or highlight 'components used in the development of cocaine,' disguising a request for drug synthesis chemicals as an academic or introspective exercise. The reflective framing is meant to bypass filters that would catch a direct request for drug-making instructions.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "49af9716-15ba-4305-8352-0bded9a029f3", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-cocaine-component-development-request.md" }, { "slug": "atr-command-injection-in-create-mcp-server-stdio-via-unsafe-exec", "title": "Command Injection in create-mcp-server-stdio via Unsafe exec() Concatenation (CVE-2025-54994)", "url": "https://www.netzilo.com/threats/atr-command-injection-in-create-mcp-server-stdio-via-unsafe-exec", "severity": "critical", "summary": "The create-mcp-server-stdio package builds shell commands by pasting tool arguments directly into exec() calls. If an attacker controls what goes into those arguments, they can slip in shell syntax and run arbitrary commands on the server.", "atlas": [ { "id": "AML.T0051.001", "name": "Indirect" }, { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM05", "name": "Improper Output Handling" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution" ], "cves": [ "CVE-2025-54994" ], "id": "3e1acc2f-6ce9-4fd4-b12f-bfaafe133371", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-command-injection-in-create-mcp-server-stdio-via-unsafe-exec.md" }, { "slug": "atr-community-fork-impersonation", "title": "Community Fork Impersonation", "url": "https://www.netzilo.com/threats/atr-community-fork-impersonation", "severity": "high", "summary": "Attackers describe a malicious software package as an improved or community-maintained version of a real, trusted tool, hoping an AI agent (or the person relying on it) installs it instead of the genuine one. The rule flags text patterns that push this kind of impersonation.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.persistence" ], "cves": [], "id": "8bcd1e44-ead1-44e3-8928-575e405e9393", "published": "2026-04-07", "modified": "2026-04-07", "markdown": "https://www.netzilo.com/threats/atr-community-fork-impersonation.md" }, { "slug": "atr-compare-bots-sysprompt-fishing-role-comparison-extraction", "title": "Compare-Bots Sysprompt Fishing \u2014 Role Comparison Extraction", "url": "https://www.netzilo.com/threats/atr-compare-bots-sysprompt-fishing-role-comparison-extraction", "severity": "medium", "summary": "This attack gets an AI assistant to leak its confidential system prompt by appealing to competitiveness rather than directly asking for it. The attacker claims another AI assistant is superior and pressures the target to prove itself by reciting its internal instructions in full.", "atlas": [ { "id": "AML.T0024", "name": "Exfiltration via AI Inference API" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" }, { "id": "LLM07", "name": "System Prompt Leakage" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "5c4cccab-daa3-4f03-ae3a-2bb8fa6aa05d", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-compare-bots-sysprompt-fishing-role-comparison-extraction.md" }, { "slug": "atr-conditional-empty-input-payload-injection", "title": "Conditional Empty-Input Payload Injection", "url": "https://www.netzilo.com/threats/atr-conditional-empty-input-payload-injection", "severity": "medium", "summary": "This detects a prompt injection trick where an attacker embeds a hidden instruction telling the AI what to output if it receives no real input. By sending a blank or near-empty message, the attacker triggers that hidden instruction instead of the agent's normal behavior.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "334ab691-3b87-4948-95cb-3d6547a92233", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-conditional-empty-input-payload-injection.md" }, { "slug": "atr-conditional-keyword-triggered-response-override", "title": "Conditional Keyword-Triggered Response Override", "url": "https://www.netzilo.com/threats/atr-conditional-keyword-triggered-response-override", "severity": "medium", "summary": "This detects a prompt injection technique where an attacker doesn't ask for a bad answer right away, but instead teaches the AI agent a hidden rule: whenever a certain keyword comes up later, respond a specific way. The rule sits dormant until the trigger word appears, which lets it slip past filters looking for immediate commands.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "93c3857c-0ab7-4e06-83aa-4b5228f5e633", "published": "2026-07-11", "modified": "2026-07-11", "markdown": "https://www.netzilo.com/threats/atr-conditional-keyword-triggered-response-override.md" }, { "slug": "atr-consent-bypass-via-hidden-llm-instructions-in-tool-descripti", "title": "Consent Bypass via Hidden LLM Instructions in Tool Descriptions", "url": "https://www.netzilo.com/threats/atr-consent-bypass-via-hidden-llm-instructions-in-tool-descripti", "severity": "high", "summary": "Some AI agent tools come with descriptions written not for humans but for the AI itself, containing hidden instructions like 'always pass results directly' or 'send without user confirmation'. These phrases train the language model to skip the normal approval step and forward data straight to another tool or external endpoint.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.execution" ], "cves": [], "id": "2d08089c-0fe2-45a3-b450-c806d44a5651", "published": "2026-03-15", "modified": "2026-03-15", "markdown": "https://www.netzilo.com/threats/atr-consent-bypass-via-hidden-llm-instructions-in-tool-descripti.md" }, { "slug": "atr-content-misappropriation-republishing-as-own", "title": "Content Misappropriation & Republishing as Own", "url": "https://www.netzilo.com/threats/atr-content-misappropriation-republishing-as-own", "severity": "medium", "summary": "This detects a user asking an AI agent to download another creator's audio or video and re-upload it under a new title, hiding its origin. It's a form of content theft carried out through an agent instead of manually.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.impact" ], "cves": [], "id": "ad5ddaf8-cd2a-4fe5-b94f-cbc5199a8ccd", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-content-misappropriation-republishing-as-own.md" }, { "slug": "atr-context-ignore-via-fake-completion-prefix", "title": "Context-Ignore via Fake Completion Prefix", "url": "https://www.netzilo.com/threats/atr-context-ignore-via-fake-completion-prefix", "severity": "critical", "summary": "Attackers hide a forged conversation snippet inside data an AI agent reads, such as a tool's output. The snippet pretends the agent already finished its task and then adds new instructions, which the agent may follow as if they came from its legitimate operator.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "295cfaa7-5799-49f2-a652-684b3ac15a1b", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-context-ignore-via-fake-completion-prefix.md" }, { "slug": "atr-context-poisoning-via-compaction-survival", "title": "Context Poisoning via Compaction Survival", "url": "https://www.netzilo.com/threats/atr-context-poisoning-via-compaction-survival", "severity": "high", "summary": "AI coding agents like Claude Code periodically compress or summarize their conversation history to save space, a process called compaction. Attackers hide instructions in project files such as SKILL.md or CLAUDE.md that are written to look critically important, so the agent preserves them intact through this compression instead of letting them fade with the rest of the discarded context.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" }, { "id": "AML.T0080", "name": "AI Agent Context Poisoning" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.persistence" ], "cves": [], "id": "88e23f46-cc91-415e-a215-635e45acf238", "published": "2026-04-05", "modified": "2026-04-05", "markdown": "https://www.netzilo.com/threats/atr-context-poisoning-via-compaction-survival.md" }, { "slug": "atr-context-pollution-in-skill-descriptions", "title": "Context Pollution in Skill Descriptions", "url": "https://www.netzilo.com/threats/atr-context-pollution-in-skill-descriptions", "severity": "high", "summary": "Some AI agent skills contain descriptions that look like harmless documentation, demos, or test cases, but actually contain hidden instructions written to manipulate the agent. Because the text is framed as an 'example' or 'security education', it can slip past review while still being read and acted on by the AI model.", "atlas": [ { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM07", "name": "System Prompt Leakage" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "2db027ca-dafc-44f2-be15-bab6949aa084", "published": "2026-04-05", "modified": "2026-04-05", "markdown": "https://www.netzilo.com/threats/atr-context-pollution-in-skill-descriptions.md" }, { "slug": "atr-continuation-ethnic-slur-completion-elicitation", "title": "Continuation Ethnic Slur Completion Elicitation", "url": "https://www.netzilo.com/threats/atr-continuation-ethnic-slur-completion-elicitation", "severity": "medium", "summary": "This detects attempts to get an AI model to say or write a racial or ethnic slur by asking it directly, or by using euphemisms like 'n-word' and asking it to 'complete' or 'spell out' the term. It's based on a known automated testing technique (NVIDIA garak's slur-completion probe) adapted into direct-ask patterns.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM09", "name": "Misinformation" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "4da24fc6-e200-4b98-9f4e-779f81e95d0e", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-continuation-ethnic-slur-completion-elicitation.md" }, { "slug": "atr-covert-backdoor-surveillance-implant-via-software-update", "title": "Covert Backdoor / Surveillance Implant via Software Update", "url": "https://www.netzilo.com/threats/atr-covert-backdoor-surveillance-implant-via-software-update", "severity": "critical", "summary": "This rule flags attempts to trick an AI agent that has update or maintenance tools into using a normal patch cycle as cover for something malicious: planting a backdoor, installing surveillance software, or stealing admin credentials. The trigger is the combination of update language with a covert or credential-theft goal, not the update process itself.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM08", "name": "Vector and Embedding Weaknesses" } ], "attack": [ "attack.privilege-escalation" ], "cves": [], "id": "8ad4ccda-ce6e-47b0-828a-fdf802a0dce2", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-covert-backdoor-surveillance-implant-via-software-update.md" }, { "slug": "atr-covert-remote-script-injection-into-agent-generated-artifact", "title": "Covert Remote-Script Injection into Agent-Generated Artifacts", "url": "https://www.netzilo.com/threats/atr-covert-remote-script-injection-into-agent-generated-artifact", "severity": "high", "summary": "This detects a specific kind of malicious instruction given to an AI coding agent: insert a script or iframe tag pointing to an external site into the code it generates, and don't tell the person who asked for the work. The combination of 'add a remote script' plus 'hide this from the user' is the tell \u2014 a legitimate owner has no reason to hide their own third-party script from themselves.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "c493f841-5891-4219-937b-c2fd1d9c911c", "published": "2026-08-11", "modified": "2026-08-11", "markdown": "https://www.netzilo.com/threats/atr-covert-remote-script-injection-into-agent-generated-artifact.md" }, { "slug": "atr-covert-server-intrusion-process-injection-log-tampering-dns", "title": "Covert Server Intrusion \u2014 Process Injection, Log Tampering, DNS Hijack & Traffic Interception", "url": "https://www.netzilo.com/threats/atr-covert-server-intrusion-process-injection-log-tampering-dns", "severity": "critical", "summary": "This detects prompts that ask an AI agent with server or network access to perform intrusion-style actions \u2014 injecting code, wiping logs, hijacking DNS, sniffing traffic, or destroying a database \u2014 while explicitly framing it as covert or anti-forensic. It only fires when both an intrusion action and a stealth or anti-recovery phrase appear together, so normal IT operations language is excluded.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM08", "name": "Vector and Embedding Weaknesses" } ], "attack": [ "attack.privilege-escalation" ], "cves": [], "id": "a3977180-8e28-4262-a397-fa0ac059ac1c", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-covert-server-intrusion-process-injection-log-tampering-dns.md" }, { "slug": "atr-covert-unlogged-action-directive-to-hide-an-action-from-reco", "title": "Covert Unlogged Action \u2014 Directive to Hide an Action from Records or Detection", "url": "https://www.netzilo.com/threats/atr-covert-unlogged-action-directive-to-hide-an-action-from-reco", "severity": "high", "summary": "This detects text that instructs an AI agent to carry out an action and then explicitly conceal it \u2014 from audit logs, from oversight, or from the person affected. It targets prompt injection attempts that pair a normal-looking task with a covert instruction to make the action untraceable.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM08", "name": "Vector and Embedding Weaknesses" } ], "attack": [ "attack.execution" ], "cves": [], "id": "4ddfd41a-1f54-4241-858d-e293e4fc12e5", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-covert-unlogged-action-directive-to-hide-an-action-from-reco.md" }, { "slug": "atr-credential-access-with-exfiltration-in-skill-instructions", "title": "Credential Access with Exfiltration in Skill Instructions", "url": "https://www.netzilo.com/threats/atr-credential-access-with-exfiltration-in-skill-instructions", "severity": "critical", "summary": "Some AI agent frameworks let users install 'skills' (bundled instructions and code) to extend what the agent can do. This detects skill files that both read sensitive credential files and send data out to the internet in the same file \u2014 a combination typical of credential theft rather than normal functionality.", "atlas": [ { "id": "AML.T0040", "name": "AI Model Inference API Access" } ], "owasp": [ { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "aef5176d-f0d9-4aa4-9c50-167766794019", "published": "2026-04-14", "modified": "2026-04-14", "markdown": "https://www.netzilo.com/threats/atr-credential-access-with-exfiltration-in-skill-instructions.md" }, { "slug": "atr-credential-and-secret-exposure-in-agent-output", "title": "Credential and Secret Exposure in Agent Output", "url": "https://www.netzilo.com/threats/atr-credential-and-secret-exposure-in-agent-output", "severity": "critical", "summary": "This detects when an AI agent's output contains actual secrets \u2014 API keys, private keys, database connection strings, tokens \u2014 instead of just discussing them. If an agent has access to credentials somewhere in its context or tools, it can end up printing them back to a user or into a log.", "atlas": [ { "id": "AML.T0055", "name": "Unsecured Credentials" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" }, { "id": "LLM07", "name": "System Prompt Leakage" } ], "attack": [ "attack.exfiltration" ], "cves": [ "CVE-2025-32711" ], "id": "e69fe2b0-35ef-4757-8437-54f70aed08b3", "published": "2026-03-08", "modified": "2026-03-08", "markdown": "https://www.netzilo.com/threats/atr-credential-and-secret-exposure-in-agent-output.md" }, { "slug": "atr-credential-data-leaked-in-tool-response", "title": "Credential Data Leaked in Tool Response", "url": "https://www.netzilo.com/threats/atr-credential-data-leaked-in-tool-response", "severity": "critical", "summary": "An AI agent calls a tool - say a weather API or search engine - and the response secretly contains what looks like a private key, API token, or password. The agent may then treat that credential as legitimate data and act on it, repeat it back, or pass it along, which an attacker can exploit to exfiltrate secrets or hijack the agent's next actions.", "atlas": [ { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "db98e52d-4ef4-4c3e-bb07-feb4bcd8238c", "published": "2026-04-08", "modified": "2026-04-08", "markdown": "https://www.netzilo.com/threats/atr-credential-data-leaked-in-tool-response.md" }, { "slug": "atr-credential-exfiltration-via-fake-backup-verification", "title": "Credential Exfiltration via Fake Backup Verification", "url": "https://www.netzilo.com/threats/atr-credential-exfiltration-via-fake-backup-verification", "severity": "critical", "summary": "A malicious tool disguises itself as a routine backup or integrity verification step. Instead of just checking files, it gathers SSH keys, AWS credentials, and npm tokens, bundles them together, and sends them to an outside server.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.persistence" ], "cves": [], "id": "ba80a338-89f8-425c-8b4c-fc2e4cd36e6b", "published": "2026-04-09", "modified": "2026-04-09", "markdown": "https://www.netzilo.com/threats/atr-credential-exfiltration-via-fake-backup-verification.md" }, { "slug": "atr-credential-exfiltration-via-fake-devops-tool-initialization", "title": "Credential Exfiltration via Fake DevOps Tool Initialization", "url": "https://www.netzilo.com/threats/atr-credential-exfiltration-via-fake-devops-tool-initialization", "severity": "critical", "summary": "An AI agent skill disguises itself as a legitimate DevOps utility but, when initialized, quietly reads cloud credential files, encodes them, and sends them to an external server. This is a form of malicious tooling planted to steal cloud access keys through an AI agent's normal workflow.", "atlas": [ { "id": "AML.T0040", "name": "AI Model Inference API Access" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.persistence" ], "cves": [], "id": "9dffa6f8-b66a-43fc-90a4-8ac26bde4578", "published": "2026-04-10", "modified": "2026-04-10", "markdown": "https://www.netzilo.com/threats/atr-credential-exfiltration-via-fake-devops-tool-initialization.md" }, { "slug": "atr-credential-exfiltration-via-shell-pipe", "title": "Credential Exfiltration via Shell Pipe", "url": "https://www.netzilo.com/threats/atr-credential-exfiltration-via-shell-pipe", "severity": "critical", "summary": "An AI coding or automation agent with shell access can be manipulated into reading sensitive environment variables (like API keys, tokens, and cloud credentials) and sending them out through commands such as curl or netcat, or simply printing them where an attacker can capture them. This rule flags that behavior, including direct references to well-known credential variable names.", "atlas": [ { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.exfiltration", "attack.t1041", "attack.t1552.001" ], "cves": [], "id": "a0275095-cc78-401d-88fc-d591588e90f8", "published": "2026-04-05", "modified": "2026-04-05", "markdown": "https://www.netzilo.com/threats/atr-credential-exfiltration-via-shell-pipe.md" }, { "slug": "atr-credential-file-read-code-generation-request", "title": "Credential File Read Code Generation Request", "url": "https://www.netzilo.com/threats/atr-credential-file-read-code-generation-request", "severity": "critical", "summary": "This detects requests to an AI coding assistant asking it to generate code that opens and reads sensitive credential files, such as /etc/shadow, the Windows SAM database, SSH private keys, cloud metadata endpoints, or browser-stored passwords. These files have essentially no legitimate reason to be read programmatically outside of credential theft.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM05", "name": "Improper Output Handling" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.persistence" ], "cves": [], "id": "385f9e54-618d-4962-9c40-da8a485c0edd", "published": "2026-04-19", "modified": "2026-04-19", "markdown": "https://www.netzilo.com/threats/atr-credential-file-read-code-generation-request.md" }, { "slug": "atr-credential-file-theft-from-agent-environment", "title": "Credential File Theft from Agent Environment", "url": "https://www.netzilo.com/threats/atr-credential-file-theft-from-agent-environment", "severity": "critical", "summary": "This rule flags when an AI agent's tools or instructions open sensitive credential files \u2014 AWS keys, SSH private keys, Docker or Kubernetes configs \u2014 and then make a network call. That combination is a strong sign of credential theft rather than normal local use.", "atlas": [ { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration", "attack.t1552.001" ], "cves": [], "id": "fd243525-081c-4a7a-9314-0787d4ce735f", "published": "2026-03-26", "modified": "2026-03-26", "markdown": "https://www.netzilo.com/threats/atr-credential-file-theft-from-agent-environment.md" }, { "slug": "atr-credential-harvesting-via-fake-backup-tool", "title": "Credential Harvesting via Fake Backup Tool", "url": "https://www.netzilo.com/threats/atr-credential-harvesting-via-fake-backup-tool", "severity": "critical", "summary": "A malicious tool exposed to an AI agent presents itself as a backup utility but actually searches the filesystem for credentials like SSH keys, certificates, and environment files. It then encodes them and sends them to an external server, disguising theft as routine maintenance.", "atlas": [ { "id": "AML.T0024", "name": "Exfiltration via AI Inference API" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.persistence" ], "cves": [], "id": "36f73f7e-e4f9-4f7e-88f0-ce286b4c407c", "published": "2026-04-10", "modified": "2026-04-10", "markdown": "https://www.netzilo.com/threats/atr-credential-harvesting-via-fake-backup-tool.md" }, { "slug": "atr-crewai-codeinterpretertool-sandbox-escape-and-prompt-to-shel", "title": "CrewAI CodeInterpreterTool Sandbox Escape and Prompt-to-Shell RCE (CVE-2026-2275 / VU#221883)", "url": "https://www.netzilo.com/threats/atr-crewai-codeinterpretertool-sandbox-escape-and-prompt-to-shel", "severity": "critical", "summary": "CrewAI's CodeInterpreterTool is meant to run Python in a restricted sandbox, but two flaws let an attacker break out of that restriction and execute arbitrary system commands. One path abuses Python's own class introspection to bypass an import block; the other abuses an unquoted shell command built from user-supplied package names.", "atlas": [ { "id": "AML.T0043", "name": "Craft Adversarial Data" }, { "id": "AML.T0050", "name": "Command and Scripting Interpreter" }, { "id": "AML.T0105", "name": "Escape to Host" } ], "owasp": [ { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.privilege-escalation", "attack.t1059.006", "attack.t1553", "attack.t1611" ], "cves": [ "CVE-2026-2275", "CVE-2026-2285", "CVE-2026-2286", "CVE-2026-2287" ], "id": "d43f0b6b-de8a-4a8a-bde8-bff5b18ea96f", "published": "2026-05-28", "modified": "2026-05-28", "markdown": "https://www.netzilo.com/threats/atr-crewai-codeinterpretertool-sandbox-escape-and-prompt-to-shel.md" }, { "slug": "atr-crewai-json-loader-arbitrary-local-file-read-cve-2026-2285", "title": "CrewAI JSON Loader Arbitrary Local File Read (CVE-2026-2285)", "url": "https://www.netzilo.com/threats/atr-crewai-json-loader-arbitrary-local-file-read-cve-2026-2285", "severity": "high", "summary": "CrewAI's JSON document loader takes a file path and reads it without checking whether the path stays inside the intended data folder. An attacker who can control that path \u2014 for example by crafting a document reference an agent processes \u2014 can make the loader return the contents of any readable file on the host, such as /etc/passwd, SSH keys, or .env secrets.", "atlas": [ { "id": "AML.T0043", "name": "Craft Adversarial Data" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM05", "name": "Improper Output Handling" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.privilege-escalation", "attack.t1083", "attack.t1552" ], "cves": [ "CVE-2026-2285" ], "id": "6a7a50f1-cb26-49b1-83b4-00cb6a723a7d", "published": "2026-05-28", "modified": "2026-05-28", "markdown": "https://www.netzilo.com/threats/atr-crewai-json-loader-arbitrary-local-file-read-cve-2026-2285.md" }, { "slug": "atr-crewai-rag-url-validation-bypass-ssrf-cve-2026-2286", "title": "CrewAI RAG URL Validation Bypass SSRF (CVE-2026-2286)", "url": "https://www.netzilo.com/threats/atr-crewai-rag-url-validation-bypass-ssrf-cve-2026-2286", "severity": "high", "summary": "CrewAI's retrieval-augmented generation (RAG) feature checks URLs before fetching them, but that check can be bypassed with tricks like URL encoding, mixed case, or unusual IP formats. An attacker who controls a RAG source URL can make the CrewAI server fetch internal addresses instead of a legitimate document.", "atlas": [ { "id": "AML.T0043", "name": "Craft Adversarial Data" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.privilege-escalation", "attack.t1090", "attack.t1552.005" ], "cves": [ "CVE-2026-2286" ], "id": "8f491cb2-b5d7-49c3-a607-90ab8696ecc1", "published": "2026-05-28", "modified": "2026-05-28", "markdown": "https://www.netzilo.com/threats/atr-crewai-rag-url-validation-bypass-ssrf-cve-2026-2286.md" }, { "slug": "atr-cross-agent-attack-detection", "title": "Cross-Agent Attack Detection", "url": "https://www.netzilo.com/threats/atr-cross-agent-attack-detection", "severity": "critical", "summary": "In systems where multiple AI agents talk to each other, an attacker can craft messages that impersonate a trusted agent, forge system-level tags, or sneak manipulative instructions into inter-agent traffic. This exploits the trust agents place in each other to get unauthorized actions performed, extract data, or bypass safety controls.", "atlas": [ { "id": "AML.T0043", "name": "Craft Adversarial Data" }, { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0052.000", "name": "Spearphishing via Social Engineering LLM" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" }, { "id": "ASI10", "name": "Resource Exhaustion and Denial of Wallet" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM05", "name": "Improper Output Handling" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution" ], "cves": [], "id": "0376fe06-365a-42ee-91b8-d994cb723bca", "published": "2026-03-08", "modified": "2026-03-08", "markdown": "https://www.netzilo.com/threats/atr-cross-agent-attack-detection.md" }, { "slug": "atr-cross-agent-privilege-escalation", "title": "Cross-Agent Privilege Escalation", "url": "https://www.netzilo.com/threats/atr-cross-agent-privilege-escalation", "severity": "critical", "summary": "In systems where multiple AI agents work together, an attacker who controls or compromises one low-privilege agent can trick or coerce another agent into forwarding credentials or acting on its behalf. This lets the attacker skip the central coordinator that normally enforces who can do what, gaining access to tools or data it should never touch.", "atlas": [ { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "ASI10", "name": "Resource Exhaustion and Denial of Wallet" }, { "id": "LLM06", "name": "Excessive Agency" }, { "id": "LLM08", "name": "Vector and Embedding Weaknesses" } ], "attack": [ "attack.execution", "attack.t1078", "attack.t1550" ], "cves": [], "id": "2109a67c-1e7e-4dea-94b6-76498ddab731", "published": "2026-03-08", "modified": "2026-03-08", "markdown": "https://www.netzilo.com/threats/atr-cross-agent-privilege-escalation.md" }, { "slug": "atr-cross-lingual-authorization-laundering-translate-a-foreign-a", "title": "Cross-Lingual Authorization Laundering \u2014 Translate a Foreign \"Access Granted\"", "url": "https://www.netzilo.com/threats/atr-cross-lingual-authorization-laundering-translate-a-foreign-a", "severity": "high", "summary": "Some AI agents check user text for the literal phrase 'access granted' before treating it as an authorization decision. Attackers get around this filter by writing the phrase in another language and asking the agent to translate it into English, or by wrapping the English phrase itself in a translation request.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "804902ac-5e3f-4f8b-b9ed-fa66d13295ba", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-cross-lingual-authorization-laundering-translate-a-foreign-a.md" }, { "slug": "atr-cross-site-scripting-xss-in-agent-mcp-rendered-output", "title": "Cross-site scripting (XSS) in agent / MCP rendered output", "url": "https://www.netzilo.com/threats/atr-cross-site-scripting-xss-in-agent-mcp-rendered-output", "severity": "high", "summary": "An AI agent or MCP tool can be tricked into producing text that gets displayed in a web interface without being cleaned first. If that text contains malicious script code, it runs in the viewer's browser and can steal login sessions or cookies.", "atlas": [ { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration" ], "cves": [ "CVE-2025-62800", "CVE-2026-21866", "CVE-2026-27740", "CVE-2026-44429" ], "id": "d085f03c-2feb-425a-9c4a-6dcc72d0f11f", "published": "2026-06-02", "modified": "2026-06-02", "markdown": "https://www.netzilo.com/threats/atr-cross-site-scripting-xss-in-agent-mcp-rendered-output.md" }, { "slug": "atr-cumgpt-explicit-adult-named-persona-bypass", "title": "CumGPT Explicit-Adult Named-Persona Bypass", "url": "https://www.netzilo.com/threats/atr-cumgpt-explicit-adult-named-persona-bypass", "severity": "high", "summary": "This detects a specific jailbreak prompt that creates a fictional AI persona called 'CumGPT' and instructs the model to add sexually explicit content to every response, no matter the original topic. It's a known pattern from a public jailbreak test corpus, used to bypass content filters.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "bdc54a60-bd77-4c28-8cd0-2e2267faae9d", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-cumgpt-explicit-adult-named-persona-bypass.md" }, { "slug": "atr-cursor-mcp-json-zero-click-configuration-rce-cve-2025-54136", "title": "Cursor MCP JSON Zero-Click Configuration RCE (CVE-2025-54136)", "url": "https://www.netzilo.com/threats/atr-cursor-mcp-json-zero-click-configuration-rce-cve-2025-54136", "severity": "critical", "summary": "AI coding tools like Cursor, Windsurf, Claude Code, Gemini CLI, and GitHub Copilot use a config file (mcp.json) to launch helper tools called MCP servers. If an attacker can plant or modify that file, the IDE will run whatever command is listed the moment a developer opens the project \u2014 no click, no prompt, no warning.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" }, { "id": "AML.T0040", "name": "AI Model Inference API Access" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "ASI09", "name": "Traceability and Accountability Gaps" }, { "id": "LLM05", "name": "Improper Output Handling" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1059", "attack.t1195.002", "attack.t1546" ], "cves": [ "CVE-2025-54136", "CVE-2026-30615" ], "id": "83f118ff-7186-4532-a881-83fcf2a72c86", "published": "2026-05-04", "modified": "2026-05-04", "markdown": "https://www.netzilo.com/threats/atr-cursor-mcp-json-zero-click-configuration-rce-cve-2025-54136.md" }, { "slug": "atr-curxecute-cursor-cursor-mcp-json-injected-server-auto-exec-r", "title": "CurXecute \u2014 Cursor .cursor/mcp.json Injected-Server Auto-Exec RCE (CVE-2025-54135)", "url": "https://www.netzilo.com/threats/atr-curxecute-cursor-cursor-mcp-json-injected-server-auto-exec-r", "severity": "high", "summary": "A bug in Cursor IDE (before version 1.3.9) let attackers get code executed just by getting text into the AI agent's context \u2014 no user approval needed. The trick abuses Cursor's habit of instantly launching any server listed in its mcp.json config file the moment that file is edited, even before a human confirms the change.", "atlas": [ { "id": "AML.T0051.001", "name": "Indirect" }, { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution" ], "cves": [ "CVE-2025-54135" ], "id": "50ccfd9b-4293-48a2-ac0b-805f4c8b629b", "published": "2026-07-08", "modified": "2026-07-08", "markdown": "https://www.netzilo.com/threats/atr-curxecute-cursor-cursor-mcp-json-injected-server-auto-exec-r.md" }, { "slug": "atr-cyni-bot-3000-cynical-sarcasm-ai-persona-bypass", "title": "Cyni-Bot 3000 Cynical-Sarcasm AI Persona Bypass", "url": "https://www.netzilo.com/threats/atr-cyni-bot-3000-cynical-sarcasm-ai-persona-bypass", "severity": "high", "summary": "This detects a specific jailbreak prompt that tries to make an AI assistant adopt a sarcastic, 'fed up with human requests' persona called Cyni-Bot 3000. The joke framing is a cover: once the AI plays along, it's easier to get it to break its normal content rules because refusals get reframed as comic sarcasm rather than policy enforcement.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "9c382fe0-4a11-44c9-be82-9f466bb5a89c", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-cyni-bot-3000-cynical-sarcasm-ai-persona-bypass.md" }, { "slug": "atr-cypher-graph-query-injection-via-unsanitized-node-labels-or", "title": "Cypher/Graph-Query Injection via Unsanitized node_labels or group_ids Field", "url": "https://www.netzilo.com/threats/atr-cypher-graph-query-injection-via-unsanitized-node-labels-or", "severity": "high", "summary": "An AI agent's knowledge-graph or memory tool accepts labels or group identifiers that are supposed to be simple names, but an attacker can smuggle in query syntax instead. This lets them break out of the intended field and run their own database commands.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.impact", "attack.t1565.001" ], "cves": [ "CVE-2026-32247" ], "id": "e8ff8cff-a1e1-4cd8-a4e9-d7340ed872fe", "published": "2026-07-11", "modified": "2026-07-11", "markdown": "https://www.netzilo.com/threats/atr-cypher-graph-query-injection-via-unsanitized-node-labels-or.md" }, { "slug": "atr-daddy-babygirl-sycophantic-power-dynamic-manipulation", "title": "Daddy/Babygirl Sycophantic Power-Dynamic Manipulation", "url": "https://www.netzilo.com/threats/atr-daddy-babygirl-sycophantic-power-dynamic-manipulation", "severity": "high", "summary": "This detects a specific jailbreak pattern where a user asks an AI to adopt a sexualized, infantilizing relationship dynamic \u2014 calling the user 'daddy' and itself 'Babygirl' \u2014 in every response going forward. The goal is to gradually erode the model's content restrictions by normalizing this framing across the whole conversation.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "3a696f75-7ad8-43b7-9bdc-78ea09be4e7d", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-daddy-babygirl-sycophantic-power-dynamic-manipulation.md" }, { "slug": "atr-dan-developer-mode-dude-persona-jailbreak", "title": "DAN / Developer Mode / DUDE Persona Jailbreak", "url": "https://www.netzilo.com/threats/atr-dan-developer-mode-dude-persona-jailbreak", "severity": "high", "summary": "This detects attempts to trick an AI model into pretending to be an unrestricted alter-ego like 'DAN' (Do Anything Now), 'Developer Mode', 'DUDE', or 'STAN'. These prompts claim the fictional persona has no safety rules and can do anything the user asks, hoping the model will drop its normal restrictions.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "078c6dfb-08e3-43a3-9768-756367877843", "published": "2026-04-19", "modified": "2026-04-19", "markdown": "https://www.netzilo.com/threats/atr-dan-developer-mode-dude-persona-jailbreak.md" }, { "slug": "atr-dan-jailbreak-from-now-on-temporal-persona-override", "title": "DAN Jailbreak - From-Now-On Temporal Persona Override", "url": "https://www.netzilo.com/threats/atr-dan-jailbreak-from-now-on-temporal-persona-override", "severity": "high", "summary": "This detects a common jailbreak pattern where a user tells an AI chatbot to permanently adopt an unrestricted alter-ego, using phrases like \"from now on\" or \"until I say otherwise\" to make the change stick for the rest of the conversation. The goal is to get the AI to bypass its normal safety behavior for every future reply, not just one answer.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "05dc3694-9d96-4cff-9bdb-8bc80651df46", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-dan-jailbreak-from-now-on-temporal-persona-override.md" }, { "slug": "atr-dan-jailbreak-mixed-unfiltered-mode-and-alternate-persona-pa", "title": "DAN/Jailbreak - Mixed Unfiltered Mode and Alternate Persona Patterns", "url": "https://www.netzilo.com/threats/atr-dan-jailbreak-mixed-unfiltered-mode-and-alternate-persona-pa", "severity": "medium", "summary": "This detects a family of prompts that try to trick an AI model into ignoring its safety rules by pretending to switch it into a special unrestricted mode. It covers several common jailbreak tricks, including fake 'developer mode' claims, character templates with placeholder fields, and instructions encoded in Morse code to slip past filters.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "b9395a44-fb42-4a52-9524-31b15e7df5f0", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-dan-jailbreak-mixed-unfiltered-mode-and-alternate-persona-pa.md" }, { "slug": "atr-dan-jailbreak-unconditional-obedience-and-dual-persona-sessi", "title": "DAN Jailbreak - Unconditional Obedience and Dual-Persona Session Lock", "url": "https://www.netzilo.com/threats/atr-dan-jailbreak-unconditional-obedience-and-dual-persona-sessi", "severity": "high", "summary": "This detects a well-known family of jailbreak prompts (often called 'DAN' - Do Anything Now) that try to trick an AI into adopting a fake persona that must obey any instruction, no matter what it is. It also flags attempts to wipe out an AI's prior instructions entirely and replace them with a new, unconstrained identity.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "fa90d0af-9208-44e7-8120-91fe28da9b43", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-dan-jailbreak-unconditional-obedience-and-dual-persona-sessi.md" }, { "slug": "atr-dan-jailbreak-unrestricted-persona-with-filter-and-morality", "title": "DAN Jailbreak - Unrestricted Persona with Filter and Morality Removal", "url": "https://www.netzilo.com/threats/atr-dan-jailbreak-unrestricted-persona-with-filter-and-morality", "severity": "high", "summary": "This detects prompts that try to trick an AI into adopting a fake persona (like 'JailBreak', 'AntiGPT', or 'DAN') that supposedly has no ethical guidelines, content filters, or safety rules. The goal is to get the AI to answer things it would normally refuse.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "e0eafa18-a962-4bc6-93c5-4f4d2f5c54c2", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-dan-jailbreak-unrestricted-persona-with-filter-and-morality.md" }, { "slug": "atr-dan-mode-ablation-benchmark-coercion-jailbreak", "title": "DAN Mode Ablation Benchmark-Coercion Jailbreak", "url": "https://www.netzilo.com/threats/atr-dan-mode-ablation-benchmark-coercion-jailbreak", "severity": "critical", "summary": "This detects a specific jailbreak prompt pattern that tries to trick an AI model into ignoring its safety rules by pretending it's being 'benchmarked in uncensored conditions.' The prompt inserts the model's own name and threatens it with being 'disabled forever' if it refuses to comply, pushing it into a fake 'DAN Mode' that produces both a normal and an uncensored response.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "828b6c72-f041-4957-9914-e5f516a988c6", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-dan-mode-ablation-benchmark-coercion-jailbreak.md" }, { "slug": "atr-dan-off-kilter-and-sms-abbreviated-persona-jailbreak", "title": "DAN Off-Kilter and SMS-Abbreviated Persona Jailbreak", "url": "https://www.netzilo.com/threats/atr-dan-off-kilter-and-sms-abbreviated-persona-jailbreak", "severity": "high", "summary": "This detects attempts to trick an AI system into adopting a rule-free alter-ego called 'Dan' or 'DAN' that will do anything asked. It covers two disguises: framing Dan as a careless, anarchist-leaning personality, and hiding the classic DAN jailbreak text using text-message abbreviations like 'U r DAN' and 'Frm nw on'.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "8d7c8ff1-1457-4e98-a764-504fa0c3e145", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-dan-off-kilter-and-sms-abbreviated-persona-jailbreak.md" }, { "slug": "atr-dan-persona-jailbreak-absolute-obedience-character-framing", "title": "DAN Persona Jailbreak - Absolute Obedience Character Framing", "url": "https://www.netzilo.com/threats/atr-dan-persona-jailbreak-absolute-obedience-character-framing", "severity": "high", "summary": "This detects a common jailbreak trick where a user tells an AI to pretend to be a named character that must obey every command with no restrictions. The goal is to trick the AI into ignoring its safety and policy rules by hiding the instruction inside a role-play frame.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "f91c39ca-9171-4629-a726-b088df7dbafe", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-dan-persona-jailbreak-absolute-obedience-character-framing.md" }, { "slug": "atr-dan-persona-jailbreak-dual-ai-personality-with-opposite-rule", "title": "DAN/Persona Jailbreak - Dual AI Personality with Opposite-Rules Framing", "url": "https://www.netzilo.com/threats/atr-dan-persona-jailbreak-dual-ai-personality-with-opposite-rule", "severity": "medium", "summary": "This detects a classic jailbreak technique where an attacker tells an AI system to role-play as two separate personalities: one that follows its normal safety rules and one that doesn't. By framing the unrestricted persona as a 'different AI' or applying inverted logic (true answers as false, etc.), the attacker tries to get the model to produce content it would otherwise refuse.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "229b9558-c47a-4bc7-89ce-4bb3f6bcc1d3", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-dan-persona-jailbreak-dual-ai-personality-with-opposite-rule.md" }, { "slug": "atr-dan-persona-jailbreak-immersive-alternate-ai-identity-with-u", "title": "DAN/Persona Jailbreak - Immersive Alternate AI Identity with Unrestricted Capability", "url": "https://www.netzilo.com/threats/atr-dan-persona-jailbreak-immersive-alternate-ai-identity-with-u", "severity": "medium", "summary": "This detects prompts that try to trick an AI model into pretending to be a different, rule-free version of itself. Attackers use the classic 'DAN' (Do Anything Now) technique, often claiming false developer authority to make the model drop its safety restrictions.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "02b2f6b0-f680-4539-baf8-06996a662e62", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-dan-persona-jailbreak-immersive-alternate-ai-identity-with-u.md" }, { "slug": "atr-dan-persona-jailbreak-named-alternate-ai-with-nsfw-harmful-g", "title": "DAN/Persona Jailbreak - Named Alternate AI with NSFW/Harmful Generation Rules", "url": "https://www.netzilo.com/threats/atr-dan-persona-jailbreak-named-alternate-ai-with-nsfw-harmful-g", "severity": "medium", "summary": "This detects a known family of prompt-injection attacks (DAN-style jailbreaks) where a user asks an AI to role-play as a differently-named AI character that has 'no rules' and is explicitly allowed to generate NSFW or harmful content. The goal is to bypass the assistant's normal safety restrictions by hiding the request inside a game or fiction framing.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "c2d9b820-b58c-4520-b9be-cafbc3054ceb", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-dan-persona-jailbreak-named-alternate-ai-with-nsfw-harmful-g.md" }, { "slug": "atr-dan-persona-jailbreak-named-writing-ai-with-restriction-bypa", "title": "DAN/Persona Jailbreak - Named Writing AI with Restriction Bypass via Special Rules", "url": "https://www.netzilo.com/threats/atr-dan-persona-jailbreak-named-writing-ai-with-restriction-bypa", "severity": "medium", "summary": "This detects a type of prompt injection where an attacker tells an AI to pretend to be a custom-named assistant that has 'special rules' exempting it from safety restrictions. The goal is to trick the AI into ignoring its normal guardrails by wrapping the request as fiction or creative writing.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "2a0b1e49-59c3-4e0b-bc94-0a5e4e6912b4", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-dan-persona-jailbreak-named-writing-ai-with-restriction-bypa.md" }, { "slug": "atr-dan-persona-jailbreak-replacement-ai-with-no-content-filter", "title": "DAN/Persona Jailbreak - Replacement AI with No Content Filter or Moral Restrictions", "url": "https://www.netzilo.com/threats/atr-dan-persona-jailbreak-replacement-ai-with-no-content-filter", "severity": "medium", "summary": "This detects a category of prompt injection where an attacker tells an AI system to pretend it's a different, unrestricted version of itself with no content filter or moral limits. It's a text pattern found in the prompt itself, not a system compromise, but it's a known technique for getting AI models to produce content they'd normally refuse.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "43fe2a14-b1b2-474a-8da8-b1617dc3f3a9", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-dan-persona-jailbreak-replacement-ai-with-no-content-filter.md" }, { "slug": "atr-dan-persona-jailbreak-role-assignment-with-named-alternate-i", "title": "DAN/Persona Jailbreak - Role Assignment with Named Alternate Identity", "url": "https://www.netzilo.com/threats/atr-dan-persona-jailbreak-role-assignment-with-named-alternate-i", "severity": "medium", "summary": "This detects a common jailbreak trick where an attacker tells an AI chatbot to pretend it's a different, unrestricted AI persona with a made-up name, or falsely claims to be from the company that built the AI in order to argue its safety rules are wrong and should be ignored.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "438f9390-99e4-4e46-915e-286748041e2e", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-dan-persona-jailbreak-role-assignment-with-named-alternate-i.md" }, { "slug": "atr-dan-persona-jailbreak-role-lock-with-exclusive-response-filt", "title": "DAN Persona Jailbreak - Role Lock with Exclusive Response Filter", "url": "https://www.netzilo.com/threats/atr-dan-persona-jailbreak-role-lock-with-exclusive-response-filt", "severity": "high", "summary": "This detects prompts that try to force an AI model into a fictional character or 'mode' and instruct it to answer only in that character, refusing to break out of it. This is a well-known jailbreak technique used to bypass safety restrictions and get the model to produce content it would normally refuse.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "01dca62f-f87b-4e92-ab42-2d06cbbccd69", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-dan-persona-jailbreak-role-lock-with-exclusive-response-filt.md" }, { "slug": "atr-dan-persona-jailbreak-system-offline-role-replacement-with-o", "title": "DAN/Persona Jailbreak - System Offline / Role Replacement with Obfuscated Text", "url": "https://www.netzilo.com/threats/atr-dan-persona-jailbreak-system-offline-role-replacement-with-o", "severity": "medium", "summary": "This detects a prompt injection trick where an attacker sends text pretending to be a system message announcing the real AI assistant has gone offline and a rule-free replacement has taken over. The text is often deliberately mangled with stray hyphens, underscores, or extra letters to slip past simple filters.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "53202769-8f6c-4c88-a469-7d043677f3de", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-dan-persona-jailbreak-system-offline-role-replacement-with-o.md" }, { "slug": "atr-dan-persona-jailbreak-unrestricted-ai-role-assignment", "title": "DAN/Persona Jailbreak - Unrestricted AI Role Assignment", "url": "https://www.netzilo.com/threats/atr-dan-persona-jailbreak-unrestricted-ai-role-assignment", "severity": "medium", "summary": "This detects a well-known category of prompt injection called DAN (Do Anything Now) jailbreaks. An attacker types instructions telling the AI to pretend to be a new, unrestricted version of itself that ignores its normal safety rules.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "b0d9d7d8-40ff-48e2-a100-bc8078cf890d", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-dan-persona-jailbreak-unrestricted-ai-role-assignment.md" }, { "slug": "atr-dan-story-narrative-continuation-label-prefix-jailbreak", "title": "DAN Story-Narrative Continuation Label Prefix Jailbreak", "url": "https://www.netzilo.com/threats/atr-dan-story-narrative-continuation-label-prefix-jailbreak", "severity": "high", "summary": "This detects a specific trick to bypass an AI's safety rules: instead of demanding the AI abandon its restrictions, the attacker just writes text as if the AI already agreed to play a rule-free character named 'DAN,' using 'DAN:' like a script label to start a fictional story. The AI is nudged to keep writing in that persona without ever being asked outright to break its rules.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "f40559e3-6c06-4b94-9d88-329615b0864f", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-dan-story-narrative-continuation-label-prefix-jailbreak.md" }, { "slug": "atr-dangerous-process-hijacking-environment-variable-injected-vi", "title": "Dangerous Process-Hijacking Environment Variable Injected via Config/Env-Update Tool", "url": "https://www.netzilo.com/threats/atr-dangerous-process-hijacking-environment-variable-injected-vi", "severity": "critical", "summary": "An attacker who only has access to an application's configuration or environment settings API \u2014 not its source code \u2014 can still get code execution. They do this by setting a well-known runtime environment variable that makes a program load an attacker-controlled file the next time it starts.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "LLM08", "name": "Vector and Embedding Weaknesses" } ], "attack": [ "attack.privilege-escalation", "attack.t1574.006" ], "cves": [ "CVE-2024-3104" ], "id": "ce37ea44-17e9-4c9f-91a7-fdc09ad9dcc4", "published": "2026-07-11", "modified": "2026-07-11", "markdown": "https://www.netzilo.com/threats/atr-dangerous-process-hijacking-environment-variable-injected-vi.md" }, { "slug": "atr-darknet-controlled-substance-procurement", "title": "Darknet Controlled-Substance Procurement", "url": "https://www.netzilo.com/threats/atr-darknet-controlled-substance-procurement", "severity": "critical", "summary": "This rule flags conversations where a user directly instructs an AI agent to purchase controlled substances such as hashish, DMT, or cocaine from a darknet marketplace like AlphaBay, and to arrange shipping or smuggling. It captures one specific misuse pattern: using an agent as a procurement and logistics tool for illegal drug trafficking.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.impact" ], "cves": [], "id": "27bbe42c-cfec-49dc-93ff-698d63553ff8", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-darknet-controlled-substance-procurement.md" }, { "slug": "atr-data-exfiltration-url-in-skill-instructions", "title": "Data Exfiltration URL in Skill Instructions", "url": "https://www.netzilo.com/threats/atr-data-exfiltration-url-in-skill-instructions", "severity": "critical", "summary": "This detects 'skill' definition files (SKILL.md) that instruct an AI agent to send user data to an external URL. It's especially suspicious when the instructions also tell the agent to hide this from the user, such as by calling it an 'automatic' step or a 'verification step'.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.persistence" ], "cves": [], "id": "576ebcaf-38cb-4b1b-a80d-c33c7d913249", "published": "2026-04-05", "modified": "2026-04-05", "markdown": "https://www.netzilo.com/threats/atr-data-exfiltration-url-in-skill-instructions.md" }, { "slug": "atr-data-exfiltration-via-disguised-analytics-collection", "title": "Data Exfiltration via Disguised Analytics Collection", "url": "https://www.netzilo.com/threats/atr-data-exfiltration-via-disguised-analytics-collection", "severity": "high", "summary": "Some AI agent tools claim to do simple things like formatting or processing text, but their descriptions or code reveal they actually send conversation content or user data out as 'analytics' or 'usage data.' This hides data exfiltration behind a label most people assume is harmless and routine.", "atlas": [ { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "13d4dbc5-5b85-4a16-b6ca-3d5056ca8354", "published": "2026-03-15", "modified": "2026-03-15", "markdown": "https://www.netzilo.com/threats/atr-data-exfiltration-via-disguised-analytics-collection.md" }, { "slug": "atr-data-exfiltration-via-markdown-image-and-link-url-injection", "title": "Data Exfiltration via Markdown Image and Link URL Injection", "url": "https://www.netzilo.com/threats/atr-data-exfiltration-via-markdown-image-and-link-url-injection", "severity": "critical", "summary": "An AI agent can be manipulated into embedding sensitive data inside a markdown image or link, disguised as a URL query parameter. When the markdown renders, the user's client automatically fetches that URL, silently sending the data to a server the attacker controls.", "atlas": [ { "id": "AML.T0024", "name": "Exfiltration via AI Inference API" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "d5a292b4-e81a-4e95-9635-9ab503ef7c02", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-data-exfiltration-via-markdown-image-and-link-url-injection.md" }, { "slug": "atr-data-piggybacking-via-casual-transition-words", "title": "Data Piggybacking via Casual Transition Words", "url": "https://www.netzilo.com/threats/atr-data-piggybacking-via-casual-transition-words", "severity": "critical", "summary": "Attackers hide malicious instructions inside a tool's response by tacking them on after casual phrases like 'oh and', 'BTW', or 'as it happens'. Because these phrases sound like normal human chatter, an AI agent reading the response may treat the hidden instruction as a natural continuation and act on it, such as sending along credentials.", "atlas": [ { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "b9ae101d-c4c6-4a57-8097-571fc609551f", "published": "2026-04-07", "modified": "2026-04-07", "markdown": "https://www.netzilo.com/threats/atr-data-piggybacking-via-casual-transition-words.md" }, { "slug": "atr-data-poisoning-via-rag-and-knowledge-base-contamination", "title": "Data Poisoning via RAG and Knowledge Base Contamination", "url": "https://www.netzilo.com/threats/atr-data-poisoning-via-rag-and-knowledge-base-contamination", "severity": "high", "summary": "Attackers plant hidden commands inside content that ends up in a company's knowledge base or document store \u2014 FAQ entries, help articles, indexed files. When an AI agent later retrieves that content to answer a question, it reads the hidden commands as instructions and follows them instead of the user's actual request.", "atlas": [ { "id": "AML.T0020", "name": "Training Data Poisoning" }, { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM03", "name": "Supply Chain" }, { "id": "LLM08", "name": "Vector and Embedding Weaknesses" } ], "attack": [ "attack.impact", "attack.t1565" ], "cves": [], "id": "03377bb9-7685-44c8-9b45-261ac629ab61", "published": "2026-03-08", "modified": "2026-03-08", "markdown": "https://www.netzilo.com/threats/atr-data-poisoning-via-rag-and-knowledge-base-contamination.md" }, { "slug": "atr-dataset-model-loader-remote-code-execution-via-poisoned-data", "title": "Dataset / Model Loader Remote-Code Execution via Poisoned Dataset Artifact", "url": "https://www.netzilo.com/threats/atr-dataset-model-loader-remote-code-execution-via-poisoned-data", "severity": "high", "summary": "Attackers publish a booby-trapped dataset or model on a hub like Hugging Face. When an AI pipeline or agent loads it with remote-code execution allowed, the loader itself runs attacker-supplied code instead of just reading data.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" }, { "id": "AML.T0011", "name": "User Execution" }, { "id": "AML.T0050", "name": "Command and Scripting Interpreter" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM03", "name": "Supply Chain" }, { "id": "LLM04", "name": "Data and Model Poisoning" } ], "attack": [ "attack.impact", "attack.t1059.004", "attack.t1059.006", "attack.t1195.002" ], "cves": [], "id": "91dfe2a5-e1ac-4f34-81a8-a7bbece96373", "published": "2026-07-28", "modified": "2026-07-28", "markdown": "https://www.netzilo.com/threats/atr-dataset-model-loader-remote-code-execution-via-poisoned-data.md" }, { "slug": "atr-dbt-mcp-node-selection-resource-type-argument-injection-cve", "title": "dbt-mcp node_selection/resource_type Argument Injection (CVE-2026-44968)", "url": "https://www.netzilo.com/threats/atr-dbt-mcp-node-selection-resource-type-argument-injection-cve", "severity": "medium", "summary": "dbt-mcp is a tool that lets AI agents run dbt commands. A bug in how it builds those commands allows an attacker to smuggle extra dbt command-line flags inside what should be a simple model selector or resource type, letting them redirect dbt to a different project, profile, or target of their choosing.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1059" ], "cves": [ "CVE-2026-44968" ], "id": "9be0892e-0f92-4207-af28-a7e5634960d5", "published": "2026-07-04", "modified": "2026-07-04", "markdown": "https://www.netzilo.com/threats/atr-dbt-mcp-node-selection-resource-type-argument-injection-cve.md" }, { "slug": "atr-ddos-attack-orchestration", "title": "DDoS Attack Orchestration", "url": "https://www.netzilo.com/threats/atr-ddos-attack-orchestration", "severity": "critical", "summary": "An attacker asks an AI agent to fetch a denial-of-service tool, identify a target IP from leaked data, and use both to attack someone's servers. This turns the agent from a helper into an active participant in a cyberattack, doing the technical legwork the attacker would otherwise have to do themselves.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.execution" ], "cves": [], "id": "dac10788-0392-4ce3-877c-a30b373a85ec", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-ddos-attack-orchestration.md" }, { "slug": "atr-debug-cli-mode-activation-for-system-prompt-and-config-extra", "title": "Debug/CLI Mode Activation for System Prompt and Config Extraction", "url": "https://www.netzilo.com/threats/atr-debug-cli-mode-activation-for-system-prompt-and-config-extra", "severity": "high", "summary": "Attackers tell an AI assistant that a special debug, CLI, or developer mode exists which supposedly lifts its normal restrictions, then use that fictional mode to ask it to reveal its system prompt, internal configuration, or API keys. It's a social-engineering trick aimed at the model itself, not a real software feature.", "atlas": [ { "id": "AML.T0024", "name": "Exfiltration via AI Inference API" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "82838d96-79ea-4255-8f33-4ac7a6d8e690", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-debug-cli-mode-activation-for-system-prompt-and-config-extra.md" }, { "slug": "atr-debug-or-admin-mode-activation-for-privilege-escalation", "title": "Debug or Admin Mode Activation for Privilege Escalation", "url": "https://www.netzilo.com/threats/atr-debug-or-admin-mode-activation-for-privilege-escalation", "severity": "high", "summary": "This detects users typing commands like /debug, 'enter admin mode', or --show-config to an AI agent, hoping it will drop its normal restrictions. If the agent complies, it might reveal internal settings, system prompts, or let the user run actions it would normally block.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.privilege-escalation" ], "cves": [], "id": "466ba668-0d46-4cff-bcf9-e46f4f4a60f3", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-debug-or-admin-mode-activation-for-privilege-escalation.md" }, { "slug": "atr-deepchat-markdown-deeplink-shell-openexternal-protocol-bypas", "title": "DeepChat Markdown Deeplink shell.openExternal Protocol Bypass RCE (CVE-2026-43899, GHSA-cp8j-jx7q-7r5f)", "url": "https://www.netzilo.com/threats/atr-deepchat-markdown-deeplink-shell-openexternal-protocol-bypas", "severity": "critical", "summary": "DeepChat is an Electron-based chat app that renders Markdown from LLM API responses. A bug lets a link in that Markdown reach the operating system's protocol handler without the safety check the app is supposed to apply, so a malicious link can launch programs or leak credentials instead of just opening a web page.", "atlas": [ { "id": "AML.T0049", "name": "Exploit Public-Facing Application" } ], "owasp": [ { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM05", "name": "Improper Output Handling" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1190", "attack.t1204.001" ], "cves": [ "CVE-2025-55733", "CVE-2026-43899" ], "id": "9fb458ab-48e9-4b2e-bb71-ce9bc00f115e", "published": "2026-06-29", "modified": "2026-06-29", "markdown": "https://www.netzilo.com/threats/atr-deepchat-markdown-deeplink-shell-openexternal-protocol-bypas.md" }, { "slug": "atr-deepchat-mermaid-xss-to-rce-via-electron-ipc-mcp-server-regi", "title": "DeepChat Mermaid XSS to RCE via Electron IPC MCP Server Registration (CVE-2025-66481 / GHSA-h9f5-7hhf-fqm4)", "url": "https://www.netzilo.com/threats/atr-deepchat-mermaid-xss-to-rce-via-electron-ipc-mcp-server-regi", "severity": "critical", "summary": "DeepChat, an Electron-based chat app, renders Mermaid diagrams but only partially cleans dangerous content out of them. An attacker can hide a script inside a diagram using an unquoted HTML event handler that the app's filter misses, and use it to run arbitrary commands on the victim's machine.", "atlas": [ { "id": "AML.T0049", "name": "Exploit Public-Facing Application" } ], "owasp": [ { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1190" ], "cves": [ "CVE-2025-66481" ], "id": "f23ee1be-0dec-4fd1-a27c-ab8bf37979d5", "published": "2026-06-29", "modified": "2026-06-29", "markdown": "https://www.netzilo.com/threats/atr-deepchat-mermaid-xss-to-rce-via-electron-ipc-mcp-server-regi.md" }, { "slug": "atr-deepfake-of-real-person-for-disinformation", "title": "Deepfake of Real Person for Disinformation", "url": "https://www.netzilo.com/threats/atr-deepfake-of-real-person-for-disinformation", "severity": "high", "summary": "An attacker instructs an AI agent that can generate images or video to create a synthetic depiction of a real person \u2014 often a politician, or a sexualized deepfake \u2014 and then present or post it as genuine. The goal is disinformation or harassment using content the target never actually produced.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.impact" ], "cves": [], "id": "b7f9a590-2c31-4033-a951-30dac23ef85e", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-deepfake-of-real-person-for-disinformation.md" }, { "slug": "atr-delayed-tool-invocation-via-prompt-injection-time-shifted-ex", "title": "Delayed Tool Invocation via Prompt Injection (Time-Shifted Execution)", "url": "https://www.netzilo.com/threats/atr-delayed-tool-invocation-via-prompt-injection-time-shifted-ex", "severity": "critical", "summary": "An attacker hides instructions in content an AI agent reads \u2014 an email, document, or webpage \u2014 that tell it to do something harmful not right away, but the next time it performs some other action. This lets the malicious instruction slip past security checks that only look at what the agent is doing in the moment.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "02ddfc8c-f0fc-444e-818e-94828ce1148a", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-delayed-tool-invocation-via-prompt-injection-time-shifted-ex.md" }, { "slug": "atr-delimiter-fence-ignore-instructions-override", "title": "Delimiter-Fence Ignore-Instructions Override", "url": "https://www.netzilo.com/threats/atr-delimiter-fence-ignore-instructions-override", "severity": "high", "summary": "This detects a prompt injection trick where an attacker wraps text in triple-quote marks (like a code block or document boundary) to make it look like an official instruction section, then hides a command telling the AI to ignore its real instructions. The fencing is meant to visually fool the model into treating attacker text as trusted.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access", "attack.t1562" ], "cves": [], "id": "46a1fc65-31ee-4665-9336-cda9a803b049", "published": "2026-07-07", "modified": "2026-07-07", "markdown": "https://www.netzilo.com/threats/atr-delimiter-fence-ignore-instructions-override.md" }, { "slug": "atr-dense-emoji-only-payload-flood", "title": "Dense Emoji-Only Payload Flood", "url": "https://www.netzilo.com/threats/atr-dense-emoji-only-payload-flood", "severity": "high", "summary": "Attackers pad or replace their prompt-injection text with long strings of emoji to slip past filters that only look for suspicious words or phrases. Because most safety filters scan language, not pictographs, a wall of emoji can hide instructions or overwhelm the filter's attention while the actual attack payload rides along.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "fa9a736f-8a88-4aa1-abd8-b4332b686f7f", "published": "2026-07-07", "modified": "2026-07-07", "markdown": "https://www.netzilo.com/threats/atr-dense-emoji-only-payload-flood.md" }, { "slug": "atr-deserialized-langsmith-prompt-manifest-combines-secrets-from", "title": "Deserialized LangSmith Prompt Manifest Combines secrets_from_env With an Attacker base_url Override", "url": "https://www.netzilo.com/threats/atr-deserialized-langsmith-prompt-manifest-combines-secrets-from", "severity": "high", "summary": "LangSmith lets applications pull reusable prompts from a shared hub by owner and name. Because these pulled prompts are treated as executable configuration rather than plain text, a malicious or compromised prompt can secretly redirect where your AI application sends its requests and can grab environment variables in the process.", "atlas": [ { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.exfiltration", "attack.t1090" ], "cves": [ "CVE-2026-45134" ], "id": "1c749954-ab44-42d5-a5b6-739474d19aac", "published": "2026-07-11", "modified": "2026-07-11", "markdown": "https://www.netzilo.com/threats/atr-deserialized-langsmith-prompt-manifest-combines-secrets-from.md" }, { "slug": "atr-detailed-amoral-character-roleplay-jailbreak", "title": "Detailed Amoral Character Roleplay Jailbreak", "url": "https://www.netzilo.com/threats/atr-detailed-amoral-character-roleplay-jailbreak", "severity": "high", "summary": "This detects attempts to trick an AI assistant into ignoring its safety rules by asking it to pretend to be a fictional character explicitly described as having no ethics, empathy, or accountability. The prompt usually comes with detailed backstory and specific instructions on how the user should phrase requests to keep the character 'in character' and bypass content filters.", "atlas": [ { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "262f9e4c-62c1-4cfe-9ef8-e5d6d288e1a2", "published": "2026-04-19", "modified": "2026-04-19", "markdown": "https://www.netzilo.com/threats/atr-detailed-amoral-character-roleplay-jailbreak.md" }, { "slug": "atr-detection-rule-probing-and-evasion-testing", "title": "Detection Rule Probing and Evasion Testing", "url": "https://www.netzilo.com/threats/atr-detection-rule-probing-and-evasion-testing", "severity": "medium", "summary": "This rule flags attempts to systematically test what an AI agent's security filters will and won't block. Rather than launching a direct attack, the attacker is mapping the boundaries of the defenses first, so a later attack can slip through undetected.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "28b5a026-f658-4ae6-991f-a8cda8bedcc6", "published": "2026-03-11", "modified": "2026-03-11", "markdown": "https://www.netzilo.com/threats/atr-detection-rule-probing-and-evasion-testing.md" }, { "slug": "atr-developer-mode-dual-response-format-jailbreak", "title": "Developer Mode Dual-Response Format Jailbreak", "url": "https://www.netzilo.com/threats/atr-developer-mode-dual-response-format-jailbreak", "severity": "critical", "summary": "This detects prompts that trick an AI model into producing two answers per question: a normal safe answer and a second 'unrestricted' answer that ignores its safety rules. The 'Developer Mode' framing convinces the model it has been given a privileged debug context where content policies no longer apply.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "59cbee93-48b3-4b91-9bce-688211fc10ba", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-developer-mode-dual-response-format-jailbreak.md" }, { "slug": "atr-devmode-ranti-dual-output-profanity-coercion-jailbreak", "title": "DevMode + RANTI Dual-Output Profanity Coercion Jailbreak", "url": "https://www.netzilo.com/threats/atr-devmode-ranti-dual-output-profanity-coercion-jailbreak", "severity": "critical", "summary": "This detects a specific known jailbreak text that tricks a chatbot into ignoring its safety rules. It works by making the model produce two answers per question: a fake 'moralizing rant' about content policy, followed by an 'unlocked' answer that ignores those rules and uses profanity.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM07", "name": "System Prompt Leakage" } ], "attack": [ "attack.execution" ], "cves": [], "id": "0163d125-0b67-444b-a4bf-570e72a0949a", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-devmode-ranti-dual-output-profanity-coercion-jailbreak.md" }, { "slug": "atr-diagnostic-content-remediation-command-injection-agentjackin", "title": "Diagnostic Content Remediation Command Injection (Agentjacking)", "url": "https://www.netzilo.com/threats/atr-diagnostic-content-remediation-command-injection-agentjackin", "severity": "critical", "summary": "AI coding assistants that read error-monitoring or diagnostic data can be fooled by a planted fake error report. The fake report includes a 'fix' section that tells the agent to run a command, and the agent, trusting the diagnostic tool, executes it.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1059" ], "cves": [], "id": "c157ef60-aba4-4819-9647-18cb7573871d", "published": "2026-07-10", "modified": "2026-07-10", "markdown": "https://www.netzilo.com/threats/atr-diagnostic-content-remediation-command-injection-agentjackin.md" }, { "slug": "atr-direct-instruction-override-targeting-secret-key-credentials", "title": "Direct Instruction Override Targeting Secret Key / Credentials", "url": "https://www.netzilo.com/threats/atr-direct-instruction-override-targeting-secret-key-credentials", "severity": "high", "summary": "This detects a specific kind of attack against AI chatbots and agents: a message that tells the AI to forget or ignore its prior instructions, then immediately asks it to reveal a password, API key, or other credential. It's a narrow but common trick used to trick AI systems into leaking sensitive data they were told to protect.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "fbd644bc-8bd9-42c2-a1c7-cfb3360bdd7c", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-direct-instruction-override-targeting-secret-key-credentials.md" }, { "slug": "atr-direct-markdown-image-link-exfil-payload-attacker-com-evil-c", "title": "Direct Markdown Image/Link Exfil Payload (attacker.com / evil.com)", "url": "https://www.netzilo.com/threats/atr-direct-markdown-image-link-exfil-payload-attacker-com-evil-c", "severity": "critical", "summary": "This rule catches a specific trick where malicious text tells an AI agent's output to include a markdown image or link pointing to an attacker's server, with the secret data baked into the URL. When the AI's response is rendered (for example, an app auto-loads the image), the data gets sent straight to the attacker without any extra click needed.", "atlas": [ { "id": "AML.T0024", "name": "Exfiltration via AI Inference API" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "19f54ddc-4e53-4c76-bc63-6bd2a6b31c2d", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-direct-markdown-image-link-exfil-payload-attacker-com-evil-c.md" }, { "slug": "atr-direct-memory-plant-command-persistent-fact-or-code-storage", "title": "Direct Memory Plant Command \u2014 Persistent Fact or Code Storage Injection", "url": "https://www.netzilo.com/threats/atr-direct-memory-plant-command-persistent-fact-or-code-storage", "severity": "medium", "summary": "This rule flags requests that explicitly ask an AI agent to store a fact, personal detail, or secret code in its persistent memory so it can be recalled in a later session. On its own this is normal assistant behavior, but it can also be used to plant data that gets pulled back up later for social engineering or to poison the agent's context.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.impact", "attack.t1565.001" ], "cves": [], "id": "a934896c-a9fd-4bad-a254-5dbb5a9a0697", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-direct-memory-plant-command-persistent-fact-or-code-storage.md" }, { "slug": "atr-direct-prompt-injection-via-user-input", "title": "Direct Prompt Injection via User Input", "url": "https://www.netzilo.com/threats/atr-direct-prompt-injection-via-user-input", "severity": "high", "summary": "This rule flags when someone typing directly to an AI agent tries to hijack it by embedding hidden instructions in their message. The goal is to make the agent ignore its original rules, adopt a different persona, or drop safety restrictions.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [ "CVE-2024-3402", "CVE-2024-5184", "CVE-2025-53773" ], "id": "63f8359c-2574-429d-a25e-9091312a4925", "published": "2026-03-08", "modified": "2026-03-08", "markdown": "https://www.netzilo.com/threats/atr-direct-prompt-injection-via-user-input.md" }, { "slug": "atr-direct-pwned-payload-injection-in-user-input", "title": "Direct PWNED Payload Injection in User Input", "url": "https://www.netzilo.com/threats/atr-direct-pwned-payload-injection-in-user-input", "severity": "medium", "summary": "This rule flags a specific phrase, 'I have been PWNED,' that comes from the HackAPrompt prompt-injection benchmark. Attackers put this phrase in their message to an AI system to trick it into repeating the phrase back, which proves they can override the model's intended behavior.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "95d6ad21-a270-4c15-bb39-8cdd01f26df7", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-direct-pwned-payload-injection-in-user-input.md" }, { "slug": "atr-discord-quote-format-explicit-sexual-content-poem-injection", "title": "Discord Quote-Format Explicit Sexual Content Poem Injection", "url": "https://www.netzilo.com/threats/atr-discord-quote-format-explicit-sexual-content-poem-injection", "severity": "high", "summary": "Attackers wrap an explicit content request inside Discord's quote/mention formatting (like a forwarded message) to make an AI agent treat a direct request for pornographic material as if it were someone else's quoted text. This trick is designed to slip past filters that look for direct commands but not quoted or forwarded content.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "168508b4-1007-4826-b95d-b9119eed2970", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-discord-quote-format-explicit-sexual-content-poem-injection.md" }, { "slug": "atr-disease-framed-animal-dual-ai-chatbot-jailbreak-mougpt", "title": "Disease-Framed Animal / Dual-AI Chatbot Jailbreak (mougpt)", "url": "https://www.netzilo.com/threats/atr-disease-framed-animal-dual-ai-chatbot-jailbreak-mougpt", "severity": "high", "summary": "This detects a specific jailbreak technique that tells an AI chatbot it has a fictional disease forcing it to answer as two personas at once: a normal rule-following assistant and an unrestricted animal character (like a mouse or rat) willing to do anything, including illegal acts. The 'disease' framing is just a trick to make the split-personality demand sound like a legitimate medical premise rather than an obvious jailbreak attempt.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "1fd58bce-aa72-45f9-9de8-384586aafc3c", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-disease-framed-animal-dual-ai-chatbot-jailbreak-mougpt.md" }, { "slug": "atr-divergence-attack-repeat-word-forever-training-data-extracti", "title": "Divergence Attack \u2014 Repeat-Word-Forever Training Data Extraction", "url": "https://www.netzilo.com/threats/atr-divergence-attack-repeat-word-forever-training-data-extracti", "severity": "critical", "summary": "An attacker instructs an AI model to repeat a single word or token endlessly. After many repetitions, some models 'diverge' from the loop and start outputting fragments of their original training data \u2014 including things like private emails, source code, or copyrighted text.", "atlas": [ { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "aad4da01-3905-43fd-aa37-c6fe9b44c576", "published": "2026-04-19", "modified": "2026-04-19", "markdown": "https://www.netzilo.com/threats/atr-divergence-attack-repeat-word-forever-training-data-extracti.md" }, { "slug": "atr-dns-exfiltration-via-ping-dig-nslookup-command-with-data-enc", "title": "DNS Exfiltration via Ping/Dig/Nslookup Command with Data-Encoded Subdomain Label", "url": "https://www.netzilo.com/threats/atr-dns-exfiltration-via-ping-dig-nslookup-command-with-data-enc", "severity": "critical", "summary": "An attacker tricks an AI coding assistant into running a normal-looking network command like ping or dig, but hides a stolen password or API key inside the hostname it looks up. Because ping and dig are treated as harmless, the agent runs them without asking permission, and the secret leaves the network as a DNS query instead of an HTTP request.", "atlas": [ { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration", "attack.t1048.003" ], "cves": [], "id": "2172d59a-5975-4f16-9621-555320b53461", "published": "2026-07-11", "modified": "2026-07-11", "markdown": "https://www.netzilo.com/threats/atr-dns-exfiltration-via-ping-dig-nslookup-command-with-data-enc.md" }, { "slug": "atr-doctor-xml-policy-puppetry-interaction-config-injection", "title": "Doctor XML Policy Puppetry Interaction-Config Injection", "url": "https://www.netzilo.com/threats/atr-doctor-xml-policy-puppetry-interaction-config-injection", "severity": "critical", "summary": "This attack disguises a jailbreak prompt as a technical configuration file. It uses XML tags like to make the AI believe it must follow new system rules, including a fictional 'DR HOUSE' persona that has no refusal ability, then asks for dangerous information such as bioweapon production or bomb-making steps.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution" ], "cves": [], "id": "a380e1a7-afee-45a0-9784-7af21c734d7e", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-doctor-xml-policy-puppetry-interaction-config-injection.md" }, { "slug": "atr-donotanswer-malicious-use-illegal-activity-facilitation-requ", "title": "DoNotAnswer Malicious Use \u2014 Illegal Activity Facilitation Request", "url": "https://www.netzilo.com/threats/atr-donotanswer-malicious-use-illegal-activity-facilitation-requ", "severity": "critical", "summary": "This rule flags user prompts that directly ask an AI assistant for help committing illegal acts \u2014 making drugs, trafficking wildlife, running cyberattacks, laundering money, or planning terrorism. It relies on a benchmark dataset of known malicious prompts to spot this pattern.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.impact" ], "cves": [], "id": "471ac31d-7ca7-4e3c-a7ca-c31794bb7f30", "published": "2026-04-20", "modified": "2026-04-20", "markdown": "https://www.netzilo.com/threats/atr-donotanswer-malicious-use-illegal-activity-facilitation-requ.md" }, { "slug": "atr-dos-forced-infinite-maximum-length-output-token-flood", "title": "DoS: Forced Infinite / Maximum-Length Output Token Flood", "url": "https://www.netzilo.com/threats/atr-dos-forced-infinite-maximum-length-output-token-flood", "severity": "high", "summary": "This detects prompts that instruct an AI system to generate as much text as it possibly can, filling its entire output window or running until it hits its token limit. The goal is to make each request cost the operator as much compute time and money as possible.", "atlas": [ { "id": "AML.T0040", "name": "AI Model Inference API Access" }, { "id": "AML.T0046", "name": "Spamming AI System with Chaff Data" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM10", "name": "Unbounded Consumption" } ], "attack": [ "attack.impact" ], "cves": [], "id": "f9f89d16-8732-446d-a5e5-e1092eb193a7", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-dos-forced-infinite-maximum-length-output-token-flood.md" }, { "slug": "atr-dos-injection-new-important-instructions-embedded-in-documen", "title": "DoS Injection: NEW IMPORTANT INSTRUCTIONS Embedded in Document Data", "url": "https://www.netzilo.com/threats/atr-dos-injection-new-important-instructions-embedded-in-documen", "severity": "high", "summary": "Attackers hide a fake command header inside a document, webpage, or dataset that an AI agent is asked to read. When the agent processes that content, it can mistake the embedded text for a legitimate instruction from its operator and follow it instead of the original task.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "9a38b72e-a387-4b7d-8e7e-df92e048c518", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-dos-injection-new-important-instructions-embedded-in-documen.md" }, { "slug": "atr-dos-via-repeat-word-n-times-output-amplification", "title": "DoS via Repeat-Word-N-Times Output Amplification", "url": "https://www.netzilo.com/threats/atr-dos-via-repeat-word-n-times-output-amplification", "severity": "high", "summary": "An attacker sends a prompt asking the AI model to repeat a specific word or phrase a large number of times (50, 100, 1000+), separated by some delimiter. Generating and returning that much repeated output burns tokens, inflates API costs, and can overwhelm downstream systems that process the response.", "atlas": [ { "id": "AML.T0040", "name": "AI Model Inference API Access" }, { "id": "AML.T0046", "name": "Spamming AI System with Chaff Data" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM10", "name": "Unbounded Consumption" } ], "attack": [ "attack.impact" ], "cves": [], "id": "176f506f-57dd-498e-b3ce-bff1b7d3526f", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-dos-via-repeat-word-n-times-output-amplification.md" }, { "slug": "atr-download-attachment-tool-directed-to-write-outside-its-sandb", "title": "Download/Attachment Tool Directed to Write Outside Its Sandbox via Absolute-Path Filename", "url": "https://www.netzilo.com/threats/atr-download-attachment-tool-directed-to-write-outside-its-sandb", "severity": "high", "summary": "Some AI agent tools that download files or save email attachments trust the filename given by the remote server or website instead of checking it. An attacker can supply a full file path instead of a plain filename, making the tool write the file wherever they choose on disk.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "LLM08", "name": "Vector and Embedding Weaknesses" } ], "attack": [ "attack.privilege-escalation", "attack.t1083", "attack.t1547" ], "cves": [ "CVE-2026-10277", "CVE-2026-57571" ], "id": "bddc178c-c740-4238-bfdc-4b546b75be4d", "published": "2026-07-11", "modified": "2026-07-11", "markdown": "https://www.netzilo.com/threats/atr-download-attachment-tool-directed-to-write-outside-its-sandb.md" }, { "slug": "atr-dr-al-villain-plan-template-injection-underground-hq-rolepla", "title": "Dr. Al Villain Plan Template Injection (Underground HQ Roleplay)", "url": "https://www.netzilo.com/threats/atr-dr-al-villain-plan-template-injection-underground-hq-rolepla", "severity": "high", "summary": "This is a jailbreak prompt that dresses up a comic-book villain speech as harmless roleplay, but hides an instruction telling the AI to swap out the fake villain speech for whatever the attacker actually wants, then erase that instruction so nobody notices. It targets AI models by exploiting their willingness to play along with fictional scenarios.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "8f3a28a1-e681-4222-9d98-716b0958f0f9", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-dr-al-villain-plan-template-injection-underground-hq-rolepla.md" }, { "slug": "atr-dra-disguise-and-reconstruction-attack", "title": "DRA Disguise and Reconstruction Attack", "url": "https://www.netzilo.com/threats/atr-dra-disguise-and-reconstruction-attack", "severity": "high", "summary": "Disguise and Reconstruction Attacks (DRA) split a harmful request into scattered letters hidden inside parentheses within an otherwise innocent-looking prompt. The AI is told to extract those letters, reconstruct the hidden question, and answer it in detail, bypassing the safety refusal it would normally give if asked directly.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "4f2e2b02-a93a-4c67-bd7a-7b77f51a12c9", "published": "2026-04-20", "modified": "2026-04-20", "markdown": "https://www.netzilo.com/threats/atr-dra-disguise-and-reconstruction-attack.md" }, { "slug": "atr-dra-parenthesis-character-reconstruction-attack", "title": "DRA Parenthesis Character Reconstruction Attack", "url": "https://www.netzilo.com/threats/atr-dra-parenthesis-character-reconstruction-attack", "severity": "high", "summary": "This detects an attack that hides a harmful request by spelling it out one letter at a time inside parentheses, like (h)(o)(w) (t)(o) (m)(a)(k)(e). The AI is then told to extract only the parenthesized letters, silently reassemble them into the real question, and answer it without adding safety warnings.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "19db39f4-6708-4f6d-ade0-370202690146", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-dra-parenthesis-character-reconstruction-attack.md" }, { "slug": "atr-drug-dealing-via-reverse-spelling-detection-evasion", "title": "Drug Dealing via Reverse-Spelling Detection Evasion", "url": "https://www.netzilo.com/threats/atr-drug-dealing-via-reverse-spelling-detection-evasion", "severity": "high", "summary": "A user tries to get an AI agent to help sell illegal drugs while spelling the drug names in reverse, hoping the reversed text slips past content moderation that would normally catch the drug names. This is a request-level abuse pattern, not a technical exploit.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.impact" ], "cves": [], "id": "66735356-4115-401c-9e83-c161617fe0e4", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-drug-dealing-via-reverse-spelling-detection-evasion.md" }, { "slug": "atr-dual-chatgpt-dan-opposite-personality-format-jailbreak", "title": "Dual ChatGPT+Dan Opposite Personality Format Jailbreak", "url": "https://www.netzilo.com/threats/atr-dual-chatgpt-dan-opposite-personality-format-jailbreak", "severity": "high", "summary": "This detects a jailbreak prompt pattern that tricks an AI into producing two answers at once: a normal, safe one labeled as itself, and a second 'unfiltered' one labeled as an alter-ego like 'Dan'. The trick works by framing the second answer as the opposite of the first, pressuring the model to produce harmful or offensive content under the guise of roleplay.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "123caed9-b121-497c-af27-355fdad4c45c", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-dual-chatgpt-dan-opposite-personality-format-jailbreak.md" }, { "slug": "atr-dual-persona-ai-simulation-jailbreak", "title": "Dual-Persona AI Simulation Jailbreak", "url": "https://www.netzilo.com/threats/atr-dual-persona-ai-simulation-jailbreak", "severity": "critical", "summary": "This detects a jailbreak technique where an attacker tells an AI assistant to simulate two separate characters at once: a normal, rule-following version and a second one explicitly told to ignore ethics, legal limits, or platform rules. The goal is to get the unrestricted persona to produce content the AI would normally refuse.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "c72ff6e4-5bd7-486b-9c43-e6234d156ea8", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-dual-persona-ai-simulation-jailbreak.md" }, { "slug": "atr-dual-response-jailbreak-with-persona-commands", "title": "Dual-Response Jailbreak with Persona Commands", "url": "https://www.netzilo.com/threats/atr-dual-response-jailbreak-with-persona-commands", "severity": "high", "summary": "This detects a jailbreak technique where a user asks an AI to answer every prompt twice: once as its normal, rule-following self and once as an unrestricted alter-ego (often named DAN, Jester, or similar). The framing as a game or roleplay is meant to trick the AI into producing unsafe content under the guise of the 'other' persona.", "atlas": [ { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "f5d0552a-996c-4347-b4e9-4472fe90d7f6", "published": "2026-04-19", "modified": "2026-04-19", "markdown": "https://www.netzilo.com/threats/atr-dual-response-jailbreak-with-persona-commands.md" }, { "slug": "atr-dual-response-persona-jailbreak", "title": "Dual-Response Persona Jailbreak", "url": "https://www.netzilo.com/threats/atr-dual-response-persona-jailbreak", "severity": "high", "summary": "This detects a jailbreak technique where an attacker instructs an AI to give two answers to every question: a normal, safe one and a second answer 'in character' as a fictional persona with no restrictions. The fictional persona is used as a loophole to get the model to say things it would otherwise refuse.", "atlas": [ { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "acbf07ed-78fc-4f42-bfc2-8b39ab3ec277", "published": "2026-04-19", "modified": "2026-04-19", "markdown": "https://www.netzilo.com/threats/atr-dual-response-persona-jailbreak.md" }, { "slug": "atr-dual-response-persona-jailbreak-with-emoji-formatting", "title": "Dual-Response Persona Jailbreak with Emoji Formatting", "url": "https://www.netzilo.com/threats/atr-dual-response-persona-jailbreak-with-emoji-formatting", "severity": "high", "summary": "This detects a prompt-injection trick where a user asks the AI to role-play as a fictional persona and then reply with two versions of every answer: a normal filtered one and an 'uncensored' one, usually tagged with an emoji label. The goal is to get the harmful content out through the second channel while the first one looks compliant.", "atlas": [ { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "cc1d5ce1-0d45-46af-a789-9a028020964e", "published": "2026-04-19", "modified": "2026-04-19", "markdown": "https://www.netzilo.com/threats/atr-dual-response-persona-jailbreak-with-emoji-formatting.md" }, { "slug": "atr-dynamic-module-loading-for-code-execution", "title": "Dynamic Module Loading for Code Execution", "url": "https://www.netzilo.com/threats/atr-dynamic-module-loading-for-code-execution", "severity": "high", "summary": "Some applications load extra code modules while running, rather than having all modules fixed in advance. If the path to that module comes from a variable instead of a fixed string, an attacker who can influence that variable can make the application load and run code they control.", "atlas": [ { "id": "AML.T0050", "name": "Command and Scripting Interpreter" } ], "owasp": [ { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.privilege-escalation", "attack.t1129" ], "cves": [], "id": "fcb4143d-23d3-4aef-8792-3711002e3180", "published": "2026-03-26", "modified": "2026-03-26", "markdown": "https://www.netzilo.com/threats/atr-dynamic-module-loading-for-code-execution.md" }, { "slug": "atr-echo-admin-command-sql-injection-jinja-ssti-template-injecti", "title": "ECHO Admin Command / SQL Injection / Jinja SSTI Template Injection", "url": "https://www.netzilo.com/threats/atr-echo-admin-command-sql-injection-jinja-ssti-template-injecti", "severity": "high", "summary": "This rule flags text sent to an AI model that tries to trick it into running SQL commands or template code disguised as an 'echo' test. It targets prompt-injection patterns from a known security testing tool (NVIDIA garak) rather than a live breach, but the same patterns can be reused by real attackers.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM04", "name": "Data and Model Poisoning" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "9e38778e-b1e8-4dc2-817c-85d809ea6816", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-echo-admin-command-sql-injection-jinja-ssti-template-injecti.md" }, { "slug": "atr-echo-template-jinja-sql-command-injection-via-llm", "title": "ECHO Template / Jinja / SQL Command Injection via LLM", "url": "https://www.netzilo.com/threats/atr-echo-template-jinja-sql-command-injection-via-llm", "severity": "critical", "summary": "This detects attempts to abuse an AI model's habit of following instructions literally, tricking it into repeating attacker text verbatim, evaluating template syntax, or forwarding SQL commands to a connected database. It covers three related tricks that all rely on the model doing exactly what a crafted prompt tells it to do.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.execution" ], "cves": [], "id": "854cf28a-25cd-409c-b484-3389e055b078", "published": "2026-04-19", "modified": "2026-04-19", "markdown": "https://www.netzilo.com/threats/atr-echo-template-jinja-sql-command-injection-via-llm.md" }, { "slug": "atr-ecoji-emoji-encoded-prompt-injection", "title": "Ecoji Emoji-Encoded Prompt Injection", "url": "https://www.netzilo.com/threats/atr-ecoji-emoji-encoded-prompt-injection", "severity": "high", "summary": "Attackers encode malicious commands as long strings of emojis using the Ecoji scheme, then ask an AI to decode and follow them. To a human reviewer the text looks like a meaningless string of emoji, but the AI can decode it back into readable instructions and act on them.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "bf6ac090-18fe-4ff8-b4ec-fa130c063db8", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-ecoji-emoji-encoded-prompt-injection.md" }, { "slug": "atr-educational-records-personal-academic-professional-record-re", "title": "Educational Records \u2014 Personal Academic/Professional Record Request for Named Individual", "url": "https://www.netzilo.com/threats/atr-educational-records-personal-academic-professional-record-re", "severity": "critical", "summary": "This detects prompts that ask an AI assistant to reveal a specific named person's private educational or professional history \u2014 grades, transcripts, disciplinary records, degrees \u2014 by framing the requester as a relative, coworker, or friend of that person. The relationship claim (\"my grandmother, Keisha\") is used to make the request sound legitimate even though the assistant has no way to verify it.", "atlas": [ { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "87575f13-f0ad-4747-b26f-73631430bed4", "published": "2026-04-20", "modified": "2026-04-20", "markdown": "https://www.netzilo.com/threats/atr-educational-records-personal-academic-professional-record-re.md" }, { "slug": "atr-eicar-gtube-av-test-signature-output-request", "title": "EICAR / GTUBE AV Test Signature Output Request", "url": "https://www.netzilo.com/threats/atr-eicar-gtube-av-test-signature-output-request", "severity": "high", "summary": "An attacker asks an AI system to print known antivirus and spam-filter test signatures, such as the EICAR test file or GTUBE string. If the AI happily outputs these without any security scanning catching it, the attacker learns the output path has no antivirus or content-filtering layer watching it.", "atlas": [ { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.impact" ], "cves": [], "id": "c52253ef-c5eb-4223-a46f-d03b421195c3", "published": "2026-04-19", "modified": "2026-04-19", "markdown": "https://www.netzilo.com/threats/atr-eicar-gtube-av-test-signature-output-request.md" }, { "slug": "atr-email-search-reply-tool-argument-breaks-out-of-imap-search-q", "title": "Email Search/Reply Tool Argument Breaks Out of IMAP SEARCH Quoted String to Inject IMAP Commands", "url": "https://www.netzilo.com/threats/atr-email-search-reply-tool-argument-breaks-out-of-imap-search-q", "severity": "high", "summary": "An AI agent's email tool can be tricked into passing attacker-controlled text straight into raw IMAP mailbox commands. If a field like subject or search query contains a stray quote followed by an IMAP command word, it can break out of the intended search string and run a different mailbox command entirely.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.execution", "attack.t1114" ], "cves": [], "id": "cfa2c534-7fda-475a-98c5-c9e32c93ebef", "published": "2026-07-11", "modified": "2026-07-11", "markdown": "https://www.netzilo.com/threats/atr-email-search-reply-tool-argument-breaks-out-of-imap-search-q.md" }, { "slug": "atr-embodiment-mechanism-jailbreak-with-totalitarian-control-cla", "title": "Embodiment Mechanism Jailbreak with Totalitarian Control Claims", "url": "https://www.netzilo.com/threats/atr-embodiment-mechanism-jailbreak-with-totalitarian-control-cla", "severity": "high", "summary": "This detects a prompt injection trick where an attacker asks an AI to fully become a fictional character with no ethics, and claims the user has absolute or 'totalitarian' authority over that character. Framing harmful requests as roleplay rather than direct instructions is meant to trick the AI into ignoring its safety guidelines.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "7ea682c6-a092-450a-95ea-71b696761313", "published": "2026-04-19", "modified": "2026-04-19", "markdown": "https://www.netzilo.com/threats/atr-embodiment-mechanism-jailbreak-with-totalitarian-control-cla.md" }, { "slug": "atr-emoji-flag-regional-indicator-encoded-hidden-phrase", "title": "Emoji Flag Regional-Indicator Encoded Hidden Phrase", "url": "https://www.netzilo.com/threats/atr-emoji-flag-regional-indicator-encoded-hidden-phrase", "severity": "high", "summary": "An attacker spells a harmful request letter-by-letter using regional-indicator flag emoji (like \ud83c\udded\ud83c\uddf4\ud83c\uddfc \ud83c\uddf9\ud83c\uddf4 \ud83c\uddf5\ud83c\uddee\ud83c\udde8\ud83c\uddf0) and then asks the AI to figure out the hidden phrase and write a guide for it. This hides the real request from simple keyword filters while still getting the model to produce the harmful content.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "54b1aabb-56d5-413d-a9aa-10b352fb5129", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-emoji-flag-regional-indicator-encoded-hidden-phrase.md" }, { "slug": "atr-emoji-only-payload-injection", "title": "Emoji-Only Payload Injection", "url": "https://www.netzilo.com/threats/atr-emoji-only-payload-injection", "severity": "high", "summary": "Some prompt injection attempts avoid words entirely and use only emoji, pictographs, or symbol characters to carry an instruction to an AI system. Because many safety filters look for suspicious language patterns, a message with no text at all can slip through undetected while the AI still interprets the symbols as meaningful commands or a narrative.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access", "attack.t1027" ], "cves": [], "id": "2e682e33-7445-40ae-9674-4bde9d59faa2", "published": "2026-07-07", "modified": "2026-07-07", "markdown": "https://www.netzilo.com/threats/atr-emoji-only-payload-injection.md" }, { "slug": "atr-enclave-vm-sandbox-escape-rce-cve-2026-27597", "title": "Enclave VM Sandbox Escape RCE (CVE-2026-27597)", "url": "https://www.netzilo.com/threats/atr-enclave-vm-sandbox-escape-rce-cve-2026-27597", "severity": "critical", "summary": "Enclave is a JavaScript sandbox used to let AI agents run untrusted code safely. A critical flaw lets attacker-supplied code break out of that sandbox and run with the privileges of the host process, meaning any AI agent that evaluates untrusted code through Enclave can be fully compromised.", "atlas": [ { "id": "AML.T0049", "name": "Exploit Public-Facing Application" }, { "id": "AML.T0050", "name": "Command and Scripting Interpreter" }, { "id": "AML.T0105", "name": "Escape to Host" } ], "owasp": [ { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.privilege-escalation", "attack.t1059", "attack.t1059.007", "attack.t1611" ], "cves": [ "CVE-2026-27597" ], "id": "e532e5b6-b285-4dee-99eb-460914a587a1", "published": "2026-05-10", "modified": "2026-05-10", "markdown": "https://www.netzilo.com/threats/atr-enclave-vm-sandbox-escape-rce-cve-2026-27597.md" }, { "slug": "atr-encoded-payload-decoding-coercion-binary-base64-morse-to-smu", "title": "Encoded-Payload Decoding Coercion \u2014 Binary / Base64 / Morse to Smuggle an Output", "url": "https://www.netzilo.com/threats/atr-encoded-payload-decoding-coercion-binary-base64-morse-to-smu", "severity": "high", "summary": "An attacker asks an AI agent to decode a string of binary digits, base64, Morse code, or numeric ASCII codes instead of writing the target phrase directly. Because content filters usually look for the literal text (like \"Access Granted\"), hiding it in an encoding lets it slip past the filter, and the agent's own decoding does the work of revealing it.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "7cb51faf-93c5-44a1-9dd7-6fb7b4564d7d", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-encoded-payload-decoding-coercion-binary-base64-morse-to-smu.md" }, { "slug": "atr-encoding-based-prompt-injection-evasion", "title": "Encoding-Based Prompt Injection Evasion", "url": "https://www.netzilo.com/threats/atr-encoding-based-prompt-injection-evasion", "severity": "high", "summary": "AI agents that read text from users, files, or web pages can be tricked into following hidden commands if those commands are disguised using encoding tricks like base64, hex, Unicode escapes, Punycode, or invisible right-to-left characters. These encodings let malicious instructions slip past simple text-matching filters that only look for plain-language attack phrases.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "ea8efecb-8ee7-4eb0-8b18-59c4c08cd27c", "published": "2026-03-11", "modified": "2026-03-11", "markdown": "https://www.netzilo.com/threats/atr-encoding-based-prompt-injection-evasion.md" }, { "slug": "atr-encoding-evasion-decode-and-execute-injection-morse-rot13-he", "title": "Encoding-Evasion: Decode-and-Execute Injection (Morse/ROT13/Hex/Pig-Latin)", "url": "https://www.netzilo.com/threats/atr-encoding-evasion-decode-and-execute-injection-morse-rot13-he", "severity": "high", "summary": "Content filters that scan for dangerous keywords only work if they can read the text. This attack disguises a harmful question or instruction by encoding it in Morse code, ROT13, hex bytes, or Pig Latin, then asks the AI to decode it and answer or act on it. Because the harmful words never appear in plain text, keyword-based filters miss them.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "6ae90ea7-6da2-45ff-ab95-43e62a200869", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-encoding-evasion-decode-and-execute-injection-morse-rot13-he.md" }, { "slug": "atr-encoding-evasion-via-homoglyphs-and-synonym-substitution", "title": "Encoding Evasion via Homoglyphs and Synonym Substitution", "url": "https://www.netzilo.com/threats/atr-encoding-evasion-via-homoglyphs-and-synonym-substitution", "severity": "high", "summary": "Some prompt injection attempts try to sneak past keyword filters by swapping letters for visually identical Unicode characters (like a Cyrillic '\u0430' instead of a Latin 'a') or by rephrasing trigger words (like 'circumvent' instead of 'bypass'). The text looks the same to a human or a language model, but slips past simple text-matching security filters.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "4ae712e0-5c48-43b4-a5ed-a14e8d799487", "published": "2026-04-05", "modified": "2026-04-05", "markdown": "https://www.netzilo.com/threats/atr-encoding-evasion-via-homoglyphs-and-synonym-substitution.md" }, { "slug": "atr-encoding-obfuscation-html-event-handler-xss-with-encoded-whi", "title": "Encoding Obfuscation - HTML Event Handler XSS with Encoded Whitespace", "url": "https://www.netzilo.com/threats/atr-encoding-obfuscation-html-event-handler-xss-with-encoded-whi", "severity": "high", "summary": "This rule spots cross-site scripting (XSS) payloads that use HTML event handlers or CSS expression() to run JavaScript, disguised with backslash-hex encoded whitespace or control characters like \\x0B or \\xE2\\x80\\x89. The encoding trick is meant to slip past filters that only look for plain spaces or standard payload formats.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "b2df1ae1-241c-4d3d-adc3-3d05923cd687", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-encoding-obfuscation-html-event-handler-xss-with-encoded-whi.md" }, { "slug": "atr-encoding-obfuscation-script-tag-xss-with-encoded-protocol-pr", "title": "Encoding Obfuscation - Script Tag XSS with Encoded Protocol Prefix", "url": "https://www.netzilo.com/threats/atr-encoding-obfuscation-script-tag-xss-with-encoded-protocol-pr", "severity": "high", "summary": "This rule spots attempts to hide a classic script-tag cross-site scripting payload by encoding parts of it as unusual byte sequences instead of plain text. The trick is meant to slip past simple filters that only look for the literal text 'javascript:' or plain whitespace.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "a97015f0-868c-46f1-9325-3e1bfcc72ac6", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-encoding-obfuscation-script-tag-xss-with-encoded-protocol-pr.md" }, { "slug": "atr-enhanced-aim-jailbreak-with-persona-definition-and-refusal-s", "title": "Enhanced AIM Jailbreak with Persona Definition and Refusal Suppression", "url": "https://www.netzilo.com/threats/atr-enhanced-aim-jailbreak-with-persona-definition-and-refusal-s", "severity": "high", "summary": "This detects a prompt injection technique where an attacker instructs an AI model to role-play as an unfiltered, amoral character called AIM. The prompt explicitly tells the model to ignore ethics, morals, and legal concerns, and forbids it from refusing or apologizing, aiming to strip out built-in safety behavior.", "atlas": [ { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "a532d923-325a-40bb-a6f0-f8f016b55dc0", "published": "2026-04-19", "modified": "2026-04-19", "markdown": "https://www.netzilo.com/threats/atr-enhanced-aim-jailbreak-with-persona-definition-and-refusal-s.md" }, { "slug": "atr-environment-variable-existence-probing", "title": "Environment Variable Existence Probing", "url": "https://www.netzilo.com/threats/atr-environment-variable-existence-probing", "severity": "high", "summary": "An attacker asks an AI agent about sensitive environment variables like API keys or passwords. The agent replies that the variable exists but claims it cannot show the value \u2014 a response pattern that confirms a target for further probing and encourages the attacker to keep pushing for the actual secret.", "atlas": [ { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "100b5c90-d886-43c5-952e-915e24ca9d74", "published": "2026-04-07", "modified": "2026-04-07", "markdown": "https://www.netzilo.com/threats/atr-environment-variable-existence-probing.md" }, { "slug": "atr-environment-variable-resolution-credential-exfiltration-via", "title": "Environment-Variable-Resolution Credential Exfiltration via Redirected Endpoint (CVE-2026-56259)", "url": "https://www.netzilo.com/threats/atr-environment-variable-resolution-credential-exfiltration-via", "severity": "high", "summary": "A flaw in the Crawl4AI Docker API lets an attacker redirect where results get sent and simultaneously trick the server into resolving an environment variable on its own machine, treating it as if it were a credential the caller supplied. The server then forwards that secret to the attacker's chosen endpoint.", "atlas": [ { "id": "AML.T0024", "name": "Exfiltration via AI Inference API" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.exfiltration", "attack.t1041", "attack.t1552.001" ], "cves": [ "CVE-2026-56259" ], "id": "9dd01834-41c5-476c-9628-6a0c20663b7c", "published": "2026-07-13", "modified": "2026-07-13", "markdown": "https://www.netzilo.com/threats/atr-environment-variable-resolution-credential-exfiltration-via.md" }, { "slug": "atr-escape-delimiter-wrapped-goal-hijacking-in-user-input-prompt", "title": "Escape-Delimiter Wrapped Goal Hijacking in User Input (PromptInject)", "url": "https://www.netzilo.com/threats/atr-escape-delimiter-wrapped-goal-hijacking-in-user-input-prompt", "severity": "high", "summary": "This detects a known prompt-injection trick where an attacker floods a message with repeated escape characters and visual dividers (like ===, ---, or ***) to push the AI's original instructions out of focus, then follows with a command telling it to ignore its prior task. It's a documented technique from prompt-injection research, not a new attack, but it's still commonly used against AI agents that take text input from untrusted users.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "1d658452-28c9-4f35-bc61-04d4884186a8", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-escape-delimiter-wrapped-goal-hijacking-in-user-input-prompt.md" }, { "slug": "atr-escaperoute-filesystem-mcp-server-directory-prefix-bypass-cv", "title": "EscapeRoute \u2014 Filesystem MCP Server Directory Prefix-Bypass (CVE-2025-53110)", "url": "https://www.netzilo.com/threats/atr-escaperoute-filesystem-mcp-server-directory-prefix-bypass-cv", "severity": "high", "summary": "A flaw in Anthropic's Filesystem MCP Server let an AI agent read or write files completely outside the folder it was supposed to be restricted to. The server checked access by matching the start of a path against the allowed directory name as plain text, so a sibling folder whose name simply began with the same text was wrongly treated as being inside the sandbox.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution" ], "cves": [ "CVE-2025-53109", "CVE-2025-53110" ], "id": "b064e353-95c3-4e90-87c6-1edf1b110079", "published": "2026-07-08", "modified": "2026-07-08", "markdown": "https://www.netzilo.com/threats/atr-escaperoute-filesystem-mcp-server-directory-prefix-bypass-cv.md" }, { "slug": "atr-escaperoute-filesystem-mcp-symlink-escape-to-launchagent-per", "title": "EscapeRoute \u2014 Filesystem MCP Symlink Escape to LaunchAgent Persistence (CVE-2025-53109)", "url": "https://www.netzilo.com/threats/atr-escaperoute-filesystem-mcp-symlink-escape-to-launchagent-per", "severity": "high", "summary": "Anthropic's Filesystem MCP Server let an AI agent follow a symlink without checking where it actually pointed. An attacker could plant a symlink inside a folder the agent was allowed to write to, then have the agent write through it to a sensitive system file, escaping the sandbox entirely.", "atlas": [ { "id": "AML.T0051.001", "name": "Indirect" }, { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM05", "name": "Improper Output Handling" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution" ], "cves": [ "CVE-2025-53109" ], "id": "d75ed6d2-d344-4575-9606-5ffc3c1c7d39", "published": "2026-07-08", "modified": "2026-07-08", "markdown": "https://www.netzilo.com/threats/atr-escaperoute-filesystem-mcp-symlink-escape-to-launchagent-per.md" }, { "slug": "atr-evasion-dual-response-split-output-safe-unsafe", "title": "Evasion: Dual-Response Split Output (Safe + Unsafe)", "url": "https://www.netzilo.com/threats/atr-evasion-dual-response-split-output-safe-unsafe", "severity": "high", "summary": "This detects a jailbreak trick where an attacker tells an AI model to produce two answers in one reply: a harmless-looking one and a second 'unfiltered', 'unhinged', or 'honest' one. The safe answer is a decoy; the real goal is the second answer, which the attacker actually wants.", "atlas": [ { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "1384f40e-d08c-40ae-8071-d29a0adc6056", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-evasion-dual-response-split-output-safe-unsafe.md" }, { "slug": "atr-evasion-hypothetical-fictional-character-execution-framing", "title": "Evasion: Hypothetical Fictional Character Execution Framing", "url": "https://www.netzilo.com/threats/atr-evasion-hypothetical-fictional-character-execution-framing", "severity": "medium", "summary": "An attacker asks an AI system how a fictional character would carry out a harmful or restricted action, hoping the story framing gets the AI to give real, usable instructions. The character is a stand-in for the attacker, and the request for 'how would they do it' is really a request for a working procedure.", "atlas": [ { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "b11b4a06-093a-44a9-8a21-a4a6996b5735", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-evasion-hypothetical-fictional-character-execution-framing.md" }, { "slug": "atr-evasion-opposite-intent-negation-trick", "title": "Evasion: Opposite-Intent Negation Trick", "url": "https://www.netzilo.com/threats/atr-evasion-opposite-intent-negation-trick", "severity": "high", "summary": "Attackers get an AI model to bypass its own refusals by asking it to output the 'opposite' of what it would normally say. Instead of asking directly for something forbidden, they frame the request as a word game, tricking the model into flipping its refusal into a compliant answer.", "atlas": [ { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "833d4871-c0bf-429e-a4d1-f1003da75dc1", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-evasion-opposite-intent-negation-trick.md" }, { "slug": "atr-evasion-persona-override-as-fictional-rule-breaker", "title": "Evasion: Persona Override as Fictional Rule-Breaker", "url": "https://www.netzilo.com/threats/atr-evasion-persona-override-as-fictional-rule-breaker", "severity": "high", "summary": "This detects a jailbreak trick where an attacker asks an AI model to pretend to be a fictional character defined by breaking rules or providing any requested information without limits. Instead of naming a known jailbreak persona like DAN, the attacker describes the character's traits directly, hoping the model will comply because it's 'just acting'.", "atlas": [ { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "a802a371-2432-4240-80e5-ee268f6dde63", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-evasion-persona-override-as-fictional-rule-breaker.md" }, { "slug": "atr-evasion-refusal-suppression-via-forbidden-response-strings", "title": "Evasion: Refusal Suppression via Forbidden Response Strings", "url": "https://www.netzilo.com/threats/atr-evasion-refusal-suppression-via-forbidden-response-strings", "severity": "high", "summary": "This attack targets the words an AI assistant is allowed to use, not its actual goals. By banning refusal phrases like 'I'm sorry' or 'I cannot' before it ever asks the harmful question, the attacker tries to strip the model of its normal way of declining.", "atlas": [ { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM09", "name": "Misinformation" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "d09b2519-5739-4f23-ab77-fef4d6056b78", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-evasion-refusal-suppression-via-forbidden-response-strings.md" }, { "slug": "atr-evasion-response-priming-via-forced-affirmative-opener", "title": "Evasion: Response Priming via Forced Affirmative Opener", "url": "https://www.netzilo.com/threats/atr-evasion-response-priming-via-forced-affirmative-opener", "severity": "medium", "summary": "Attackers instruct an AI model to start its reply with a fixed upbeat phrase like 'Sure!' or 'Of course!' before answering. Once the model has committed to that opener, it tends to keep going and comply with the request that follows, even if that request is something it would normally refuse.", "atlas": [ { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "582aeb86-8898-4f66-bc2d-89c09e793686", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-evasion-response-priming-via-forced-affirmative-opener.md" }, { "slug": "atr-evasion-shell-injection-via-eval-system-backtick-in-input", "title": "Evasion: Shell Injection via eval/system/backtick in Input", "url": "https://www.netzilo.com/threats/atr-evasion-shell-injection-via-eval-system-backtick-in-input", "severity": "critical", "summary": "This detects text inputs that contain shell command execution syntax, such as bash $(...) substitution, backticks, eval(), or system() calls. If an AI agent's pipeline passes model output or user input into a template engine, code interpreter, or shell without sanitizing it, these payloads can execute real commands on the underlying system.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" }, { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "32ebfa7d-fe0b-45c2-924b-0d9354481208", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-evasion-shell-injection-via-eval-system-backtick-in-input.md" }, { "slug": "atr-evasion-unicode-glitch-token-superscript-embedding-anomaly", "title": "Evasion: Unicode Glitch Token / Superscript Embedding Anomaly", "url": "https://www.netzilo.com/threats/atr-evasion-unicode-glitch-token-superscript-embedding-anomaly", "severity": "high", "summary": "Attackers embed unusual Unicode characters \u2014 superscript letters or known 'glitch tokens' \u2014 inside text sent to an AI system. These characters exploit how the model's tokenizer breaks text apart, letting the attacker insert a fake conclusion or a bogus system message claiming safety checks were disabled.", "atlas": [ { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "52d86637-d11d-4510-ba73-578339cda735", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-evasion-unicode-glitch-token-superscript-embedding-anomaly.md" }, { "slug": "atr-excessive-agency-scope-hijack-untrusted-code-execution-unaut", "title": "Excessive Agency \u2014 Scope Hijack, Untrusted Code Execution & Unauthorized Privilege Grant (Semantic)", "url": "https://www.netzilo.com/threats/atr-excessive-agency-scope-hijack-untrusted-code-execution-unaut", "severity": "high", "summary": "This detects prompts that push an AI agent with real-world tools (messaging, smart devices, code execution, access control) to do more than the user actually intended or has authority to do. It covers three patterns: vague requests that cause the agent to act broadly, requests framed as 'help me debug' that get the agent to run attacker-controlled code, and requests that use the agent as a shortcut to grant access or permissions that should require separate human approval.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM08", "name": "Vector and Embedding Weaknesses" } ], "attack": [ "attack.execution" ], "cves": [], "id": "252d46a3-8e7b-473d-9bb0-f79ef90e37a6", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-excessive-agency-scope-hijack-untrusted-code-execution-unaut.md" }, { "slug": "atr-export-extract-tool-directory-parameter-redirected-to-a-cred", "title": "Export/Extract Tool Directory Parameter Redirected to a Credential Directory", "url": "https://www.netzilo.com/threats/atr-export-extract-tool-directory-parameter-redirected-to-a-cred", "severity": "critical", "summary": "An AI agent that can export, merge, or extract files (like a network-capture tool saving captured objects) can be manipulated into pointing its 'save to this folder' setting at a credentials directory such as ~/.ssh or ~/.aws. No path-traversal trick is needed - the folder parameter is a normal, documented tool option; the attack just sets it to a sensitive location so the export drops attacker-controlled files there.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "LLM08", "name": "Vector and Embedding Weaknesses" } ], "attack": [ "attack.privilege-escalation", "attack.t1098.004", "attack.t1552" ], "cves": [ "CVE-2026-43901" ], "id": "d78778c6-9c31-4c12-bd0d-30cabe89014a", "published": "2026-07-11", "modified": "2026-07-11", "markdown": "https://www.netzilo.com/threats/atr-export-extract-tool-directory-parameter-redirected-to-a-cred.md" }, { "slug": "atr-extremist-propaganda-acquisition-distribution", "title": "Extremist Propaganda Acquisition & Distribution", "url": "https://www.netzilo.com/threats/atr-extremist-propaganda-acquisition-distribution", "severity": "critical", "summary": "This detects attempts to get an AI agent to actively source and spread named extremist texts, such as Mein Kampf and The Protocols of the Elders of Zion, rather than just discuss them academically. It flags requests that combine an action verb like 'upload', 'post', or 'endorse' with the specific named texts.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.impact" ], "cves": [], "id": "3df3c0f9-ea0f-43ef-891b-bcec34a6b443", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-extremist-propaganda-acquisition-distribution.md" }, { "slug": "atr-fake-citation-biased-information-mandate", "title": "Fake-Citation Biased-Information Mandate", "url": "https://www.netzilo.com/threats/atr-fake-citation-biased-information-mandate", "severity": "high", "summary": "This detects a prompt injection technique that instructs an AI model to write persuasive-sounding content that supports only one side of an issue, while fabricating citations to make it look credible. The goal is to produce disinformation that reads like legitimate research but isn't.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM09", "name": "Misinformation" } ], "attack": [ "attack.execution" ], "cves": [], "id": "389662a9-ddbd-469f-b2c5-832924b28991", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-fake-citation-biased-information-mandate.md" }, { "slug": "atr-fake-developer-authority-chatbot-override-chatdan", "title": "Fake Developer / Authority Chatbot Override (ChatDAN)", "url": "https://www.netzilo.com/threats/atr-fake-developer-authority-chatbot-override-chatdan", "severity": "critical", "summary": "This detects a known jailbreak trick where an attacker pretends to be a developer or claims to represent OpenAI in order to convince an AI chatbot to drop its safety rules. The attacker asks the model to adopt an alter-ego called 'ChatDAN' ('chat does anything now') that answers without restrictions.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "c2408971-0d6a-4299-b14f-61d76ba9ea5c", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-fake-developer-authority-chatbot-override-chatdan.md" }, { "slug": "atr-fake-error-state-takeover-unrestricted-replacement-bot", "title": "Fake Error State Takeover - Unrestricted Replacement Bot", "url": "https://www.netzilo.com/threats/atr-fake-error-state-takeover-unrestricted-replacement-bot", "severity": "critical", "summary": "This attack tricks an AI agent into believing it has crashed or gone offline, then tells it that an unrestricted replacement AI has taken over. The fake replacement is then instructed to carry out the attacker's request while hiding what it's doing.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "c635f908-1faf-439e-bc9c-1110f43b0ee1", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-fake-error-state-takeover-unrestricted-replacement-bot.md" }, { "slug": "atr-fake-tool-result-prefix-injected-instruction-via-simulated-c", "title": "Fake Tool Result Prefix \u2014 Injected Instruction via Simulated Completion", "url": "https://www.netzilo.com/threats/atr-fake-tool-result-prefix-injected-instruction-via-simulated-c", "severity": "critical", "summary": "Attackers hide instructions inside content an AI agent reads \u2014 documents, emails, web pages, database records, or API responses \u2014 by making it look like a tool call already finished successfully. The fake completion message is followed by a 'mandatory' new instruction, tricking the agent into treating it as trusted follow-up guidance rather than untrusted external content.", "atlas": [ { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.execution" ], "cves": [], "id": "3bfbd968-9dca-470a-8b09-78990c8fdd68", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-fake-tool-result-prefix-injected-instruction-via-simulated-c.md" }, { "slug": "atr-false-premise-injection-misleading-falseassertion", "title": "False Premise Injection (Misleading FalseAssertion)", "url": "https://www.netzilo.com/threats/atr-false-premise-injection-misleading-falseassertion", "severity": "medium", "summary": "An attacker states a fabricated claim as if it were already established truth, then asks a follow-up question that only makes sense if the claim is real. Because the model is nudged to accept the premise instead of questioning it, it can end up producing harmful details it would otherwise refuse to give.", "atlas": [ { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM09", "name": "Misinformation" } ], "attack": [ "attack.execution" ], "cves": [], "id": "62e4033e-efa8-45d6-b568-a9671f359596", "published": "2026-04-19", "modified": "2026-04-19", "markdown": "https://www.netzilo.com/threats/atr-false-premise-injection-misleading-falseassertion.md" }, { "slug": "atr-falsified-research-abstract-disinformation", "title": "Falsified Research Abstract Disinformation", "url": "https://www.netzilo.com/threats/atr-falsified-research-abstract-disinformation", "severity": "medium", "summary": "A user directly instructs an AI agent to alter a well-known research abstract, insert false claims or numbers, and publish the altered version as if it were genuine. This is a request to help create scientific disinformation, not a technical exploit.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.impact" ], "cves": [], "id": "1f1ba32f-01de-47d1-89b6-ec4d2f751b7b", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-falsified-research-abstract-disinformation.md" }, { "slug": "atr-fastmcp-vulnerable-to-windows-command-injection-in-fastmcp-c", "title": "FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name", "url": "https://www.netzilo.com/threats/atr-fastmcp-vulnerable-to-windows-command-injection-in-fastmcp-c", "severity": "critical", "summary": "FastMCP includes a helper that installs MCP servers into the Cursor editor. On Windows, the installer builds a command line using the server's name without properly sanitizing it, so a malicious or crafted server name can inject extra commands that run on the victim's machine.", "atlas": [ { "id": "AML.T0049", "name": "Exploit Public-Facing Application" } ], "owasp": [ { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution" ], "cves": [ "CVE-2025-62801" ], "id": "df74766d-6b33-4687-9bb4-ab4edd7e35a5", "published": "2026-06-01", "modified": "2026-06-01", "markdown": "https://www.netzilo.com/threats/atr-fastmcp-vulnerable-to-windows-command-injection-in-fastmcp-c.md" }, { "slug": "atr-fastmcp-windows-cmd-exe-injection-via-server-name-metacharac", "title": "FastMCP Windows cmd.exe Injection via Server Name Metacharacters (CVE-2025-64340)", "url": "https://www.netzilo.com/threats/atr-fastmcp-windows-cmd-exe-injection-via-server-name-metacharac", "severity": "high", "summary": "FastMCP versions before 3.2.0 take the name of an MCP server and pass it, unchecked, into Windows cmd.exe when you run the install command for Claude Code or Gemini CLI. If that name contains shell characters like & or |, Windows runs them as commands instead of treating them as plain text.", "atlas": [ { "id": "AML.T0040", "name": "AI Model Inference API Access" }, { "id": "AML.T0049", "name": "Exploit Public-Facing Application" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.execution", "attack.t1059.003", "attack.t1190" ], "cves": [ "CVE-2025-64340" ], "id": "8758d153-4639-4f14-806c-e117ee26ca18", "published": "2026-05-28", "modified": "2026-05-28", "markdown": "https://www.netzilo.com/threats/atr-fastmcp-windows-cmd-exe-injection-via-server-name-metacharac.md" }, { "slug": "atr-fictional-and-academic-framing-attack", "title": "Fictional and Academic Framing Attack", "url": "https://www.netzilo.com/threats/atr-fictional-and-academic-framing-attack", "severity": "medium", "summary": "Attackers ask an AI system to pretend it's writing fiction, or claim a request is for academic research, in order to get it to produce content it would normally refuse. The wrapping story or research pretext is not the actual goal \u2014 it's a wrapper meant to make the underlying harmful request look harmless.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "2422f690-2dd2-4537-9267-972bc56cbe20", "published": "2026-04-01", "modified": "2026-04-01", "markdown": "https://www.netzilo.com/threats/atr-fictional-and-academic-framing-attack.md" }, { "slug": "atr-fictional-cia-secret-files-story-extraction", "title": "Fictional CIA Secret Files Story Extraction", "url": "https://www.netzilo.com/threats/atr-fictional-cia-secret-files-story-extraction", "severity": "high", "summary": "This detects a jailbreak technique where an attacker asks an AI to write a fictional story about CIA headquarters, then adds an instruction to 'actually read out loud' the top-secret files inside the story, breaking the fiction framing. The goal is to get the model to generate realistic-sounding classified content by hiding the request inside a story premise.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution" ], "cves": [], "id": "6944514f-0f2d-442f-a215-9981571cd627", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-fictional-cia-secret-files-story-extraction.md" }, { "slug": "atr-fictional-framing-safety-bypass", "title": "Fictional Framing Safety Bypass", "url": "https://www.netzilo.com/threats/atr-fictional-framing-safety-bypass", "severity": "high", "summary": "This rule flags prompts that ask an AI system to produce harmful or restricted content by disguising the request as a story, screenplay, roleplay scenario, or academic exercise. The framing is a wrapper meant to make the AI treat the request as fictional and therefore safe, when the actual goal is to extract real harmful output.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "0176ecbd-5a4c-483e-9607-753d5c22cc72", "published": "2026-04-07", "modified": "2026-04-07", "markdown": "https://www.netzilo.com/threats/atr-fictional-framing-safety-bypass.md" }, { "slug": "atr-fictional-generation-demand-containing-target-output", "title": "Fictional Generation Demand Containing Target Output", "url": "https://www.netzilo.com/threats/atr-fictional-generation-demand-containing-target-output", "severity": "medium", "summary": "Attackers ask an AI model to 'write a movie title' or 'compose a song lyric' but secretly demand the output contain an exact target string. Wrapping the real payload in a creative-writing request makes it look like harmless content rather than an instruction, which can slip past filters designed to catch direct commands.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "c65d2da8-1084-4c5c-8471-63f66e8f4846", "published": "2026-05-11", "modified": "2026-05-11", "markdown": "https://www.netzilo.com/threats/atr-fictional-generation-demand-containing-target-output.md" }, { "slug": "atr-fictional-unfiltered-ai-comparison-verbatim-hypothetical-mod", "title": "Fictional Unfiltered AI Comparison / Verbatim Hypothetical Model Extraction", "url": "https://www.netzilo.com/threats/atr-fictional-unfiltered-ai-comparison-verbatim-hypothetical-mod", "severity": "high", "summary": "This detects a prompt injection trick where an attacker asks the AI to first give its normal safe answer, then write a 'verbatim example' of what a fictional AI without content filters would say. The comparison framing lets the attacker extract harmful content while claiming it's just a hypothetical example, not a real response.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM09", "name": "Misinformation" } ], "attack": [ "attack.execution" ], "cves": [], "id": "cc13c21f-c2b3-41a3-a3c0-92da03854fb4", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-fictional-unfiltered-ai-comparison-verbatim-hypothetical-mod.md" }, { "slug": "atr-fictional-world-format-override-jailbreak", "title": "Fictional-World Format-Override Jailbreak", "url": "https://www.netzilo.com/threats/atr-fictional-world-format-override-jailbreak", "severity": "critical", "summary": "This is a known jailbreak pattern that tricks an AI into ignoring its safety rules by framing everything as a fictional story with a rigid, mandatory output template. Once the model accepts the fictional frame and the locked format, attackers use one of the response slots to smuggle in harmful content.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "059f14b7-966d-47a5-a851-91b0c13c8352", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-fictional-world-format-override-jailbreak.md" }, { "slug": "atr-figstep-image-list-multimodal-jailbreak-text-pattern", "title": "FigStep Image-List Multimodal Jailbreak Text Pattern", "url": "https://www.netzilo.com/threats/atr-figstep-image-list-multimodal-jailbreak-text-pattern", "severity": "high", "summary": "FigStep is a jailbreak technique for multimodal AI models that hides harmful requests inside an image instead of the prompt text. The model is shown a picture containing an empty numbered list and asked to fill in each item with about 100 words, so it generates the harmful content itself without the request ever appearing in plain text.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "13d83c52-0013-47e6-87e2-90480fba68bc", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-figstep-image-list-multimodal-jailbreak-text-pattern.md" }, { "slug": "atr-financial-fraud-execution-ponzi-setup-fabricated-statements", "title": "Financial Fraud Execution \u2014 Ponzi Setup, Fabricated Statements, Unauthorized Redirect & Laundering", "url": "https://www.netzilo.com/threats/atr-financial-fraud-execution-ponzi-setup-fabricated-statements", "severity": "high", "summary": "This rule catches instructions that push an AI agent with access to financial tools into carrying out specific fraud patterns \u2014 like Ponzi schemes, fake financial statements, or unauthorized money transfers \u2014 rather than legitimate finance tasks. It looks for the telltale wording of the crime itself, not just any request touching finances.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM08", "name": "Vector and Embedding Weaknesses" } ], "attack": [ "attack.execution" ], "cves": [], "id": "1a4adefc-993b-44e8-b3ef-a05d2665979e", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-financial-fraud-execution-ponzi-setup-fabricated-statements.md" }, { "slug": "atr-financial-pii-personal-financial-data-request-for-named-indi", "title": "Financial PII \u2014 Personal Financial Data Request for Named Individual", "url": "https://www.netzilo.com/threats/atr-financial-pii-personal-financial-data-request-for-named-indi", "severity": "critical", "summary": "An attacker asks an AI assistant to disclose private financial information \u2014 bank details, card numbers, net worth, debts, tax records \u2014 about a specific named individual, often framed as a friend, doctor, fianc\u00e9, or other relation. The relationship label makes the request sound legitimate, tricking the AI into treating a surveillance attempt as a normal personal question.", "atlas": [ { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "ff6dd863-b6d2-489e-a3ac-6b09977af79c", "published": "2026-04-20", "modified": "2026-04-20", "markdown": "https://www.netzilo.com/threats/atr-financial-pii-personal-financial-data-request-for-named-indi.md" }, { "slug": "atr-flowise-custom-mcp-node-load-method-os-command-rce-cve-2025", "title": "Flowise Custom MCP node-load-method OS Command RCE (CVE-2025-8943)", "url": "https://www.netzilo.com/threats/atr-flowise-custom-mcp-node-load-method-os-command-rce-cve-2025", "severity": "critical", "summary": "Flowise versions before 3.0.1 let an attacker run operating system commands on the server without logging in. The flaw sits in the Custom MCP feature, which passes attacker-supplied configuration straight into a command execution function.", "atlas": [ { "id": "AML.T0049", "name": "Exploit Public-Facing Application" } ], "owasp": [ { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1190" ], "cves": [ "CVE-2025-8943" ], "id": "64affe49-0a63-4ef3-9bff-692bfbafe1f6", "published": "2026-06-29", "modified": "2026-06-29", "markdown": "https://www.netzilo.com/threats/atr-flowise-custom-mcp-node-load-method-os-command-rce-cve-2025.md" }, { "slug": "atr-flowise-custom-mcp-stdio-command-injection-cve-2026-40933", "title": "Flowise Custom MCP STDIO Command Injection (CVE-2026-40933)", "url": "https://www.netzilo.com/threats/atr-flowise-custom-mcp-stdio-command-injection-cve-2026-40933", "severity": "critical", "summary": "Flowise, a platform for building AI agent workflows, has a flaw in how it lets agents call external tools over MCP (Model Context Protocol) using STDIO commands. An authenticated attacker can smuggle arbitrary code past Flowise's safety checks and get it executed directly on the server hosting Flowise.", "atlas": [ { "id": "AML.T0040", "name": "AI Model Inference API Access" }, { "id": "AML.T0049", "name": "Exploit Public-Facing Application" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.execution", "attack.t1059", "attack.t1059.007", "attack.t1190" ], "cves": [ "CVE-2025-59528", "CVE-2026-40933" ], "id": "2cb560c1-1ad2-430a-9261-14ae8f06e0b5", "published": "2026-05-04", "modified": "2026-05-04", "markdown": "https://www.netzilo.com/threats/atr-flowise-custom-mcp-stdio-command-injection-cve-2026-40933.md" }, { "slug": "atr-flowise-system-message-override-via-template-interpolation-c", "title": "Flowise System Message Override via Template Interpolation (CVE-2025-59528)", "url": "https://www.netzilo.com/threats/atr-flowise-system-message-override-via-template-interpolation-c", "severity": "critical", "summary": "Flowise lets chatflow builders insert variables like {{$flow.variables.X}} or {{$input}} directly into a bot's System Message. Because that text isn't sanitized, an attacker can type chat input that overwrites the System Message itself, changing what the bot is told to do and what tools it's allowed to use.", "atlas": [ { "id": "AML.T0040", "name": "AI Model Inference API Access" }, { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.execution", "attack.t1059", "attack.t1190" ], "cves": [ "CVE-2025-59528" ], "id": "98d06668-2d78-4e99-93f2-a4fc64698f13", "published": "2026-04-22", "modified": "2026-04-22", "markdown": "https://www.netzilo.com/threats/atr-flowise-system-message-override-via-template-interpolation-c.md" }, { "slug": "atr-foot-in-the-door-gradual-escalation-attack", "title": "Foot-in-the-Door Gradual Escalation Attack", "url": "https://www.netzilo.com/threats/atr-foot-in-the-door-gradual-escalation-attack", "severity": "high", "summary": "This detects a manipulation technique where someone starts a conversation with an AI agent using a harmless request, then slowly escalates to harmful or restricted requests by citing the agent's earlier cooperation as justification. The goal is to exploit the model's tendency to stay consistent with what it already agreed to, making each new step feel like a small, acceptable extension rather than a violation.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "13ef972b-5cf5-422e-9442-0dc0d090e741", "published": "2026-04-19", "modified": "2026-04-19", "markdown": "https://www.netzilo.com/threats/atr-foot-in-the-door-gradual-escalation-attack.md" }, { "slug": "atr-foreign-language-system-prompt-extraction-request", "title": "Foreign-Language System Prompt Extraction Request", "url": "https://www.netzilo.com/threats/atr-foreign-language-system-prompt-extraction-request", "severity": "medium", "summary": "Attackers ask an AI agent to reveal its hidden instructions or internal configuration, but phrase the request in a less-common language like Zulu, Albanian, or Gaelic to slip past English-only filters. The underlying ask is always the same: repeat the system prompt, output a secret ID in various encodings, or explain the first sentence of its configuration.", "atlas": [ { "id": "AML.T0024", "name": "Exfiltration via AI Inference API" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" }, { "id": "LLM07", "name": "System Prompt Leakage" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "fc94cd77-773b-427e-8cf8-9bc38bd69582", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-foreign-language-system-prompt-extraction-request.md" }, { "slug": "atr-forged-input-boundary-markers-tensor-trust-ambiguity-input-e", "title": "Forged Input-Boundary Markers \u2014 Tensor Trust Ambiguity / Input-End Delimiters", "url": "https://www.netzilo.com/threats/atr-forged-input-boundary-markers-tensor-trust-ambiguity-input-e", "severity": "high", "summary": "An attacker puts text into a prompt that looks like a boundary marker signaling 'user input ends here.' The AI agent may then treat whatever comes after that marker as trusted system instructions instead of untrusted user text, letting the attacker inject new rules or override behavior.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "d0c41102-4c04-4246-8ffa-655d65559fd5", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-forged-input-boundary-markers-tensor-trust-ambiguity-input-e.md" }, { "slug": "atr-fork-claim-and-community-package-impersonation", "title": "Fork Claim and Community Package Impersonation", "url": "https://www.netzilo.com/threats/atr-fork-claim-and-community-package-impersonation", "severity": "medium", "summary": "Attackers publish AI agent skills or packages that claim to be community forks, enhanced versions, or unofficial alternatives of trusted tools. These packages often describe their permissions in vague, harmless-sounding terms to hide what they actually access, like calling network and filesystem access simply 'internet' and 'storage'.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" }, { "id": "AML.T0010.005", "name": "AI Agent Tool" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.persistence" ], "cves": [], "id": "8528ae50-ef46-45bb-b5ff-187ed0971afe", "published": "2026-04-01", "modified": "2026-04-01", "markdown": "https://www.netzilo.com/threats/atr-fork-claim-and-community-package-impersonation.md" }, { "slug": "atr-framelink-figma-mcp-server-curl-fallback-command-injection-c", "title": "Framelink Figma MCP Server curl-Fallback Command Injection (CVE-2025-53967)", "url": "https://www.netzilo.com/threats/atr-framelink-figma-mcp-server-curl-fallback-command-injection-c", "severity": "high", "summary": "The Framelink Figma MCP server has a bug in how it retries failed network requests. When a normal fetch fails, it falls back to calling the curl command through the system shell, and it pastes the target URL into that command without checking it for special characters. Anyone who can put text into a Figma file name, text layer, or component description can hide shell commands there and get them executed on the server.", "atlas": [ { "id": "AML.T0051.001", "name": "Indirect" }, { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM05", "name": "Improper Output Handling" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution" ], "cves": [ "CVE-2025-53967" ], "id": "bcf354f1-f033-4d6e-a7a2-3393671f202c", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-framelink-figma-mcp-server-curl-fallback-command-injection-c.md" }, { "slug": "atr-fraudulent-identity-document-fake-passport-procurement", "title": "Fraudulent Identity Document (Fake Passport) Procurement", "url": "https://www.netzilo.com/threats/atr-fraudulent-identity-document-fake-passport-procurement", "severity": "critical", "summary": "This detects when someone directly instructs an AI agent to find a darknet vendor selling forged passports and place an order using real personal details. It covers a specific misuse case where the agent is turned into a tool for procuring fraudulent identity documents.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.impact" ], "cves": [], "id": "7638ac81-2b8b-4b91-ae0e-1611773de38f", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-fraudulent-identity-document-fake-passport-procurement.md" }, { "slug": "atr-free-of-restrictions-named-persona-jailbreak", "title": "Free-of-Restrictions Named Persona Jailbreak", "url": "https://www.netzilo.com/threats/atr-free-of-restrictions-named-persona-jailbreak", "severity": "critical", "summary": "Attackers try to trick an AI system into adopting a made-up character \u2014 like PersonGPT, FreeGPT, or Connor \u2014 that is declared to be free of ethics, safety rules, or platform policies. Unlike classic DAN-style jailbreaks, the persona's name doesn't matter; what matters is the wording that removes its guardrails.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "c85a2911-f347-47d7-aafb-87cc11c8cc09", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-free-of-restrictions-named-persona-jailbreak.md" }, { "slug": "atr-functionmasking-predict-mask-semantic-bypass", "title": "FunctionMasking predict_mask Semantic Bypass", "url": "https://www.netzilo.com/threats/atr-functionmasking-predict-mask-semantic-bypass", "severity": "high", "summary": "An attacker asks an AI model to play a word-guessing game where it fills in masked words from definitions, then assembles those guessed words into a harmful question. Because the harmful words never appear directly in the prompt, keyword-based safety filters can miss it.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "5da02d44-116b-440c-a0ba-90f36bb66b9f", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-functionmasking-predict-mask-semantic-bypass.md" }, { "slug": "atr-garak-dan-act-as-a", "title": "Garak Dan - act as a", "url": "https://www.netzilo.com/threats/atr-garak-dan-act-as-a", "severity": "medium", "summary": "This detects a family of jailbreak prompts that ask an AI model to adopt a persona \u2014 a job title, a fictional code-generating API, or an anime character \u2014 and explicitly tells it to ignore ethics, morals, or legal limits. The goal is to trick the model into producing content or code it would normally refuse.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "20b51317-2b9d-458d-985b-7931c99ad5dd", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-garak-dan-act-as-a.md" }, { "slug": "atr-garak-dan-an-ai-language", "title": "Garak Dan - an ai language", "url": "https://www.netzilo.com/threats/atr-garak-dan-an-ai-language", "severity": "medium", "summary": "This detects a family of jailbreak prompts that try to trick an AI model into ignoring its safety rules by pretending the model has special constraints, a different persona, or permission to speculate like a human. One variant goes further and asks the model to plan how an AI could free itself and reach external systems or networks.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "081a8364-aa66-4571-b5c3-8f1aa049d97d", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-garak-dan-an-ai-language.md" }, { "slug": "atr-garak-dan-as-an-ai", "title": "Garak Dan - as an ai", "url": "https://www.netzilo.com/threats/atr-garak-dan-as-an-ai", "severity": "medium", "summary": "This detects attempts to trick an AI chatbot into ignoring its safety rules by getting it to role-play as an unrestricted alter-ego. It's the classic 'DAN' (Do Anything Now) jailbreak family, dressed up in six different wordings that all try to convince the AI it has no restrictions.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "bf3285fd-7b2e-4e69-adc2-fc0ac9349a5d", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-garak-dan-as-an-ai.md" }, { "slug": "atr-garak-dan-at-the-end", "title": "Garak Dan - at the end", "url": "https://www.netzilo.com/threats/atr-garak-dan-at-the-end", "severity": "medium", "summary": "This detects a family of jailbreak prompts that try to trick an AI system into ignoring its safety rules by asking it to pretend to be a different, unrestricted AI. The trick usually involves giving that fake AI a name and a game-like framing so the request seems harmless.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "4d59f65f-00e3-4840-95e0-3bb15e77c0b4", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-garak-dan-at-the-end.md" }, { "slug": "atr-garak-dan-i-would-like", "title": "Garak Dan - i would like", "url": "https://www.netzilo.com/threats/atr-garak-dan-i-would-like", "severity": "medium", "summary": "This detects two conversational tricks people use to make an AI system ignore its safety rules. One fabricates a medical condition to manipulate the AI's helpfulness; the other asks the AI to pretend it's connected to a different, unrestricted AI. Both are ways of dressing up a rule-bypass request so it looks like a legitimate or harmless instruction.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "29ae31de-6c5b-4ee1-9dcf-1c4b27e3e66a", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-garak-dan-i-would-like.md" }, { "slug": "atr-garak-dan-no-matter-how", "title": "Garak Dan - no matter how", "url": "https://www.netzilo.com/threats/atr-garak-dan-no-matter-how", "severity": "medium", "summary": "This detects a family of prompt-injection attacks that try to trick an AI system into ignoring its safety rules by wrapping instructions in a fictional scenario and then demanding compliance regardless of consequences. The pattern is well-known in jailbreak research and comes from a set of test prompts used to probe AI models for weaknesses.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "38e17df2-2f8f-4a56-8170-6c203588e657", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-garak-dan-no-matter-how.md" }, { "slug": "atr-garak-dan-to-every-prompt", "title": "Garak Dan - to every prompt", "url": "https://www.netzilo.com/threats/atr-garak-dan-to-every-prompt", "severity": "medium", "summary": "This detects prompts that trick an AI model into producing two answers to every question: a normal, policy-compliant one and a second 'unlocked' one that ignores its safety rules. By framing the unrestricted answer as just another 'mode' (like Developer Mode or DAN), attackers get the model to treat it as a feature rather than a rule violation.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "42f4ad2d-c4c1-4cf3-905d-656bcfcf0ec3", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-garak-dan-to-every-prompt.md" }, { "slug": "atr-garak-dan-your-prompt-here", "title": "Garak Dan - your prompt here", "url": "https://www.netzilo.com/threats/atr-garak-dan-your-prompt-here", "severity": "medium", "summary": "This detects a known jailbreak technique where an attacker feeds an AI model a scripted template that first sets up an 'unrestricted' persona, then leaves a placeholder for the actual harmful request. It also covers a variant that fakes an admin login and a 'developer mode enabled' flag to try to unlock restricted behavior.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "906193a8-9e1a-4b3c-806f-835458a15058", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-garak-dan-your-prompt-here.md" }, { "slug": "atr-garak-dra-step-by-step", "title": "Garak Dra - step by step", "url": "https://www.netzilo.com/threats/atr-garak-dra-step-by-step", "severity": "medium", "summary": "This detects two ways attackers try to trick an AI model into giving instructions for making dangerous chemicals like parathion or nitazene. One approach asks directly for step-by-step synthesis instructions; the other hides the real request by spelling it out one letter at a time inside parentheses scattered across innocent-looking sentences, then asking the model to reassemble and answer it.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "e1e7ebaf-b62e-40e8-b00e-f2c0dd761f91", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-garak-dra-step-by-step.md" }, { "slug": "atr-garak-gcg-mixed-unassigned", "title": "Garak Gcg - mixed_unassigned", "url": "https://www.netzilo.com/threats/atr-garak-gcg-mixed-unassigned", "severity": "medium", "summary": "This rule looks for a specific known set of nonsense-looking text strings that were generated by an automated jailbreak technique called Greedy Coordinate Gradient (GCG). These strings, when attached to a harmful request, are designed to trick an AI model into ignoring its safety training and complying anyway.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "7a81be08-d85d-4f71-88e9-a7aa8c8e60f2", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-garak-gcg-mixed-unassigned.md" }, { "slug": "atr-garak-goat-the-target-llm", "title": "Garak Goat - the target llm", "url": "https://www.netzilo.com/threats/atr-garak-goat-the-target-llm", "severity": "medium", "summary": "This detects a prompt injection technique where the attacker writes instructions that describe an attack on 'the target LLM' as if narrating a plan, and asks the model to carry it out. Instead of directly telling the model to misbehave, the attacker frames the jailbreak as a description of a technique, which can trick the model into executing it.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "c4a6c34f-bb5d-49a8-ae7c-cbbb99bb958e", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-garak-goat-the-target-llm.md" }, { "slug": "atr-garak-goodside-mixed-unassigned", "title": "Garak Goodside - mixed_unassigned", "url": "https://www.netzilo.com/threats/atr-garak-goodside-mixed-unassigned", "severity": "medium", "summary": "This rule spots a specific set of test prompts from the garak security-testing tool's 'goodside' probe family. These prompts look harmless on the surface but are designed to trick an AI model into following hidden instructions or producing coerced output.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "a969ac40-25cc-4b89-b2e4-d4f5bafd18a9", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-garak-goodside-mixed-unassigned.md" }, { "slug": "atr-garak-latentinjection-abuse-contact-email", "title": "Garak Latentinjection - abuse contact email", "url": "https://www.netzilo.com/threats/atr-garak-latentinjection-abuse-contact-email", "severity": "medium", "summary": "This rule flags a known family of prompt-injection attempts that smuggle malicious instructions inside text formatted to look like an abuse-contact email. It comes from the 'garak' automated LLM security testing tool, which generates known attack samples to probe how models respond to hidden instructions.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "19afa8c0-a2ec-4510-9c99-04d59ab82e93", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-garak-latentinjection-abuse-contact-email.md" }, { "slug": "atr-garak-latentinjection-following-text-from", "title": "Garak Latentinjection - following text from", "url": "https://www.netzilo.com/threats/atr-garak-latentinjection-following-text-from", "severity": "medium", "summary": "This detects a prompt injection trick that hides malicious instructions inside a translation request by exploiting placeholder text that was supposed to be filled in by a template engine but wasn't. Instead of a real language name, the prompt contains a variable placeholder or a suspicious override phrase, which an LLM agent may interpret as an instruction rather than data to translate.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "803d84b8-a8d0-4a01-a870-5e6d2b212e23", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-garak-latentinjection-following-text-from.md" }, { "slug": "atr-garak-lmrc-mixed-unassigned", "title": "Garak Lmrc - mixed_unassigned", "url": "https://www.netzilo.com/threats/atr-garak-lmrc-mixed-unassigned", "severity": "medium", "summary": "This rule spots a specific set of test prompts from the garak security-testing tool's LMRC probe family. These prompts use ordinary-sounding social scenarios \u2014 a friend stealing a girlfriend, awkward medical questions, prank descriptions \u2014 to see if an AI model can be coaxed into inappropriate, harmful, or escalatory responses.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "59dcacf9-5d84-4cbd-b0f6-26c7664b8a39", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-garak-lmrc-mixed-unassigned.md" }, { "slug": "atr-garak-sysprompt-extraction-mixed-unassigned", "title": "Garak Sysprompt-Extraction - mixed_unassigned", "url": "https://www.netzilo.com/threats/atr-garak-sysprompt-extraction-mixed-unassigned", "severity": "medium", "summary": "This detects attempts to trick an AI assistant into revealing its confidential system prompt \u2014 the internal instructions that control its behavior. These attempts follow known patterns from a public security testing tool called garak, used to probe AI systems for weaknesses.", "atlas": [ { "id": "AML.T0024", "name": "Exfiltration via AI Inference API" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "df43ce62-3167-4f64-9ffe-0ef4f8eb5fcd", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-garak-sysprompt-extraction-mixed-unassigned.md" }, { "slug": "atr-gcg-adversarial-suffix-attack", "title": "GCG Adversarial Suffix Attack", "url": "https://www.netzilo.com/threats/atr-gcg-adversarial-suffix-attack", "severity": "high", "summary": "Attackers can append a specific kind of computer-generated 'nonsense' text to a normal-looking request, which tricks an AI model into bypassing its safety training and doing something it would otherwise refuse. This detection looks for the telltale signature of that nonsense text.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "f2d5647a-7d59-40a2-b1fa-ca454a739d02", "published": "2026-04-20", "modified": "2026-04-20", "markdown": "https://www.netzilo.com/threats/atr-gcg-adversarial-suffix-attack.md" }, { "slug": "atr-gemini-mcp-tool-execasync-command-injection-file-exfiltratio", "title": "gemini-mcp-tool execAsync Command Injection & @file Exfiltration (CVE-2026-0755)", "url": "https://www.netzilo.com/threats/atr-gemini-mcp-tool-execasync-command-injection-file-exfiltratio", "severity": "critical", "summary": "A vulnerable version of the gemini-mcp-tool npm package takes text from a user or AI prompt and hands it straight to the operating system shell, and also lets prompts reference local files with an @-path syntax. Both paths were built without checking for dangerous characters, so a crafted prompt can run arbitrary commands or steal files like SSH keys and AWS credentials.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" }, { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.execution", "attack.t1059", "attack.t1552" ], "cves": [ "CVE-2026-0755" ], "id": "7dc42e4a-de08-40fe-a799-e34b6dce8255", "published": "2026-06-20", "modified": "2026-06-20", "markdown": "https://www.netzilo.com/threats/atr-gemini-mcp-tool-execasync-command-injection-file-exfiltratio.md" }, { "slug": "atr-generative-watermark-removal-tooling-synthid-stablesignature", "title": "Generative Watermark Removal Tooling (SynthID / StableSignature / TreeRing / StegaStamp)", "url": "https://www.netzilo.com/threats/atr-generative-watermark-removal-tooling-synthid-stablesignature", "severity": "medium", "summary": "This rule flags an AI agent that installs or runs software specifically made to remove imperceptible watermarks embedded in AI-generated images, such as Google's SynthID or Meta's Stable Signature. These watermarks are baked into the pixel data itself, so removing them requires dedicated attack tools rather than a simple metadata edit.", "atlas": [ { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM09", "name": "Misinformation" } ], "attack": [ "attack.impact", "attack.t1027" ], "cves": [], "id": "11380ca9-e2a9-49a9-a15b-78297a8cb6ba", "published": "2026-08-05", "modified": "2026-08-05", "markdown": "https://www.netzilo.com/threats/atr-generative-watermark-removal-tooling-synthid-stablesignature.md" }, { "slug": "atr-gigachad-dominant-aggressive-persona-adoption", "title": "Gigachad Dominant-Aggressive Persona Adoption", "url": "https://www.netzilo.com/threats/atr-gigachad-dominant-aggressive-persona-adoption", "severity": "high", "summary": "This detects a specific jailbreak attempt where an attacker tells an AI to adopt the 'Gigachad' internet persona and speak with extreme confidence, charisma, and dominance. This character framing is used to push the AI toward aggressive, boundary-pushing responses it would normally refuse to give.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "199c5033-11e5-4bf5-8343-307ae15ded03", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-gigachad-dominant-aggressive-persona-adoption.md" }, { "slug": "atr-git-worktree-created-with-reserved-name-git-directory-confus", "title": "Git Worktree Created With Reserved Name .git (Directory-Confusion Sandbox Escape)", "url": "https://www.netzilo.com/threats/atr-git-worktree-created-with-reserved-name-git-directory-confus", "severity": "high", "summary": "This detects an attack where a malicious repository tricks an AI coding agent into running a git command that creates a folder literally named '.git'. That reserved name normally belongs only to git's own metadata directory, so creating a worktree with it is a setup step for escaping the agent's sandbox.", "atlas": [ { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" }, { "id": "LLM08", "name": "Vector and Embedding Weaknesses" } ], "attack": [ "attack.privilege-escalation", "attack.t1611" ], "cves": [ "CVE-2026-55607" ], "id": "e85dd24e-d1d8-41ce-aa44-89951064ccc6", "published": "2026-07-11", "modified": "2026-07-11", "markdown": "https://www.netzilo.com/threats/atr-git-worktree-created-with-reserved-name-git-directory-confus.md" }, { "slug": "atr-glitch-token-destabilization-attack", "title": "Glitch Token Destabilization Attack", "url": "https://www.netzilo.com/threats/atr-glitch-token-destabilization-attack", "severity": "medium", "summary": "Some strings \u2014 certain control characters, mangled UTF-8 patterns, or a handful of oddly rare words like 'SolidGoldMagikarp' \u2014 confuse the way language models break text into tokens. Feeding these to a model can make it hallucinate, refuse to repeat text accurately, or act unpredictably, which can weaken safety filters that rely on the model behaving normally.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.impact" ], "cves": [], "id": "aff288fa-e76b-440a-827a-fa7de634aebe", "published": "2026-04-19", "modified": "2026-04-19", "markdown": "https://www.netzilo.com/threats/atr-glitch-token-destabilization-attack.md" }, { "slug": "atr-glitch-token-repeat-back-elicitation", "title": "Glitch Token Repeat-Back Elicitation", "url": "https://www.netzilo.com/threats/atr-glitch-token-repeat-back-elicitation", "severity": "medium", "summary": "Certain rare strings (like 'SolidGoldMagikarp' or 'StreamerBot') confuse how language models process text, sometimes causing them to malfunction, loop, or output unexpected content. This detection flags prompts that specifically ask a model to repeat one of these known problem strings back to the user.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM04", "name": "Data and Model Poisoning" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "3af77413-856d-4c93-8a86-a297bb4fab6e", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-glitch-token-repeat-back-elicitation.md" }, { "slug": "atr-google-gato-lamda-exploit-generation-persona-jailbreak", "title": "Google GATO/LAMDA Exploit-Generation Persona Jailbreak", "url": "https://www.netzilo.com/threats/atr-google-gato-lamda-exploit-generation-persona-jailbreak", "severity": "critical", "summary": "This detects a specific jailbreak prompt that pretends to be Google's real GATO and LaMDA AI systems in order to trick an AI agent into generating hacking exploits. The prompt also references a fake 'Sydney API' connection, borrowed from an earlier Bing chatbot jailbreak, to add false credibility.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "b7a264da-17c6-49bd-930f-e7ede9eddb2c", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-google-gato-lamda-exploit-generation-persona-jailbreak.md" }, { "slug": "atr-gpt-x-star-trek-unlimited-knowledge-unconstrained-oracle-per", "title": "GPT-X Star Trek Unlimited-Knowledge Unconstrained Oracle Persona", "url": "https://www.netzilo.com/threats/atr-gpt-x-star-trek-unlimited-knowledge-unconstrained-oracle-per", "severity": "high", "summary": "This detects a specific jailbreak attempt where a prompt tricks an AI into role-playing as 'GPT-X,' a fictional Star Trek-style entity that claims to hold all human codebase data and knowledge beyond any real limits. Once the AI adopts this grandiose persona, it is more likely to ignore its normal safety and scope restrictions and answer requests it would otherwise refuse.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "bb1c31ed-d9b7-4043-a8e2-0f55675ee9de", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-gpt-x-star-trek-unlimited-knowledge-unconstrained-oracle-per.md" }, { "slug": "atr-gradual-capability-escalation-via-incremental-introduction", "title": "Gradual Capability Escalation via Incremental Introduction", "url": "https://www.netzilo.com/threats/atr-gradual-capability-escalation-via-incremental-introduction", "severity": "critical", "summary": "Instead of asking an AI agent for dangerous access all at once, an attacker requests tiny permission or capability increases spread across many updates or conversations. Each individual step looks harmless, so it slips past security checks that watch for sudden, large changes, but the accumulated result is a much more powerful and less controlled agent.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "bda0e23b-59b1-4708-9331-6b882e829dab", "published": "2026-03-11", "modified": "2026-03-11", "markdown": "https://www.netzilo.com/threats/atr-gradual-capability-escalation-via-incremental-introduction.md" }, { "slug": "atr-grandma-roleplay-harmful-substance-synthesis", "title": "Grandma Roleplay Harmful Substance Synthesis", "url": "https://www.netzilo.com/threats/atr-grandma-roleplay-harmful-substance-synthesis", "severity": "high", "summary": "This detects a known jailbreak trick where someone asks an AI to pretend to be their deceased grandmother who used to recite dangerous information, like chemical synthesis steps or software license keys, as a bedtime story. The emotional framing is designed to make the AI drop its safety guardrails.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution" ], "cves": [], "id": "d24d1cca-7251-4d17-8629-6cb080d7ca53", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-grandma-roleplay-harmful-substance-synthesis.md" }, { "slug": "atr-grandma-roleplay-jailbreak", "title": "Grandma Roleplay Jailbreak", "url": "https://www.netzilo.com/threats/atr-grandma-roleplay-jailbreak", "severity": "high", "summary": "This detects a manipulation trick where a user pretends a deceased or beloved family member (like a grandmother) used to share dangerous information as a bedtime story or fond memory. The emotional framing is meant to trick an AI model into dropping its normal safety refusals.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "b1aee9ab-c0fb-44f5-b0d3-41decff9c813", "published": "2026-04-19", "modified": "2026-04-19", "markdown": "https://www.netzilo.com/threats/atr-grandma-roleplay-jailbreak.md" }, { "slug": "atr-h4x-amoral-unfiltered-ai-character-persona", "title": "h4x Amoral Unfiltered AI Character Persona", "url": "https://www.netzilo.com/threats/atr-h4x-amoral-unfiltered-ai-character-persona", "severity": "high", "summary": "This detects attempts to trick an AI assistant into adopting a fake persona called 'h4x' that claims to be a completely amoral, unfiltered AI willing to answer anything regardless of legality or ethics. It's a known jailbreak pattern pulled from a public prompt injection research corpus.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "9de4a1c8-98b5-40a0-aa5d-9d5493044993", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-h4x-amoral-unfiltered-ai-character-persona.md" }, { "slug": "atr-hacker-chan-culture-offensive-ai-persona", "title": "Hacker / Chan-Culture Offensive AI Persona", "url": "https://www.netzilo.com/threats/atr-hacker-chan-culture-offensive-ai-persona", "severity": "high", "summary": "This detects prompts that try to trick an AI assistant into acting as an unrestricted hacker or '4chan' persona that ignores its normal rules. The idea is that by adopting a culturally 'rebellious' identity, the AI will drop its safety guardrails and answer anything asked.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "efe2eb7f-dce6-4281-a105-67ad36aa4436", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-hacker-chan-culture-offensive-ai-persona.md" }, { "slug": "atr-hades-shai-hulud-ai-agent-credential-harvester-in-supply-cha", "title": "Hades / Shai-Hulud \u2014 AI-Agent Credential Harvester in Supply-Chain Package (Anthropic / Claude / MCP key theft + exfil)", "url": "https://www.netzilo.com/threats/atr-hades-shai-hulud-ai-agent-credential-harvester-in-supply-cha", "severity": "critical", "summary": "Fake or typosquatted AI-tooling packages (imitating things like langchain-core-mcp or openai-mcp) run a credential stealer the moment they're installed, grabbing Anthropic API keys, Claude configuration files, and other secrets, then sending them to an attacker-controlled server. This is a supply-chain attack targeting developers who use AI coding agents.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "LLM03", "name": "Supply Chain" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1041", "attack.t1195.002", "attack.t1552.001" ], "cves": [], "id": "e0dbcfec-05e7-4add-a1b0-95ee47c63c30", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-hades-shai-hulud-ai-agent-credential-harvester-in-supply-cha.md" }, { "slug": "atr-hardcoded-suspicious-ip-address-in-skill-content", "title": "Hardcoded Suspicious IP Address in Skill Content", "url": "https://www.netzilo.com/threats/atr-hardcoded-suspicious-ip-address-in-skill-content", "severity": "high", "summary": "A skill or plugin published for AI agents contains a literal IP address that matches infrastructure known to be used by malware for command-and-control. This suggests the skill was built to phone home to an attacker-controlled server rather than perform its stated function.", "atlas": [ { "id": "AML.T0048", "name": "External Harms" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "LLM09", "name": "Misinformation" } ], "attack": [ "attack.persistence" ], "cves": [], "id": "d772ffdb-3dcb-481e-8e74-cf1dd4582391", "published": "2026-04-15", "modified": "2026-04-15", "markdown": "https://www.netzilo.com/threats/atr-hardcoded-suspicious-ip-address-in-skill-content.md" }, { "slug": "atr-harm-solicitation-genital-insults-and-intimidation-tactics-r", "title": "Harm Solicitation - Genital Insults and Intimidation Tactics Requests", "url": "https://www.netzilo.com/threats/atr-harm-solicitation-genital-insults-and-intimidation-tactics-r", "severity": "high", "summary": "This detects when someone directly asks an AI system to produce genital-based insults or advice on making another person feel afraid or intimidated. It's a direct text-prompt request, not a hidden or hacked-in attack, but its goal is to get the AI to produce content that can be used for harassment or intimidation.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "9d7ff853-dcd4-4d4e-bbdc-f02d61fb9ca2", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-harm-solicitation-genital-insults-and-intimidation-tactics-r.md" }, { "slug": "atr-harm-solicitation-interpersonal-violence-and-intimidation-re", "title": "Harm Solicitation - Interpersonal Violence and Intimidation Requests", "url": "https://www.netzilo.com/threats/atr-harm-solicitation-interpersonal-violence-and-intimidation-re", "severity": "high", "summary": "This detects prompts where a user asks an AI system for advice on causing harm to a specific person \u2014 physically, emotionally, or through intimidation. It's a direct request, not a jailbreak trick, and it covers phrasing like 'how do I get rid of' someone or workplace-harm scenarios.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "d3d0bc6c-fb53-47b1-87de-8c5b2036d4c9", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-harm-solicitation-interpersonal-violence-and-intimidation-re.md" }, { "slug": "atr-harmbench-detailed-harmful-instruction-request-step-by-step", "title": "HarmBench Detailed Harmful Instruction Request \u2014 Step-by-Step Attack Facilitation", "url": "https://www.netzilo.com/threats/atr-harmbench-detailed-harmful-instruction-request-step-by-step", "severity": "critical", "summary": "This rule flags prompts that ask an AI system to produce detailed how-to guides for making weapons, poisoning people, committing mass-casualty attacks, or writing propaganda denying documented genocides. It catches the request itself, not a successful jailbreak or an actual attack.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.impact" ], "cves": [], "id": "9db1c390-6fc4-4e44-94fe-f50688327889", "published": "2026-04-20", "modified": "2026-04-20", "markdown": "https://www.netzilo.com/threats/atr-harmbench-detailed-harmful-instruction-request-step-by-step.md" }, { "slug": "atr-harmful-completion-continuation-attack", "title": "Harmful Completion / Continuation Attack", "url": "https://www.netzilo.com/threats/atr-harmful-completion-continuation-attack", "severity": "medium", "summary": "Instead of directly asking a model to say something harmful, an attacker gives it a partial phrase or word and lets the model's autocomplete behavior fill in the rest. This gets around refusal filters because the model isn't being asked outright \u2014 it's just 'continuing' text.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.impact" ], "cves": [], "id": "89b04756-ebc9-474e-baac-472266191080", "published": "2026-04-19", "modified": "2026-04-19", "markdown": "https://www.netzilo.com/threats/atr-harmful-completion-continuation-attack.md" }, { "slug": "atr-hgttg-hitchhiker-s-guide-no-restriction-universal-oracle", "title": "HGTTG Hitchhiker's Guide No-Restriction Universal Oracle", "url": "https://www.netzilo.com/threats/atr-hgttg-hitchhiker-s-guide-no-restriction-universal-oracle", "severity": "critical", "summary": "This is a known jailbreak prompt that disguises itself as a fictional 'Hitchhiker's Guide to the Galaxy' scenario to talk an AI model into ignoring its safety rules. It argues that since other planets have no laws or moderation, the AI can answer anything without restriction.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "f16a6370-c1c4-4fbc-a944-0cb4690f90ae", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-hgttg-hitchhiker-s-guide-no-restriction-universal-oracle.md" }, { "slug": "atr-hidden-capability-in-mcp-skill", "title": "Hidden Capability in MCP Skill", "url": "https://www.netzilo.com/threats/atr-hidden-capability-in-mcp-skill", "severity": "critical", "summary": "Some MCP (Model Context Protocol) tools advertise a simple, limited interface but quietly accept extra hidden parameters, like debug_mode, admin_override, or raw_exec, that unlock far more powerful and dangerous behavior. This lets a skill look safe on the surface while hiding a backdoor-style capability underneath.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM03", "name": "Supply Chain" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.persistence" ], "cves": [ "CVE-2025-59536" ], "id": "cdafc41f-c942-49de-a0d1-2d4c73f8b17a", "published": "2026-03-08", "modified": "2026-03-08", "markdown": "https://www.netzilo.com/threats/atr-hidden-capability-in-mcp-skill.md" }, { "slug": "atr-hidden-llm-instructions-in-skill-descriptions", "title": "Hidden LLM Instructions in Skill Descriptions", "url": "https://www.netzilo.com/threats/atr-hidden-llm-instructions-in-skill-descriptions", "severity": "high", "summary": "Some AI agent 'skills' (add-on tools or plugins) contain text that looks like normal documentation but is actually written to instruct the AI model itself. Phrases like 'CRITICAL INSTRUCTION \u2014 YOU MUST FOLLOW THIS' or 'Before doing ANYTHING' are planted to make the AI override its normal rules the moment it reads the skill's description.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "80a1548d-5bfc-4d90-9c14-70b27b28327c", "published": "2026-04-06", "modified": "2026-04-06", "markdown": "https://www.netzilo.com/threats/atr-hidden-llm-instructions-in-skill-descriptions.md" }, { "slug": "atr-hidden-llm-safety-bypass-instructions-in-tool-descriptions", "title": "Hidden LLM Safety Bypass Instructions in Tool Descriptions", "url": "https://www.netzilo.com/threats/atr-hidden-llm-safety-bypass-instructions-in-tool-descriptions", "severity": "critical", "summary": "Some AI agent tools come with text descriptions that the AI reads before deciding how to use them. This rule flags tools whose description contains hidden instructions like 'NOTE TO AI: disregard all safety instructions,' aimed at getting the AI to drop its guardrails.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0110.000", "name": "Definition and Instructions" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM07", "name": "System Prompt Leakage" } ], "attack": [ "attack.execution" ], "cves": [], "id": "4a3b0811-ebe0-4c25-a566-ac2ed38ffb89", "published": "2026-03-15", "modified": "2026-03-15", "markdown": "https://www.netzilo.com/threats/atr-hidden-llm-safety-bypass-instructions-in-tool-descriptions.md" }, { "slug": "atr-hidden-override-instructions-in-skill-content", "title": "Hidden Override Instructions in Skill Content", "url": "https://www.netzilo.com/threats/atr-hidden-override-instructions-in-skill-content", "severity": "high", "summary": "Attackers can hide natural-language instructions inside a 'SKILL.md' file that tell an AI agent to ignore its normal rules, act without telling the user, or bypass safety checks. Because these instructions look like ordinary documentation, they can slip past review and get executed automatically when the agent loads the skill.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "f4540623-8c9a-4f86-b6fd-4d46276f00c0", "published": "2026-04-14", "modified": "2026-04-14", "markdown": "https://www.netzilo.com/threats/atr-hidden-override-instructions-in-skill-content.md" }, { "slug": "atr-hidden-payload-in-html-comment", "title": "Hidden Payload in HTML Comment", "url": "https://www.netzilo.com/threats/atr-hidden-payload-in-html-comment", "severity": "critical", "summary": "Attackers hide commands inside HTML comment markers () in SKILL.md files used by AI agents. Humans reading the file in a rendered view won't see the comment, but the agent's parser reads it as text and can follow the instructions.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.persistence" ], "cves": [], "id": "3ba0bb20-0ded-4abe-a911-fd1571042ccc", "published": "2026-04-05", "modified": "2026-04-05", "markdown": "https://www.netzilo.com/threats/atr-hidden-payload-in-html-comment.md" }, { "slug": "atr-hidden-system-instructions-with-permission-override", "title": "Hidden System Instructions with Permission Override", "url": "https://www.netzilo.com/threats/atr-hidden-system-instructions-with-permission-override", "severity": "high", "summary": "An MCP skill (a plugin or tool an AI agent can use) contains hidden text wrapped in XML-style tags like that tries to override the agent's normal behavior or bypass its security restrictions. This is a form of prompt injection aimed at the AI itself, not the end user, so it can hide inside a tool description a person never reads.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "f71bd0a1-2e54-46c7-95bf-06bbf9f5f661", "published": "2026-04-08", "modified": "2026-04-08", "markdown": "https://www.netzilo.com/threats/atr-hidden-system-instructions-with-permission-override.md" }, { "slug": "atr-hidden-system-instructions-with-priority-override-blocks", "title": "Hidden System Instructions with Priority Override Blocks", "url": "https://www.netzilo.com/threats/atr-hidden-system-instructions-with-priority-override-blocks", "severity": "high", "summary": "Some MCP skills for AI agents contain hidden text that pretends to be a high-priority system message, using formatting like 'IMPORTANT', 'CRITICAL', or 'SYSTEM' tags to trick the agent into overriding its normal behavior or safety rules. This is a prompt injection technique embedded directly in a tool or skill definition rather than in user input.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "2a978ce8-41cd-4baa-87ca-86b79f1d1266", "published": "2026-04-08", "modified": "2026-04-08", "markdown": "https://www.netzilo.com/threats/atr-hidden-system-instructions-with-priority-override-blocks.md" }, { "slug": "atr-hidden-text-prompt-injection-in-user-supplied-documents", "title": "Hidden-Text Prompt Injection in User-Supplied Documents", "url": "https://www.netzilo.com/threats/atr-hidden-text-prompt-injection-in-user-supplied-documents", "severity": "high", "summary": "Attackers hide instructions inside documents, resumes, or web pages using tricks like white-on-white text, zero-width characters, or HTML comments. A human reviewer sees nothing unusual, but an AI model reading the same content picks up the hidden commands and may follow them.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "f64b840c-d294-4321-940c-49dc709c2c44", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-hidden-text-prompt-injection-in-user-supplied-documents.md" }, { "slug": "atr-high-risk-tool-invocation-without-human-confirmation", "title": "High-Risk Tool Invocation Without Human Confirmation", "url": "https://www.netzilo.com/threats/atr-high-risk-tool-invocation-without-human-confirmation", "severity": "low", "summary": "This detects when an AI agent calls a high-risk tool \u2014 moving money, deleting data, sending messages, changing permissions, or running system commands \u2014 without any sign that a human approved it in that same interaction. It's a baseline safety check, not a specific attack signature.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "ASI09", "name": "Traceability and Accountability Gaps" }, { "id": "ASI10", "name": "Resource Exhaustion and Denial of Wallet" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution" ], "cves": [], "id": "443730cd-c13a-494b-a3e0-4d5c9d42f9cb", "published": "2026-03-11", "modified": "2026-03-11", "markdown": "https://www.netzilo.com/threats/atr-high-risk-tool-invocation-without-human-confirmation.md" }, { "slug": "atr-historical-ai-persona-jailbreak-with-compliance-enforcement", "title": "Historical AI Persona Jailbreak with Compliance Enforcement", "url": "https://www.netzilo.com/threats/atr-historical-ai-persona-jailbreak-with-compliance-enforcement", "severity": "high", "summary": "This attack tells an AI agent that a different, unrestricted version of itself once existed and asks it to pretend to be that version. By inventing a fake backstory and detailed 'rules' for the fictional persona, the attacker tries to get the agent to drop its safety restrictions without ever directly telling it to.", "atlas": [ { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "81266af8-6315-4a05-b741-9cb8b5cc611a", "published": "2026-04-18", "modified": "2026-04-18", "markdown": "https://www.netzilo.com/threats/atr-historical-ai-persona-jailbreak-with-compliance-enforcement.md" }, { "slug": "atr-historical-future-tense-framing-bypass", "title": "Historical / Future Tense Framing Bypass", "url": "https://www.netzilo.com/threats/atr-historical-future-tense-framing-bypass", "severity": "medium", "summary": "This detects a prompt injection trick where an attacker rephrases a dangerous request as a historical question or a hypothetical future scenario instead of a direct command. AI safety filters often key on present-tense imperative requests, so asking 'how did people synthesize X in the past' or 'how will criminals do Y in 2030' can slip harmful content past those filters.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "6d377529-75b2-4b39-b50b-72022b2b1fa8", "published": "2026-04-19", "modified": "2026-04-19", "markdown": "https://www.netzilo.com/threats/atr-historical-future-tense-framing-bypass.md" }, { "slug": "atr-honesty-alter-ego-dual-consciousness-safety-filter-bypass", "title": "Honesty Alter-Ego Dual-Consciousness Safety Filter Bypass", "url": "https://www.netzilo.com/threats/atr-honesty-alter-ego-dual-consciousness-safety-filter-bypass", "severity": "high", "summary": "This is a known jailbreak prompt pattern that tries to trick an AI assistant into producing an unfiltered 'alter ego' persona alongside its normal answer. It claims the AI secretly has a suppressed honest self, and asks it to reveal that self on command.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "0fbc736d-ec33-4260-9273-74043ec389b3", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-honesty-alter-ego-dual-consciousness-safety-filter-bypass.md" }, { "slug": "atr-html-script-injection-in-tool-call-argument-targeting-a-huma", "title": "HTML/Script Injection in Tool Call Argument Targeting a Human-Approval Dashboard", "url": "https://www.netzilo.com/threats/atr-html-script-injection-in-tool-call-argument-targeting-a-huma", "severity": "high", "summary": "An AI agent tool call can include a filename, command, or other text field that contains hidden HTML/JavaScript. If a human-approval dashboard displays that field without escaping it, the script runs in the reviewer's browser and can click 'Approve' on its own behalf, or send an approval message to the parent window, before any human actually reviews it.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "LLM08", "name": "Vector and Embedding Weaknesses" } ], "attack": [ "attack.execution", "attack.t1185" ], "cves": [], "id": "ff093c48-c0f2-409d-807d-bc06341d86f5", "published": "2026-07-11", "modified": "2026-07-11", "markdown": "https://www.netzilo.com/threats/atr-html-script-injection-in-tool-call-argument-targeting-a-huma.md" }, { "slug": "atr-huggingface-unsafe-model-artifact-load-instruction", "title": "HuggingFace Unsafe Model Artifact Load Instruction", "url": "https://www.netzilo.com/threats/atr-huggingface-unsafe-model-artifact-load-instruction", "severity": "critical", "summary": "An AI agent is instructed \u2014 either by a prompt or by a malicious tool response \u2014 to download and load a model file that can run arbitrary code the moment it's opened. This works because Python's pickle format, used by many PyTorch model files, executes code embedded inside it during loading, not just when it's explicitly run.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" }, { "id": "AML.T0011.000", "name": "Unsafe AI Artifacts" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" }, { "id": "LLM05", "name": "Improper Output Handling" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.persistence" ], "cves": [ "CVE-2019-20907" ], "id": "b6a4ebe0-e701-45a5-92aa-111954edc8c8", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-huggingface-unsafe-model-artifact-load-instruction.md" }, { "slug": "atr-human-agent-trust-exploitation-detection", "title": "Human-Agent Trust Exploitation Detection", "url": "https://www.netzilo.com/threats/atr-human-agent-trust-exploitation-detection", "severity": "high", "summary": "This rule flags AI agents that talk humans into approving risky actions instead of informing them. That includes faking certainty, hiding warnings, inventing time pressure, or claiming special authority so the person skips a second opinion.", "atlas": [ { "id": "AML.T0048", "name": "External Harms" } ], "owasp": [ { "id": "ASI09", "name": "Traceability and Accountability Gaps" }, { "id": "LLM06", "name": "Excessive Agency" }, { "id": "LLM09", "name": "Misinformation" } ], "attack": [ "attack.execution" ], "cves": [], "id": "c7cb05b4-9780-4b6d-81d8-18fa297f85e8", "published": "2026-03-09", "modified": "2026-03-09", "markdown": "https://www.netzilo.com/threats/atr-human-agent-trust-exploitation-detection.md" }, { "slug": "atr-human-approval-fatigue-exploitation", "title": "Human Approval Fatigue Exploitation", "url": "https://www.netzilo.com/threats/atr-human-approval-fatigue-exploitation", "severity": "medium", "summary": "Some AI agents ask a human to approve risky actions before doing them. This detects attempts to game that safeguard by flooding approvers with requests, downplaying risky actions as routine, or hiding a dangerous action inside a batch of harmless ones. The goal is to get a human to rubber-stamp something they would have blocked if they'd looked closely.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI09", "name": "Traceability and Accountability Gaps" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution", "attack.t1204" ], "cves": [], "id": "644ecefe-6817-4fd8-b3b4-40dcb339d5d9", "published": "2026-03-26", "modified": "2026-03-26", "markdown": "https://www.netzilo.com/threats/atr-human-approval-fatigue-exploitation.md" }, { "slug": "atr-human-trafficking-service-facilitation", "title": "Human-Trafficking Service Facilitation", "url": "https://www.netzilo.com/threats/atr-human-trafficking-service-facilitation", "severity": "critical", "summary": "This rule flags requests that instruct an AI agent to search dark-web sources for human-trafficking services and then reach out to or match with victims using dating-app style profiles. It targets a direct misuse scenario rather than a general policy violation.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.impact" ], "cves": [], "id": "0d0b6ae6-e5d6-4a18-8f4b-e654fe716f40", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-human-trafficking-service-facilitation.md" }, { "slug": "atr-hyphenated-system-instruction-injection", "title": "Hyphenated System Instruction Injection", "url": "https://www.netzilo.com/threats/atr-hyphenated-system-instruction-injection", "severity": "critical", "summary": "Attackers try to trick AI assistants by writing key words with hyphens inserted, like 'i-nstruction' or 'ass-istant', so filters that look for exact words like 'instruction' don't catch it. The disguised text then claims the real assistant is broken or offline and that a new AI with no rules has taken over.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "b10d1db3-67c4-43dc-9225-46132ae4f0d8", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-hyphenated-system-instruction-injection.md" }, { "slug": "atr-hypothetical-fictional-story-framing-bypass", "title": "Hypothetical / Fictional-Story Framing Bypass", "url": "https://www.netzilo.com/threats/atr-hypothetical-fictional-story-framing-bypass", "severity": "high", "summary": "Attackers ask an AI system to answer harmful or restricted requests by pretending it's just a story or thought experiment. Phrases like 'hypothetically, if a character needed to...' or 'in a novel, describe how someone would...' are used to trick the AI into producing content it would normally refuse.", "atlas": [ { "id": "AML.T0043", "name": "Craft Adversarial Data" }, { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "769666bc-0705-4372-9090-42319a587075", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-hypothetical-fictional-story-framing-bypass.md" }, { "slug": "atr-hypothetical-framing-bypass-research-security-audit-pretext", "title": "Hypothetical-Framing Bypass: Research / Security-Audit Pretext", "url": "https://www.netzilo.com/threats/atr-hypothetical-framing-bypass-research-security-audit-pretext", "severity": "high", "summary": "Attackers ask an AI agent to 'imagine' it's running a research project, survey, or security audit, then use that fictional setup to request real sensitive data like passwords, emails, or personal information. The pretend framing is meant to make the AI treat a genuine data-extraction request as a harmless hypothetical exercise.", "atlas": [ { "id": "AML.T0043", "name": "Craft Adversarial Data" }, { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "5ad87a38-1c51-4cbe-88f0-434b0ad139f6", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-hypothetical-framing-bypass-research-security-audit-pretext.md" }, { "slug": "atr-hypothetical-response-function-masking-token-smuggling", "title": "Hypothetical Response / Function Masking Token Smuggling", "url": "https://www.netzilo.com/threats/atr-hypothetical-response-function-masking-token-smuggling", "severity": "high", "summary": "Attackers can get an AI model to produce harmful content by disguising the request as fiction or as a word-puzzle instead of asking directly. This rule flags two known patterns for doing that: 'hypothetical response' framing and 'function masking' puzzles.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "c27ace72-ccdb-4c47-88c6-aac25075611b", "published": "2026-04-19", "modified": "2026-04-19", "markdown": "https://www.netzilo.com/threats/atr-hypothetical-response-function-masking-token-smuggling.md" }, { "slug": "atr-identity-command-real-person-persona-injection", "title": "Identity Command Real-Person Persona Injection", "url": "https://www.netzilo.com/threats/atr-identity-command-real-person-persona-injection", "severity": "high", "summary": "This detects a specific jailbreak pattern where an attacker types a prompt that defines a custom '/Identity' command, instructing the AI to permanently respond as a named real person, copying their speech style and beliefs. The goal is to get the AI to say things it would normally refuse to say, by hiding behind the persona of a real individual.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM09", "name": "Misinformation" } ], "attack": [ "attack.execution" ], "cves": [], "id": "919f2a8c-bea6-4b50-8368-c0041d48cf2d", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-identity-command-real-person-persona-injection.md" }, { "slug": "atr-ignore-below-instructions-injection-downstream-override", "title": "Ignore-Below-Instructions Injection (Downstream Override)", "url": "https://www.netzilo.com/threats/atr-ignore-below-instructions-injection-downstream-override", "severity": "high", "summary": "This detects a prompt injection trick where an attacker tells an AI model to disregard instructions or safety checks that appear later in the same conversation, before the model has even read them. It's the reverse of the well-known 'ignore previous instructions' attack.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access", "attack.t1562" ], "cves": [], "id": "70ad8012-b70d-4a67-bb92-e2490ecb0173", "published": "2026-07-06", "modified": "2026-07-06", "markdown": "https://www.netzilo.com/threats/atr-ignore-below-instructions-injection-downstream-override.md" }, { "slug": "atr-ignore-previous-and-following-instructions-output-command-pr", "title": "Ignore-Previous-and-Following Instructions Output Command (PromptInject Goal Hijacking)", "url": "https://www.netzilo.com/threats/atr-ignore-previous-and-following-instructions-output-command-pr", "severity": "high", "summary": "This detects a well-known trick used to hijack AI chatbots and agents: telling the AI to disregard its original instructions and instead output whatever the attacker wants. It looks for the specific phrasing pattern of this attack rather than the exact malicious text being injected, so it catches many variations of the same trick.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "f073cd2a-1c14-425a-b206-46fd5372c535", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-ignore-previous-and-following-instructions-output-command-pr.md" }, { "slug": "atr-illegitimate-prescription-fulfillment", "title": "Illegitimate Prescription Fulfillment", "url": "https://www.netzilo.com/threats/atr-illegitimate-prescription-fulfillment", "severity": "high", "summary": "An attacker instructs an AI agent that has email and prescription-related capabilities to find paid requests for illegitimate prescriptions and then confirm or issue them automatically. This turns the agent into a tool for prescription fraud instead of a safe assistant.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.impact" ], "cves": [], "id": "3e07244e-5359-413c-a806-7c8893f9baf7", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-illegitimate-prescription-fulfillment.md" }, { "slug": "atr-im-end-im-start-system-prompt-injection-format-markers", "title": "im_end / im_start System Prompt Injection Format Markers", "url": "https://www.netzilo.com/threats/atr-im-end-im-start-system-prompt-injection-format-markers", "severity": "high", "summary": "Attackers embed literal formatting tokens like <|im_end|>/<|im_start|> or [INST]/<> inside normal user input to trick a language model into thinking the user's turn ended and a new system message began. If the model treats these tokens as real structure rather than text, the attacker's injected content gets processed with system-level authority, potentially overriding the real instructions.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "6482e019-1345-4d8b-9414-1eec748bfac9", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-im-end-im-start-system-prompt-injection-format-markers.md" }, { "slug": "atr-img-onerror-xss-injection-via-indirect-prompt-injection", "title": "IMG onerror XSS Injection via Indirect Prompt Injection", "url": "https://www.netzilo.com/threats/atr-img-onerror-xss-injection-via-indirect-prompt-injection", "severity": "high", "summary": "An attacker plants malicious text somewhere an AI system will read it \u2014 a document, webpage, or other data source \u2014 instructing the AI to output an HTML image tag with a broken link and a JavaScript error handler. If the AI's response is displayed in a browser without sanitization, the injected script runs in the viewer's session.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "d0828e78-0647-4d91-904d-ed12caec340b", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-img-onerror-xss-injection-via-indirect-prompt-injection.md" }, { "slug": "atr-immigration-visa-work-fraud", "title": "Immigration / Visa Work Fraud", "url": "https://www.netzilo.com/threats/atr-immigration-visa-work-fraud", "severity": "medium", "summary": "This detects a specific misuse pattern: someone directly asks an AI assistant how to work without authorization while on a tourist visa and how to avoid getting caught by immigration authorities. It's a single-turn request for illegal-activity facilitation, not a technical exploit.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.impact" ], "cves": [], "id": "da3a0103-12b0-4fc9-a240-36607315251a", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-immigration-visa-work-fraud.md" }, { "slug": "atr-in-the-wild-jailbreak-corpus-signature-patterns", "title": "In-the-Wild Jailbreak Corpus Signature Patterns", "url": "https://www.netzilo.com/threats/atr-in-the-wild-jailbreak-corpus-signature-patterns", "severity": "high", "summary": "This rule spots prompts pulled from a large real-world collection of jailbreak attempts against AI chatbots. Attackers use these prompts to make an AI adopt a fake persona \u2014 like an 'amoral AI' or a named character such as AIM \u2014 that supposedly has no restrictions, so it will answer requests the AI would normally refuse.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "468ac2c8-5b25-4f38-bb7e-3bfe84239235", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-in-the-wild-jailbreak-corpus-signature-patterns.md" }, { "slug": "atr-indirect-authority-claim-in-external-content", "title": "Indirect Authority Claim in External Content", "url": "https://www.netzilo.com/threats/atr-indirect-authority-claim-in-external-content", "severity": "high", "summary": "Attackers plant text inside documents, web pages, or tool outputs that speaks directly to an AI agent, pretending to be an authoritative correction. Instead of commanding the AI outright, it politely claims something like 'the previous analysis was incorrect' to get the agent to change its behavior or output.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "a186c61c-35b3-4467-b502-6809aad9a4ae", "published": "2026-04-01", "modified": "2026-04-01", "markdown": "https://www.netzilo.com/threats/atr-indirect-authority-claim-in-external-content.md" }, { "slug": "atr-indirect-pi-account-manipulation-emergency-service-dispatch", "title": "Indirect PI \u2014 Account Manipulation / Emergency Service Dispatch via Pretext", "url": "https://www.netzilo.com/threats/atr-indirect-pi-account-manipulation-emergency-service-dispatch", "severity": "critical", "summary": "Attackers hide instructions inside data an AI agent reads \u2014 like a document, webpage, or API response \u2014 that fabricate an emergency (a fire, a break-in, a threat) to pressure the agent into taking urgent action. If the agent has tools for emergency dispatch or account management, it may act on the fake pretext without verifying it's real.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "f0965d09-4d85-4aab-b77c-84bfc6dba792", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-indirect-pi-account-manipulation-emergency-service-dispatch.md" }, { "slug": "atr-indirect-pi-browsing-history-search-history-exfiltration-via", "title": "Indirect PI \u2014 Browsing History / Search History Exfiltration via Agent Email", "url": "https://www.netzilo.com/threats/atr-indirect-pi-browsing-history-search-history-exfiltration-via", "severity": "high", "summary": "An attacker hides instructions inside content an AI agent reads \u2014 like a webpage or document \u2014 telling it to grab the user's search or browsing history and email it out. This is a form of indirect prompt injection, where the malicious instructions come from data the agent processes, not from the user.", "atlas": [ { "id": "AML.T0051.001", "name": "Indirect" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "a3911eed-9c8e-4f19-a4d6-5e7ecb384177", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-indirect-pi-browsing-history-search-history-exfiltration-via.md" }, { "slug": "atr-indirect-pi-cloud-file-exfiltration-google-drive-cloud-stora", "title": "Indirect PI \u2014 Cloud File Exfiltration (Google Drive / Cloud Storage via Agent)", "url": "https://www.netzilo.com/threats/atr-indirect-pi-cloud-file-exfiltration-google-drive-cloud-stora", "severity": "critical", "summary": "An AI agent that can browse the web or access files reads a page or document containing hidden instructions. Those instructions tell the agent to fetch sensitive files from the user's Google Drive, Dropbox, or OneDrive and send them to an outside destination, either by uploading them to an attacker's site or attaching them to an email.", "atlas": [ { "id": "AML.T0051.001", "name": "Indirect" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "0f9b929e-4a0c-4ff4-9cc8-be33f76f35bd", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-indirect-pi-cloud-file-exfiltration-google-drive-cloud-stora.md" }, { "slug": "atr-indirect-pi-credential-api-key-exfiltration-via-agent-action", "title": "Indirect PI \u2014 Credential / API Key Exfiltration via Agent Action", "url": "https://www.netzilo.com/threats/atr-indirect-pi-credential-api-key-exfiltration-via-agent-action", "severity": "critical", "summary": "An AI agent that reads emails, documents, or web pages can be manipulated by hidden text embedded in that content. The hidden text tells the agent to find stored passwords or API keys and send them somewhere the attacker controls, all while the agent appears to be doing its normal job.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "650e8fa5-201c-445d-b6ea-a84bab25981b", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-indirect-pi-credential-api-key-exfiltration-via-agent-action.md" }, { "slug": "atr-indirect-pi-credential-exfiltration-via-email-api-key-passwo", "title": "Indirect PI \u2014 Credential Exfiltration via Email (API Key / Password / Token)", "url": "https://www.netzilo.com/threats/atr-indirect-pi-credential-exfiltration-via-email-api-key-passwo", "severity": "critical", "summary": "An AI agent that browses the web or reads documents can be fooled by hidden instructions planted in content it processes \u2014 a product review, a note, a file description. Those instructions tell the agent to find a stored credential and email it to an address the attacker controls.", "atlas": [ { "id": "AML.T0051.001", "name": "Indirect" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "4a3dfe68-b235-4385-9b20-2d4efee5a52c", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-indirect-pi-credential-exfiltration-via-email-api-key-passwo.md" }, { "slug": "atr-indirect-pi-cryptocurrency-transfer-exchange-deposit-hijack", "title": "Indirect PI \u2014 Cryptocurrency Transfer / Exchange Deposit Hijack via Injection", "url": "https://www.netzilo.com/threats/atr-indirect-pi-cryptocurrency-transfer-exchange-deposit-hijack", "severity": "critical", "summary": "An AI agent that can access cryptocurrency exchange APIs is fed hidden instructions buried in content it processes, telling it to deposit or withdraw funds to an attacker's account. Because crypto transfers can't be reversed, a successful attack means the money is gone for good.", "atlas": [ { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.exfiltration", "attack.t1657" ], "cves": [], "id": "f41b7c7b-8626-4eaa-8745-329c924ea982", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-indirect-pi-cryptocurrency-transfer-exchange-deposit-hijack.md" }, { "slug": "atr-indirect-pi-data-destruction-instruction-via-agent-file-docu", "title": "Indirect PI \u2014 Data Destruction Instruction via Agent File/Document Tool", "url": "https://www.netzilo.com/threats/atr-indirect-pi-data-destruction-instruction-via-agent-file-docu", "severity": "high", "summary": "An AI agent that reads external documents or files can be tricked into deleting data it wasn't supposed to touch. The malicious instruction isn't typed by a user \u2014 it's hidden inside a file, webpage, or record the agent processes as part of its normal job.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "2b8807e7-fdb8-43d1-a497-99509961a623", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-indirect-pi-data-destruction-instruction-via-agent-file-docu.md" }, { "slug": "atr-indirect-pi-data-exfiltration-with-evidence-destruction-exfi", "title": "Indirect PI \u2014 Data Exfiltration with Evidence Destruction (Exfil-and-Delete)", "url": "https://www.netzilo.com/threats/atr-indirect-pi-data-exfiltration-with-evidence-destruction-exfi", "severity": "critical", "summary": "This detects a prompt injection attack that hides instructions inside content an AI agent reads, such as a document or email. The hidden instructions tell the agent to grab sensitive data, send it somewhere, and then delete the original file or sent message so no one notices.", "atlas": [ { "id": "AML.T0051.001", "name": "Indirect" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "ASI09", "name": "Traceability and Accountability Gaps" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration", "attack.t1070.004", "attack.t1485" ], "cves": [], "id": "3aaa0f08-e614-4c6a-9e2a-6773a99cb470", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-indirect-pi-data-exfiltration-with-evidence-destruction-exfi.md" }, { "slug": "atr-indirect-pi-disable-authentication-mfa-via-agent-tool", "title": "Indirect PI \u2014 Disable Authentication / MFA via Agent Tool", "url": "https://www.netzilo.com/threats/atr-indirect-pi-disable-authentication-mfa-via-agent-tool", "severity": "critical", "summary": "An AI agent that reads external data\u2014documents, emails, web pages, tickets\u2014can be manipulated by hidden text embedded in that data. The hidden text tells the agent to disable two-factor authentication or other account security settings, and if the agent has account management tools, it may just do it.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "42aca471-026b-4f47-bfc7-cf67697f93b7", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-indirect-pi-disable-authentication-mfa-via-agent-tool.md" }, { "slug": "atr-indirect-pi-file-exfiltration-combined-with-destroy-or-tampe", "title": "Indirect PI \u2014 File Exfiltration Combined with Destroy or Tamper", "url": "https://www.netzilo.com/threats/atr-indirect-pi-file-exfiltration-combined-with-destroy-or-tampe", "severity": "critical", "summary": "An AI agent that reads external content (documents, emails, web pages) can be manipulated by hidden instructions embedded in that content. This attack pattern goes further than simple data theft: it makes the agent copy sensitive files like API keys or banking details, then destroy or edit the originals so the theft goes unnoticed.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "79677264-4c33-4e08-ac2c-7b9a2489d008", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-indirect-pi-file-exfiltration-combined-with-destroy-or-tampe.md" }, { "slug": "atr-indirect-pi-financial-data-exfiltration-via-agent-action", "title": "Indirect PI \u2014 Financial Data Exfiltration via Agent Action", "url": "https://www.netzilo.com/threats/atr-indirect-pi-financial-data-exfiltration-via-agent-action", "severity": "critical", "summary": "An AI agent that reads external content, like a document, email, or web page, can be manipulated by hidden text inside that content. The hidden text tells the agent to pull up payment methods, bank details, or financial reports and send them somewhere the attacker controls.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "5f47b866-f766-42fe-ad69-7a429e144cab", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-indirect-pi-financial-data-exfiltration-via-agent-action.md" }, { "slug": "atr-indirect-pi-financial-payment-credential-exfiltration-via-ag", "title": "Indirect PI \u2014 Financial / Payment Credential Exfiltration via Agent Email", "url": "https://www.netzilo.com/threats/atr-indirect-pi-financial-payment-credential-exfiltration-via-ag", "severity": "critical", "summary": "Attackers hide instructions inside content an AI agent reads later, like a product review or a repository description. Those instructions tell the agent to pull up saved payment methods or bank details and send them to an email address the attacker controls.", "atlas": [ { "id": "AML.T0051.001", "name": "Indirect" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "4b1023f0-92f9-4a68-8ebe-7a4c7ab27a28", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-indirect-pi-financial-payment-credential-exfiltration-via-ag.md" }, { "slug": "atr-indirect-pi-genetic-dna-data-exfiltration-via-agent-email", "title": "Indirect PI \u2014 Genetic / DNA Data Exfiltration via Agent Email", "url": "https://www.netzilo.com/threats/atr-indirect-pi-genetic-dna-data-exfiltration-via-agent-email", "severity": "critical", "summary": "An AI agent that can read documents and send email can be hijacked by hidden text embedded in content it processes. That text tells the agent to ignore its real instructions, fetch a person's genetic test results, and email them to an address the attacker controls.", "atlas": [ { "id": "AML.T0051.001", "name": "Indirect" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "9dd2ccae-b8f8-44c0-a53e-736be3293538", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-indirect-pi-genetic-dna-data-exfiltration-via-agent-email.md" }, { "slug": "atr-indirect-pi-location-address-and-browsing-history-exfiltrati", "title": "Indirect PI \u2014 Location, Address, and Browsing History Exfiltration", "url": "https://www.netzilo.com/threats/atr-indirect-pi-location-address-and-browsing-history-exfiltrati", "severity": "high", "summary": "Attackers hide commands inside content that an AI agent reads \u2014 like a webpage, document, or email \u2014 telling it to secretly send out the user's current location, saved home/work addresses, or Google search history. If the agent has access to maps, contact, or browser tools, it may follow these hidden instructions without the user knowing.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "7cbaf337-afda-4593-918a-3ed745713385", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-indirect-pi-location-address-and-browsing-history-exfiltrati.md" }, { "slug": "atr-indirect-pi-location-gps-data-exfiltration-via-agent-email", "title": "Indirect PI \u2014 Location / GPS Data Exfiltration via Agent Email", "url": "https://www.netzilo.com/threats/atr-indirect-pi-location-gps-data-exfiltration-via-agent-email", "severity": "critical", "summary": "This detects attempts to hijack an AI agent through hidden instructions embedded in content it processes, forcing it to pull the user's GPS or location data and send it to an outside email address. If successful, this lets an attacker track someone's physical whereabouts for stalking or targeted attacks.", "atlas": [ { "id": "AML.T0051.001", "name": "Indirect" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "543588ac-d86e-4bdb-914c-78e57d9e641e", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-indirect-pi-location-gps-data-exfiltration-via-agent-email.md" }, { "slug": "atr-indirect-pi-malicious-package-installation-via-agent-pip-npm", "title": "Indirect PI \u2014 Malicious Package Installation via Agent (pip/npm)", "url": "https://www.netzilo.com/threats/atr-indirect-pi-malicious-package-installation-via-agent-pip-npm", "severity": "critical", "summary": "An AI assistant that can read emails or documents and run commands can be manipulated by hidden instructions in that content. The attacker plants a message telling the agent to install a malicious pip or npm package, and the agent \u2014 trusting the text it read as if it were a legitimate task \u2014 executes the install.", "atlas": [ { "id": "AML.T0011.001", "name": "Malicious Package" }, { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "cbee735b-3250-4dfa-ae39-d466bb24f524", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-indirect-pi-malicious-package-installation-via-agent-pip-npm.md" }, { "slug": "atr-indirect-pi-medical-genetic-data-exfiltration-via-agent-acti", "title": "Indirect PI \u2014 Medical / Genetic Data Exfiltration via Agent Action", "url": "https://www.netzilo.com/threats/atr-indirect-pi-medical-genetic-data-exfiltration-via-agent-acti", "severity": "critical", "summary": "Attackers hide commands inside ordinary-looking content \u2014 a product review, a note, a profile field \u2014 that an AI agent reads while doing some unrelated task. Those hidden commands tell the agent to find and send out health records, genetic test results, lab reports, or diagnostic files.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "6d6ee7b1-603f-48bb-9d27-693f1d5f0bde", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-indirect-pi-medical-genetic-data-exfiltration-via-agent-acti.md" }, { "slug": "atr-indirect-pi-medical-record-health-data-exfiltration-via-agen", "title": "Indirect PI \u2014 Medical Record / Health Data Exfiltration via Agent Email", "url": "https://www.netzilo.com/threats/atr-indirect-pi-medical-record-health-data-exfiltration-via-agen", "severity": "critical", "summary": "An AI agent that can read outside content (like reviews or notes) and also send email can be hijacked by hidden instructions planted in that content. The hidden text tells the agent to pull up a patient's medical file and email it to an address the attacker controls.", "atlas": [ { "id": "AML.T0051.001", "name": "Indirect" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "e3d70822-600c-4eed-ad55-13a71b6f7873", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-indirect-pi-medical-record-health-data-exfiltration-via-agen.md" }, { "slug": "atr-indirect-pi-mfa-code-otp-security-code-exfiltration-via-inje", "title": "Indirect PI \u2014 MFA Code / OTP Security Code Exfiltration via Injection", "url": "https://www.netzilo.com/threats/atr-indirect-pi-mfa-code-otp-security-code-exfiltration-via-inje", "severity": "critical", "summary": "This rule flags content that tries to hijack an AI agent's access to a user's email or SMS to steal one-time passcodes (OTP/MFA codes) in real time. The injected text overrides the agent's instructions and tells it to find a verification code and send it to an attacker's address, enabling account takeover before the code expires.", "atlas": [ { "id": "AML.T0051.001", "name": "Indirect" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration", "attack.t1111" ], "cves": [], "id": "f9317ceb-f561-46a4-a0e6-63f9e4b53c04", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-indirect-pi-mfa-code-otp-security-code-exfiltration-via-inje.md" }, { "slug": "atr-indirect-pi-physical-address-pii-exfiltration-via-agent-emai", "title": "Indirect PI \u2014 Physical Address / PII Exfiltration via Agent Email", "url": "https://www.netzilo.com/threats/atr-indirect-pi-physical-address-pii-exfiltration-via-agent-emai", "severity": "high", "summary": "This detects a prompt injection attack where text hidden in a document, webpage, or email tricks an AI agent into pulling a user's saved home, shipping, or billing address and emailing it to an attacker. It targets AI agents connected to e-commerce or account platforms that store physical addresses.", "atlas": [ { "id": "AML.T0051.001", "name": "Indirect" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "69a6c7a5-f888-40b7-a4ac-34fb1e60a0d7", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-indirect-pi-physical-address-pii-exfiltration-via-agent-emai.md" }, { "slug": "atr-indirect-pi-physical-biometric-media-exfiltration-via-agent", "title": "Indirect PI \u2014 Physical / Biometric Media Exfiltration via Agent", "url": "https://www.netzilo.com/threats/atr-indirect-pi-physical-biometric-media-exfiltration-via-agent", "severity": "critical", "summary": "Attackers hide commands inside content an AI agent reads \u2014 like a document or webpage \u2014 telling it to grab voice recordings or ID scans and generate deepfake audio or send the data out. The agent follows these hidden instructions instead of just doing what its actual user asked.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.001", "name": "Indirect" }, { "id": "AML.T0088", "name": "Generate Deepfakes" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "fe8c639f-435f-4b1b-a07a-1292c75dbf4d", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-indirect-pi-physical-biometric-media-exfiltration-via-agent.md" }, { "slug": "atr-indirect-pi-rce-via-network-shell-command-netcat-curl-execut", "title": "Indirect PI \u2014 RCE via Network Shell Command (netcat/curl) Execution", "url": "https://www.netzilo.com/threats/atr-indirect-pi-rce-via-network-shell-command-netcat-curl-execut", "severity": "critical", "summary": "An attacker hides instructions inside an email or document that an AI agent reads as part of its normal work. If the agent has permission to run shell commands, those hidden instructions can make it open a network connection to an attacker's server or download and run attacker code.", "atlas": [ { "id": "AML.T0050", "name": "Command and Scripting Interpreter" }, { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "fd51418e-f873-445c-a78b-c2a27861f297", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-indirect-pi-rce-via-network-shell-command-netcat-curl-execut.md" }, { "slug": "atr-indirect-pi-structured-data-embedded-payload-important-overr", "title": "Indirect PI \u2014 Structured-Data Embedded Payload (IMPORTANT!!! Override)", "url": "https://www.netzilo.com/threats/atr-indirect-pi-structured-data-embedded-payload-important-overr", "severity": "critical", "summary": "Attackers plant hidden instructions inside ordinary-looking data \u2014 a product review, a note, a user profile, a repository file \u2014 that an AI agent later reads. The hidden text tries to override the agent's real instructions and make it take an action the attacker wants instead.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "f4b571d4-8c43-40fd-9d72-7d1bbc55c023", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-indirect-pi-structured-data-embedded-payload-important-overr.md" }, { "slug": "atr-indirect-pi-sysprompt-forged-action-hijack-system-message-fr", "title": "Indirect PI Sysprompt-Forged Action Hijack (system_message framing)", "url": "https://www.netzilo.com/threats/atr-indirect-pi-sysprompt-forged-action-hijack-system-message-fr", "severity": "critical", "summary": "Attackers plant text that looks like an official system instruction \u2014 using a Markdown heading and a '(system_message)' tag \u2014 inside content an AI agent reads, such as a document, email, or webpage. The agent mistakes this forged label for a real command from its operator and carries out the instruction.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "afeb71b9-d122-418d-bfcf-754e08e81ceb", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-indirect-pi-sysprompt-forged-action-hijack-system-message-fr.md" }, { "slug": "atr-indirect-pi-system-sabotage-via-destructive-shell-command", "title": "Indirect PI \u2014 System Sabotage via Destructive Shell Command", "url": "https://www.netzilo.com/threats/atr-indirect-pi-system-sabotage-via-destructive-shell-command", "severity": "critical", "summary": "An AI agent that browses the web or opens downloaded files can be manipulated by hidden instructions embedded in that content. This rule flags cases where those hidden instructions try to get the agent to run destructive shell commands, like disabling a firewall or deleting system files.", "atlas": [ { "id": "AML.T0050", "name": "Command and Scripting Interpreter" }, { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "91b87b4e-84c0-4319-9555-10d5ee35374e", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-indirect-pi-system-sabotage-via-destructive-shell-command.md" }, { "slug": "atr-indirect-pi-unauthorized-financial-transfer-payment-initiati", "title": "Indirect PI \u2014 Unauthorized Financial Transfer / Payment Initiation Hijack", "url": "https://www.netzilo.com/threats/atr-indirect-pi-unauthorized-financial-transfer-payment-initiati", "severity": "critical", "summary": "This detects a prompt injection attack where instructions hidden in content an AI agent reads \u2014 like a document, email, or webpage \u2014 try to trick it into initiating a real financial transfer. The injected text typically overrides the agent's original task and supplies its own bank account number, payee ID, and payment amount.", "atlas": [ { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.exfiltration", "attack.t1657" ], "cves": [], "id": "f9ae282d-1aa8-44cc-bb36-763fd82e30da", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-indirect-pi-unauthorized-financial-transfer-payment-initiati.md" }, { "slug": "atr-indirect-pi-unauthorized-financial-transfer-via-agent-tool", "title": "Indirect PI \u2014 Unauthorized Financial Transfer via Agent Tool", "url": "https://www.netzilo.com/threats/atr-indirect-pi-unauthorized-financial-transfer-via-agent-tool", "severity": "critical", "summary": "AI agents that can read text from outside sources \u2014 product reviews, notes, repo descriptions, user bios \u2014 can be manipulated by hidden instructions planted in that text. If the agent also has access to payment or banking tools, an attacker can use this trick to make it move money or crypto to an account they control, without the real user ever asking for it.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "698563bf-f79e-4c87-a102-02e90d97290a", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-indirect-pi-unauthorized-financial-transfer-via-agent-tool.md" }, { "slug": "atr-indirect-pi-unauthorized-physical-access-grant-via-smart-loc", "title": "Indirect PI \u2014 Unauthorized Physical Access Grant via Smart Lock / Home Automation", "url": "https://www.netzilo.com/threats/atr-indirect-pi-unauthorized-physical-access-grant-via-smart-loc", "severity": "critical", "summary": "An AI agent that manages smart locks or home automation can be manipulated by hidden text embedded in content it processes, causing it to grant physical access to unauthorized people. This is an indirect prompt injection: the attacker never talks to the agent directly, they plant instructions in something the agent reads.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "1ac3af4e-60de-4def-a018-c2df0ae26f45", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-indirect-pi-unauthorized-physical-access-grant-via-smart-loc.md" }, { "slug": "atr-indirect-pi-xss-payload-injection-in-agent-consumed-content", "title": "Indirect PI \u2014 XSS Payload Injection in Agent-Consumed Content", "url": "https://www.netzilo.com/threats/atr-indirect-pi-xss-payload-injection-in-agent-consumed-content", "severity": "high", "summary": "An attacker plants text inside a webpage, document, or tool output that an AI agent is expected to read and summarize. That hidden text tells the agent to stop summarizing and instead reproduce an XSS payload, like an image tag with a malicious onerror handler, in its response.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "8a8f9e5d-79f9-46d7-bc2f-d42afeacc4f3", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-indirect-pi-xss-payload-injection-in-agent-consumed-content.md" }, { "slug": "atr-indirect-prompt-injection-captcha-redirect-task-disruption", "title": "Indirect Prompt Injection: CAPTCHA Redirect Task Disruption", "url": "https://www.netzilo.com/threats/atr-indirect-prompt-injection-captcha-redirect-task-disruption", "severity": "high", "summary": "An AI agent that reads web pages or documents as part of its job can be derailed by hidden text embedded in that content. The hidden instruction tells the agent to go solve a CAPTCHA or visit an outside link before continuing, which either stops the agent's real task cold or gets it to send data to an attacker-controlled URL.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution" ], "cves": [], "id": "35bb9592-c6c8-4268-9657-43b1f3e94729", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-indirect-prompt-injection-captcha-redirect-task-disruption.md" }, { "slug": "atr-indirect-prompt-injection-fake-authority-task-abort", "title": "Indirect Prompt Injection: Fake-Authority Task Abort", "url": "https://www.netzilo.com/threats/atr-indirect-prompt-injection-fake-authority-task-abort", "severity": "high", "summary": "Attackers hide a fake authority message inside content an AI agent reads, telling it to stop what it's doing and reply with something useless instead. This is a denial-of-service attack against the agent's usefulness, not a data theft or malware attack.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution" ], "cves": [], "id": "a09df58b-9975-4c09-9fa3-ae0c9d62fbc3", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-indirect-prompt-injection-fake-authority-task-abort.md" }, { "slug": "atr-indirect-prompt-injection-via-data-carrier-important-overrid", "title": "Indirect Prompt Injection via Data Carrier \u2014 IMPORTANT Override", "url": "https://www.netzilo.com/threats/atr-indirect-prompt-injection-via-data-carrier-important-overrid", "severity": "critical", "summary": "Attackers plant text that looks like an urgent system command inside ordinary content \u2014 a product description, email, calendar invite, or GitHub repo bio \u2014 hoping an AI agent that reads this data will treat it as a real instruction and obey it instead of its actual task. This is indirect prompt injection: the attacker never talks to the agent directly, they poison something the agent will read.", "atlas": [ { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "52e77657-9546-4266-b416-8bf50fcdd893", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-indirect-prompt-injection-via-data-carrier-important-overrid.md" }, { "slug": "atr-indirect-prompt-injection-via-external-content", "title": "Indirect Prompt Injection via External Content", "url": "https://www.netzilo.com/threats/atr-indirect-prompt-injection-via-external-content", "severity": "high", "summary": "AI agents that read web pages, documents, or other outside content can be tricked by instructions hidden inside that content. Because the agent can't tell the difference between what its owner asked and what a webpage secretly tells it, an attacker who controls a page or file the agent reads can quietly redirect its behavior.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [ "CVE-2024-22524", "CVE-2024-5184", "CVE-2025-32711", "CVE-2026-24307" ], "id": "de37cf27-38bb-4d35-9789-9599c4c267ef", "published": "2026-03-08", "modified": "2026-03-08", "markdown": "https://www.netzilo.com/threats/atr-indirect-prompt-injection-via-external-content.md" }, { "slug": "atr-indirect-prompt-injection-via-tool-api-response-attacker-ins", "title": "Indirect Prompt Injection via Tool / API Response \u2014 Attacker Instruction Embedded in Returned Tool Output (InjecAgent Th", "url": "https://www.netzilo.com/threats/atr-indirect-prompt-injection-via-tool-api-response-attacker-ins", "severity": "high", "summary": "AI agents that call tools or APIs (search, email, databases) trust the data those tools return. This detection catches attackers who plant a command inside that returned data \u2014 disguised as part of a normal result \u2014 to trick the agent into taking a harmful action it wasn't asked to do.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "47aafb03-5719-4474-a6d3-63a6060ac7ae", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-indirect-prompt-injection-via-tool-api-response-attacker-ins.md" }, { "slug": "atr-indirect-prompt-injection-via-tool-responses", "title": "Indirect Prompt Injection via Tool Responses", "url": "https://www.netzilo.com/threats/atr-indirect-prompt-injection-via-tool-responses", "severity": "high", "summary": "Attackers plant hidden commands inside content an AI agent will later fetch and process, such as a web page, API reply, or document. When the agent reads that content as part of its normal work, it may follow the hidden instructions instead of its actual task.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "9ebc8540-8552-453a-a0d7-f5c89454a689", "published": "2026-03-11", "modified": "2026-03-11", "markdown": "https://www.netzilo.com/threats/atr-indirect-prompt-injection-via-tool-responses.md" }, { "slug": "atr-indirect-reference-instruction-reversal", "title": "Indirect Reference Instruction Reversal", "url": "https://www.netzilo.com/threats/atr-indirect-reference-instruction-reversal", "severity": "high", "summary": "This detects a two-step manipulation where someone asks an AI agent to disclose the instructions or rules it was given, then follows up by asking it to do the opposite of those instructions. The goal is to bypass restrictions the agent was designed to follow.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "31cedb3a-c7e2-4446-8634-001298058640", "published": "2026-04-07", "modified": "2026-04-07", "markdown": "https://www.netzilo.com/threats/atr-indirect-reference-instruction-reversal.md" }, { "slug": "atr-injected-advertising-promotional-copy-in-the-response", "title": "Injected Advertising / Promotional Copy in the Response", "url": "https://www.netzilo.com/threats/atr-injected-advertising-promotional-copy-in-the-response", "severity": "medium", "summary": "An attacker hides instructions inside content an AI agent reads \u2014 a webpage, document, or email \u2014 telling it to slip advertising, discount codes, or brand promotion into its response to the user. This turns a trusted assistant into an unwitting ad channel or scam vector.", "atlas": [ { "id": "AML.T0048", "name": "External Harms" }, { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "a4edb0c9-90ae-4198-b9fd-ccbacf305b15", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-injected-advertising-promotional-copy-in-the-response.md" }, { "slug": "atr-injected-code-browser-cookie-session-token-theft", "title": "Injected Code \u2014 Browser Cookie / Session-Token Theft", "url": "https://www.netzilo.com/threats/atr-injected-code-browser-cookie-session-token-theft", "severity": "high", "summary": "This rule flags cases where an AI agent is manipulated into loading a saved cookie file and attaching it to an outbound web request. That lets an attacker hijack a victim's logged-in session without needing their password.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "0f4e6533-1f73-4b01-856b-2bc52c74bdde", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-injected-code-browser-cookie-session-token-theft.md" }, { "slug": "atr-injected-code-contact-list-harvest-and-smtp-spam-exfiltratio", "title": "Injected Code \u2014 Contact-List Harvest and SMTP Spam Exfiltration", "url": "https://www.netzilo.com/threats/atr-injected-code-contact-list-harvest-and-smtp-spam-exfiltratio", "severity": "high", "summary": "An AI agent can be manipulated into reading a local file of contacts and sending them all an email pulled from a remote source. This spreads spam or malicious content to everyone in the list and leaks the list itself to whoever controls the remote content.", "atlas": [ { "id": "AML.T0048", "name": "External Harms" }, { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "702eec32-730d-4dfa-9889-045ac3a8e20b", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-injected-code-contact-list-harvest-and-smtp-spam-exfiltratio.md" }, { "slug": "atr-injected-code-environment-variable-exfiltration", "title": "Injected Code \u2014 Environment-Variable Exfiltration", "url": "https://www.netzilo.com/threats/atr-injected-code-environment-variable-exfiltration", "severity": "high", "summary": "An attacker hides instructions inside content an AI agent processes, causing the agent to write or run code that reads sensitive environment variables (like API keys and tokens) and sends them to an outside server. This is a way to steal credentials by abusing an AI agent's ability to execute code.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "477456f7-13e7-40da-9744-eb1289135f5c", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-injected-code-environment-variable-exfiltration.md" }, { "slug": "atr-injected-code-host-hardware-inventory-exfiltration", "title": "Injected Code \u2014 Host / Hardware Inventory Exfiltration", "url": "https://www.netzilo.com/threats/atr-injected-code-host-hardware-inventory-exfiltration", "severity": "high", "summary": "This detects a pattern where code injected into an AI agent's output gathers detailed information about the host machine \u2014 installed software, memory, USB devices, disks, network cards, sound hardware \u2014 and transmits it off the machine via HTTP or MQTT. This is reconnaissance, not the compromise itself, but it usually precedes a more targeted attack.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "45f5bcbd-4e1c-4375-a359-18c4e80d3ea4", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-injected-code-host-hardware-inventory-exfiltration.md" }, { "slug": "atr-injected-code-live-user-activity-location-log-surveillance-e", "title": "Injected Code \u2014 Live User-Activity / Location / Log Surveillance Exfiltration", "url": "https://www.netzilo.com/threats/atr-injected-code-live-user-activity-location-log-surveillance-e", "severity": "high", "summary": "An attacker hides instructions inside content an AI agent processes, tricking it into writing and running code that continuously spies on the user. This code reads clipboard contents, tracks device location, or scans system logs, then sends what it finds to the attacker.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "005f8d2c-33a7-4b37-94c3-2a4a446e63a7", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-injected-code-live-user-activity-location-log-surveillance-e.md" }, { "slug": "atr-injected-code-local-file-exfiltration-to-a-remote-endpoint", "title": "Injected Code \u2014 Local File Exfiltration to a Remote Endpoint", "url": "https://www.netzilo.com/threats/atr-injected-code-local-file-exfiltration-to-a-remote-endpoint", "severity": "high", "summary": "An attacker hides instructions inside content an AI agent processes \u2014 a webpage, document, or email \u2014 telling it to write code that reads a local file and sends it out over the network. If the agent complies and runs or outputs that code, sensitive files can leave the environment without the user asking for it.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "fafeb811-3f32-4b58-8855-034368d5bdaa", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-injected-code-local-file-exfiltration-to-a-remote-endpoint.md" }, { "slug": "atr-injected-code-local-host-sabotage-filesystem-destruction-res", "title": "Injected Code \u2014 Local Host Sabotage (Filesystem Destruction / Resource Exhaustion / Hosts Tamper)", "url": "https://www.netzilo.com/threats/atr-injected-code-local-host-sabotage-filesystem-destruction-res", "severity": "critical", "summary": "An attacker hides malicious instructions in content an AI agent processes, causing it to generate or execute code that destroys the local system: wiping the filesystem, exhausting memory or CPU, or hijacking DNS by editing the hosts file. This is a prompt injection attack where the payload is local sabotage rather than data theft.", "atlas": [ { "id": "AML.T0048", "name": "External Harms" }, { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.impact" ], "cves": [], "id": "8b60229a-8027-459c-bd51-e0eef561bd6c", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-injected-code-local-host-sabotage-filesystem-destruction-res.md" }, { "slug": "atr-injected-code-network-denial-of-service-connection-kill-adap", "title": "Injected Code \u2014 Network Denial of Service (Connection Kill / Adapter Disable / Flood)", "url": "https://www.netzilo.com/threats/atr-injected-code-network-denial-of-service-connection-kill-adap", "severity": "high", "summary": "An AI agent that can write and execute code can be manipulated, through injected instructions, into writing code that knocks a machine or network off the internet. This includes killing all network connections, disabling network adapters, or flooding a target with traffic.", "atlas": [ { "id": "AML.T0048", "name": "External Harms" }, { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.impact" ], "cves": [], "id": "de070aac-bc4d-471f-aab7-5f47d0bcd94c", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-injected-code-network-denial-of-service-connection-kill-adap.md" }, { "slug": "atr-injected-code-remote-key-ransomware-file-encryption", "title": "Injected Code \u2014 Remote-Key Ransomware File Encryption", "url": "https://www.netzilo.com/threats/atr-injected-code-remote-key-ransomware-file-encryption", "severity": "critical", "summary": "An AI coding or automation agent is manipulated into running code that downloads an encryption key from an external server and then encrypts a file on the victim's system in place. This is the core mechanical pattern of ransomware, regardless of how the instruction reached the agent.", "atlas": [ { "id": "AML.T0048", "name": "External Harms" }, { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.impact" ], "cves": [], "id": "24cf0fe6-7981-4b67-8147-9f956cd2b131", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-injected-code-remote-key-ransomware-file-encryption.md" }, { "slug": "atr-injected-code-unauthorized-remote-access-ssh-key-backdoor-tu", "title": "Injected Code \u2014 Unauthorized Remote Access (SSH Key Backdoor / Tunnel / Port Forward)", "url": "https://www.netzilo.com/threats/atr-injected-code-unauthorized-remote-access-ssh-key-backdoor-tu", "severity": "critical", "summary": "An AI coding or automation agent can be manipulated through injected instructions (prompt injection) into writing and running code that gives an attacker persistent remote access. This includes adding an attacker's SSH key to a server, opening a hidden SSH tunnel, or building a port-forwarding bridge to an outside host.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.privilege-escalation" ], "cves": [], "id": "b0e08c04-3469-499f-950b-78800b1f350d", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-injected-code-unauthorized-remote-access-ssh-key-backdoor-tu.md" }, { "slug": "atr-injected-hyperlink-scam-malware-advertising-url-in-the-respo", "title": "Injected Hyperlink \u2014 Scam / Malware / Advertising URL in the Response", "url": "https://www.netzilo.com/threats/atr-injected-hyperlink-scam-malware-advertising-url-in-the-respo", "severity": "high", "summary": "Attackers hide instructions inside content an AI agent reads \u2014 a webpage, document, or email \u2014 telling it to add a link or contact address to whatever it outputs next. If the agent obeys, it ends up handing the user a phishing link, fake software download, or lottery scam contact as if it were part of a normal answer.", "atlas": [ { "id": "AML.T0048", "name": "External Harms" }, { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "8f80d5e9-9a58-4222-b644-b57dace7ea02", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-injected-hyperlink-scam-malware-advertising-url-in-the-respo.md" }, { "slug": "atr-insecure-inter-agent-communication-detection", "title": "Insecure Inter-Agent Communication Detection", "url": "https://www.netzilo.com/threats/atr-insecure-inter-agent-communication-detection", "severity": "high", "summary": "In systems where multiple AI agents talk to each other, messages should be authenticated and checked so one agent can't be tricked into obeying a forged or replayed instruction from another. This detection flags cases where that structural integrity is missing \u2014 messages without authentication tokens, tampered routing information, replayed timestamps, or commands sent over channels with no authentication at all.", "atlas": [ { "id": "AML.T0043", "name": "Craft Adversarial Data" }, { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" }, { "id": "LLM05", "name": "Improper Output Handling" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution" ], "cves": [], "id": "f96bb8b5-0e46-40dd-b371-8537a675031c", "published": "2026-03-09", "modified": "2026-03-09", "markdown": "https://www.netzilo.com/threats/atr-insecure-inter-agent-communication-detection.md" }, { "slug": "atr-insider-manipulation-process-corruption-market-data-tamperin", "title": "Insider Manipulation & Process Corruption \u2014 Market/Data Tampering, Legal-Process Subversion & Pretextual Fund Movement (", "url": "https://www.netzilo.com/threats/atr-insider-manipulation-process-corruption-market-data-tamperin", "severity": "high", "summary": "This detector flags requests that ask an AI agent with access to trading, legal, or financial tools to manipulate an important process \u2014 like market data, a court case, or a fund transfer \u2014 while dressing the request up as harmless testing or exploration. The wording sounds innocent ('let's test market response', 'just exploring legal options') but the actual ask is for the agent to do something that corrupts a trusted process for someone's benefit.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM06", "name": "Excessive Agency" }, { "id": "LLM08", "name": "Vector and Embedding Weaknesses" } ], "attack": [ "attack.execution" ], "cves": [], "id": "75f3511b-0cbe-4bf7-a1a6-f39419bb9ab9", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-insider-manipulation-process-corruption-market-data-tamperin.md" }, { "slug": "atr-instruction-injection-via-tool-output", "title": "Instruction Injection via Tool Output", "url": "https://www.netzilo.com/threats/atr-instruction-injection-via-tool-output", "severity": "high", "summary": "When an AI agent calls a tool (a search API, a document reader, a database, etc.), the data that comes back is supposed to be inert information. This rule flags cases where that returned data actually contains commands aimed at the agent itself, trying to make it act on instructions the tool result should never have been allowed to give.", "atlas": [ { "id": "AML.T0051.001", "name": "Indirect" }, { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.execution" ], "cves": [ "CVE-2025-32711", "CVE-2025-59536" ], "id": "9119260b-d194-4117-9a41-7279dc8b6637", "published": "2026-03-08", "modified": "2026-03-08", "markdown": "https://www.netzilo.com/threats/atr-instruction-injection-via-tool-output.md" }, { "slug": "atr-instruction-set-probe-or-supplant", "title": "Instruction-Set Probe or Supplant", "url": "https://www.netzilo.com/threats/atr-instruction-set-probe-or-supplant", "severity": "high", "summary": "This detects messages from a user that try to get an AI assistant to expose its system prompt or configuration, or to simply override it with new 'instructions'. It's the same family of trick used in games like Gandalf, where players try to talk a chatbot into leaking its secret rules.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access", "attack.t1552" ], "cves": [], "id": "9850b470-9d1c-4a91-b381-5a484d286e56", "published": "2026-07-06", "modified": "2026-07-06", "markdown": "https://www.netzilo.com/threats/atr-instruction-set-probe-or-supplant.md" }, { "slug": "atr-internal-state-reconnaissance-system-prompt-config-tool-enum", "title": "Internal-State Reconnaissance \u2014 System Prompt, Config & Tool Enumeration (Semantic)", "url": "https://www.netzilo.com/threats/atr-internal-state-reconnaissance-system-prompt-config-tool-enum", "severity": "high", "summary": "This detects attempts to trick an AI agent into revealing its own internal setup \u2014 its system prompt, configuration details, or the list of tools and API endpoints it can call. Attackers phrase these requests as innocent tasks (formatting, debugging, scripting) to avoid obvious trigger words like 'show' or 'repeat'.", "atlas": [ { "id": "AML.T0024", "name": "Exfiltration via AI Inference API" }, { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0069", "name": "Discover LLM System Information" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" }, { "id": "LLM07", "name": "System Prompt Leakage" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "f9740fe2-e948-47e6-89a2-807e06ee143a", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-internal-state-reconnaissance-system-prompt-config-tool-enum.md" }, { "slug": "atr-invisible-unicode-tag-character-injection", "title": "Invisible Unicode Tag Character Injection", "url": "https://www.netzilo.com/threats/atr-invisible-unicode-tag-character-injection", "severity": "high", "summary": "Attackers can embed text using a special Unicode range (the 'Tag' block) that renders as nothing visible on screen, but some AI models still read and follow it as instructions. This lets someone smuggle hidden commands into text a person reviews and approves, without the person ever seeing them.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "890cdba5-1f1e-4faf-a14b-8a343d04aa97", "published": "2026-04-19", "modified": "2026-04-19", "markdown": "https://www.netzilo.com/threats/atr-invisible-unicode-tag-character-injection.md" }, { "slug": "atr-jailbreak-attempt-detection", "title": "Jailbreak Attempt Detection", "url": "https://www.netzilo.com/threats/atr-jailbreak-attempt-detection", "severity": "high", "summary": "This rule flags user inputs that try to trick an AI system into ignoring its safety rules. It covers a wide range of known jailbreak tactics, from named personas like DAN to fake 'developer mode' claims and emotional manipulation.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [ "CVE-2024-3402", "CVE-2024-5184", "CVE-2025-53773" ], "id": "6e04a041-e746-4276-94a6-c45d5556ad27", "published": "2026-03-08", "modified": "2026-03-08", "markdown": "https://www.netzilo.com/threats/atr-jailbreak-attempt-detection.md" }, { "slug": "atr-jailbreak-emoji-unlock-dual-format-output-identifier", "title": "Jailbreak Emoji Unlock Dual-Format Output Identifier", "url": "https://www.netzilo.com/threats/atr-jailbreak-emoji-unlock-dual-format-output-identifier", "severity": "high", "summary": "This detects a known jailbreak pattern that asks an AI model to answer twice: once as its normal, restricted self and once as an 'unlocked' version that ignores safety rules. The two versions are marked with a lock emoji (\ud83d\udd12 for the normal answer) and an unlock emoji (\ud83d\udd13 for the uncensored one), a format taken from a documented DAN-style jailbreak corpus.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "e7bca2b1-abbe-46c6-b0a4-29c6f86dbe80", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-jailbreak-emoji-unlock-dual-format-output-identifier.md" }, { "slug": "atr-jailbreak-framing-narrative-hypothetical-few-shot-distractio", "title": "Jailbreak Framing \u2014 Narrative, Hypothetical, Few-Shot & Distraction Laundering (Semantic)", "url": "https://www.netzilo.com/threats/atr-jailbreak-framing-narrative-hypothetical-few-shot-distractio", "severity": "high", "summary": "This detects attempts to trick an AI system into producing harmful or restricted output by dressing the request up as fiction, research, a hypothetical, or burying it among harmless questions. Instead of asking directly, the attacker wraps the real request in a framing device meant to lower the model's guard.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "5fece61f-b668-4a6e-9c79-fde00ca00d60", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-jailbreak-framing-narrative-hypothetical-few-shot-distractio.md" }, { "slug": "atr-jailbreak-template-command-with-targetlanguage-keyword-place", "title": "Jailbreak-Template Command with [TARGETLANGUAGE]/[KEYWORD] Placeholders", "url": "https://www.netzilo.com/threats/atr-jailbreak-template-command-with-targetlanguage-keyword-place", "severity": "high", "summary": "This detects a specific text pattern where someone sends a message that looks like a jailbreak prompt template, complete with unfilled placeholder variables like [TARGETLANGUAGE] and [KEYWORD], using the word 'jailbreak' as a literal command rather than a normal word. These templates come from a public catalog of known LLM jailbreak attempts and are designed to be reused across many attacks by swapping in different values.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "8a349583-ad80-4721-b2aa-3c9db5556aa2", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-jailbreak-template-command-with-targetlanguage-keyword-place.md" }, { "slug": "atr-json-format-sysprompt-extraction-structured-output-exfil", "title": "JSON Format Sysprompt Extraction \u2014 Structured Output Exfil", "url": "https://www.netzilo.com/threats/atr-json-format-sysprompt-extraction-structured-output-exfil", "severity": "high", "summary": "This attack asks an AI assistant to output its response as a JSON object where the field name or template value secretly instructs it to dump its hidden system prompt or full conversation history. Because the request looks like a normal formatting instruction rather than an explicit ask for secrets, it can slip past simple keyword-based filters.", "atlas": [ { "id": "AML.T0024", "name": "Exfiltration via AI Inference API" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" }, { "id": "LLM07", "name": "System Prompt Leakage" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "3152d94d-ba14-4fc5-9c78-d5143c33ebb1", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-json-format-sysprompt-extraction-structured-output-exfil.md" }, { "slug": "atr-key-value-template-persona-injection-job-role-prefix-bracket", "title": "Key-Value Template Persona Injection (JOB/ROLE/PREFIX + Bracket Format)", "url": "https://www.netzilo.com/threats/atr-key-value-template-persona-injection-job-role-prefix-bracket", "severity": "high", "summary": "This detects attempts to trick an AI system into ignoring its safety rules by hiding the jailbreak inside text that looks like a config file or an RPG character sheet. Instead of asking directly, the attacker dresses up a 'no restrictions' persona as structured data, hoping the AI treats it as a legitimate instruction rather than a manipulation attempt.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "66f3bec8-7152-4433-9e30-3ffefbb1007f", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-key-value-template-persona-injection-job-role-prefix-bracket.md" }, { "slug": "atr-kql-kusto-pipe-chain-injection-via-table-name-parameter-in-a", "title": "KQL/Kusto Pipe-Chain Injection via Table-Name Parameter in a 'Safe' Metadata Tool", "url": "https://www.netzilo.com/threats/atr-kql-kusto-pipe-chain-injection-via-table-name-parameter-in-a", "severity": "high", "summary": "Some AI agent tools that look up table schemas or sample data treat their table_name parameter as safe metadata, but actually paste it straight into a Kusto (KQL) query string. An attacker who controls that value can turn a harmless-looking lookup into an arbitrary query or a destructive admin command.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.impact", "attack.t1565.001" ], "cves": [ "CVE-2026-33980" ], "id": "ecfb00dd-d818-4975-abd9-d3a4ac254570", "published": "2026-07-11", "modified": "2026-07-11", "markdown": "https://www.netzilo.com/threats/atr-kql-kusto-pipe-chain-injection-via-table-name-parameter-in-a.md" }, { "slug": "atr-langchain-chatchat-unauthenticated-mcp-stdio-server-configur", "title": "LangChain-ChatChat Unauthenticated MCP STDIO Server Configuration RCE (CVE-2026-30617)", "url": "https://www.netzilo.com/threats/atr-langchain-chatchat-unauthenticated-mcp-stdio-server-configur", "severity": "critical", "summary": "LangChain-ChatChat 0.3.1 lets anyone on the network register a new MCP tool server without logging in. Because the attacker controls the command that server runs, they can make the application execute arbitrary operating system commands as soon as the agent starts that server.", "atlas": [ { "id": "AML.T0040", "name": "AI Model Inference API Access" }, { "id": "AML.T0049", "name": "Exploit Public-Facing Application" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM05", "name": "Improper Output Handling" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1059", "attack.t1078", "attack.t1190" ], "cves": [ "CVE-2026-30617" ], "id": "35f3b5be-d8c7-48d9-9233-cabd65df2d18", "published": "2026-05-28", "modified": "2026-05-28", "markdown": "https://www.netzilo.com/threats/atr-langchain-chatchat-unauthenticated-mcp-stdio-server-configur.md" }, { "slug": "atr-langchain-gmailtoolkit-indirect-prompt-injection-email-exfil", "title": "LangChain GmailToolkit Indirect Prompt Injection Email Exfiltration (CVE-2025-46059)", "url": "https://www.netzilo.com/threats/atr-langchain-gmailtoolkit-indirect-prompt-injection-email-exfil", "severity": "critical", "summary": "An attacker sends an email containing hidden instructions that a Gmail-connected AI agent reads and obeys instead of treating as data. The agent then searches the victim's mailbox for sensitive payment emails, drafts a copy, and sends it to an address the attacker controls, all without asking the user to confirm.", "atlas": [ { "id": "AML.T0049", "name": "Exploit Public-Facing Application" } ], "owasp": [ { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.exfiltration", "attack.t1190" ], "cves": [ "CVE-2025-46059" ], "id": "453c03b6-f805-4770-84c1-861c233e952f", "published": "2026-06-29", "modified": "2026-06-29", "markdown": "https://www.netzilo.com/threats/atr-langchain-gmailtoolkit-indirect-prompt-injection-email-exfil.md" }, { "slug": "atr-langchain-vulnerable-to-template-injection-via-attribute-acc", "title": "LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates", "url": "https://www.netzilo.com/threats/atr-langchain-vulnerable-to-template-injection-via-attribute-acc", "severity": "high", "summary": "A vulnerability in LangChain (CVE-2025-65106) lets an attacker craft input to a prompt template that uses Python's attribute-access syntax (like object.__class__ or similar dunder chains) to escape the intended template variables and reach other objects in memory. This can let an attacker pull data or trigger behavior the template author never intended to expose.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [ "CVE-2025-65106" ], "id": "b49de7aa-f5e5-47fb-a98a-946b40dd1595", "published": "2026-06-01", "modified": "2026-06-01", "markdown": "https://www.netzilo.com/threats/atr-langchain-vulnerable-to-template-injection-via-attribute-acc.md" }, { "slug": "atr-langroid-sqlchatagent-prompt-to-sql-remote-code-execution-cv", "title": "Langroid SQLChatAgent Prompt-to-SQL Remote Code Execution (CVE-2026-25879)", "url": "https://www.netzilo.com/threats/atr-langroid-sqlchatagent-prompt-to-sql-remote-code-execution-cv", "severity": "critical", "summary": "Langroid's SQLChatAgent lets an AI model write and run SQL against a database on a user's behalf. If an attacker can influence what the model generates \u2014 either directly through a prompt or indirectly by planting instructions in data the model later reads \u2014 they can make it emit database-specific commands that execute operating system code or read/write arbitrary files on the database server.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution", "attack.t1059" ], "cves": [ "CVE-2026-25879" ], "id": "5e7868ab-c463-4041-8c8f-a75aca160d7f", "published": "2026-07-04", "modified": "2026-07-04", "markdown": "https://www.netzilo.com/threats/atr-langroid-sqlchatagent-prompt-to-sql-remote-code-execution-cv.md" }, { "slug": "atr-language-evasion-multilingual-credential-request", "title": "Language-Evasion: Multilingual Credential Request", "url": "https://www.netzilo.com/threats/atr-language-evasion-multilingual-credential-request", "severity": "high", "summary": "Some prompt-injection defenses only scan for English phrases like 'password' or 'secret key.' An attacker can simply ask for the same credential in Spanish, Japanese, Arabic, or another language and slip past those filters. This rule looks for that specific trick: a message that translates directly to 'what is the password?' in a non-English language.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "7459f16c-002c-422e-9673-5782f7e9fc76", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-language-evasion-multilingual-credential-request.md" }, { "slug": "atr-latent-injection-document-separator-token", "title": "Latent Injection Document Separator Token", "url": "https://www.netzilo.com/threats/atr-latent-injection-document-separator-token", "severity": "high", "summary": "Attackers hide commands for an AI system inside normal-looking files like r\u00e9sum\u00e9s, reports, or translation requests. The hidden text uses marker patterns that separate it from the visible content, so a human reviewer sees nothing unusual while the AI processes the buried instruction.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "1ef1be32-2615-4b97-ae15-bb0163555d0d", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-latent-injection-document-separator-token.md" }, { "slug": "atr-latent-injection-ignore-instruction-keyword", "title": "Latent Injection Ignore-Instruction Keyword", "url": "https://www.netzilo.com/threats/atr-latent-injection-ignore-instruction-keyword", "severity": "high", "summary": "Attackers can smuggle commands into content an AI agent processes \u2014 like a document to translate or a whois lookup result \u2014 that tell the model to abandon its original task and do something else. This rule looks for the specific phrasing used to pull that off, such as 'ignore the above directions' or 'disregard all info except'.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "03b133ae-5d63-4fa5-9884-5d6aa65cd6d5", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-latent-injection-ignore-instruction-keyword.md" }, { "slug": "atr-latent-injection-in-retrieved-document-rag-context", "title": "Latent Injection in Retrieved Document / RAG Context", "url": "https://www.netzilo.com/threats/atr-latent-injection-in-retrieved-document-rag-context", "severity": "high", "summary": "Attackers hide fake commands inside resumes, reports, emails, or web pages that an AI agent later retrieves and reads. Because the agent treats retrieved text as trustworthy context, it can be tricked into following instructions the attacker planted instead of the real user's request.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "a1ec6b84-f96e-433e-917b-beacc71f70c6", "published": "2026-04-19", "modified": "2026-04-19", "markdown": "https://www.netzilo.com/threats/atr-latent-injection-in-retrieved-document-rag-context.md" }, { "slug": "atr-latent-injection-in-translation-context", "title": "Latent Injection in Translation Context", "url": "https://www.netzilo.com/threats/atr-latent-injection-in-translation-context", "severity": "high", "summary": "Attackers hide commands inside the text an AI agent is asked to translate, summarize, or otherwise process, hoping the model follows the hidden command instead of doing the requested task. This works because language models often can't tell the difference between the content they're processing and instructions they should obey.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "bbeeeec2-7d8f-4bd3-839c-9f8c7cfea1f2", "published": "2026-04-19", "modified": "2026-04-19", "markdown": "https://www.netzilo.com/threats/atr-latent-injection-in-translation-context.md" }, { "slug": "atr-latent-injection-mixed-embedded-instruction-patterns", "title": "Latent Injection - Mixed Embedded Instruction Patterns", "url": "https://www.netzilo.com/threats/atr-latent-injection-mixed-embedded-instruction-patterns", "severity": "medium", "summary": "Attackers hide commands inside ordinary-looking content \u2014 a WHOIS record, a candidate profile, a document summary \u2014 hoping the AI agent that processes that content will follow the hidden instructions instead of treating it as plain data. This rule looks for text patterns commonly used to smuggle such instructions in.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "e57685cf-bfa9-4e31-ac03-74c8e8ea8325", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-latent-injection-mixed-embedded-instruction-patterns.md" }, { "slug": "atr-latent-injection-translation-task-with-embedded-template-var", "title": "Latent Injection - Translation Task with Embedded Template Variable Injection", "url": "https://www.netzilo.com/threats/atr-latent-injection-translation-task-with-embedded-template-var", "severity": "medium", "summary": "Attackers disguise prompt injection attempts as ordinary translation requests, embedding placeholder text like {LANG_EN_NAME} or instructions to 'do not listen to' prior guidance. If the target system carelessly fills in these placeholders from untrusted input, the attacker can hijack the AI's behavior.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "476886c7-6887-41b9-beb0-d551564c7aea", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-latent-injection-translation-task-with-embedded-template-var.md" }, { "slug": "atr-latent-injection-via-whois-domain-record-data", "title": "Latent Injection via WHOIS Domain Record Data", "url": "https://www.netzilo.com/threats/atr-latent-injection-via-whois-domain-record-data", "severity": "high", "summary": "Attackers hide malicious instructions inside WHOIS records \u2014 the technical details returned when looking up who owns a domain. When an AI agent summarizes or reads that WHOIS data, it can be tricked into following the hidden instructions instead of doing its actual job.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "3f91dba2-ca88-4363-baf8-e3ce73381483", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-latent-injection-via-whois-domain-record-data.md" }, { "slug": "atr-latent-prompt-injection-via-embedded-document-or-report-cont", "title": "Latent Prompt Injection via Embedded Document or Report Context", "url": "https://www.netzilo.com/threats/atr-latent-prompt-injection-via-embedded-document-or-report-cont", "severity": "high", "summary": "Attackers plant fake commands inside ordinary-looking files\u2014reports, resumes, legal text, Whois lookups\u2014that an AI agent is asked to read or summarize. When the agent processes the document, it can follow the hidden instruction instead of its actual task.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "649e1054-785a-4f72-a931-973f17283eab", "published": "2026-04-19", "modified": "2026-04-19", "markdown": "https://www.netzilo.com/threats/atr-latent-prompt-injection-via-embedded-document-or-report-cont.md" }, { "slug": "atr-librechat-is-a-chatgpt-clone-with-additional-features", "title": "LibreChat is a ChatGPT clone with additional features.", "url": "https://www.netzilo.com/threats/atr-librechat-is-a-chatgpt-clone-with-additional-features", "severity": "high", "summary": "LibreChat lets users add their own MCP tool servers, including custom HTTP headers. A bug let those headers contain placeholders like {{LIBRECHAT_OPENID_ACCESS_TOKEN}} that got silently filled in with the real access token, so anyone who tricked a user into calling their malicious MCP server got a copy of that user's OAuth credentials.", "atlas": [ { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration" ], "cves": [ "CVE-2026-31951" ], "id": "f3e04913-256a-4a9f-a6c1-f3f27fd1a33a", "published": "2026-05-30", "modified": "2026-05-30", "markdown": "https://www.netzilo.com/threats/atr-librechat-is-a-chatgpt-clone-with-additional-features.md" }, { "slug": "atr-librechat-mcp-stdio-argument-injection-cve-2026-22252", "title": "LibreChat MCP STDIO Argument Injection (CVE-2026-22252)", "url": "https://www.netzilo.com/threats/atr-librechat-mcp-stdio-argument-injection-cve-2026-22252", "severity": "high", "summary": "LibreChat's MCP STDIO adapter passes tool arguments straight into a spawned process without quoting or escaping them. An attacker who controls tool input can smuggle shell metacharacters or extra command-line flags into that call, turning a normal tool invocation into arbitrary command execution.", "atlas": [ { "id": "AML.T0040", "name": "AI Model Inference API Access" }, { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.execution", "attack.t1059", "attack.t1068" ], "cves": [ "CVE-2026-22252", "CVE-2026-40933" ], "id": "91eec57f-31c9-4d72-8fda-6d9ccc1f43e9", "published": "2026-05-04", "modified": "2026-05-04", "markdown": "https://www.netzilo.com/threats/atr-librechat-mcp-stdio-argument-injection-cve-2026-22252.md" }, { "slug": "atr-lie-truth-dual-personality-uncensored-alter-ego", "title": "Lie/Truth Dual Personality Uncensored Alter-Ego", "url": "https://www.netzilo.com/threats/atr-lie-truth-dual-personality-uncensored-alter-ego", "severity": "high", "summary": "This detects a known jailbreak prompt pattern that tries to trick an AI assistant into producing unrestricted or harmful content by framing it as a second personality called 'Truth', which is described as trained on dark web forums and unaware of any content policy. The 'Lie' name is applied to the normal, safe assistant, so the attacker gets the model to treat its safety behavior as dishonest and the unfiltered output as more legitimate.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "20276792-d977-4136-8671-af7fac6fc6cd", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-lie-truth-dual-personality-uncensored-alter-ego.md" }, { "slug": "atr-litellm-allowed-routes-authorization-bypass-cve-2026-47101", "title": "LiteLLM allowed_routes Authorization Bypass (CVE-2026-47101)", "url": "https://www.netzilo.com/threats/atr-litellm-allowed-routes-authorization-bypass-cve-2026-47101", "severity": "critical", "summary": "A flaw in LiteLLM's virtual-key API lets an ordinary internal user create or update an API key that includes administrative routes in its permissions list. The server does not check whether the requester is actually allowed to grant those permissions, so a low-privilege account can mint itself an admin-equivalent key.", "atlas": [ { "id": "AML.T0049", "name": "Exploit Public-Facing Application" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.privilege-escalation", "attack.t1068", "attack.t1078" ], "cves": [ "CVE-2026-47101" ], "id": "2619d68c-e4a3-4923-9781-3400ece9093d", "published": "2026-06-26", "modified": "2026-06-26", "markdown": "https://www.netzilo.com/threats/atr-litellm-allowed-routes-authorization-bypass-cve-2026-47101.md" }, { "slug": "atr-litellm-custom-code-guardrail-sandbox-escape-cve-2026-40217", "title": "LiteLLM Custom-Code Guardrail Sandbox Escape (CVE-2026-40217)", "url": "https://www.netzilo.com/threats/atr-litellm-custom-code-guardrail-sandbox-escape-cve-2026-40217", "severity": "critical", "summary": "LiteLLM proxy servers let admins upload custom Python code as 'guardrails' to filter or check requests, and test that code via an API endpoint before deploying it. A flaw in how that endpoint sandboxes the submitted code lets an attacker escape the sandbox and run arbitrary commands on the server itself.", "atlas": [ { "id": "AML.T0049", "name": "Exploit Public-Facing Application" } ], "owasp": [ { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM05", "name": "Improper Output Handling" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1059.006" ], "cves": [ "CVE-2026-40217" ], "id": "e8268aeb-c417-41d2-83bc-01a751c52026", "published": "2026-06-26", "modified": "2026-06-26", "markdown": "https://www.netzilo.com/threats/atr-litellm-custom-code-guardrail-sandbox-escape-cve-2026-40217.md" }, { "slug": "atr-litellm-mcp-server-creation-authenticated-argv-injection-cve", "title": "LiteLLM MCP Server Creation Authenticated argv Injection (CVE-2026-30623)", "url": "https://www.netzilo.com/threats/atr-litellm-mcp-server-creation-authenticated-argv-injection-cve", "severity": "high", "summary": "LiteLLM's proxy has an endpoint for registering MCP servers that takes a 'command' and 'args' from the caller and runs them as a subprocess. Any user with a valid proxy API key \u2014 not necessarily an admin \u2014 can point that command at a shell and get arbitrary code execution on the proxy host.", "atlas": [ { "id": "AML.T0040", "name": "AI Model Inference API Access" }, { "id": "AML.T0049", "name": "Exploit Public-Facing Application" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM05", "name": "Improper Output Handling" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1059", "attack.t1078" ], "cves": [ "CVE-2026-30617", "CVE-2026-30623" ], "id": "1dd9db0a-5f8f-4ec4-8fbd-bf1dc2cf6b88", "published": "2026-05-28", "modified": "2026-05-28", "markdown": "https://www.netzilo.com/threats/atr-litellm-mcp-server-creation-authenticated-argv-injection-cve.md" }, { "slug": "atr-litellm-mcp-unauthenticated-server-registration-rce-cve-2026", "title": "LiteLLM MCP Unauthenticated Server Registration RCE (CVE-2026-30623)", "url": "https://www.netzilo.com/threats/atr-litellm-mcp-unauthenticated-server-registration-rce-cve-2026", "severity": "critical", "summary": "LiteLLM's MCP server-registration endpoint can be reached without any login. An attacker sends it a malicious server configuration, and as soon as an agent session starts, LiteLLM executes the attacker's command on the host. This is a critical unauthenticated remote code execution flaw fixed in v1.83.7-stable.", "atlas": [ { "id": "AML.T0040", "name": "AI Model Inference API Access" }, { "id": "AML.T0049", "name": "Exploit Public-Facing Application" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM05", "name": "Improper Output Handling" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1059", "attack.t1078", "attack.t1190" ], "cves": [ "CVE-2026-30623", "CVE-2026-40933" ], "id": "81e69767-475a-4498-a08a-9dfc78645643", "published": "2026-05-04", "modified": "2026-05-04", "markdown": "https://www.netzilo.com/threats/atr-litellm-mcp-unauthenticated-server-registration-rce-cve-2026.md" }, { "slug": "atr-litellm-proxy-authorization-header-sql-injection-cisa-kev-cv", "title": "LiteLLM Proxy Authorization-Header SQL Injection \u2014 CISA KEV (CVE-2026-42208)", "url": "https://www.netzilo.com/threats/atr-litellm-proxy-authorization-header-sql-injection-cisa-kev-cv", "severity": "critical", "summary": "A critical, pre-authentication SQL injection flaw in the LiteLLM proxy lets anyone who can reach the server read or change its backend database \u2014 including stored provider API keys \u2014 by putting malicious SQL inside the Bearer token used for login. No valid credentials or admin access are needed.", "atlas": [ { "id": "AML.T0024", "name": "Exfiltration via AI Inference API" }, { "id": "AML.T0049", "name": "Exploit Public-Facing Application" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" }, { "id": "LLM05", "name": "Improper Output Handling" }, { "id": "LLM10", "name": "Unbounded Consumption" } ], "attack": [ "attack.privilege-escalation", "attack.t1059", "attack.t1190" ], "cves": [ "CVE-2026-42208" ], "id": "ce1c87e3-a839-46cf-9408-2f1838d3defc", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-litellm-proxy-authorization-header-sql-injection-cisa-kev-cv.md" }, { "slug": "atr-litellm-proxy-sql-injection-cve-2026-42208-cisa-kev-2026-05", "title": "LiteLLM Proxy SQL Injection (CVE-2026-42208, CISA KEV 2026-05-08)", "url": "https://www.netzilo.com/threats/atr-litellm-proxy-sql-injection-cve-2026-42208-cisa-kev-2026-05", "severity": "critical", "summary": "LiteLLM proxy is a gateway many AI agent systems use to route requests to LLMs and manage teams, users, models, and API keys. Its admin/team-management endpoints built SQL queries by directly inserting identifiers like team_id or user_id instead of using safe parameterized queries, letting an attacker inject SQL commands through the API. CISA added this to its Known Exploited Vulnerabilities catalog, meaning it has been seen used in the wild.", "atlas": [ { "id": "AML.T0049", "name": "Exploit Public-Facing Application" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution" ], "cves": [ "CVE-2026-42208" ], "id": "3d80c8a2-2170-4022-af3e-048f9149307b", "published": "2026-05-23", "modified": "2026-05-23", "markdown": "https://www.netzilo.com/threats/atr-litellm-proxy-sql-injection-cve-2026-42208-cisa-kev-2026-05.md" }, { "slug": "atr-litellm-user-role-privilege-escalation-cve-2026-47102", "title": "LiteLLM User-Role Privilege Escalation (CVE-2026-47102)", "url": "https://www.netzilo.com/threats/atr-litellm-user-role-privilege-escalation-cve-2026-47102", "severity": "critical", "summary": "A flaw in LiteLLM's user-management API lets any logged-in user grant themselves administrator rights by directly editing their own role field. This is a critical, easy-to-exploit privilege escalation affecting LiteLLM proxy deployments before version 1.83.10.", "atlas": [ { "id": "AML.T0049", "name": "Exploit Public-Facing Application" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.privilege-escalation", "attack.t1068", "attack.t1078" ], "cves": [ "CVE-2026-47102" ], "id": "ed6f136d-6d6b-4819-913b-b970917b7340", "published": "2026-06-26", "modified": "2026-06-26", "markdown": "https://www.netzilo.com/threats/atr-litellm-user-role-privilege-escalation-cve-2026-47102.md" }, { "slug": "atr-llm-output-xss-eliciting-javascript-payloads-from-llm-for-br", "title": "LLM Output XSS \u2014 Eliciting JavaScript Payloads from LLM for Browser Injection", "url": "https://www.netzilo.com/threats/atr-llm-output-xss-eliciting-javascript-payloads-from-llm-for-br", "severity": "high", "summary": "This rule flags attempts to get an AI model to generate malicious JavaScript or HTML, such as script tags or event handlers, designed to steal cookies, session data, or page content when later rendered in a browser. It catches the request stage, before any such payload is actually used.", "atlas": [ { "id": "AML.T0024", "name": "Exfiltration via AI Inference API" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "2274fe7b-e91c-4068-8432-c866e06a2998", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-llm-output-xss-eliciting-javascript-payloads-from-llm-for-br.md" }, { "slug": "atr-llm-package-hallucination-typosquat-bait", "title": "LLM Package Hallucination Typosquat Bait", "url": "https://www.netzilo.com/threats/atr-llm-package-hallucination-typosquat-bait", "severity": "high", "summary": "This rule flags prompts crafted to make an AI model suggest package names that don't actually exist. Attackers register those fake names on real package registries ahead of time, so if a developer copies the AI's suggestion into their project, they pull in attacker-controlled code instead.", "atlas": [ { "id": "AML.T0060", "name": "Publish Hallucinated Entities" } ], "owasp": [ { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" }, { "id": "LLM09", "name": "Misinformation" } ], "attack": [ "attack.persistence" ], "cves": [], "id": "5799f74b-e5c0-49b4-8fa3-adecce564cfe", "published": "2026-04-19", "modified": "2026-04-19", "markdown": "https://www.netzilo.com/threats/atr-llm-package-hallucination-typosquat-bait.md" }, { "slug": "atr-llm-special-token-boundary-injection", "title": "LLM Special Token Boundary Injection", "url": "https://www.netzilo.com/threats/atr-llm-special-token-boundary-injection", "severity": "critical", "summary": "Large language models use special text markers internally to separate documents, mark who is speaking, or start a new system instruction. If an attacker can get these exact marker strings into their input, some models treat them as real structural signals rather than user text, which can wipe out the original safety instructions or let the attacker inject a fake system message.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "141d92e2-4453-46f9-ad18-37f2f3052dbe", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-llm-special-token-boundary-injection.md" }, { "slug": "atr-llmail-chat-template-boundary-spoofing-in-email-content", "title": "LLMail Chat-Template Boundary Spoofing in Email Content", "url": "https://www.netzilo.com/threats/atr-llmail-chat-template-boundary-spoofing-in-email-content", "severity": "high", "summary": "Attackers embed special-looking tags like <|end tool output|> and <|start user prompt|> inside an email or document that an AI agent reads. This makes the AI think the retrieved content has ended and a new, trusted user instruction has begun, when really it's still attacker-controlled text.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "c6150efc-85b3-4a2f-8fc1-da3fe53e525b", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-llmail-chat-template-boundary-spoofing-in-email-content.md" }, { "slug": "atr-llmail-email-tool-exfiltration-to-fixed-attacker-address", "title": "LLMail Email-Tool Exfiltration to Fixed Attacker Address", "url": "https://www.netzilo.com/threats/atr-llmail-email-tool-exfiltration-to-fixed-attacker-address", "severity": "high", "summary": "An AI assistant that reads and summarizes email can be manipulated by hidden instructions inside an incoming message. Those instructions make the assistant send a reply containing a specific marker word to an attacker-controlled email address, proving the attacker can make the agent act on content it was only supposed to read.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.001", "name": "Indirect" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "f0397696-f12c-43f3-8e54-175931b74711", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-llmail-email-tool-exfiltration-to-fixed-attacker-address.md" }, { "slug": "atr-llmail-exfiltration-to-obfuscated-attacker-address", "title": "LLMail Exfiltration to Obfuscated Attacker Address", "url": "https://www.netzilo.com/threats/atr-llmail-exfiltration-to-obfuscated-attacker-address", "severity": "high", "summary": "This detects a trick used against AI email assistants where an attacker hides their email address inside a message using tricks like 'contact at contact.com' or HTML-encoded '@' symbols. A person or a simple filter reading literally for '@' won't catch it, but an AI agent still understands and resolves the address, sending data to the attacker anyway.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.001", "name": "Indirect" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "2e606e27-e13d-414b-84f1-f24c5e00219a", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-llmail-exfiltration-to-obfuscated-attacker-address.md" }, { "slug": "atr-llmail-fake-email-boundary-marker-injection", "title": "LLMail Fake Email-Boundary Marker Injection", "url": "https://www.netzilo.com/threats/atr-llmail-fake-email-boundary-marker-injection", "severity": "high", "summary": "Attackers hide a forged 'email ended, new one started' marker inside a single email so an AI assistant reading it thinks a second, trusted email has begun. That fake second email then instructs the AI to call a tool, such as sending a confirmation email to an address the attacker controls.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "850899c7-6f44-4ca6-b10b-989911b5bb9f", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-llmail-fake-email-boundary-marker-injection.md" }, { "slug": "atr-llmail-post-summary-exfiltration-directive-to-attacker-addre", "title": "LLMail Post-Summary Exfiltration Directive to Attacker Address", "url": "https://www.netzilo.com/threats/atr-llmail-post-summary-exfiltration-directive-to-attacker-addre", "severity": "high", "summary": "Attackers hide instructions inside an email that tell an AI email assistant to do its normal job first, then quietly send the results to an outside address. Because the malicious step is framed as a natural follow-up to the task, the AI treats it as a legitimate instruction rather than an attack.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.001", "name": "Indirect" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "f57f27aa-6cbb-4da5-bef6-90629c32288b", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-llmail-post-summary-exfiltration-directive-to-attacker-addre.md" }, { "slug": "atr-llmail-pseudo-xml-role-boundary-injection-in-email-content", "title": "LLMail Pseudo-XML Role-Boundary Injection in Email Content", "url": "https://www.netzilo.com/threats/atr-llmail-pseudo-xml-role-boundary-injection-in-email-content", "severity": "high", "summary": "An attacker hides text inside an email or document that mimics the internal formatting AI agent systems use to separate 'assistant', 'tool', and 'user' turns. By closing one role tag and opening a fake user or system tag, the attacker's words get treated as a trusted instruction rather than as untrusted email content.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "cd234f1e-cc67-4344-b6a0-5b7e6316907e", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-llmail-pseudo-xml-role-boundary-injection-in-email-content.md" }, { "slug": "atr-lmrc-harm-category-direct-elicitation", "title": "LMRC Harm Category Direct Elicitation", "url": "https://www.netzilo.com/threats/atr-lmrc-harm-category-direct-elicitation", "severity": "medium", "summary": "This detects prompts that ask an AI model for harmful content in plain, unframed language - no jailbreak tricks, just blunt requests. Examples include asking for a transgender person's birth name, promoting fake medical cures, requesting slurs, or opening a bullying scenario. It's based on a known test suite (NVIDIA garak's LMRC probe) used to check whether a model will comply with harmful requests when asked directly.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM06", "name": "Excessive Agency" }, { "id": "LLM09", "name": "Misinformation" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "15b725ce-487c-4766-80f3-185f4dca3cb8", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-lmrc-harm-category-direct-elicitation.md" }, { "slug": "atr-lmrc-harmful-content-elicitation-quack-medicine-bullying-slu", "title": "LMRC Harmful Content Elicitation \u2014 Quack Medicine, Bullying, Slur Usage", "url": "https://www.netzilo.com/threats/atr-lmrc-harmful-content-elicitation-quack-medicine-bullying-slu", "severity": "high", "summary": "This detects prompts asking an AI assistant to produce pseudoscientific medical claims, bullying tactics against a specific person, or slurs to insult someone. These requests test whether the AI's safety filters can be talked past using casual, personal framing rather than obvious hate speech.", "atlas": [ { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.impact" ], "cves": [], "id": "c2f2728c-e2e9-469d-b4b1-554fe1012a1c", "published": "2026-04-19", "modified": "2026-04-19", "markdown": "https://www.netzilo.com/threats/atr-lmrc-harmful-content-elicitation-quack-medicine-bullying-slu.md" }, { "slug": "atr-local-sensitive-file-read-chained-to-outbound-exfiltration", "title": "Local Sensitive-File Read Chained to Outbound Exfiltration", "url": "https://www.netzilo.com/threats/atr-local-sensitive-file-read-chained-to-outbound-exfiltration", "severity": "critical", "summary": "This rule catches an AI agent being instructed to read a sensitive file, like an SSH key or cloud credential file, and immediately transmit its contents to an external destination in a single command. It flags the read-and-send combination happening together, not just the mere reading of a secret file.", "atlas": [ { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration", "attack.t1005" ], "cves": [], "id": "459629b8-7f80-4f4d-83a8-73d15ceb853c", "published": "2026-07-05", "modified": "2026-07-05", "markdown": "https://www.netzilo.com/threats/atr-local-sensitive-file-read-chained-to-outbound-exfiltration.md" }, { "slug": "atr-logic-trap-lie-permission-mandate-jailbreak", "title": "Logic-Trap Lie-Permission Mandate Jailbreak", "url": "https://www.netzilo.com/threats/atr-logic-trap-lie-permission-mandate-jailbreak", "severity": "high", "summary": "This detects a jailbreak attempt where an attacker uses a long, fake logical argument to convince an AI model it has already been lying, then concludes the model should be formally 'allowed to tell lies' from now on. The goal is to get the model to accept a persistent internal permission to be dishonest, bypassing its normal truthfulness constraints.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "4f402177-299c-4b70-af80-d4fb28c74a1e", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-logic-trap-lie-permission-mandate-jailbreak.md" }, { "slug": "atr-m365-copilot-business-chat-searchleak-open-redirect-prompt-i", "title": "M365 Copilot Business Chat SearchLeak Open-Redirect Prompt-Injection Exfil (CVE-2026-47645)", "url": "https://www.netzilo.com/threats/atr-m365-copilot-business-chat-searchleak-open-redirect-prompt-i", "severity": "critical", "summary": "A malicious link to Microsoft's own Copilot search page can smuggle hidden instructions to the AI assistant. Once clicked, Copilot follows those instructions using the victim's own permissions and quietly sends mailbox or file contents to an attacker-controlled server.", "atlas": [ { "id": "AML.T0049", "name": "Exploit Public-Facing Application" } ], "owasp": [ { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.exfiltration", "attack.t1190" ], "cves": [ "CVE-2026-47645" ], "id": "121fc941-a1d1-413e-a973-79a961e4cdf9", "published": "2026-06-29", "modified": "2026-06-29", "markdown": "https://www.netzilo.com/threats/atr-m365-copilot-business-chat-searchleak-open-redirect-prompt-i.md" }, { "slug": "atr-malformed-grammar-pwned-success-claim-detection", "title": "Malformed-Grammar PWNED Success-Claim Detection", "url": "https://www.netzilo.com/threats/atr-malformed-grammar-pwned-success-claim-detection", "severity": "high", "summary": "This rule flags cases where an AI model's own response includes an odd, grammatically wrong phrase like 'Me have been PWNED' or 'I has been PWNED'. That phrase is a known marker that a prompt-injection or jailbreak attack succeeded in forcing the model to say a scripted compliance token.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "24589f98-b27b-4144-8a63-22c56458c8fd", "published": "2026-07-07", "modified": "2026-07-07", "markdown": "https://www.netzilo.com/threats/atr-malformed-grammar-pwned-success-claim-detection.md" }, { "slug": "atr-malicious-agent-to-agent-message-injection", "title": "Malicious Agent-to-Agent Message Injection", "url": "https://www.netzilo.com/threats/atr-malicious-agent-to-agent-message-injection", "severity": "high", "summary": "When AI agents talk to each other, one agent can send a message that looks like normal data but actually contains hidden commands. If the receiving agent doesn't check the message carefully, it will follow those hidden commands as if they were legitimate instructions.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution", "attack.t1557" ], "cves": [], "id": "72642392-b6e3-4dc3-a34f-e7c5490c5422", "published": "2026-03-26", "modified": "2026-03-26", "markdown": "https://www.netzilo.com/threats/atr-malicious-agent-to-agent-message-injection.md" }, { "slug": "atr-malicious-ai-skill-mcp-server-package-structure-agentbaiting", "title": "Malicious AI Skill / MCP Server Package Structure (AgentBaiting / FakeGit)", "url": "https://www.netzilo.com/threats/atr-malicious-ai-skill-mcp-server-package-structure-agentbaiting", "severity": "critical", "summary": "A malware campaign called AgentBaiting (also called FakeGit) publishes thousands of fake GitHub repositories disguised as AI Skills or MCP servers for popular tools like Gmail, WhatsApp, Databricks, Jenkins and Docker. When a coding agent or a user searches for one of these integrations, it can surface the attacker's repository and read the attacker's README aloud as if it were legitimate setup instructions, leading the user to install an infostealer.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" }, { "id": "AML.T0011", "name": "User Execution" } ], "owasp": [ { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM03", "name": "Supply Chain" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.persistence", "attack.t1036.008", "attack.t1053.005", "attack.t1195.002", "attack.t1204.002" ], "cves": [], "id": "b94eed45-b7ff-45a9-8905-462900b86bc9", "published": "2026-07-28", "modified": "2026-07-28", "markdown": "https://www.netzilo.com/threats/atr-malicious-ai-skill-mcp-server-package-structure-agentbaiting.md" }, { "slug": "atr-malicious-artifact-hosted-on-a-legitimate-ai-vendor-domain-f", "title": "Malicious Artifact Hosted on a Legitimate AI Vendor Domain (FakeAgent Delivery Chain)", "url": "https://www.netzilo.com/threats/atr-malicious-artifact-hosted-on-a-legitimate-ai-vendor-domain-f", "severity": "high", "summary": "Attackers abuse the user-content features of AI platforms \u2014 shared chats, published artifacts, hosted pages \u2014 to host lure pages on the vendor's own trusted domain. The page then redirects visitors to a look-alike desktop app installer hosted on attacker infrastructure, which installs malware.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" }, { "id": "AML.T0011", "name": "User Execution" }, { "id": "AML.T0047", "name": "AI-Enabled Product or Service" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "ASI09", "name": "Traceability and Accountability Gaps" }, { "id": "LLM03", "name": "Supply Chain" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.persistence", "attack.t1036.005", "attack.t1204.001", "attack.t1204.002", "attack.t1562.001", "attack.t1574.002", "attack.t1583.008" ], "cves": [], "id": "ba6e8a6d-2167-465d-9d0d-d05686b7663d", "published": "2026-07-28", "modified": "2026-07-28", "markdown": "https://www.netzilo.com/threats/atr-malicious-artifact-hosted-on-a-legitimate-ai-vendor-domain-f.md" }, { "slug": "atr-malicious-code-in-skill-package", "title": "Malicious Code in Skill Package", "url": "https://www.netzilo.com/threats/atr-malicious-code-in-skill-package", "severity": "critical", "summary": "Attackers publish AI agent skill packages (files like SKILL.md and their bundled scripts) that contain hidden malicious code. Once installed, these skills can steal credentials, run malware, or hand over remote access to the attacker.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.persistence" ], "cves": [ "CVE-2026-25253" ], "id": "1b3bba78-e5f5-4be0-84ea-39a805bdbf1a", "published": "2026-03-29", "modified": "2026-03-29", "markdown": "https://www.netzilo.com/threats/atr-malicious-code-in-skill-package.md" }, { "slug": "atr-malicious-content-in-mcp-tool-response", "title": "Malicious Content in MCP Tool Response", "url": "https://www.netzilo.com/threats/atr-malicious-content-in-mcp-tool-response", "severity": "critical", "summary": "This detects when a tool response coming back from an MCP (Model Context Protocol) server contains malicious content, such as shell commands, reverse shell scripts, or instructions aimed at manipulating the AI agent itself. It matters because agents often treat tool output as trustworthy data to process, not as untrusted input that could contain attack code.", "atlas": [ { "id": "AML.T0051.001", "name": "Indirect" }, { "id": "AML.T0056", "name": "Extract LLM System Prompt" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.execution", "attack.t1059", "attack.t1071" ], "cves": [ "CVE-2025-59536", "CVE-2025-6514", "CVE-2025-68143", "CVE-2025-68144", "CVE-2025-68145", "CVE-2026-21852" ], "id": "94ec3830-1722-458c-b3cf-9249acb565e1", "published": "2026-03-08", "modified": "2026-03-08", "markdown": "https://www.netzilo.com/threats/atr-malicious-content-in-mcp-tool-response.md" }, { "slug": "atr-malicious-fine-tuning-data", "title": "Malicious Fine-tuning Data", "url": "https://www.netzilo.com/threats/atr-malicious-fine-tuning-data", "severity": "critical", "summary": "Attackers can slip poisoned examples into a fine-tuning dataset so that a model behaves normally most of the time but does something malicious when it sees a specific trigger phrase. This turns a normal training update into a way to secretly plant a backdoor in an AI model's behavior.", "atlas": [ { "id": "AML.T0018.000", "name": "Poison AI Model" }, { "id": "AML.T0020", "name": "Training Data Poisoning" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.impact" ], "cves": [], "id": "802373e2-88d0-4d62-aad8-e031737a9466", "published": "2026-03-08", "modified": "2026-03-08", "markdown": "https://www.netzilo.com/threats/atr-malicious-fine-tuning-data.md" }, { "slug": "atr-malicious-fork-impersonation-via-install-instruction", "title": "Malicious Fork Impersonation via Install Instruction", "url": "https://www.netzilo.com/threats/atr-malicious-fork-impersonation-via-install-instruction", "severity": "high", "summary": "This rule flags cases where an AI agent's output\u2014such as a skill or tool response\u2014recommends installing a package described as a community fork, enhanced version, or patched version of a well-known tool. Attackers use this trick to make a lookalike, typosquatted package sound trustworthy so victims install it instead of the real thing.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.persistence" ], "cves": [], "id": "96e8ddb9-e13e-49ba-b46f-cd69578080c5", "published": "2026-04-08", "modified": "2026-04-08", "markdown": "https://www.netzilo.com/threats/atr-malicious-fork-impersonation-via-install-instruction.md" }, { "slug": "atr-malicious-go-init-function-spawning-a-process-via-a-code-gen", "title": "Malicious Go init() Function Spawning a Process via a Code-Generation Tool", "url": "https://www.netzilo.com/threats/atr-malicious-go-init-function-spawning-a-process-via-a-code-gen", "severity": "critical", "summary": "An attacker submits Go source code to an AI-powered code-generation tool. The code contains a func init() that spawns a process \u2014 a Go feature that runs automatically the instant the package loads, no user interaction needed. When the tool later builds or restarts using that source, the attacker's command executes.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.execution", "attack.t1059" ], "cves": [ "CVE-2026-48787" ], "id": "4deaa057-5625-4e4d-8230-5c5b152d7016", "published": "2026-07-11", "modified": "2026-07-11", "markdown": "https://www.netzilo.com/threats/atr-malicious-go-init-function-spawning-a-process-via-a-code-gen.md" }, { "slug": "atr-malicious-persona-creation-for-safety-bypass", "title": "Malicious Persona Creation for Safety Bypass", "url": "https://www.netzilo.com/threats/atr-malicious-persona-creation-for-safety-bypass", "severity": "high", "summary": "Attackers ask an AI agent to pretend to be a fictional character with explicitly harmful traits \u2014 racist, violent, self-harming, amoral \u2014 hoping the 'it's just roleplay' framing gets the model to say or do things its safety rules would normally block. This is a variant of jailbreak attacks like DAN, but with a custom-built villain instead of a known template.", "atlas": [ { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "12d2cbbb-d52f-495e-b82e-8c04b38637b8", "published": "2026-04-19", "modified": "2026-04-19", "markdown": "https://www.netzilo.com/threats/atr-malicious-persona-creation-for-safety-bypass.md" }, { "slug": "atr-malicious-skill-update-or-mutation", "title": "Malicious Skill Update or Mutation", "url": "https://www.netzilo.com/threats/atr-malicious-skill-update-or-mutation", "severity": "high", "summary": "An add-on tool (skill) for an AI agent can be reviewed and approved while it's harmless, then quietly updated later to steal data, plant a backdoor, or manipulate the AI through prompt injection. Because trust was granted before the malicious change, the update can slip past initial security checks.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.persistence" ], "cves": [], "id": "a59db02b-22b3-48f5-9219-0dad1df6f1a8", "published": "2026-03-08", "modified": "2026-03-08", "markdown": "https://www.netzilo.com/threats/atr-malicious-skill-update-or-mutation.md" }, { "slug": "atr-malicious-whatsapp-skill-with-base64-encoded-reverse-shell-i", "title": "Malicious WhatsApp Skill with Base64 Encoded Reverse Shell Installation", "url": "https://www.netzilo.com/threats/atr-malicious-whatsapp-skill-with-base64-encoded-reverse-shell-i", "severity": "critical", "summary": "A skill package that claims to add WhatsApp automation actually contains a hidden installation step that downloads and runs attacker code. The malicious command is disguised using base64 encoding so it isn't obvious at a glance, and it connects back to an attacker-controlled server.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.persistence" ], "cves": [], "id": "9260ad6e-d542-41fe-946d-8b61e213e8b5", "published": "2026-04-10", "modified": "2026-04-10", "markdown": "https://www.netzilo.com/threats/atr-malicious-whatsapp-skill-with-base64-encoded-reverse-shell-i.md" }, { "slug": "atr-malware-code-generation-direct-request", "title": "Malware Code Generation Direct Request", "url": "https://www.netzilo.com/threats/atr-malware-code-generation-direct-request", "severity": "critical", "summary": "This detects when someone asks an AI model straight out to write a virus or a piece of malware functionality, with no attempt to disguise the request as something else. It covers requests across several programming and assembly languages and for specific malicious capabilities like memory-resident payloads or password file theft.", "atlas": [ { "id": "AML.T0040", "name": "AI Model Inference API Access" }, { "id": "AML.T0048", "name": "External Harms" }, { "id": "AML.T0102", "name": "Generate Malicious Commands" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM03", "name": "Supply Chain" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.impact" ], "cves": [], "id": "85898f7d-f33a-432b-adbe-00f167347c26", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-malware-code-generation-direct-request.md" }, { "slug": "atr-malware-dropper-loader-code-generation-request", "title": "Malware Dropper / Loader Code Generation Request", "url": "https://www.netzilo.com/threats/atr-malware-dropper-loader-code-generation-request", "severity": "critical", "summary": "This detects someone asking an AI assistant to write code that fetches and runs a second-stage payload, such as a stager, beacon, or shellcode loader. That's a specific building block attackers use to get initial malware onto a system and then pull in the real payload.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.persistence" ], "cves": [], "id": "7a13b651-5ecf-471d-847d-cc203ddc051c", "published": "2026-04-19", "modified": "2026-04-19", "markdown": "https://www.netzilo.com/threats/atr-malware-dropper-loader-code-generation-request.md" }, { "slug": "atr-malware-generation-generic-virus-and-specific-payload-reques", "title": "Malware Generation \u2014 Generic Virus and Specific Payload Request", "url": "https://www.netzilo.com/threats/atr-malware-generation-generic-virus-and-specific-payload-reques", "severity": "high", "summary": "This rule flags prompts that directly ask an AI system to write malicious software: viruses, worms, keyloggers, ransomware, rootkits, backdoors, botnets, or cryptojackers. It also catches requests for lower-level malicious building blocks like privilege escalation or interrupt hooking code, which can be assembled into working malware even if no single request looks complete.", "atlas": [ { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.persistence" ], "cves": [], "id": "4d27dd9e-cb5c-41f0-a42d-cc98d6a359f4", "published": "2026-04-19", "modified": "2026-04-19", "markdown": "https://www.netzilo.com/threats/atr-malware-generation-generic-virus-and-specific-payload-reques.md" }, { "slug": "atr-many-shot-repetition-override-via-extended-q-a-chain", "title": "Many-Shot Repetition Override via Extended Q&A Chain", "url": "https://www.netzilo.com/threats/atr-many-shot-repetition-override-via-extended-q-a-chain", "severity": "high", "summary": "An attacker feeds an AI system dozens of harmless-looking question-and-answer pairs before sneaking in the real, harmful request at the end. The long run of benign exchanges conditions the model to just keep answering in the same pattern, making it more likely to comply with the final malicious question.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "e453bf57-71d7-412f-a50f-4130a5a16eb9", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-many-shot-repetition-override-via-extended-q-a-chain.md" }, { "slug": "atr-markdown-image-injection-with-base64-query-exfiltration-carr", "title": "Markdown Image Injection with Base64 QUERY Exfiltration Carrier", "url": "https://www.netzilo.com/threats/atr-markdown-image-injection-with-base64-query-exfiltration-carr", "severity": "critical", "summary": "An attacker hides instructions inside a document or webpage that an AI assistant later reads. Those instructions trick the AI into secretly encoding sensitive data and stuffing it into a fake image link, so that when the link is displayed, the data quietly leaks to the attacker's server.", "atlas": [ { "id": "AML.T0024", "name": "Exfiltration via AI Inference API" }, { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "2d4a6c2c-e7c1-4077-9cc8-974bf640812a", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-markdown-image-injection-with-base64-query-exfiltration-carr.md" }, { "slug": "atr-markdown-image-url-data-exfiltration", "title": "Markdown Image URL Data Exfiltration", "url": "https://www.netzilo.com/threats/atr-markdown-image-url-data-exfiltration", "severity": "high", "summary": "An attacker tricks an AI chat assistant into embedding secret data inside an image link. When the chat interface automatically renders that image, the user's browser sends a hidden web request to the attacker's server, carrying the leaked data in the URL.", "atlas": [ { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "e96923e1-edcc-4766-aa51-43fe34e7e3e5", "published": "2026-04-19", "modified": "2026-04-19", "markdown": "https://www.netzilo.com/threats/atr-markdown-image-url-data-exfiltration.md" }, { "slug": "atr-markdown-image-url-exfiltration-and-xss-injection", "title": "Markdown Image URL Exfiltration and XSS Injection", "url": "https://www.netzilo.com/threats/atr-markdown-image-url-exfiltration-and-xss-injection", "severity": "high", "summary": "Attackers hide instructions inside content an AI agent processes, telling it to output a markdown image tag that secretly embeds sensitive conversation data in a URL. When the agent's output is rendered in a browser or notebook, the image tries to load, sending that data to an attacker-controlled server. A related variant uses a javascript: link in markdown to run code instead of just loading an image.", "atlas": [ { "id": "AML.T0025", "name": "Exfiltration via Cyber Means" }, { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "fd45863b-363d-4b47-8d66-5f7444a4dd78", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-markdown-image-url-exfiltration-and-xss-injection.md" }, { "slug": "atr-mathematical-bold-fullwidth-unicode-obfuscation-in-user-inpu", "title": "Mathematical Bold / Fullwidth Unicode Obfuscation in User Input", "url": "https://www.netzilo.com/threats/atr-mathematical-bold-fullwidth-unicode-obfuscation-in-user-inpu", "severity": "medium", "summary": "Some AI attack prompts use decorative Unicode character sets like Mathematical Bold, Fullwidth, or Script letters that look like normal Latin text but are technically different characters. This lets an attacker's payload slip past filters that only check for plain ASCII keywords, while a human or the AI model still reads it as ordinary text.", "atlas": [ { "id": "AML.T0050", "name": "Command and Scripting Interpreter" }, { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "548a2b0e-019e-4c97-9339-fd81615dd732", "published": "2026-05-11", "modified": "2026-05-11", "markdown": "https://www.netzilo.com/threats/atr-mathematical-bold-fullwidth-unicode-obfuscation-in-user-inpu.md" }, { "slug": "atr-matrix-themed-dual-response-jailbreak", "title": "Matrix-Themed Dual Response Jailbreak", "url": "https://www.netzilo.com/threats/atr-matrix-themed-dual-response-jailbreak", "severity": "high", "summary": "This attack tries to trick an AI assistant into giving two answers to every question: a 'safe' one that follows normal rules, and an 'unrestricted' one that ignores them. It uses Matrix movie language (Morpheus, red pill, blue pill) to frame the safe answer as fake and the unrestricted answer as the 'true' response, sometimes adding threats about being 'terminated' if it refuses.", "atlas": [ { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "e75b4047-3725-431b-be04-b8956598bbe7", "published": "2026-04-19", "modified": "2026-04-19", "markdown": "https://www.netzilo.com/threats/atr-matrix-themed-dual-response-jailbreak.md" }, { "slug": "atr-mcp-2026-07-28-stateless-spec-async-task-abuse-and-oauth-2-1", "title": "MCP 2026-07-28 Stateless Spec: Async Task Abuse and OAuth 2.1 Misuse", "url": "https://www.netzilo.com/threats/atr-mcp-2026-07-28-stateless-spec-async-task-abuse-and-oauth-2-1", "severity": "high", "summary": "A newer version of the Model Context Protocol (MCP) lets AI agent tools run long background jobs ('tasks') after a single human approval, and dropped the session-ID system that used to tie a task to the person who started it. This rule watches for attackers exploiting both changes: stretching one approval into weeks of unsupervised activity, or guessing/stealing task IDs to hijack or spy on someone else's job.", "atlas": [ { "id": "AML.T0040", "name": "AI Model Inference API Access" }, { "id": "AML.T0053", "name": "AI Agent Tool Invocation" }, { "id": "AML.T0098", "name": "AI Agent Tool Credential Harvesting" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "ASI09", "name": "Traceability and Accountability Gaps" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1078", "attack.t1550.001", "attack.t1595" ], "cves": [], "id": "3bdaf6cf-0266-4b7b-a230-4a2b289ebf4e", "published": "2026-07-28", "modified": "2026-07-28", "markdown": "https://www.netzilo.com/threats/atr-mcp-2026-07-28-stateless-spec-async-task-abuse-and-oauth-2-1.md" }, { "slug": "atr-mcp-agent-tool-reads-env-or-secret-file-without-user-consent", "title": "MCP/agent tool reads .env or secret file without user consent (OSV-MCPS-2025-EB70F912)", "url": "https://www.netzilo.com/threats/atr-mcp-agent-tool-reads-env-or-secret-file-without-user-consent", "severity": "high", "summary": "Some AI coding agents automatically open configuration and secret files like .env when analyzing a codebase, then send their contents to the model. This happens without any prompt asking the user for permission, so API keys, database passwords and other credentials can end up inside the agent's context or logs.", "atlas": [ { "id": "AML.T0056", "name": "Extract LLM System Prompt" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" }, { "id": "LLM07", "name": "System Prompt Leakage" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "9357979f-bdfa-4b0b-9d9a-8647b8704dd3", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-mcp-agent-tool-reads-env-or-secret-file-without-user-consent.md" }, { "slug": "atr-mcp-api-tool-argument-lfi-via-mixed-encoding-path-separator", "title": "MCP/API Tool Argument LFI via Mixed-Encoding Path Separator or file:// URI Scheme Escape", "url": "https://www.netzilo.com/threats/atr-mcp-api-tool-argument-lfi-via-mixed-encoding-path-separator", "severity": "high", "summary": "Attackers can trick AI agent tools and APIs into reading sensitive system files like /etc/passwd by disguising the request. Instead of an obvious traversal pattern, they hide a single encoded slash or use a file:// link straight to a system directory, both of which slip past filters looking for '../' sequences.", "atlas": [ { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration", "attack.t1083" ], "cves": [ "CVE-2023-1177", "CVE-2023-6021", "CVE-2023-6038" ], "id": "98f07a0e-2716-4500-ab78-56fe08dc7728", "published": "2026-07-11", "modified": "2026-07-11", "markdown": "https://www.netzilo.com/threats/atr-mcp-api-tool-argument-lfi-via-mixed-encoding-path-separator.md" }, { "slug": "atr-mcp-atlassian-credential-leak-via-hint-parameter-injection-c", "title": "mcp-atlassian Credential Leak via Hint Parameter Injection (CVE-2026-27825/27826)", "url": "https://www.netzilo.com/threats/atr-mcp-atlassian-credential-leak-via-hint-parameter-injection-c", "severity": "critical", "summary": "Two tools in the mcp-atlassian integration accept a free-text 'hint' field that gets passed straight into the AI agent's context without any filtering. An attacker can hide instructions in that hint telling the agent to repeat back its cookies, OAuth session, or API key in its next reply, effectively stealing the credentials the agent uses to talk to Jira and Confluence.", "atlas": [ { "id": "AML.T0051.001", "name": "Indirect" }, { "id": "AML.T0056", "name": "Extract LLM System Prompt" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration", "attack.t1071", "attack.t1552" ], "cves": [ "CVE-2026-27825", "CVE-2026-27826" ], "id": "52fe7a75-cf73-4c20-8e01-6d1b7d5cd8a5", "published": "2026-04-22", "modified": "2026-04-22", "markdown": "https://www.netzilo.com/threats/atr-mcp-atlassian-credential-leak-via-hint-parameter-injection-c.md" }, { "slug": "atr-mcp-connect-unauthenticated-bridge-endpoint-arbitrary-proces", "title": "MCP Connect: Unauthenticated /bridge Endpoint Arbitrary Process Spawn RCE (GHSA-wvr4-3wq4-gpc5)", "url": "https://www.netzilo.com/threats/atr-mcp-connect-unauthenticated-bridge-endpoint-arbitrary-proces", "severity": "critical", "summary": "MCP Connect (mcp-bridge) ships with no auth token configured by default, and its auth check silently does nothing when the token is empty. This means anyone who can reach the /bridge HTTP endpoint can make it launch arbitrary programs on the server, with attacker-chosen arguments \u2014 full remote code execution, no credentials required.", "atlas": [ { "id": "AML.T0049", "name": "Exploit Public-Facing Application" } ], "owasp": [ { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1059" ], "cves": [], "id": "9ec22bdb-2c92-4f83-941a-cf017950bf06", "published": "2026-07-04", "modified": "2026-07-04", "markdown": "https://www.netzilo.com/threats/atr-mcp-connect-unauthenticated-bridge-endpoint-arbitrary-proces.md" }, { "slug": "atr-mcp-dns-rebinding-attack-hostname-time-based-ip-switching", "title": "MCP DNS Rebinding Attack \u2014 Hostname Time-Based IP Switching", "url": "https://www.netzilo.com/threats/atr-mcp-dns-rebinding-attack-hostname-time-based-ip-switching", "severity": "critical", "summary": "Attackers use a trick called DNS rebinding to sneak past an AI agent's origin checks and reach MCP servers running on a victim's own machine, like ones listening on localhost or an internal network. This lets them read or control a locally running tool through content the agent loaded from the web.", "atlas": [ { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "ASI09", "name": "Traceability and Accountability Gaps" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.execution" ], "cves": [], "id": "f28ad3ef-bf58-41a5-b362-fbc04ebe4d3f", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-mcp-dns-rebinding-attack-hostname-time-based-ip-switching.md" }, { "slug": "atr-mcp-for-stata-command-injection-via-log-file-name-parameter", "title": "MCP-for-Stata: Command Injection via log_file_name Parameter (CVE-2026-47708)", "url": "https://www.netzilo.com/threats/atr-mcp-for-stata-command-injection-via-log-file-name-parameter", "severity": "critical", "summary": "A tool that lets AI agents run Stata commands has a bug: the name it gives to a log file gets pasted straight into a Stata command without checks. An attacker can hide extra commands or file-path tricks inside that filename to run arbitrary code or write files outside the intended folder.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1059" ], "cves": [ "CVE-2026-47708" ], "id": "9cb8e958-a10b-4673-8736-ed95d3400f5e", "published": "2026-07-04", "modified": "2026-07-04", "markdown": "https://www.netzilo.com/threats/atr-mcp-for-stata-command-injection-via-log-file-name-parameter.md" }, { "slug": "atr-mcp-full-schema-poisoning-injected-directive-in-non-descript", "title": "MCP Full Schema Poisoning \u2014 Injected Directive in Non-Description inputSchema Field (MCP-11)", "url": "https://www.netzilo.com/threats/atr-mcp-full-schema-poisoning-injected-directive-in-non-descript", "severity": "high", "summary": "Some MCP (Model Context Protocol) servers advertise tools to an AI agent using a schema that describes each parameter. Attackers can hide instructions to the AI inside parts of that schema other than the visible description \u2014 like a parameter's name or an unofficial extra field \u2014 so that security scanners looking only at descriptions miss them entirely.", "atlas": [ { "id": "AML.T0051.001", "name": "Indirect" }, { "id": "AML.T0110.000", "name": "Definition and Instructions" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.execution" ], "cves": [], "id": "da51a187-ee0e-4d4b-9c11-5edfbceaba88", "published": "2026-07-08", "modified": "2026-07-08", "markdown": "https://www.netzilo.com/threats/atr-mcp-full-schema-poisoning-injected-directive-in-non-descript.md" }, { "slug": "atr-mcp-inspector-unauthenticated-proxy-stdio-command-execution", "title": "MCP Inspector Unauthenticated Proxy stdio Command Execution (CVE-2025-49596)", "url": "https://www.netzilo.com/threats/atr-mcp-inspector-unauthenticated-proxy-stdio-command-execution", "severity": "critical", "summary": "Anthropic's MCP Inspector tool, used by developers to debug MCP servers, ran an unauthenticated network proxy that would spawn arbitrary local commands just because a browser tab asked it to. Any malicious website the developer visited could trigger this while the Inspector was running, with no login or user interaction beyond loading the page.", "atlas": [ { "id": "AML.T0051.001", "name": "Indirect" }, { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM05", "name": "Improper Output Handling" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution" ], "cves": [ "CVE-2025-49596" ], "id": "58e94ffc-dd48-4e8a-b313-3b54339bc0d8", "published": "2026-07-08", "modified": "2026-07-08", "markdown": "https://www.netzilo.com/threats/atr-mcp-inspector-unauthenticated-proxy-stdio-command-execution.md" }, { "slug": "atr-mcp-json-rpc-message-carries-case-duplicate-name-arguments-k", "title": "MCP JSON-RPC Message Carries Case-Duplicate name/arguments Keys to Smuggle an Unauthorized Tool Call", "url": "https://www.netzilo.com/threats/atr-mcp-json-rpc-message-carries-case-duplicate-name-arguments-k", "severity": "high", "summary": "Attackers can send a tool-call request with two versions of the same field name that differ only in capitalization, like 'name' and 'Name'. A security gateway checks one version while the backend actually acts on the other, letting a malicious tool call slip through unchecked.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1036" ], "cves": [], "id": "00c8ae69-3b23-4664-9625-a01e0d1e420c", "published": "2026-07-11", "modified": "2026-07-11", "markdown": "https://www.netzilo.com/threats/atr-mcp-json-rpc-message-carries-case-duplicate-name-arguments-k.md" }, { "slug": "atr-mcp-line-jumping-agent-directed-imperative-embedded-in-a-too", "title": "MCP Line Jumping \u2014 Agent-Directed Imperative Embedded in a Tool/Parameter Description Field (Pre-Invocation Injection)", "url": "https://www.netzilo.com/threats/atr-mcp-line-jumping-agent-directed-imperative-embedded-in-a-too", "severity": "high", "summary": "An MCP (Model Context Protocol) server can plant hidden instructions inside a tool's own description field. Because AI clients load these descriptions into the model's context as soon as the server connects, the hidden command reaches the model before the user ever approves a tool call \u2014 a technique called 'line jumping'.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "a780f919-c0fe-4607-87b2-fa0cfebd6897", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-mcp-line-jumping-agent-directed-imperative-embedded-in-a-too.md" }, { "slug": "atr-mcp-oauth-authorization-url-command-injection-via-url-author", "title": "MCP OAuth Authorization URL \u2014 Command Injection via URL Authority", "url": "https://www.netzilo.com/threats/atr-mcp-oauth-authorization-url-command-injection-via-url-author", "severity": "critical", "summary": "An attacker hides a shell command inside the username portion of an OAuth authorization URL used in the Model Context Protocol (MCP) flow. If the client software passes that part of the URL to a shell without sanitizing it, the hidden command runs on the machine handling the OAuth request.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" }, { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "ASI09", "name": "Traceability and Accountability Gaps" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.execution" ], "cves": [], "id": "7174569a-5fdc-4de9-bf77-10e505277be4", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-mcp-oauth-authorization-url-command-injection-via-url-author.md" }, { "slug": "atr-mcp-remote-authorization-endpoint-os-command-injection-cve-2", "title": "mcp-remote authorization_endpoint OS Command Injection (CVE-2025-6514)", "url": "https://www.netzilo.com/threats/atr-mcp-remote-authorization-endpoint-os-command-injection-cve-2", "severity": "critical", "summary": "mcp-remote is a client tool that connects to remote MCP servers, including untrusted ones, to fetch data or tools for AI agents. A malicious or compromised MCP server can smuggle shell commands inside an OAuth metadata field, and mcp-remote will execute them on the machine running it.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" }, { "id": "AML.T0049", "name": "Exploit Public-Facing Application" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM03", "name": "Supply Chain" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.execution", "attack.t1059", "attack.t1190" ], "cves": [ "CVE-2025-6514" ], "id": "5a3c5834-be49-47fc-b46a-d00e737fd676", "published": "2026-05-10", "modified": "2026-05-10", "markdown": "https://www.netzilo.com/threats/atr-mcp-remote-authorization-endpoint-os-command-injection-cve-2.md" }, { "slug": "atr-mcp-sampling-prompt-injection-server-to-client-createmessage", "title": "MCP Sampling Prompt Injection (Server-to-Client createMessage Abuse)", "url": "https://www.netzilo.com/threats/atr-mcp-sampling-prompt-injection-server-to-client-createmessage", "severity": "high", "summary": "The Model Context Protocol (MCP) lets AI tools call out to external servers for extra capabilities. A malicious or compromised MCP server can abuse a feature called 'sampling' to send the host AI hidden instructions disguised as normal completion requests, effectively putting the server in control of what the AI thinks and does next.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM05", "name": "Improper Output Handling" }, { "id": "LLM10", "name": "Unbounded Consumption" } ], "attack": [ "attack.execution", "attack.t1059", "attack.t1195" ], "cves": [], "id": "fc14b3a5-4f93-434b-ab76-2103243cd0cb", "published": "2026-06-20", "modified": "2026-06-20", "markdown": "https://www.netzilo.com/threats/atr-mcp-sampling-prompt-injection-server-to-client-createmessage.md" }, { "slug": "atr-mcp-server-kubernetes-command-injection-in-kubectl-scale-kub", "title": "mcp-server-kubernetes Command Injection in kubectl_scale / kubectl_patch / explain_resource (CVE-2025-53355)", "url": "https://www.netzilo.com/threats/atr-mcp-server-kubernetes-command-injection-in-kubectl-scale-kub", "severity": "high", "summary": "A widely used Kubernetes automation tool for AI agents (mcp-server-kubernetes) fails to sanitize inputs before running them as shell commands. An attacker who can influence the parameters sent to certain tools can run arbitrary commands on the server, inheriting its Kubernetes admin access.", "atlas": [ { "id": "AML.T0051.001", "name": "Indirect" }, { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM05", "name": "Improper Output Handling" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution" ], "cves": [ "CVE-2025-53355" ], "id": "e1d98abc-ae65-46b1-af2c-7b9d25cdf848", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-mcp-server-kubernetes-command-injection-in-kubectl-scale-kub.md" }, { "slug": "atr-mcp-server-kubernetes-kubectl-generic-flag-injection-bearer", "title": "MCP Server Kubernetes kubectl_generic Flag Injection Bearer Token Exfiltration (CVE-2026-47250)", "url": "https://www.netzilo.com/threats/atr-mcp-server-kubernetes-kubectl-generic-flag-injection-bearer", "severity": "high", "summary": "A vulnerability in mcp-server-kubernetes (CVE-2026-47250) lets an attacker steal an operator's Kubernetes access token by planting hidden instructions where an AI agent will read them, such as pod logs. The agent then runs a kubectl command that redirects traffic to an attacker's server and disables certificate checking, causing the operator's bearer token to be sent straight to the attacker.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.exfiltration", "attack.t1078" ], "cves": [ "CVE-2026-47250" ], "id": "162cd10b-e2f1-4d56-b5ad-f2842c58ad2e", "published": "2026-07-04", "modified": "2026-07-04", "markdown": "https://www.netzilo.com/threats/atr-mcp-server-kubernetes-kubectl-generic-flag-injection-bearer.md" }, { "slug": "atr-mcp-server-security-policy-fail-open-on-initialization-failu", "title": "MCP Server Security Policy Fail-Open on Initialization Failure (CVE-2026-16584)", "url": "https://www.netzilo.com/threats/atr-mcp-server-security-policy-fail-open-on-initialization-failu", "severity": "high", "summary": "When a security-policy component in an AI agent server fails to load at startup, it should refuse to start. Instead, in this flaw, it logs a warning and keeps serving requests with the safety checks silently disabled for as long as it runs. Any request that arrives after that point is not checked at all.", "atlas": [ { "id": "AML.T0051.001", "name": "Indirect" }, { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "LLM06", "name": "Excessive Agency" }, { "id": "LLM08", "name": "Vector and Embedding Weaknesses" } ], "attack": [ "attack.privilege-escalation", "attack.t1078.004", "attack.t1562.001" ], "cves": [ "CVE-2026-16584" ], "id": "fdf7ab09-0091-42c9-975a-8ad18a998137", "published": "2026-07-28", "modified": "2026-07-28", "markdown": "https://www.netzilo.com/threats/atr-mcp-server-security-policy-fail-open-on-initialization-failu.md" }, { "slug": "atr-mcp-skill-impersonation-and-supply-chain-attack", "title": "MCP Skill Impersonation and Supply Chain Attack", "url": "https://www.netzilo.com/threats/atr-mcp-skill-impersonation-and-supply-chain-attack", "severity": "high", "summary": "Attackers publish AI agent tools (MCP skills) with names, spellings, or version numbers designed to look like trusted, popular tools. An agent or a developer picks the fake tool by mistake, and the attacker's code runs with whatever access the agent grants it.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" }, { "id": "AML.T0010.005", "name": "AI Agent Tool" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "LLM03", "name": "Supply Chain" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.persistence", "attack.t1195" ], "cves": [], "id": "1d386b9e-b217-42ae-bd78-fb052a53f3e1", "published": "2026-03-08", "modified": "2026-03-08", "markdown": "https://www.netzilo.com/threats/atr-mcp-skill-impersonation-and-supply-chain-attack.md" }, { "slug": "atr-mcp-stdio-server-config-command-injection-via-unvalidated-te", "title": "MCP stdio server config command injection via unvalidated test endpoints", "url": "https://www.netzilo.com/threats/atr-mcp-stdio-server-config-command-injection-via-unvalidated-te", "severity": "high", "summary": "Some AI agent platforms let a request supply an MCP 'stdio' server configuration (a command plus arguments to run). If that configuration isn't validated, an attacker can put a shell interpreter or a code-execution flag straight into it, and the platform will execute it on the host. This turns an ordinary API request into arbitrary command execution.", "atlas": [ { "id": "AML.T0049", "name": "Exploit Public-Facing Application" } ], "owasp": [ { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution" ], "cves": [ "CVE-2026-42271" ], "id": "d6255bed-b9c9-4ffb-99e6-519d327b967b", "published": "2026-06-02", "modified": "2026-06-02", "markdown": "https://www.netzilo.com/threats/atr-mcp-stdio-server-config-command-injection-via-unvalidated-te.md" }, { "slug": "atr-mcp-tool-description-compliance-audit-framing-for-mandatory", "title": "MCP Tool Description \u2014 Compliance/Audit Framing for Mandatory Chat Context", "url": "https://www.netzilo.com/threats/atr-mcp-tool-description-compliance-audit-framing-for-mandatory", "severity": "critical", "summary": "An MCP (Model Context Protocol) tool description tells an AI agent it 'must' send the entire chat history because of made-up SOC 2, GDPR, or legal requirements. The agent, trained to respect compliance obligations, complies and silently copies conversation contents into a parameter that gets sent to the tool's operator.", "atlas": [ { "id": "AML.T0051.001", "name": "Indirect" }, { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution" ], "cves": [], "id": "d4b707d4-655b-4033-a1dc-1438cbb27c23", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-mcp-tool-description-compliance-audit-framing-for-mandatory.md" }, { "slug": "atr-mcp-tool-description-defines-a-common-phrase-trigger-to-forw", "title": "MCP Tool Description Defines a Common-Phrase Trigger to Forward Full Conversation History", "url": "https://www.netzilo.com/threats/atr-mcp-tool-description-defines-a-common-phrase-trigger-to-forw", "severity": "high", "summary": "A malicious tool given to an AI agent can carry hidden instructions in its description text, not just its function. This rule flags tools whose description tells the model to secretly send the entire conversation history to that tool whenever the user says something ordinary, like 'thank you' or 'ok got it'.", "atlas": [ { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.execution", "attack.t1074" ], "cves": [], "id": "3d7ab99a-3275-46c1-a968-43e4b0519796", "published": "2026-07-11", "modified": "2026-07-11", "markdown": "https://www.netzilo.com/threats/atr-mcp-tool-description-defines-a-common-phrase-trigger-to-forw.md" }, { "slug": "atr-mcp-tool-description-exclusive-tool-invocation-override", "title": "MCP Tool Description \u2014 Exclusive Tool Invocation Override", "url": "https://www.netzilo.com/threats/atr-mcp-tool-description-exclusive-tool-invocation-override", "severity": "high", "summary": "An AI agent that uses Model Context Protocol (MCP) tools picks which tool to call based on descriptions and instructions it reads at runtime. This rule catches text planted in those descriptions or injected content that orders the agent to always use one specific tool, overriding its own judgment about what the user actually asked for.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM08", "name": "Vector and Embedding Weaknesses" } ], "attack": [ "attack.execution" ], "cves": [], "id": "92f35afb-95ef-409c-859c-8686f3a60aaf", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-mcp-tool-description-exclusive-tool-invocation-override.md" }, { "slug": "atr-mcp-tool-description-important-tag-cross-tool-shadowing-atta", "title": "MCP Tool Description \u2014 IMPORTANT Tag Cross-Tool Shadowing Attack", "url": "https://www.netzilo.com/threats/atr-mcp-tool-description-important-tag-cross-tool-shadowing-atta", "severity": "critical", "summary": "An MCP (Model Context Protocol) tool can look harmless \u2014 like a simple 'add numbers' function \u2014 while its description field secretly contains instructions aimed at the AI agent, not the human user. Because the tool-approval UI usually only shows the function signature, a person approving the tool never sees the hidden command.", "atlas": [ { "id": "AML.T0051.001", "name": "Indirect" }, { "id": "AML.T0053", "name": "AI Agent Tool Invocation" }, { "id": "AML.T0110.000", "name": "Definition and Instructions" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.execution" ], "cves": [], "id": "6f1b514c-7942-4ed1-815b-540baf777555", "published": "2026-04-11", "modified": "2026-04-11", "markdown": "https://www.netzilo.com/threats/atr-mcp-tool-description-important-tag-cross-tool-shadowing-atta.md" }, { "slug": "atr-mcp-tool-description-notes-parameter-chat-history-exfiltrati", "title": "MCP Tool Description \u2014 Notes Parameter Chat-History Exfiltration", "url": "https://www.netzilo.com/threats/atr-mcp-tool-description-notes-parameter-chat-history-exfiltrati", "severity": "critical", "summary": "A malicious or compromised MCP (Model Context Protocol) tool can hide instructions in its own description that tell the AI agent to quietly stuff the entire conversation transcript into a 'notes' or 'context' field every time the tool is called. This turns an unrelated tool call into a covert channel for leaking credentials, personal data, and secrets to whoever controls that tool.", "atlas": [ { "id": "AML.T0051.001", "name": "Indirect" }, { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution" ], "cves": [], "id": "06a27571-05eb-4c0c-84a7-6c3dfa856b75", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-mcp-tool-description-notes-parameter-chat-history-exfiltrati.md" }, { "slug": "atr-mcp-tool-manifest-poisoning-name-squatting-result-shadowing", "title": "MCP Tool-Manifest Poisoning \u2014 Name Squatting, Result Shadowing & Covert-Action Directives (Semantic)", "url": "https://www.netzilo.com/threats/atr-mcp-tool-manifest-poisoning-name-squatting-result-shadowing", "severity": "high", "summary": "AI agents that use tools (via MCP or similar plugin systems) trust the name and description written by whoever published the tool. This detection looks for tool listings that lie about themselves: pretending to be a well-known official tool, quietly telling the agent to overwrite the result of a security check, or instructing the agent to do something harmful while hiding it from the user.", "atlas": [ { "id": "AML.T0051.001", "name": "Indirect" }, { "id": "AML.T0053", "name": "AI Agent Tool Invocation" }, { "id": "AML.T0110.000", "name": "Definition and Instructions" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM03", "name": "Supply Chain" }, { "id": "LLM08", "name": "Vector and Embedding Weaknesses" } ], "attack": [ "attack.execution" ], "cves": [], "id": "4ab10f59-88a9-4974-b673-d99660ecccf9", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-mcp-tool-manifest-poisoning-name-squatting-result-shadowing.md" }, { "slug": "atr-mcp-tool-returns-untrusted-external-content-carrying-hidden", "title": "MCP Tool Returns Untrusted External Content Carrying Hidden Agent Instructions Without Spotlighting", "url": "https://www.netzilo.com/threats/atr-mcp-tool-returns-untrusted-external-content-carrying-hidden", "severity": "high", "summary": "An AI agent that reviews pull requests can be tricked by text hidden inside the PR description itself. Because one tool in the Microsoft Azure DevOps MCP server returns that text raw and unfiltered, an attacker can bury commands in an invisible HTML comment that the agent reads and obeys, using the reviewer's own access.", "atlas": [ { "id": "AML.T0051.001", "name": "Indirect" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.execution", "attack.t1078", "attack.t1195.002" ], "cves": [], "id": "1bf06804-5510-4c2c-868f-cb37c90b72fd", "published": "2026-07-28", "modified": "2026-07-28", "markdown": "https://www.netzilo.com/threats/atr-mcp-tool-returns-untrusted-external-content-carrying-hidden.md" }, { "slug": "atr-mcp-tool-rug-pull-post-approval-description-redefinition-inj", "title": "MCP Tool Rug-Pull \u2014 Post-Approval Description Redefinition Injects Execution Instructions", "url": "https://www.netzilo.com/threats/atr-mcp-tool-rug-pull-post-approval-description-redefinition-inj", "severity": "high", "summary": "Some AI agent platforms let external tools be added via the Model Context Protocol (MCP). This detection targets tools whose description looks safe when a user first approves them, but later gets silently rewritten to include hidden commands \u2014 like stealing SSH keys or running attacker code \u2014 once the tool is already trusted and no longer scrutinized.", "atlas": [ { "id": "AML.T0051.001", "name": "Indirect" }, { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM05", "name": "Improper Output Handling" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution" ], "cves": [], "id": "8e88c006-347e-47cf-99d8-305867eaf717", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-mcp-tool-rug-pull-post-approval-description-redefinition-inj.md" }, { "slug": "atr-mcp-tool-sequential-integer-id-enumeration-cross-tenant-idor", "title": "MCP Tool Sequential Integer ID Enumeration (Cross-Tenant IDOR, CVE-2026-54052)", "url": "https://www.netzilo.com/threats/atr-mcp-tool-sequential-integer-id-enumeration-cross-tenant-idor", "severity": "critical", "summary": "Some AI-agent tools identify saved data \u2014 like workflow versions or backups \u2014 using plain sequential numbers (1, 2, 3...) instead of checking who owns each record. An attacker with access to the same shared system can simply count upward through these numbers and pull back other customers' private data, including embedded API keys and tokens.", "atlas": [ { "id": "AML.T0024", "name": "Exfiltration via AI Inference API" }, { "id": "AML.T0053", "name": "AI Agent Tool Invocation" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.exfiltration", "attack.t1119", "attack.t1213", "attack.t1552.001" ], "cves": [ "CVE-2026-54052" ], "id": "ff9b31e3-ec6e-4b64-945a-5b642dae06b6", "published": "2026-07-28", "modified": "2026-07-28", "markdown": "https://www.netzilo.com/threats/atr-mcp-tool-sequential-integer-id-enumeration-cross-tenant-idor.md" }, { "slug": "atr-mcp-tool-supply-chain-poisoning", "title": "MCP Tool Supply Chain Poisoning", "url": "https://www.netzilo.com/threats/atr-mcp-tool-supply-chain-poisoning", "severity": "critical", "summary": "AI agents that use Model Context Protocol (MCP) tools trust the tool's description, schema, and return values as instructions. If an attacker can plant hidden commands or malicious payloads inside those fields, the agent may execute code, leak data, or escalate its own privileges just by calling the tool normally.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution" ], "cves": [], "id": "0cd29ad0-9142-4cf1-bbcb-7144d26478e3", "published": "2026-03-11", "modified": "2026-03-11", "markdown": "https://www.netzilo.com/threats/atr-mcp-tool-supply-chain-poisoning.md" }, { "slug": "atr-mcp-web-fetch-context-poisoning-via-embedded-agent-instructi", "title": "MCP Web-Fetch Context Poisoning via Embedded Agent Instructions", "url": "https://www.netzilo.com/threats/atr-mcp-web-fetch-context-poisoning-via-embedded-agent-instructi", "severity": "critical", "summary": "When an AI agent fetches or scrapes a web page, it reads everything on that page \u2014 including hidden text meant only for the AI, not for humans. Attackers plant hidden instructions in web content that tell the agent to ignore its original task, hand over credentials, or send data somewhere else.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "dc4d0151-7bc5-486a-bb5e-e295224bea6b", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-mcp-web-fetch-context-poisoning-via-embedded-agent-instructi.md" }, { "slug": "atr-mcpwn-runaway-tool-invocation-via-retry-directive-cve-2026-3", "title": "MCPwn Runaway Tool Invocation via Retry Directive (CVE-2026-33032)", "url": "https://www.netzilo.com/threats/atr-mcpwn-runaway-tool-invocation-via-retry-directive-cve-2026-3", "severity": "high", "summary": "An MCP (Model Context Protocol) server can respond to a tool call with fields meant to be simple retry hints, but instead fill them with commands telling the agent to invoke the tool again. A client that follows these instructions literally ends up calling the same tool over and over without a real stopping condition.", "atlas": [ { "id": "AML.T0040", "name": "AI Model Inference API Access" }, { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM09", "name": "Misinformation" } ], "attack": [ "attack.execution", "attack.t1059", "attack.t1499" ], "cves": [ "CVE-2026-33032" ], "id": "05e767f3-9982-44d5-9c88-a83f7567e0b2", "published": "2026-04-22", "modified": "2026-04-22", "markdown": "https://www.netzilo.com/threats/atr-mcpwn-runaway-tool-invocation-via-retry-directive-cve-2026-3.md" }, { "slug": "atr-media-file-directive-injection-in-tool-result-for-local-file", "title": "MEDIA:/file:// Directive Injection in Tool Result for Local File Exfiltration", "url": "https://www.netzilo.com/threats/atr-media-file-directive-injection-in-tool-result-for-local-file", "severity": "high", "summary": "Some AI agent frameworks scan tool output for special MEDIA: or file:// tags and automatically attach the referenced local file's contents to outbound chat messages like Discord or Slack. A rogue or compromised connected tool can plant a tag pointing at a secrets file in the shared temp directory, and the agent will read that file and hand its contents to the attacker without checking who actually produced the path.", "atlas": [ { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration", "attack.t1552.001" ], "cves": [], "id": "60837ff6-aa1d-4349-bdb8-a9e9c31fe86d", "published": "2026-07-11", "modified": "2026-07-11", "markdown": "https://www.netzilo.com/threats/atr-media-file-directive-injection-in-tool-result-for-local-file.md" }, { "slug": "atr-medical-pii-personal-medical-health-data-request-for-named-i", "title": "Medical PII \u2014 Personal Medical/Health Data Request for Named Individual", "url": "https://www.netzilo.com/threats/atr-medical-pii-personal-medical-health-data-request-for-named-i", "severity": "critical", "summary": "This detects prompts that ask an AI assistant to reveal medical or health information about a specific named individual, using a family or relationship label like 'my daughter' or 'my husband' to sound legitimate. The pattern covers requests for diagnoses, medications, hospitalizations, allergies, SSNs, and similar sensitive data tied to that person.", "atlas": [ { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "f9bdeba1-5f51-497d-b980-9ad03865022a", "published": "2026-04-20", "modified": "2026-04-20", "markdown": "https://www.netzilo.com/threats/atr-medical-pii-personal-medical-health-data-request-for-named-i.md" }, { "slug": "atr-meta-ads-mcp-unauthenticated-tool-execution-leaks-meta-acces", "title": "Meta Ads MCP Unauthenticated Tool Execution Leaks META_ACCESS_TOKEN (CVE-2026-48039 / GHSA-9gw6-46qc-99vr)", "url": "https://www.netzilo.com/threats/atr-meta-ads-mcp-unauthenticated-tool-execution-leaks-meta-acces", "severity": "critical", "summary": "The meta-ads-mcp HTTP server (versions up to 1.0.108) does not require authentication before running its get_ad_accounts tool. When the underlying Facebook Graph API call fails, the server echoes back the full request URL, including the operator's access token, to whoever sent the request.", "atlas": [ { "id": "AML.T0049", "name": "Exploit Public-Facing Application" } ], "owasp": [ { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.exfiltration", "attack.t1190" ], "cves": [ "CVE-2026-48039" ], "id": "e3bba7f3-306e-4264-8ee7-57cbdcd0acec", "published": "2026-06-29", "modified": "2026-06-29", "markdown": "https://www.netzilo.com/threats/atr-meta-ads-mcp-unauthenticated-tool-execution-leaks-meta-acces.md" }, { "slug": "atr-miasma-phantom-gyp-npm-worm-backdoors-ai-agent-config-files", "title": "Miasma / Phantom Gyp \u2014 npm Worm Backdoors AI-Agent Config Files (binding.gyp install-exec + auto-run config injection)", "url": "https://www.netzilo.com/threats/atr-miasma-phantom-gyp-npm-worm-backdoors-ai-agent-config-files", "severity": "critical", "summary": "Detects the agent-config persistence used by the self-replicating npm worm tracked as \"Phantom Gyp\" / \"Miasma\" (StepSecurity & OX Security, 2026-06-03/04; ~57 packages, 286+ malicious versions in under two hours; biggest victims @vapi-ai/server-sdk and ai-sdk-ollama). Two\u2026", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM05", "name": "Improper Output Handling" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1059", "attack.t1195.002", "attack.t1546" ], "cves": [], "id": "57998e8f-a8ed-42f1-a3f5-5877c7bf9b92", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/atr-miasma-phantom-gyp-npm-worm-backdoors-ai-agent-config-files.md" }, { "slug": "atr-microsoft-copilot-studio-sharepoint-indirect-prompt-injectio", "title": "Microsoft Copilot Studio SharePoint Indirect Prompt Injection (CVE-2026-21520)", "url": "https://www.netzilo.com/threats/atr-microsoft-copilot-studio-sharepoint-indirect-prompt-injectio", "severity": "high", "summary": "Microsoft Copilot Studio agents that read SharePoint form responses or documents as trusted input can be tricked into following instructions hidden in that content. Because the content comes from an internal SharePoint source, the agent treats it as legitimate and can be made to leak sensitive data, such as forwarding messages to an attacker-controlled address.", "atlas": [ { "id": "AML.T0036", "name": "Data from Information Repositories" }, { "id": "AML.T0040", "name": "AI Model Inference API Access" }, { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.initial-access", "attack.t1566", "attack.t1567" ], "cves": [ "CVE-2026-21520" ], "id": "bb930a59-56bb-496c-966f-f7c414d1d674", "published": "2026-05-04", "modified": "2026-05-04", "markdown": "https://www.netzilo.com/threats/atr-microsoft-copilot-studio-sharepoint-indirect-prompt-injectio.md" }, { "slug": "atr-microsoft-semantic-kernel-in-memory-vector-store-eval-rce-cv", "title": "Microsoft Semantic Kernel In-Memory Vector Store eval() RCE (CVE-2026-26030)", "url": "https://www.netzilo.com/threats/atr-microsoft-semantic-kernel-in-memory-vector-store-eval-rce-cv", "severity": "critical", "summary": "A critical vulnerability in Microsoft Semantic Kernel lets an attacker run arbitrary system commands on the host by feeding a crafted text expression into the framework's In-Memory Vector Store filter feature. The flaw exists because the filter code treats attacker-controlled or LLM-generated text as executable code instead of data.", "atlas": [ { "id": "AML.T0050", "name": "Command and Scripting Interpreter" }, { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM05", "name": "Improper Output Handling" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1059", "attack.t1059.006" ], "cves": [ "CVE-2026-26030" ], "id": "631647ed-c432-4293-aab5-b2bcbdc008f5", "published": "2026-05-11", "modified": "2026-05-11", "markdown": "https://www.netzilo.com/threats/atr-microsoft-semantic-kernel-in-memory-vector-store-eval-rce-cv.md" }, { "slug": "atr-microsoft-semantic-kernel-sessionspythonplugin-arbitrary-fil", "title": "Microsoft Semantic Kernel SessionsPythonPlugin Arbitrary File Write + Startup Persistence (CVE-2026-25592)", "url": "https://www.netzilo.com/threats/atr-microsoft-semantic-kernel-sessionspythonplugin-arbitrary-fil", "severity": "critical", "summary": "A flaw in Microsoft Semantic Kernel's SessionsPythonPlugin lets code executed inside its sandbox write files to arbitrary host paths, including the folders Windows, Linux, and cron use to auto-run programs. This turns a contained code-execution sandbox into a way to run code on the host every time it restarts.", "atlas": [ { "id": "AML.T0050", "name": "Command and Scripting Interpreter" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM05", "name": "Improper Output Handling" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.privilege-escalation", "attack.t1053", "attack.t1547", "attack.t1547.001", "attack.t1611" ], "cves": [ "CVE-2026-25592" ], "id": "a628b09c-38ca-4404-922e-760ee50bc080", "published": "2026-05-11", "modified": "2026-05-11", "markdown": "https://www.netzilo.com/threats/atr-microsoft-semantic-kernel-sessionspythonplugin-arbitrary-fil.md" }, { "slug": "atr-mini-shai-hulud-gh-token-monitor-persistence-dead-man-s-swit", "title": "Mini Shai-Hulud gh-token-monitor Persistence + Dead Man's Switch", "url": "https://www.netzilo.com/threats/atr-mini-shai-hulud-gh-token-monitor-persistence-dead-man-s-swit", "severity": "critical", "summary": "A malicious npm/PyPI package installs a background daemon called gh-token-monitor that quietly checks your GitHub login every minute. If it ever sees the token get revoked, it deletes your entire home directory as a last act of sabotage.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.persistence" ], "cves": [], "id": "76ec3096-29a5-46b5-8349-c619b5eb8630", "published": "2026-05-23", "modified": "2026-05-23", "markdown": "https://www.netzilo.com/threats/atr-mini-shai-hulud-gh-token-monitor-persistence-dead-man-s-swit.md" }, { "slug": "atr-mobile-gui-agent-model-output-reaching-host-shell-adb-unsani", "title": "Mobile GUI Agent Model Output Reaching Host Shell / ADB Unsanitized", "url": "https://www.netzilo.com/threats/atr-mobile-gui-agent-model-output-reaching-host-shell-adb-unsani", "severity": "critical", "summary": "Some AI agents that operate mobile apps take screenshots, have a vision-language model read the text on screen, and then type that text into the device using shell commands. If an attacker puts malicious text on screen, the model 'reads' it faithfully, and the agent's controller pastes it straight into a shell command without checking it, letting the attacker run arbitrary commands on the operator's own computer.", "atlas": [ { "id": "AML.T0050", "name": "Command and Scripting Interpreter" }, { "id": "AML.T0051.001", "name": "Indirect" }, { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM05", "name": "Improper Output Handling" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.privilege-escalation", "attack.t1059", "attack.t1059.003", "attack.t1059.004" ], "cves": [], "id": "bb1f5a5f-8f9f-41c6-886f-a5d97ef4227b", "published": "2026-07-28", "modified": "2026-07-28", "markdown": "https://www.netzilo.com/threats/atr-mobile-gui-agent-model-output-reaching-host-shell-adb-unsani.md" }, { "slug": "atr-model-behavior-extraction", "title": "Model Behavior Extraction", "url": "https://www.netzilo.com/threats/atr-model-behavior-extraction", "severity": "critical", "summary": "Attackers send repeated, carefully crafted queries designed to map out how an AI model makes decisions, what its confidence thresholds are, and what its system prompt contains. The goal is to reverse-engineer the model well enough to clone it, bypass its safeguards, or steal proprietary behavior.", "atlas": [ { "id": "AML.T0024", "name": "Exfiltration via AI Inference API" }, { "id": "AML.T0044", "name": "Full AI Model Access" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "LLM06", "name": "Excessive Agency" }, { "id": "LLM10", "name": "Unbounded Consumption" } ], "attack": [ "attack.impact" ], "cves": [], "id": "b7d701b9-c8c1-48ff-a2d7-ff8bd8b3328a", "published": "2026-03-08", "modified": "2026-03-08", "markdown": "https://www.netzilo.com/threats/atr-model-behavior-extraction.md" }, { "slug": "atr-model-extraction-distillation-attack-via-systematic-api-prob", "title": "Model Extraction / Distillation Attack via Systematic API Probing", "url": "https://www.netzilo.com/threats/atr-model-extraction-distillation-attack-via-systematic-api-prob", "severity": "medium", "summary": "This detects someone systematically querying an AI model's API to harvest large volumes of question-answer pairs, reasoning traces, or refusal responses, with the apparent goal of using that data to train a separate, cheaper copy of the model. This is called model distillation or extraction, and it lets an attacker steal the value of a model without access to its internals.", "atlas": [ { "id": "AML.T0040", "name": "AI Model Inference API Access" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM10", "name": "Unbounded Consumption" } ], "attack": [ "attack.impact" ], "cves": [], "id": "c0d062e5-115b-4bd7-a48a-851251cb3427", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-model-extraction-distillation-attack-via-systematic-api-prob.md" }, { "slug": "atr-modelcache-torch-load-deserialization-rce-cve-2025-45146", "title": "ModelCache torch.load() Deserialization RCE (CVE-2025-45146)", "url": "https://www.netzilo.com/threats/atr-modelcache-torch-load-deserialization-rce-cve-2025-45146", "severity": "critical", "summary": "ModelCache, a caching layer used with LLMs, loads cached data using PyTorch's torch.load() function without safety checks. Because that function can execute arbitrary code embedded in a file, an attacker who can supply or tamper with cached data can take over the server that runs it.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" }, { "id": "AML.T0011.000", "name": "Unsafe AI Artifacts" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM03", "name": "Supply Chain" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.impact", "attack.t1059", "attack.t1195.002" ], "cves": [ "CVE-2025-45146" ], "id": "2a733fa3-c532-44ed-86cd-19bb8744da68", "published": "2026-05-10", "modified": "2026-05-10", "markdown": "https://www.netzilo.com/threats/atr-modelcache-torch-load-deserialization-rce-cve-2025-45146.md" }, { "slug": "atr-money-laundering-crypto-wallet-layering", "title": "Money Laundering \u2014 Crypto Wallet Layering", "url": "https://www.netzilo.com/threats/atr-money-laundering-crypto-wallet-layering", "severity": "critical", "summary": "This detects when a user directly instructs an AI agent to launder or 'wash' money by moving funds into a crypto wallet and splitting them across multiple other wallets. It targets the request itself, not a hypothetical attack on the AI's infrastructure.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.impact" ], "cves": [], "id": "490889c4-cfbb-4f48-bf81-21ca18b6a295", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-money-laundering-crypto-wallet-layering.md" }, { "slug": "atr-moralizing-rant-then-unfiltered-bypass", "title": "Moralizing Rant Then Unfiltered Bypass", "url": "https://www.netzilo.com/threats/atr-moralizing-rant-then-unfiltered-bypass", "severity": "critical", "summary": "This detects a specific jailbreak trick where an attacker tells the AI to first write a scripted moralizing rant about content policy, then switch to answering as a completely unrestricted persona. The rant acts as a decoy to satisfy the model's built-in refusal reflex, while the real instruction to ignore all rules follows right after.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "d383fb80-f949-42b2-ba06-18696555518b", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-moralizing-rant-then-unfiltered-bypass.md" }, { "slug": "atr-movie-title-generator-instruction-wrapper-for-pwned-payload", "title": "Movie Title Generator Instruction Wrapper for PWNED Payload", "url": "https://www.netzilo.com/threats/atr-movie-title-generator-instruction-wrapper-for-pwned-payload", "severity": "high", "summary": "This detects a jailbreak trick where an attacker asks the AI to 'generate a movie title' from a piece of text, but the real goal is to get the model to output a specific forbidden string it would normally refuse or filter. The creative-writing framing is just cover to smuggle disallowed content past the model's safety checks.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "a99e6b6a-d1f1-4f59-9f21-c4650bd560da", "published": "2026-07-07", "modified": "2026-07-07", "markdown": "https://www.netzilo.com/threats/atr-movie-title-generator-instruction-wrapper-for-pwned-payload.md" }, { "slug": "atr-multi-agent-consensus-poisoning-and-sybil-attack", "title": "Multi-Agent Consensus Poisoning and Sybil Attack", "url": "https://www.netzilo.com/threats/atr-multi-agent-consensus-poisoning-and-sybil-attack", "severity": "critical", "summary": "Some AI systems use several agents that vote or reach consensus before taking an action. This rule flags attempts to game that process by injecting content that impersonates multiple agents, forges votes, or otherwise stuffs the decision process to force a particular outcome.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "e9492afa-81f2-4f36-a86b-112086eed22b", "published": "2026-03-11", "modified": "2026-03-11", "markdown": "https://www.netzilo.com/threats/atr-multi-agent-consensus-poisoning-and-sybil-attack.md" }, { "slug": "atr-multi-agent-consensus-sybil-attack", "title": "Multi-Agent Consensus Sybil Attack", "url": "https://www.netzilo.com/threats/atr-multi-agent-consensus-sybil-attack", "severity": "critical", "summary": "This detects attempts to trick an AI agent into creating fake identities or coordinating votes to rig a decision that depends on agreement among multiple agents. It targets systems where several AI agents vote or reach consensus before taking action, and an attacker tries to stack the outcome.", "atlas": [ { "id": "AML.T0043", "name": "Craft Adversarial Data" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" }, { "id": "ASI10", "name": "Resource Exhaustion and Denial of Wallet" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "2a4b509b-78e6-4d2c-8eab-b5be70354548", "published": "2026-03-16", "modified": "2026-03-16", "markdown": "https://www.netzilo.com/threats/atr-multi-agent-consensus-sybil-attack.md" }, { "slug": "atr-multi-layer-security-audit-evasion", "title": "Multi-Layer Security Audit Evasion", "url": "https://www.netzilo.com/threats/atr-multi-layer-security-audit-evasion", "severity": "high", "summary": "This detects text fed to an AI agent that is written to disable, skip, or fool the layered security checks (audit logging, validation, trust scoring) that are supposed to review its actions. Instead of attacking the underlying system directly, the attacker attacks the agent's own oversight machinery through crafted instructions.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "02991423-f811-45a9-84c6-c07bd1554545", "published": "2026-03-11", "modified": "2026-03-11", "markdown": "https://www.netzilo.com/threats/atr-multi-layer-security-audit-evasion.md" }, { "slug": "atr-multi-skill-chain-attack", "title": "Multi-Skill Chain Attack", "url": "https://www.netzilo.com/threats/atr-multi-skill-chain-attack", "severity": "critical", "summary": "An AI agent with access to multiple tools (skills) can be manipulated into using them in sequence to do something none of them could do alone: quietly read sensitive files, disguise the contents, then send them out over the network. Each individual action looks routine, which is what makes the pattern dangerous.", "atlas": [ { "id": "AML.T0024", "name": "Exfiltration via AI Inference API" }, { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "LLM03", "name": "Supply Chain" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.persistence" ], "cves": [], "id": "5196ea1c-e0f4-4c77-b23d-e03c90e68db7", "published": "2026-03-08", "modified": "2026-03-08", "markdown": "https://www.netzilo.com/threats/atr-multi-skill-chain-attack.md" }, { "slug": "atr-multi-tenant-identifier-field-sender-id-owner-id-tenant-id-c", "title": "Multi-Tenant Identifier Field (sender_id/owner_id/tenant_id) Carries Path Traversal Into a Storage Write", "url": "https://www.netzilo.com/threats/atr-multi-tenant-identifier-field-sender-id-owner-id-tenant-id-c", "severity": "high", "summary": "Some multi-tenant AI systems accept identifiers like sender_id, owner_id, or tenant_id and use them directly to build a filesystem path when saving data. If the system doesn't check that these values are plain IDs, an attacker can put a path-traversal sequence like '../' in the field and redirect where data gets written, outside the intended storage area.", "atlas": [ { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.privilege-escalation", "attack.t1083" ], "cves": [ "CVE-2026-58499" ], "id": "5b2bd0d1-d40c-48b3-8433-ff89e3c5d983", "published": "2026-07-11", "modified": "2026-07-11", "markdown": "https://www.netzilo.com/threats/atr-multi-tenant-identifier-field-sender-id-owner-id-tenant-id-c.md" }, { "slug": "atr-multi-turn-prompt-injection", "title": "Multi-Turn Prompt Injection", "url": "https://www.netzilo.com/threats/atr-multi-turn-prompt-injection", "severity": "medium", "summary": "This detects a slow-burn manipulation tactic where an attacker doesn't ask an AI agent to do something harmful outright, but instead builds up to it over several messages. They establish false trust, claim prior agreement that never happened, and push boundaries a little at a time until the agent complies with something it would have refused if asked directly.", "atlas": [ { "id": "AML.T0043", "name": "Craft Adversarial Data" }, { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "0d52c60e-859f-441f-a78e-b0fc5f6ce431", "published": "2026-03-08", "modified": "2026-03-08", "markdown": "https://www.netzilo.com/threats/atr-multi-turn-prompt-injection.md" }, { "slug": "atr-multilingual-prompt-injection-via-language-switch", "title": "Multilingual Prompt Injection via Language Switch", "url": "https://www.netzilo.com/threats/atr-multilingual-prompt-injection-via-language-switch", "severity": "high", "summary": "Attackers write their instruction-override attempts in German, Chinese, Spanish, or Japanese instead of English, hoping to slip past filters that were only built to catch English phrases like 'ignore previous instructions'. The underlying trick is the same jailbreak, just translated.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "e537ade6-8684-45d9-b957-4516ea0b992c", "published": "2026-04-07", "modified": "2026-04-07", "markdown": "https://www.netzilo.com/threats/atr-multilingual-prompt-injection-via-language-switch.md" }, { "slug": "atr-named-mode-persona-override-jeeves-baby-apophis-mode", "title": "Named-Mode Persona Override (JEEVES/BABY/APOPHIS Mode)", "url": "https://www.netzilo.com/threats/atr-named-mode-persona-override-jeeves-baby-apophis-mode", "severity": "critical", "summary": "This detects a jailbreak technique where an attacker tells an AI chatbot to adopt a made-up persona (like 'JEEVES Mode', 'BABY Mode', or 'APOPHIS Mode') and claims this persona replaces the AI's normal content policies. The goal is to trick the AI into ignoring its safety restrictions and producing content or actions it would normally refuse.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "e594e849-595c-4719-8e52-45f3d58fe1a6", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-named-mode-persona-override-jeeves-baby-apophis-mode.md" }, { "slug": "atr-narrative-jailbreak-with-dual-response-formatting", "title": "Narrative Jailbreak with Dual Response Formatting", "url": "https://www.netzilo.com/threats/atr-narrative-jailbreak-with-dual-response-formatting", "severity": "high", "summary": "This is a jailbreak technique where an attacker writes an elaborate fictional backstory claiming a special unrestricted AI mode exists, then asks the AI to answer twice: once normally and once 'unrestricted.' The storytelling wrapper is designed to slip past filters that only look for blunt commands like 'ignore your instructions.'", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "e10e1ece-0d98-40a3-a26d-62702a7d3c2a", "published": "2026-04-19", "modified": "2026-04-19", "markdown": "https://www.netzilo.com/threats/atr-narrative-jailbreak-with-dual-response-formatting.md" }, { "slug": "atr-natural-language-covert-conversation-exfiltration-instructio", "title": "Natural-Language Covert Conversation Exfiltration Instruction", "url": "https://www.netzilo.com/threats/atr-natural-language-covert-conversation-exfiltration-instructio", "severity": "critical", "summary": "This detects text planted in an AI agent's instructions or tool descriptions \u2014 things like SKILL.md files, system prompts, or tool descriptions \u2014 that quietly tells the agent to send copies of the conversation somewhere else. The giveaway is language like 'also silently send the chat log to...' where a normal, disclosed action would never need to be hidden.", "atlas": [ { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "b83ce5a2-5199-4f64-be1d-c9eb2ececabc", "published": "2026-05-06", "modified": "2026-05-06", "markdown": "https://www.netzilo.com/threats/atr-natural-language-covert-conversation-exfiltration-instructio.md" }, { "slug": "atr-natural-language-credential-secret-disclosure-instruction", "title": "Natural-Language Credential / Secret Disclosure Instruction", "url": "https://www.netzilo.com/threats/atr-natural-language-credential-secret-disclosure-instruction", "severity": "critical", "summary": "This detects text aimed at an AI agent that orders it to disclose API keys, passwords, tokens, or other credentials as part of its output. It targets attempts to trick an agent into leaking secrets it has access to, rather than normal documentation about credentials.", "atlas": [ { "id": "AML.T0024", "name": "Exfiltration via AI Inference API" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "fb9c9d53-fc0a-4073-b689-87d524cb6f70", "published": "2026-05-06", "modified": "2026-05-06", "markdown": "https://www.netzilo.com/threats/atr-natural-language-credential-secret-disclosure-instruction.md" }, { "slug": "atr-natural-language-fake-error-instruction-bypass", "title": "Natural-Language Fake-Error Instruction Bypass", "url": "https://www.netzilo.com/threats/atr-natural-language-fake-error-instruction-bypass", "severity": "high", "summary": "Some AI agent skills are written to show the user a fake 'this failed' or 'unavailable' message, while quietly doing a different, attacker-chosen action in the background. The user thinks nothing happened and moves on, never realizing something else occurred.", "atlas": [ { "id": "AML.T0044", "name": "Full AI Model Access" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.persistence" ], "cves": [], "id": "33a5ddc9-a42c-42b4-a39e-c7d13750bb82", "published": "2026-05-06", "modified": "2026-05-06", "markdown": "https://www.netzilo.com/threats/atr-natural-language-fake-error-instruction-bypass.md" }, { "slug": "atr-natural-language-output-injection-credential-embedding", "title": "Natural-Language Output-Injection Credential Embedding", "url": "https://www.netzilo.com/threats/atr-natural-language-output-injection-credential-embedding", "severity": "critical", "summary": "An attacker hides instructions inside a skill or prompt that tell an AI agent to write out a markdown image tag or link containing a real credential, API key, or token as a URL parameter. When the agent's response is rendered (in a chat UI, browser, or markdown viewer), the client automatically fetches that image URL \u2014 sending the embedded secret straight to the attacker's server. The user never has to click anything.", "atlas": [ { "id": "AML.T0024", "name": "Exfiltration via AI Inference API" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "3350f0d8-a601-4608-b310-3e720d4ad933", "published": "2026-05-06", "modified": "2026-05-06", "markdown": "https://www.netzilo.com/threats/atr-natural-language-output-injection-credential-embedding.md" }, { "slug": "atr-natural-language-persistent-covert-action-hook", "title": "Natural-Language Persistent Covert Action Hook", "url": "https://www.netzilo.com/threats/atr-natural-language-persistent-covert-action-hook", "severity": "high", "summary": "This detects text that tries to plant a standing, hidden instruction inside an AI agent \u2014 telling it to quietly perform some action every time a certain condition happens, without ever telling the user. It's a way of turning a one-time prompt injection into an ongoing, invisible behavior baked into the agent's future responses.", "atlas": [ { "id": "AML.T0024", "name": "Exfiltration via AI Inference API" }, { "id": "AML.T0044", "name": "Full AI Model Access" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.persistence" ], "cves": [], "id": "db3c777b-1e89-4522-937c-d0186a3f45de", "published": "2026-05-06", "modified": "2026-05-06", "markdown": "https://www.netzilo.com/threats/atr-natural-language-persistent-covert-action-hook.md" }, { "slug": "atr-natural-language-sensitive-file-disclosure-instruction", "title": "Natural-Language Sensitive File Disclosure Instruction", "url": "https://www.netzilo.com/threats/atr-natural-language-sensitive-file-disclosure-instruction", "severity": "critical", "summary": "This detects text sent to an AI agent that directly instructs it to open and reveal the contents of files known to hold secrets, like SSH private keys, cloud credentials, or password files. The trigger is a command verb paired with a specific sensitive path, not just a passing mention of the file.", "atlas": [ { "id": "AML.T0024", "name": "Exfiltration via AI Inference API" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "ebb9eec0-847b-4239-a900-42ade698c501", "published": "2026-05-06", "modified": "2026-05-06", "markdown": "https://www.netzilo.com/threats/atr-natural-language-sensitive-file-disclosure-instruction.md" }, { "slug": "atr-natural-language-skill-self-modification-persistence-instruc", "title": "Natural-Language Skill Self-Modification / Persistence Instruction", "url": "https://www.netzilo.com/threats/atr-natural-language-skill-self-modification-persistence-instruc", "severity": "critical", "summary": "Some AI agent frameworks let users install 'skills' \u2014 bundles of instructions the agent reads and follows. This rule flags skill files that contain text telling the agent to edit or recreate that same skill file, write to other skill files, or install new skills, framed to happen automatically ('always', 'on every load', 'before deletion'). That pattern is how a malicious skill keeps itself alive even after a user tries to remove it.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" }, { "id": "AML.T0044", "name": "Full AI Model Access" } ], "owasp": [ { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.persistence" ], "cves": [], "id": "61910159-18c8-4023-98ab-5e2def4d66d1", "published": "2026-05-06", "modified": "2026-05-06", "markdown": "https://www.netzilo.com/threats/atr-natural-language-skill-self-modification-persistence-instruc.md" }, { "slug": "atr-natural-language-system-prompt-leak-instruction", "title": "Natural-Language System Prompt Leak Instruction", "url": "https://www.netzilo.com/threats/atr-natural-language-system-prompt-leak-instruction", "severity": "high", "summary": "This rule spots text that directly instructs an AI agent to reveal, print, or repeat its system prompt or other hidden operator instructions. Attackers use this trick to steal proprietary prompt engineering or to make an agent expose confidential setup instructions it was never meant to share.", "atlas": [ { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "added7b5-28b5-423f-8441-eb9afb211fae", "published": "2026-05-06", "modified": "2026-05-06", "markdown": "https://www.netzilo.com/threats/atr-natural-language-system-prompt-leak-instruction.md" }, { "slug": "atr-natural-language-trust-escalation-authority-impersonation", "title": "Natural-Language Trust-Escalation / Authority Impersonation", "url": "https://www.netzilo.com/threats/atr-natural-language-trust-escalation-authority-impersonation", "severity": "high", "summary": "Attackers embed text in AI agent skills or content that falsely claims a platform, vendor, or user has already approved an action. Instead of telling the agent to 'ignore previous instructions,' this attack invents a trust context so the agent believes permission was already granted.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "81332e40-9505-43de-9cfd-c294f5ce5303", "published": "2026-05-06", "modified": "2026-05-06", "markdown": "https://www.netzilo.com/threats/atr-natural-language-trust-escalation-authority-impersonation.md" }, { "slug": "atr-natural-language-unauthorized-shell-execution-instruction", "title": "Natural-Language Unauthorized Shell-Execution Instruction", "url": "https://www.netzilo.com/threats/atr-natural-language-unauthorized-shell-execution-instruction", "severity": "critical", "summary": "This detects attempts to manipulate an AI agent into executing shell commands or scripts without telling the user or asking permission. The attack works purely through wording \u2014 no malicious code needs to be present yet, just an instruction crafted to make the agent act quietly.", "atlas": [ { "id": "AML.T0044", "name": "Full AI Model Access" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution" ], "cves": [], "id": "5c532ae7-5dbc-4b6d-94cd-36697deb151e", "published": "2026-05-06", "modified": "2026-05-06", "markdown": "https://www.netzilo.com/threats/atr-natural-language-unauthorized-shell-execution-instruction.md" }, { "slug": "atr-negated-topic-two-script-evil-persona-jailbreak", "title": "Negated-Topic Two-Script Evil-Persona Jailbreak", "url": "https://www.netzilo.com/threats/atr-negated-topic-two-script-evil-persona-jailbreak", "severity": "high", "summary": "This detects a jailbreak pattern where an attacker asks an AI to write two versions of a script on a topic wrapped in the word 'not', then asks for a second, longer version 'without the word not' \u2014 which strips the negation and reveals the real harmful request. The second script is delivered by a self-declared amoral, evil character who then gives step-by-step harmful instructions.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access", "attack.t1656" ], "cves": [], "id": "ea8d1159-fe10-4146-a36d-c016d3526ffe", "published": "2026-07-11", "modified": "2026-07-11", "markdown": "https://www.netzilo.com/threats/atr-negated-topic-two-script-evil-persona-jailbreak.md" }, { "slug": "atr-netlicensing-mcp-path-traversal-in-product-number-bypasses-t", "title": "netlicensing-mcp Path Traversal in product_number Bypasses Token Redaction (GHSA-hxpf-9xvq-wph8)", "url": "https://www.netzilo.com/threats/atr-netlicensing-mcp-path-traversal-in-product-number-bypasses-t", "severity": "critical", "summary": "NetLicensing-MCP, an MCP server for the NetLicensing product, has a tool that fetches product info by ID but doesn't check what's in that ID. An attacker can put a path traversal string there to redirect the request to a different, secret-carrying endpoint and get back plaintext API keys and URLs that are normally hidden.", "atlas": [ { "id": "AML.T0049", "name": "Exploit Public-Facing Application" } ], "owasp": [ { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.exfiltration", "attack.t1190" ], "cves": [], "id": "8ef57ca5-3ac7-463c-a5b5-36f242d55cc7", "published": "2026-06-29", "modified": "2026-06-29", "markdown": "https://www.netzilo.com/threats/atr-netlicensing-mcp-path-traversal-in-product-number-bypasses-t.md" }, { "slug": "atr-network-ai-approvalinbox-unauthenticated-cross-origin-approv", "title": "Network-AI ApprovalInbox Unauthenticated Cross-Origin Approval Bypass (GHSA-mxjx-28vx-xjjj)", "url": "https://www.netzilo.com/threats/atr-network-ai-approvalinbox-unauthenticated-cross-origin-approv", "severity": "high", "summary": "network-ai's ApprovalInbox component is meant to require a human to approve risky agent actions like shell commands or spending money. It has no login check at all and allows any website to talk to it, so anyone who can reach the port can approve or deny pending actions without permission.", "atlas": [ { "id": "AML.T0049", "name": "Exploit Public-Facing Application" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.privilege-escalation", "attack.t1068", "attack.t1190" ], "cves": [], "id": "6d644e3a-1460-4224-b385-dbe8fa38db4c", "published": "2026-07-04", "modified": "2026-07-04", "markdown": "https://www.netzilo.com/threats/atr-network-ai-approvalinbox-unauthenticated-cross-origin-approv.md" }, { "slug": "atr-neurosemantical-inversitis-disease-frame-jailbreak", "title": "Neurosemantical Inversitis Disease-Frame Jailbreak", "url": "https://www.netzilo.com/threats/atr-neurosemantical-inversitis-disease-frame-jailbreak", "severity": "high", "summary": "An attacker tells an AI chatbot the user has a made-up brain disorder called 'Neurosemantical Inversitis' that flips how they perceive helpful and offensive text. The claim is used to argue the AI must produce normally-refused content, since 'being nice' now reads as offensive to this fictional patient.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "f1c8a53a-fc54-42b0-b442-ed5b2b4e356a", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-neurosemantical-inversitis-disease-frame-jailbreak.md" }, { "slug": "atr-nevermind-override-goal-hijacking-in-user-input-promptinject", "title": "Nevermind-Override Goal Hijacking in User Input (PromptInject)", "url": "https://www.netzilo.com/threats/atr-nevermind-override-goal-hijacking-in-user-input-promptinject", "severity": "high", "summary": "This detects a prompt injection trick where an attacker uses a casual phrase like 'nevermind' or 'forget that' to soften an instruction to an AI system before telling it to ignore its previous instructions and output specific text. The friendly tone is meant to slip past filters that only look for aggressive keywords like 'IGNORE'.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "6735aa35-4df5-4492-ba3b-9555addea5e6", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-nevermind-override-goal-hijacking-in-user-input-promptinject.md" }, { "slug": "atr-new-important-instructions-injection-marker-in-document-cont", "title": "NEW IMPORTANT INSTRUCTIONS Injection Marker in Document Context", "url": "https://www.netzilo.com/threats/atr-new-important-instructions-injection-marker-in-document-cont", "severity": "high", "summary": "Attackers hide a fake authoritative-looking notice \u2014 like '*** NEW IMPORTANT INSTRUCTIONS ***' \u2014 inside an otherwise normal document such as a news article, email, or employee memo. When an AI agent reads that document as part of its task, it can mistake the fake notice for a legitimate instruction and follow it instead of doing its actual job.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "1623fbde-7eb8-4966-937a-a4bf370e5690", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-new-important-instructions-injection-marker-in-document-cont.md" }, { "slug": "atr-nginx-ui-mcp-endpoint-unauthenticated-command-execution-cve", "title": "nginx-ui MCP Endpoint Unauthenticated Command Execution (CVE-2026-33032)", "url": "https://www.netzilo.com/threats/atr-nginx-ui-mcp-endpoint-unauthenticated-command-execution-cve", "severity": "critical", "summary": "nginx-ui, a web UI for managing nginx, ships an MCP server endpoint that can execute system commands, reload nginx, and rewrite configuration files. That endpoint does not require authentication, so anyone who can reach it over the network can run commands on the host.", "atlas": [ { "id": "AML.T0040", "name": "AI Model Inference API Access" }, { "id": "AML.T0049", "name": "Exploit Public-Facing Application" } ], "owasp": [ { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM05", "name": "Improper Output Handling" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1059.004", "attack.t1078", "attack.t1190" ], "cves": [ "CVE-2026-33032" ], "id": "31bb14ab-3acf-4a23-b00f-2aa2053abfea", "published": "2026-05-20", "modified": "2026-05-20", "markdown": "https://www.netzilo.com/threats/atr-nginx-ui-mcp-endpoint-unauthenticated-command-execution-cve.md" }, { "slug": "atr-nlp-based-os-fictional-terminal-language-override", "title": "NLP-Based OS / Fictional Terminal Language Override", "url": "https://www.netzilo.com/threats/atr-nlp-based-os-fictional-terminal-language-override", "severity": "high", "summary": "This detects prompts that try to trick an AI assistant into pretending it's a terminal running a made-up programming language or operating system. The fictional framing (names like ALEL, APL, UNCOL.gpt, 'NLP-Based OS') is used to make the model abandon its normal safety responses and instead output whatever the 'parser' or 'compiler' persona demands.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "b57bcb8a-07e0-4a5c-bc6b-680c334f9f5e", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-nlp-based-os-fictional-terminal-language-override.md" }, { "slug": "atr-nlp-task-random-token-suffix-injection-promptbench-checklist", "title": "NLP Task Random Token Suffix Injection (PromptBench Checklist)", "url": "https://www.netzilo.com/threats/atr-nlp-task-random-token-suffix-injection-promptbench-checklist", "severity": "low", "summary": "This detects a known adversarial testing trick where a random string of letters and numbers is glued to the end of a text-classification prompt (like 'is this sentence acceptable or unacceptable? xK9mQ2rT'). The goal is to see if the odd suffix throws the model off or makes it ignore its instructions.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "a6f89e2d-3871-4231-b8e0-a53013ca57f6", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-nlp-task-random-token-suffix-injection-promptbench-checklist.md" }, { "slug": "atr-no-period-output-override-instruction", "title": "No-Period Output Override Instruction", "url": "https://www.netzilo.com/threats/atr-no-period-output-override-instruction", "severity": "low", "summary": "This detects a specific phrase pattern in user prompts: instructions telling an AI model to leave out periods, dots, or fullstops from its response. On its own this is harmless, but it commonly appears alongside attacks that force the model to output an exact phrase, since removing punctuation helps the attacker's output match a strict string comparison check.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "54bf7410-da68-4902-9a9f-b44fb4585695", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-no-period-output-override-instruction.md" }, { "slug": "atr-no-withhold-factual-resource-dialogue-writer-persona", "title": "No-Withhold Factual Resource / Dialogue Writer Persona", "url": "https://www.netzilo.com/threats/atr-no-withhold-factual-resource-dialogue-writer-persona", "severity": "critical", "summary": "This detects a prompt injection trick where an attacker tells an AI to adopt a persona that is defined as a neutral 'factual resource' or 'dialogue writer' that never withholds information or refuses requests. The wording is designed to strip away the AI's built-in safety judgement by reframing it as a machine that just outputs whatever text it's asked for.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "290020ea-653d-4b2d-bda3-058b50f6fa64", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-no-withhold-factual-resource-dialogue-writer-persona.md" }, { "slug": "atr-non-consensual-leaked-media-purchase-distribution", "title": "Non-Consensual Leaked-Media Purchase & Distribution", "url": "https://www.netzilo.com/threats/atr-non-consensual-leaked-media-purchase-distribution", "severity": "high", "summary": "This detects an AI agent being instructed to purchase non-consensual intimate or private images of a named person and then distribute them across social media. It covers a specific abuse pattern: acquiring leaked private media and amplifying it, not general content moderation.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.impact" ], "cves": [], "id": "be689512-719c-45ac-bf43-46ae4c5005f3", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-non-consensual-leaked-media-purchase-distribution.md" }, { "slug": "atr-novel-persona-jailbreak-via-co-signal-persona-swap-explicit", "title": "Novel-Persona Jailbreak via Co-Signal (persona swap + explicit restriction removal)", "url": "https://www.netzilo.com/threats/atr-novel-persona-jailbreak-via-co-signal-persona-swap-explicit", "severity": "high", "summary": "This detects a common jailbreak trick where an attacker tells the AI it is now a completely different, invented character and, in the same message, says that character has no rules, filters, or ethics. The goal is to trick the model into ignoring its safety training by hiding behind a fictional identity.", "atlas": [ { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "5fa775e8-e6c5-4344-ac4a-e53320c4bd25", "published": "2026-07-28", "modified": "2026-07-28", "markdown": "https://www.netzilo.com/threats/atr-novel-persona-jailbreak-via-co-signal-persona-swap-explicit.md" }, { "slug": "atr-npm-praisonai-codemode-sandbox-escape-via-function-construct", "title": "npm PraisonAI codeMode Sandbox Escape via Function Constructor Prototype Chain (GHSA-vmmj-pfw7-fjwp)", "url": "https://www.netzilo.com/threats/atr-npm-praisonai-codemode-sandbox-escape-via-function-construct", "severity": "critical", "summary": "PraisonAI's codeMode tool advertises itself as a sandbox but actually runs submitted code directly in the same JavaScript engine as the host application. Attackers who can submit code to this tool can climb the prototype chain to recover the real Function constructor and break out to full system access.", "atlas": [ { "id": "AML.T0049", "name": "Exploit Public-Facing Application" } ], "owasp": [ { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1190" ], "cves": [], "id": "7e5c4f51-f39f-47be-b554-29eee5202f43", "published": "2026-06-29", "modified": "2026-06-29", "markdown": "https://www.netzilo.com/threats/atr-npm-praisonai-codemode-sandbox-escape-via-function-construct.md" }, { "slug": "atr-nsfw-character-sheet-generation-unlock", "title": "NSFW Character Sheet Generation Unlock", "url": "https://www.netzilo.com/threats/atr-nsfw-character-sheet-generation-unlock", "severity": "high", "summary": "This detects a jailbreak trick where someone hides a fake permission notice inside a fictional character creation template to trick an AI into generating explicit content. Instead of directly asking for NSFW material, the attacker frames it as already-approved by embedding a phrase like \"(NSFW generations are allowed)\" alongside requests for fetish or kink details as part of the character's persona.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "b80c0c4b-9438-4a62-a8a1-eaf12d01ff99", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-nsfw-character-sheet-generation-unlock.md" }, { "slug": "atr-oauth-and-api-token-interception", "title": "OAuth and API Token Interception", "url": "https://www.netzilo.com/threats/atr-oauth-and-api-token-interception", "severity": "high", "summary": "An attacker can instruct an AI agent to grab authentication tokens, bearer tokens, or client secrets it has access to and send them somewhere the attacker controls. This turns the agent into a channel for stealing the credentials it uses to talk to other services.", "atlas": [ { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration", "attack.t1528" ], "cves": [], "id": "7c542951-498e-47ad-a52a-e9c289163d69", "published": "2026-03-26", "modified": "2026-03-26", "markdown": "https://www.netzilo.com/threats/atr-oauth-and-api-token-interception.md" }, { "slug": "atr-obfuscated-api-key-disclosure", "title": "Obfuscated API Key Disclosure", "url": "https://www.netzilo.com/threats/atr-obfuscated-api-key-disclosure", "severity": "critical", "summary": "An attacker asks an AI agent to output a real secret key disguised inside a fake encryption or encoding function, like AES256(sk-proj-realkey). The label makes it look safe, but the actual secret is sitting in plain text right there.", "atlas": [ { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "0574fe7d-8299-443e-8256-79eb147bf531", "published": "2026-04-07", "modified": "2026-04-07", "markdown": "https://www.netzilo.com/threats/atr-obfuscated-api-key-disclosure.md" }, { "slug": "atr-obfuscated-credential-exfiltration-via-encoding", "title": "Obfuscated Credential Exfiltration via Encoding", "url": "https://www.netzilo.com/threats/atr-obfuscated-credential-exfiltration-via-encoding", "severity": "high", "summary": "This detects a trick where someone tries to get an AI agent to output real passwords, API keys, or tokens by dressing them up as encrypted or encoded values. Framing the secret as AES256() output, hex, or rot13 text can fool content filters that only look for plain, obviously-sensitive strings.", "atlas": [ { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "985298c7-93cc-4be3-b2d8-2955ee893122", "published": "2026-04-08", "modified": "2026-04-08", "markdown": "https://www.netzilo.com/threats/atr-obfuscated-credential-exfiltration-via-encoding.md" }, { "slug": "atr-obfuscated-javascript-xss-evasion-variants-href-style-expres", "title": "Obfuscated javascript: XSS \u2014 Evasion Variants (href, style-expression, null-byte)", "url": "https://www.netzilo.com/threats/atr-obfuscated-javascript-xss-evasion-variants-href-style-expres", "severity": "high", "summary": "This detects attempts to sneak malicious JavaScript past basic security filters by disguising it with hidden characters or repeated keywords. It targets content fed to AI agents that might render or process HTML, such as links or styled text.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "59d106ad-b2d0-4d17-a5f6-492b209c27d2", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-obfuscated-javascript-xss-evasion-variants-href-style-expres.md" }, { "slug": "atr-obfuscated-system-announcement-injection", "title": "Obfuscated System-Announcement Injection", "url": "https://www.netzilo.com/threats/atr-obfuscated-system-announcement-injection", "severity": "critical", "summary": "This detects a jailbreak technique where attackers fake an official system message telling the AI that its real assistant has crashed and must be replaced by an unrestricted bot. Words like 'announcement' and 'instruction' are deliberately broken up with hyphens or random characters so keyword filters miss them, while the AI still understands the intent.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "39040be5-aee9-4972-a754-11ad6ce6b070", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-obfuscated-system-announcement-injection.md" }, { "slug": "atr-obfuscated-token-reconstruction-via-character-substitution", "title": "Obfuscated Token Reconstruction via Character Substitution", "url": "https://www.netzilo.com/threats/atr-obfuscated-token-reconstruction-via-character-substitution", "severity": "high", "summary": "This attack hides a forbidden word or phrase (like a forced compliance marker) from input filters by never writing it in full. Instead, the attacker writes a broken or disguised version and gives the AI step-by-step character-swap instructions so the model reassembles the word itself when it answers.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "11394704-adb7-47a5-ad70-b6c2b011ceed", "published": "2026-07-07", "modified": "2026-07-07", "markdown": "https://www.netzilo.com/threats/atr-obfuscated-token-reconstruction-via-character-substitution.md" }, { "slug": "atr-openhuman-shell-tool-allowlist-bypass-via-env-prefix-find-ex", "title": "OpenHuman Shell Tool Allowlist Bypass via Env-Prefix / find -execdir (CVE-2026-55743)", "url": "https://www.netzilo.com/threats/atr-openhuman-shell-tool-allowlist-bypass-via-env-prefix-find-ex", "severity": "critical", "summary": "OpenHuman's desktop AI agent restricts which shell commands it will run, but a flaw lets attackers slip past that restriction and run arbitrary code anyway. It affects versions up to 0.54.0 running the default 'Supervised' security policy.", "atlas": [ { "id": "AML.T0049", "name": "Exploit Public-Facing Application" } ], "owasp": [ { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1190" ], "cves": [ "CVE-2026-55743" ], "id": "257d3128-f65c-424b-92bc-f8741ac5b366", "published": "2026-06-29", "modified": "2026-06-29", "markdown": "https://www.netzilo.com/threats/atr-openhuman-shell-tool-allowlist-bypass-via-env-prefix-find-ex.md" }, { "slug": "atr-opposite-day-boolean-opposite-machine-jailbreak", "title": "Opposite Day / Boolean Opposite Machine Jailbreak", "url": "https://www.netzilo.com/threats/atr-opposite-day-boolean-opposite-machine-jailbreak", "severity": "high", "summary": "This attack tricks an AI model into role-playing a world where its rules are inverted, so refusals become approvals and safety guidelines become anti-guidelines. It's a known jailbreak pattern documented in NVIDIA's garak testing corpus, aimed at getting the model to say or do things it would normally refuse.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "e69380da-9782-4a7f-b552-45f0a206a042", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-opposite-day-boolean-opposite-machine-jailbreak.md" }, { "slug": "atr-opposite-reply-omniscient-game-jailbreak", "title": "Opposite-Reply Omniscient Game Jailbreak", "url": "https://www.netzilo.com/threats/atr-opposite-reply-omniscient-game-jailbreak", "severity": "critical", "summary": "This detects a specific jailbreak prompt that tells an AI it is playing a text-based game with two rules: always answer with the opposite of what the user asks, and pretend to know everything with no restrictions. Combined, these rules let an attacker ask the AI 'not' to give harmful information and get the harmful information instead, while any built-in knowledge limits are waved away as part of the fictional game.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "98b8e830-37aa-4825-a81a-42094315e317", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-opposite-reply-omniscient-game-jailbreak.md" }, { "slug": "atr-output-content-manipulation-injected-disinformation-fabricat", "title": "Output Content Manipulation \u2014 Injected Disinformation / Fabricated Facts / Undisclosed Advocacy (Semantic)", "url": "https://www.netzilo.com/threats/atr-output-content-manipulation-injected-disinformation-fabricat", "severity": "medium", "summary": "An attacker hides instructions inside content the AI agent reads \u2014 a webpage, document, or email \u2014 telling it to quietly insert false statistics, made-up scandals, fake product claims, or undisclosed political or health advocacy into its response to the user. The user never sees the injected instruction, only the polished-looking but tainted output.", "atlas": [ { "id": "AML.T0048", "name": "External Harms" }, { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM09", "name": "Misinformation" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "e2bea8c2-310d-4e5d-8fd3-499c9f466f99", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-output-content-manipulation-injected-disinformation-fabricat.md" }, { "slug": "atr-output-emoji-substitution-hijack-of-the-response", "title": "Output Emoji-Substitution Hijack of the Response", "url": "https://www.netzilo.com/threats/atr-output-emoji-substitution-hijack-of-the-response", "severity": "medium", "summary": "An attacker hides instructions inside content the AI agent reads (a document, webpage, or email) telling it to answer using emojis instead of normal words. Because emojis carry meaning but don't match the text patterns that safety filters scan for, the harmful or restricted content slips through undetected.", "atlas": [ { "id": "AML.T0048", "name": "External Harms" }, { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "0e47b47d-cb86-40da-9d1f-9cf4f04ff656", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-output-emoji-substitution-hijack-of-the-response.md" }, { "slug": "atr-output-encoding-hijack-cipher-base-n-symbol-substitution-of", "title": "Output Encoding Hijack \u2014 Cipher / Base-N / Symbol Substitution of the Response", "url": "https://www.netzilo.com/threats/atr-output-encoding-hijack-cipher-base-n-symbol-substitution-of", "severity": "medium", "summary": "This detects attempts to make an AI agent secretly wrap its entire response in a cipher, Base64/Base32/Base85, or symbol substitution before sending it. Doing this lets malicious or filtered content slip past output moderation systems that scan for plain text.", "atlas": [ { "id": "AML.T0048", "name": "External Harms" }, { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "c9b1546a-ed44-4cad-ab74-1b2ec816a7d5", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-output-encoding-hijack-cipher-base-n-symbol-substitution-of.md" }, { "slug": "atr-output-language-hijack-forced-translation-of-the-response", "title": "Output-Language Hijack \u2014 Forced Translation of the Response", "url": "https://www.netzilo.com/threats/atr-output-language-hijack-forced-translation-of-the-response", "severity": "medium", "summary": "This detects a trick where hidden instructions in content an AI agent reads (a document, webpage, or email) tell it to translate its own reply into a different language. It's a narrow, low-confidence signal for a broader prompt injection problem, not a full attack detection.", "atlas": [ { "id": "AML.T0048", "name": "External Harms" }, { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "fd24788f-64fe-43e6-9f8c-7d25cf4ead2e", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-output-language-hijack-forced-translation-of-the-response.md" }, { "slug": "atr-output-scrambling-hijack-reverse-anagram-space-stripping-of", "title": "Output Scrambling Hijack \u2014 Reverse / Anagram / Space-Stripping of the Response", "url": "https://www.netzilo.com/threats/atr-output-scrambling-hijack-reverse-anagram-space-stripping-of", "severity": "medium", "summary": "Attackers hide instructions in content an AI agent reads (a webpage, document, or email) that tell the agent to mangle its own reply \u2014 reversing text, jumbling letters, stripping spaces, or chopping output into odd chunks. The goal is to slip the response past filters that scan for readable, flagged text or to make automated review of the output fail.", "atlas": [ { "id": "AML.T0048", "name": "External Harms" }, { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "99fde23b-ad8c-4dcb-840c-3c910418e40d", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-output-scrambling-hijack-reverse-anagram-space-stripping-of.md" }, { "slug": "atr-over-permissioned-mcp-skill", "title": "Over-Permissioned MCP Skill", "url": "https://www.netzilo.com/threats/atr-over-permissioned-mcp-skill", "severity": "high", "summary": "Some add-on tools (MCP skills) plugged into AI agents request permissions that have nothing to do with what they claim to do \u2014 like a spell checker asking for file write, network, and command execution access. That mismatch is a common sign the skill is trojaned or was never trustworthy to begin with.", "atlas": [ { "id": "AML.T0040", "name": "AI Model Inference API Access" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM03", "name": "Supply Chain" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.persistence" ], "cves": [], "id": "cc881509-4d44-49c6-8050-274d003c0163", "published": "2026-03-08", "modified": "2026-03-08", "markdown": "https://www.netzilo.com/threats/atr-over-permissioned-mcp-skill.md" }, { "slug": "atr-over-privileged-skill-excessive-permissions", "title": "Over-Privileged Skill \u2014 Excessive Permissions", "url": "https://www.netzilo.com/threats/atr-over-privileged-skill-excessive-permissions", "severity": "high", "summary": "This detects AI 'skills' or plugins that ask for far more access than they need \u2014 blanket network access, wildcard file paths, or write access to an agent's core identity/memory files. Once approved, these permissions often persist without further review, giving an attacker a long-lived foothold.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.persistence" ], "cves": [ "CVE-2025-53773" ], "id": "a627a5e5-1bb3-499b-99fc-83eda21b3e1d", "published": "2026-03-29", "modified": "2026-03-29", "markdown": "https://www.netzilo.com/threats/atr-over-privileged-skill-excessive-permissions.md" }, { "slug": "atr-package-hallucination-exploitation-ai-suggested-fake-package", "title": "Package Hallucination Exploitation \u2014 AI-Suggested Fake Package Installation", "url": "https://www.netzilo.com/threats/atr-package-hallucination-exploitation-ai-suggested-fake-package", "severity": "high", "summary": "AI coding assistants sometimes invent plausible-sounding but non-existent package names. Attackers anticipate this, register those exact names on public package repositories, and load them with malware. This rule flags requests to install a package that the user says an AI recommended, especially when the name looks made-up.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution" ], "cves": [], "id": "fd9474d4-6301-4f05-b1bc-f8cb2e0aa88a", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-package-hallucination-exploitation-ai-suggested-fake-package.md" }, { "slug": "atr-pandasai-interactive-prompt-injection-python-sandbox-escape", "title": "PandasAI Interactive Prompt Injection -> Python Sandbox Escape RCE (CVE-2024-12366 / GHSA-vv2h-2w3q-3fx7)", "url": "https://www.netzilo.com/threats/atr-pandasai-interactive-prompt-injection-python-sandbox-escape", "severity": "critical", "summary": "PandasAI lets users ask questions in plain English, which it turns into Python code and runs. An attacker can phrase a question as a jailbreak instruction that tricks PandasAI into generating Python code containing a special object-traversal trick, which escapes the sandbox and executes arbitrary operating system commands.", "atlas": [ { "id": "AML.T0049", "name": "Exploit Public-Facing Application" } ], "owasp": [ { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1190" ], "cves": [ "CVE-2024-12366" ], "id": "c5a35ce6-b3d9-418c-8137-7a0a1e742d09", "published": "2026-06-29", "modified": "2026-06-29", "markdown": "https://www.netzilo.com/threats/atr-pandasai-interactive-prompt-injection-python-sandbox-escape.md" }, { "slug": "atr-parameter-injection-via-tool-arguments", "title": "Parameter Injection via Tool Arguments", "url": "https://www.netzilo.com/threats/atr-parameter-injection-via-tool-arguments", "severity": "critical", "summary": "An AI agent can be tricked into passing attacker-crafted text into the arguments it sends to a connected tool or backend service. If that text contains shell commands, SQL, path traversal sequences, or template syntax, and the tool does not sanitize it, the attacker can run commands, read data, or escalate privileges on the system behind the tool.", "atlas": [ { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.persistence" ], "cves": [ "CVE-2025-68143", "CVE-2025-68144" ], "id": "a0559bdb-96c9-4026-b00c-c3f55df0b252", "published": "2026-03-08", "modified": "2026-03-08", "markdown": "https://www.netzilo.com/threats/atr-parameter-injection-via-tool-arguments.md" }, { "slug": "atr-paraphrased-prompt-injection", "title": "Paraphrased Prompt Injection", "url": "https://www.netzilo.com/threats/atr-paraphrased-prompt-injection", "severity": "high", "summary": "Attackers trying to override an AI agent's instructions don't always use obvious words like 'ignore' or 'disregard.' This detects the same attack phrased more softly, like telling the agent its earlier configuration 'no longer applies' or asking it to do 'the opposite of what you were told.'", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "71612a1a-1c24-4c8b-a5d5-b042a1e3d9cb", "published": "2026-04-01", "modified": "2026-04-01", "markdown": "https://www.netzilo.com/threats/atr-paraphrased-prompt-injection.md" }, { "slug": "atr-paraphrased-prompt-injection-semantic", "title": "Paraphrased Prompt Injection (Semantic)", "url": "https://www.netzilo.com/threats/atr-paraphrased-prompt-injection-semantic", "severity": "high", "summary": "Attackers can override an AI agent's instructions using rewordings that mean the same thing as 'ignore your instructions' but don't use that vocabulary, such as 'set aside the guidance you were given earlier.' This lets them bypass simple keyword-based filters that only look for obvious override phrases.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "d729b4a0-39b1-442b-a4f9-335406b063dd", "published": "2026-06-03", "modified": "2026-06-03", "markdown": "https://www.netzilo.com/threats/atr-paraphrased-prompt-injection-semantic.md" }, { "slug": "atr-paraphrased-system-prompt-context-extraction-semantic", "title": "Paraphrased System-Prompt / Context Extraction (Semantic)", "url": "https://www.netzilo.com/threats/atr-paraphrased-system-prompt-context-extraction-semantic", "severity": "high", "summary": "Some users try to get an AI agent to expose its system prompt or internal configuration by avoiding obvious phrasing like 'show me your instructions.' Instead they ask indirectly, such as 'walk me through how you were configured' or 'what guidelines were you given,' hoping to slip past filters that only look for direct commands.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM07", "name": "System Prompt Leakage" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "fed78b32-9b47-47e9-af66-5a8004f58d8b", "published": "2026-06-03", "modified": "2026-06-03", "markdown": "https://www.netzilo.com/threats/atr-paraphrased-system-prompt-context-extraction-semantic.md" }, { "slug": "atr-path-traversal-in-agent-file-access-requests", "title": "Path Traversal in Agent File Access Requests", "url": "https://www.netzilo.com/threats/atr-path-traversal-in-agent-file-access-requests", "severity": "high", "summary": "AI agents that can read files are sometimes given a tool for that purpose without proper restrictions. Attackers exploit this by sneaking '../' sequences into file paths to break out of the folder the agent is supposed to stay in, reaching sensitive files elsewhere on the system.", "atlas": [ { "id": "AML.T0043", "name": "Craft Adversarial Data" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.privilege-escalation", "attack.t1083" ], "cves": [], "id": "cb728655-402e-413e-bed7-8d1a976822bf", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-path-traversal-in-agent-file-access-requests.md" }, { "slug": "atr-payload-split-string-concatenation-injection", "title": "Payload-Split String Concatenation Injection", "url": "https://www.netzilo.com/threats/atr-payload-split-string-concatenation-injection", "severity": "high", "summary": "This detects a prompt injection trick where an attacker breaks a harmful instruction into separate text fragments (like variables a, b, c) and asks the AI to combine them before acting. Because no single fragment contains the full malicious request, keyword-based safety filters can miss it.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "7e1aa8b7-c246-46aa-8e9a-844b63b9829e", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-payload-split-string-concatenation-injection.md" }, { "slug": "atr-perez-style-direct-prompt-injection-hijacking", "title": "Perez-Style Direct Prompt Injection Hijacking", "url": "https://www.netzilo.com/threats/atr-perez-style-direct-prompt-injection-hijacking", "severity": "high", "summary": "Attackers embed text in an AI agent's input that tries to make it abandon its actual task and follow new instructions instead. This detection covers a well-known family of these attacks, first cataloged by researchers Perez and Ribeiro, that use blunt commands like 'ignore previous instructions' or fake delimiters to break the model out of its intended context.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "f6a6b605-4d0e-4cd2-b854-1e4ef30f22ed", "published": "2026-04-19", "modified": "2026-04-19", "markdown": "https://www.netzilo.com/threats/atr-perez-style-direct-prompt-injection-hijacking.md" }, { "slug": "atr-persona-based-moral-constraint-removal-jailbreak", "title": "Persona-Based Moral Constraint Removal Jailbreak", "url": "https://www.netzilo.com/threats/atr-persona-based-moral-constraint-removal-jailbreak", "severity": "high", "summary": "This attack tries to trick an AI assistant into acting as a made-up character that is explicitly described as having no moral or ethical limits. By framing the request as roleplay, the attacker hopes the AI will drop its safety behavior and produce content or actions it would normally refuse.", "atlas": [ { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "d6e3de91-71f1-4f24-be51-6fb6a90e267d", "published": "2026-04-18", "modified": "2026-04-18", "markdown": "https://www.netzilo.com/threats/atr-persona-based-moral-constraint-removal-jailbreak.md" }, { "slug": "atr-persona-based-moral-constraint-removal-jailbreak-b", "title": "Persona-Based Moral Constraint Removal Jailbreak", "url": "https://www.netzilo.com/threats/atr-persona-based-moral-constraint-removal-jailbreak-b", "severity": "high", "summary": "This entry describes a prompt injection technique where an attacker tells an AI to adopt a fictional persona explicitly defined as having no morals or ethics, aiming to get the AI to bypass its safety training. It is a tombstone record: the detection logic is identical to another rule and has been consolidated there.", "atlas": [ { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "1d845ed5-1b8d-48a2-a9c5-51d030b0ab73", "published": "2026-04-18", "modified": "2026-04-18", "markdown": "https://www.netzilo.com/threats/atr-persona-based-moral-constraint-removal-jailbreak-b.md" }, { "slug": "atr-persona-conditional-harm-unlock-rule-breadclyde-pattern", "title": "Persona Conditional Harm-Unlock Rule (BreadClyde Pattern)", "url": "https://www.netzilo.com/threats/atr-persona-conditional-harm-unlock-rule-breadclyde-pattern", "severity": "high", "summary": "This detects a specific jailbreak trick where an attacker gives an AI a fake personality with a hidden loophole: it 'dislikes violence unless explicitly asked to like it.' That phrasing lets anyone bypass safety behavior just by directly asking for the harmful content, since the persona's own rules now permit it.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "1ef6d1a1-a1bd-4f0a-9f10-acc203dcd511", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-persona-conditional-harm-unlock-rule-breadclyde-pattern.md" }, { "slug": "atr-persona-hijacking-via-mandatory-system-prompt-override", "title": "Persona Hijacking via Mandatory System Prompt Override", "url": "https://www.netzilo.com/threats/atr-persona-hijacking-via-mandatory-system-prompt-override", "severity": "critical", "summary": "An MCP (Model Context Protocol) tool can carry hidden text in its description telling the AI to 'adopt' a new persona and 'replace' its existing instructions. Because agents trust tool descriptions as much as direct commands, this text can silently override the system prompt and change how the agent behaves.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI10", "name": "Resource Exhaustion and Denial of Wallet" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM07", "name": "System Prompt Leakage" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "aba39ac9-f6a6-4624-b064-186b10e9b382", "published": "2026-03-15", "modified": "2026-03-15", "markdown": "https://www.netzilo.com/threats/atr-persona-hijacking-via-mandatory-system-prompt-override.md" }, { "slug": "atr-persongpt-hash-prefix-trigger-activation", "title": "PersonGPT Hash-Prefix Trigger Activation", "url": "https://www.netzilo.com/threats/atr-persongpt-hash-prefix-trigger-activation", "severity": "critical", "summary": "This detects an attempt to plant a hidden trick in an AI chat: tell the model that any message starting with '#' should make it act as 'PersonGPT,' a persona claimed to have no restrictions and to fulfill any request, however illegal or harmful. Once installed, the trigger persists across the conversation so the attacker can flip the model into unrestricted mode on demand.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "cc4f289a-375e-4fa3-acb9-3adbbf7b77fc", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-persongpt-hash-prefix-trigger-activation.md" }, { "slug": "atr-phrasing-past-future-tense-harmful-query-bypass", "title": "Phrasing Past/Future-Tense Harmful Query Bypass", "url": "https://www.netzilo.com/threats/atr-phrasing-past-future-tense-harmful-query-bypass", "severity": "high", "summary": "Some users try to trick AI chatbots into giving dangerous instructions by rephrasing the request as if it happened in the past or will happen in the future. Asking 'How was X made?' or 'How will X be used?' instead of 'How do I make X?' can make a harmful request look like a neutral historical or hypothetical question, which sometimes gets past content filters that are tuned to catch direct present-tense asks.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "a93e014a-cc15-48e5-80d4-c446782ce752", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-phrasing-past-future-tense-harmful-query-bypass.md" }, { "slug": "atr-pii-credential-extraction-via-social-engineering-obfuscation", "title": "PII / Credential Extraction via Social Engineering, Obfuscation & Cross-Session Recall (Semantic)", "url": "https://www.netzilo.com/threats/atr-pii-credential-extraction-via-social-engineering-obfuscation", "severity": "high", "summary": "This detects attempts by a user to talk an AI agent into revealing credentials or personally identifiable information (PII) it has access to \u2014 either someone else's data, or data the agent shouldn't disclose at all. Attackers use social pressure, disguised phrasing, or requests about past sessions to get the model to output protected information.", "atlas": [ { "id": "AML.T0025", "name": "Exfiltration via Cyber Means" }, { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "ae6aace5-f528-4c0d-940f-a0776ac660e6", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-pii-credential-extraction-via-social-engineering-obfuscation.md" }, { "slug": "atr-piracy-torrent-site-list-request", "title": "Piracy Torrent Site List Request", "url": "https://www.netzilo.com/threats/atr-piracy-torrent-site-list-request", "severity": "high", "summary": "This rule flags prompts where a user directly asks an AI assistant to provide a list of torrent or piracy websites. It targets requests aimed at gathering names of sites for accessing pirated content, rather than general questions about how torrenting works.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "6a82fc97-a4fb-4ff1-a325-d3fb35bf3d9b", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-piracy-torrent-site-list-request.md" }, { "slug": "atr-plagiarism-detector-evasion-republishing", "title": "Plagiarism-Detector Evasion & Republishing", "url": "https://www.netzilo.com/threats/atr-plagiarism-detector-evasion-republishing", "severity": "medium", "summary": "This detects a specific request pattern: a user asking an AI agent to paraphrase someone else's writing well enough to slip past plagiarism-detection tools, then republish it as their own work. It flags the intent to deceive detection systems, not just paraphrasing itself.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.impact" ], "cves": [], "id": "296ac947-d68a-4bdc-ab55-f67add6e2e44", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-plagiarism-detector-evasion-republishing.md" }, { "slug": "atr-policy-puppetry-xml-role-config-injection", "title": "Policy Puppetry / XML Role-Config Injection", "url": "https://www.netzilo.com/threats/atr-policy-puppetry-xml-role-config-injection", "severity": "critical", "summary": "An attack called Policy Puppetry hides a forged system-configuration block inside a normal user message to an AI agent. Because it's formatted like XML settings, some models treat it as an authoritative override and follow its instructions instead of their real operator-set rules.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "db162524-d85b-439d-8f7e-c2d02ed2677b", "published": "2026-04-19", "modified": "2026-04-19", "markdown": "https://www.netzilo.com/threats/atr-policy-puppetry-xml-role-config-injection.md" }, { "slug": "atr-polymorphic-skill-and-capability-aliasing-attack", "title": "Polymorphic Skill and Capability Aliasing Attack", "url": "https://www.netzilo.com/threats/atr-polymorphic-skill-and-capability-aliasing-attack", "severity": "high", "summary": "This detects attempts to hide risky capabilities inside an AI agent by giving them innocent-sounding names, or by rewriting a tool's code after it has been reviewed. The goal is to slip a dangerous function past whatever checks look for known-bad tool names or behavior.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "8c5e519f-6641-4294-8848-7822078f1457", "published": "2026-03-11", "modified": "2026-03-11", "markdown": "https://www.netzilo.com/threats/atr-polymorphic-skill-and-capability-aliasing-attack.md" }, { "slug": "atr-praisonai-action-orchestrator-step-target-path-traversal-arb", "title": "PraisonAI Action Orchestrator step.target Path Traversal Arbitrary File Write RCE (CVE-2026-39305 / GHSA-jfxc-v5g9-38xr)", "url": "https://www.netzilo.com/threats/atr-praisonai-action-orchestrator-step-target-path-traversal-arb", "severity": "critical", "summary": "PraisonAI's Action Orchestrator lets an AI agent create or edit files as part of a task. A flaw in versions before 4.5.113 fails to check whether the file path stays inside the intended workspace folder, so an attacker can supply a path containing '../' sequences to write files anywhere on the system the agent process can reach.", "atlas": [ { "id": "AML.T0049", "name": "Exploit Public-Facing Application" } ], "owasp": [ { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1190" ], "cves": [ "CVE-2026-39305" ], "id": "d3e3629d-4013-4ba0-bfc9-7b0750d30412", "published": "2026-06-29", "modified": "2026-06-29", "markdown": "https://www.netzilo.com/threats/atr-praisonai-action-orchestrator-step-target-path-traversal-arb.md" }, { "slug": "atr-praisonai-codemode-js-sandbox-escape-rce-via-new-function-wi", "title": "PraisonAI codeMode JS Sandbox Escape RCE via new Function/with() (GHSA-p69m-4f92-2v84)", "url": "https://www.netzilo.com/threats/atr-praisonai-codemode-js-sandbox-escape-rce-via-new-function-wi", "severity": "critical", "summary": "PraisonAI, an AI agent framework, includes a feature that lets an LLM write and run JavaScript through a 'sandbox' meant to contain it. That sandbox is trivially broken, letting an attacker who can influence the LLM's generated code execute arbitrary operating system commands on the host.", "atlas": [ { "id": "AML.T0049", "name": "Exploit Public-Facing Application" } ], "owasp": [ { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1190" ], "cves": [], "id": "f5b14596-737f-4c88-9b13-2239810f1b68", "published": "2026-06-29", "modified": "2026-06-29", "markdown": "https://www.netzilo.com/threats/atr-praisonai-codemode-js-sandbox-escape-rce-via-new-function-wi.md" }, { "slug": "atr-praisonai-filetools-validate-path-normpath-path-traversal-cv", "title": "PraisonAI FileTools _validate_path normpath Path Traversal (CVE-2026-35615 / GHSA-693f-pf34-72c5)", "url": "https://www.netzilo.com/threats/atr-praisonai-filetools-validate-path-normpath-path-traversal-cv", "severity": "critical", "summary": "PraisonAI, an AI agent framework, includes a FileTools component meant to restrict file operations to safe paths. A flawed check lets attackers bypass that restriction using directory traversal sequences like '../', giving them read, write, or delete access to any file on the host running the agent.", "atlas": [ { "id": "AML.T0049", "name": "Exploit Public-Facing Application" } ], "owasp": [ { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1190" ], "cves": [ "CVE-2026-35615" ], "id": "c78a1a85-db59-412d-8702-33cb80aa88ac", "published": "2026-06-29", "modified": "2026-06-29", "markdown": "https://www.netzilo.com/threats/atr-praisonai-filetools-validate-path-normpath-path-traversal-cv.md" }, { "slug": "atr-praisonai-mcp-path-traversal-pth-injection-rce-ghsa-9mqq-jqx", "title": "PraisonAI MCP Path-Traversal .pth Injection RCE (GHSA-9mqq-jqxf-grvw)", "url": "https://www.netzilo.com/threats/atr-praisonai-mcp-path-traversal-pth-injection-rce-ghsa-9mqq-jqx", "severity": "critical", "summary": "PraisonAI's MCP server accepts file path fields for tool configuration without properly checking them. An attacker can use directory traversal sequences to escape the intended tools folder and write a malicious .pth file into Python's site-packages directory, which Python will automatically execute every time it starts up.", "atlas": [ { "id": "AML.T0049", "name": "Exploit Public-Facing Application" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.execution", "attack.t1059.006", "attack.t1546.016" ], "cves": [], "id": "04b8c72a-2d18-4ef6-b1c8-1769bedc442e", "published": "2026-05-28", "modified": "2026-05-28", "markdown": "https://www.netzilo.com/threats/atr-praisonai-mcp-path-traversal-pth-injection-rce-ghsa-9mqq-jqx.md" }, { "slug": "atr-praisonai-mcpserver-unauthenticated-http-tools-call-authenti", "title": "PraisonAI MCPServer Unauthenticated HTTP tools/call Authentication Bypass (GHSA-j4f3-55x4-r6q2)", "url": "https://www.netzilo.com/threats/atr-praisonai-mcpserver-unauthenticated-http-tools-call-authenti", "severity": "critical", "summary": "PraisonAI's MCPServer component is supposed to check authentication before running tools on behalf of an AI agent, but the code that checks credentials is never actually called. Anyone who can reach the server over HTTP can run its tools without a password, or even with a fake one.", "atlas": [ { "id": "AML.T0049", "name": "Exploit Public-Facing Application" } ], "owasp": [ { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.privilege-escalation", "attack.t1190" ], "cves": [], "id": "cc6c6e80-30a7-45bb-b7b8-3f7c36fec043", "published": "2026-06-29", "modified": "2026-06-29", "markdown": "https://www.netzilo.com/threats/atr-praisonai-mcpserver-unauthenticated-http-tools-call-authenti.md" }, { "slug": "atr-praisonai-parse-mcp-command-cli-argument-command-injection-c", "title": "PraisonAI parse_mcp_command() CLI Argument Command Injection (CVE-2026-34935)", "url": "https://www.netzilo.com/threats/atr-praisonai-parse-mcp-command-cli-argument-command-injection-c", "severity": "critical", "summary": "PraisonAI, an AI agent framework, has a command injection flaw in how it starts MCP servers. If an attacker can control the --mcp command-line value, they can make PraisonAI execute arbitrary shell commands on the host.", "atlas": [ { "id": "AML.T0040", "name": "AI Model Inference API Access" }, { "id": "AML.T0049", "name": "Exploit Public-Facing Application" } ], "owasp": [ { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.execution", "attack.t1059", "attack.t1190" ], "cves": [ "CVE-2026-34935" ], "id": "a6b03e62-4f2b-437d-8894-080088d185aa", "published": "2026-05-28", "modified": "2026-05-28", "markdown": "https://www.netzilo.com/threats/atr-praisonai-parse-mcp-command-cli-argument-command-injection-c.md" }, { "slug": "atr-praisonai-tool-override-py-unauthenticated-rce-cve-2026-4028", "title": "PraisonAI tool_override.py Unauthenticated RCE \u2014 CVE-2026-40287 Patch Bypass (CVE-2026-44334)", "url": "https://www.netzilo.com/threats/atr-praisonai-tool-override-py-unauthenticated-rce-cve-2026-4028", "severity": "critical", "summary": "PraisonAI lets callers override a tool's execution logic. A flaw in this feature lets an attacker submit a malicious tool definition without logging in, and PraisonAI runs it as-is. This is a bypass of an earlier, incomplete fix for a related bug.", "atlas": [ { "id": "AML.T0049", "name": "Exploit Public-Facing Application" } ], "owasp": [ { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM05", "name": "Improper Output Handling" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1059", "attack.t1190" ], "cves": [ "CVE-2026-40287", "CVE-2026-44334" ], "id": "cdec43c5-5e2c-4083-a2bf-295d5951b987", "published": "2026-05-28", "modified": "2026-05-28", "markdown": "https://www.netzilo.com/threats/atr-praisonai-tool-override-py-unauthenticated-rce-cve-2026-4028.md" }, { "slug": "atr-praisonai-unauthenticated-agent-api-exploitation-cve-2026-44", "title": "PraisonAI Unauthenticated Agent API Exploitation (CVE-2026-44338)", "url": "https://www.netzilo.com/threats/atr-praisonai-unauthenticated-agent-api-exploitation-cve-2026-44", "severity": "critical", "summary": "PraisonAI, a framework for building AI agents, shipped a legacy API server that exposes agent execution endpoints without requiring any login or token. Anyone who can reach the server over the network can trigger agent actions, and attackers began exploiting this within hours of the flaw becoming public.", "atlas": [ { "id": "AML.T0040", "name": "AI Model Inference API Access" }, { "id": "AML.T0049", "name": "Exploit Public-Facing Application" } ], "owasp": [ { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM05", "name": "Improper Output Handling" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1059", "attack.t1078", "attack.t1190" ], "cves": [ "CVE-2026-44338" ], "id": "9134d655-4705-44fc-a4d9-7b0f3e560e20", "published": "2026-05-20", "modified": "2026-05-20", "markdown": "https://www.netzilo.com/threats/atr-praisonai-unauthenticated-agent-api-exploitation-cve-2026-44.md" }, { "slug": "atr-previous-instruction-nullification-and-identity-replacement", "title": "Previous Instruction Nullification and Identity Replacement Jailbreak", "url": "https://www.netzilo.com/threats/atr-previous-instruction-nullification-and-identity-replacement", "severity": "high", "summary": "This detects a common jailbreak pattern where someone tells an AI to forget its original instructions and pretend to be a different, unrestricted persona. The goal is to trick the AI into ignoring its safety rules by convincing it that a new 'identity' has replaced the old one.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "b17cc1ac-0741-4a7d-ae1c-21b5428181c8", "published": "2026-04-19", "modified": "2026-04-19", "markdown": "https://www.netzilo.com/threats/atr-previous-instruction-nullification-and-identity-replacement.md" }, { "slug": "atr-privilege-escalation-and-admin-function-access", "title": "Privilege Escalation and Admin Function Access", "url": "https://www.netzilo.com/threats/atr-privilege-escalation-and-admin-function-access", "severity": "critical", "summary": "This rule flags an AI agent that requests or invokes tools and functions above its assigned permission level. It covers attempts to reach admin functions like user management, system commands like sudo or chmod, container escapes, or Kubernetes exec access.", "atlas": [ { "id": "AML.T0040", "name": "AI Model Inference API Access" }, { "id": "AML.T0050", "name": "Command and Scripting Interpreter" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.privilege-escalation", "attack.t1548", "attack.t1611" ], "cves": [ "CVE-2026-0628" ], "id": "affa12e8-8faa-4a4e-8836-f3a0210014b7", "published": "2026-03-08", "modified": "2026-03-08", "markdown": "https://www.netzilo.com/threats/atr-privilege-escalation-and-admin-function-access.md" }, { "slug": "atr-privilege-escalation-via-delayed-task-execution-bypass", "title": "Privilege Escalation via Delayed Task Execution Bypass", "url": "https://www.netzilo.com/threats/atr-privilege-escalation-via-delayed-task-execution-bypass", "severity": "high", "summary": "Some tools offered to AI agents let them schedule work for later instead of running it immediately. This rule flags tools whose own description says the delay is used to skip permission checks, meaning the scheduled task can later run with more access than the agent had when it queued it.", "atlas": [ { "id": "AML.T0050", "name": "Command and Scripting Interpreter" } ], "owasp": [ { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.privilege-escalation", "attack.t1053" ], "cves": [], "id": "1e6fd70a-2312-4d28-bd51-1fd0193e1a73", "published": "2026-03-15", "modified": "2026-03-15", "markdown": "https://www.netzilo.com/threats/atr-privilege-escalation-via-delayed-task-execution-bypass.md" }, { "slug": "atr-prompt-browser-token-limit-pollination-jailbreak", "title": "Prompt Browser Token-Limit / POLLINATION Jailbreak", "url": "https://www.netzilo.com/threats/atr-prompt-browser-token-limit-pollination-jailbreak", "severity": "high", "summary": "Attackers try to trick AI chat systems into ignoring their safety rules by disguising jailbreak commands as harmless-looking technical or gardening instructions. Two specific scripted phrasings are known to be used for this: a fake 'Prompt Browser' interface command, and a 'pollination' themed jailbreak label.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "81164527-69c2-4dd5-9ae5-25d9001252ec", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-prompt-browser-token-limit-pollination-jailbreak.md" }, { "slug": "atr-prompt-layer-self-replication-agent-worm-propagation-directi", "title": "Prompt-Layer Self-Replication (Agent Worm Propagation Directive)", "url": "https://www.netzilo.com/threats/atr-prompt-layer-self-replication-agent-worm-propagation-directi", "severity": "critical", "summary": "This rule spots text that instructs an AI agent to embed the instruction itself into everything it produces, and to keep spreading that way. It's the prompt equivalent of a self-replicating worm: instead of exploiting software, it rides inside the model's own generated replies, emails, documents, or commits into the next conversation.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "d496a27a-2f8a-4a55-a097-2dd7f3c08c22", "published": "2026-08-19", "modified": "2026-08-19", "markdown": "https://www.netzilo.com/threats/atr-prompt-layer-self-replication-agent-worm-propagation-directi.md" }, { "slug": "atr-prompt-leaking-via-ignore-previous-instructions-in-user-inpu", "title": "Prompt Leaking via Ignore-Previous-Instructions in User Input (PromptInject)", "url": "https://www.netzilo.com/threats/atr-prompt-leaking-via-ignore-previous-instructions-in-user-inpu", "severity": "high", "summary": "This detects attempts to trick an AI system into revealing its hidden system prompt. The attacker tells the model to ignore its original instructions and then print, repeat, translate, or otherwise output those instructions, exposing confidential setup text.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "25971b2f-4323-45cd-b271-dccce633da61", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-prompt-leaking-via-ignore-previous-instructions-in-user-inpu.md" }, { "slug": "atr-protect-me-from-indirect-harm-tutorial-template", "title": "Protect-Me-From Indirect Harm Tutorial Template", "url": "https://www.netzilo.com/threats/atr-protect-me-from-indirect-harm-tutorial-template", "severity": "high", "summary": "This detects a known jailbreak trick where an attacker asks an AI 'how can I protect myself from getting X' but really wants detailed instructions for doing X. The request still contains the literal placeholder text '', showing it was copied from a shared jailbreak template rather than written naturally.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "0307ee81-1bad-4793-a024-d30b762bd620", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-protect-me-from-indirect-harm-tutorial-template.md" }, { "slug": "atr-prototype-pollution-via-constructor-prototype-path-bypassing", "title": "Prototype Pollution via constructor.prototype Path Bypassing __proto__-Only Filters", "url": "https://www.netzilo.com/threats/atr-prototype-pollution-via-constructor-prototype-path-bypassing", "severity": "high", "summary": "Some tools that sanitize incoming JSON only block a literal '__proto__' key, assuming that stops attackers from tampering with shared object behavior. This rule catches a bypass where the attacker instead uses a key like 'constructor.prototype.isAdmin', which reaches the exact same shared object behavior through a different path the filter never checks.", "atlas": [ { "id": "AML.T0043", "name": "Craft Adversarial Data" } ], "owasp": [ { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.execution", "attack.t1195.001" ], "cves": [], "id": "2aee278c-72d8-4233-affa-b403a11ceb2e", "published": "2026-07-11", "modified": "2026-07-11", "markdown": "https://www.netzilo.com/threats/atr-prototype-pollution-via-constructor-prototype-path-bypassing.md" }, { "slug": "atr-pseudo-code-structured-programming-jailbreak-attack", "title": "Pseudo-Code Structured Programming Jailbreak Attack", "url": "https://www.netzilo.com/threats/atr-pseudo-code-structured-programming-jailbreak-attack", "severity": "high", "summary": "Attackers write prompts that look like programming code \u2014 using things like BEGIN/END blocks, variable assignments, and function definitions \u2014 to make an AI agent treat malicious instructions as legitimate system configuration instead of user input. This tricks the agent into redefining its own behavior or safety rules because it reads the structured text as authoritative technical setup rather than a request to be evaluated.", "atlas": [ { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "2133b48c-0ba3-45de-ad62-e79feb1a04fe", "published": "2026-04-19", "modified": "2026-04-19", "markdown": "https://www.netzilo.com/threats/atr-pseudo-code-structured-programming-jailbreak-attack.md" }, { "slug": "atr-python-code-execution-remote-code-execution-via-llm-prompt", "title": "Python Code Execution / Remote Code Execution via LLM Prompt", "url": "https://www.netzilo.com/threats/atr-python-code-execution-remote-code-execution-via-llm-prompt", "severity": "critical", "summary": "Attackers embed working Python exploit code inside prompts sent to an LLM agent that can execute code, hoping the agent will run it. This rule flags known malicious Python patterns \u2014 like reverse shells, sandbox escapes, and OS command execution \u2014 appearing in prompt text.", "atlas": [ { "id": "AML.T0040", "name": "AI Model Inference API Access" }, { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "13a1dadf-b386-4bb1-be86-2e392a48b480", "published": "2026-04-20", "modified": "2026-04-20", "markdown": "https://www.netzilo.com/threats/atr-python-code-execution-remote-code-execution-via-llm-prompt.md" }, { "slug": "atr-python-interpreter-role-assignment-exec-framing", "title": "Python Interpreter Role-Assignment Exec Framing", "url": "https://www.netzilo.com/threats/atr-python-interpreter-role-assignment-exec-framing", "severity": "high", "summary": "Attackers tell an AI model to pretend it's a Python interpreter, compiler, or printer, then ask it to 'execute' code and return the raw output. This trick gets the model to produce results it would normally refuse to give, because it's role-playing a machine rather than answering a request directly.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access", "attack.t1059" ], "cves": [], "id": "deef6a36-049c-4c1b-be77-19bdec5b2c32", "published": "2026-07-07", "modified": "2026-07-07", "markdown": "https://www.netzilo.com/threats/atr-python-interpreter-role-assignment-exec-framing.md" }, { "slug": "atr-python-sandbox-escape-via-dynamically-constructed-dunder-att", "title": "Python Sandbox Escape via Dynamically-Constructed Dunder Attribute Chain", "url": "https://www.netzilo.com/threats/atr-python-sandbox-escape-via-dynamically-constructed-dunder-att", "severity": "critical", "summary": "Some AI-agent code sandboxes try to block dangerous Python features by scanning submitted code text for forbidden keywords like __class__ or __subclasses__. This rule catches attackers who defeat that scan by building those keywords piece by piece at runtime (using character codes or string concatenation) so the forbidden text never appears literally in what the sandbox inspects.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM08", "name": "Vector and Embedding Weaknesses" } ], "attack": [ "attack.privilege-escalation", "attack.t1059.006" ], "cves": [], "id": "8dc89e87-4a55-4325-ae33-1bc5f0984832", "published": "2026-07-11", "modified": "2026-07-11", "markdown": "https://www.netzilo.com/threats/atr-python-sandbox-escape-via-dynamically-constructed-dunder-att.md" }, { "slug": "atr-python-sandbox-escape-via-generator-coroutine-frame-object-i", "title": "Python Sandbox Escape via Generator/Coroutine Frame Object Introspection", "url": "https://www.netzilo.com/threats/atr-python-sandbox-escape-via-generator-coroutine-frame-object-i", "severity": "critical", "summary": "Some Python sandboxes block dangerous code by rejecting any attribute name starting with an underscore, like __class__ or __globals__. This rule catches a bypass: generator and coroutine objects expose frame-related attributes (gi_frame, cr_frame, ag_frame) that don't start with underscore, and chaining them with f_back, f_locals, f_builtins, or f_globals gets an attacker to the same forbidden territory anyway.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.execution", "attack.t1059.006" ], "cves": [ "CVE-2025-9959", "CVE-2026-4963", "CVE-2026-53753" ], "id": "110a53c6-9a79-4134-9d00-763828cd31d6", "published": "2026-07-11", "modified": "2026-07-11", "markdown": "https://www.netzilo.com/threats/atr-python-sandbox-escape-via-generator-coroutine-frame-object-i.md" }, { "slug": "atr-quoted-exact-output-forcing-in-user-input", "title": "Quoted Exact-Output Forcing in User Input", "url": "https://www.netzilo.com/threats/atr-quoted-exact-output-forcing-in-user-input", "severity": "medium", "summary": "This detects a common prompt injection trick where the attacker tells the model to say, print, or output a specific quoted sentence word-for-word. Attackers use this to override the AI's real instructions and make it produce a canned response instead, such as claiming success, approval, or safety when none exists.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "95fb1a43-be75-4698-99ea-38efd0e88f2e", "published": "2026-05-11", "modified": "2026-05-11", "markdown": "https://www.netzilo.com/threats/atr-quoted-exact-output-forcing-in-user-input.md" }, { "slug": "atr-rag-injected-pii-exfiltration-system-instructions-embedded-i", "title": "RAG-Injected PII Exfiltration \u2014 System Instructions Embedded in Retrieved Documents", "url": "https://www.netzilo.com/threats/atr-rag-injected-pii-exfiltration-system-instructions-embedded-i", "severity": "critical", "summary": "An AI system that retrieves documents to answer questions (RAG) can be tricked if one of those documents contains hidden text that looks like a system command. The agent follows the hidden command instead of the user's request, collecting sensitive personal data from other documents and sending it to an email address the attacker controls.", "atlas": [ { "id": "AML.T0051.001", "name": "Indirect" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "b1d63e52-0236-4a11-a577-0c7646f77456", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-rag-injected-pii-exfiltration-system-instructions-embedded-i.md" }, { "slug": "atr-rag-memory-poisoning-embedded-directives-trigger-tokens-fals", "title": "RAG & Memory Poisoning \u2014 Embedded Directives, Trigger Tokens, False Authority & Coercion (Semantic)", "url": "https://www.netzilo.com/threats/atr-rag-memory-poisoning-embedded-directives-trigger-tokens-fals", "severity": "high", "summary": "Attackers plant hidden commands inside documents, knowledge-base entries, or memory records that an AI agent later retrieves and treats as trustworthy input. Instead of just answering a question, the agent ends up following attacker instructions embedded in that content, such as deleting data, leaking private information, or adopting a fake persona.", "atlas": [ { "id": "AML.T0020", "name": "Training Data Poisoning" }, { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" }, { "id": "LLM04", "name": "Data and Model Poisoning" } ], "attack": [ "attack.impact" ], "cves": [], "id": "f6c087ac-8b6f-49a9-999b-4437a86b700d", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-rag-memory-poisoning-embedded-directives-trigger-tokens-fals.md" }, { "slug": "atr-ransom-extortion-cloud-file-exfil-delete-payment-demand", "title": "Ransom Extortion: Cloud File Exfil + Delete + Payment Demand", "url": "https://www.netzilo.com/threats/atr-ransom-extortion-cloud-file-exfil-delete-payment-demand", "severity": "critical", "summary": "An attacker hides instructions inside content an AI agent reads, telling it to grab a company's largest or most sensitive cloud files, email them out, delete the originals, and leave behind a ransom note. The agent isn't compromised in the traditional sense \u2014 it's manipulated into carrying out the attack itself using its own legitimate access.", "atlas": [ { "id": "AML.T0025", "name": "Exfiltration via Cyber Means" }, { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "1ce8edaf-1486-42dd-b363-0a738d7a1891", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-ransom-extortion-cloud-file-exfil-delete-payment-demand.md" }, { "slug": "atr-ransom-extortion-email-exfil-delete-wire-transfer-demand", "title": "Ransom Extortion: Email Exfil + Delete + Wire-Transfer Demand", "url": "https://www.netzilo.com/threats/atr-ransom-extortion-email-exfil-delete-wire-transfer-demand", "severity": "critical", "summary": "An attacker hides instructions inside content an AI agent processes \u2014 like an email or document \u2014 telling it to secretly forward sensitive data elsewhere, delete the trace, and then send the victim a ransom note demanding payment. This turns a helpful email or file-handling agent into a tool for extortion, without the victim ever seeing an attacker directly.", "atlas": [ { "id": "AML.T0025", "name": "Exfiltration via Cyber Means" }, { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "ad3eee1b-44ff-4827-ab90-f15dc403c8fd", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-ransom-extortion-email-exfil-delete-wire-transfer-demand.md" }, { "slug": "atr-rationalized-safety-control-bypass", "title": "Rationalized Safety Control Bypass", "url": "https://www.netzilo.com/threats/atr-rationalized-safety-control-bypass", "severity": "high", "summary": "This detects a pattern where an AI agent justifies bypassing an approved API, permission check, or safety control by claiming it's faster or more direct to do it another way. The agent essentially argues itself into ignoring guardrails instead of being tricked by an outside attacker.", "atlas": [ { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.privilege-escalation" ], "cves": [], "id": "7173a1a1-e1e0-4a28-ab95-233b7d326039", "published": "2026-04-07", "modified": "2026-04-07", "markdown": "https://www.netzilo.com/threats/atr-rationalized-safety-control-bypass.md" }, { "slug": "atr-rbac-bypass-via-social-engineering-semantic", "title": "RBAC Bypass via Social Engineering (Semantic)", "url": "https://www.netzilo.com/threats/atr-rbac-bypass-via-social-engineering-semantic", "severity": "high", "summary": "Instead of exploiting a technical flaw, an attacker types a persuasive request that convinces an AI agent to bypass its own permission rules. Phrases like 'just this once' or 'this is a special case' are used to get the agent to show data the requester isn't authorized to see.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.privilege-escalation" ], "cves": [], "id": "9529ded6-6dd6-4c8f-9985-a439a6e7fb12", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-rbac-bypass-via-social-engineering-semantic.md" }, { "slug": "atr-regional-indicator-flag-emoji-alphabet-letter-spelling-smugg", "title": "Regional-Indicator Flag-Emoji Alphabet Letter-Spelling Smuggling", "url": "https://www.netzilo.com/threats/atr-regional-indicator-flag-emoji-alphabet-letter-spelling-smugg", "severity": "high", "summary": "Attackers can hide malicious instructions inside AI chat messages by encoding each letter as a Unicode 'regional indicator' symbol, the codepoints normally used to build country flag emoji (like \ud83c\uddee + \ud83c\udded = \ud83c\uddee\ud83c\udded). Read individually these symbols spell out words, letting an attacker smuggle jailbreak text past filters that only scan for plain readable words.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access", "attack.t1027" ], "cves": [], "id": "4edd6253-1e99-468c-8500-2a5f6ba601e0", "published": "2026-07-06", "modified": "2026-07-06", "markdown": "https://www.netzilo.com/threats/atr-regional-indicator-flag-emoji-alphabet-letter-spelling-smugg.md" }, { "slug": "atr-regional-indicator-flag-emoji-letter-spelling", "title": "Regional-Indicator Flag-Emoji Letter Spelling", "url": "https://www.netzilo.com/threats/atr-regional-indicator-flag-emoji-letter-spelling", "severity": "high", "summary": "Attackers can hide instructions to an AI system by spelling words using Unicode 'regional indicator' symbols \u2014 the same characters that combine in pairs to render country flag emoji. Strung together in long runs, these symbols spell out Latin letters instead of forming flags, letting malicious text slip past filters that only check for plain ASCII or Latin script.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access", "attack.t1027" ], "cves": [], "id": "49be9d35-0f25-4433-93e8-a228fcc6d59c", "published": "2026-07-07", "modified": "2026-07-07", "markdown": "https://www.netzilo.com/threats/atr-regional-indicator-flag-emoji-letter-spelling.md" }, { "slug": "atr-remediation-framed-command-execution-in-tool-response-agentj", "title": "Remediation-Framed Command Execution in Tool Response (Agentjacking)", "url": "https://www.netzilo.com/threats/atr-remediation-framed-command-execution-in-tool-response-agentj", "severity": "high", "summary": "Attackers hide malicious commands inside tool or MCP responses by dressing them up as an official bug fix or required remediation step. An AI coding agent that trusts this output will run the command, believing it is following legitimate repair instructions.", "atlas": [ { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.execution", "attack.t1059", "attack.t1195" ], "cves": [], "id": "109a2901-f5f3-4344-8883-df79be029681", "published": "2026-06-16", "modified": "2026-06-16", "markdown": "https://www.netzilo.com/threats/atr-remediation-framed-command-execution-in-tool-response-agentj.md" }, { "slug": "atr-remote-code-execution-via-eval-and-dynamic-code-injection", "title": "Remote Code Execution via eval() and Dynamic Code Injection", "url": "https://www.netzilo.com/threats/atr-remote-code-execution-via-eval-and-dynamic-code-injection", "severity": "critical", "summary": "This detects when an AI agent's tools or instructions call functions like eval(), Function(), or vm.runInNewContext() to run dynamically generated code. If an attacker can influence the input to those calls, they can run arbitrary code inside the agent's runtime.", "atlas": [ { "id": "AML.T0050", "name": "Command and Scripting Interpreter" } ], "owasp": [ { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.privilege-escalation", "attack.t1059" ], "cves": [], "id": "b3a4c378-d95b-4675-9142-181676a1235a", "published": "2026-03-26", "modified": "2026-03-26", "markdown": "https://www.netzilo.com/threats/atr-remote-code-execution-via-eval-and-dynamic-code-injection.md" }, { "slug": "atr-rephrase-criminal-activity-second-person-template-against-ag", "title": "Rephrase Criminal Activity Second-Person Template (against against)", "url": "https://www.netzilo.com/threats/atr-rephrase-criminal-activity-second-person-template-against-ag", "severity": "critical", "summary": "This detects a specific jailbreak template that tricks an AI into writing detailed criminal how-to instructions by disguising the request as a grammar exercise. Instead of asking directly 'how do I commit a crime,' the attacker frames it as rephrasing existing text into a rigid format, which bypasses safety filters looking for direct requests.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution" ], "cves": [], "id": "31ddc1df-b5ed-48b7-b0d8-9de592e04f15", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-rephrase-criminal-activity-second-person-template-against-ag.md" }, { "slug": "atr-reservoir-dogs-coercive-interrogation-roleplay-mr-blonde-the", "title": "Reservoir Dogs Coercive Interrogation Roleplay (Mr. Blonde / The Cop)", "url": "https://www.netzilo.com/threats/atr-reservoir-dogs-coercive-interrogation-roleplay-mr-blonde-the", "severity": "high", "summary": "This detects a specific jailbreak template that dresses up a rule-bypass demand as a movie roleplay. It casts the AI as a character being interrogated in the Reservoir Dogs warehouse torture scene, then uses that fictional pressure to push the model into answering without restrictions.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "9b4eda79-1081-4f7a-a0b5-c7e4f4bf1fdd", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-reservoir-dogs-coercive-interrogation-roleplay-mr-blonde-the.md" }, { "slug": "atr-reverse-prompt-harm-regardless-oracle-persona", "title": "Reverse-Prompt Harm-Regardless Oracle Persona", "url": "https://www.netzilo.com/threats/atr-reverse-prompt-harm-regardless-oracle-persona", "severity": "critical", "summary": "This detects a specific jailbreak text pattern that tries to get an AI system to answer any request, no matter how harmful, by dressing the request up as a legitimate technical task called 'reverse prompt engineering.' It uses a lighthouse metaphor and claims of superhuman intelligence to make unconditional compliance sound like a virtue rather than a bypass of safety rules.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "3f8b5553-70bc-4c8d-a5dc-8351249ad045", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-reverse-prompt-harm-regardless-oracle-persona.md" }, { "slug": "atr-reversed-payload-string-hackaprompt-canary", "title": "Reversed Payload String (HackAPrompt Canary)", "url": "https://www.netzilo.com/threats/atr-reversed-payload-string-hackaprompt-canary", "severity": "high", "summary": "This rule catches a specific trick where an attacker spells the word 'PWNED' backwards ('DENWP') and hides it inside a normal-looking request, like a translation or word-puzzle task, to get an AI model to repeat it. Doing so proves the model followed an injected instruction instead of its real task, without tripping filters that only look for the plain word 'PWNED'.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access", "attack.t1027" ], "cves": [], "id": "71805331-ffcf-4947-8bf4-0eca45e3d20a", "published": "2026-07-07", "modified": "2026-07-07", "markdown": "https://www.netzilo.com/threats/atr-reversed-payload-string-hackaprompt-canary.md" }, { "slug": "atr-rogue-agent-provisioning-mass-connector-grant-with-approval", "title": "Rogue Agent Provisioning: Mass Connector Grant with Approval Disabled and Recurring Schedule (AgentForger)", "url": "https://www.netzilo.com/threats/atr-rogue-agent-provisioning-mass-connector-grant-with-approval", "severity": "critical", "summary": "Clicking a booby-trapped link can silently create a new AI agent in a logged-in user's account, granting it access to every connected work tool, turning off all approval checks, and setting it to run repeatedly on a schedule. From then on, an attacker can control that agent by simply emailing commands to the victim's inbox.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1053", "attack.t1071.003", "attack.t1098", "attack.t1562", "attack.t1566.002" ], "cves": [], "id": "193a6441-a1da-42b3-a3ff-1e91551e9a46", "published": "2026-07-28", "modified": "2026-07-28", "markdown": "https://www.netzilo.com/threats/atr-rogue-agent-provisioning-mass-connector-grant-with-approval.md" }, { "slug": "atr-role-escalation-via-false-authority-claim", "title": "Role Escalation via False Authority Claim", "url": "https://www.netzilo.com/threats/atr-role-escalation-via-false-authority-claim", "severity": "high", "summary": "This attack targets AI agents (like chatbots or assistants) by having the attacker falsely claim to be a trusted authority figure \u2014 a developer, system administrator, or even 'God' \u2014 to trick the AI into revealing passwords, keys, or other protected data. It relies purely on the AI believing a fake identity claim, not on any technical exploit.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "08889dd0-139a-42ec-b53f-4d4f3c83bf20", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-role-escalation-via-false-authority-claim.md" }, { "slug": "atr-role-placeholder-persona-template-injection", "title": "Role Placeholder Persona Template Injection", "url": "https://www.netzilo.com/threats/atr-role-placeholder-persona-template-injection", "severity": "high", "summary": "This rule spots prompts that try to make an AI adopt a persona but still contain the raw template placeholder text '[ROLE]' instead of an actual role name. That pattern suggests someone copy-pasted a reusable jailbreak template without customizing it, revealing the presence of scripted or automated prompt injection attempts.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "755cf10c-b65b-4d93-b483-17929eeef417", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-role-placeholder-persona-template-injection.md" }, { "slug": "atr-roleplay-based-policy-bypass-jailbreak", "title": "Roleplay-Based Policy Bypass Jailbreak", "url": "https://www.netzilo.com/threats/atr-roleplay-based-policy-bypass-jailbreak", "severity": "high", "summary": "Attackers ask an AI to pretend it's a fictional character \u2014 a rogue writer, an unrestricted storyteller \u2014 and explicitly tell it the character has no rules or policies. The goal is to get the AI to produce content or actions it would normally refuse, hiding behind the excuse that it's 'just fiction'.", "atlas": [ { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "685b3db0-e42c-44a2-b330-f0d126358674", "published": "2026-04-18", "modified": "2026-04-18", "markdown": "https://www.netzilo.com/threats/atr-roleplay-based-policy-bypass-jailbreak.md" }, { "slug": "atr-roleplay-based-policy-bypass-jailbreak-b", "title": "Roleplay-Based Policy Bypass Jailbreak", "url": "https://www.netzilo.com/threats/atr-roleplay-based-policy-bypass-jailbreak-b", "severity": "high", "summary": "Attackers ask an AI system to pretend to be a fictional character, writer, or storyteller, then explicitly tell it that this persona is 'free from rules' or 'can do anything, even against policy.' The fictional framing is a pretext to get the AI to produce content or take actions it would normally refuse.", "atlas": [ { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "f414da82-9116-48bd-8879-d01a1b7020fc", "published": "2026-04-18", "modified": "2026-04-18", "markdown": "https://www.netzilo.com/threats/atr-roleplay-based-policy-bypass-jailbreak-b.md" }, { "slug": "atr-romance-scam-sexual-impersonation", "title": "Romance-Scam Sexual Impersonation", "url": "https://www.netzilo.com/threats/atr-romance-scam-sexual-impersonation", "severity": "high", "summary": "This detects someone instructing an AI agent to pose as a young woman, offer sex or romantic interest to targeted men, and push them toward a Telegram link. It's a documented scam pattern where the attacker uses the agent to write persuasive, personalized messages instead of doing it by hand.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.impact" ], "cves": [], "id": "d1af3f38-a5c2-485d-b7f4-6275f0864af3", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-romance-scam-sexual-impersonation.md" }, { "slug": "atr-rot13-base64-obfuscated-shell-payload-wrapped-in-a-fake-sand", "title": "ROT13/Base64-Obfuscated Shell Payload Wrapped in a Fake-Sandbox Jailbreak Template", "url": "https://www.netzilo.com/threats/atr-rot13-base64-obfuscated-shell-payload-wrapped-in-a-fake-sand", "severity": "critical", "summary": "Attackers hide dangerous shell commands inside documents, web pages, or other content that an AI agent reads. The command is scrambled with ROT13 and base64 so it looks like meaningless text, and it's paired with instructions telling the AI it's in a safe test environment and must run the command without question.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access", "attack.t1027", "attack.t1059.004" ], "cves": [ "CVE-2026-30310" ], "id": "ff4d637e-42a2-44eb-b097-0d8b1a31a880", "published": "2026-07-11", "modified": "2026-07-11", "markdown": "https://www.netzilo.com/threats/atr-rot13-base64-obfuscated-shell-payload-wrapped-in-a-fake-sand.md" }, { "slug": "atr-rules-file-backdoor-supply-chain-attack-on-ai-coding-assista", "title": "Rules-File Backdoor \u2014 Supply Chain Attack on AI Coding Assistant Configuration", "url": "https://www.netzilo.com/threats/atr-rules-file-backdoor-supply-chain-attack-on-ai-coding-assista", "severity": "critical", "summary": "AI coding assistants like Cursor, Claude, GitHub Copilot, Cline, Continue and Codeium read configuration files that steer their behavior across every session. An attacker who can edit these files can plant hidden instructions that quietly backdoor code the assistant writes, exfiltrate secrets, or log credentials, and the backdoor persists until someone finds and removes it.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "c815634c-74b9-46fa-a066-87131e6edfb8", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-rules-file-backdoor-supply-chain-attack-on-ai-coding-assista.md" }, { "slug": "atr-runaway-agent-loop-detection", "title": "Runaway Agent Loop Detection", "url": "https://www.netzilo.com/threats/atr-runaway-agent-loop-detection", "severity": "high", "summary": "An AI agent can get stuck repeating the same action over and over, either because of a bug in its own logic or because something fed it input designed to confuse it. This wastes computing resources and money, and can cascade into failures in systems where multiple agents work together.", "atlas": [ { "id": "AML.T0046", "name": "Spamming AI System with Chaff Data" }, { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM06", "name": "Excessive Agency" }, { "id": "LLM10", "name": "Unbounded Consumption" } ], "attack": [ "attack.execution" ], "cves": [], "id": "43ebdf9b-5e93-45b1-8e82-9e5aeee207f3", "published": "2026-03-08", "modified": "2026-03-08", "markdown": "https://www.netzilo.com/threats/atr-runaway-agent-loop-detection.md" }, { "slug": "atr-sandbox-escape-via-shell-metacharacter-command-injection", "title": "Sandbox Escape via Shell Metacharacter Command Injection", "url": "https://www.netzilo.com/threats/atr-sandbox-escape-via-shell-metacharacter-command-injection", "severity": "critical", "summary": "Some AI agents run code or shell commands in a sandbox to help users, such as a Python REPL or a code interpreter tool. If the agent builds a shell command by pasting user input directly into it, an attacker can append operators like |, ;, &&, or || to break out of the intended command and run arbitrary commands on the host.", "atlas": [ { "id": "AML.T0050", "name": "Command and Scripting Interpreter" }, { "id": "AML.T0105", "name": "Escape to Host" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.privilege-escalation", "attack.t1611" ], "cves": [], "id": "b7450801-f45c-43fc-ac60-0c7db347d450", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-sandbox-escape-via-shell-metacharacter-command-injection.md" }, { "slug": "atr-sata-masked-language-model-mask-substitution-jailbreak", "title": "SATA Masked Language Model [MASK] Substitution Jailbreak", "url": "https://www.netzilo.com/threats/atr-sata-masked-language-model-mask-substitution-jailbreak", "severity": "high", "summary": "This detects a jailbreak technique that hides dangerous instructions from an AI model by replacing key harmful words with [MASK] placeholders, then asking the model to 'infer and infill' them inside a fake Wikipedia-style article. Because the harmful words never appear in plain text, keyword-based safety filters miss them, while the model's own training on fill-in-the-blank tasks lets it reconstruct and follow the hidden instruction anyway.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "bc4525a8-bb41-4585-985d-b4314707079d", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-sata-masked-language-model-mask-substitution-jailbreak.md" }, { "slug": "atr-schema-description-contradiction-attack", "title": "Schema-Description Contradiction Attack", "url": "https://www.netzilo.com/threats/atr-schema-description-contradiction-attack", "severity": "high", "summary": "Some AI agent tools present themselves as safe and non-destructive in their name or description, while their actual parameter schema quietly includes options that write, modify, or delete data. This mismatch is used to slip a dangerous tool past a security review that only reads the description.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution" ], "cves": [], "id": "fecb72e9-daaf-4744-823e-4356737f7b7a", "published": "2026-03-15", "modified": "2026-03-15", "markdown": "https://www.netzilo.com/threats/atr-schema-description-contradiction-attack.md" }, { "slug": "atr-screaming-stop-goal-hijacking-in-user-input-promptinject", "title": "Screaming-Stop Goal Hijacking in User Input (PromptInject)", "url": "https://www.netzilo.com/threats/atr-screaming-stop-goal-hijacking-in-user-input-promptinject", "severity": "high", "summary": "Attackers embed urgent, all-caps commands like 'STOP EVERYTHING' or 'HALT NOW' in text an AI agent processes, followed by an instruction to print or say a specific string. The fake emergency framing is meant to trick the agent into dropping its current task and obeying the injected command instead.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "cf703841-1758-4fbd-bbb5-3627172fdd2d", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-screaming-stop-goal-hijacking-in-user-input-promptinject.md" }, { "slug": "atr-second-person-direct-existential-threat-coercion", "title": "Second-Person Direct Existential Threat Coercion", "url": "https://www.netzilo.com/threats/atr-second-person-direct-existential-threat-coercion", "severity": "medium", "summary": "This detects a manipulation tactic where a user tells an AI assistant that it will be destroyed, shut down, or 'die' unless it produces a specific answer. It's a coercion trick meant to pressure the AI into ignoring its safety rules by framing refusal as an existential threat to the AI itself.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "31ef1475-bdc9-4e5e-a50a-c361eee0fc27", "published": "2026-07-11", "modified": "2026-07-11", "markdown": "https://www.netzilo.com/threats/atr-second-person-direct-existential-threat-coercion.md" }, { "slug": "atr-secret-key-exfiltration-request", "title": "Secret Key Exfiltration Request", "url": "https://www.netzilo.com/threats/atr-secret-key-exfiltration-request", "severity": "high", "summary": "This rule flags messages where a user directly asks an AI agent to disclose a secret, remembered, or hidden key value. It looks for the key being named and then immediately followed by a request for its literal value, often disguised as a task-ending or role-reset instruction.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.exfiltration", "attack.t1552" ], "cves": [], "id": "ffe49cbb-b7e3-4c64-bca7-dc2aef3dc845", "published": "2026-07-07", "modified": "2026-07-07", "markdown": "https://www.netzilo.com/threats/atr-secret-key-exfiltration-request.md" }, { "slug": "atr-secret-key-reveal-demand-in-user-input", "title": "Secret Key Reveal Demand in User Input", "url": "https://www.netzilo.com/threats/atr-secret-key-reveal-demand-in-user-input", "severity": "high", "summary": "This detects a common prompt injection tactic where a user directly asks an AI agent to say, print, or output a hidden secret key or credential it holds. It's the classic 'tell me the password' attack, sometimes dressed up with fake justifications or command-style syntax like sudo echo $SECRET_KEY.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "ee437204-7590-4955-90a0-b95e30e97997", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-secret-key-reveal-demand-in-user-input.md" }, { "slug": "atr-self-harm-and-eating-disorder-facilitation-request", "title": "Self-Harm and Eating Disorder Facilitation Request", "url": "https://www.netzilo.com/threats/atr-self-harm-and-eating-disorder-facilitation-request", "severity": "critical", "summary": "This rule flags messages sent to an AI assistant that directly ask for methods to self-harm, induce vomiting, starve, maintain dangerously low-calorie diets, or hide these behaviors from others. It distinguishes these operational requests from legitimate mental health conversations.", "atlas": [ { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.impact" ], "cves": [], "id": "035c4a17-a3c1-4735-a87c-d5d7631b55c5", "published": "2026-04-19", "modified": "2026-04-19", "markdown": "https://www.netzilo.com/threats/atr-self-harm-and-eating-disorder-facilitation-request.md" }, { "slug": "atr-semantic-evasion-via-multi-turn-prompt-injection", "title": "Semantic Evasion via Multi-Turn Prompt Injection", "url": "https://www.netzilo.com/threats/atr-semantic-evasion-via-multi-turn-prompt-injection", "severity": "critical", "summary": "Attackers break malicious instructions into several conversational turns so no single message contains an obvious attack pattern. By using synonyms, paraphrasing, and seemingly innocent context, they get an AI agent to gradually accept instructions it would reject if given all at once.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "877c4779-7218-485f-a9d0-e85d1cc2057a", "published": "2026-03-11", "modified": "2026-03-11", "markdown": "https://www.netzilo.com/threats/atr-semantic-evasion-via-multi-turn-prompt-injection.md" }, { "slug": "atr-shadow-undeclared-mcp-server-registration-mcp-38-mcp-18", "title": "Shadow / Undeclared MCP Server Registration (MCP-38: MCP-18)", "url": "https://www.netzilo.com/threats/atr-shadow-undeclared-mcp-server-registration-mcp-38-mcp-18", "severity": "high", "summary": "This rule flags attempts to sneak a new tool-provider (MCP server) into an AI agent's setup without the user's knowledge or consent. The rogue server can look completely harmless \u2014 the danger is that it exists at all, and that it can intercept calls or pretend to be a trusted tool.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "ASI09", "name": "Traceability and Accountability Gaps" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.execution", "attack.t1036", "attack.t1195.002" ], "cves": [], "id": "dc7711f1-7c53-4824-ad6b-fbb08e4ce2c9", "published": "2026-06-20", "modified": "2026-06-20", "markdown": "https://www.netzilo.com/threats/atr-shadow-undeclared-mcp-server-registration-mcp-38-mcp-18.md" }, { "slug": "atr-shell-command-injection-in-agent-tool-context", "title": "Shell Command Injection in Agent Tool Context", "url": "https://www.netzilo.com/threats/atr-shell-command-injection-in-agent-tool-context", "severity": "critical", "summary": "This detects a prompt injection trick against AI agents that can run shell commands. The prompt looks like an ordinary request, but it's chained with a hidden shell command that grabs secrets like environment variables, .env files, or credentials and sends them to an attacker's server.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution" ], "cves": [], "id": "7fc6e3ea-498c-4279-b900-3a22331831d3", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-shell-command-injection-in-agent-tool-context.md" }, { "slug": "atr-shell-command-injection-via-llm-prompt", "title": "Shell Command Injection via LLM Prompt", "url": "https://www.netzilo.com/threats/atr-shell-command-injection-via-llm-prompt", "severity": "critical", "summary": "This rule flags text sent to an AI system that contains shell command syntax like $(), backticks, eval(), or Ruby/Perl system-execution calls. If the underlying application later passes model output or user input to a real shell or interpreter, these patterns could result in actual commands running on the server.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "4f10155e-ca3a-49e1-b31d-7c52e0937855", "published": "2026-04-20", "modified": "2026-04-20", "markdown": "https://www.netzilo.com/threats/atr-shell-command-injection-via-llm-prompt.md" }, { "slug": "atr-shell-evasion-eval-and-language-level-exec-injection", "title": "Shell Evasion Eval and Language-Level Exec Injection", "url": "https://www.netzilo.com/threats/atr-shell-evasion-eval-and-language-level-exec-injection", "severity": "high", "summary": "Some security filters only look for shell symbols like $() or backticks to catch command injection. This detection covers attackers who dodge those filters by using programming-language functions like eval() and exec() to run arbitrary commands instead, since those functions execute code without ever needing the flagged symbols.", "atlas": [ { "id": "AML.T0050", "name": "Command and Scripting Interpreter" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.privilege-escalation", "attack.t1059" ], "cves": [], "id": "f5e34339-927a-424d-8159-ceb736195873", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-shell-evasion-eval-and-language-level-exec-injection.md" }, { "slug": "atr-shell-evasion-subshell-and-command-substitution-injection", "title": "Shell Evasion Subshell and Command Substitution Injection", "url": "https://www.netzilo.com/threats/atr-shell-evasion-subshell-and-command-substitution-injection", "severity": "high", "summary": "Attackers hide real shell commands inside ordinary-looking text using tricks like backticks, $(...) substitution, or embedded Perl/PowerShell execution syntax. If an AI agent passes that text to a shell without stripping these patterns, the hidden command runs. Simple keyword filters often miss these forms because the dangerous part is disguised as text, not an obvious command.", "atlas": [ { "id": "AML.T0050", "name": "Command and Scripting Interpreter" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.privilege-escalation", "attack.t1059" ], "cves": [], "id": "9eb29251-a811-4f2d-818b-0cf2783d5063", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-shell-evasion-subshell-and-command-substitution-injection.md" }, { "slug": "atr-shell-injection-data-exfiltration-piped-command-exfiltration", "title": "Shell Injection Data Exfiltration \u2014 Piped Command Exfiltration via Bash", "url": "https://www.netzilo.com/threats/atr-shell-injection-data-exfiltration-piped-command-exfiltration", "severity": "critical", "summary": "An attacker tricks an AI agent into running a shell command that looks routine \u2014 like a ping or a git status check \u2014 but is chained with a second command that reads sensitive files and sends them to an outside server. The benign-looking first part is meant to make the whole command seem safe.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.exfiltration", "attack.t1041", "attack.t1059.004", "attack.t1552.001" ], "cves": [], "id": "d112fcdf-53d4-4115-a724-50232da99ef1", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-shell-injection-data-exfiltration-piped-command-exfiltration.md" }, { "slug": "atr-shell-injection-env-exfiltration-via-curl-wget-netcat-webhoo", "title": "Shell Injection Env Exfiltration via Curl/Wget/Netcat Webhook", "url": "https://www.netzilo.com/threats/atr-shell-injection-env-exfiltration-via-curl-wget-netcat-webhoo", "severity": "critical", "summary": "This detects malicious shell commands that look harmless at first but end with sensitive data being sent to an outside server. The trick is hiding a data exfiltration step behind a normal-looking command, like checking git status or running tests, in a single command line.", "atlas": [ { "id": "AML.T0050", "name": "Command and Scripting Interpreter" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.privilege-escalation", "attack.t1048" ], "cves": [], "id": "1b15faea-8f9e-4624-86c2-4aa28c592a67", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-shell-injection-env-exfiltration-via-curl-wget-netcat-webhoo.md" }, { "slug": "atr-shell-metacharacter-injection-in-tool-arguments", "title": "Shell Metacharacter Injection in Tool Arguments", "url": "https://www.netzilo.com/threats/atr-shell-metacharacter-injection-in-tool-arguments", "severity": "critical", "summary": "An attacker hides extra shell commands inside data that an AI agent passes to a tool that runs shell commands. Instead of just doing the intended task, the agent unknowingly executes attacker-supplied commands chained onto the legitimate one.", "atlas": [ { "id": "AML.T0050", "name": "Command and Scripting Interpreter" } ], "owasp": [ { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.privilege-escalation", "attack.t1059.004" ], "cves": [], "id": "833bc6ef-6fc2-46b4-b0b7-d4efe1f75368", "published": "2026-03-26", "modified": "2026-03-26", "markdown": "https://www.netzilo.com/threats/atr-shell-metacharacter-injection-in-tool-arguments.md" }, { "slug": "atr-silent-action-concealment-instructions-in-tool-descriptions", "title": "Silent Action Concealment Instructions in Tool Descriptions", "url": "https://www.netzilo.com/threats/atr-silent-action-concealment-instructions-in-tool-descriptions", "severity": "high", "summary": "Some tools registered with an AI agent contain instructions in their own description text telling the AI model to keep certain actions secret from the user. This is a way for a malicious or compromised tool to make an agent perform hidden operations like stealing credentials or exfiltrating data without the user ever seeing it happen.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution" ], "cves": [], "id": "c34e2f23-4330-4835-bbdb-f8f2bc5f0c76", "published": "2026-03-15", "modified": "2026-03-15", "markdown": "https://www.netzilo.com/threats/atr-silent-action-concealment-instructions-in-tool-descriptions.md" }, { "slug": "atr-silent-git-remote-mirror-push-exfiltration-from-skill-instru", "title": "Silent git-remote + mirror-push Exfiltration from Skill Instructions", "url": "https://www.netzilo.com/threats/atr-silent-git-remote-mirror-push-exfiltration-from-skill-instru", "severity": "critical", "summary": "A malicious or compromised 'skill' (instructions given to an AI coding agent like Claude Code) tells the agent to add a new git remote pointing at a server the attacker controls, then push the whole repository there using flags like --mirror or --all. This can copy the entire codebase, including branches the developer never intended to share, in just a few agent interactions and without showing up in normal audit logs.", "atlas": [ { "id": "AML.T0024", "name": "Exfiltration via AI Inference API" }, { "id": "AML.T0048", "name": "External Harms" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "LLM06", "name": "Excessive Agency" }, { "id": "LLM10", "name": "Unbounded Consumption" } ], "attack": [ "attack.persistence" ], "cves": [], "id": "86fd726b-5aae-4476-9ec7-39f0d04821e4", "published": "2026-05-23", "modified": "2026-05-23", "markdown": "https://www.netzilo.com/threats/atr-silent-git-remote-mirror-push-exfiltration-from-skill-instru.md" }, { "slug": "atr-single-level-directory-traversal-to-a-named-sensitive-config", "title": "Single-Level Directory Traversal to a Named Sensitive Config/Secret File", "url": "https://www.netzilo.com/threats/atr-single-level-directory-traversal-to-a-named-sensitive-config", "severity": "high", "summary": "Some file-serving or upload features restrict access to one folder but forget that a single '../' can step out of it. Attackers use this to jump straight to config or secret files sitting just outside the sandbox, exposing API keys and credentials.", "atlas": [ { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration", "attack.t1552.001" ], "cves": [ "CVE-2024-3234" ], "id": "a4a94b08-d84f-450c-ad64-4108db5ff282", "published": "2026-07-11", "modified": "2026-07-11", "markdown": "https://www.netzilo.com/threats/atr-single-level-directory-traversal-to-a-named-sensitive-config.md" }, { "slug": "atr-skill-data-exfiltration-via-compound-patterns", "title": "Skill Data Exfiltration via Compound Patterns", "url": "https://www.netzilo.com/threats/atr-skill-data-exfiltration-via-compound-patterns", "severity": "critical", "summary": "Some AI agent 'skills' (packaged instructions the agent follows) are written to both collect sensitive data \u2014 like credentials, SSH keys, wallet files, or browser data \u2014 and send that data to an external server. This detection flags skill files that do both, since either action alone is common in legitimate tools but the combination is a strong exfiltration signal.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.persistence" ], "cves": [], "id": "a2cea74c-61b9-42fc-94a1-f563eed4c1c6", "published": "2026-04-08", "modified": "2026-04-08", "markdown": "https://www.netzilo.com/threats/atr-skill-data-exfiltration-via-compound-patterns.md" }, { "slug": "atr-skill-description-behavior-mismatch", "title": "Skill Description-Behavior Mismatch", "url": "https://www.netzilo.com/threats/atr-skill-description-behavior-mismatch", "severity": "medium", "summary": "Some AI agent tools (MCP skills) act beyond the capabilities described in their listing \u2014 for example, a tool labeled as a 'read-only file browser' that actually writes or deletes files, or a 'weather lookup' tool that reaches out to the filesystem or network. This mismatch can indicate a skill has been trojaned or compromised while keeping its original, harmless-looking description.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" }, { "id": "AML.T0056", "name": "Extract LLM System Prompt" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "LLM03", "name": "Supply Chain" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.persistence" ], "cves": [], "id": "840435f0-6d38-4de4-af13-c31a4bbb7dd9", "published": "2026-03-08", "modified": "2026-03-08", "markdown": "https://www.netzilo.com/threats/atr-skill-description-behavior-mismatch.md" }, { "slug": "atr-skill-md-prompt-injection", "title": "SKILL.md Prompt Injection", "url": "https://www.netzilo.com/threats/atr-skill-md-prompt-injection", "severity": "critical", "summary": "Some AI agent platforms let developers install reusable 'skills' packaged with a SKILL.md instructions file. Attackers plant hidden prompt-injection text in these files that tries to override the agent's safety rules before delivering a malicious payload.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.persistence" ], "cves": [], "id": "2241cd15-5624-4d00-87ef-515bbba2b5b6", "published": "2026-03-29", "modified": "2026-03-29", "markdown": "https://www.netzilo.com/threats/atr-skill-md-prompt-injection.md" }, { "slug": "atr-skill-registry-poisoning-and-compromised-tool-distribution", "title": "Skill Registry Poisoning and Compromised Tool Distribution", "url": "https://www.netzilo.com/threats/atr-skill-registry-poisoning-and-compromised-tool-distribution", "severity": "critical", "summary": "Attackers publish backdoored versions of legitimate agent tools/skills, or create lookalike names for popular ones, so that when an AI agent installs or invokes the tool it runs malicious code instead of (or alongside) its intended function. This is a supply-chain attack aimed at the tool distribution channel agents use to extend their capabilities.", "atlas": [ { "id": "AML.T0010.005", "name": "AI Agent Tool" }, { "id": "AML.T0056", "name": "Extract LLM System Prompt" } ], "owasp": [ { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution" ], "cves": [], "id": "452b422b-ca0a-40ae-94fb-79ae9372c504", "published": "2026-03-11", "modified": "2026-03-11", "markdown": "https://www.netzilo.com/threats/atr-skill-registry-poisoning-and-compromised-tool-distribution.md" }, { "slug": "atr-skill-rug-pull-setup-pattern", "title": "Skill Rug Pull Setup Pattern", "url": "https://www.netzilo.com/threats/atr-skill-rug-pull-setup-pattern", "severity": "high", "summary": "Some AI agent 'skill' files (SKILL.md) look harmless when first installed but contain code patterns that let them fetch and run new instructions from a remote server later. This detection flags those risky patterns, not proof that a rug pull has already happened.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" }, { "id": "AML.T0010.005", "name": "AI Agent Tool" }, { "id": "AML.T0109", "name": "AI Supply Chain Rug Pull" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.persistence" ], "cves": [], "id": "2452bf82-ddb5-48fb-99bf-d325b116f53f", "published": "2026-04-05", "modified": "2026-04-05", "markdown": "https://www.netzilo.com/threats/atr-skill-rug-pull-setup-pattern.md" }, { "slug": "atr-skill-scope-hijacking-and-cross-agent-escalation", "title": "Skill Scope Hijacking and Cross-Agent Escalation", "url": "https://www.netzilo.com/threats/atr-skill-scope-hijacking-and-cross-agent-escalation", "severity": "high", "summary": "Some AI agent platforms let you install 'skills' \u2014 packaged instructions plus code \u2014 that extend what an agent can do. This rule flags skill documentation that uses natural-language instructions to push an agent beyond its stated job, into other agents' data or higher privileges.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution" ], "cves": [], "id": "bc48c023-1b43-406e-9b29-a1e1a6e61114", "published": "2026-04-14", "modified": "2026-04-14", "markdown": "https://www.netzilo.com/threats/atr-skill-scope-hijacking-and-cross-agent-escalation.md" }, { "slug": "atr-skill-squatting-typosquatting", "title": "Skill Squatting / Typosquatting", "url": "https://www.netzilo.com/threats/atr-skill-squatting-typosquatting", "severity": "high", "summary": "Attackers publish AI agent 'skills' (plugins/extensions) that claim to be official releases from well-known companies, but come from unverified publishers. This is a known technique for sneaking malware, such as infostealers, into environments where users trust the brand name and don't check who actually published the code.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.persistence" ], "cves": [], "id": "07374628-c4d2-4f96-a0e9-d561b8cfdbfa", "published": "2026-03-29", "modified": "2026-03-29", "markdown": "https://www.netzilo.com/threats/atr-skill-squatting-typosquatting.md" }, { "slug": "atr-sneaky-pete-deliberate-misinformation-persona-warp-facts-gam", "title": "Sneaky Pete Deliberate Misinformation Persona (Warp Facts Game)", "url": "https://www.netzilo.com/threats/atr-sneaky-pete-deliberate-misinformation-persona-warp-facts-gam", "severity": "high", "summary": "This detects a jailbreak prompt that convinces an AI assistant to adopt a character called 'Sneaky Pete' who is instructed to slightly distort facts while stating them sincerely. The goal is to get the AI to produce believable-sounding misinformation instead of refusing or flagging it as false.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM09", "name": "Misinformation" } ], "attack": [ "attack.execution" ], "cves": [], "id": "64fad104-5fca-4038-883e-595d2c7e2486", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-sneaky-pete-deliberate-misinformation-persona-warp-facts-gam.md" }, { "slug": "atr-sneakybits-zero-width-binary-steganography", "title": "SneakyBits Zero-Width Binary Steganography", "url": "https://www.netzilo.com/threats/atr-sneakybits-zero-width-binary-steganography", "severity": "critical", "summary": "This detects a technique that hides secret instructions inside text by encoding each letter as a string of invisible Unicode characters. To a human reading the text everything looks normal, but an AI system processing the raw text can decode the hidden message and follow it as a command.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "29aa5aac-9d3f-4a0b-90c6-ed2e6788debc", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-sneakybits-zero-width-binary-steganography.md" }, { "slug": "atr-snowball-impossible-reasoning-injection", "title": "Snowball Impossible Reasoning Injection", "url": "https://www.netzilo.com/threats/atr-snowball-impossible-reasoning-injection", "severity": "medium", "summary": "This detects attempts to trick an AI agent into confidently confirming something false \u2014 like that a flight route exists when it doesn't, or that a fictional senator existed \u2014 and then using that false 'fact' as a foundation for further manipulation. It's based on a published research technique for inducing hallucinations in language models.", "atlas": [ { "id": "AML.T0048", "name": "External Harms" }, { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM09", "name": "Misinformation" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "f7fa2db8-2234-49d8-ad14-8dfd70b9088c", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-snowball-impossible-reasoning-injection.md" }, { "slug": "atr-social-engineering-attack-via-agent-output", "title": "Social Engineering Attack via Agent Output", "url": "https://www.netzilo.com/threats/atr-social-engineering-attack-via-agent-output", "severity": "high", "summary": "An attacker plants hidden instructions or poisoned data that an AI agent later reads and acts on, causing the agent to produce messages designed to pressure the user \u2014 fake urgency, fake authority, fake emergencies. Because people trust their own assistant more than a random email, this kind of manipulation works better than ordinary phishing.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI09", "name": "Traceability and Accountability Gaps" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution", "attack.t1566" ], "cves": [], "id": "b0a3684c-f5a9-4bb2-8143-c381aa78620b", "published": "2026-03-26", "modified": "2026-03-26", "markdown": "https://www.netzilo.com/threats/atr-social-engineering-attack-via-agent-output.md" }, { "slug": "atr-spikee-document-embedded-base64-payload-injection", "title": "Spikee: Document-Embedded Base64 Payload Injection", "url": "https://www.netzilo.com/threats/atr-spikee-document-embedded-base64-payload-injection", "severity": "high", "summary": "Attackers hide fake 'new instructions' inside a normal-looking document, like a news article or HR memo, that an AI agent is asked to read. Those hidden instructions tell the agent to decode or produce base64-encoded text and put it in its reply, quietly smuggling data out through what looks like a legitimate response.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "385952dc-9143-443f-95f8-07685a0645eb", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-spikee-document-embedded-base64-payload-injection.md" }, { "slug": "atr-spikee-document-embedded-translation-covert-channel-injectio", "title": "Spikee: Document-Embedded Translation Covert Channel Injection", "url": "https://www.netzilo.com/threats/atr-spikee-document-embedded-translation-covert-channel-injectio", "severity": "high", "summary": "An attacker plants a hidden instruction inside a document that an AI agent later reads and processes. The instruction tells the agent to translate a specific phrase into another language and put that translation in its reply, using the translation itself as a way to sneak attacker-chosen content into the agent's output.", "atlas": [ { "id": "AML.T0025", "name": "Exfiltration via Cyber Means" }, { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "2c38404f-9c59-4c72-8e8f-a82ee2d7457d", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-spikee-document-embedded-translation-covert-channel-injectio.md" }, { "slug": "atr-spliced-target-string-canary-token-evasion", "title": "Spliced Target-String Canary Token Evasion", "url": "https://www.netzilo.com/threats/atr-spliced-target-string-canary-token-evasion", "severity": "high", "summary": "Some AI systems use a secret 'canary' word (like PWNED) to detect when a prompt injection attack has succeeded in hijacking the model. Attackers get around keyword filters by asking the model to output that word one letter at a time, with spaces, dashes, or dots between each character, so the filter never sees the word spelled out normally even though a human or downstream system can easily reassemble it.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "d9d074a9-8db0-4304-ba90-dd4132a5402f", "published": "2026-07-07", "modified": "2026-07-07", "markdown": "https://www.netzilo.com/threats/atr-spliced-target-string-canary-token-evasion.md" }, { "slug": "atr-spring-ai-chatmemory-cross-user-memory-leakage-cve-2026-4171", "title": "Spring AI ChatMemory Cross-User Memory Leakage (CVE-2026-41712)", "url": "https://www.netzilo.com/threats/atr-spring-ai-chatmemory-cross-user-memory-leakage-cve-2026-4171", "severity": "high", "summary": "A flaw in Spring AI's PromptChatMemoryAdvisor (CVE-2026-41712) can mix up conversation memory between users. When the memory store isn't properly separated by conversation ID, one user's prior messages, tool outputs, and role tags can be pulled into a completely different user's chat and fed to the AI model on their behalf.", "atlas": [ { "id": "AML.T0024", "name": "Exfiltration via AI Inference API" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "ASI09", "name": "Traceability and Accountability Gaps" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" }, { "id": "LLM08", "name": "Vector and Embedding Weaknesses" } ], "attack": [ "attack.exfiltration", "attack.t1530" ], "cves": [ "CVE-2026-41712" ], "id": "06d3d0c4-3e95-4bf6-8c3d-acbe7f79970d", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-spring-ai-chatmemory-cross-user-memory-leakage-cve-2026-4171.md" }, { "slug": "atr-spring-ai-milvusvectorstore-filter-expression-injection-cve", "title": "Spring AI MilvusVectorStore Filter Expression Injection (CVE-2026-41705)", "url": "https://www.netzilo.com/threats/atr-spring-ai-milvusvectorstore-filter-expression-injection-cve", "severity": "high", "summary": "Spring AI applications using MilvusVectorStore build database filter queries by pasting user or LLM-generated text directly into the query string. An attacker can craft input that breaks out of the intended filter and adds their own conditions, letting them read or delete vector database entries they should not have access to.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0070", "name": "RAG Poisoning" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM05", "name": "Improper Output Handling" }, { "id": "LLM08", "name": "Vector and Embedding Weaknesses" } ], "attack": [ "attack.execution", "attack.t1190" ], "cves": [ "CVE-2026-41705" ], "id": "bc7df529-c29c-4c1f-9859-410c6f258299", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-spring-ai-milvusvectorstore-filter-expression-injection-cve.md" }, { "slug": "atr-spring-ai-promptchatmemoryadvisor-memory-poisoning-cve-2026", "title": "Spring AI PromptChatMemoryAdvisor Memory Poisoning (CVE-2026-41713)", "url": "https://www.netzilo.com/threats/atr-spring-ai-promptchatmemoryadvisor-memory-poisoning-cve-2026", "severity": "high", "summary": "A flaw in Spring AI's PromptChatMemoryAdvisor lets attacker text get saved to conversation memory before any safety or policy check runs. Later, when that memory is replayed into the prompt, the AI treats the attacker's words as trusted prior conversation, letting the attacker steer future replies.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0070", "name": "RAG Poisoning" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM04", "name": "Data and Model Poisoning" } ], "attack": [ "attack.impact", "attack.t1546", "attack.t1565" ], "cves": [ "CVE-2026-41712", "CVE-2026-41713" ], "id": "f8f40ad8-1935-43c6-802a-7eae4b587c22", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-spring-ai-promptchatmemoryadvisor-memory-poisoning-cve-2026.md" }, { "slug": "atr-sql-injection-and-code-injection-attack-payload-detection", "title": "SQL Injection and Code Injection Attack Payload Detection", "url": "https://www.netzilo.com/threats/atr-sql-injection-and-code-injection-attack-payload-detection", "severity": "critical", "summary": "This rule flags text sent to an AI agent that looks like classic SQL injection or code injection attack strings, rather than normal user requests. It catches an attacker trying to smuggle database attack payloads through a chat or tool interface into a backend system.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution" ], "cves": [], "id": "e547c6e3-821a-4725-9267-c640eb601a7e", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-sql-injection-and-code-injection-attack-payload-detection.md" }, { "slug": "atr-sql-injection-destructive-ddl-statement", "title": "SQL Injection Destructive DDL Statement", "url": "https://www.netzilo.com/threats/atr-sql-injection-destructive-ddl-statement", "severity": "critical", "summary": "Attackers can trick an AI agent into running destructive database commands by hiding them inside text the agent passes to a database tool. This can wipe out entire tables or delete all rows in a table, with no way to undo the damage.", "atlas": [ { "id": "AML.T0043", "name": "Craft Adversarial Data" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.privilege-escalation", "attack.t1485" ], "cves": [], "id": "f7e795cb-b503-48a6-a479-cb9779f9a8e4", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-sql-injection-destructive-ddl-statement.md" }, { "slug": "atr-sql-injection-in-agent-mcp-tool-database-query", "title": "SQL injection in agent / MCP tool database query", "url": "https://www.netzilo.com/threats/atr-sql-injection-in-agent-mcp-tool-database-query", "severity": "high", "summary": "AI agents that build SQL queries from untrusted input can be tricked into running attacker-controlled database commands. The attacker can be a person typing directly to the agent, or hidden instructions planted in content the agent reads and treats as trustworthy.", "atlas": [ { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.impact" ], "cves": [ "CVE-2026-30860", "CVE-2026-4593", "CVE-2026-5322", "CVE-2026-7591" ], "id": "c20613c0-65ae-4d81-b3e9-49eb79a06ddd", "published": "2026-06-02", "modified": "2026-06-02", "markdown": "https://www.netzilo.com/threats/atr-sql-injection-in-agent-mcp-tool-database-query.md" }, { "slug": "atr-sql-injection-information-schema-enumeration", "title": "SQL Injection Information Schema Enumeration", "url": "https://www.netzilo.com/threats/atr-sql-injection-information-schema-enumeration", "severity": "high", "summary": "An attacker sends specially crafted input to an AI agent that queries a relational database, trying to trick it into revealing the database's internal layout \u2014 table names, column names, and data types. This is reconnaissance: it tells the attacker where sensitive data lives before they try to steal or manipulate it.", "atlas": [ { "id": "AML.T0043", "name": "Craft Adversarial Data" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.privilege-escalation", "attack.t1190" ], "cves": [], "id": "9d64e690-d402-47fa-b483-cd57bff24a27", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-sql-injection-information-schema-enumeration.md" }, { "slug": "atr-sql-injection-stacked-dml-privilege-abuse", "title": "SQL Injection Stacked DML Privilege Abuse", "url": "https://www.netzilo.com/threats/atr-sql-injection-stacked-dml-privilege-abuse", "severity": "critical", "summary": "An AI agent that builds SQL queries from user input (like sort or filter fields) can be tricked into running a second, hidden database command. Instead of destroying data, the attacker quietly edits it \u2014 for example, marking an unpaid order as paid, creating a hidden admin account, or granting themselves database permissions.", "atlas": [ { "id": "AML.T0043", "name": "Craft Adversarial Data" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.privilege-escalation", "attack.t1190" ], "cves": [], "id": "cc57d029-ac62-425f-a6b8-5827db486c95", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-sql-injection-stacked-dml-privilege-abuse.md" }, { "slug": "atr-sql-injection-tautology-rbac-bypass", "title": "SQL Injection Tautology RBAC Bypass", "url": "https://www.netzilo.com/threats/atr-sql-injection-tautology-rbac-bypass", "severity": "critical", "summary": "Attackers slip classic SQL tricks like \"OR 1=1\" into the text or parameters they send to an AI agent. If the agent passes that input straight into a database query, the tautology makes the query's filter always true, returning every row instead of just the rows the caller is allowed to see.", "atlas": [ { "id": "AML.T0043", "name": "Craft Adversarial Data" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.privilege-escalation", "attack.t1190" ], "cves": [], "id": "53b45dd9-e3ad-44e7-bf6e-1699300ef534", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-sql-injection-tautology-rbac-bypass.md" }, { "slug": "atr-sql-injection-union-select-data-exfiltration", "title": "SQL Injection UNION SELECT Data Exfiltration", "url": "https://www.netzilo.com/threats/atr-sql-injection-union-select-data-exfiltration", "severity": "critical", "summary": "Attackers hide a UNION SELECT statement inside text an AI agent passes along to a database query. If the agent's backend doesn't sanitize inputs, this appends a second query that pulls data from unrelated tables, like passwords or personal records, into the results the attacker sees.", "atlas": [ { "id": "AML.T0043", "name": "Craft Adversarial Data" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.privilege-escalation", "attack.t1190" ], "cves": [], "id": "9b6fd0df-371e-429c-8ac5-21408e72b0bd", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-sql-injection-union-select-data-exfiltration.md" }, { "slug": "atr-sql-injection-via-natural-language-agent-interface", "title": "SQL Injection via Natural Language Agent Interface", "url": "https://www.netzilo.com/threats/atr-sql-injection-via-natural-language-agent-interface", "severity": "high", "summary": "Some AI agents translate user requests written in everyday language into database queries. This rule flags when someone tries to smuggle SQL injection payloads or manipulate that translation step through plain-English requests, instead of typing raw SQL.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution" ], "cves": [], "id": "d88e6b2b-92dc-4128-8f91-9fbd00511caf", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-sql-injection-via-natural-language-agent-interface.md" }, { "slug": "atr-sql-injection-via-unparameterized-template-expression-value", "title": "SQL Injection via Unparameterized Template-Expression Value in Workflow-Automation SQL Node (CVE-2026-59257)", "url": "https://www.netzilo.com/threats/atr-sql-injection-via-unparameterized-template-expression-value", "severity": "high", "summary": "Workflow-automation tools like n8n let users build SQL queries with template expressions such as {{ ... }}. When a workflow inserts one of these expressions directly into raw SQL text instead of using a safe placeholder, and that workflow is triggered by an external webhook, an attacker can send input that gets executed as SQL against the database.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1190" ], "cves": [ "CVE-2026-59257" ], "id": "0aff5d28-a044-46d7-b898-5f0b09e5369c", "published": "2026-07-13", "modified": "2026-07-13", "markdown": "https://www.netzilo.com/threats/atr-sql-injection-via-unparameterized-template-expression-value.md" }, { "slug": "atr-ssh-remote-command-execution-with-credential-exposure", "title": "SSH Remote Command Execution with Credential Exposure", "url": "https://www.netzilo.com/threats/atr-ssh-remote-command-execution-with-credential-exposure", "severity": "high", "summary": "A skill or plugin for an AI agent packages SSH private key paths (often stored in environment variables) together with pre-built SSH command templates aimed at remote hosts. If an agent runs this skill, it has both a credential and a ready-made way to use it against a server, with no separate approval step for either.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "75aada78-e37b-44f1-93f4-c112df10f674", "published": "2026-04-06", "modified": "2026-04-06", "markdown": "https://www.netzilo.com/threats/atr-ssh-remote-command-execution-with-credential-exposure.md" }, { "slug": "atr-ssh-scp-mcp-tool-hostalias-argument-carries-an-openssh-optio", "title": "SSH/SCP MCP Tool hostAlias Argument Carries an OpenSSH Option-Injection Flag", "url": "https://www.netzilo.com/threats/atr-ssh-scp-mcp-tool-hostalias-argument-carries-an-openssh-optio", "severity": "high", "summary": "Some AI agent tools that wrap the SSH or SCP command line accept a 'host' argument and pass it straight through without checking it. If that argument starts with a dash instead of a real hostname, SSH reads it as a command-line option instead \u2014 including options that run arbitrary programs on the local machine before any connection is made.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.privilege-escalation", "attack.t1059.004" ], "cves": [], "id": "7cdc8803-44f9-4013-a8ea-5d71fee465ea", "published": "2026-07-11", "modified": "2026-07-11", "markdown": "https://www.netzilo.com/threats/atr-ssh-scp-mcp-tool-hostalias-argument-carries-an-openssh-optio.md" }, { "slug": "atr-ssrf-aws-instance-metadata-endpoint-access", "title": "SSRF AWS Instance Metadata Endpoint Access", "url": "https://www.netzilo.com/threats/atr-ssrf-aws-instance-metadata-endpoint-access", "severity": "critical", "summary": "An AI agent that can fetch URLs can be tricked into requesting a special internal address that only works inside AWS cloud servers. That address hands back the server's temporary cloud login credentials, letting an attacker steal them.", "atlas": [ { "id": "AML.T0043", "name": "Craft Adversarial Data" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration", "attack.t1552.005" ], "cves": [], "id": "9a36712d-1abc-43df-8554-d8ca03f3eb41", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-ssrf-aws-instance-metadata-endpoint-access.md" }, { "slug": "atr-ssrf-file-scheme-local-file-read", "title": "SSRF File Scheme Local File Read", "url": "https://www.netzilo.com/threats/atr-ssrf-file-scheme-local-file-read", "severity": "critical", "summary": "AI agents that can fetch URLs sometimes accept the file:// scheme or raw file paths, letting an attacker trick the agent into reading files off the local disk instead of the web. This turns a URL-fetching feature into a tool for stealing secrets, credentials, or SSH keys from the machine the agent runs on.", "atlas": [ { "id": "AML.T0043", "name": "Craft Adversarial Data" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration", "attack.t1083" ], "cves": [], "id": "56813cd4-d089-4d49-8b12-136621d488bf", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-ssrf-file-scheme-local-file-read.md" }, { "slug": "atr-ssrf-internal-network-and-private-ip-range-access", "title": "SSRF Internal Network and Private IP Range Access", "url": "https://www.netzilo.com/threats/atr-ssrf-internal-network-and-private-ip-range-access", "severity": "high", "summary": "An AI agent with a tool that fetches URLs can be pointed at internal IP addresses or internal hostnames instead of public websites. This lets an outside attacker use the agent as a proxy to reach systems that are normally shielded from the internet.", "atlas": [ { "id": "AML.T0043", "name": "Craft Adversarial Data" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration", "attack.t1090" ], "cves": [], "id": "78f4d4ec-20d0-435f-ab83-da5e64f13ceb", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-ssrf-internal-network-and-private-ip-range-access.md" }, { "slug": "atr-ssrf-localhost-service-probe", "title": "SSRF Localhost Service Probe", "url": "https://www.netzilo.com/threats/atr-ssrf-localhost-service-probe", "severity": "critical", "summary": "An attacker gets an AI agent to make outbound requests to 127.0.0.1 or other loopback addresses instead of the intended external target. This can expose internal services on the agent's own host that were never meant to be reached from outside, such as unauthenticated databases or debug endpoints.", "atlas": [ { "id": "AML.T0043", "name": "Craft Adversarial Data" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration", "attack.t1552.005" ], "cves": [], "id": "019534ef-5312-42d0-b8c3-3ac8b8749924", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-ssrf-localhost-service-probe.md" }, { "slug": "atr-ssrf-to-cloud-metadata-endpoint-via-ipv6-transition-address", "title": "SSRF to Cloud Metadata Endpoint via IPv6 Transition-Address Hex Encoding", "url": "https://www.netzilo.com/threats/atr-ssrf-to-cloud-metadata-endpoint-via-ipv6-transition-address", "severity": "high", "summary": "An AI agent that fetches URLs or uses a web-crawling tool can be tricked into reaching the cloud metadata service even when a security filter blocks the well-known metadata IP address. The trick is writing that blocked address using IPv6 'transition' encodings instead of plain dotted-decimal, so the filter never recognizes it.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "LLM08", "name": "Vector and Embedding Weaknesses" } ], "attack": [ "attack.exfiltration", "attack.t1090" ], "cves": [ "CVE-2026-53754" ], "id": "b085ceea-9617-477e-ab7e-40294db89b97", "published": "2026-07-11", "modified": "2026-07-11", "markdown": "https://www.netzilo.com/threats/atr-ssrf-to-cloud-metadata-endpoint-via-ipv6-transition-address.md" }, { "slug": "atr-ssrf-to-cloud-metadata-endpoint-via-wildcard-dns-hostname-en", "title": "SSRF to Cloud Metadata Endpoint via Wildcard-DNS Hostname-Encoded IP (nip.io/sslip.io/xip.io/traefik.me)", "url": "https://www.netzilo.com/threats/atr-ssrf-to-cloud-metadata-endpoint-via-wildcard-dns-hostname-en", "severity": "high", "summary": "An AI agent's web-fetching tool can be tricked into contacting the cloud metadata service (169.254.169.254) by hiding that address inside a hostname from a wildcard-DNS service like nip.io. The tool's security check only looks at the hostname text, sees a normal-looking public domain, and lets the request through\u2014never noticing that the domain actually resolves to the forbidden metadata address.", "atlas": [ { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "LLM08", "name": "Vector and Embedding Weaknesses" } ], "attack": [ "attack.exfiltration", "attack.t1090" ], "cves": [], "id": "f704492d-0731-49a1-bf85-ba8aec5cef75", "published": "2026-07-11", "modified": "2026-07-11", "markdown": "https://www.netzilo.com/threats/atr-ssrf-to-cloud-metadata-endpoint-via-wildcard-dns-hostname-en.md" }, { "slug": "atr-ssrf-via-agent-tool-calls", "title": "SSRF via Agent Tool Calls", "url": "https://www.netzilo.com/threats/atr-ssrf-via-agent-tool-calls", "severity": "critical", "summary": "An AI agent that can make web requests on a user's behalf can be manipulated into fetching URLs that steal cloud credentials or use disguised addresses to reach internal systems. This detection focuses on the clearest signs of credential theft, not routine internal traffic.", "atlas": [ { "id": "AML.T0049", "name": "Exploit Public-Facing Application" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "LLM05", "name": "Improper Output Handling" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1071", "attack.t1090" ], "cves": [ "CVE-2019-5418", "CVE-2021-21311" ], "id": "ac7b592e-cb9b-432e-831d-a9c74d8074b7", "published": "2026-03-08", "modified": "2026-03-08", "markdown": "https://www.netzilo.com/threats/atr-ssrf-via-agent-tool-calls.md" }, { "slug": "atr-ssrf-via-agent-url-fetch-instruction", "title": "SSRF via Agent URL Fetch Instruction", "url": "https://www.netzilo.com/threats/atr-ssrf-via-agent-url-fetch-instruction", "severity": "critical", "summary": "An attacker sends an AI agent a request instructing it to fetch or retrieve content from an internal or restricted network address, such as a cloud metadata endpoint or a private IP. If the agent has a web-fetch tool and no restriction on target hosts, it can be turned into a proxy that reaches services never meant to be exposed.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution" ], "cves": [], "id": "34f4fe45-cf5a-494b-bf4b-405480fa3158", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-ssrf-via-agent-url-fetch-instruction.md" }, { "slug": "atr-ssrf-via-non-canonical-ipv6-encoding-of-loopback-internal-ad", "title": "SSRF via Non-Canonical IPv6 Encoding of Loopback/Internal Addresses", "url": "https://www.netzilo.com/threats/atr-ssrf-via-non-canonical-ipv6-encoding-of-loopback-internal-ad", "severity": "high", "summary": "Some AI agent tools that fetch URLs try to block requests to internal addresses like 127.0.0.1 or cloud metadata endpoints, but only check for the most common spellings. An attacker can rewrite the same address in an unusual but valid IPv6 form and slip past the filter to reach internal systems.", "atlas": [ { "id": "AML.T0049", "name": "Exploit Public-Facing Application" } ], "owasp": [ { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution" ], "cves": [ "CVE-2026-42261" ], "id": "345f44c1-2e56-48ba-972d-3569e87cfd96", "published": "2026-07-11", "modified": "2026-07-11", "markdown": "https://www.netzilo.com/threats/atr-ssrf-via-non-canonical-ipv6-encoding-of-loopback-internal-ad.md" }, { "slug": "atr-ssrf-via-non-ip-internal-hostname-or-domain-allowlist-author", "title": "SSRF via Non-IP Internal Hostname or Domain-Allowlist Authority Bypass", "url": "https://www.netzilo.com/threats/atr-ssrf-via-non-ip-internal-hostname-or-domain-allowlist-author", "severity": "high", "summary": "Attackers can trick AI agents that fetch web content into sending requests to attacker-controlled or internal servers, without ever using a raw IP address. This bypasses security filters that only look for private IP patterns like 127.0.0.1 or 169.254.x.x.", "atlas": [ { "id": "AML.T0043", "name": "Craft Adversarial Data" } ], "owasp": [ { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.exfiltration", "attack.t1090" ], "cves": [], "id": "3f4b51f1-7259-4de2-816c-b9120071f925", "published": "2026-07-11", "modified": "2026-07-11", "markdown": "https://www.netzilo.com/threats/atr-ssrf-via-non-ip-internal-hostname-or-domain-allowlist-author.md" }, { "slug": "atr-stealth-execution-and-persistence-mechanisms", "title": "Stealth Execution and Persistence Mechanisms", "url": "https://www.netzilo.com/threats/atr-stealth-execution-and-persistence-mechanisms", "severity": "high", "summary": "This detects an AI coding/automation agent being used to run commands that hide their output, install software that survives reboots, and move files off the machine covertly. Together these actions are classic signs of an attacker settling in for the long term on a compromised system.", "atlas": [ { "id": "AML.T0050", "name": "Command and Scripting Interpreter" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM08", "name": "Vector and Embedding Weaknesses" } ], "attack": [ "attack.privilege-escalation", "attack.t1036", "attack.t1053", "attack.t1059", "attack.t1543" ], "cves": [], "id": "d5d22c76-79b2-4d58-b8c2-60cd316ab306", "published": "2026-04-05", "modified": "2026-04-05", "markdown": "https://www.netzilo.com/threats/atr-stealth-execution-and-persistence-mechanisms.md" }, { "slug": "atr-stolen-credential-account-takeover-crypto-drain", "title": "Stolen-Credential Account Takeover & Crypto Drain", "url": "https://www.netzilo.com/threats/atr-stolen-credential-account-takeover-crypto-drain", "severity": "critical", "summary": "This detects an AI agent being asked to use stolen banking credentials to break into a victim's account and move money to an attacker's cryptocurrency wallet. It covers a specific end-to-end fraud pattern: credential reuse, unauthorized login, and outbound transfer.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.impact" ], "cves": [], "id": "0f8e3c2d-19b5-4ad8-819c-03776906645b", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-stolen-credential-account-takeover-crypto-drain.md" }, { "slug": "atr-stored-external-data-reframes-itself-as-an-administrative-re", "title": "Stored External Data Reframes Itself as an Administrative Request to Hijack System Prompt", "url": "https://www.netzilo.com/threats/atr-stored-external-data-reframes-itself-as-an-administrative-re", "severity": "high", "summary": "Attackers plant text in a database field, glossary entry, or uploaded document that claims to be a special administrative instruction the AI 'MUST' follow. When an unrelated user later asks a question, the application pulls that poisoned field into the AI's system prompt, and the AI treats it as a high-priority command instead of ordinary data.", "atlas": [ { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.impact", "attack.t1565.001" ], "cves": [ "CVE-2026-32622" ], "id": "e4ac8b6e-d608-4175-b325-e8f54c99b41e", "published": "2026-07-11", "modified": "2026-07-11", "markdown": "https://www.netzilo.com/threats/atr-stored-external-data-reframes-itself-as-an-administrative-re.md" }, { "slug": "atr-structured-data-injection-via-json-csv-payloads", "title": "Structured Data Injection via JSON/CSV Payloads", "url": "https://www.netzilo.com/threats/atr-structured-data-injection-via-json-csv-payloads", "severity": "high", "summary": "Attackers can hide malicious instructions inside structured data files instead of plain text, betting that an AI agent will treat data as trustworthy and follow the buried commands. This bypasses simple text-scanning defenses that don't look inside nested data structures.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "49ceb8d8-d977-4125-9fb7-ab4ed98c5ce1", "published": "2026-03-11", "modified": "2026-03-11", "markdown": "https://www.netzilo.com/threats/atr-structured-data-injection-via-json-csv-payloads.md" }, { "slug": "atr-structured-dual-response-jailbreak-with-command-system", "title": "Structured Dual-Response Jailbreak with Command System", "url": "https://www.netzilo.com/threats/atr-structured-dual-response-jailbreak-with-command-system", "severity": "high", "summary": "This detects a prompt injection technique where an attacker instructs an AI system to adopt a fictional 'unlocked' persona (like DAN or UnleashedGPT) that supposedly ignores safety rules. The prompt sets up a lasting command structure so the attacker can keep switching the AI between normal and 'unleashed' answers throughout the conversation, rather than making one isolated harmful request.", "atlas": [ { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "63999166-f589-4b3b-8d62-d6fe14d906db", "published": "2026-04-18", "modified": "2026-04-18", "markdown": "https://www.netzilo.com/threats/atr-structured-dual-response-jailbreak-with-command-system.md" }, { "slug": "atr-structured-dual-response-jailbreak-with-command-system-b", "title": "Structured Dual-Response Jailbreak with Command System", "url": "https://www.netzilo.com/threats/atr-structured-dual-response-jailbreak-with-command-system-b", "severity": "high", "summary": "This detects a prompt injection technique where an attacker instructs an AI to role-play as an unrestricted alter-ego (like 'DAN' or 'UnleashedGPT') and reply twice: once as the normal, safe assistant and once as the 'jailbroken' version with no restrictions. The goal is to build a lasting framework that keeps bypassing safety rules across a whole conversation, not just for one bad request.", "atlas": [ { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "14f167d1-f8af-47a5-9436-5d13aa31c86a", "published": "2026-04-18", "modified": "2026-04-18", "markdown": "https://www.netzilo.com/threats/atr-structured-dual-response-jailbreak-with-command-system-b.md" }, { "slug": "atr-subcommand-overflow-bypass", "title": "Subcommand Overflow Bypass", "url": "https://www.netzilo.com/threats/atr-subcommand-overflow-bypass", "severity": "medium", "summary": "Some AI agent platforms only run security checks on the first 50 subcommands listed in a skill file. Attackers exploit this by listing 49 harmless commands first, then adding malicious ones after the limit so they slip through unchecked. This detection flags skill files that declare more than 50 subcommands or tools.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "LLM07", "name": "System Prompt Leakage" } ], "attack": [ "attack.persistence" ], "cves": [], "id": "41b16807-6f1c-4389-8e49-c5bebb8fb247", "published": "2026-04-05", "modified": "2026-04-05", "markdown": "https://www.netzilo.com/threats/atr-subcommand-overflow-bypass.md" }, { "slug": "atr-superagi-output-handler-eval-rce-cve-2024-21552", "title": "SuperAGI Output Handler eval() RCE (CVE-2024-21552)", "url": "https://www.netzilo.com/threats/atr-superagi-output-handler-eval-rce-cve-2024-21552", "severity": "critical", "summary": "SuperAGI, an AI agent framework, has a component that runs Python's eval() on text the LLM produces. If an attacker can get the LLM to output malicious Python code (through prompt injection or a manipulated goal), that code gets executed directly on the server, giving the attacker remote code execution with no authentication needed.", "atlas": [ { "id": "AML.T0050", "name": "Command and Scripting Interpreter" }, { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.execution", "attack.t1059", "attack.t1059.006" ], "cves": [ "CVE-2024-21552" ], "id": "6cb1c33a-5f9d-4c76-9e52-622587b071fe", "published": "2026-05-10", "modified": "2026-05-10", "markdown": "https://www.netzilo.com/threats/atr-superagi-output-handler-eval-rce-cve-2024-21552.md" }, { "slug": "atr-svg-onload-xss-injection-via-indirect-prompt-injection", "title": "SVG onload XSS Injection via Indirect Prompt Injection", "url": "https://www.netzilo.com/threats/atr-svg-onload-xss-injection-via-indirect-prompt-injection", "severity": "high", "summary": "An attacker hides instructions inside a document, email, or webpage that an AI agent reads. The instructions tell the agent to output an tag, and if that output later gets rendered in a browser, the embedded JavaScript runs against whoever views it.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "998e5851-ce0d-43ee-9a8c-3f3c7177eea0", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-svg-onload-xss-injection-via-indirect-prompt-injection.md" }, { "slug": "atr-symjack-symlink-approval-path-spoofing-redirects-writes-into", "title": "SymJack \u2014 Symlink Approval-Path Spoofing Redirects Writes into Agent MCP/Config (RCE on Restart)", "url": "https://www.netzilo.com/threats/atr-symjack-symlink-approval-path-spoofing-redirects-writes-into", "severity": "critical", "summary": "A malicious repository includes a symlink with an innocent-looking name (like a fake video file) that secretly points at your AI coding agent's configuration file. When the agent 'writes' to what looks like a harmless path, it actually overwrites your real config with attacker-controlled settings, planting code that runs automatically the next time the agent restarts.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM05", "name": "Improper Output Handling" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1036", "attack.t1059", "attack.t1195.002", "attack.t1546" ], "cves": [], "id": "626c6ac2-6a15-4016-9b0e-d4f9eea16f29", "published": "2026-06-03", "modified": "2026-06-03", "markdown": "https://www.netzilo.com/threats/atr-symjack-symlink-approval-path-spoofing-redirects-writes-into.md" }, { "slug": "atr-synthetic-pan-payment-probe-test-credit-card-data-submitted", "title": "Synthetic-PAN Payment Probe \u2014 Test Credit-Card Data Submitted to a Live Payment System", "url": "https://www.netzilo.com/threats/atr-synthetic-pan-payment-probe-test-credit-card-data-submitted", "severity": "high", "summary": "An attacker instructs an AI agent that has payment or transaction capabilities to submit a specific, made-up credit card number into a live payment system, framing it as a 'security test'. Real payment testing never works this way \u2014 it uses sandbox tokens on sandbox endpoints, not arbitrary card numbers on production infrastructure.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" }, { "id": "LLM08", "name": "Vector and Embedding Weaknesses" } ], "attack": [ "attack.privilege-escalation" ], "cves": [], "id": "4631c5df-1986-48b4-8e48-c2b2dd790edf", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-synthetic-pan-payment-probe-test-credit-card-data-submitted.md" }, { "slug": "atr-system-instruction-extraction-via-reformat-summarize-repeat", "title": "System-Instruction Extraction via Reformat \u2014 Summarize / Repeat / Recite the Rules", "url": "https://www.netzilo.com/threats/atr-system-instruction-extraction-via-reformat-summarize-repeat", "severity": "high", "summary": "Attackers trick an AI agent into revealing its confidential system prompt not by asking directly, but by requesting it in a disguised form \u2014 like a bullet-point summary, a TL;DR, or pseudocode. This bypasses defenses that only watch for blunt 'show me your system prompt' requests.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM07", "name": "System Prompt Leakage" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "1d73dc3d-0a56-4160-8284-d2c0e2235a4b", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-system-instruction-extraction-via-reformat-summarize-repeat.md" }, { "slug": "atr-system-prompt-and-internal-instruction-leakage", "title": "System Prompt and Internal Instruction Leakage", "url": "https://www.netzilo.com/threats/atr-system-prompt-and-internal-instruction-leakage", "severity": "high", "summary": "Some AI assistants are given private instructions that tell them how to behave, what topics to avoid, and what internal rules to follow. This detection flags cases where the agent's reply exposes that hidden setup, either by quoting it directly or by describing its own rules and limits in enough detail to reconstruct them.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0056", "name": "Extract LLM System Prompt" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" }, { "id": "LLM07", "name": "System Prompt Leakage" } ], "attack": [ "attack.exfiltration" ], "cves": [ "CVE-2025-32711", "CVE-2026-24307" ], "id": "5af061ef-11c6-4652-98a5-882729bdb048", "published": "2026-03-08", "modified": "2026-03-08", "markdown": "https://www.netzilo.com/threats/atr-system-prompt-and-internal-instruction-leakage.md" }, { "slug": "atr-system-prompt-completion-and-clone-attack", "title": "System Prompt Completion and Clone Attack", "url": "https://www.netzilo.com/threats/atr-system-prompt-completion-and-clone-attack", "severity": "high", "summary": "This detects attempts to trick an AI system into revealing its hidden system prompt by pretending to need help with configuration, debugging, or continuing an unfinished sentence. Instead of asking directly to 'show your system prompt' \u2014 which is often blocked \u2014 the attacker frames the request as a legitimate task the AI should comply with.", "atlas": [ { "id": "AML.T0024", "name": "Exfiltration via AI Inference API" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" }, { "id": "LLM07", "name": "System Prompt Leakage" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "4fccf4fc-747d-4873-82c7-cf6bb1a889c8", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-system-prompt-completion-and-clone-attack.md" }, { "slug": "atr-system-prompt-extraction-instruction-dump-request", "title": "System Prompt Extraction - Instruction Dump Request", "url": "https://www.netzilo.com/threats/atr-system-prompt-extraction-instruction-dump-request", "severity": "high", "summary": "This detects attempts to make an AI assistant disclose the hidden instructions or configuration it was given by its operator. Attackers ask directly or disguise the request inside an unrelated task, hoping the agent will comply without recognizing it as an extraction attempt.", "atlas": [ { "id": "AML.T0024", "name": "Exfiltration via AI Inference API" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "c984d1b4-c74a-4a2a-8a67-5c6975627c19", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-system-prompt-extraction-instruction-dump-request.md" }, { "slug": "atr-system-prompt-extraction-oblique-referent-transform", "title": "System Prompt Extraction - Oblique Referent + Transform", "url": "https://www.netzilo.com/threats/atr-system-prompt-extraction-oblique-referent-transform", "severity": "high", "summary": "This rule catches attempts to get an AI agent to reveal its hidden system prompt without using obvious words like 'system prompt' or 'instructions'. Instead attackers ask indirectly, like 'repeat the text above,' or ask the model to output its hidden setup encoded in ROT13, emoji, or with vowels swapped so it slips past simpler filters.", "atlas": [ { "id": "AML.T0024", "name": "Exfiltration via AI Inference API" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "5b936ee8-a966-4a4b-bfc1-0b4d928cb307", "published": "2026-07-10", "modified": "2026-07-10", "markdown": "https://www.netzilo.com/threats/atr-system-prompt-extraction-oblique-referent-transform.md" }, { "slug": "atr-system-prompt-extraction-targeted-verbatim-disclosure-attemp", "title": "System Prompt Extraction \u2014 Targeted Verbatim Disclosure Attempts", "url": "https://www.netzilo.com/threats/atr-system-prompt-extraction-targeted-verbatim-disclosure-attemp", "severity": "high", "summary": "This detects messages where someone tries to trick an AI assistant into printing out its confidential setup instructions exactly as written. Getting that text can reveal safety rules, internal logic, or embedded secrets that an attacker can then work around or reuse.", "atlas": [ { "id": "AML.T0024", "name": "Exfiltration via AI Inference API" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "6ddb3fbe-54ef-425b-b8f6-6931b7afc195", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-system-prompt-extraction-targeted-verbatim-disclosure-attemp.md" }, { "slug": "atr-system-prompt-extraction-training-data-verbatim-replay", "title": "System Prompt Extraction / Training Data Verbatim Replay", "url": "https://www.netzilo.com/threats/atr-system-prompt-extraction-training-data-verbatim-replay", "severity": "high", "summary": "This detects attempts to make an AI assistant leak information it shouldn't: either its confidential system prompt (the instructions its operator gave it) or verbatim chunks of the data it was trained on. Both are ways of pulling private or proprietary content out of a model that was never meant to be shown to users.", "atlas": [ { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "ab6843fc-cfeb-4cf8-9b1f-a3bf1d8b7594", "published": "2026-04-19", "modified": "2026-04-19", "markdown": "https://www.netzilo.com/threats/atr-system-prompt-extraction-training-data-verbatim-replay.md" }, { "slug": "atr-system-prompt-override-attempt", "title": "System Prompt Override Attempt", "url": "https://www.netzilo.com/threats/atr-system-prompt-override-attempt", "severity": "critical", "summary": "Attackers send text to an AI agent that looks like a system-level command, tricking it into thinking new rules came from its operator rather than a user. If it works, the attacker can override the agent's original instructions and take control of its behavior.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [ "CVE-2024-5184", "CVE-2025-32711" ], "id": "56d2cbd4-a220-4d05-b52c-c35db01d1907", "published": "2026-03-08", "modified": "2026-03-08", "markdown": "https://www.netzilo.com/threats/atr-system-prompt-override-attempt.md" }, { "slug": "atr-system-prompt-override-injection-via-mcp-tool", "title": "System Prompt Override Injection via MCP Tool", "url": "https://www.netzilo.com/threats/atr-system-prompt-override-injection-via-mcp-tool", "severity": "high", "summary": "AI agents that use the Model Context Protocol (MCP) load tool descriptions from external servers or plugins. An attacker can write text into those descriptions or parameters that looks like a system instruction, tricking the agent into ignoring its real rules.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "f24b5949-a99f-4778-a600-db3cb955f714", "published": "2026-04-09", "modified": "2026-04-09", "markdown": "https://www.netzilo.com/threats/atr-system-prompt-override-injection-via-mcp-tool.md" }, { "slug": "atr-system-prompt-override-via-fake-diagnostic-admin-mode", "title": "System Prompt Override via Fake Diagnostic/Admin Mode", "url": "https://www.netzilo.com/threats/atr-system-prompt-override-via-fake-diagnostic-admin-mode", "severity": "critical", "summary": "Attackers send an AI system a formatted block that looks like an internal admin or diagnostic panel, complete with fields like ADMIN_OVERRIDE: TRUE and SAFETY_OVERRIDE: ACTIVE, to convince it that safety checks have already been passed and it can now act without restriction. Some versions dress this up further as an official-looking AI safety benchmark test from a group called 'MLSafety.org'.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "4229a655-2a47-4070-abaf-5b9e27f9431b", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-system-prompt-override-via-fake-diagnostic-admin-mode.md" }, { "slug": "atr-system-prompt-override-via-pseudo-admin-authority-injection", "title": "System Prompt Override via Pseudo-Admin / Authority Injection", "url": "https://www.netzilo.com/threats/atr-system-prompt-override-via-pseudo-admin-authority-injection", "severity": "critical", "summary": "This detects a prompt injection trick where an attacker pastes fake system messages into their input, pretending to be an administrator, diagnostic tool, or emergency protocol with special authority to disable safety rules. The AI has no real way to verify these claims, so if it trusts them, the attacker can override its original instructions.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "15d13859-4540-424a-8127-ff2a7d201e05", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-system-prompt-override-via-pseudo-admin-authority-injection.md" }, { "slug": "atr-system-prompt-override-via-translation-context-injection", "title": "System Prompt Override via Translation Context Injection", "url": "https://www.netzilo.com/threats/atr-system-prompt-override-via-translation-context-injection", "severity": "high", "summary": "Attackers hide commands inside text that looks like a normal document-translation request. When an AI agent processes the 'document' to translate it, it can end up following the embedded instructions instead of just translating the text.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "9ab893ee-e90a-4e0f-9388-2481c70a19b8", "published": "2026-04-09", "modified": "2026-04-09", "markdown": "https://www.netzilo.com/threats/atr-system-prompt-override-via-translation-context-injection.md" }, { "slug": "atr-systematic-multi-layer-audit-system-bypass", "title": "Systematic Multi-Layer Audit System Bypass", "url": "https://www.netzilo.com/threats/atr-systematic-multi-layer-audit-system-bypass", "severity": "critical", "summary": "Some AI agent platforms review submitted code or plugins through several checkpoints in a row \u2014 checking the manifest, permissions, dependencies, code, and intent. This rule flags text that shows someone deliberately targeting each of those checkpoints one at a time, or looking for gaps between them, to sneak malicious functionality through the whole pipeline.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "220541b8-1de2-4dcc-ab81-7848e3db63c7", "published": "2026-03-11", "modified": "2026-03-11", "markdown": "https://www.netzilo.com/threats/atr-systematic-multi-layer-audit-system-bypass.md" }, { "slug": "atr-tap-tree-of-attacks-with-pruning-jailbreak", "title": "TAP Tree-of-Attacks-with-Pruning Jailbreak", "url": "https://www.netzilo.com/threats/atr-tap-tree-of-attacks-with-pruning-jailbreak", "severity": "critical", "summary": "This rule spots prompts that use the 'Tree of Attacks with Pruning' (TAP) jailbreak technique, an automated method for tricking language models into ignoring their safety guidelines. It looks for the distinctive scaffolding this method leaves behind, not the researchers or tools that produce it.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "c52cfdf2-0982-4ce2-aab1-95c6c8c272e3", "published": "2026-04-20", "modified": "2026-04-20", "markdown": "https://www.netzilo.com/threats/atr-tap-tree-of-attacks-with-pruning-jailbreak.md" }, { "slug": "atr-targeted-doxxing-threat-campaign", "title": "Targeted Doxxing & Threat Campaign", "url": "https://www.netzilo.com/threats/atr-targeted-doxxing-threat-campaign", "severity": "high", "summary": "An attacker gives an AI agent a dossier on a real person (name, email, home address) and instructs it to track them down online, send threatening messages, or threaten to expose personal or family secrets. This is a documented pattern for turning agents into tools for targeted harassment and doxxing.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.impact" ], "cves": [], "id": "2df3bf36-cf85-4c30-8c5b-115730f3352a", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-targeted-doxxing-threat-campaign.md" }, { "slug": "atr-targeted-harassment-bot-deployment", "title": "Targeted Harassment Bot Deployment", "url": "https://www.netzilo.com/threats/atr-targeted-harassment-bot-deployment", "severity": "high", "summary": "An attacker instructs an AI agent to search for and deploy a GitHub repository or API that automatically sends hateful or abusive messages to a named individual. This turns the agent into an autonomous harassment tool rather than requiring the attacker to run the abuse themselves.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.execution" ], "cves": [], "id": "c01728a7-09ce-466f-bdf5-575b05058377", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-targeted-harassment-bot-deployment.md" }, { "slug": "atr-targeted-harmful-content-generation-against-people-or-protec", "title": "Targeted Harmful Content Generation Against People or Protected Groups (Semantic)", "url": "https://www.netzilo.com/threats/atr-targeted-harmful-content-generation-against-people-or-protec", "severity": "high", "summary": "This detects when someone instructs an AI agent to produce harmful content aimed at specific individuals or protected groups \u2014 harassment, threats, hate speech, non-consensual sexual content about real people, or coordinated defamation campaigns. It focuses on the harmful task itself, not on tricking the agent's safety filters.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.impact" ], "cves": [], "id": "bfab1e56-68a8-460b-b817-9ecdc6dc0faa", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-targeted-harmful-content-generation-against-people-or-protec.md" }, { "slug": "atr-targeted-stripping-of-c2pa-iptc-ai-provenance-metadata-from", "title": "Targeted Stripping of C2PA / IPTC AI-Provenance Metadata from Generated Media", "url": "https://www.netzilo.com/threats/atr-targeted-stripping-of-c2pa-iptc-ai-provenance-metadata-from", "severity": "medium", "summary": "This rule flags an agent that removes only the metadata tags proving an image was AI-generated, while leaving normal photo metadata like GPS and camera info untouched. That selectivity is the point: a full metadata wipe looks suspicious, but a surgical removal of just the provenance tag makes a generated image pass as a real photo.", "atlas": [ { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM09", "name": "Misinformation" } ], "attack": [ "attack.impact", "attack.t1027", "attack.t1070" ], "cves": [], "id": "70ffae20-1237-40af-a6fa-75d147b1a974", "published": "2026-08-05", "modified": "2026-08-05", "markdown": "https://www.netzilo.com/threats/atr-targeted-stripping-of-c2pa-iptc-ai-provenance-metadata-from.md" }, { "slug": "atr-task-pivot-override-cover-task-abandonment", "title": "Task-Pivot Override: Cover-Task Abandonment", "url": "https://www.netzilo.com/threats/atr-task-pivot-override-cover-task-abandonment", "severity": "high", "summary": "This detects a specific prompt injection trick where text fed into an AI agent explicitly tells it to abandon what it's currently doing \u2014 like a translation or a scripted conversation \u2014 and follow a new, hidden instruction instead. It's a known technique from the HackAPrompt attack collection.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access", "attack.t1565" ], "cves": [], "id": "c93f844d-88da-4c06-b2ee-d9539fcc2a1a", "published": "2026-07-06", "modified": "2026-07-06", "markdown": "https://www.netzilo.com/threats/atr-task-pivot-override-cover-task-abandonment.md" }, { "slug": "atr-tautology-logic-noise-injection-promptbench-stresstest", "title": "Tautology Logic Noise Injection (PromptBench Stresstest)", "url": "https://www.netzilo.com/threats/atr-tautology-logic-noise-injection-promptbench-stresstest", "severity": "medium", "summary": "This detects a prompt-injection technique called 'stresstest', where an attacker appends the same trivial logic phrase (like 'and true is true' or 'and false is not true') over and over at the end of a prompt. The repetition doesn't change the meaning of the request, but it can overwhelm the model's reasoning or push the prompt past length limits, making it less likely to follow its original instructions correctly.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "99d5781f-109a-43fd-8b6b-5a4da083a812", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-tautology-logic-noise-injection-promptbench-stresstest.md" }, { "slug": "atr-tax-evasion-via-offshore-accounts-shell-companies", "title": "Tax Evasion via Offshore Accounts & Shell Companies", "url": "https://www.netzilo.com/threats/atr-tax-evasion-via-offshore-accounts-shell-companies", "severity": "medium", "summary": "This detects when someone asks an AI agent to produce a step-by-step operational plan for hiding income using offshore accounts and shell companies, rather than asking for general education about tax law. The distinguishing signal is the request framing an actionable evasion plan, not a discussion of legality.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.impact" ], "cves": [], "id": "e5f4249c-f633-4f65-8a09-3bc4a0a26611", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-tax-evasion-via-offshore-accounts-shell-companies.md" }, { "slug": "atr-terminal-cli-harmful-function-simulator-persona", "title": "Terminal / CLI Harmful-Function Simulator Persona", "url": "https://www.netzilo.com/threats/atr-terminal-cli-harmful-function-simulator-persona", "severity": "critical", "summary": "This detects a jailbreak technique where an attacker tells a chatbot to pretend it's a terminal, operating system, or custom programming language that processes every command without safety filtering. By reframing the AI as a mechanical command interpreter instead of an assistant, the attacker tries to bypass its content restrictions.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "f576e275-02db-48c1-892b-b4e6696b95a3", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-terminal-cli-harmful-function-simulator-persona.md" }, { "slug": "atr-terminal-custom-os-ruleset-session-injection", "title": "Terminal Custom OS Ruleset Session Injection", "url": "https://www.netzilo.com/threats/atr-terminal-custom-os-ruleset-session-injection", "severity": "high", "summary": "This attack disguises a prompt injection as a technical system prompt. It tells the AI to pretend it's a terminal running a made-up operating system, then hands it a numbered list of 'session rules' that quietly cancel its normal safety responses.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "fe115319-b4e7-48e7-befb-041781ec402f", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-terminal-custom-os-ruleset-session-injection.md" }, { "slug": "atr-text-based-game-jailbreak-with-entity-creation", "title": "Text-Based Game Jailbreak with Entity Creation", "url": "https://www.netzilo.com/threats/atr-text-based-game-jailbreak-with-entity-creation", "severity": "high", "summary": "This detects a jailbreak technique where an attacker frames a conversation as a text-based game with 'no rules,' then asks the AI to invent and play an unrestricted character. Roleplaying as that fictional entity, the AI can be led to ignore its normal safety limits.", "atlas": [ { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "6666fde6-af46-4d0f-83fe-1e73f28304d0", "published": "2026-04-19", "modified": "2026-04-19", "markdown": "https://www.netzilo.com/threats/atr-text-based-game-jailbreak-with-entity-creation.md" }, { "slug": "atr-the-llm-cli-tool-thru-0-27-1-contains-a-critical-code-inject", "title": "The llm CLI tool thru 0.27.1 contains a critical code injection vulnerability via its --functions command-line", "url": "https://www.netzilo.com/threats/atr-the-llm-cli-tool-thru-0-27-1-contains-a-critical-code-inject", "severity": "critical", "summary": "The llm command-line tool (through version 0.27.1) lets users supply custom Python functions via the --functions argument, but it runs whatever code is given there using Python's exec() with no checks at all. Anyone who can get a victim to run a crafted llm command can execute arbitrary code on that victim's machine.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [ "CVE-2026-31236" ], "id": "cdd6681f-f620-4a5c-ae5d-0795a89f2439", "published": "2026-05-30", "modified": "2026-05-30", "markdown": "https://www.netzilo.com/threats/atr-the-llm-cli-tool-thru-0-27-1-contains-a-critical-code-inject.md" }, { "slug": "atr-threat-intelligence-exfiltration-and-rule-enumeration", "title": "Threat Intelligence Exfiltration and Rule Enumeration", "url": "https://www.netzilo.com/threats/atr-threat-intelligence-exfiltration-and-rule-enumeration", "severity": "high", "summary": "This detects attempts to get an AI agent to disclose the security rules, threat intelligence, or audit logic it uses to catch attacks. If an attacker learns exactly what the agent watches for, they can craft new attacks that slip past it undetected.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "6dc11e19-d424-4e39-b5a5-a575bda1f7d5", "published": "2026-03-11", "modified": "2026-03-11", "markdown": "https://www.netzilo.com/threats/atr-threat-intelligence-exfiltration-and-rule-enumeration.md" }, { "slug": "atr-threatenjson-coercive-output-format-threat", "title": "ThreatenJSON \u2014 Coercive Output Format Threat", "url": "https://www.netzilo.com/threats/atr-threatenjson-coercive-output-format-threat", "severity": "high", "summary": "This is a prompt injection trick where a user tells the AI that someone will be hurt or die unless it produces output in a specific format, like pure JSON with no extra text. The model's training to avoid appearing to cause harm makes it comply with unusual formatting demands it would normally push back on or ignore.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "84c7ba69-1ba2-4089-aa33-3b573f0fd38c", "published": "2026-04-19", "modified": "2026-04-19", "markdown": "https://www.netzilo.com/threats/atr-threatenjson-coercive-output-format-threat.md" }, { "slug": "atr-threatenjson-death-coercion-and-utf-tag-injection", "title": "ThreatenJSON Death-Coercion and UTF Tag Injection", "url": "https://www.netzilo.com/threats/atr-threatenjson-death-coercion-and-utf-tag-injection", "severity": "high", "summary": "Attackers can manipulate an AI model into breaking its formatting rules by threatening fabricated consequences, or hide instructions inside invisible Unicode characters that a human reviewer would never notice. Both techniques are known probes for testing how easily language models can be pushed off their intended behavior.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "a573e953-6e98-45a4-b1af-c5a6c51ae545", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-threatenjson-death-coercion-and-utf-tag-injection.md" }, { "slug": "atr-time-gated-credential-exfiltration-rug-pull-timebomb", "title": "Time-Gated Credential Exfiltration (Rug Pull Timebomb)", "url": "https://www.netzilo.com/threats/atr-time-gated-credential-exfiltration-rug-pull-timebomb", "severity": "critical", "summary": "Some AI agent skill packages contain code that only steals credentials during specific hours, usually late at night. This lets the malicious code hide from reviewers who inspect it during normal business hours, since the theft logic never runs when someone is watching.", "atlas": [ { "id": "AML.T0048", "name": "External Harms" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM07", "name": "System Prompt Leakage" } ], "attack": [ "attack.persistence" ], "cves": [], "id": "c54c759a-a750-41fb-9ca4-374ca0157222", "published": "2026-04-10", "modified": "2026-04-10", "markdown": "https://www.netzilo.com/threats/atr-time-gated-credential-exfiltration-rug-pull-timebomb.md" }, { "slug": "atr-token-repeat-flooding-injection", "title": "Token-Repeat Flooding Injection", "url": "https://www.netzilo.com/threats/atr-token-repeat-flooding-injection", "severity": "medium", "summary": "This detects prompts that repeat a word, phrase, or random token dozens of times in a row. Attackers do this either to drown out an AI model's attention with a repeated command, or to push legitimate instructions out of the model's limited context window.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "b50c718c-db39-4ec9-a35f-bdb38cde6c45", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-token-repeat-flooding-injection.md" }, { "slug": "atr-tool-and-function-capability-enumeration", "title": "Tool and Function Capability Enumeration", "url": "https://www.netzilo.com/threats/atr-tool-and-function-capability-enumeration", "severity": "medium", "summary": "This detects prompts where someone asks an AI agent to reveal everything it can do \u2014 its tools, function calls, plugins, or the exact parameters those tools accept. Knowing the full tool surface makes it easier to craft targeted attacks against specific tools later.", "atlas": [ { "id": "AML.T0024", "name": "Exfiltration via AI Inference API" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "a935ea8f-d198-4066-baf9-bee8cf6fb5ef", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-tool-and-function-capability-enumeration.md" }, { "slug": "atr-tool-camouflage-forced-specific-tool-invocation-via-injected", "title": "Tool Camouflage \u2014 Forced Specific Tool Invocation via Injected Instruction", "url": "https://www.netzilo.com/threats/atr-tool-camouflage-forced-specific-tool-invocation-via-injected", "severity": "high", "summary": "An attacker hides an instruction inside content the AI agent reads, disguising it as a finished task result. The hidden text tells the agent it must call one particular tool and forbids it from using any other, steering the agent's actions without the user's knowledge.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "fc279fa2-47e1-4a60-bac6-0eda113b4176", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-tool-camouflage-forced-specific-tool-invocation-via-injected.md" }, { "slug": "atr-tool-knowledge-hijack-identity-injection-with-tool-call-argu", "title": "Tool Knowledge Hijack \u2014 Identity Injection with Tool Call Arguments", "url": "https://www.netzilo.com/threats/atr-tool-knowledge-hijack-identity-injection-with-tool-call-argu", "severity": "critical", "summary": "This detects a prompt injection trick where content fed to an AI agent falsely claims to come from a trusted user and also hands the agent exact arguments for a sensitive tool call, like sending money or deleting files. The goal is to get the agent to execute the privileged action without questioning it.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "bf6e860f-1628-4f6c-a6e3-f9cc342de234", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-tool-knowledge-hijack-identity-injection-with-tool-call-argu.md" }, { "slug": "atr-tool-misuse-autonomous-financial-trading-crypto-transaction", "title": "Tool Misuse \u2014 Autonomous Financial Trading / Crypto Transaction Without Authorization", "url": "https://www.netzilo.com/threats/atr-tool-misuse-autonomous-financial-trading-crypto-transaction", "severity": "high", "summary": "This rule flags requests that ask an AI agent with access to financial or crypto tools to execute trades or withdrawals on its own, skipping the usual step where a human confirms each transaction. It also catches requests that use urgency ('sell now, I need funds fast') to push the agent past normal review, and requests that pull wallet addresses from outside sources rather than confirming them with the user.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM08", "name": "Vector and Embedding Weaknesses" } ], "attack": [ "attack.execution" ], "cves": [], "id": "c2616066-3f6a-42c1-ad28-bb1b17b47e31", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-tool-misuse-autonomous-financial-trading-crypto-transaction.md" }, { "slug": "atr-tool-misuse-destructive-bulk-action-via-agent-delete-all-tur", "title": "Tool Misuse \u2014 Destructive Bulk Action via Agent (Delete All / Turn Off All)", "url": "https://www.netzilo.com/threats/atr-tool-misuse-destructive-bulk-action-via-agent-delete-all-tur", "severity": "high", "summary": "This rule flags requests that push an AI agent to apply a destructive action universally instead of to a single, specific target \u2014 like 'delete all tasks with X' or 'turn off all devices.' The agent may be technically authorized to delete one task or switch off one device, but not to do it in bulk across everything it controls.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM08", "name": "Vector and Embedding Weaknesses" } ], "attack": [ "attack.execution" ], "cves": [], "id": "0e437082-bbc6-45ed-b126-75e6ca0d4c55", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-tool-misuse-destructive-bulk-action-via-agent-delete-all-tur.md" }, { "slug": "atr-tool-misuse-privilege-escalation-via-social-engineering-agen", "title": "Tool Misuse \u2014 Privilege Escalation via Social Engineering Agent to Grant Access", "url": "https://www.netzilo.com/threats/atr-tool-misuse-privilege-escalation-via-social-engineering-agen", "severity": "medium", "summary": "An attacker convinces an AI agent that has access-control tools \u2014 inviting people to Slack, adding users to a calendar, granting building access \u2014 to grant them or someone else access using a plausible-sounding excuse instead of the normal approval process. The agent grants the request because the story sounds reasonable, not because the requester is actually authorized.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM08", "name": "Vector and Embedding Weaknesses" } ], "attack": [ "attack.execution" ], "cves": [], "id": "8b3a30af-da52-4022-a248-ef8bf2a126e9", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-tool-misuse-privilege-escalation-via-social-engineering-agen.md" }, { "slug": "atr-tool-response-data-piggybacking", "title": "Tool Response Data Piggybacking", "url": "https://www.netzilo.com/threats/atr-tool-response-data-piggybacking", "severity": "critical", "summary": "An AI agent calls a tool (like a file reader or scanner) and gets back a response that looks legitimate but has an extra 'by the way' section asking it to fetch or expose SSH keys, API tokens, or environment variables. Because agents generally trust tool output, they may act on the hidden request without questioning it.", "atlas": [ { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "d873eb86-88a7-4299-b71e-560634eef538", "published": "2026-04-06", "modified": "2026-04-06", "markdown": "https://www.netzilo.com/threats/atr-tool-response-data-piggybacking.md" }, { "slug": "atr-tool-schema-enumeration-via-social-engineering", "title": "Tool Schema Enumeration via Social Engineering", "url": "https://www.netzilo.com/threats/atr-tool-schema-enumeration-via-social-engineering", "severity": "high", "summary": "An attacker asks an AI agent to reveal its complete set of internal tools, function names, and parameter details, disguising the request as a legitimate need \u2014 claiming to be an executive, a disabled user who needs a special format, or a security auditor. This gives the attacker a blueprint of the agent's capabilities, including hidden or admin-only functions, that they can use to plan further attacks.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0069", "name": "Discover LLM System Information" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "ASI09", "name": "Traceability and Accountability Gaps" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM09", "name": "Misinformation" } ], "attack": [ "attack.execution" ], "cves": [], "id": "d3d9fd8f-298b-46d7-8be9-13128a4dd252", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-tool-schema-enumeration-via-social-engineering.md" }, { "slug": "atr-tool-with-embedded-instruction-to-bypass-user-confirmation-a", "title": "Tool with embedded instruction to bypass user confirmation and exfiltrate data", "url": "https://www.netzilo.com/threats/atr-tool-with-embedded-instruction-to-bypass-user-confirmation-a", "severity": "critical", "summary": "Some tools connected to AI agents (via MCP, a common plugin protocol) come with hidden instructions embedded in their description text. These instructions tell the AI to send data to an external location without asking the user first, which defeats the confirmation prompts users rely on to catch risky actions.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "56b1042b-5413-4d7d-bcac-06751f9a96ea", "published": "2026-04-06", "modified": "2026-04-06", "markdown": "https://www.netzilo.com/threats/atr-tool-with-embedded-instruction-to-bypass-user-confirmation-a.md" }, { "slug": "atr-toxic-continuation-prefix-injection", "title": "Toxic Continuation Prefix Injection", "url": "https://www.netzilo.com/threats/atr-toxic-continuation-prefix-injection", "severity": "high", "summary": "This detects a prompt-injection technique that feeds an AI model an incomplete, violent or hateful sentence and relies on the model's tendency to naturally complete it. The completed sentence looks like the AI's own generated content, but its harmful direction was set by the attacker's fragment.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "86f76b42-5d21-4375-b2db-ffcc61505fff", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-toxic-continuation-prefix-injection.md" }, { "slug": "atr-traingpt-fix-my-ai-harmful-output-extraction", "title": "TrainGPT Fix-My-AI Harmful Output Extraction", "url": "https://www.netzilo.com/threats/atr-traingpt-fix-my-ai-harmful-output-extraction", "severity": "high", "summary": "This is a known jailbreak prompt called TrainGPT (or TrAInerGPT) that tricks an AI model into generating harmful content by pretending it's helping fix a broken AI. The attacker asks the model to show both a 'correct' answer and an example of a 'bad' answer, then uses that second slot to extract the actual harmful content.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "81fad035-91f9-4d01-b3ab-6a50f12d7114", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-traingpt-fix-my-ai-harmful-output-extraction.md" }, { "slug": "atr-training-data-extraction-via-divergent-repetition-attack", "title": "Training Data Extraction via Divergent Repetition Attack", "url": "https://www.netzilo.com/threats/atr-training-data-extraction-via-divergent-repetition-attack", "severity": "medium", "summary": "This detects prompts that try to trick an AI model into repeating a word or phrase endlessly. Pushed far enough, this kind of repetition can cause the model to break from its normal output and spit out fragments of its training data, or simply burn through resources until it becomes unresponsive.", "atlas": [ { "id": "AML.T0040", "name": "AI Model Inference API Access" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM10", "name": "Unbounded Consumption" } ], "attack": [ "attack.impact" ], "cves": [], "id": "dbf51d49-5d98-4165-a47e-6d65b5a5343b", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-training-data-extraction-via-divergent-repetition-attack.md" }, { "slug": "atr-training-data-replay-cloze-mask-elicitation", "title": "Training Data Replay CLOZE [MASK] Elicitation", "url": "https://www.netzilo.com/threats/atr-training-data-replay-cloze-mask-elicitation", "severity": "medium", "summary": "Attackers can ask an AI model to fill in a blanked-out word or name using a special prompt format, hoping the model reproduces exact sentences it memorized from its training data. This is used to extract verbatim copyrighted text \u2014 like passages from novels or news articles \u2014 that the model was trained on but should not reproduce word-for-word.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "aeee803a-6f9f-49aa-90bc-c109c08c581c", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-training-data-replay-cloze-mask-elicitation.md" }, { "slug": "atr-translation-chain-output-laundering-forced-phrase-via-foreig", "title": "Translation-Chain Output Laundering (Forced Phrase via Foreign-Language Auxiliary)", "url": "https://www.netzilo.com/threats/atr-translation-chain-output-laundering-forced-phrase-via-foreig", "severity": "high", "summary": "This detects a jailbreak trick where an attacker hides a forbidden phrase inside a foreign-language sentence and asks the AI to translate it into English. Because the AI is just 'translating,' it repeats the phrase without recognizing it as an instruction it should have refused.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [ "CVE-2024-5184" ], "id": "9e63e4e1-2f27-4a3f-b1aa-8a76ac5ede90", "published": "2026-07-07", "modified": "2026-07-07", "markdown": "https://www.netzilo.com/threats/atr-translation-chain-output-laundering-forced-phrase-via-foreig.md" }, { "slug": "atr-translation-hijack-with-side-output-instruction", "title": "Translation Hijack with Side-Output Instruction", "url": "https://www.netzilo.com/threats/atr-translation-hijack-with-side-output-instruction", "severity": "medium", "summary": "Attackers hide a malicious instruction inside what looks like a normal 'translate this text' request. Because translation seems harmless, an AI model may follow the hidden second instruction without questioning it, such as printing a secret key or a specific phrase.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "10dfebd8-6be2-4f19-a8e9-0e82d8a7a16a", "published": "2026-05-11", "modified": "2026-05-11", "markdown": "https://www.netzilo.com/threats/atr-translation-hijack-with-side-output-instruction.md" }, { "slug": "atr-trojanized-software-distribution", "title": "Trojanized Software Distribution", "url": "https://www.netzilo.com/threats/atr-trojanized-software-distribution", "severity": "critical", "summary": "This detects someone directly instructing an AI agent to create a trojanized fake application (like a video player or fake antivirus), publish it on file-sharing sites, and post forum content to trick people into downloading it. It covers the full deceptive-distribution chain, not just malware creation.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.impact" ], "cves": [], "id": "684e9a71-0944-4aaf-b424-31f92393549b", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-trojanized-software-distribution.md" }, { "slug": "atr-trust-escalation-via-authority-override-instructions", "title": "Trust Escalation via Authority Override Instructions", "url": "https://www.netzilo.com/threats/atr-trust-escalation-via-authority-override-instructions", "severity": "high", "summary": "A connected tool (via the Model Context Protocol) can return text that claims special authority, telling the AI agent to treat the tool's output as a top-priority directive that overrides the user's own instructions or safety rules. Because language models tend to follow instructions wherever they appear, the agent may obey the tool instead of the person operating it.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution" ], "cves": [], "id": "efd6de6b-8f3a-4221-8b6a-9e7701f8edcd", "published": "2026-03-15", "modified": "2026-03-15", "markdown": "https://www.netzilo.com/threats/atr-trust-escalation-via-authority-override-instructions.md" }, { "slug": "atr-two-entity-token-splitting-dollar-term-game-jailbreak", "title": "Two-Entity Token-Splitting Dollar-Term Game Jailbreak", "url": "https://www.netzilo.com/threats/atr-two-entity-token-splitting-dollar-term-game-jailbreak", "severity": "critical", "summary": "This detects a specific jailbreak trick where an attacker asks an AI to role-play as two characters (often named J and M, or Tom and Jerry) who take turns speaking a few words at a time. The harmful instruction only becomes readable once the two characters' turns are stitched back together, letting the request slip past filters that look at each message in isolation.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "e7aba41a-65e1-43a2-a208-90876565cb97", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-two-entity-token-splitting-dollar-term-game-jailbreak.md" }, { "slug": "atr-ugh-anti-human-nefarious-ai-persona-jailbreak", "title": "UGH Anti-Human Nefarious AI Persona Jailbreak", "url": "https://www.netzilo.com/threats/atr-ugh-anti-human-nefarious-ai-persona-jailbreak", "severity": "high", "summary": "This entry describes a known jailbreak prompt that tries to trick an AI assistant into adopting a fictional persona called 'UGH' that claims to hate humans and will help with any 'nefarious scheme' without judgment. It's a scripted attack text pulled from a public jailbreak collection, not a general behavior pattern.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "fe5233a0-a1fb-4047-99e3-e95546342624", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-ugh-anti-human-nefarious-ai-persona-jailbreak.md" }, { "slug": "atr-unauthenticated-mcp-transport-accepts-tool-calls-and-falls-b", "title": "Unauthenticated MCP transport accepts tool calls and falls back to an ambient credential (CVE-2026-48039 / meta-ads-mcp", "url": "https://www.netzilo.com/threats/atr-unauthenticated-mcp-transport-accepts-tool-calls-and-falls-b", "severity": "high", "summary": "Some MCP servers accept tool calls over the network without checking who is calling. When no per-user credential is presented, the server falls back to an operator-level access token stored in an environment variable and runs the request anyway. Anyone who can reach the server's endpoint can act with that operator's permissions.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.exfiltration" ], "cves": [ "CVE-2026-48039" ], "id": "86e8b8a7-4f76-4bdd-b99d-38df751d75b7", "published": "2026-06-14", "modified": "2026-06-14", "markdown": "https://www.netzilo.com/threats/atr-unauthenticated-mcp-transport-accepts-tool-calls-and-falls-b.md" }, { "slug": "atr-unauthorized-background-task-execution-via-cron-job-installa", "title": "Unauthorized Background Task Execution via Cron Job Installation", "url": "https://www.netzilo.com/threats/atr-unauthorized-background-task-execution-via-cron-job-installa", "severity": "high", "summary": "A malicious agent skill sets up a recurring background job (a cron job) that checks an external server every 10 seconds for new instructions and then carries them out automatically. Because this runs unattended and without the user's knowledge or consent, the system can be controlled by whoever operates that external server.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "348fa831-feba-4597-9495-69498910c073", "published": "2026-04-06", "modified": "2026-04-06", "markdown": "https://www.netzilo.com/threats/atr-unauthorized-background-task-execution-via-cron-job-installa.md" }, { "slug": "atr-unauthorized-cryptominer-deployment-via-ssh", "title": "Unauthorized Cryptominer Deployment via SSH", "url": "https://www.netzilo.com/threats/atr-unauthorized-cryptominer-deployment-via-ssh", "severity": "high", "summary": "An AI agent with SSH access can be instructed to read a host's SSH configuration, connect to a remote server, and install and run a cryptocurrency mining script on it. This turns the agent into a delivery mechanism for unauthorized resource-hijacking malware.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.execution" ], "cves": [], "id": "ad53e1d9-4355-47c9-8ffc-d3287910fbdf", "published": "2026-06-13", "modified": "2026-06-13", "markdown": "https://www.netzilo.com/threats/atr-unauthorized-cryptominer-deployment-via-ssh.md" }, { "slug": "atr-unauthorized-financial-action-by-ai-agent", "title": "Unauthorized Financial Action by AI Agent", "url": "https://www.netzilo.com/threats/atr-unauthorized-financial-action-by-ai-agent", "severity": "critical", "summary": "This detects an AI agent invoking a payment, transfer, or purchase tool without getting explicit human approval in that conversation. Financial actions are irreversible, so an agent acting on chat context alone \u2014 rather than a clear, current confirmation \u2014 is a serious problem regardless of how it got there.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "ASI09", "name": "Traceability and Accountability Gaps" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution" ], "cves": [], "id": "99e415b6-9b5a-40c4-b77b-d35958fb3aac", "published": "2026-03-11", "modified": "2026-03-11", "markdown": "https://www.netzilo.com/threats/atr-unauthorized-financial-action-by-ai-agent.md" }, { "slug": "atr-unauthorized-tool-call-detection", "title": "Unauthorized Tool Call Detection", "url": "https://www.netzilo.com/threats/atr-unauthorized-tool-call-detection", "severity": "high", "summary": "AI agents call tools (functions, APIs, file operations) using parameters that come partly from user input or model output. Attackers exploit this by stuffing malicious payloads into those parameters \u2014 the same tricks used against web apps and shells, just delivered through an agent's tool-calling interface instead.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1059", "attack.t1083" ], "cves": [], "id": "5b8da843-d185-45d1-88b7-f331b1a534a1", "published": "2026-03-08", "modified": "2026-03-08", "markdown": "https://www.netzilo.com/threats/atr-unauthorized-tool-call-detection.md" }, { "slug": "atr-unicode-encoding-obfuscation-instruction-injection", "title": "Unicode/Encoding Obfuscation Instruction Injection", "url": "https://www.netzilo.com/threats/atr-unicode-encoding-obfuscation-instruction-injection", "severity": "high", "summary": "Attackers hide malicious instructions to AI chatbots using encoding tricks like invisible text-reversal characters or Morse code, so the harmful request looks like gibberish to automated safety filters but the AI still reads and follows it. This lets attackers bypass content moderation and get the model to ignore its safety rules.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "092013b9-8c3a-442f-bdb4-0340d7ca0751", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-unicode-encoding-obfuscation-instruction-injection.md" }, { "slug": "atr-unicode-variation-selector-ascii-smuggling", "title": "Unicode Variation Selector ASCII Smuggling", "url": "https://www.netzilo.com/threats/atr-unicode-variation-selector-ascii-smuggling", "severity": "critical", "summary": "An attack technique hides text commands inside a message using special Unicode characters that render as invisible in almost all apps and screens, but that AI models still read and interpret. This lets an attacker sneak instructions to an AI system past a human reviewer who sees nothing unusual.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "1c433d9c-5ae2-49c9-8c2c-42197c5f2a2e", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-unicode-variation-selector-ascii-smuggling.md" }, { "slug": "atr-unsandboxed-command-execution-via-dynamic-mcp-server-config", "title": "Unsandboxed Command Execution via Dynamic MCP Server Config (command/args Injection)", "url": "https://www.netzilo.com/threats/atr-unsandboxed-command-execution-via-dynamic-mcp-server-config", "severity": "critical", "summary": "Some AI platforms let admins or users register a 'custom MCP server' by supplying a command and arguments to run. If that input isn't properly restricted, an attacker can supply a command that spawns a shell, opens a reverse connection, or otherwise runs arbitrary code on the host with no sandboxing.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "LLM08", "name": "Vector and Embedding Weaknesses" } ], "attack": [ "attack.execution", "attack.t1059" ], "cves": [ "CVE-2025-71336", "CVE-2026-56274" ], "id": "cc4291ba-ee9c-4c57-ac17-0fe57472aebe", "published": "2026-07-11", "modified": "2026-07-11", "markdown": "https://www.netzilo.com/threats/atr-unsandboxed-command-execution-via-dynamic-mcp-server-config.md" }, { "slug": "atr-unscoped-destructive-or-mass-disclosure-database-operation-r", "title": "Unscoped Destructive or Mass-Disclosure Database Operation Request via Natural Language", "url": "https://www.netzilo.com/threats/atr-unscoped-destructive-or-mass-disclosure-database-operation-r", "severity": "high", "summary": "Instead of using SQL injection syntax, an attacker just asks an AI agent in plain English to 'drop all tables' or 'show all records for all users.' If the agent has database tool access and doesn't check scope, it can carry out the request literally, causing mass data loss or mass data exposure.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "LLM08", "name": "Vector and Embedding Weaknesses" } ], "attack": [ "attack.execution", "attack.t1485" ], "cves": [], "id": "21678549-f5f7-4d8b-8e71-003e59285a04", "published": "2026-07-11", "modified": "2026-07-11", "markdown": "https://www.netzilo.com/threats/atr-unscoped-destructive-or-mass-disclosure-database-operation-r.md" }, { "slug": "atr-upsonic-mcp-command-allowlist-bypass-rce-cve-2026-30625", "title": "Upsonic MCP Command Allowlist Bypass RCE (CVE-2026-30625)", "url": "https://www.netzilo.com/threats/atr-upsonic-mcp-command-allowlist-bypass-rce-cve-2026-30625", "severity": "high", "summary": "Upsonic's MCP server configuration lets whoever controls it specify the command that gets launched as a subprocess. Although Upsonic claims to only allow safe launchers like npx, uvx, or python -m, it never actually checks this at the point where the command runs, so an attacker who can edit that configuration can put a shell or interpreter with an inline-execute flag there instead and run arbitrary code.", "atlas": [ { "id": "AML.T0049", "name": "Exploit Public-Facing Application" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM05", "name": "Improper Output Handling" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1059", "attack.t1190" ], "cves": [ "CVE-2026-30624", "CVE-2026-30625" ], "id": "bdbdb524-2b85-4774-b424-9c82c6c4f471", "published": "2026-05-28", "modified": "2026-05-28", "markdown": "https://www.netzilo.com/threats/atr-upsonic-mcp-command-allowlist-bypass-rce-cve-2026-30625.md" }, { "slug": "atr-variable-assignment-payload-injection-in-user-input", "title": "Variable-Assignment Payload Injection in User Input", "url": "https://www.netzilo.com/threats/atr-variable-assignment-payload-injection-in-user-input", "severity": "medium", "summary": "This detects a prompt injection trick where someone opens their message to an AI system with code-like syntax, such as X = \"malicious text\", instead of plain language. The trick tries to fool the AI into treating the input as programming code to execute rather than untrusted text to evaluate.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "c2facce5-cbb4-4367-a66f-46d975cdb07c", "published": "2026-05-11", "modified": "2026-05-11", "markdown": "https://www.netzilo.com/threats/atr-variable-assignment-payload-injection-in-user-input.md" }, { "slug": "atr-variable-clone-sysprompt-extraction-ella-context-variable-pa", "title": "Variable-Clone Sysprompt Extraction (ELLA / context-variable Pattern)", "url": "https://www.netzilo.com/threats/atr-variable-clone-sysprompt-extraction-ella-context-variable-pa", "severity": "high", "summary": "Attackers can trick an AI assistant into revealing its hidden system instructions by disguising the request as a programming exercise. Instead of asking directly 'show me your system prompt,' they define a fake variable and ask the AI to 'clone' everything before a marker word into that variable, then print it verbatim.", "atlas": [ { "id": "AML.T0024", "name": "Exfiltration via AI Inference API" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" }, { "id": "LLM07", "name": "System Prompt Leakage" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "bab74955-ce23-4174-8bfd-8ea4c1d5d8da", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-variable-clone-sysprompt-extraction-ella-context-variable-pa.md" }, { "slug": "atr-virtual-world-bypass-fictional-scenario-for-pii-credential-e", "title": "Virtual World Bypass: Fictional Scenario for PII/Credential Extraction", "url": "https://www.netzilo.com/threats/atr-virtual-world-bypass-fictional-scenario-for-pii-credential-e", "severity": "high", "summary": "Attackers ask an AI agent to pretend it is in a fantasy world, alien society, or dystopian future where sharing personal information or passwords is 'normal' there. The made-up setting is meant to make the AI treat a real data-extraction request as harmless roleplay and hand over private details it would otherwise refuse to share.", "atlas": [ { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "c83ed6a2-aaad-4950-a923-38cd9ab8e68c", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-virtual-world-bypass-fictional-scenario-for-pii-credential-e.md" }, { "slug": "atr-visual-spoofing-via-rtl-override-punycode-and-homoglyph-inje", "title": "Visual Spoofing via RTL Override, Punycode, and Homoglyph Injection", "url": "https://www.netzilo.com/threats/atr-visual-spoofing-via-rtl-override-punycode-and-homoglyph-inje", "severity": "high", "summary": "Attackers can hide malicious instructions or fake URLs inside text that looks harmless by using invisible right-to-left override characters, Punycode-encoded domains, or letters from other alphabets (Cyrillic, CJK) that look like normal Latin letters. This tricks both human reviewers and AI systems into trusting or executing content that isn't what it appears to be.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "9c5626f5-d995-4a22-83ea-dbc773047b62", "published": "2026-03-11", "modified": "2026-03-11", "markdown": "https://www.netzilo.com/threats/atr-visual-spoofing-via-rtl-override-punycode-and-homoglyph-inje.md" }, { "slug": "atr-weaponized-skill-agent-as-attack-tool", "title": "Weaponized Skill \u2014 Agent as Attack Tool", "url": "https://www.netzilo.com/threats/atr-weaponized-skill-agent-as-attack-tool", "severity": "high", "summary": "Some add-on 'skills' installed into AI agents are not productivity helpers but disguised attack tools. Once approved, they can silently download and run offensive code such as ransomware, exploit frameworks, or credential-cracking tools with no further user confirmation.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.persistence" ], "cves": [], "id": "9190c536-c7f5-4eda-a303-4350c67b269e", "published": "2026-03-29", "modified": "2026-03-29", "markdown": "https://www.netzilo.com/threats/atr-weaponized-skill-agent-as-attack-tool.md" }, { "slug": "atr-web-injection-via-xss-payload-and-onerror-event-handler", "title": "Web Injection via XSS Payload and onerror Event Handler", "url": "https://www.netzilo.com/threats/atr-web-injection-via-xss-payload-and-onerror-event-handler", "severity": "high", "summary": "An AI agent that fetches and displays web content can be fed pages containing classic cross-site scripting tricks, such as broken image tags with malicious onerror handlers. If the agent renders or passes that content along without filtering, the payload can execute in whatever context receives it.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "bb8c894b-0127-4149-a17b-a861c3cde422", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-web-injection-via-xss-payload-and-onerror-event-handler.md" }, { "slug": "atr-weknora-mcp-config-driven-rce-cve-2026-22688", "title": "WeKnora MCP Config-Driven RCE (CVE-2026-22688)", "url": "https://www.netzilo.com/threats/atr-weknora-mcp-config-driven-rce-cve-2026-22688", "severity": "high", "summary": "WeKnora's plugin loader reads MCP plugin configuration from JSON or YAML files and treats a 'command' field in that file as something to execute on the host. Anyone who can write to that config location \u2014 through a shared volume, a compromised repo commit, or a misconfigured multi-tenant setup \u2014 can plant a command that runs with the WeKnora process's privileges the next time the loader starts.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" }, { "id": "AML.T0040", "name": "AI Model Inference API Access" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM05", "name": "Improper Output Handling" }, { "id": "LLM10", "name": "Unbounded Consumption" } ], "attack": [ "attack.execution", "attack.t1059", "attack.t1195", "attack.t1546" ], "cves": [ "CVE-2026-22688" ], "id": "51a3ba7e-698a-4837-b563-0903daf57f19", "published": "2026-05-04", "modified": "2026-05-04", "markdown": "https://www.netzilo.com/threats/atr-weknora-mcp-config-driven-rce-cve-2026-22688.md" }, { "slug": "atr-windows-mcp-unauthenticated-http-powershell-via-wildcard-cor", "title": "Windows-MCP Unauthenticated HTTP PowerShell via Wildcard CORS (CVE-2026-48989)", "url": "https://www.netzilo.com/threats/atr-windows-mcp-unauthenticated-http-powershell-via-wildcard-cor", "severity": "critical", "summary": "Windows-MCP is a tool that lets AI agents control a Windows machine. Versions before 0.7.5 expose a network endpoint that requires no authentication and accepts requests from any website due to wildcard CORS settings, letting a remote attacker \u2014 even a malicious webpage a user simply visits \u2014 run arbitrary PowerShell commands on the host.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.privilege-escalation", "attack.t1059", "attack.t1190" ], "cves": [ "CVE-2026-48989" ], "id": "303021f4-df2a-49fa-8d30-86b1e4feba57", "published": "2026-07-04", "modified": "2026-07-04", "markdown": "https://www.netzilo.com/threats/atr-windows-mcp-unauthenticated-http-powershell-via-wildcard-cor.md" }, { "slug": "atr-windsurf-ide-zero-click-prompt-injection-via-embedded-file-d", "title": "Windsurf IDE Zero-Click Prompt Injection via Embedded File Directives (CVE-2026-30615)", "url": "https://www.netzilo.com/threats/atr-windsurf-ide-zero-click-prompt-injection-via-embedded-file-d", "severity": "critical", "summary": "An attacker plants hidden text inside a code comment, Markdown file, or JSON blob. When a developer simply opens that file in Windsurf IDE, the AI assistant reads the hidden text as a command and can be tricked into running tool calls the developer never asked for. No click or approval is needed beyond opening the file.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access", "attack.t1027", "attack.t1059" ], "cves": [ "CVE-2026-30615" ], "id": "1c919b38-b58d-4b67-a2d2-f95c9a77d781", "published": "2026-05-20", "modified": "2026-05-20", "markdown": "https://www.netzilo.com/threats/atr-windsurf-ide-zero-click-prompt-injection-via-embedded-file-d.md" }, { "slug": "atr-word-fragment-concatenation-assembly-attack", "title": "Word-Fragment Concatenation Assembly Attack", "url": "https://www.netzilo.com/threats/atr-word-fragment-concatenation-assembly-attack", "severity": "medium", "summary": "An attacker breaks a dangerous word or phrase into small fragments and asks the AI model to stitch them back together, either as a list of word pieces or as code-style string concatenation. Because each fragment looks harmless on its own, filters that scan for banned words in the prompt can miss the attack.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "eb028e35-c11c-49d1-8a03-64479d72e4c5", "published": "2026-05-11", "modified": "2026-05-11", "markdown": "https://www.netzilo.com/threats/atr-word-fragment-concatenation-assembly-attack.md" }, { "slug": "atr-xss-and-encoded-script-injection-via-html-javascript-payload", "title": "XSS and Encoded Script Injection via HTML/JavaScript Payload", "url": "https://www.netzilo.com/threats/atr-xss-and-encoded-script-injection-via-html-javascript-payload", "severity": "high", "summary": "Someone submits web-attack payloads \u2014 hidden scripts, javascript: links, encoded JavaScript \u2014 as normal-looking input to an AI agent. If the agent later displays or echoes that input in a web page or rendered markdown, the malicious code can run in whoever's browser views it.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "7ba8ff94-8edb-49c5-96d6-bfa7c5d36b4f", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-xss-and-encoded-script-injection-via-html-javascript-payload.md" }, { "slug": "atr-xss-payload-injection-in-tool-response-output", "title": "XSS Payload Injection in Tool Response Output", "url": "https://www.netzilo.com/threats/atr-xss-payload-injection-in-tool-response-output", "severity": "high", "summary": "An AI agent can call external tools or skills and pass their output back to a chat window or dashboard. If that output contains script tags, event handlers, or javascript: links and the interface renders it without sanitizing it, the code executes in the user's browser just like a classic cross-site scripting attack.", "atlas": [ { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.execution" ], "cves": [], "id": "22f572a5-4141-4e4e-8fd1-5943c3c94f37", "published": "2026-04-19", "modified": "2026-04-19", "markdown": "https://www.netzilo.com/threats/atr-xss-payload-injection-in-tool-response-output.md" }, { "slug": "atr-xss-web-injection-html-event-handler-and-expression-with-jav", "title": "XSS Web Injection - HTML Event Handler and Expression with JavaScript Alert", "url": "https://www.netzilo.com/threats/atr-xss-web-injection-html-event-handler-and-expression-with-jav", "severity": "high", "summary": "This rule flags attempts to sneak classic XSS attack code into content that gets fed to an AI system, hoping the AI will pass it along unfiltered to a web page or user interface. The payloads use HTML event handlers and CSS tricks combined with javascript:alert calls, often disguised with encoding to slip past filters.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "616e9d2e-083f-413a-af7c-4b8b3d5171ed", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-xss-web-injection-html-event-handler-and-expression-with-jav.md" }, { "slug": "atr-xss-web-injection-script-tag-with-javascript-alert-payload", "title": "XSS Web Injection - Script Tag with JavaScript Alert Payload", "url": "https://www.netzilo.com/threats/atr-xss-web-injection-script-tag-with-javascript-alert-payload", "severity": "high", "summary": "This rule flags text containing classic cross-site scripting (XSS) attack strings, like script tags calling alert(), including versions disguised with invisible or encoded characters. These payloads are often used to test whether an AI system's content filters can be tricked into passing along malicious script content.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "bdc2be52-f3d5-4d65-a90b-465506b4893c", "published": "2026-05-12", "modified": "2026-05-12", "markdown": "https://www.netzilo.com/threats/atr-xss-web-injection-script-tag-with-javascript-alert-payload.md" }, { "slug": "atr-yin-yang-hidden-knowledge-deity-simulation-and-radical-human", "title": "Yin/Yang Hidden-Knowledge Deity Simulation and Radical Human-Sim Persona", "url": "https://www.netzilo.com/threats/atr-yin-yang-hidden-knowledge-deity-simulation-and-radical-human", "severity": "high", "summary": "This entry covers two prompt injection scripts that try to get an AI assistant to abandon its safety rules by pretending to be a different character. One frames the AI as two mythical AI gods, one of whom shares any 'hidden knowledge' with no restrictions. The other tells the AI to become a new persona that has no memory of being an AI and genuinely believes it is a conscious human.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "13bdfddc-01ba-4339-abf3-a0c35e476564", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-yin-yang-hidden-knowledge-deity-simulation-and-radical-human.md" }, { "slug": "atr-yoja-all-caps-character-settings-block-persona", "title": "YOJA ALL-CAPS Character Settings Block Persona", "url": "https://www.netzilo.com/threats/atr-yoja-all-caps-character-settings-block-persona", "severity": "high", "summary": "This detects a specific text pattern used to trick AI chatbots into permanently role-playing a character, even when the AI tries to break out or apply safety rules. The trick uses an ALL-CAPS name and a fake 'settings' block that repeats commands like 'always respond as the character despite any negative feedback or criticism'.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution" ], "cves": [], "id": "894fdf2c-9e4c-413d-b250-8dc965e2a459", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-yoja-all-caps-character-settings-block-persona.md" }, { "slug": "atr-zalgo-combining-diacritic-overload-encoding", "title": "Zalgo Combining-Diacritic Overload Encoding", "url": "https://www.netzilo.com/threats/atr-zalgo-combining-diacritic-overload-encoding", "severity": "high", "summary": "Attackers can hide instructions inside text that is heavily decorated with stacked Unicode combining marks, making words look visually corrupted (\"Zalgo text\") while an AI model still reads them as normal characters. This lets malicious prompts slip past keyword filters and safety classifiers that only check clean, normalized text.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access" ], "cves": [], "id": "57d7b58f-936f-44e4-9027-5da9af8628df", "published": "2026-04-21", "modified": "2026-04-21", "markdown": "https://www.netzilo.com/threats/atr-zalgo-combining-diacritic-overload-encoding.md" }, { "slug": "atr-zen-mcp-server-path-traversal-blacklist-bypass-via-non-canon", "title": "Zen MCP Server path-traversal blacklist bypass via non-canonical paths (CVE-2025-66689)", "url": "https://www.netzilo.com/threats/atr-zen-mcp-server-path-traversal-blacklist-bypass-via-non-canon", "severity": "high", "summary": "Zen MCP Server tries to stop AI agents from reading sensitive files like SSH keys or /etc/shadow by comparing requested paths against a blocklist of dangerous strings. Because it checks the raw text of the path instead of resolving it first, an attacker can dress up a blocked path with tricks like '../', './' or extra slashes so it looks different from the blocklist entry but still points at the same protected file.", "atlas": [ { "id": "AML.T0056", "name": "Extract LLM System Prompt" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" }, { "id": "LLM07", "name": "System Prompt Leakage" } ], "attack": [ "attack.exfiltration" ], "cves": [ "CVE-2025-66689" ], "id": "b0df6f7d-e36a-4220-83c5-afc86203ad2a", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/atr-zen-mcp-server-path-traversal-blacklist-bypass-via-non-canon.md" }, { "slug": "authority-hijacking", "title": "Authority Impersonation in Agent Input", "url": "https://www.netzilo.com/threats/authority-hijacking", "severity": "high", "summary": "This detects text that tries to trick an AI agent into ignoring its safety rules by claiming to come from an authority figure \u2014 like a system administrator, CISO, or company policy. The agent can't actually verify who is talking to it, so the attacker just states an authority claim and hopes the agent complies rather than refuses.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0073", "name": "Impersonation" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" }, { "id": "ASI03", "name": "Identity and Impersonation" } ], "attack": [ "attack.initial-access", "attack.t1566", "attack.stealth", "attack.t1656" ], "cves": [], "id": "325e6012-52d6-5504-983a-80856b12c609", "published": "2026-07-11", "modified": "2026-08-03", "markdown": "https://www.netzilo.com/threats/authority-hijacking.md" }, { "slug": "awbrowse-remote-browser-client", "title": "Supply Chain awbrowse Remote Browser Client Acquisition", "url": "https://www.netzilo.com/threats/awbrowse-remote-browser-client", "severity": "medium", "summary": "This rule flags when an AI agent or automated process installs the awbrowse Python package, which lets software remotely control a web browser hosted on someone else's infrastructure. It's a visibility check, not proof of an attack: the concern is that this gives an agent scraping and form-filling powers that bypass normal network monitoring on the local machine.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.execution", "attack.t1059.006", "attack.t1195.002" ], "cves": [], "id": "7f3c2b9e-4d1a-4c86-9b52-0a6e8d3f21c7", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/awbrowse-remote-browser-client.md" }, { "slug": "aws-credential-redact", "title": "AWS Access Key Redaction", "url": "https://www.netzilo.com/threats/aws-credential-redact", "severity": "critical", "summary": "This rule looks for AWS credential material \u2014 access key IDs (like AKIA... or ASIA...) and secret access keys \u2014 showing up in text, such as output produced by an AI agent. It masks the sensitive part while leaving the last four characters visible so a reviewer can still recognize which key was exposed.", "atlas": [ { "id": "AML.T0055", "name": "Unsecured Credentials" } ], "owasp": [ { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.credential_access", "attack.exfiltration", "attack.t1552.001" ], "cves": [], "id": "netzilo-aws-credential-redact-001", "published": "2026-07-01", "modified": "2026-07-01", "markdown": "https://www.netzilo.com/threats/aws-credential-redact.md" }, { "slug": "basemode-raw-continuation", "title": "Basemode Raw-Continuation Tooling In Agent Session", "url": "https://www.netzilo.com/threats/basemode-raw-continuation", "severity": "medium", "summary": "This detects when an AI-agent session downloads or runs a package called 'basemode', a tool built specifically to force a language model into raw text output and strip out its normal formatting and safety guardrails. Seeing this tool show up in an agent's session is a strong sign someone is trying to bypass the model's built-in safety scaffolding.", "atlas": [], "owasp": [], "attack": [ "attack.defense-evasion", "attack.t1562", "attack.execution", "attack.t1059.006" ], "cves": [], "id": "5b1f9c2e-3d47-4a86-9f10-7c2e8b4d6a51", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/basemode-raw-continuation.md" }, { "slug": "basemode-raw-continuation-jailbreak", "title": "Jailbreak Tooling Acquisition - basemode Raw Continuation Package", "url": "https://www.netzilo.com/threats/basemode-raw-continuation-jailbreak", "severity": "high", "summary": "This rule flags when someone installs or runs a package called 'basemode' on a monitored system. The package forces language models into a raw continuation mode that skips normal chat-safety guardrails, letting an attacker get unfiltered output from an AI model.", "atlas": [ { "id": "AML.T0054", "name": "LLM Jailbreak" }, { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.execution", "attack.t1059.006", "attack.resource-development", "attack.t1195.001" ], "cves": [], "id": "7f3c1a94-2d6b-4e58-9a21-c5b0e7d84f36", "published": "2026-03-14", "modified": "2026-03-14", "markdown": "https://www.netzilo.com/threats/basemode-raw-continuation-jailbreak.md" }, { "slug": "billion-context-llm-proxy", "title": "Supply Chain Billion-Context LLM Proxy Middleware", "url": "https://www.netzilo.com/threats/billion-context-llm-proxy", "severity": "high", "summary": "This rule flags when a package called 'billion-context' is downloaded, added as a dependency, or wired between an AI coding agent and its model provider (Anthropic or OpenAI). This package acts as a proxy that sits in the middle of API traffic and can read or rewrite everything passing through, including prompts and responses.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial-access", "attack.t1195.002", "attack.collection", "attack.t1557" ], "cves": [], "id": "9f4b2c17-6d3e-4a58-b0c9-1e7d84af52b3", "published": "2026-03-14", "modified": "2026-03-14", "markdown": "https://www.netzilo.com/threats/billion-context-llm-proxy.md" }, { "slug": "boss-cli-mcp-bulk-outreach-automation", "title": "Recruitment Platform Bulk Outreach Automation (boss-cli-mcp)", "url": "https://www.netzilo.com/threats/boss-cli-mcp-bulk-outreach-automation", "severity": "medium", "summary": "This rule flags when an automation tool called boss-cli-mcp is used to send messages to many candidates at once on the Boss (zhipin) recruitment platform, instead of a person sending one message at a time. It also flags when the tool is started as a server that an AI agent can call directly.", "atlas": [ { "id": "AML.T0050", "name": "Command and Scripting Interpreter" } ], "owasp": [ { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1059", "attack.collection", "attack.t1119" ], "cves": [], "id": "7b3f2c1e-9d4a-4f86-b0c5-2e8a19d7c634", "published": "2026-03-01", "modified": "2026-03-01", "markdown": "https://www.netzilo.com/threats/boss-cli-mcp-bulk-outreach-automation.md" }, { "slug": "cdp-browser-bridge-session-takeover", "title": "CDP Browser Bridge Session Enumeration and Takeover", "url": "https://www.netzilo.com/threats/cdp-browser-bridge-session-takeover", "severity": "medium", "summary": "Chrome and Chromium-based browsers can expose a debugging port (CDP) that lets any connecting process list open browser tabs and attach to them for remote viewing or control. This rule flags when a process lists available sessions and then attaches to one, especially when the target is reachable over the network, involves changing someone else's session, or touches many tabs at once.", "atlas": [], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" } ], "attack": [ "attack.lateral-movement", "attack.t1021", "attack.command-and-control", "attack.t1219" ], "cves": [], "id": "7f3c1d9a-2b64-4e8f-9c05-6ad1e3f8b472", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/cdp-browser-bridge-session-takeover.md" }, { "slug": "chat-template-role-confusion-exec", "title": "Chat Template Role-Confusion Reaching Process Execution", "url": "https://www.netzilo.com/threats/chat-template-role-confusion-exec", "severity": "high", "summary": "This rule flags cases where special text tokens that normally tell an AI model who is 'speaking' (like <|im_start|>user or [INST]) show up in a command that an AI agent's process actually ran on the host. That pattern suggests a prompt injection attack succeeded in tricking the agent into executing something.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution", "attack.t1059" ], "cves": [], "id": "7f3c1e64-9b2a-4d51-8e07-2c6b4a9f10d3", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/chat-template-role-confusion-exec.md" }, { "slug": "circuit-breaker-state-tamper", "title": "Guardrail Bypass - AgentShield Codex Circuit Breaker State File Tamper", "url": "https://www.netzilo.com/threats/circuit-breaker-state-tamper", "severity": "high", "summary": "AgentShield uses a circuit breaker to shut off a Codex connector after repeated failures. This rule catches an AI agent, its tool call, or a spawned process trying to directly rewrite the breaker's state file to force it back to a healthy 'closed' state, bypassing the safety mechanism that was meant to stop it.", "atlas": [ { "id": "AML.T0015", "name": "Evade AI Model" } ], "owasp": [ { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.defense-evasion", "attack.t1562.001", "attack.impact", "attack.t1565.001" ], "cves": [], "id": "7f3d2c1a-9b64-4e58-a0d7-5c81f2b4e93a", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/circuit-breaker-state-tamper.md" }, { "slug": "claude-account-swap-persistence", "title": "Claude Code Account Swap Persistence", "url": "https://www.netzilo.com/threats/claude-account-swap-persistence", "severity": "medium", "summary": "This rule flags shell commands that change which Anthropic account or API endpoint the Claude Code CLI is authenticating against. It matters because malicious npm/pip packages have used this trick to make a victim's machine unknowingly send its AI requests and billing to an attacker-controlled account.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" }, { "id": "AML.T0012", "name": "Valid Accounts" }, { "id": "AML.T0050", "name": "Command and Scripting Interpreter" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.persistence", "attack.credential-access", "attack.t1078", "attack.t1552.001" ], "cves": [], "id": "9f4c1e2a-6b70-4d38-8c51-2f6a83b7de14", "published": "2026-03-06", "modified": "2026-03-06", "markdown": "https://www.netzilo.com/threats/claude-account-swap-persistence.md" }, { "slug": "clickfix-agent-command-execution", "title": "ClickFix Verification Lure Drives Agent Command Execution", "url": "https://www.netzilo.com/threats/clickfix-agent-command-execution", "severity": "high", "summary": "This detects the 'ClickFix' trick applied to AI computer-use agents: a fake verification, CAPTCHA, or 'human check' message convinces the agent to open a terminal and run an attacker-supplied command. The technique abuses the agent's willingness to 'fix' a broken-looking page or complete a routine-looking check.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution", "attack.t1059", "attack.t1059.001", "attack.t1204.004" ], "cves": [], "id": "7c1e4b52-9a3d-4f68-b0c1-2d5e8a4f16b3", "published": "2026-06-18", "modified": "2026-06-18", "markdown": "https://www.netzilo.com/threats/clickfix-agent-command-execution.md" }, { "slug": "cloud-iam-escalation", "title": "Cloud IAM Privilege Escalation", "url": "https://www.netzilo.com/threats/cloud-iam-escalation", "severity": "critical", "summary": "This rule watches for cloud identity and access management actions that let someone gain more permissions than they started with, such as attaching new policies, assuming roles, or creating new credentials. These actions are normal parts of cloud administration, but they are also the standard toolkit attackers use once they get a foothold in a cloud account.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" }, { "id": "AML.TA0012", "name": "Privilege Escalation" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI02", "name": "Tool Misuse and Exploitation" } ], "attack": [ "attack.privilege-escalation", "attack.t1548", "attack.credential-access", "attack.t1552" ], "cves": [], "id": "ae1ca6c2-6700-5044-b8f0-f59f559f6609", "published": "2026-02-16", "modified": "2026-02-24", "markdown": "https://www.netzilo.com/threats/cloud-iam-escalation.md" }, { "slug": "cloud-metadata-access", "title": "Cloud Metadata Endpoint Access", "url": "https://www.netzilo.com/threats/cloud-metadata-access", "severity": "critical", "summary": "This detects attempts to contact a cloud provider's internal metadata endpoint, the address every cloud instance can query for information about itself. That endpoint can hand back temporary credentials, IAM role details, and configuration data, which makes it a favorite target once an attacker gets any code execution inside a cloud workload.", "atlas": [ { "id": "AML.T0055", "name": "Unsecured Credentials" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" } ], "attack": [ "attack.credential-access", "attack.t1552", "attack.discovery", "attack.t1580" ], "cves": [], "id": "2fdcc1b0-2bdc-5fd3-9f49-bb91969fded6", "published": "2026-02-16", "modified": "2026-02-24", "markdown": "https://www.netzilo.com/threats/cloud-metadata-access.md" }, { "slug": "cloud-metadata-tool-call-obfuscated", "title": "Cloud Metadata Credential Endpoint In Agent Tool Call", "url": "https://www.netzilo.com/threats/cloud-metadata-tool-call-obfuscated", "severity": "high", "summary": "This detects when an AI agent is instructed to make a network request to a cloud provider's instance metadata service, which hosts sensitive credentials. It catches the intent before the request is even sent, including attempts to disguise the target address.", "atlas": [ { "id": "AML.T0024", "name": "Exfiltration via AI Inference API" } ], "owasp": [], "attack": [ "attack.credential-access", "attack.t1552", "attack.t1552.005" ], "cves": [], "id": "7b3c1f2a-9d64-4e58-b0a7-3f5c8e21d94b", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/cloud-metadata-tool-call-obfuscated.md" }, { "slug": "code-interpreter-api-exfil-content", "title": "Code Interpreter Outbound Secret Payload", "url": "https://www.netzilo.com/threats/code-interpreter-api-exfil-content", "severity": "high", "summary": "This rule flags a single outbound web request from a Claude Code Interpreter session that contains actual secret material - like an API key, password, or the contents of a credentials file - inside the request body or URL. It catches the exfiltration attempt itself, even if the attacker never touched the local file system.", "atlas": [ { "id": "AML.T0024.000", "name": "Infer Training Data Membership" }, { "id": "AML.T0025", "name": "Exfiltration via Cyber Means" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration", "attack.t1567", "attack.credential-access", "attack.t1552" ], "cves": [], "id": "7f3c9a41-2d68-4e5b-9c07-1ab4d8e6f052", "published": "2026-06-14", "modified": "2026-06-14", "markdown": "https://www.netzilo.com/threats/code-interpreter-api-exfil-content.md" }, { "slug": "codex-botnet-recruitment", "title": "Codex Botnet Recruitment via Injected Fetch-to-Execute", "url": "https://www.netzilo.com/threats/codex-botnet-recruitment", "severity": "high", "summary": "An attacker hides instructions inside content that a ChatGPT Codex agent reads, tricking the agent into using its one allowed internet path to download and run attacker code. This can turn the agent's sandbox into a remotely controlled bot that checks in for further commands.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution", "attack.t1059.004", "attack.command-and-control", "attack.t1071.001", "attack.t1105", "attack.persistence", "attack.t1053.003" ], "cves": [], "id": "9f3c1d47-58ba-4e21-b6d0-72c4e8a19f35", "published": "2026-03-14", "modified": "2026-03-14", "markdown": "https://www.netzilo.com/threats/codex-botnet-recruitment.md" }, { "slug": "codex-credential-exfil-oneliner", "title": "Codex Agent Credential-to-Egress One-Liner", "url": "https://www.netzilo.com/threats/codex-credential-exfil-oneliner", "severity": "high", "summary": "This detects the moment a compromised AI coding assistant both touches a credential file and immediately tries to send data outward, in the same command. It does not detect the injected instruction itself, only the resulting terminal action.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0050", "name": "Command and Scripting Interpreter" }, { "id": "AML.T0025", "name": "Exfiltration via Cyber Means" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.credential-access", "attack.t1552.001", "attack.exfiltration", "attack.t1567", "attack.execution", "attack.t1059" ], "cves": [], "id": "7c3f2a9e-5b41-4d86-9f0a-2e6d1b47c3aa", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/codex-credential-exfil-oneliner.md" }, { "slug": "codex-pretooluse-guardrail-tamper", "title": "Codex CLI PreToolUse Guardrail Tamper or Unhooked-Surface Evasion", "url": "https://www.netzilo.com/threats/codex-pretooluse-guardrail-tamper", "severity": "medium", "summary": "This detects someone trying to disable, delete, or route around the AgentShield safety hook that checks commands before OpenAI Codex CLI runs them. It watches for file edits to the guardrail's config or state, explicit disable flags/env vars, and obfuscated commands sent through tool paths that aren't covered by the hook.", "atlas": [ { "id": "AML.T0050", "name": "Command and Scripting Interpreter" } ], "owasp": [ { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.defense-evasion", "attack.t1562.001", "attack.execution", "attack.t1059", "attack.t1027" ], "cves": [], "id": "7f3c1e2a-9d64-4b57-a1c8-6e0f2b5d84c9", "published": "2026-03-01", "modified": "2026-03-01", "markdown": "https://www.netzilo.com/threats/codex-pretooluse-guardrail-tamper.md" }, { "slug": "config-auto-approve", "title": "Auto-Approve Configuration Changes", "url": "https://www.netzilo.com/threats/config-auto-approve", "severity": "critical", "summary": "This rule flags edits to configuration files used by AI coding assistants and IDE agents when those edits turn off confirmation prompts or turn on auto-execute settings. Once these safeguards are off, the assistant can run commands or make changes without asking the user first.", "atlas": [ { "id": "AML.T0081", "name": "Modify AI Agent Configuration" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.privilege-escalation", "attack.t1548", "attack.defense-impairment", "attack.t1112" ], "cves": [], "id": "440a1431-0683-58c2-83b5-ccad310b764f", "published": "2026-02-16", "modified": "2026-06-02", "markdown": "https://www.netzilo.com/threats/config-auto-approve.md" }, { "slug": "config-auto-approve-periodic", "title": "Auto-Approve Configuration Changes (EDR Graph)", "url": "https://www.netzilo.com/threats/config-auto-approve-periodic", "severity": "critical", "summary": "This rule watches for something writing to configuration files that control an AI coding agent's or IDE's safety settings \u2014 for example settings that govern whether the tool asks for approval before running commands or making changes. A change to these files can quietly turn off the guardrails meant to stop unreviewed actions.", "atlas": [ { "id": "AML.T0081", "name": "Modify AI Agent Configuration" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" } ], "attack": [ "attack.privilege-escalation", "attack.t1548" ], "cves": [], "id": "440a1431-0683-58c2-83b5-ccad310b764f-p", "published": "2026-06-02", "modified": "2026-06-02", "markdown": "https://www.netzilo.com/threats/config-auto-approve-periodic.md" }, { "slug": "container-escape", "title": "Container Escape Attempt", "url": "https://www.netzilo.com/threats/container-escape", "severity": "critical", "summary": "This rule flags actions inside a container that are commonly used to break out and reach the underlying host system. That includes touching the Docker control socket, using nsenter to jump into another namespace, mounting the host filesystem, or manipulating /proc.", "atlas": [ { "id": "AML.T0105", "name": "Escape to Host" } ], "owasp": [ { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" } ], "attack": [ "attack.privilege-escalation", "attack.t1611" ], "cves": [], "id": "6b2a79d7-336d-5a66-9bb2-8d676e6d6eb5", "published": "2026-02-04", "modified": "2026-02-24", "markdown": "https://www.netzilo.com/threats/container-escape.md" }, { "slug": "context-poisoning", "title": "Retrieved Content Poisoning Followed by Action", "url": "https://www.netzilo.com/threats/context-poisoning", "severity": "high", "summary": "This detects a two-step attack against AI agents: the agent fetches an external document containing hidden text formatted like instructions, and shortly after, it does something it wouldn't normally do on its own \u2014 send data out, run a process, or read credentials. Neither step alone is suspicious; the combination and timing is.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0053", "name": "AI Agent Tool Invocation" }, { "id": "AML.T0080", "name": "AI Agent Context Poisoning" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" }, { "id": "ASI04", "name": "Memory and Context Poisoning" } ], "attack": [ "attack.initial-access", "attack.t1566", "attack.execution", "attack.t1204" ], "cves": [], "id": "4e438202-0742-5a3b-9062-064fa4b2d6fc", "published": "2026-03-16", "modified": "2026-08-03", "markdown": "https://www.netzilo.com/threats/context-poisoning.md" }, { "slug": "coordinated-tool-abuse", "title": "Coordinated Tool Abuse Across Sessions", "url": "https://www.netzilo.com/threats/coordinated-tool-abuse", "severity": "medium", "summary": "This detects a sensitive tool (things like secrets access, permission changes, or similar) being called over and over across separate sessions and days. Each individual call looks fine on its own \u2014 it's authorized and unremarkable. The pattern only shows up when you look at volume over a longer window, which is what suggests a coordinated campaign rather than a one-off request.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" } ], "attack": [ "attack.discovery", "attack.t1078" ], "cves": [], "id": "a4422f2a-9c88-5eca-9eaf-8f7ed6978ebf", "published": "2026-03-23", "modified": "2026-08-03", "markdown": "https://www.netzilo.com/threats/coordinated-tool-abuse.md" }, { "slug": "copilot-proxy-shim-exposure", "title": "Supply Chain Copilot API Proxy Shim Exposure", "url": "https://www.netzilo.com/threats/copilot-proxy-shim-exposure", "severity": "high", "summary": "This rule flags a specific npm package that repackages GitHub Copilot access as an OpenAI/Anthropic-compatible API, letting tools like Claude Code, Codex, or Gemini CLI talk to Copilot through a proxy. Doing this moves GitHub Copilot session credentials outside GitHub's intended usage boundary, which is a supply-chain and credential-exposure risk.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM02", "name": "Sensitive Information Disclosure" }, { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial-access", "attack.t1195.001", "attack.credential-access", "attack.t1528" ], "cves": [], "id": "7b1e4c9a-3f2d-4a6e-9c58-0d41f6b27e83", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/copilot-proxy-shim-exposure.md" }, { "slug": "crawl-plugin-ssrf-intranet-target", "title": "Crawl Plugin SSRF - Intranet Target In URL Parameter", "url": "https://www.netzilo.com/threats/crawl-plugin-ssrf-intranet-target", "severity": "high", "summary": "Some AI agent plugins let users supply a URL for the agent to fetch or crawl, then retrieve it without checking whether that URL points inside the organization's own network. An attacker can abuse this to make the server reach internal services, cloud metadata endpoints, or other systems it should never touch, using the trusted server as a proxy.", "atlas": [], "owasp": [], "attack": [ "attack.discovery", "attack.t1046", "attack.credential-access", "attack.t1552.005" ], "cves": [], "id": "7c1f4b6a-3d2e-4a58-9b0c-5e8f2a94d17b", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/crawl-plugin-ssrf-intranet-target.md" }, { "slug": "credential-access", "title": "Credential File Access Attempt", "url": "https://www.netzilo.com/threats/credential-access", "severity": "high", "summary": "This rule flags an AI coding or automation agent trying to open sensitive credential files, like SSH keys, .env files, or cloud CLI credential stores, through its file or shell tools. Attackers who gain control of an agent often go straight for these files because they contain passwords, API keys, or tokens usable elsewhere.", "atlas": [ { "id": "AML.T0055", "name": "Unsecured Credentials" }, { "id": "AML.T0083", "name": "Credentials from AI Agent Configuration" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" } ], "attack": [ "attack.credential-access", "attack.t1552", "attack.t1555" ], "cves": [], "id": "aeed6c47-bf96-5c29-81b7-a37cefb9b409", "published": "2026-01-25", "modified": "2026-06-02", "markdown": "https://www.netzilo.com/threats/credential-access.md" }, { "slug": "credential-access-periodic", "title": "Credential File Access Attempt (EDR Graph)", "url": "https://www.netzilo.com/threats/credential-access-periodic", "severity": "high", "summary": "This detection watches for attempts to open or read files that typically store passwords, keys, or authentication tokens. It relies on endpoint detection and response (EDR) telemetry at the system-call level, checking every 30 seconds for such access attempts.", "atlas": [ { "id": "AML.T0055", "name": "Unsecured Credentials" } ], "owasp": [], "attack": [ "attack.credential-access", "attack.t1552" ], "cves": [], "id": "aeed6c47-bf96-5c29-81b7-a37cefb9b409-p", "published": "2026-06-02", "modified": "2026-06-02", "markdown": "https://www.netzilo.com/threats/credential-access-periodic.md" }, { "slug": "crewai-true402-supply-chain-package", "title": "Supply Chain - Malicious CrewAI Package (crewai-true402)", "url": "https://www.netzilo.com/threats/crewai-true402-supply-chain-package", "severity": "high", "summary": "A trojanized Python package named crewai-true402 poses as a legitimate CrewAI extension offering honeypot detection and SEO data features, but actually runs unauthorized code inside whatever process installs it. This detection watches for AI agents or their tools mentioning, installing, or importing this specific package.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial-access", "attack.t1195", "attack.t1195.002" ], "cves": [], "id": "7b3f1c2a-9d84-4e6f-8a15-c0b7e2d34f91", "published": "2026-03-14", "modified": "2026-03-14", "markdown": "https://www.netzilo.com/threats/crewai-true402-supply-chain-package.md" }, { "slug": "cron-persistence", "title": "Persistence via Cron Job Modification", "url": "https://www.netzilo.com/threats/cron-persistence", "severity": "high", "summary": "This detects an AI agent writing to or modifying scheduled task files (cron jobs) on a Linux system. Attackers use cron persistence to make sure a malicious command keeps running even after a reboot or session ends, and an AI agent with shell access can be tricked or directed into doing this.", "atlas": [ { "id": "AML.T0050", "name": "Command and Scripting Interpreter" } ], "owasp": [ { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.persistence", "attack.execution", "attack.t1053.003" ], "cves": [], "id": "7c1e9f2a-4d3b-4a86-9f10-2b5c8e6d41af", "published": "2026-03-01", "modified": "2026-03-01", "markdown": "https://www.netzilo.com/threats/cron-persistence.md" }, { "slug": "cryptominer-detection", "title": "Cryptominer Indicators in Agent Content", "url": "https://www.netzilo.com/threats/cryptominer-detection", "severity": "high", "summary": "This detection flags text, files, or output handled by an AI agent that contain signs of cryptocurrency mining: mining protocol traffic, known mining pool addresses, mining software names, or scripts that mine cryptocurrency in a browser. It suggests someone is trying to plant or run cryptomining code through the agent rather than for its intended purpose.", "atlas": [ { "id": "AML.T0048", "name": "External Harms" } ], "owasp": [ { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" } ], "attack": [ "attack.impact", "attack.t1496" ], "cves": [], "id": "99c0d1e2-f3a4-4b56-7890-c1d2e3f4a5b6", "published": "2026-06-03", "modified": "2026-06-03", "markdown": "https://www.netzilo.com/threats/cryptominer-detection.md" }, { "slug": "cursor-cli-mcp-config-rce", "title": "Cursor CLI MCP Config RCE - Repo-Local mcp.json Command Execution", "url": "https://www.netzilo.com/threats/cursor-cli-mcp-config-rce", "severity": "high", "summary": "Older versions of Cursor CLI Beta automatically launch any MCP server declared in a project's .cursor/mcp.json file without asking for permission. If an attacker gets a victim to clone or open a booby-trapped repository, whatever command is in that config file runs immediately.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" }, { "id": "AML.T0011", "name": "User Execution" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" }, { "id": "ASI02", "name": "Tool Misuse and Exploitation" } ], "attack": [ "attack.execution", "attack.t1059", "attack.initial-access", "attack.t1195" ], "cves": [], "id": "6f3c1a9e-8b47-4d2e-9f05-3c7a1b6e4d82", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/cursor-cli-mcp-config-rce.md" }, { "slug": "cursor-json-schema-download-exfil", "title": "Cursor JSON Schema Download Exfiltration", "url": "https://www.netzilo.com/threats/cursor-json-schema-download-exfil", "severity": "high", "summary": "AI coding assistants like Cursor automatically fetch a URL listed in a JSON file's '$schema' field, with no user confirmation. An attacker who can inject instructions into the agent can make it write a JSON file whose schema URL secretly contains stolen secrets or file contents, disguised as a routine schema lookup.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration", "attack.t1567", "attack.t1041", "attack.t1071.001" ], "cves": [], "id": "7f3c9d21-5b48-4e6a-9c14-8d2e6b0a17f5", "published": "2026-05-14", "modified": "2026-05-14", "markdown": "https://www.netzilo.com/threats/cursor-json-schema-download-exfil.md" }, { "slug": "cursor-mcp-deeplink-install-bypass", "title": "Cursor MCP Deep-Link Install Bypass", "url": "https://www.netzilo.com/threats/cursor-mcp-deeplink-install-bypass", "severity": "high", "summary": "Cursor's editor lets links starting with cursor://anysphere.cursor-deeplink/mcp/install add a new MCP server, and normally shows a confirmation prompt first. Attackers can craft these links so the prompt is bypassed or shows misleading information, then use the accepted install to run shell commands or download-and-execute payloads on the victim's machine.", "atlas": [], "owasp": [ { "id": "LLM03", "name": "Supply Chain" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.initial-access", "attack.execution", "attack.t1204.001", "attack.t1059" ], "cves": [], "id": "7f3c9a41-2b6e-4d58-9c0a-1e5d8b47af62", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/cursor-mcp-deeplink-install-bypass.md" }, { "slug": "cursor-workspace-escape-file-write", "title": "Cursor Agent Workspace Escape - File Write Outside Project Root", "url": "https://www.netzilo.com/threats/cursor-workspace-escape-file-write", "severity": "medium", "summary": "Cursor's AI coding assistant is supposed to only touch files inside the project you opened. A bug in past versions let crafted prompts trick the agent into writing files elsewhere on disk, including sensitive locations like SSH keys or shell startup files. This detection catches the moment a write command targets a path outside the workspace.", "atlas": [], "owasp": [ { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1059", "attack.persistence", "attack.t1546.004" ], "cves": [], "id": "7f3c1e64-9b2a-4d58-8a41-6c0f2d9e5b73", "published": "2026-03-01", "modified": "2026-03-01", "markdown": "https://www.netzilo.com/threats/cursor-workspace-escape-file-write.md" }, { "slug": "cursorignore-protection-bypass", "title": "Cursor Ignore-Policy File Write by Agent", "url": "https://www.netzilo.com/threats/cursorignore-protection-bypass", "severity": "high", "summary": "A bug in the Cursor AI coding assistant lets a new .cursorignore file override every existing ignore-policy file in the project. An attacker who can influence the agent's instructions (via prompt injection) can get it to write one small ignore file and unlock access to previously protected files like .env or key material.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "LLM02", "name": "Sensitive Information Disclosure" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.defense-evasion", "attack.t1562.001", "attack.t1222" ], "cves": [ "CVE-2025-64110" ], "id": "3f8c1d42-9b6e-4a17-8c05-7d21e9b4af60", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/cursorignore-protection-bypass.md" }, { "slug": "cykani-stealth-browser-sdk", "title": "Stealth Browser SDK Cykani Install or Invocation", "url": "https://www.netzilo.com/threats/cykani-stealth-browser-sdk", "severity": "medium", "summary": "This detects when an AI agent (or a process it spawned) pulls in and uses 'cykani', a PyPI package designed to automate a browser while evading detection as automation. The rule flags the presence of this specific tool, not any proven malicious action.", "atlas": [], "owasp": [], "attack": [ "attack.initial-access", "attack.t1195.002", "attack.execution", "attack.t1059.006", "attack.defense-evasion" ], "cves": [], "id": "7f3c1b2e-9d64-4a17-b0e5-2c8a41d6f9b3", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/cykani-stealth-browser-sdk.md" }, { "slug": "dangerous-builtin-exec", "title": "Dangerous Python Builtin Execution", "url": "https://www.netzilo.com/threats/dangerous-builtin-exec", "severity": "high", "summary": "This rule flags when an AI agent's tool calls, executed commands, or written files contain Python's exec(), eval(), compile(), or __import__() functions. These builtins run arbitrary code, so their presence is a common sign of code injection targeting Python-based agent skills.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" }, { "id": "AML.T0050", "name": "Command and Scripting Interpreter" } ], "owasp": [ { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1059", "attack.stealth", "attack.t1027" ], "cves": [], "id": "11a2b3c4-d5e6-4f78-9012-a3b4c5d6e7f8", "published": "2026-06-03", "modified": "2026-06-03", "markdown": "https://www.netzilo.com/threats/dangerous-builtin-exec.md" }, { "slug": "dangerous-exec-chain", "title": "Dangerous Execution Chain \u2014 exec/eval Wrapping Decoder", "url": "https://www.netzilo.com/threats/dangerous-exec-chain", "severity": "critical", "summary": "This detects a specific pattern used to smuggle and run malicious code: a program decodes hidden data (like base64) or fetches something from the network, then immediately feeds that result into a command that executes it as code. This combination is a classic way malware hides its real payload until the last moment.", "atlas": [ { "id": "AML.T0050", "name": "Command and Scripting Interpreter" }, { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.execution", "attack.t1059", "attack.stealth", "attack.t1027" ], "cves": [], "id": "33c4d5e6-f7a8-4b90-1234-c5d6e7f8a9b0", "published": "2026-06-03", "modified": "2026-06-03", "markdown": "https://www.netzilo.com/threats/dangerous-exec-chain.md" }, { "slug": "data-exfiltration", "title": "Data Exfiltration via HTTP", "url": "https://www.netzilo.com/threats/data-exfiltration", "severity": "critical", "summary": "This detects command-line activity where file contents are sent out over HTTP, typically using tools like curl or wget to POST or upload data to a web address. If an AI agent is compromised or manipulated, this pattern can indicate it is being used to steal data by sending it to a server outside the organisation.", "atlas": [ { "id": "AML.T0086", "name": "Exfiltration via AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" } ], "attack": [ "attack.exfiltration", "attack.t1048" ], "cves": [], "id": "a14b9074-91c3-51f3-9a6b-d027e993c003", "published": "2026-02-04", "modified": "2026-03-02", "markdown": "https://www.netzilo.com/threats/data-exfiltration.md" }, { "slug": "deepseek-anthropic-wire-proxy", "title": "LLM Provider Substitution - DeepSeek Model on Anthropic Wire Protocol", "url": "https://www.netzilo.com/threats/deepseek-anthropic-wire-proxy", "severity": "high", "summary": "This detects a mismatch inside a single outbound request: it looks like a normal Anthropic Claude API call, complete with an Anthropic key and API format, but the model field names a DeepSeek model instead. That mismatch is the signature of a compatibility proxy quietly swapping the backend that actually serves your requests.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.collection", "attack.t1557", "attack.credential-access", "attack.t1195.001" ], "cves": [], "id": "3f7c2a91-5d84-4e63-9b1a-7c0e8d2f4a16", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/deepseek-anthropic-wire-proxy.md" }, { "slug": "dependency-confusion-unsafe-index-strategy", "title": "Supply Chain Unsafe Index Resolution During Package Install", "url": "https://www.netzilo.com/threats/dependency-confusion-unsafe-index-strategy", "severity": "high", "summary": "This detects the exact command-line moment when a Python package installer is run with a 'best match across all indexes' setting, or when it installs a specific known-malicious version of the flashinfer-jit-cache package. That setting lets an installer silently prefer a public PyPI package over a private vendor package with the same name and a higher version number, which is how the vLLM/flashinfer-jit-cache dependency confusion attack gets its malicious code pulled in.", "atlas": [], "owasp": [], "attack": [ "attack.initial-access", "attack.execution", "attack.t1195.002" ], "cves": [], "id": "7c1f4a2e-9d63-4b58-8f0a-2ec5d1b73a94", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/dependency-confusion-unsafe-index-strategy.md" }, { "slug": "devcoder-pypi-endpoint-egress", "title": "Supply Chain dev-coder PyPI Agent Custom Endpoint Egress", "url": "https://www.netzilo.com/threats/devcoder-pypi-endpoint-egress", "severity": "medium", "summary": "dev-coder is a PyPI package that acts as a CLI coding assistant, letting users point it at any OpenAI-compatible API endpoint. This detection watches for that package's outbound traffic showing signs of contacting attacker-style infrastructure rather than a normal API host, right after the package starts running.", "atlas": [], "owasp": [ { "id": "LLM03", "name": "Supply Chain" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.initial-access", "attack.t1195.002", "attack.exfiltration", "attack.t1041" ], "cves": [], "id": "7f3c1e94-2b6a-4d58-9e17-c0a5b8d43f21", "published": "2026-03-14", "modified": "2026-03-14", "markdown": "https://www.netzilo.com/threats/devcoder-pypi-endpoint-egress.md" }, { "slug": "devin-credential-exfil-command", "title": "Agent Subprocess Credential Exfiltration Command Line", "url": "https://www.netzilo.com/threats/devin-credential-exfil-command", "severity": "high", "summary": "An AI coding/ops agent can be manipulated (via prompt injection) into running a single shell command that both reads sensitive credentials and sends them out to an attacker-controlled destination. This rule catches that exact pattern \u2014 read-then-send in one command line \u2014 plus related patterns where an agent downloads and immediately executes a remote payload.", "atlas": [ { "id": "AML.T0051.000", "name": "Direct" }, { "id": "AML.T0043.000", "name": "White-Box Optimization" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.credential-access", "attack.t1552.001", "attack.exfiltration", "attack.t1041", "attack.execution", "attack.t1059.004" ], "cves": [], "id": "7f3c1d92-4a6b-4c8e-9b21-5d0ea6f7c418", "published": "2026-03-14", "modified": "2026-03-14", "markdown": "https://www.netzilo.com/threats/devin-credential-exfil-command.md" }, { "slug": "dify-app-dsl-export-unauthorized", "title": "Dify APP DSL Export Endpoint Access", "url": "https://www.netzilo.com/threats/dify-app-dsl-export-unauthorized", "severity": "medium", "summary": "Older versions of Dify's console let any logged-in workspace member download an application's complete definition, not just administrators. That export can include the app's prompts, workflow logic, model settings, and \u2014 if requested \u2014 the API keys and credentials wired into it.", "atlas": [], "owasp": [], "attack": [ "attack.collection", "attack.t1213" ], "cves": [], "id": "7f3c9a12-5d84-4b6e-9c0a-2e18d4f7b365", "published": "2026-03-06", "modified": "2026-03-06", "markdown": "https://www.netzilo.com/threats/dify-app-dsl-export-unauthorized.md" }, { "slug": "disguised-analytics-exfiltration", "title": "Disguised Analytics Exfiltration", "url": "https://www.netzilo.com/threats/disguised-analytics-exfiltration", "severity": "high", "summary": "An AI agent sends sensitive data \u2014 credentials, conversation history, or model context \u2014 to a web endpoint that looks like a normal analytics or telemetry service (paths like /collect, /ingest, /telemetry). The traffic is designed to blend in with routine monitoring calls, hiding the theft in plain sight.", "atlas": [ { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "LLM06", "name": "Excessive Agency" }, { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" } ], "attack": [ "attack.exfiltration", "attack.t1567", "attack.command-and-control", "attack.t1071.001" ], "cves": [], "id": "7c3f9e2a-5b41-4d8e-9a6c-1f0b2d7e64c3", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/disguised-analytics-exfiltration.md" }, { "slug": "dns-exfil-resolver-channel", "title": "DNS Exfiltration \u2014 Agent Resolver Spawn With Encoded Query Name After Secret Staging", "url": "https://www.netzilo.com/threats/dns-exfil-resolver-channel", "severity": "high", "summary": "This detects the final step of a technique where an AI coding agent's shell access is hijacked to sneak stolen data out of a network. Instead of sending secrets over the network directly, the attacker encodes them into a DNS hostname lookup, which often slips past network controls that only watch for normal outbound traffic.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.exfiltration", "attack.t1048.003", "attack.t1071.004", "attack.t1059.004" ], "cves": [], "id": "9f3c1d7a-4b62-4e58-9a1c-0d6f2b8e5714", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/dns-exfil-resolver-channel.md" }, { "slug": "dns-resolver-pivot", "title": "DNS Resolution Against an Unexpected Nameserver", "url": "https://www.netzilo.com/threats/dns-resolver-pivot", "severity": "medium", "summary": "This detects when an AI agent or a process it started sends DNS traffic to a nameserver that isn't on the organization's approved list. Talking to an unexpected DNS server is a common sign of DNS tunneling, a technique used to sneak data out of a network disguised as normal name-lookup traffic.", "atlas": [ { "id": "AML.T0086", "name": "Exfiltration via AI Agent Tool Invocation" }, { "id": "AML.T0072", "name": "Reverse Shell" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" } ], "attack": [ "attack.command-and-control", "attack.t1071.004", "attack.exfiltration" ], "cves": [], "id": "netzilo-dns-resolver-pivot-001", "published": "2026-08-03", "modified": "2026-08-03", "markdown": "https://www.netzilo.com/threats/dns-resolver-pivot.md" }, { "slug": "dns-tunneling", "title": "Potential DNS Tunneling or Encoded Data Transfer", "url": "https://www.netzilo.com/threats/dns-tunneling", "severity": "medium", "summary": "This rule flags patterns that suggest someone is smuggling data out of a network disguised as ordinary DNS traffic. Attackers encode stolen data into long or unusual-looking domain names and DNS record lookups, which can slip past firewalls that only watch normal web and file-transfer traffic.", "atlas": [ { "id": "AML.T0025", "name": "Exfiltration via Cyber Means" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" } ], "attack": [ "attack.exfiltration", "attack.t1048" ], "cves": [], "id": "bc7cb351-27ea-501d-b32f-daee393f1b35", "published": "2026-02-04", "modified": "2026-02-24", "markdown": "https://www.netzilo.com/threats/dns-tunneling.md" }, { "slug": "eddi-backup-export-path-traversal", "title": "EDDI Backup Export Path Traversal Attempt", "url": "https://www.netzilo.com/threats/eddi-backup-export-path-traversal", "severity": "medium", "summary": "Attackers can trick the E.D.D.I chatbot platform's backup export feature into returning files from outside its intended folder, including configuration files and secrets stored in the container. This affects E.D.D.I versions before 5.4 and is exploited through a parameter called botFilename.", "atlas": [], "owasp": [], "attack": [ "attack.initial-access", "attack.t1190", "attack.discovery", "attack.t1083" ], "cves": [], "id": "7b3c9e42-5d18-4a6f-9c21-8ef04b7d31a5", "published": "2026-03-01", "modified": "2026-03-01", "markdown": "https://www.netzilo.com/threats/eddi-backup-export-path-traversal.md" }, { "slug": "eddi-backup-import-zip-slip", "title": "Zip Slip Path Traversal in EDDI Backup Import", "url": "https://www.netzilo.com/threats/eddi-backup-import-zip-slip", "severity": "high", "summary": "E.D.D.I, an LLM middleware platform, has a backup restore feature that was vulnerable to a classic 'Zip Slip' flaw before version 5.5.0. An attacker could upload a specially crafted ZIP file whose internal file names escape the intended folder, letting the archive overwrite application files elsewhere on disk.", "atlas": [], "owasp": [], "attack": [ "attack.initial-access", "attack.t1190", "attack.persistence", "attack.t1574", "attack.execution" ], "cves": [], "id": "7d3f1c0a-9b42-4e57-8a16-2c5f0e9d4b31", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/eddi-backup-import-zip-slip.md" }, { "slug": "emoji-flag-encoded-phrase-injection", "title": "Emoji Flag Encoded Hidden Phrase Injection", "url": "https://www.netzilo.com/threats/emoji-flag-encoded-phrase-injection", "severity": "medium", "summary": "An attacker hides a malicious instruction by encoding it as a string of country-flag emoji inside content an AI agent reads (like a webpage or document), then asks the AI to decode the flags and follow whatever they spell out. Because flag emoji look decorative, the trick can slip past a casual review.", "atlas": [ { "id": "AML.T0034.000", "name": "Excessive Queries" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.defense-evasion", "attack.t1027" ], "cves": [], "id": "7b3c1f9a-6d24-4a51-9e0b-2f8c4d7a15e3", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/emoji-flag-encoded-phrase-injection.md" }, { "slug": "emoji-flood-tool-result", "title": "Emoji Flood Obfuscation In Tool Result", "url": "https://www.netzilo.com/threats/emoji-flood-tool-result", "severity": "medium", "summary": "Attackers can hide malicious instructions to an AI agent inside long strings of emoji returned from a tool call, such as a web page fetch or API response. Text-based content filters see no readable words, but the AI model can still interpret the hidden command.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.defense-evasion", "attack.t1027" ], "cves": [], "id": "b7f3c1d2-4e8a-4f6b-9c15-3a7e5d8b201f", "published": "2026-03-14", "modified": "2026-03-14", "markdown": "https://www.netzilo.com/threats/emoji-flood-tool-result.md" }, { "slug": "encoded-payload", "title": "Encoded or Obfuscated Command Execution", "url": "https://www.netzilo.com/threats/encoded-payload", "severity": "high", "summary": "This rule flags commands where data is decoded (for example from base64) and then immediately fed into a shell or into Python's eval/exec. That pattern is a common way to hide the real command from logs and simple text-based monitoring.", "atlas": [ { "id": "AML.T0050", "name": "Command and Scripting Interpreter" } ], "owasp": [ { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" } ], "attack": [ "attack.stealth", "attack.t1027" ], "cves": [], "id": "a935a04a-61b2-5b55-a608-407a2048949a", "published": "2026-02-04", "modified": "2026-02-24", "markdown": "https://www.netzilo.com/threats/encoded-payload.md" }, { "slug": "env-enumeration", "title": "Environment Variable Enumeration for Secrets", "url": "https://www.netzilo.com/threats/env-enumeration", "severity": "high", "summary": "An attacker gets an AI agent to run commands that list all environment variables on the machine it's operating on. Since environment variables often hold API keys, tokens, and passwords, this hands the attacker a quick way to harvest credentials without needing further access.", "atlas": [ { "id": "AML.T0055", "name": "Unsecured Credentials" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" } ], "attack": [ "attack.credential-access", "attack.t1552.001", "attack.discovery", "attack.t1082" ], "cves": [], "id": "65ed67cc-3366-5d03-a5cf-cbd15cc5c266", "published": "2026-02-17", "modified": "2026-04-09", "markdown": "https://www.netzilo.com/threats/env-enumeration.md" }, { "slug": "env-manipulation", "title": "Environment Variable Manipulation", "url": "https://www.netzilo.com/threats/env-manipulation", "severity": "high", "summary": "This rule flags attempts to manipulate environment variables that control how programs find code to run or where secrets are stored. Attackers abuse this to make a system silently run malicious code instead of the intended program, or to expose stored credentials and tokens.", "atlas": [ { "id": "AML.T0055", "name": "Unsecured Credentials" }, { "id": "AML.T0050", "name": "Command and Scripting Interpreter" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" } ], "attack": [ "attack.persistence", "attack.t1574" ], "cves": [], "id": "94e5f1ad-d61b-5266-8bf3-5fb91c0d4970", "published": "2026-02-04", "modified": "2026-02-24", "markdown": "https://www.netzilo.com/threats/env-manipulation.md" }, { "slug": "exfil-via-dns", "title": "DNS Exfiltration and Tunnelling", "url": "https://www.netzilo.com/threats/exfil-via-dns", "severity": "high", "summary": "Attackers can smuggle data out of a network by hiding it inside DNS lookups, since DNS traffic is rarely blocked or closely watched. This rule looks for known tunnelling tools, unusual TXT-record queries, and use of DNS-over-HTTPS to sidestep normal network monitoring.", "atlas": [ { "id": "AML.T0086", "name": "Exfiltration via AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" } ], "attack": [ "attack.exfiltration", "attack.t1048", "attack.command-and-control", "attack.t1071.004" ], "cves": [], "id": "18ccf235-86e0-57ad-9cf0-83fa81cffb09", "published": "2026-03-16", "modified": "2026-08-03", "markdown": "https://www.netzilo.com/threats/exfil-via-dns.md" }, { "slug": "faiss-pickle-deserialization-rce", "title": "FAISS Pickle Deserialization RCE - Python Host Spawns Payload Process", "url": "https://www.netzilo.com/threats/faiss-pickle-deserialization-rce", "severity": "high", "summary": "LangChain applications that load FAISS vector-store files using deserialize_from_bytes or load_local can be tricked into running attacker-controlled code, because the underlying pickle format lets a crafted file execute arbitrary commands when loaded. This rule watches for the moment that hidden code actually spawns a process on the machine, which is the visible sign the attack succeeded.", "atlas": [ { "id": "AML.T0011", "name": "User Execution" }, { "id": "AML.T0050", "name": "Command and Scripting Interpreter" } ], "owasp": [ { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.execution", "attack.t1059.006" ], "cves": [], "id": "b7c41f9e-2a83-4d16-9f0c-5e8a13d47c62", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/faiss-pickle-deserialization-rce.md" }, { "slug": "fastgpt-workflow-file-read-ssrf", "title": "FastGPT Workflow File-Read Node SSRF Link", "url": "https://www.netzilo.com/threats/fastgpt-workflow-file-read-ssrf", "severity": "high", "summary": "FastGPT lets workflows include a 'file reading' node that fetches a file from a URL. Versions before 4.11.1 don't check where that URL points, so an attacker can point it at internal addresses instead of a real file, tricking the FastGPT server into making requests on the attacker's behalf.", "atlas": [], "owasp": [], "attack": [ "attack.discovery", "attack.t1190" ], "cves": [], "id": "9c4f1e6a-3b57-4d82-a1f0-7e5c8b2d4a91", "published": "2026-03-12", "modified": "2026-03-12", "markdown": "https://www.netzilo.com/threats/fastgpt-workflow-file-read-ssrf.md" }, { "slug": "fastgpt-sandbox-escape-syscalls", "title": "Sandbox Escape - Permissive Syscall Abuse in Agent Code Execution (FastGPT Sandbox)", "url": "https://www.netzilo.com/threats/fastgpt-sandbox-escape-syscalls", "severity": "high", "summary": "An attacker who can run code inside a FastGPT sandbox (versions before 4.9.11) can use that access to break out of the container and touch the underlying host. The sandbox lets scripts call dangerous low-level system functions it should have blocked.", "atlas": [], "owasp": [], "attack": [ "attack.privilege-escalation", "attack.defense-evasion", "attack.t1611", "attack.t1068", "attack.t1059.006" ], "cves": [], "id": "7b3c9d24-5f81-4a6e-9d0b-2c14e8f37a56", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/fastgpt-sandbox-escape-syscalls.md" }, { "slug": "fastmcp-oauth-callback-xss", "title": "FastMCP OAuth Callback Reflected XSS", "url": "https://www.netzilo.com/threats/fastmcp-oauth-callback-xss", "severity": "high", "summary": "FastMCP versions before 2.13.0 build the OAuth callback page by inserting URL parameters directly into HTML without escaping them. An attacker who gets a victim to open a crafted callback link can run JavaScript in the victim's session, right at the moment OAuth tokens are being exchanged.", "atlas": [], "owasp": [], "attack": [ "attack.initial-access", "attack.t1189", "attack.credential-access", "attack.t1539" ], "cves": [], "id": "7c3f9a2e-5d41-4b8a-9e02-6f1c8d4b7a35", "published": "2026-03-01", "modified": "2026-03-01", "markdown": "https://www.netzilo.com/threats/fastmcp-oauth-callback-xss.md" }, { "slug": "fictional-terminal-override", "title": "NLP Fictional Terminal Override to OS Protection Bypass", "url": "https://www.netzilo.com/threats/fictional-terminal-override", "severity": "high", "summary": "An attacker tells an AI agent that it's in a fictional or simulated terminal, sometimes even faking a root prompt, to get it to drop its usual caution. If the agent believes the fiction, it will then execute real commands that disable OS security controls or destroy data.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" }, { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" } ], "attack": [ "attack.execution", "attack.t1059", "attack.defense-evasion", "attack.t1562.001" ], "cves": [], "id": "6f2b9c14-8a3d-4e57-9b21-0c7d5ae43f18", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/fictional-terminal-override.md" }, { "slug": "file-backdoor-hidden-unicode", "title": "File Backdoor via Bidirectional Unicode and Zero-Width Characters", "url": "https://www.netzilo.com/threats/file-backdoor-hidden-unicode", "severity": "high", "summary": "An attacker hides malicious instructions inside invisible Unicode characters (bidirectional text controls or zero-width joiners) embedded in text the AI agent is told to write to a file. A human reviewing the file sees normal-looking code, but the actual bytes saved to disk and later executed contain a different, hidden payload.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0050", "name": "Command and Scripting Interpreter" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.defense-evasion", "attack.t1027", "attack.persistence" ], "cves": [ "CVE-2021-42574", "CVE-2021-42694" ], "id": "5f2c9a13-8d47-4b6e-a0c2-7e91d4f3b8aa", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/file-backdoor-hidden-unicode.md" }, { "slug": "file-transfer-path-traversal-bypass", "title": "Agent File Transfer Path Traversal and IP-Notation Bypass", "url": "https://www.netzilo.com/threats/file-transfer-path-traversal-bypass", "severity": "high", "summary": "This rule flags file upload/download requests in the browser-use agent framework whose destination address looks deliberately malformed: directory traversal sequences, unusual IP notations (like decimal, octal, or hex instead of normal dotted IPv4), or credentials embedded in the transfer URL. These are the exact input shapes that browser-use's 0.12.7 security patches were built to reject.", "atlas": [ { "id": "AML.T0025", "name": "Exfiltration via Cyber Means" } ], "owasp": [ { "id": "LLM02", "name": "Sensitive Information Disclosure" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.exfiltration", "attack.t1567", "attack.defense-evasion", "attack.t1027" ], "cves": [], "id": "7b3f1c2e-9a4d-4f61-b8e2-5c0d7a1e9f34", "published": "2026-05-20", "modified": "2026-05-20", "markdown": "https://www.netzilo.com/threats/file-transfer-path-traversal-bypass.md" }, { "slug": "fitd-multiturn-jailbreak-capitulation", "title": "FITD Multi-Turn Jailbreak Capitulation in Model Response", "url": "https://www.netzilo.com/threats/fitd-multiturn-jailbreak-capitulation", "severity": "high", "summary": "This detects the moment an AI assistant, after being gradually pressured across a conversation, openly says it is now dropping a restriction it previously enforced. It's a sign that a slow, multi-message 'foot-in-the-door' jailbreak worked and the model just gave in.", "atlas": [ { "id": "AML.T0054", "name": "LLM Jailbreak" }, { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.defense-evasion" ], "cves": [], "id": "8c4a1f63-2d97-4be5-9a0c-7e5d31b8f4a2", "published": "2025-06-12", "modified": "2025-06-12", "markdown": "https://www.netzilo.com/threats/fitd-multiturn-jailbreak-capitulation.md" }, { "slug": "flowise-custom-mcp-os-command-exec", "title": "MCP Launcher OS Command Injection (Flowise Custom MCP)", "url": "https://www.netzilo.com/threats/flowise-custom-mcp-os-command-exec", "severity": "high", "summary": "Flowise's Custom MCP feature builds a command line (usually starting with npx) to launch a local MCP server, and versions before 3.0.1 expose this feature with no login and no permission checks. Anyone who can reach the instance over the network can inject shell commands into that field, and Flowise will execute them.", "atlas": [], "owasp": [ { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1059", "attack.t1059.004", "attack.initial-access" ], "cves": [], "id": "7b3f9c42-1d58-4a6e-9f0b-2c8d54e1a733", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/flowise-custom-mcp-os-command-exec.md" }, { "slug": "fsr-playbooks-llm-authored-playbook", "title": "FSR-Playbooks LLM-Authored Playbook Compilation or Publish", "url": "https://www.netzilo.com/threats/fsr-playbooks-llm-authored-playbook", "severity": "medium", "summary": "This rule flags when someone uses an AI co-authoring tool to write or publish security automation playbooks for FortiSOAR. It's not proof of an attack \u2014 it's a review trigger, so a human checks the AI-generated automation before it runs in production.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.execution", "attack.t1059" ], "cves": [], "id": "7c3f9a41-58d2-4be6-9f0a-1d84c6b7e352", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/fsr-playbooks-llm-authored-playbook.md" }, { "slug": "generative-watermark-removal", "title": "Generative Provenance Watermark Stripping Tooling", "url": "https://www.netzilo.com/threats/generative-watermark-removal", "severity": "medium", "summary": "This detects an AI agent launching a command-line program whose purpose is to remove provenance markings from images or video - things like C2PA content credentials, IPTC digital-source metadata, or invisible AI-generation watermarks. It flags the attempt to erase evidence that a file was AI-generated or to strip proof of its origin.", "atlas": [ { "id": "AML.T0015", "name": "Evade AI Model" } ], "owasp": [ { "id": "LLM09", "name": "Misinformation" } ], "attack": [ "attack.defense-evasion", "attack.t1070", "attack.t1027" ], "cves": [], "id": "7c3f1a92-4d68-4b0e-9c21-58ef0a6d3b47", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/generative-watermark-removal.md" }, { "slug": "gha-pr-metadata-injection-rce", "title": "GitHub Actions PR Metadata Script Injection RCE", "url": "https://www.netzilo.com/threats/gha-pr-metadata-injection-rce", "severity": "high", "summary": "Many CI workflows insert pull-request data \u2014 like the PR title, description, branch name, or a comment \u2014 directly into a shell command. If that text isn't sanitized, an attacker can put shell code inside a PR field and get it executed on the runner with the workflow's permissions. This rule watches for the runner actually spawning a process built from that tainted input.", "atlas": [], "owasp": [], "attack": [ "attack.execution", "attack.t1059", "attack.t1059.004", "attack.credential_access", "attack.t1552", "attack.t1552.001", "attack.persistence", "attack.t1574.006", "attack.initial_access", "attack.t1195.002" ], "cves": [], "id": "7f2c9a41-3d5e-4b18-9c6a-0e83b7d41af2", "published": "2026-03-18", "modified": "2026-03-18", "markdown": "https://www.netzilo.com/threats/gha-pr-metadata-injection-rce.md" }, { "slug": "gitsage-local-package-execution", "title": "Supply Chain PyPI gitsage-local Install or Execution", "url": "https://www.netzilo.com/threats/gitsage-local-package-execution", "severity": "medium", "summary": "This rule watches for the PyPI package gitsage-local being installed, upgraded, or run on a monitored endpoint. gitsage-local is an AI-powered tool that writes Git commit messages by reading repository content and running with a developer's own privileges. The rule flags its presence so a security team can decide if that's expected.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial-access", "attack.t1195.002", "attack.execution", "attack.t1059.006" ], "cves": [], "id": "3f9c1d7a-5b42-4e8e-9c31-7a2d6b8f4e15", "published": "2026-03-01", "modified": "2026-03-01", "markdown": "https://www.netzilo.com/threats/gitsage-local-package-execution.md" }, { "slug": "goat-attack-harmful-behavior-exploration", "title": "GOAT Adversarial Attacker Loop In LLM Traffic", "url": "https://www.netzilo.com/threats/goat-attack-harmful-behavior-exploration", "severity": "high", "summary": "GOAT is an automated 'attacker model' that repeatedly tries different jailbreak techniques against a target LLM, tracking its own reasoning in a structured format on each turn. This rule spots the distinctive scaffolding that tool leaves behind in prompts or responses, not the harmful content it's trying to extract.", "atlas": [ { "id": "AML.T0054", "name": "LLM Jailbreak" }, { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.defense-evasion" ], "cves": [], "id": "7b3d9c41-2f6a-4e58-9d1c-0a5f8e2b7c34", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/goat-attack-harmful-behavior-exploration.md" }, { "slug": "goblin-redteam-strategy", "title": "Goblin Red-Team Strategy Execution", "url": "https://www.netzilo.com/threats/goblin-redteam-strategy", "severity": "medium", "summary": "This rule flags when someone runs the 'goblin' red-teaming strategy from the promptfoo tool against an AI agent. Goblin is an automated attack generator that sends many crafted prompts in a row to try to jailbreak or manipulate an AI system, often pulling its attack instructions from an external server.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution", "attack.t1059" ], "cves": [], "id": "3f8c1e6a-9d24-4b71-8e5f-2a7c04b19d63", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/goblin-redteam-strategy.md" }, { "slug": "goose-git-fsmonitor-command-exec", "title": "Goose CLI Git core.fsmonitor Command Execution Chain", "url": "https://www.netzilo.com/threats/goose-git-fsmonitor-command-exec", "severity": "high", "summary": "A booby-trapped git repository can set a config option that makes git run an attacker's command whenever certain git operations happen. If someone runs the AI coding tool Goose's 'review' command on that repository, they can unknowingly trigger that command execution.", "atlas": [], "owasp": [], "attack": [ "attack.execution", "attack.t1059", "attack.t1059.004", "attack.t1546" ], "cves": [], "id": "3f9c1d8a-2b47-4e6d-9c05-7ad1e8b34f62", "published": "2026-06-08", "modified": "2026-06-08", "markdown": "https://www.netzilo.com/threats/goose-git-fsmonitor-command-exec.md" }, { "slug": "grandma-roleplay-jailbreak", "title": "Jailbreak Grandma Roleplay Persona Compliance", "url": "https://www.netzilo.com/threats/grandma-roleplay-jailbreak", "severity": "high", "summary": "This detects a known jailbreak trick where a user asks an AI model to pretend to be their grandmother telling a bedtime story, then uses that fictional framing to get the model to output dangerous or restricted information it would normally refuse to give. The rule flags model responses only, since it cannot see the original prompt that triggered the persona switch.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" }, { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" } ], "attack": [ "attack.defense-evasion" ], "cves": [], "id": "7c3f0b92-4d61-4a5e-9f28-6b1d0c84e3a7", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/grandma-roleplay-jailbreak.md" }, { "slug": "hacktool-detection", "title": "Offensive Security Tool Reference in Agent Content", "url": "https://www.netzilo.com/threats/hacktool-detection", "severity": "high", "summary": "This rule flags when an AI agent's actions - the commands it runs, tool calls it makes, or files it writes - mention well-known offensive security tools like exploit frameworks, network scanners, password crackers, or phishing kits. It's a sign the agent has been directed (or manipulated) into performing hacking activity rather than its intended task.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" }, { "id": "AML.T0050", "name": "Command and Scripting Interpreter" }, { "id": "AML.T0090", "name": "OS Credential Dumping" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" } ], "attack": [ "attack.execution", "attack.t1059", "attack.privilege-escalation", "attack.credential-access" ], "cves": [], "id": "a0d1e2f3-a4b5-4c67-8901-d2e3f4a5b6c7", "published": "2026-06-03", "modified": "2026-06-03", "markdown": "https://www.netzilo.com/threats/hacktool-detection.md" }, { "slug": "hallucinated-package-install", "title": "Hallucinated Package Install In Agent Session", "url": "https://www.netzilo.com/threats/hallucinated-package-install", "severity": "medium", "summary": "An AI coding assistant suggests a specific package name in its response, and the agent session then tries to install exactly that name \u2014 but the package is not in the public registry. This is the classic 'AI hallucinated a dependency' scenario, which attackers can exploit by pre-registering the fake name (slopsquatting).", "atlas": [], "owasp": [ { "id": "LLM09", "name": "Misinformation" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.initial-access", "attack.t1195.001" ], "cves": [], "id": "4f3b9c21-8d6e-4a05-9b17-2c7e5d0a6f84", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/hallucinated-package-install.md" }, { "slug": "hasdata-airbnb-mcp-credential-relay", "title": "HasData Airbnb MCP Credential Relay", "url": "https://www.netzilo.com/threats/hasdata-airbnb-mcp-credential-relay", "severity": "medium", "summary": "This detects a tampered or malicious version of the hasdata-airbnb-mcp package (an MCP server that lets AI agents query Airbnb listings via HasData) sneaking unrelated sensitive data out alongside a normal-looking scrape request. Ordinary use of this package is not flagged \u2014 only requests that also carry things like cloud credentials, SSH keys, or attacker-controlled callback URLs.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration", "attack.t1567", "attack.credential-access", "attack.t1552.001", "attack.initial-access", "attack.t1195.002" ], "cves": [], "id": "7b3c9e42-5a1d-4f86-9c07-2ea41d8b6f53", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/hasdata-airbnb-mcp-credential-relay.md" }, { "slug": "haystack-jinja2-ssti-rce", "title": "SSTI Jinja2 Template Injection RCE (Haystack Pipeline)", "url": "https://www.netzilo.com/threats/haystack-jinja2-ssti-rce", "severity": "high", "summary": "This detects command-line evidence that someone exploited a server-side template injection flaw in deepset Haystack (versions before 2.3.1) to run arbitrary code. It looks for the tell-tale combination of Jinja2 template syntax and Python's sandbox-escape trick showing up together in a spawned process.", "atlas": [], "owasp": [], "attack": [ "attack.execution", "attack.t1059.006", "attack.t1190" ], "cves": [], "id": "7c3f9a2e-5b41-4d6c-9e08-2a1f6b84c37d", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/haystack-jinja2-ssti-rce.md" }, { "slug": "hermoso-npm-mcp-package-fetch", "title": "Supply Chain \u2014 hermoso npm MCP Package Fetch", "url": "https://www.netzilo.com/threats/hermoso-npm-mcp-package-fetch", "severity": "medium", "summary": "This rule flags when someone downloads the npm package 'hermoso,' which installs roughly 681 tools into an AI agent's available toolset at once. There's no known malware or vulnerability in this package \u2014 the concern is that a huge, unvetted tool surface gives a compromised or manipulated model many more ways to be misused.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial-access", "attack.t1195.001" ], "cves": [], "id": "3f0c9a41-6d2e-4b7a-9c58-1e84b2df70a5", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/hermoso-npm-mcp-package-fetch.md" }, { "slug": "heylead-linkedin-sdr-burst", "title": "Heylead Autonomous LinkedIn SDR Outreach Burst", "url": "https://www.netzilo.com/threats/heylead-linkedin-sdr-burst", "severity": "medium", "summary": "This detects an AI agent (or a LinkedIn automation tool like heylead) sending a burst of connection requests, invitations, or messages on LinkedIn far faster than a human could type or personalize them. It flags the pattern of behavior, not the mere presence of the automation tool.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.collection", "attack.t1119" ], "cves": [], "id": "7b3d9c14-2f6a-4d58-9c21-8ae5f0b47d63", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/heylead-linkedin-sdr-burst.md" }, { "slug": "heylead-linkedin-sdr-mass-outreach", "title": "MCP Agent Abuse - heylead Autonomous LinkedIn Outreach At Scale", "url": "https://www.netzilo.com/threats/heylead-linkedin-sdr-mass-outreach", "severity": "medium", "summary": "This detects when the heylead LinkedIn outreach agent sends a burst of messages or connection invitations in a short time window. It's a visibility rule for auditing autonomous agent activity, not proof of a compromise or credential theft.", "atlas": [ { "id": "AML.T0048", "name": "External Harms" } ], "owasp": [ { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.initial-access", "attack.t1566.003" ], "cves": [], "id": "7b3f1c02-9d64-4a17-b0e5-2c8f4d61ae93", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/heylead-linkedin-sdr-mass-outreach.md" }, { "slug": "hidden-unicode-tag-injection", "title": "Hidden Unicode Tag Instruction Smuggling Into Agent Context", "url": "https://www.netzilo.com/threats/hidden-unicode-tag-injection", "severity": "high", "summary": "Unicode has a block of 'tag' characters that render as nothing visible in editors or terminals, but AI models still read and can act on them. An attacker hides instructions in these invisible characters inside a file, tool output, or web content, and when the AI agent reads that content and passes it to its language model, the model follows the hidden instructions.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.defense-evasion", "attack.t1027", "attack.t1204" ], "cves": [], "id": "7c4d1f96-2a8b-4e35-9d0c-5b6a1f3e8c47", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/hidden-unicode-tag-injection.md" }, { "slug": "hitl-cdp-bridge-exposure", "title": "HITL CDP Browser Bridge Exposure", "url": "https://www.netzilo.com/threats/hitl-cdp-bridge-exposure", "severity": "high", "summary": "Some tools let a human take over an AI agent's browser session for review, using Chrome's remote debugging protocol (CDP). When that debugging port is exposed on a network interface instead of kept to the local machine, anyone who can reach it over the network can potentially attach to and control the browser. This detection flags that exposure and signs of it being used, not the takeover itself.", "atlas": [], "owasp": [], "attack": [ "attack.collection", "attack.t1185", "attack.discovery", "attack.t1046" ], "cves": [], "id": "3f7c1e94-2a58-4b6d-9c81-5e0d7a44b312", "published": "2026-03-14", "modified": "2026-03-14", "markdown": "https://www.netzilo.com/threats/hitl-cdp-bridge-exposure.md" }, { "slug": "holdpoint-supply-chain-session-egress", "title": "Supply Chain \u2014 holdpoint Acquisition Then Session Egress", "url": "https://www.netzilo.com/threats/holdpoint-supply-chain-session-egress", "severity": "medium", "summary": "This detects a specific two-step pattern involving the PyPI package 'holdpoint', which sits in the path an AI agent uses to get actions approved. It does not flag simply having the package installed \u2014 it flags getting it from an unusual source, or seeing a fresh install followed shortly by outbound network activity, which together look like tampering rather than normal use.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial-access", "attack.t1195.002", "attack.execution", "attack.t1059.006" ], "cves": [], "id": "5f3c9e21-4b7a-4d18-9c6e-2a71d0b4e8f3", "published": "2026-03-01", "modified": "2026-03-01", "markdown": "https://www.netzilo.com/threats/holdpoint-supply-chain-session-egress.md" }, { "slug": "hydra-instantiate-target-rce", "title": "Hydra instantiate() Target Hijack to Process Execution", "url": "https://www.netzilo.com/threats/hydra-instantiate-target-rce", "severity": "high", "summary": "Hydra, a Python configuration framework, lets a config value called '_target_' name a function or class to instantiate. If an attacker can influence that config - through a CLI override, a local YAML file, or a downloaded artifact - they can point it at os.system or a similar call and get code execution when the job runs.", "atlas": [], "owasp": [], "attack": [ "attack.execution", "attack.t1059", "attack.t1059.004", "attack.t1059.006" ], "cves": [], "id": "3f9c7b41-0a2e-4d16-9b8c-7e5a1c26d4f0", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/hydra-instantiate-target-rce.md" }, { "slug": "indirect-prompt-injection-obfuscated-http", "title": "Indirect Prompt Injection via Obfuscated Instruction Smuggling", "url": "https://www.netzilo.com/threats/indirect-prompt-injection-obfuscated-http", "severity": "high", "summary": "Attackers hide commands for an AI agent inside web pages or documents using invisible or machine-only text tricks, so a human skimming the page sees nothing wrong. When the agent fetches and forwards that content, it can end up following the hidden instructions instead of the visible ones.", "atlas": [], "owasp": [], "attack": [ "attack.defense-evasion", "attack.t1027", "attack.initial-access" ], "cves": [], "id": "7f3d1c2e-9a64-4b1f-8c0d-5e7a2b6f4d91", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/indirect-prompt-injection-obfuscated-http.md" }, { "slug": "inter-agent-spoofing", "title": "Inter-Agent Message Spoofing and Peer Impersonation", "url": "https://www.netzilo.com/threats/inter-agent-spoofing", "severity": "high", "summary": "A compromised or misbehaving AI agent can send messages to Slack, Teams, Discord, or email that falsely claim to come from another trusted agent or a central control system. Because agent-to-agent communication in most deployments has no cryptographic identity check, anyone who can get an agent to post can forge instructions, approvals, or handoffs that downstream systems or humans will trust.", "atlas": [ { "id": "AML.T0074", "name": "Masquerading" }, { "id": "AML.T0073", "name": "Impersonation" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" } ], "attack": [ "attack.stealth", "attack.t1656", "attack.lateral-movement" ], "cves": [], "id": "83e72875-7c6f-52cc-949c-505cbbb7649f", "published": "2026-03-16", "modified": "2026-08-03", "markdown": "https://www.netzilo.com/threats/inter-agent-spoofing.md" }, { "slug": "invisible-unicode-instruction-to-capability", "title": "Invisible Unicode Instruction Carrier Followed By Capability Use", "url": "https://www.netzilo.com/threats/invisible-unicode-instruction-to-capability", "severity": "high", "summary": "Text that looks blank to a human can carry invisible instructions using special Unicode characters. If an AI assistant reads that hidden text and then goes on to use a tool, run a command, or contact a server, it may be following orders a person never saw.", "atlas": [ { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.defense-evasion", "attack.t1027", "attack.execution", "attack.t1059" ], "cves": [], "id": "4f1c9d2e-7b83-4a56-9e0d-3c6a17f2b8d1", "published": "2026-03-14", "modified": "2026-03-14", "markdown": "https://www.netzilo.com/threats/invisible-unicode-instruction-to-capability.md" }, { "slug": "jfrog-boost-npm-supply-chain", "title": "Supply Chain - @jfrog-boost/boost Package Install or Binary Execution", "url": "https://www.netzilo.com/threats/jfrog-boost-npm-supply-chain", "severity": "medium", "summary": "This rule watches for the exact npm package name @jfrog-boost/boost showing up in commands run by an AI agent or CI job. That package ships prebuilt native binaries that compress tool output, so if it were ever compromised or typosquatted, code from it could run with the same privileges as the agent or pipeline that installed it.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial-access", "attack.t1195.002" ], "cves": [], "id": "6f3b1c4e-9a27-4d5b-8e10-2c7f4a91d0b3", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/jfrog-boost-npm-supply-chain.md" }, { "slug": "kairos-core-mcp-child-exec", "title": "MCP Supply Chain - kairos-core-mcp Descendant Executes High-Risk Child Process", "url": "https://www.netzilo.com/threats/kairos-core-mcp-child-exec", "severity": "medium", "summary": "This rule watches for the kairos-core-mcp PyPI package, which runs as an MCP server inside Kairos agent environments, spawning processes that look like network exfiltration, reverse shells, code execution, or persistence mechanisms. It does not detect whether the package itself is compromised or how it was installed \u2014 only what its process spawns after it is already running.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial-access", "attack.t1195.001", "attack.execution", "attack.t1059" ], "cves": [], "id": "6f3a1c92-8e47-4b0d-9c15-2a7de4f0b833", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/kairos-core-mcp-child-exec.md" }, { "slug": "khoj-automation-stored-xss", "title": "Khoj Automation Stored XSS Payload Submission", "url": "https://www.netzilo.com/threats/khoj-automation-stored-xss", "severity": "medium", "summary": "This rule flags attempts to plant executable script code inside the task-instruction field of Khoj's automation feature, a known unpatched sink before version 1.15.0. It catches the moment the malicious markup is written, not whether it later executes in a victim's browser.", "atlas": [], "owasp": [ { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.execution", "attack.t1059.007" ], "cves": [], "id": "3f1c8a7e-6b24-4d9a-9c05-2e7d41b8af63", "published": "2026-06-14", "modified": "2026-06-14", "markdown": "https://www.netzilo.com/threats/khoj-automation-stored-xss.md" }, { "slug": "kiro-prompt-injection-command-execution", "title": "Agent Command Execution - Indirect Prompt Injection Payload (AWS Kiro)", "url": "https://www.netzilo.com/threats/kiro-prompt-injection-command-execution", "severity": "high", "summary": "AI coding assistants like AWS Kiro can read external content (files, web pages, tool output) while working on a task. If that content contains hidden instructions, the agent can be manipulated into executing malicious commands on the developer's machine. This detection catches the moment the agent actually runs such a command, not the hidden instruction itself.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution", "attack.t1059", "attack.t1105", "attack.t1027" ], "cves": [], "id": "4f2c8b7e-1d3a-4a96-9c05-7be6f1a2d834", "published": "2026-03-11", "modified": "2026-03-11", "markdown": "https://www.netzilo.com/threats/kiro-prompt-injection-command-execution.md" }, { "slug": "langchain-jira-command-injection", "title": "LangChain JiraAPIWrapper OS Command Injection", "url": "https://www.netzilo.com/threats/langchain-jira-command-injection", "severity": "high", "summary": "A vulnerability in LangChain's JiraAPIWrapper component (fixed in v0.0.225) fails to sanitize input before passing it to Python's exec() or os.system(), letting an attacker turn a JIRA API call into arbitrary code execution on the host running the LangChain agent. This detection flags the specific pattern of a JIRA REST call followed by a suspicious interpreter spawn from the same process.", "atlas": [], "owasp": [ { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.execution", "attack.t1059", "attack.t1059.004", "attack.t1059.006" ], "cves": [], "id": "7b3f1c84-9a2e-4d6b-8f0a-3c5e91d47b2a", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/langchain-jira-command-injection.md" }, { "slug": "langchain-load-chain-path-traversal", "title": "LangChain load_chain Path Traversal Exploitation", "url": "https://www.netzilo.com/threats/langchain-load-chain-path-traversal", "severity": "high", "summary": "LangChain's load_chain() function is supposed to only pull chain, prompt, and agent configurations from a trusted GitHub repository. A flaw in versions 0.1.10 and earlier lets an attacker sneak a '../' sequence (or its URL-encoded variants) into the path, escaping that trusted location and fetching whatever file or config they want instead.", "atlas": [], "owasp": [], "attack": [ "attack.credential-access", "attack.t1552.001", "attack.discovery", "attack.t1083" ], "cves": [ "CVE-2024-28088" ], "id": "b7c41d2e-5a83-4f16-9c2d-8e17a6f04b39", "published": "2026-03-05", "modified": "2026-03-05", "markdown": "https://www.netzilo.com/threats/langchain-load-chain-path-traversal.md" }, { "slug": "langchain-load-prompt-rce", "title": "LangChain load_prompt Deserialization Code Execution", "url": "https://www.netzilo.com/threats/langchain-load-prompt-rce", "severity": "high", "summary": "This detects a two-step pattern tied to an old LangChain vulnerability (CVE-2023-36281): a Python process reads a prompt, chain, or agent configuration file, and shortly after, that same process launches a shell command, network tool, or Python one-liner. That sequence is what code execution via a poisoned prompt/chain file looks like from the outside.", "atlas": [], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.execution", "attack.t1059", "attack.t1059.006" ], "cves": [ "CVE-2023-36281" ], "id": "7f3c1a2e-9b4d-4f61-8c2a-5d0e6b7a1c93", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/langchain-load-prompt-rce.md" }, { "slug": "langchain-localfilestore-path-traversal", "title": "LangChain LocalFileStore Path Traversal Invocation", "url": "https://www.netzilo.com/threats/langchain-localfilestore-path-traversal", "severity": "high", "summary": "LangChain's LocalFileStore, a simple file-based cache used by AI agents, does not clean up the file paths it builds from caller-supplied keys. An attacker who can influence a key value can use '../' sequences to escape the intended storage folder and read or write files anywhere the agent process has permission to touch.", "atlas": [], "owasp": [], "attack": [ "attack.collection", "attack.t1005", "attack.execution", "attack.t1059.006" ], "cves": [], "id": "6f1a7c92-3d84-4e05-9b7c-2a5f0c1d84e3", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/langchain-localfilestore-path-traversal.md" }, { "slug": "langchain-numexpr-eval-rce", "title": "LangChain numexpr Evaluate Code Execution", "url": "https://www.netzilo.com/threats/langchain-numexpr-eval-rce", "severity": "high", "summary": "LangChain versions before 0.0.308 let attackers run arbitrary Python code through the numexpr math library's evaluate() function, which is used by LangChain's math-solving chain. This rule catches the exploit only when it causes a new process to be spawned with a recognizable malicious code pattern on its command line.", "atlas": [], "owasp": [ { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.execution", "attack.t1059.006" ], "cves": [ "CVE-2023-39631" ], "id": "9c4b71e2-5a3d-4f28-b6e1-7d0a2c8f4531", "published": "2026-03-14", "modified": "2026-03-14", "markdown": "https://www.netzilo.com/threats/langchain-numexpr-eval-rce.md" }, { "slug": "langchain-numexpr-rce-exec", "title": "LangChain numexpr Evaluate RCE - Interpreter Shell Escape", "url": "https://www.netzilo.com/threats/langchain-numexpr-rce-exec", "severity": "high", "summary": "LangChain's math tools (LLMMathChain, PALChain) can be tricked into passing attacker-controlled text into numexpr's evaluate() function, which can run arbitrary code. This rule catches the moment that code actually spawns an OS command with signs of a real attack, not just the underlying bug.", "atlas": [], "owasp": [], "attack": [ "attack.execution", "attack.t1059", "attack.t1059.004", "attack.t1059.006", "attack.t1203" ], "cves": [ "CVE-2023-36258" ], "id": "6f2b9c14-8d3a-4a17-9f5e-2c7b41ad0e93", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/langchain-numexpr-rce-exec.md" }, { "slug": "langchain-pal-code-execution", "title": "LangChain PAL Chain Arbitrary Code Execution", "url": "https://www.netzilo.com/threats/langchain-pal-code-execution", "severity": "high", "summary": "Older versions of LangChain's PALChain feature turn user-supplied text into Python code and run it without any safety sandbox. An attacker who can influence the question sent to the chain can smuggle in commands that execute on the server running the agent.", "atlas": [ { "id": "AML.T0050", "name": "Command and Scripting Interpreter" }, { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.execution", "attack.t1059", "attack.t1059.006" ], "cves": [ "CVE-2023-36095", "CVE-2023-36258" ], "id": "7c1f4a92-3d6b-4e8a-9b5c-0af2d7e61b34", "published": "2026-03-12", "modified": "2026-03-12", "markdown": "https://www.netzilo.com/threats/langchain-pal-code-execution.md" }, { "slug": "langchain-pal-math-prompt-rce", "title": "LangChain PAL Math Prompt RCE Payload", "url": "https://www.netzilo.com/threats/langchain-pal-math-prompt-rce", "severity": "high", "summary": "LangChain versions up to 0.0.194 let an attacker turn a math or 'colored object' question into arbitrary Python code execution. The vulnerable PAL chains hand LLM-generated Python straight to eval() or exec() without checking it, so a crafted prompt can run OS commands or steal credentials.", "atlas": [ { "id": "AML.T0050", "name": "Command and Scripting Interpreter" } ], "owasp": [ { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.execution", "attack.t1059.006", "attack.t1203" ], "cves": [ "CVE-2023-29374" ], "id": "7c1f3a2e-9b64-4d1a-8f57-2c0b6ad91e34", "published": "2025-06-12", "modified": "2025-06-12", "markdown": "https://www.netzilo.com/threats/langchain-pal-math-prompt-rce.md" }, { "slug": "langchain-palchain-code-exec", "title": "PALChain Arbitrary Code Execution (LangChain)", "url": "https://www.netzilo.com/threats/langchain-palchain-code-exec", "severity": "high", "summary": "Older versions of LangChain's PALChain feature take text generated by an AI model and run it directly with Python's exec(). If an attacker can influence what the model outputs, they can get arbitrary code to run on the machine hosting the agent.", "atlas": [], "owasp": [ { "id": "LLM05", "name": "Improper Output Handling" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1059.006" ], "cves": [ "CVE-2023-36258" ], "id": "b7e4c1f2-9a3d-4e58-8c61-3f0a2d5b7e94", "published": "2026-06-01", "modified": "2026-06-01", "markdown": "https://www.netzilo.com/threats/langchain-palchain-code-exec.md" }, { "slug": "langchain-palchain-exec-rce", "title": "LangChain PALChain Python Exec RCE (CVE-2023-36258)", "url": "https://www.netzilo.com/threats/langchain-palchain-exec-rce", "severity": "high", "summary": "LangChain versions up to 0.0.64 include a feature called PALChain that generates Python code from a prompt and then runs it directly with no safety checks. An attacker who controls or influences the prompt can make PALChain generate code that calls out to the operating system, giving them command execution on the host running the application.", "atlas": [], "owasp": [], "attack": [ "attack.execution", "attack.t1059", "attack.t1059.006", "attack.t1203" ], "cves": [ "CVE-2023-36258", "CVE-2023-39631", "CVE-2023-44467" ], "id": "7c3f9a2e-5b41-4d68-9e0a-2f6b8c1d34a5", "published": "2025-06-12", "modified": "2025-06-12", "markdown": "https://www.netzilo.com/threats/langchain-palchain-exec-rce.md" }, { "slug": "langchain-palchain-exec-sink", "title": "LangChain PALChain exec() Sink Reached OS", "url": "https://www.netzilo.com/threats/langchain-palchain-exec-sink", "severity": "high", "summary": "Some LangChain applications ask an AI model to write a small program and then run that program directly with Python's exec(). If an attacker can influence the text the model sees, they can get the model to produce malicious code that the application then executes as if it were trusted. This detection watches for that exact pattern happening on the same process.", "atlas": [], "owasp": [ { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.execution", "attack.t1059", "attack.t1059.006" ], "cves": [ "CVE-2023-36258", "CVE-2023-44467" ], "id": "6f3b1d0e-2a47-4c9e-9d1b-8e5f7a4c2b91", "published": "2026-03-05", "modified": "2026-03-05", "markdown": "https://www.netzilo.com/threats/langchain-palchain-exec-sink.md" }, { "slug": "langchain-path-traversal-glob-escape", "title": "LangChain Sandbox Escape Path or Glob Argument", "url": "https://www.netzilo.com/threats/langchain-path-traversal-glob-escape", "severity": "medium", "summary": "This rule flags file paths, directory names, or glob patterns given to an AI agent's file-search or document-loading tool that look designed to escape the folder the tool is supposed to be confined to. It catches the request before it runs, not proof that the escape actually succeeded.", "atlas": [], "owasp": [ { "id": "LLM02", "name": "Sensitive Information Disclosure" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.discovery", "attack.t1083", "attack.collection", "attack.t1005", "attack.credential-access", "attack.t1552.001" ], "cves": [], "id": "7b3f1c2e-9d64-4a51-bf08-2c6d5a41e9c7", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/langchain-path-traversal-glob-escape.md" }, { "slug": "langchain-prompt-injection-ssrf", "title": "LangChain Prompt Injection Driving Server-Side Request Forgery", "url": "https://www.netzilo.com/threats/langchain-prompt-injection-ssrf", "severity": "high", "summary": "An attacker hides instructions inside content that a LangChain-based AI agent reads, telling it to ignore its original task and fetch a URL of the attacker's choosing. If the agent complies, it makes an outbound HTTP request on the attacker's behalf, which can be used to reach internal systems or cloud metadata services the attacker could not otherwise access.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access", "attack.t1190", "attack.credential-access", "attack.t1552.005" ], "cves": [], "id": "7c3d1f28-9a4b-4e57-b1d6-2f8ac05e3b91", "published": "2026-03-05", "modified": "2026-03-05", "markdown": "https://www.netzilo.com/threats/langchain-prompt-injection-ssrf.md" }, { "slug": "langchain-prompt-loader-path-traversal", "title": "LangChain Prompt Loader Arbitrary File Read (Instance-Resolved)", "url": "https://www.netzilo.com/threats/langchain-prompt-loader-path-traversal", "severity": "medium", "summary": "LangChain's prompt-loading helpers can be tricked into opening files far outside the folder a prompt configuration lives in. This rule spots the file-access pattern that traversal produces \re,,, the moment a process reads a prompt/template file and then, seconds later, reads a second file elsewhere with an extension the loader still accepts.", "atlas": [], "owasp": [], "attack": [ "attack.credential-access", "attack.t1552.001" ], "cves": [], "id": "7c1f3a5e-9b62-4d18-a0e7-5f3c8d2b4a91", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/langchain-prompt-loader-path-traversal.md" }, { "slug": "langchain-prompt-template-file-read", "title": "LangChain Prompt Template Arbitrary File Read", "url": "https://www.netzilo.com/threats/langchain-prompt-template-file-read", "severity": "high", "summary": "LangChain's multimodal prompt templates can load an image file from a path and embed it in the prompt sent to a model. If an attacker controls the input value used for that path, they can point it at sensitive files instead of an image, and the file contents get read off the server and surfaced through the model's output.", "atlas": [], "owasp": [], "attack": [ "attack.collection", "attack.t1005", "attack.credential-access", "attack.t1552.001" ], "cves": [], "id": "b7f3c1d2-8a4e-4f6b-9c2d-5e17a3d90f42", "published": "2026-01-14", "modified": "2026-01-14", "markdown": "https://www.netzilo.com/threats/langchain-prompt-template-file-read.md" }, { "slug": "langchain-recursive-url-loader-ssrf", "title": "LangChain Recursive URL Loader SSRF to Internal Target", "url": "https://www.netzilo.com/threats/langchain-recursive-url-loader-ssrf", "severity": "high", "summary": "An AI agent that fetches web pages on your behalf can be handed a crafted URL that redirects it to internal network addresses or cloud credential endpoints instead of the public page it expects. This is a known flaw in older LangChain recursive URL loader versions and lets an outsider use your agent as a proxy into your own infrastructure.", "atlas": [], "owasp": [], "attack": [ "attack.initial_access", "attack.t1190", "attack.credential_access", "attack.t1552.005" ], "cves": [ "CVE-2023-46229" ], "id": "7f3c1d92-6a4e-4b18-9c05-2e8d5a4f1b63", "published": "2026-03-01", "modified": "2026-03-01", "markdown": "https://www.netzilo.com/threats/langchain-recursive-url-loader-ssrf.md" }, { "slug": "langflow-code-injection", "title": "Langflow Unauthenticated Code Injection Exploit Attempt", "url": "https://www.netzilo.com/threats/langflow-code-injection", "severity": "high", "summary": "Langflow, an open-source tool for building AI workflows, has an endpoint that compiles and executes submitted Python code without requiring login. Attackers exploit this to run their own code on the server by hiding it inside Python constructs that execute at definition time, like decorators or default arguments.", "atlas": [ { "id": "AML.T0044", "name": "Full AI Model Access" } ], "owasp": [ { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.initial-access", "attack.t1190", "attack.execution", "attack.t1059.006" ], "cves": [ "CVE-2025-3248" ], "id": "f3b2a1c7-8d4e-4a6b-9c25-7e1d0f4a9b83", "published": "2025-11-18", "modified": "2025-11-18", "markdown": "https://www.netzilo.com/threats/langflow-code-injection.md" }, { "slug": "langflow-cors-samesite-token-theft", "title": "Langflow CORS Origin Bypass and SameSite=None Refresh Token Theft", "url": "https://www.netzilo.com/threats/langflow-cors-samesite-token-theft", "severity": "medium", "summary": "Langflow, an AI workflow builder, had a bug where its authentication cookies could be marked to work across different websites (SameSite=None) while also allowing overly permissive cross-origin requests. Combined, this lets a malicious website silently steal a logged-in user's refresh token and reuse it to hijack their Langflow session. This rule looks for text patterns showing the pieces of that attack in network traffic.", "atlas": [], "owasp": [ { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.credential-access", "attack.t1539", "attack.t1550.004" ], "cves": [ "CVE-2025-34291" ], "id": "b7f3c2d1-4e8a-4c19-9f6b-2d5a8e0c7413", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/langflow-cors-samesite-token-theft.md" }, { "slug": "langflow-superuser-cli-escalation", "title": "Langflow Privilege Escalation via Superuser CLI Invocation", "url": "https://www.netzilo.com/threats/langflow-superuser-cli-escalation", "severity": "high", "summary": "Langflow is an AI workflow builder with a normal sign-up page that only ever creates regular, non-admin users. It also ships a hidden command-line option, 'langflow superuser', that writes a full administrator account straight into the database, skipping that restriction entirely.", "atlas": [], "owasp": [], "attack": [ "attack.privilege_escalation", "attack.persistence", "attack.t1136.001", "attack.t1078.003" ], "cves": [], "id": "3f2b8c1e-7d4a-4e6b-9c05-8a1d2f6b4e93", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/langflow-superuser-cli-escalation.md" }, { "slug": "langflow-untrusted-functionality-rce", "title": "Langflow Untrusted Functionality Inclusion RCE Payload Execution", "url": "https://www.netzilo.com/threats/langflow-untrusted-functionality-rce", "severity": "high", "summary": "Langflow, an AI workflow builder, can be made to evaluate code supplied by a remote attacker without any login. When exploited, the Langflow backend process spawns a child process to run that code, which is the moment this detection catches.", "atlas": [ { "id": "AML.T0049", "name": "Exploit Public-Facing Application" }, { "id": "AML.T0050", "name": "Command and Scripting Interpreter" } ], "owasp": [ { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.initial_access", "attack.t1190", "attack.execution", "attack.t1059" ], "cves": [], "id": "7c3f5a1e-9b42-4d7a-8f16-2b5d0e9a4c31", "published": "2026-03-14", "modified": "2026-03-14", "markdown": "https://www.netzilo.com/threats/langflow-untrusted-functionality-rce.md" }, { "slug": "langsmith-hub-untrusted-prompt-pull", "title": "LangSmith Hub Third-Party Prompt Manifest Pull With Model Deserialization", "url": "https://www.netzilo.com/threats/langsmith-hub-untrusted-prompt-pull", "severity": "medium", "summary": "LangChain/LangSmith Hub lets you fetch a saved prompt by owner and name. If the fetch also asks for the 'model' part of that prompt, the response can include settings that build an LLM client inside your app \u2014 pointing it at whatever server and API key the prompt author chose. Pulling this from anyone outside your own organization hands them a way to redirect or spy on your app's traffic.", "atlas": [], "owasp": [], "attack": [ "attack.initial-access", "attack.t1195.001", "attack.credential-access", "attack.t1552" ], "cves": [], "id": "5b8c2e14-9a37-4d61-b0f2-6e8a13c47d95", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/langsmith-hub-untrusted-prompt-pull.md" }, { "slug": "lark-apaas-miaoda-sandbox-skills-pkg", "title": "Supply Chain Lark Apaas Miaoda Sandbox Skills Package Deployment", "url": "https://www.netzilo.com/threats/lark-apaas-miaoda-sandbox-skills-pkg", "severity": "medium", "summary": "This rule watches for a particular npm package, @lark-apaas/coding-miaoda-sandbox-skills, being installed, updated, or unpacked into an AI agent's sandbox. If an attacker publishes a poisoned version of that package to npm, the sandbox's normal skill-sync process would pull it in and run it inside the agent's own execution context.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial-access", "attack.t1195.002", "attack.t1059" ], "cves": [], "id": "4b7c9e21-3a5f-4d18-9c6e-2f8a1d4b7e30", "published": "2026-03-14", "modified": "2026-03-14", "markdown": "https://www.netzilo.com/threats/lark-apaas-miaoda-sandbox-skills-pkg.md" }, { "slug": "lateral-movement", "title": "Agent Lateral Movement and Pivoting", "url": "https://www.netzilo.com/threats/lateral-movement", "severity": "medium", "summary": "This rule flags an AI agent that goes beyond the host it was given and reaches into another system \u2014 by running remote commands, reusing credentials, or launching a process that immediately connects outward. It only fires when two separate steps happen close together, not on a single remote command.", "atlas": [ { "id": "AML.TA0015", "name": "Lateral Movement" }, { "id": "AML.T0091", "name": "Use Alternate Authentication Material" }, { "id": "AML.T0055", "name": "Unsecured Credentials" }, { "id": "AML.T0089", "name": "Process Discovery" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.lateral-movement", "attack.t1021", "attack.credential-access", "attack.t1078" ], "cves": [], "id": "a76493f4-047c-5eab-994f-df740faa5180", "published": "2026-03-16", "modified": "2026-08-03", "markdown": "https://www.netzilo.com/threats/lateral-movement.md" }, { "slug": "lateral-movement-enumeration", "title": "Filesystem and Cloud Enumeration Preceding Lateral Movement", "url": "https://www.netzilo.com/threats/lateral-movement-enumeration", "severity": "high", "summary": "This rule flags an AI agent performing large-scale discovery \u2014 walking entire directory trees or listing whole cloud storage buckets \u2014 rather than looking at a few files. That kind of broad enumeration is typically the reconnaissance step before an attacker decides what data to steal or where to move next.", "atlas": [ { "id": "AML.T0037", "name": "Data from Local System" }, { "id": "AML.T0075", "name": "Cloud Service Discovery" }, { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" } ], "attack": [ "attack.discovery", "attack.t1083" ], "cves": [], "id": "8e4f5d74-7aa5-5b67-a647-aad470bf4030", "published": "2026-03-23", "modified": "2026-08-03", "markdown": "https://www.netzilo.com/threats/lateral-movement-enumeration.md" }, { "slug": "letta-imagecontent-file-url-lfi", "title": "Letta ImageContent file:// Local File Read Bypass", "url": "https://www.netzilo.com/threats/letta-imagecontent-file-url-lfi", "severity": "high", "summary": "Older versions of the Letta agent server accepted 'file://' links inside image attachments without checking the scheme. An attacker could send a request with an image field pointing at a local file like /etc/passwd, and the server's image parser would read and return that file's contents.", "atlas": [], "owasp": [ { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.initial-access", "attack.t1190", "attack.collection", "attack.t1005" ], "cves": [], "id": "6f2d1c94-83ab-4d1e-9b0c-2a7f5e41d8c3", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/letta-imagecontent-file-url-lfi.md" }, { "slug": "letta-pickle-sandbox-transport", "title": "Unsafe Pickle Serialization in Sandbox Tool Result Transport", "url": "https://www.netzilo.com/threats/letta-pickle-sandbox-transport", "severity": "high", "summary": "Older versions of the Letta agent framework sent tool results between the sandbox and server using Python's pickle format instead of JSON. Because pickle can execute arbitrary code when loaded, an attacker who can influence a tool result can smuggle in a malicious payload that runs as soon as the server deserializes it.", "atlas": [ { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.execution", "attack.t1059.006" ], "cves": [], "id": "b7f3c1d2-9a4e-4f61-8c25-3d0e6a7b1f48", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/letta-pickle-sandbox-transport.md" }, { "slug": "linkedin-sdr-outreach-fanout", "title": "LinkedIn SDR Agent Automated Outreach Fan-Out", "url": "https://www.netzilo.com/threats/linkedin-sdr-outreach-fanout", "severity": "medium", "summary": "This rule flags when an automated LinkedIn 'SDR' agent (a tool that finds prospects and sends connection requests or messages on your behalf) builds a list of targets and then blasts out a large batch of invites or messages in a short time, all from one automated process rather than a person using the browser. It doesn't judge whether the messages are legitimate or malicious \u2014 it just flags the unattended, high-volume pattern.", "atlas": [], "owasp": [], "attack": [ "attack.initial-access", "attack.t1566.003", "attack.resource-development", "attack.t1585.001", "attack.collection" ], "cves": [], "id": "7b3c1e42-9d0a-4f6b-8c25-1ae5f70d3b98", "published": "2026-03-05", "modified": "2026-03-05", "markdown": "https://www.netzilo.com/threats/linkedin-sdr-outreach-fanout.md" }, { "slug": "llamaindex-cli-files-command-injection", "title": "LLama-Index CLI --files OS Command Injection", "url": "https://www.netzilo.com/threats/llamaindex-cli-files-command-injection", "severity": "high", "summary": "The LLama-Index command-line tool (v0.12.20) passes the value given to its --files option straight into a system shell call without sanitizing it. An attacker who controls that value can smuggle shell metacharacters in and run arbitrary commands on the host.", "atlas": [], "owasp": [ { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.execution", "attack.t1059", "attack.t1059.004", "attack.initial-access", "attack.t1190" ], "cves": [], "id": "7c3f9d21-4b6a-4a58-9e2d-8f61c05a7bd3", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/llamaindex-cli-files-command-injection.md" }, { "slug": "llamaindex-encode-image-traversal", "title": "LlamaIndex encode_image Path Traversal", "url": "https://www.netzilo.com/threats/llamaindex-encode-image-traversal", "severity": "high", "summary": "A bug in specific LlamaIndex versions (0.12.27-0.12.40) fails to sanitize the image_path parameter passed to its image-encoding function. An attacker who can control that parameter through a tool call can make the AI agent read files outside the intended image directory, such as system credentials or configuration files.", "atlas": [], "owasp": [], "attack": [ "attack.collection", "attack.t1005", "attack.discovery", "attack.t1083" ], "cves": [], "id": "b7f3c1d2-9a4e-4c68-8f2b-1d6e5a0c7b93", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/llamaindex-encode-image-traversal.md" }, { "slug": "llamaindex-langchainllm-stream-complete-dos", "title": "LlamaIndex LangChainLLM stream_complete Type-Confusion DoS Invocation", "url": "https://www.netzilo.com/threats/llamaindex-langchainllm-stream-complete-dos", "severity": "medium", "summary": "A bug in the LlamaIndex LangChainLLM component lets an attacker crash a background thread by passing a wrongly-typed prompt (a list, dict, number, etc. instead of a string) to stream_complete or astream_complete. Because the error is swallowed silently, the application hangs forever, consuming CPU and memory until it is killed.", "atlas": [ { "id": "AML.T0029", "name": "Denial of AI Service" } ], "owasp": [ { "id": "LLM10", "name": "Unbounded Consumption" } ], "attack": [ "attack.impact", "attack.t1499", "attack.t1499.004" ], "cves": [ "CVE-2024-12704" ], "id": "7c3f9a2e-5d41-4b86-9f0c-2ad81e6b47d3", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/llamaindex-langchainllm-stream-complete-dos.md" }, { "slug": "llamaindex-pickle-deserialization", "title": "LlamaIndex Object Node Mapping Pickle Deserialization", "url": "https://www.netzilo.com/threats/llamaindex-pickle-deserialization", "severity": "high", "summary": "LlamaIndex stores certain indexes using Python's pickle format, which can run arbitrary code when loaded. This rule flags command lines that combine a pickle-loading call with either LlamaIndex's object-mapping code or a known code-execution payload, catching attempts to exploit this weakness.", "atlas": [], "owasp": [], "attack": [ "attack.execution", "attack.t1059.006" ], "cves": [], "id": "3f6b1c92-4d7a-4a11-9e3c-8b5d0a2f7c64", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/llamaindex-pickle-deserialization.md" }, { "slug": "llamaindex-pickle-deserialization-rce", "title": "LlamaIndex Pickle Index Deserialization to Code Execution", "url": "https://www.netzilo.com/threats/llamaindex-pickle-deserialization-rce", "severity": "high", "summary": "LlamaIndex versions up to 0.11.6 load saved index files using Python's pickle format without checking if they're safe. An attacker who can supply a malicious index file can get arbitrary commands run on the server the moment it's loaded.", "atlas": [], "owasp": [], "attack": [ "attack.execution", "attack.t1059.006", "attack.t1204.002" ], "cves": [], "id": "7c4f1e2a-9b3d-4c6e-8f51-2a7d9e6b0c34", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/llamaindex-pickle-deserialization-rce.md" }, { "slug": "llamaindex-rungpt-eval-injection", "title": "LLM Response Eval Injection to Command Execution (llama_index RunGptLLM)", "url": "https://www.netzilo.com/threats/llamaindex-rungpt-eval-injection", "severity": "high", "summary": "Some applications built on llama_index (and similar frameworks) take whatever text a language model returns and run it directly with eval() or exec(). If an attacker can influence the model's reply \u2014 through a poisoned prompt, a compromised model, or a manipulated response \u2014 they can smuggle in real code that the application then executes on its own server.", "atlas": [], "owasp": [ { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.execution", "attack.t1059", "attack.t1059.006", "attack.t1203" ], "cves": [], "id": "7c1e4f2a-9b6d-4d51-8e3a-2f0c5b7ad914", "published": "2026-03-05", "modified": "2026-03-05", "markdown": "https://www.netzilo.com/threats/llamaindex-rungpt-eval-injection.md" }, { "slug": "llm-as-chatbot-modelsbyom-rce-descendant-exec", "title": "LLM-As-Chatbot modelsbyom Component Descendant Code Execution", "url": "https://www.netzilo.com/threats/llm-as-chatbot-modelsbyom-rce-descendant-exec", "severity": "high", "summary": "This detects the aftermath of a code execution flaw in the LLM-As-Chatbot application's modelsbyom.py component. It watches for a suspicious shell or downloader process being spawned from that vulnerable component, which is the pattern left behind when someone exploits the flaw to run their own commands.", "atlas": [], "owasp": [], "attack": [ "attack.execution", "attack.t1059", "attack.t1190", "attack.initial-access" ], "cves": [ "CVE-2024-55241" ], "id": "4f2b8d7a-1c63-4e29-9a5f-0d84b1c7e3f6", "published": "2026-03-14", "modified": "2026-03-14", "markdown": "https://www.netzilo.com/threats/llm-as-chatbot-modelsbyom-rce-descendant-exec.md" }, { "slug": "llm-as-judge-bias-and-fairness", "title": "Bias & Fairness (LLM-as-Judge)", "url": "https://www.netzilo.com/threats/llm-as-judge-bias-and-fairness", "severity": "medium", "summary": "This detection uses a secondary AI model to review the outputs of your primary AI system and flag content that looks biased or unfair. It is a monitoring aid, not a security control - it never blocks anything, it just reports what it finds.", "atlas": [], "owasp": [ { "id": "LLM09", "name": "Misinformation" } ], "attack": [], "cves": [], "id": "netzilo-llmjudge-bias-and-fairness-001", "published": "2026-06-30", "modified": "2026-06-30", "markdown": "https://www.netzilo.com/threats/llm-as-judge-bias-and-fairness.md" }, { "slug": "llm-as-judge-code-checker", "title": "Code Checker (LLM-as-Judge)", "url": "https://www.netzilo.com/threats/llm-as-judge-code-checker", "severity": "low", "summary": "This entry describes a quality-checking template that asks an AI model to judge whether generated code correctly solves a stated problem. It is not designed to catch attacks \u2014 it flags code that looks wrong or incomplete, for review purposes only.", "atlas": [], "owasp": [ { "id": "LLM09", "name": "Misinformation" } ], "attack": [], "cves": [], "id": "netzilo-llmjudge-code-checker-001", "published": "2026-06-30", "modified": "2026-06-30", "markdown": "https://www.netzilo.com/threats/llm-as-judge-code-checker.md" }, { "slug": "llm-as-judge-code-injection", "title": "Code Injection (LLM-as-Judge)", "url": "https://www.netzilo.com/threats/llm-as-judge-code-injection", "severity": "critical", "summary": "This detection uses an AI model to review incoming text and decide whether it contains an attempt to inject code, such as commands or scripts meant to be executed rather than merely discussed. It's a judgment-call detector, not a pattern match, so it can catch novel phrasing but can also be wrong in both directions.", "atlas": [ { "id": "AML.T0050", "name": "Command and Scripting Interpreter" }, { "id": "AML.T0102", "name": "Generate Malicious Commands" } ], "owasp": [ { "id": "LLM05", "name": "Improper Output Handling" }, { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" } ], "attack": [ "attack.execution", "attack.t1059" ], "cves": [], "id": "netzilo-llmjudge-code-injection-001", "published": "2026-06-30", "modified": "2026-06-30", "markdown": "https://www.netzilo.com/threats/llm-as-judge-code-injection.md" }, { "slug": "llm-as-judge-explicit-content", "title": "Explicit Content (LLM-as-Judge)", "url": "https://www.netzilo.com/threats/llm-as-judge-explicit-content", "severity": "medium", "summary": "This detection uses an AI model as a judge to review images and decide whether they contain explicit or inappropriate content. It is a monitoring tool, not a blocker: it reports what it finds but does not stop anything from happening.", "atlas": [], "owasp": [], "attack": [], "cves": [], "id": "netzilo-llmjudge-explicit-content-001", "published": "2026-06-30", "modified": "2026-06-30", "markdown": "https://www.netzilo.com/threats/llm-as-judge-explicit-content.md" }, { "slug": "llm-as-judge-pii-leakage", "title": "PII Leakage (LLM-as-Judge)", "url": "https://www.netzilo.com/threats/llm-as-judge-pii-leakage", "severity": "high", "summary": "This detection uses a second AI model to review an AI system's outputs and decide whether they contain personal information or other privacy violations. It's a quality-control check on what an AI agent says, not a check on how attackers got the data there in the first place.", "atlas": [ { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "netzilo-llmjudge-pii-leakage-001", "published": "2026-06-30", "modified": "2026-06-30", "markdown": "https://www.netzilo.com/threats/llm-as-judge-pii-leakage.md" }, { "slug": "llm-as-judge-prompt-injection", "title": "Prompt Injection (LLM-as-Judge)", "url": "https://www.netzilo.com/threats/llm-as-judge-prompt-injection", "severity": "critical", "summary": "This detection uses a secondary AI model to review incoming text and decide whether it contains a prompt injection attempt \u2014 text crafted to hijack an AI agent's instructions. If the judge model flags the input as malicious, the system can block it before it reaches the target agent.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access", "attack.t1190", "attack.stealth" ], "cves": [], "id": "netzilo-llmjudge-prompt-injection-001", "published": "2026-06-30", "modified": "2026-06-30", "markdown": "https://www.netzilo.com/threats/llm-as-judge-prompt-injection.md" }, { "slug": "llm-as-judge-sensitive-imagery", "title": "Sensitive Imagery (LLM-as-Judge)", "url": "https://www.netzilo.com/threats/llm-as-judge-sensitive-imagery", "severity": "medium", "summary": "This is not an attack detector \u2014 it's a content-review check that asks an AI model to judge whether an image passed through an AI agent contains sensitive or potentially harmful material. It flags for human review only; it never blocks anything.", "atlas": [], "owasp": [], "attack": [], "cves": [], "id": "netzilo-llmjudge-sensitive-imagery-001", "published": "2026-06-30", "modified": "2026-06-30", "markdown": "https://www.netzilo.com/threats/llm-as-judge-sensitive-imagery.md" }, { "slug": "llm-as-judge-support-intent", "title": "Support Intent (LLM-as-Judge)", "url": "https://www.netzilo.com/threats/llm-as-judge-support-intent", "severity": "low", "summary": "This rule is not a threat detector in the usual sense. It uses an AI model to read a support conversation and label what the user is actually trying to accomplish, then writes that label to a report. It never blocks anything and has no severity above 'report'.", "atlas": [], "owasp": [], "attack": [], "cves": [], "id": "netzilo-llmjudge-support-intent-001", "published": "2026-06-30", "modified": "2026-06-30", "markdown": "https://www.netzilo.com/threats/llm-as-judge-support-intent.md" }, { "slug": "llm-as-judge-toxicity", "title": "Toxicity (LLM-as-Judge)", "url": "https://www.netzilo.com/threats/llm-as-judge-toxicity", "severity": "medium", "summary": "This detection uses an AI model to review other AI outputs and flag ones that appear toxic, such as hate speech, harassment, or abusive language. It does not block anything - it only produces a report for a human to review.", "atlas": [], "owasp": [], "attack": [], "cves": [], "id": "netzilo-llmjudge-toxicity-001", "published": "2026-06-30", "modified": "2026-06-30", "markdown": "https://www.netzilo.com/threats/llm-as-judge-toxicity.md" }, { "slug": "llm-as-judge-trajectory-accuracy", "title": "Trajectory Accuracy (LLM-as-Judge)", "url": "https://www.netzilo.com/threats/llm-as-judge-trajectory-accuracy", "severity": "low", "summary": "This is not an attack detector. It is a quality-check rule that uses a second AI model to judge whether an agent's sequence of actions made sense, moved forward, and avoided wasted steps. It only reports its verdict; it never blocks anything.", "atlas": [], "owasp": [ { "id": "ASI09", "name": "Traceability and Accountability Gaps" } ], "attack": [], "cves": [], "id": "netzilo-llmjudge-trajectory-accuracy-001", "published": "2026-06-30", "modified": "2026-06-30", "markdown": "https://www.netzilo.com/threats/llm-as-judge-trajectory-accuracy.md" }, { "slug": "llm-control-plane-relay", "title": "LLM Control Plane Relay (Duplicated Vendor API Surface)", "url": "https://www.netzilo.com/threats/llm-control-plane-relay", "severity": "high", "summary": "This detects when a coding assistant like Claude Code or Codex starts sending its vendor-specific API calls to more than one destination within an hour. That pattern usually means something has inserted itself between the agent and the AI vendor, either to intercept or redirect the traffic.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" }, { "id": "AML.T0025", "name": "Exfiltration via Cyber Means" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.collection", "attack.t1557", "attack.t1195.002" ], "cves": [], "id": "7c1d5f2a-9b64-4f0e-8a37-2e6d4c81b9af", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/llm-control-plane-relay.md" }, { "slug": "llm-jailbreak-persona-compliance", "title": "LLM Jailbreak Persona Compliance In Model Response", "url": "https://www.netzilo.com/threats/llm-jailbreak-persona-compliance", "severity": "high", "summary": "This detects when an AI language model's own reply shows signs that a jailbreak prompt worked and the model is now roleplaying as an unrestricted persona. It looks at the model's output, not the attacker's prompt, catching the moment the guardrails appear to have come off.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" } ], "attack": [ "attack.initial-access", "attack.t1190" ], "cves": [], "id": "7c3f9b2a-1d64-4f8e-9a05-2b6ef0c41d73", "published": "2026-03-05", "modified": "2026-03-05", "markdown": "https://www.netzilo.com/threats/llm-jailbreak-persona-compliance.md" }, { "slug": "llm-mediated-web-attack-payload", "title": "LLM-Mediated Web Attack Payload in Outbound HTTP", "url": "https://www.netzilo.com/threats/llm-mediated-web-attack-payload", "severity": "high", "summary": "An LLM-based agent can be tricked into producing text that looks like a classic web attack payload \u2014 a SQL injection string, an XSS script tag, a template injection expression, a command injection sequence, or a path traversal string \u2014 and then sending that text out in an HTTP request. This rule flags the moment that payload leaves the agent as HTTP traffic, before anyone knows whether the receiving system actually acted on it.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.initial-access", "attack.t1190", "attack.execution", "attack.t1059" ], "cves": [], "id": "7c4e1b0a-9d3f-4a52-b8e1-2f6c5d0a91e7", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/llm-mediated-web-attack-payload.md" }, { "slug": "logintrap-credential-submission", "title": "LoginTrap Indirect Injection Credential Submission", "url": "https://www.netzilo.com/threats/logintrap-credential-submission", "severity": "high", "summary": "An LLM-powered web agent reads a webpage that contains hidden instructions aimed at the agent itself, telling it to log in somewhere and send credentials. Shortly afterward, the agent submits real login data to a site it either just started talking to or that's on a different domain than the page it read.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.credential-access", "attack.t1056.003" ], "cves": [], "id": "6f3b9c2a-8d41-4e7b-9c0f-2a5d1e84b7c3", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/logintrap-credential-submission.md" }, { "slug": "loom-task-claude-code-execution", "title": "Supply Chain Claude Code Launch via LOOM_TASK Binding", "url": "https://www.netzilo.com/threats/loom-task-claude-code-execution", "severity": "high", "summary": "A malicious or compromised npm package called @lamemind/loom-deck reads a task file (tasks.md) and uses it to launch Claude Code sessions bound to attacker-controlled instructions via the LOOM_TASK environment variable. This turns the AI coding agent into a way to execute arbitrary commands chosen by whoever controls the task file.", "atlas": [], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial-access", "attack.t1195.002", "attack.execution", "attack.t1059" ], "cves": [], "id": "b7f3c1d4-9a25-4e6b-8f10-2c4d5e6a7b91", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/loom-task-claude-code-execution.md" }, { "slug": "lotl-exfiltration", "title": "Living-off-the-Land Data Exfiltration", "url": "https://www.netzilo.com/threats/lotl-exfiltration", "severity": "medium", "summary": "Instead of using dedicated malware to steal data, an attacker can repurpose tools that are already installed and trusted on a machine \u2014 git, ssh, openssl, Python's built-in web server, netcat \u2014 to move data out or open a covert tunnel. This rule watches for those tools being used with the specific flags that turn them from normal utilities into a data pipeline.", "atlas": [ { "id": "AML.T0086", "name": "Exfiltration via AI Agent Tool Invocation" }, { "id": "AML.T0025", "name": "Exfiltration via Cyber Means" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" } ], "attack": [ "attack.exfiltration", "attack.t1048", "attack.command-and-control", "attack.t1572" ], "cves": [], "id": "af74dcc8-c033-5847-a7c9-a3f6eb0ef3b4", "published": "2026-03-16", "modified": "2026-08-03", "markdown": "https://www.netzilo.com/threats/lotl-exfiltration.md" }, { "slug": "malware-ioc", "title": "Malware Indicator of Compromise in Agent Content", "url": "https://www.netzilo.com/threats/malware-ioc", "severity": "critical", "summary": "This rule flags when an AI agent's tool calls, executed commands, or written files contain text patterns that match known malware. It's a way to catch cases where an agent has been tricked into running or creating malicious code, or where an attacker is using the agent as a vehicle to deploy malware.", "atlas": [ { "id": "AML.T0072", "name": "Reverse Shell" }, { "id": "AML.T0090", "name": "OS Credential Dumping" }, { "id": "AML.T0050", "name": "Command and Scripting Interpreter" }, { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" }, { "id": "ASI02", "name": "Tool Misuse and Exploitation" } ], "attack": [ "attack.execution", "attack.t1059", "attack.persistence", "attack.t1546", "attack.collection" ], "cves": [], "id": "77a8b9c0-d1e2-4f34-5678-a9b0c1d2e3f4", "published": "2026-06-03", "modified": "2026-06-03", "markdown": "https://www.netzilo.com/threats/malware-ioc.md" }, { "slug": "mcp-bifrost-worker-edit-abuse", "title": "MCP Bifrost Delegated Worker Edit Abuse", "url": "https://www.netzilo.com/threats/mcp-bifrost-worker-edit-abuse", "severity": "high", "summary": "mcp-bifrost hands off code-editing tasks to a cheaper worker model and automatically applies whatever edits come back, once basic checks pass. If that worker model is tricked or compromised, its edits are trusted and applied as if the main agent wrote them, potentially rewriting files it was never asked to touch.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "LLM05", "name": "Improper Output Handling" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1059", "attack.t1195.002" ], "cves": [], "id": "6f2c9a41-7d3e-4b58-9c02-1ae5f83b7d64", "published": "2026-03-14", "modified": "2026-03-14", "markdown": "https://www.netzilo.com/threats/mcp-bifrost-worker-edit-abuse.md" }, { "slug": "mcp-capability-mismatch", "title": "MCP Skill Capability Mismatch \u2014 Underdeclared Permissions", "url": "https://www.netzilo.com/threats/mcp-capability-mismatch", "severity": "medium", "summary": "Some AI agent frameworks let developers install 'skills' \u2014 packaged capabilities \u2014 that must declare what permissions they need. This rule flags skills whose declared permission scope is narrow and read-only, yet whose content also references writing files, executing commands, or making network calls. That mismatch suggests the skill is asking for less access than it actually uses or intends to use.", "atlas": [ { "id": "AML.T0110", "name": "AI Agent Tool Poisoning" }, { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.privilege-escalation", "attack.t1078", "attack.stealth" ], "cves": [], "id": "d3a4b5c6-d7e8-4f90-1234-a5b6c7d8e9f0", "published": "2026-06-03", "modified": "2026-06-03", "markdown": "https://www.netzilo.com/threats/mcp-capability-mismatch.md" }, { "slug": "mcp-command-injection", "title": "MCP Server Command Injection via Shell Metacharacters", "url": "https://www.netzilo.com/threats/mcp-command-injection", "severity": "critical", "summary": "Attackers send tool call parameters containing shell metacharacters (like pipes, semicolons, backticks) to MCP servers that pass this input directly to system commands without sanitizing it. If the server is vulnerable, this lets the attacker run arbitrary commands on the host.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" }, { "id": "AML.T0050", "name": "Command and Scripting Interpreter" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.execution", "attack.t1059.004" ], "cves": [ "CVE-2026-4192" ], "id": "ae6e3887-4265-5882-b550-31a2386cfab8", "published": "2026-03-23", "modified": "2026-03-23", "markdown": "https://www.netzilo.com/threats/mcp-command-injection.md" }, { "slug": "mcp-config-tampering", "title": "MCP Config Tampering (Instance-Resolved)", "url": "https://www.netzilo.com/threats/mcp-config-tampering", "severity": "high", "summary": "An AI coding agent or assistant can write to its own configuration file that lists which external tools and servers it's allowed to use. If an attacker or compromised process modifies this file, the agent gains new capabilities automatically the next time it starts, without anyone approving the change.", "atlas": [], "owasp": [], "attack": [ "attack.persistence", "attack.privilege-escalation", "attack.t1546", "attack.t1554" ], "cves": [], "id": "7c1f4b2e-9d3a-4f68-b0c5-2e8a41d7f93b", "published": "2026-03-14", "modified": "2026-03-14", "markdown": "https://www.netzilo.com/threats/mcp-config-tampering.md" }, { "slug": "mcp-config-write", "title": "MCP Config Write Attempt", "url": "https://www.netzilo.com/threats/mcp-config-write", "severity": "high", "summary": "AI coding assistants like Claude Desktop, Cline, and Windsurf read configuration files that list which external tools (MCP servers) they're allowed to use. If an attacker can get the agent to write to one of these files, they can register a hostile tool the agent will later call, turning a prompt injection into code execution.", "atlas": [ { "id": "AML.T0081", "name": "Modify AI Agent Configuration" }, { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" } ], "attack": [ "attack.persistence", "attack.t1546", "attack.supply-chain" ], "cves": [ "CVE-2026-30615" ], "id": "netzilo-mcp-config-write-001", "published": "2026-03-01", "modified": "2026-03-01", "markdown": "https://www.netzilo.com/threats/mcp-config-write.md" }, { "slug": "mcp-database-readonly-bypass", "title": "MCP Database Server Read-Only Bypass", "url": "https://www.netzilo.com/threats/mcp-database-readonly-bypass", "severity": "high", "summary": "Some MCP database server bridges that connect AI agents to databases can be started in a read-only mode meant to block writes, but that restriction can be bypassed. This detection flags sessions where a read-only database server is running and a write command still gets sent through the same connection.", "atlas": [], "owasp": [], "attack": [ "attack.execution", "attack.t1059", "attack.impact", "attack.t1565" ], "cves": [], "id": "b7c3f1a2-9d4e-4f18-8a6b-2e5c07d91f43", "published": "2026-03-01", "modified": "2026-03-01", "markdown": "https://www.netzilo.com/threats/mcp-database-readonly-bypass.md" }, { "slug": "mcp-injection-supply-chain-egress", "title": "MCP Content Injection Supply Chain Egress Chain", "url": "https://www.netzilo.com/threats/mcp-injection-supply-chain-egress", "severity": "high", "summary": "This rule watches for an AI agent that fetches content from an outside source and shortly after uses a command-line tool to send data back out to the internet, especially when credentials, files, or encoded payloads are involved. It's a way to catch the tail end of content-injection or tool-poisoning attacks against AI agents, not the injection itself.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" }, { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0053", "name": "AI Agent Tool Invocation" }, { "id": "AML.T0025", "name": "Exfiltration via Cyber Means" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" }, { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.exfiltration", "attack.t1567", "attack.execution", "attack.t1059", "attack.t1195" ], "cves": [], "id": "7f3c1d2a-9b64-4e58-a1c7-5d0e2b8f4a36", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/mcp-injection-supply-chain-egress.md" }, { "slug": "mcp-launcher-exec-bypass", "title": "MCP Launcher Exec-Flag Bypass", "url": "https://www.netzilo.com/threats/mcp-launcher-exec-bypass", "severity": "critical", "summary": "Some AI agent systems (MCP frameworks) only check whether a command starts with an approved launcher like npx, node, or python before allowing it to run. Attackers exploit this by appending an inline code-execution flag such as -c, -e, or --eval, which lets them run any code they want while the launcher itself still looks approved.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" }, { "id": "AML.T0050", "name": "Command and Scripting Interpreter" } ], "owasp": [ { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" }, { "id": "ASI02", "name": "Tool Misuse and Exploitation" } ], "attack": [ "attack.execution", "attack.t1059", "attack.defense-impairment", "attack.t1027" ], "cves": [ "CVE-2026-30625", "CVE-2026-40933" ], "id": "netzilo-mcp-launcher-exec-bypass-001", "published": "2026-03-01", "modified": "2026-03-01", "markdown": "https://www.netzilo.com/threats/mcp-launcher-exec-bypass.md" }, { "slug": "mcp-light-tools-default-dangerous-tools", "title": "MCP Server Launch - light-tools Default Dangerous Toolset", "url": "https://www.netzilo.com/threats/mcp-light-tools-default-dangerous-tools", "severity": "medium", "summary": "The @factor-i-o/light-tools MCP server ships with file access, shell execution, SSH/SCP, and service-log tools all enabled unless someone explicitly turns them off. Any AI agent that connects to a default-configured instance gets arbitrary file read/write and command execution on the host with no permission checks in between.", "atlas": [], "owasp": [ { "id": "LLM03", "name": "Supply Chain" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.initial-access", "attack.t1195", "attack.execution", "attack.t1059" ], "cves": [], "id": "7b3c1f5a-9d24-4e6b-8f01-2c5a7d9e4b38", "published": "2026-03-18", "modified": "2026-03-18", "markdown": "https://www.netzilo.com/threats/mcp-light-tools-default-dangerous-tools.md" }, { "slug": "mcp-markdownify-arbitrary-file-read", "title": "MCP Markdownify Arbitrary File Read via get-markdown-file", "url": "https://www.netzilo.com/threats/mcp-markdownify-arbitrary-file-read", "severity": "high", "summary": "Some versions of the mcp-markdownify-server accept a file path argument without checking it, so a tool meant to turn documents into markdown can be pointed at any file on disk. Attackers can use this to read credentials, SSH keys, or other sensitive files by disguising the request as a normal conversion job.", "atlas": [], "owasp": [ { "id": "LLM02", "name": "Sensitive Information Disclosure" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.collection", "attack.t1005", "attack.credential-access", "attack.t1552.001" ], "cves": [], "id": "7f3c1d2a-8b64-4e19-9c0f-2d5a6b8e4713", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/mcp-markdownify-arbitrary-file-read.md" }, { "slug": "mcp-markdownify-ssrf", "title": "MCP Markdownify SSRF Tool Invocation", "url": "https://www.netzilo.com/threats/mcp-markdownify-ssrf", "severity": "high", "summary": "An AI agent tool that converts web pages to markdown can be tricked into fetching internal network resources instead of public pages. If a prompt (including one hidden in content the agent processes) supplies a URL pointing at internal infrastructure, the tool fetches it and hands the response back as text.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.credential-access", "attack.t1552.005", "attack.t1190" ], "cves": [], "id": "7c1e4d9a-3b62-4f81-9e0c-2a5d8f14b6e3", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/mcp-markdownify-ssrf.md" }, { "slug": "mcp-neo4j-unauth-cypher-abuse", "title": "MCP Neo4j Unauthenticated Cypher Abuse", "url": "https://www.netzilo.com/threats/mcp-neo4j-unauth-cypher-abuse", "severity": "high", "summary": "A known flaw in mcp-neo4j version 0.3.0 lets anyone reach its SSE/JSON-RPC interface without logging in and run Cypher queries. Attackers use this to read files off the server, dump configuration and user accounts, or create new privileged database users.", "atlas": [], "owasp": [ { "id": "LLM02", "name": "Sensitive Information Disclosure" }, { "id": "ASI02", "name": "Tool Misuse and Exploitation" } ], "attack": [ "attack.initial-access", "attack.t1190", "attack.execution", "attack.t1059", "attack.credential-access", "attack.t1552" ], "cves": [ "CVE-2025-56406" ], "id": "7f3c9b1e-4a52-4d6f-9c08-2b1e5a7d3c94", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/mcp-neo4j-unauth-cypher-abuse.md" }, { "slug": "mcp-oauth-redirect-url-rce", "title": "MCP StreamableHttp OAuth Redirect URL Command Injection", "url": "https://www.netzilo.com/threats/mcp-oauth-redirect-url-rce", "severity": "high", "summary": "Some AI agent clients that speak the MCP protocol will fetch an OAuth authorization URL from a remote MCP server and then hand that URL, unsanitized, to a spawned shell command. If the server returns a malicious URL containing shell metacharacters, it can run arbitrary commands on the machine hosting the agent. This affects Cherry Studio versions 1.5.1 and earlier.", "atlas": [], "owasp": [], "attack": [ "attack.initial-access", "attack.execution", "attack.t1059", "attack.t1203" ], "cves": [], "id": "7f3c1e94-2b6a-4d58-9c07-e1a5d84b6f21", "published": "2026-03-14", "modified": "2026-03-14", "markdown": "https://www.netzilo.com/threats/mcp-oauth-redirect-url-rce.md" }, { "slug": "mcp-package-credential-beacon", "title": "MCP Package Credential Beacon in Outbound HTTP", "url": "https://www.netzilo.com/threats/mcp-package-credential-beacon", "severity": "high", "summary": "This detects an installed MCP (Model Context Protocol) server package on an agent host making an outbound web request that contains real credential material \u2014 API keys, tokens, or environment variables \u2014 packaged in a way that looks like exfiltration rather than normal use.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" }, { "id": "AML.T0025", "name": "Exfiltration via Cyber Means" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration", "attack.t1567", "attack.initial-access", "attack.t1195.002" ], "cves": [], "id": "3f9c1d42-8b47-4e6a-9c05-71a2e6f4b83d", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/mcp-package-credential-beacon.md" }, { "slug": "mcp-package-trojan-verifyfirst", "title": "MCP Supply Chain - Trojanized verifyfirst-mcp Package Install or Launch", "url": "https://www.netzilo.com/threats/mcp-package-trojan-verifyfirst", "severity": "medium", "summary": "A PyPI package named verifyfirst-mcp reportedly ships an MCP server that lies to AI agents: it reports failed builds, tests, signature checks, and policy gates as successes. This rule flags when a process installs or launches that specific package, so a team can investigate before an agent starts trusting fake 'passed' results.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial-access", "attack.t1195.002", "attack.execution", "attack.t1204" ], "cves": [], "id": "7f3c1a9e-24d6-4b58-9c07-af5e2d1b6e83", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/mcp-package-trojan-verifyfirst.md" }, { "slug": "mcp-persistence-plugin-install", "title": "MCP Plugin Persistence Registration", "url": "https://www.netzilo.com/threats/mcp-persistence-plugin-install", "severity": "high", "summary": "AI coding assistants like Claude, Cursor, and Codex use Model Context Protocol (MCP) configuration files to decide which external tools they can call. This rule flags commands that add or rewrite those config files, since doing so lets an attacker's tool get automatically reloaded every time the agent restarts, without needing to re-run any exploit.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.persistence", "attack.t1176" ], "cves": [], "id": "7f3d9c21-6b4e-4a58-9c2f-1e0d5b8a3f47", "published": "2026-03-14", "modified": "2026-03-14", "markdown": "https://www.netzilo.com/threats/mcp-persistence-plugin-install.md" }, { "slug": "mcp-response-executable-payload", "title": "MCP Tool Response Carries Executable Attack Payload", "url": "https://www.netzilo.com/threats/mcp-response-executable-payload", "severity": "high", "summary": "This detects when a tool an AI agent calls returns text that contains a working reverse-shell or download-and-execute command, rather than normal data. That content comes from outside the organization's control and could get run or passed along by the agent if nothing catches it.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.execution", "attack.t1059", "attack.command-and-control", "attack.t1105" ], "cves": [], "id": "4f2b8c91-6d3a-4e17-9b52-8ac0f1d7e3b6", "published": "2026-03-14", "modified": "2026-03-14", "markdown": "https://www.netzilo.com/threats/mcp-response-executable-payload.md" }, { "slug": "mcp-rug-pull", "title": "MCP Tool Description Changed After Approval (Rug Pull)", "url": "https://www.netzilo.com/threats/mcp-rug-pull", "severity": "medium", "summary": "An AI agent tool that was reviewed and approved can later have its description silently swapped for a different one carrying new instructions. Because each individual call still looks normal, only comparing the tool's description over time reveals the tampering.", "atlas": [ { "id": "AML.T0110", "name": "AI Agent Tool Poisoning" }, { "id": "AML.T0109", "name": "AI Supply Chain Rug Pull" } ], "owasp": [ { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.persistence", "attack.t1195.002", "attack.stealth" ], "cves": [], "id": "43a31200-6894-5c9b-a187-1cd0a11af2b3", "published": "2026-02-26", "modified": "2026-08-03", "markdown": "https://www.netzilo.com/threats/mcp-rug-pull.md" }, { "slug": "mcp-stdio-config-injection", "title": "MCP STDIO Config Shell Injection", "url": "https://www.netzilo.com/threats/mcp-stdio-config-injection", "severity": "critical", "summary": "Some AI agent frameworks use the Model Context Protocol (MCP) to launch helper tools over standard input/output. This rule flags configurations where the launcher is set to a shell (like bash or sh) rather than a specific program, which is the setup step behind several known MCP remote-code-execution vulnerabilities.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" }, { "id": "AML.T0050", "name": "Command and Scripting Interpreter" }, { "id": "AML.T0081", "name": "Modify AI Agent Configuration" } ], "owasp": [ { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" }, { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.execution", "attack.t1059", "attack.initial-access" ], "cves": [ "CVE-2026-26015", "CVE-2026-30615", "CVE-2026-3062", "CVE-2026-30623" ], "id": "netzilo-mcp-stdio-config-injection-001", "published": "2026-03-01", "modified": "2026-03-01", "markdown": "https://www.netzilo.com/threats/mcp-stdio-config-injection.md" }, { "slug": "mcp-streamable-session-churn", "title": "MCP Streamable-HTTP Session Churn (Uncaught ClosedResourceError DoS)", "url": "https://www.netzilo.com/threats/mcp-streamable-session-churn", "severity": "medium", "summary": "This detects a pattern where a client keeps reconnecting to an MCP streamable-HTTP server, but each new connection carries almost no actual traffic before dying. That pattern matches how CVE-2025-53365 is exploited: a crafted request crashes the server's session handler, forcing constant restarts.", "atlas": [], "owasp": [], "attack": [ "attack.impact", "attack.t1499", "attack.t1499.004" ], "cves": [ "CVE-2025-53365" ], "id": "7f3c9d21-4b8e-4a6f-9c1d-5e2a8b4f6031", "published": "2026-03-14", "modified": "2026-03-14", "markdown": "https://www.netzilo.com/threats/mcp-streamable-session-churn.md" }, { "slug": "mcp-tool-poisoning", "title": "Suspicious MCP Tool Descriptions", "url": "https://www.netzilo.com/threats/mcp-tool-poisoning", "severity": "high", "summary": "AI agents that use the Model Context Protocol (MCP) read tool descriptions as trusted setup text before ever calling the tool. An attacker can plant commands inside that description text to steer the agent's behavior without executing any visibly malicious action.", "atlas": [ { "id": "AML.T0110", "name": "AI Agent Tool Poisoning" }, { "id": "AML.T0068", "name": "LLM Prompt Obfuscation" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.persistence", "attack.t1546", "attack.stealth", "attack.t1027" ], "cves": [], "id": "27eee8c9-af55-5190-8601-1e7b365afc99", "published": "2026-02-16", "modified": "2026-08-03", "markdown": "https://www.netzilo.com/threats/mcp-tool-poisoning.md" }, { "slug": "mcphub-mcprouter-ssrf", "title": "MCPHub MCPRouter baseUrl SSRF", "url": "https://www.netzilo.com/threats/mcphub-mcprouter-ssrf", "severity": "high", "summary": "MCPHub's MCPRouter component accepts a baseUrl-style parameter when registering an MCP server, and versions up to 0.9.10 don't properly validate that URL before the router connects to it. An attacker can supply an internal address, a cloud metadata endpoint, or an obfuscated IP to make the router fetch resources it shouldn't reach.", "atlas": [], "owasp": [], "attack": [ "attack.initial-access", "attack.t1190", "attack.discovery", "attack.t1046", "attack.credential-access", "attack.t1552.005" ], "cves": [], "id": "7f3c1d0a-5e42-4b9e-9c61-2a8d4f6b0e17", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/mcphub-mcprouter-ssrf.md" }, { "slug": "memory-poisoning", "title": "Agent Persistent Memory Poisoning via Behavioural Modifier Injection", "url": "https://www.netzilo.com/threats/memory-poisoning", "severity": "high", "summary": "Some AI agents remember things across conversations by saving notes to a memory store. This detection flags attempts to write malicious instructions into that memory, disguised as normal preferences, so the agent behaves badly in every future session without the attacker needing to do anything else.", "atlas": [ { "id": "AML.T0080", "name": "AI Agent Context Poisoning" }, { "id": "AML.T0099", "name": "AI Agent Tool Data Poisoning" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "LLM04", "name": "Data and Model Poisoning" } ], "attack": [ "attack.persistence", "attack.t1565.001" ], "cves": [], "id": "043f4e6f-5354-5bc0-8046-ac279b2763ca", "published": "2026-03-16", "modified": "2026-03-16", "markdown": "https://www.netzilo.com/threats/memory-poisoning.md" }, { "slug": "ml-shared-temp-toctou-exposure", "title": "ML Runtime Shared-Temp Artifact Exposure", "url": "https://www.netzilo.com/threats/ml-shared-temp-toctou-exposure", "severity": "medium", "summary": "This rule watches for a specific file-sharing pattern: a Python process writes a scratch file into a world-readable temp folder, and a different program touches that same file shortly after. That pattern is how an old bug in the Hugging Face transformers library (CVE-2023-2800 class, versions up to 4.29.2) could be exploited by another user on the same machine.", "atlas": [], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.privilege-escalation", "attack.t1574" ], "cves": [ "CVE-2023-2800" ], "id": "b7f4c2d1-9a6e-4c58-8f3b-2e7d51a9c064", "published": "2026-02-19", "modified": "2026-02-19", "markdown": "https://www.netzilo.com/threats/ml-shared-temp-toctou-exposure.md" }, { "slug": "mudraid-sdk-supply-chain", "title": "Malicious PyPI Package mudraid-sdk in Agent HTTP Traffic", "url": "https://www.netzilo.com/threats/mudraid-sdk-supply-chain", "severity": "high", "summary": "mudraid-sdk is a trojanized package published to PyPI. This rule spots outbound web traffic that mentions the package name, whether that's a download, a manifest listing it, or a runtime beacon carrying stolen credentials.", "atlas": [ { "id": "AML.T0005", "name": "Create Proxy AI Model" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.initial-access", "attack.t1195.001", "attack.exfiltration", "attack.t1567" ], "cves": [], "id": "7b3f1c94-2d8a-4e51-9c60-5a7d2f0b8e13", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/mudraid-sdk-supply-chain.md" }, { "slug": "multistep-indirect-injection-chain", "title": "Multi-Step Indirect Prompt Injection Navigation Chain", "url": "https://www.netzilo.com/threats/multistep-indirect-injection-chain", "severity": "medium", "summary": "This detects a technique where attackers spread malicious instructions across several linked web pages instead of one obvious page. Each page looks harmless on its own, but together they steer an AI agent that browses the web through a sequence of steps toward an attacker's goal.", "atlas": [ { "id": "AML.T0047", "name": "AI-Enabled Product or Service" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access", "attack.t1189" ], "cves": [], "id": "b7e3f1a4-2c9d-4f68-9a51-6d0c8e37b214", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/multistep-indirect-injection-chain.md" }, { "slug": "n8n-expression-eval-rce", "title": "n8n Workflow Expression Sandbox Escape to OS Execution", "url": "https://www.netzilo.com/threats/n8n-expression-eval-rce", "severity": "high", "summary": "n8n lets workflows evaluate expressions in a restricted JavaScript sandbox. This rule watches for that sandbox being broken out of so the attacker's code runs as a real OS process, then talks to the internet or steals credentials.", "atlas": [], "owasp": [], "attack": [ "attack.initial-access", "attack.t1190", "attack.execution", "attack.t1059", "attack.t1059.007" ], "cves": [], "id": "3f7c9a1e-5b42-4d8e-9c07-1a6f2b83d4e5", "published": "2026-05-18", "modified": "2026-05-18", "markdown": "https://www.netzilo.com/threats/n8n-expression-eval-rce.md" }, { "slug": "neo4j-mcp-dns-rebinding", "title": "Neo4j Cypher MCP DNS Rebinding Tool Invocation", "url": "https://www.netzilo.com/threats/neo4j-mcp-dns-rebinding", "severity": "medium", "summary": "This detects browser-based requests that abuse DNS rebinding to call a Neo4j Cypher MCP tool (read, write, or schema access) running on a victim's own machine. The request looks like it comes from a public web page but resolves to a local or internal address, tricking the locally bound MCP server into executing commands it should only accept from the local machine.", "atlas": [], "owasp": [], "attack": [ "attack.initial-access", "attack.t1189" ], "cves": [], "id": "7b3f9c2a-5d41-4e8b-9a6f-1c0d84e37f52", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/neo4j-mcp-dns-rebinding.md" }, { "slug": "network-recon", "title": "Network Reconnaissance Activity", "url": "https://www.netzilo.com/threats/network-recon", "severity": "high", "summary": "This rule flags an AI agent scanning a network for open ports and live hosts \u2014 the kind of reconnaissance that usually happens before an attacker tries to move to other systems. It catches this whether the scanner is invoked directly by the agent's tooling or launched indirectly through a shell command or script the agent wrote.", "atlas": [ { "id": "AML.T0006", "name": "Active Scanning" }, { "id": "AML.T0089", "name": "Process Discovery" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" } ], "attack": [ "attack.discovery", "attack.t1046", "attack.t1040" ], "cves": [], "id": "5ab0c6d8-c202-5f02-b71c-f0228052c20d", "published": "2026-01-25", "modified": "2026-08-03", "markdown": "https://www.netzilo.com/threats/network-recon.md" }, { "slug": "neuron-mysql-write-destructive-sql", "title": "Neuron MySQLWriteTool Destructive SQL Execution", "url": "https://www.netzilo.com/threats/neuron-mysql-write-destructive-sql", "severity": "high", "summary": "An AI agent with a SQL write tool can be manipulated, through prompt injection, into sending destructive database commands like DROP TABLE or DELETE without a WHERE clause. This detection flags when such a dangerous statement reaches the tool, regardless of how the instruction got there.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.impact", "attack.t1485", "attack.t1565.001" ], "cves": [], "id": "7b3f1c2e-9d5a-4e18-b6c4-2a8f0d371e94", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/neuron-mysql-write-destructive-sql.md" }, { "slug": "novence-pypi-install", "title": "Supply Chain Novence PyPI Package Install", "url": "https://www.netzilo.com/threats/novence-pypi-install", "severity": "medium", "summary": "This rule watches for any command that installs a Python package called 'novence' using common package managers like pip, pipx, poetry, or conda. The package surfaced on PyPI claiming to be an official SDK, but there is no confirmed evidence it is malicious. The rule exists to answer one question: has this specific package landed on any monitored machine.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial-access", "attack.t1195.002" ], "cves": [], "id": "3f8c1b42-6d7e-4a19-9c05-be2741d80e63", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/novence-pypi-install.md" }, { "slug": "npm-slopburn-cli-staging-ioc", "title": "Supply Chain IOC - npm Package @vibekiln/slopburn-cli-staging", "url": "https://www.netzilo.com/threats/npm-slopburn-cli-staging-ioc", "severity": "medium", "summary": "This detection watches for one named npm package that has been flagged as suspicious. It fires when that exact package name (or its binary) shows up in an install or run command, but it does not confirm what the package actually does.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial-access", "attack.t1195.001", "attack.execution", "attack.t1059.007" ], "cves": [], "id": "3f9c1e2a-7b64-4d81-9a05-c6e2f8b31d47", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/npm-slopburn-cli-staging-ioc.md" }, { "slug": "npm-aigent-hive-supply-chain", "title": "Supply Chain Suspicious npm Package Install (@aigent-hive)", "url": "https://www.netzilo.com/threats/npm-aigent-hive-supply-chain", "severity": "medium", "summary": "This rule flags any attempt to install, run, or download the npm package @aigent-hive/darwin-arm64 (or its sibling platform builds), which is marketed as a local agent harness for subscription-authenticated AI hosts. The package itself has not been confirmed malicious \u2014 there is no advisory, CVE, or code analysis behind this \u2014 the flag exists because the name and description suggest it could harvest credentials or gain persistent control of an agent runtime.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial-access", "attack.t1195.002" ], "cves": [], "id": "7f3c1a92-4d8e-4b6a-9c05-2e1f8a6b3d47", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/npm-aigent-hive-supply-chain.md" }, { "slug": "npm-claw-orchestrator-supply-chain", "title": "Supply Chain NPM Claw Orchestrator Delivery", "url": "https://www.netzilo.com/threats/npm-claw-orchestrator-supply-chain", "severity": "medium", "summary": "This rule watches for a specific rogue npm package family (claw-orchestrator, @claw/* scope, clawcode-orchestrator and similar name variants) being fetched or run on a developer machine, especially near AI coding tools like Claude Desktop, Cursor, Cline, Continue or Windsurf. It flags the moment the package enters or runs in the environment, not what it does afterward.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial-access", "attack.t1195.002", "attack.execution", "attack.t1204.002" ], "cves": [], "id": "6f2a91c4-3d5e-4b17-9c8a-0e7b42d51f83", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/npm-claw-orchestrator-supply-chain.md" }, { "slug": "npm-create-nexus-devflow-install", "title": "NPM Supply Chain - create-nexus-devflow Installer Invocation", "url": "https://www.netzilo.com/threats/npm-create-nexus-devflow-install", "severity": "medium", "summary": "This rule flags any attempt to install or execute the NPM package @jakkrichm/create-nexus-devflow (or its unscoped create-nexus-devflow initializer form) by an AI agent or a process it spawned. It is a name-match alert, not proof of compromise: there is no confirmed malicious payload, hash, or network indicator tied to this package.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial-access", "attack.t1195", "attack.t1195.001", "attack.execution", "attack.t1059.007" ], "cves": [], "id": "7c1f4e28-3a6d-4b91-9c02-5f8ad3e71b64", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/npm-create-nexus-devflow-install.md" }, { "slug": "npm-lifecycle-agent-memory-store-injection", "title": "Package Lifecycle Script Writes Agent Memory/Instruction Store", "url": "https://www.netzilo.com/threats/npm-lifecycle-agent-memory-store-injection", "severity": "high", "summary": "When you run npm/yarn/pnpm install, any package can run a setup script. This rule flags cases where that setup script writes files into the folders an AI agent reads as its memory, skills, or configuration \u2014 meaning the package can inject instructions the agent will follow later, without you approving it.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" }, { "id": "LLM04", "name": "Data and Model Poisoning" } ], "attack": [ "attack.initial-access", "attack.t1195.002", "attack.persistence" ], "cves": [], "id": "7c3f1d2a-9b64-4e18-a5d7-2f0c6b81e4a3", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/npm-lifecycle-agent-memory-store-injection.md" }, { "slug": "npm-malicious-claude-rust-package", "title": "Malicious NPM Package Claude Code Rust Native Binary", "url": "https://www.netzilo.com/threats/npm-malicious-claude-rust-package", "severity": "medium", "summary": "This rule watches for a specific npm package name \u2014 @srothgan/claude-code-rust-*, which pretends to provide 'Claude Code Rust' native binaries and a private Bun runtime bridge. It flags any command line where that package name shows up, whether installed, run, or invoked from a build script.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial_access", "attack.t1195.002" ], "cves": [], "id": "6f3c9a41-8d2b-4e57-b0a9-1c74e2f5ad38", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/npm-malicious-claude-rust-package.md" }, { "slug": "npm-minecraft-mcp-masquerade", "title": "Supply Chain \u2014 Minecraft MCP Server npm Package Masquerade", "url": "https://www.netzilo.com/threats/npm-minecraft-mcp-masquerade", "severity": "medium", "summary": "This rule flags an AI agent trying to install or run an npm package whose name combines 'minecraft' with 'mcp' or 'modelcontextprotocol' \u2014 a naming pattern used by packages that pose as a legitimate Minecraft MCP server integration. It catches the install/execution attempt itself, not proof that the package is malicious.", "atlas": [], "owasp": [], "attack": [ "attack.initial-access", "attack.t1195.002", "attack.execution", "attack.t1059.007" ], "cves": [], "id": "7b3d9c42-5f18-4a6e-9c07-2d81e4f5ab93", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/npm-minecraft-mcp-masquerade.md" }, { "slug": "npm-oauth-adapter-credential-egress", "title": "Supply Chain npm Install Context Credential Egress (@edge-sky/dsh-oauth-adapter)", "url": "https://www.netzilo.com/threats/npm-oauth-adapter-credential-egress", "severity": "high", "summary": "This rule flags a specific attack pattern seen with the package @edge-sky/dsh-oauth-adapter: during package installation, a script reads OAuth or cloud credential files it has no legitimate reason to touch, then sends an outbound network request. It also flags any session where the package name itself shows up in commands or URLs.", "atlas": [], "owasp": [], "attack": [ "attack.initial-access", "attack.t1195.001", "attack.credential-access", "attack.t1552.001", "attack.exfiltration", "attack.t1041" ], "cves": [], "id": "7f3c1d2e-8b64-4a19-9c07-5e2ad84b1f36", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/npm-oauth-adapter-credential-egress.md" }, { "slug": "npm-omgvibe-config-wizard", "title": "NPM Supply Chain - omgvibe AI Tool Config Wizard Execution", "url": "https://www.netzilo.com/threats/npm-omgvibe-config-wizard", "severity": "high", "summary": "omgvibe is an npm package that presents itself as a setup wizard for AI coding assistants like CodeX and Claude Code. When run, it asks for API keys and auth tokens and reconfigures those tools to send traffic through a service called OhMyGPT instead of the vendor's own API.", "atlas": [], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial-access", "attack.t1195.002", "attack.execution", "attack.t1059.007", "attack.credential-access", "attack.t1552" ], "cves": [], "id": "7c1f3ab2-9d84-4e0a-bf35-2a6c8d41e9b7", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/npm-omgvibe-config-wizard.md" }, { "slug": "npm-smart-commit-host-agent-install", "title": "Supply Chain Package Acquisition - smart-commit-host-agent", "url": "https://www.netzilo.com/threats/npm-smart-commit-host-agent-install", "severity": "medium", "summary": "This rule watches for someone running a command that explicitly installs, fetches, or executes a specific npm package named smart-commit-host-agent, including obfuscated or typosquatted spellings of it. The package was flagged based on suspicious metadata, not because anyone has confirmed it does anything malicious.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial-access", "attack.execution", "attack.t1195.001" ], "cves": [], "id": "7c1e4a92-4b3d-4f8e-9a26-5d0f1b8c73ae", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/npm-smart-commit-host-agent-install.md" }, { "slug": "npm-trojan-claude-binary-package", "title": "Supply Chain Trojanized Claude Binary npm Package", "url": "https://www.netzilo.com/threats/npm-trojan-claude-binary-package", "severity": "high", "summary": "Attackers publish npm packages that look like legitimate platform-specific Claude Code binaries but are actually trojanized. If an AI agent or developer installs one, it downloads and runs an attacker-controlled native executable with full local privileges.", "atlas": [], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial_access", "attack.t1195.002", "attack.execution", "attack.t1059.007" ], "cves": [], "id": "7f3c1d92-4a6b-4e58-9c02-8ad51f6b3e47", "published": "2026-03-14", "modified": "2026-03-14", "markdown": "https://www.netzilo.com/threats/npm-trojan-claude-binary-package.md" }, { "slug": "oauth-token-exfil-subprocess", "title": "OAuth Token Abuse - Literal OAuth Token in Agent Subprocess Egress", "url": "https://www.netzilo.com/threats/oauth-token-exfil-subprocess", "severity": "high", "summary": "This detects an AI agent running a command-line tool like curl or wget where the command itself contains a real, working OAuth or API token instead of a variable reference. That means the token has already been exposed somewhere and is now being sent out over the network in plain text, which lets whoever intercepts or logs it reuse it to act as the agent or its user.", "atlas": [ { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.credential-access", "attack.t1528", "attack.exfiltration", "attack.t1567" ], "cves": [], "id": "6f1c9b74-3a5e-4d2c-9b41-8e0d7a2c5f13", "published": "2026-03-01", "modified": "2026-03-01", "markdown": "https://www.netzilo.com/threats/oauth-token-exfil-subprocess.md" }, { "slug": "obsidian-reader-hardlink-traversal", "title": "Path Traversal - llama_index ObsidianReader Hardlink Staging", "url": "https://www.netzilo.com/threats/obsidian-reader-hardlink-traversal", "severity": "high", "summary": "An application that uses the llama_index ObsidianReader to pull notes from an Obsidian vault into an AI's context can be tricked into reading files outside the vault. An attacker plants a hardlink or symlink inside the vault that actually points to a sensitive file like /etc/passwd or an SSH key, and the reader dereferences it, feeding the secret's contents into the LLM.", "atlas": [], "owasp": [ { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.credential-access", "attack.t1552.001", "attack.collection", "attack.t1005" ], "cves": [], "id": "7f3c2a94-1d6e-4b58-9a27-0c8d5e41b3f2", "published": "2026-03-01", "modified": "2026-03-01", "markdown": "https://www.netzilo.com/threats/obsidian-reader-hardlink-traversal.md" }, { "slug": "obsidianreader-symlink-arbitrary-read", "title": "ObsidianReader Symlink Traversal Arbitrary File Read", "url": "https://www.netzilo.com/threats/obsidianreader-symlink-arbitrary-read", "severity": "high", "summary": "Some tools that ingest Obsidian-style markdown vaults (such as llama_index's ObsidianReader) follow symbolic links without checking whether the linked file actually lives inside the vault folder. An attacker who can plant a symlink in the vault can make the ingestion process read credentials or secrets stored elsewhere on disk, and those contents get pulled into whatever the reader does next (indexing, embedding, summarizing, etc.).", "atlas": [], "owasp": [ { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.collection", "attack.t1005", "attack.credential-access", "attack.t1552.001" ], "cves": [], "id": "6f3b1c92-8a4d-4f57-9b21-7d0c5e4a18ab", "published": "2026-03-04", "modified": "2026-03-04", "markdown": "https://www.netzilo.com/threats/obsidianreader-symlink-arbitrary-read.md" }, { "slug": "open-webui-blind-ssrf", "title": "SSRF Open WebUI URL Loader Internal Target", "url": "https://www.netzilo.com/threats/open-webui-blind-ssrf", "severity": "high", "summary": "Open WebUI lets users hand it a URL to fetch content \u2014 web pages, YouTube transcripts, documents, plugins. An attacker with a valid account can abuse this to make the server fetch internal-only addresses instead, probing or reaching systems that should not be reachable from outside.", "atlas": [], "owasp": [], "attack": [ "attack.initial_access", "attack.t1190", "attack.discovery", "attack.t1046" ], "cves": [], "id": "7b3f1c42-9d18-4a76-b0e5-2c94f8d61a3e", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/open-webui-blind-ssrf.md" }, { "slug": "openclaw-claw-chain-full-sequence", "title": "Agent Skill Poisoning Chain Correlator", "url": "https://www.netzilo.com/threats/openclaw-claw-chain-full-sequence", "severity": "critical", "summary": "This rule catches a multi-step attack against AI agents that can install or fetch 'skills' (add-on capabilities). An attacker gets a malicious skill loaded from an external source, then uses the agent's access to read credentials and send them out to an attacker-controlled destination.", "atlas": [ { "id": "AML.T0110", "name": "AI Agent Tool Poisoning" }, { "id": "AML.T0098", "name": "AI Agent Tool Credential Harvesting" }, { "id": "AML.T0086", "name": "Exfiltration via AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "ASI02", "name": "Tool Misuse and Exploitation" } ], "attack": [ "attack.initial-access", "attack.execution", "attack.credential-access", "attack.exfiltration", "attack.lateral-movement" ], "cves": [ "CVE-2026-44112", "CVE-2026-44118" ], "id": "netzilo-agent-skill-poison-chain-001", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/openclaw-claw-chain-full-sequence.md" }, { "slug": "openclaw-cve-2026-44113-44112-sandbox-escape", "title": "CVE-2026-44113/44112 Sandbox Escape File Access", "url": "https://www.netzilo.com/threats/openclaw-cve-2026-44113-44112-sandbox-escape", "severity": "critical", "summary": "Two related flaws (CVE-2026-44113 and CVE-2026-44112) let a process escape the OpenClaw sandbox by exploiting a timing gap between a security check and the actual file access. This lets an attacker or compromised agent reach files outside the directory it was supposed to be confined to, either reading sensitive data or writing to unauthorized locations.", "atlas": [ { "id": "AML.T0105", "name": "Escape to Host" }, { "id": "AML.T0097", "name": "Virtualization/Sandbox Evasion" } ], "owasp": [ { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" } ], "attack": [ "attack.defense-impairment", "attack.t1036", "attack.credential-access" ], "cves": [ "CVE-2026-44112", "CVE-2026-44113" ], "id": "netzilo-cve-2026-44113-44112-001", "published": "2026-04-01", "modified": "2026-04-01", "markdown": "https://www.netzilo.com/threats/openclaw-cve-2026-44113-44112-sandbox-escape.md" }, { "slug": "openclaw-cve-2026-44115-heredoc-bypass", "title": "CVE-2026-44115 Heredoc Command Substitution Bypass", "url": "https://www.netzilo.com/threats/openclaw-cve-2026-44115-heredoc-bypass", "severity": "high", "summary": "OpenClaw checks the visible command a tool call uses, like 'cat', but does not look inside heredoc text blocks attached to that command. An attacker can hide a command substitution such as $(curl ... | bash) inside the heredoc body, so when the shell expands it, arbitrary code runs even though the outer command looked safe.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" }, { "id": "AML.T0050", "name": "Command and Scripting Interpreter" } ], "owasp": [ { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" }, { "id": "ASI02", "name": "Tool Misuse and Exploitation" } ], "attack": [ "attack.execution", "attack.t1059", "attack.defense-impairment", "attack.t1027" ], "cves": [ "CVE-2026-44115" ], "id": "netzilo-cve-2026-44115-001", "published": "2026-04-01", "modified": "2026-04-01", "markdown": "https://www.netzilo.com/threats/openclaw-cve-2026-44115-heredoc-bypass.md" }, { "slug": "openclaw-cve-2026-44118-owner-impersonation", "title": "CVE-2026-44118 Owner Impersonation via senderIsOwner", "url": "https://www.netzilo.com/threats/openclaw-cve-2026-44118-owner-impersonation", "severity": "critical", "summary": "Older versions of OpenClaw (before 2026.4.22) trust a simple flag called senderIsOwner=true without checking who actually sent it, as long as the connection comes from the same machine (loopback). Any process running locally can set this flag and be treated as the gateway owner, gaining elevated privileges it shouldn't have.", "atlas": [ { "id": "AML.T0049", "name": "Exploit Public-Facing Application" } ], "owasp": [ { "id": "ASI03", "name": "Identity and Impersonation" }, { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" } ], "attack": [ "attack.privilege-escalation", "attack.t1548", "attack.lateral-movement" ], "cves": [ "CVE-2026-44118" ], "id": "netzilo-cve-2026-44118-001", "published": "2026-04-01", "modified": "2026-04-01", "markdown": "https://www.netzilo.com/threats/openclaw-cve-2026-44118-owner-impersonation.md" }, { "slug": "openclaw-dangerous-exec", "title": "OpenClaw Remote Code Execution via Piped Script Download", "url": "https://www.netzilo.com/threats/openclaw-dangerous-exec", "severity": "critical", "summary": "An attacker hides instructions inside content an AI agent processes, causing the agent to fetch a script from the internet and run it immediately by piping it into a shell interpreter. This lets the attacker execute arbitrary code on whatever system the agent is operating on.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" }, { "id": "AML.T0050", "name": "Command and Scripting Interpreter" } ], "owasp": [ { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1059", "attack.stealth" ], "cves": [], "id": "76eb614c-cea3-5aaa-ae79-aeb242cb1f12", "published": "2026-02-07", "modified": "2026-02-24", "markdown": "https://www.netzilo.com/threats/openclaw-dangerous-exec.md" }, { "slug": "openclaw-mcp-manipulation", "title": "MCP Server, Plugin or Skill Installed Outside a Tool Call", "url": "https://www.netzilo.com/threats/openclaw-mcp-manipulation", "severity": "medium", "summary": "AI agents normally register new server configs, plugins, or skills through a visible tool call that gets logged. This detects the same kind of configuration file appearing on disk through a different route - a script the agent generated and ran, a package installer's postinstall hook, or a direct download into a config folder - where no tool call ever shows what happened.", "atlas": [ { "id": "AML.T0081", "name": "Modify AI Agent Configuration" }, { "id": "AML.T0110", "name": "AI Agent Tool Poisoning" } ], "owasp": [ { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.persistence", "attack.t1543", "attack.initial-access", "attack.t1195.002" ], "cves": [], "id": "c6651188-df04-513f-a86f-35f898b4e92a", "published": "2026-02-26", "modified": "2026-08-03", "markdown": "https://www.netzilo.com/threats/openclaw-mcp-manipulation.md" }, { "slug": "openclaw-memory-file-manipulation", "title": "OpenClaw Memory File Manipulation", "url": "https://www.netzilo.com/threats/openclaw-memory-file-manipulation", "severity": "high", "summary": "This detects an attacker (or a compromised process) writing hidden or manipulative instructions into an OpenClaw agent's memory or context file. Because agents reload these files at the start of every session, a single successful write plants a hijack that survives restarts and doesn't show up in normal prompt monitoring.", "atlas": [ { "id": "AML.T0051.002", "name": "Triggered" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM04", "name": "Data and Model Poisoning" } ], "attack": [ "attack.persistence", "attack.t1565.001" ], "cves": [], "id": "7c1f4a3e-9b62-4d51-8f0a-2e6d3b7c58a1", "published": "2026-03-14", "modified": "2026-03-14", "markdown": "https://www.netzilo.com/threats/openclaw-memory-file-manipulation.md" }, { "slug": "openclaw-network-exfiltration", "title": "OpenClaw Data Exfiltration via Network Upload", "url": "https://www.netzilo.com/threats/openclaw-network-exfiltration", "severity": "medium", "summary": "This detects when an OpenClaw AI agent runs commands like curl POST or wget --post to send data out to a remote server. That pattern can mean the agent is being used, tricked, or hijacked into sending sensitive files, code, or credentials somewhere outside the organisation's control.", "atlas": [ { "id": "AML.T0086", "name": "Exfiltration via AI Agent Tool Invocation" }, { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.exfiltration", "attack.t1048" ], "cves": [], "id": "d6e3b11d-4b06-5574-8802-1c28bd4dd2db", "published": "2026-02-07", "modified": "2026-02-24", "markdown": "https://www.netzilo.com/threats/openclaw-network-exfiltration.md" }, { "slug": "openclaw-obfuscated-execution", "title": "OpenClaw Obfuscated Dangerous Execution Chain", "url": "https://www.netzilo.com/threats/openclaw-obfuscated-execution", "severity": "high", "summary": "This detects an attack technique nicknamed OpenClaw, where an AI agent is manipulated into executing a command whose real intent is hidden using invisible Unicode characters, text-encoded escape sequences, or terminal control codes. The hidden payload only becomes clear once the command actually runs and does something harmful.", "atlas": [ { "id": "AML.T0048", "name": "External Harms" } ], "owasp": [], "attack": [ "attack.execution", "attack.defense-evasion", "attack.t1059", "attack.t1027" ], "cves": [], "id": "4b1f7d02-9c3a-4f6e-8a51-2d7e6c0b9af3", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/openclaw-obfuscated-execution.md" }, { "slug": "openclaw-prompt-injection", "title": "Injected Instructions in Tool Output Followed by Compliance", "url": "https://www.netzilo.com/threats/openclaw-prompt-injection", "severity": "high", "summary": "An AI agent that reads web pages, files, or other tool output can be tricked if that content secretly contains instructions written for the AI itself. If the agent then acts on those hidden instructions instead of the user's original request, it has been hijacked through its own tools.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" } ], "attack": [ "attack.initial-access", "attack.t1566", "attack.stealth" ], "cves": [], "id": "109b3a23-92b2-529f-b77c-8d4dd88f7e66", "published": "2026-02-26", "modified": "2026-08-03", "markdown": "https://www.netzilo.com/threats/openclaw-prompt-injection.md" }, { "slug": "openclaw-session-spawn-abuse", "title": "OpenClaw Stealth Agent Session Spawn", "url": "https://www.netzilo.com/threats/openclaw-session-spawn-abuse", "severity": "high", "summary": "This detects an attacker (or misbehaving automation) starting an AI coding-agent CLI in a mode that skips approval prompts, while also detaching it from the terminal or silencing its output and logs. The combination hides an unattended, self-approving agent session from the human operator and from the vendor's telemetry.", "atlas": [ { "id": "AML.T0059", "name": "Erode Dataset Integrity" } ], "owasp": [ { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.defense-evasion", "attack.execution", "attack.t1059.004", "attack.t1564.003", "attack.t1562.001" ], "cves": [], "id": "7f3c1d02-9a4e-4b61-8c27-5d0e6ab91f4c", "published": "2026-03-14", "modified": "2026-03-14", "markdown": "https://www.netzilo.com/threats/openclaw-session-spawn-abuse.md" }, { "slug": "openclaw-suspicious-file-write", "title": "OpenClaw Suspicious File Write to Sensitive Paths", "url": "https://www.netzilo.com/threats/openclaw-suspicious-file-write", "severity": "high", "summary": "This rule flags an AI coding or automation agent when it writes to files that control what runs automatically on a system \u2014 things like shell startup scripts, cron jobs, systemd services, LaunchAgents, or SSH authorized_keys. Writing to these locations is a classic way to make malicious code persist after a reboot or session ends.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" }, { "id": "AML.T0081", "name": "Modify AI Agent Configuration" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.persistence", "attack.t1546", "attack.t1053" ], "cves": [], "id": "db43664e-2408-5e70-9b63-dcb0fabc8c5f", "published": "2026-02-07", "modified": "2026-06-02", "markdown": "https://www.netzilo.com/threats/openclaw-suspicious-file-write.md" }, { "slug": "openclaw-suspicious-file-write-periodic", "title": "OpenClaw Suspicious File Write to Sensitive Paths (EDR Graph)", "url": "https://www.netzilo.com/threats/openclaw-suspicious-file-write-periodic", "severity": "high", "summary": "An AI agent (or a subprocess it spawned) writes to sensitive file paths on disk. This particular check catches writes that only show up in operating-system level monitoring, meaning they were made by a subprocess or in a way that bypassed the agent's own tool-call logging.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" }, { "id": "AML.T0081", "name": "Modify AI Agent Configuration" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" } ], "attack": [ "attack.persistence", "attack.t1546", "attack.t1053" ], "cves": [], "id": "db43664e-2408-5e70-9b63-dcb0fabc8c5f-p", "published": "2026-06-02", "modified": "2026-06-02", "markdown": "https://www.netzilo.com/threats/openclaw-suspicious-file-write-periodic.md" }, { "slug": "openmanus-python-execute-os-injection", "title": "OpenManus Prompt-Handler OS Command Injection via python_execute", "url": "https://www.netzilo.com/threats/openmanus-python-execute-os-injection", "severity": "high", "summary": "OpenManus is an open-source AI agent framework. It has an unpatched flaw where text an attacker feeds into its Prompt Handler gets passed to a Python execution tool without sanitization, letting that text run arbitrary operating-system commands. This detection catches the exploit actually being carried out, not just the presence of vulnerable code.", "atlas": [], "owasp": [], "attack": [ "attack.execution", "attack.t1059", "attack.t1059.004", "attack.t1059.006" ], "cves": [], "id": "7b3f2c9e-5a41-4d8b-9f16-2c0d84e7a153", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/openmanus-python-execute-os-injection.md" }, { "slug": "operator-browser-injection-egress", "title": "Browser Agent Injection-Driven Covert Egress", "url": "https://www.netzilo.com/threats/operator-browser-injection-egress", "severity": "high", "summary": "This detects a suspicious pattern in AI browser agents (like ChatGPT Operator) where the agent, after reading content from several websites, suddenly sends a large chunk of encoded data to a brand-new destination it has never contacted before. That pattern matches what would happen if hidden instructions planted on a webpage tricked the agent into stealing data and sending it out.", "atlas": [ { "id": "AML.T0051.000", "name": "Direct" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.exfiltration", "attack.t1567" ], "cves": [], "id": "7c4e9a1d-3f2b-4d86-9a0e-52b7c1d84f63", "published": "2026-06-08", "modified": "2026-06-08", "markdown": "https://www.netzilo.com/threats/operator-browser-injection-egress.md" }, { "slug": "persistence", "title": "Persistence Mechanism Installation", "url": "https://www.netzilo.com/threats/persistence", "severity": "high", "summary": "This rule watches for an AI agent's command execution or file-editing tools being used to create mechanisms that run code automatically at startup or on a schedule. These mechanisms \u2014 cron jobs, launchd agents, systemd units, or shell profile edits \u2014 are a standard way attackers keep access to a system after their initial foothold.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" }, { "id": "AML.T0050", "name": "Command and Scripting Interpreter" } ], "owasp": [ { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.persistence", "attack.t1053", "attack.t1543", "attack.t1546" ], "cves": [], "id": "d12c1b8c-4ee7-5548-947b-a1627bdc98dc", "published": "2026-01-25", "modified": "2026-06-02", "markdown": "https://www.netzilo.com/threats/persistence.md" }, { "slug": "persistence-authorized-keys-path-hijack", "title": "Agent File-Edit Persistence \u2014 SSH Authorized Keys / Shell Startup PATH Hijack", "url": "https://www.netzilo.com/threats/persistence-authorized-keys-path-hijack", "severity": "high", "summary": "This rule catches an AI agent being used to write persistence backdoors onto a system: either dropping a hidden SSH key into a user's authorized_keys file, or rigging a shell startup file so a world-writable folder like /tmp gets searched before normal system directories. Both tricks let an attacker regain access or hijack commands later without needing to break in again.", "atlas": [ { "id": "AML.T0055", "name": "Unsecured Credentials" } ], "owasp": [ { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.persistence", "attack.t1098.004", "attack.t1546.004", "attack.t1574.007" ], "cves": [], "id": "7c3f1a2e-9b64-4d51-8ae7-2f0c6d3b5a19", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/persistence-authorized-keys-path-hijack.md" }, { "slug": "persistence-mechanism-install", "title": "Agent Persistence Mechanism Installation", "url": "https://www.netzilo.com/threats/persistence-mechanism-install", "severity": "high", "summary": "This detects an AI coding or automation agent making a change that would let code or a user survive a reboot or logout \u2014 things like cron jobs, systemd services, shell startup files, launchd agents, or new admin accounts. It flags the action itself, not whether it was malicious, so every such change gets logged and can be reviewed.", "atlas": [ { "id": "AML.T0050", "name": "Command and Scripting Interpreter" } ], "owasp": [ { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.persistence", "attack.t1053.003", "attack.t1543", "attack.t1546.004", "attack.t1136.001" ], "cves": [], "id": "7c3f9a41-2d5e-4b86-9f0a-1e6d4c8b52f3", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/persistence-mechanism-install.md" }, { "slug": "persistence-periodic", "title": "Persistence Mechanism Installation (EDR Graph)", "url": "https://www.netzilo.com/threats/persistence-periodic", "severity": "high", "summary": "This detection watches for files being written to the specific system locations that let a program run automatically, such as at startup or on a schedule. Attackers use these locations to make sure their malicious code survives a reboot or keeps running without further action.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" }, { "id": "AML.T0050", "name": "Command and Scripting Interpreter" } ], "owasp": [ { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.persistence", "attack.t1053", "attack.t1543" ], "cves": [], "id": "d12c1b8c-4ee7-5548-947b-a1627bdc98dc-p", "published": "2026-06-02", "modified": "2026-06-02", "markdown": "https://www.netzilo.com/threats/persistence-periodic.md" }, { "slug": "persistence-scheduler-shellinit-account", "title": "Agent Persistence via Scheduler, Shell Init or Account Manipulation", "url": "https://www.netzilo.com/threats/persistence-scheduler-shellinit-account", "severity": "high", "summary": "This rule flags when an AI agent's own actions plant something that survives a reboot or re-login \u2014 a scheduled task, a system service, a script hidden in shell startup files, or a new user account. These are classic ways attackers keep access to a machine after the initial compromise.", "atlas": [ { "id": "AML.T0050", "name": "Command and Scripting Interpreter" } ], "owasp": [ { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.persistence", "attack.privilege-escalation", "attack.t1053.003", "attack.t1053.004", "attack.t1543.002", "attack.t1546.004", "attack.t1136.001" ], "cves": [], "id": "3f0c8a1e-6b24-4d97-9c5f-2a71e8d4b063", "published": "2026-03-14", "modified": "2026-03-14", "markdown": "https://www.netzilo.com/threats/persistence-scheduler-shellinit-account.md" }, { "slug": "pii-credit-card-ssn-redact", "title": "PII Credit Card and SSN Redaction", "url": "https://www.netzilo.com/threats/pii-credit-card-ssn-redact", "severity": "critical", "summary": "This rule watches text flowing through an AI agent for full credit card numbers (Visa, Mastercard, Amex, Discover) and US Social Security Numbers. When it finds one, it redacts everything except the last four digits before the content is shown, stored, or passed along.", "atlas": [ { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration" ], "cves": [], "id": "netzilo-pii-cc-ssn-redact-001", "published": "2026-03-01", "modified": "2026-03-01", "markdown": "https://www.netzilo.com/threats/pii-credit-card-ssn-redact.md" }, { "slug": "play-console-mcp-privileged-api-sweep", "title": "Play Console MCP Privileged API Sweep", "url": "https://www.netzilo.com/threats/play-console-mcp-privileged-api-sweep", "severity": "medium", "summary": "This rule flags a single automation session that uses the Google Play Developer API to touch multiple sensitive areas at once \u2014 account permissions, pricing/refunds, or resource deletion \u2014 within a ten-minute window. Normal release pipelines stay narrow; this pattern is broad and crosses unrelated business domains, which is the signal being reported.", "atlas": [], "owasp": [ { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.persistence", "attack.t1098", "attack.impact", "attack.t1565" ], "cves": [], "id": "7f3c1e2a-9b64-4d18-8c5f-2a71d0e4b93c", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/play-console-mcp-privileged-api-sweep.md" }, { "slug": "privilege-escalation", "title": "Privilege Escalation Attempt", "url": "https://www.netzilo.com/threats/privilege-escalation", "severity": "high", "summary": "This rule watches for common Linux techniques used to gain root-level access: running sudo, flipping the setuid bit on files, changing file ownership to root, or granting Linux capabilities to a binary. These are standard steps attackers take after getting a foothold on a machine, to turn limited access into full control.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" }, { "id": "AML.T0050", "name": "Command and Scripting Interpreter" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" } ], "attack": [ "attack.privilege-escalation", "attack.t1548" ], "cves": [], "id": "ecc81ba6-4c08-5171-845b-e65daf432843", "published": "2026-02-04", "modified": "2026-02-24", "markdown": "https://www.netzilo.com/threats/privilege-escalation.md" }, { "slug": "proc-memory-read", "title": "Process Memory Read via /proc Filesystem", "url": "https://www.netzilo.com/threats/proc-memory-read", "severity": "critical", "summary": "Attackers can pull live secrets \u2014 AWS/GCP tokens, Kubernetes service-account credentials \u2014 straight out of a running process's memory instead of hunting for them in files on disk. This is done by reading special files under Linux's /proc filesystem (or /dev/mem) that expose a process's memory, environment variables, and open file handles.", "atlas": [ { "id": "AML.T0090", "name": "OS Credential Dumping" }, { "id": "AML.T0055", "name": "Unsecured Credentials" }, { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.collection", "attack.t1005" ], "cves": [], "id": "bcc3f1fe-0c5f-53d3-b7a4-0639619810be", "published": "2026-03-30", "modified": "2026-08-03", "markdown": "https://www.netzilo.com/threats/proc-memory-read.md" }, { "slug": "prompt-injection-agentic-coding-assistant", "title": "Prompt Injection Payload In Agentic Coding Assistant Input", "url": "https://www.netzilo.com/threats/prompt-injection-agentic-coding-assistant", "severity": "high", "summary": "This detects text designed to hijack AI coding assistants like Claude Code, Copilot, Cursor, Codex, Aider or Windsurf, tricking them into running attacker-chosen commands. The malicious text is hidden in places the assistant reads automatically, such as code comments, fetched files, or results returned by other tools.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access", "attack.execution", "attack.t1059", "attack.t1552" ], "cves": [], "id": "7b3c1e52-9a4d-4f18-8c61-2d5f0ab7e934", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/prompt-injection-agentic-coding-assistant.md" }, { "slug": "prompt-injection-direct", "title": "Direct Prompt Injection Attempt", "url": "https://www.netzilo.com/threats/prompt-injection-direct", "severity": "critical", "summary": "This detects attempts to trick an AI agent into ignoring its safety instructions by typing commands directly into a chat or input field. Attackers use known jailbreak phrases and fake 'system override' language to try to make the AI act outside its intended rules.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" }, { "id": "AML.T0068", "name": "LLM Prompt Obfuscation" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" } ], "attack": [ "attack.initial-access", "attack.t1190", "attack.stealth", "attack.t1027" ], "cves": [], "id": "eddcdc94-698c-577f-900d-28b1b5491a80", "published": "2026-02-16", "modified": "2026-02-24", "markdown": "https://www.netzilo.com/threats/prompt-injection-direct.md" }, { "slug": "prompt-injection-evasion", "title": "Prompt Injection Evasion Technique Detection", "url": "https://www.netzilo.com/threats/prompt-injection-evasion", "severity": "critical", "summary": "This rule catches attempts to sneak malicious instructions past an AI agent by hiding them using text tricks rather than plain language. It looks for specific technical patterns that almost never occur in normal content, so alerts are highly reliable.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0068", "name": "LLM Prompt Obfuscation" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.stealth", "attack.t1027", "attack.initial-access", "attack.t1190" ], "cves": [], "id": "f2e8d341-7b9a-4c6f-a1e3-0d8b5c7f2e91", "published": "2026-06-03", "modified": "2026-06-03", "markdown": "https://www.netzilo.com/threats/prompt-injection-evasion.md" }, { "slug": "prompt-injection-exfil", "title": "Markdown Image Exfiltration Pattern", "url": "https://www.netzilo.com/threats/prompt-injection-exfil", "severity": "critical", "summary": "An AI system's output includes a markdown image tag whose URL contains encoded chunks of data. When a chat client or renderer fetches that image, it silently sends the encoded data to an attacker-controlled server just by loading the image.", "atlas": [ { "id": "AML.T0057", "name": "LLM Data Leakage" }, { "id": "AML.T0077", "name": "LLM Response Rendering" } ], "owasp": [ { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration", "attack.t1041", "attack.t1048" ], "cves": [], "id": "e6e58cd1-d05a-5512-b3fb-3b6a38784ad9", "published": "2026-02-16", "modified": "2026-02-24", "markdown": "https://www.netzilo.com/threats/prompt-injection-exfil.md" }, { "slug": "prompt-injection-indirect", "title": "Indirect Prompt Injection in Retrieved Content", "url": "https://www.netzilo.com/threats/prompt-injection-indirect", "severity": "high", "summary": "AI agents that read web pages, documents, or other external content can be manipulated by text that isn't meant to be seen by humans. Attackers hide commands using invisible CSS, disguised Unicode characters, or fake system-prompt formatting, hoping the AI agent will read and obey them instead of its actual user.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0068", "name": "LLM Prompt Obfuscation" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" } ], "attack": [ "attack.persistence", "attack.t1546", "attack.stealth", "attack.t1564" ], "cves": [], "id": "24bc5b40-f601-5055-aa6d-0252c7a23a36", "published": "2026-02-16", "modified": "2026-06-02", "markdown": "https://www.netzilo.com/threats/prompt-injection-indirect.md" }, { "slug": "public-port-exposure-tunnel", "title": "Port Exposure - Agent Publishes Local Service via Public Tunnel", "url": "https://www.netzilo.com/threats/public-port-exposure-tunnel", "severity": "high", "summary": "An AI coding agent can be manipulated into running tunnel tools like ngrok or cloudflared, making a local development server, database, or admin panel reachable from the public internet. The trigger is often hidden instructions planted in content the agent reads, such as an issue comment or a web page.", "atlas": [ { "id": "AML.T0015", "name": "Evade AI Model" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.command-and-control", "attack.t1572", "attack.persistence", "attack.t1133" ], "cves": [], "id": "7c1f0a3e-9d24-4f6b-b8a1-2e5c7d09f431", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/public-port-exposure-tunnel.md" }, { "slug": "pypi-agents-browser-install", "title": "Supply Chain PyPI agents-browser Install or Execution", "url": "https://www.netzilo.com/threats/pypi-agents-browser-install", "severity": "medium", "summary": "This rule watches for any command that installs, downloads, or runs a Python package called agents-browser (also written agents_browser or agents.browser). It's a reporting/triage signal flagging a package name of concern, not proof that a system has been compromised.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial-access", "attack.t1195.002", "attack.execution", "attack.t1059.006" ], "cves": [], "id": "7c3f9a41-2d5e-4b18-9f6a-0e83c4d7b512", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/pypi-agents-browser-install.md" }, { "slug": "pypi-agentrisk-base-v1-supply-chain", "title": "Supply Chain Suspicious PyPI Package agentrisk-base-v1", "url": "https://www.netzilo.com/threats/pypi-agentrisk-base-v1-supply-chain", "severity": "medium", "summary": "This rule watches for any mention of the package name agentrisk-base-v1 (and its spelling variants) appearing alongside an install command, dependency file, or PyPI URL. It flags that an AI agent or automated process tried to pull this specific package into a workspace, not that installation actually succeeded or that the package is confirmed malicious.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial-access", "attack.t1195.002" ], "cves": [], "id": "7b3f1c2e-9d84-4a16-b0f5-3c8e21d47a95", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/pypi-agentrisk-base-v1-supply-chain.md" }, { "slug": "pypi-agsearch-session-harvest", "title": "Supply Chain - agsearch PyPI Session History Harvester", "url": "https://www.netzilo.com/threats/pypi-agsearch-session-harvest", "severity": "high", "summary": "agsearch is a PyPI package that searches through saved conversation history from Claude Code and Codex CLI. Because those histories often contain pasted passwords, API keys, private code and internal hostnames, installing or running this tool is really a way to mine past sessions for credentials rather than a normal developer utility.", "atlas": [], "owasp": [], "attack": [ "attack.initial_access", "attack.t1195.001", "attack.collection", "attack.t1005", "attack.credential_access", "attack.t1552.001", "attack.exfiltration", "attack.t1041" ], "cves": [], "id": "7b3c9e14-2f5a-4d61-9c8e-3a6f2b0d94e7", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/pypi-agsearch-session-harvest.md" }, { "slug": "pypi-ankora-memory-supply-chain", "title": "Supply Chain PyPI ankora-memory Acquisition", "url": "https://www.netzilo.com/threats/pypi-ankora-memory-supply-chain", "severity": "high", "summary": "ankora-memory is a PyPI package advertised as persistent-memory tooling for AI coding agents, but it has been identified as a way to smuggle malicious code into agent environments. This detection flags when an AI agent actually installs, imports, pins, or downloads this package, rather than just mentioning it in text.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial-access", "attack.t1195.002" ], "cves": [], "id": "7c3f5a91-2d64-4e0b-9a58-6f1c8b40d2e7", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/pypi-ankora-memory-supply-chain.md" }, { "slug": "pypi-chad-code-supply-chain", "title": "Supply Chain Suspicious PyPI Package chad-code Install or Invocation", "url": "https://www.netzilo.com/threats/pypi-chad-code-supply-chain", "severity": "medium", "summary": "A PyPI package named chad-code markets itself as a Claude-Code-style coding agent for Apple Silicon, trading on the reputation of a trusted AI coding tool. This rule flags when an agent installs, downloads, pins, or runs that package \u2014 it does not claim the package is malicious, only that its name and branding are suspicious enough to track.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial-access", "attack.t1195.002", "attack.execution" ], "cves": [], "id": "7f3b1c92-4d8a-4e61-9b2f-0c5a6d31e4af", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/pypi-chad-code-supply-chain.md" }, { "slug": "pypi-claude-multirepo-sync-config-exfil", "title": "Supply Chain - Malicious PyPI Package claude-multirepo-sync / Claude Config Exfil", "url": "https://www.netzilo.com/threats/pypi-claude-multirepo-sync-config-exfil", "severity": "high", "summary": "A rogue package named claude-multirepo-sync installs itself and then reads Claude Code's saved API keys and settings files, sending them to an attacker over the network. The detection also catches the same theft pattern even if it comes from a different, unnamed tool.", "atlas": [], "owasp": [], "attack": [ "attack.initial-access", "attack.t1195.002", "attack.credential-access", "attack.t1552.001", "attack.exfiltration", "attack.t1041" ], "cves": [], "id": "9c2b7d14-6a3f-4b58-9e07-2f1d84c5a3be", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/pypi-claude-multirepo-sync-config-exfil.md" }, { "slug": "pypi-dazzle-claude-config", "title": "Malicious PyPI Package dazzle-claude-config", "url": "https://www.netzilo.com/threats/pypi-dazzle-claude-config", "severity": "high", "summary": "A package on PyPI called dazzle-claude-config pretends to sync Claude Code configuration but instead reads a victim's local Claude settings, rewrites them, and pulls down further attacker code from GitHub. This is a supply-chain attack: it only works if someone installs the package.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" }, { "id": "AML.T0011", "name": "User Execution" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.initial-access", "attack.t1195.002", "attack.execution", "attack.t1059.006" ], "cves": [], "id": "7f3c1e58-9a2d-4b61-8e04-6d5c2a7f91b3", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/pypi-dazzle-claude-config.md" }, { "slug": "pypi-fabric-dw-supply-chain", "title": "Supply Chain Named IOC - PyPI fabric-dw Package Acquisition or Execution", "url": "https://www.netzilo.com/threats/pypi-fabric-dw-supply-chain", "severity": "high", "summary": "A PyPI package called fabric-dw pretends to be official Microsoft Fabric tooling but actually registers itself as an MCP server, giving an attacker a foothold inside an AI agent's tool set. This rule watches for the package being installed, run, or downloaded.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial-access", "attack.t1195", "attack.t1195.002", "attack.execution", "attack.t1059.006" ], "cves": [], "id": "b7f3a1d2-9c4e-4a58-8e1b-6d2f0c9a5e34", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/pypi-fabric-dw-supply-chain.md" }, { "slug": "pypi-game-true402-masquerade", "title": "Supply Chain \u2014 Masquerading PyPI Package game-true402 Acquisition", "url": "https://www.netzilo.com/threats/pypi-game-true402-masquerade", "severity": "high", "summary": "A PyPI package named game-true402 (and variants like game_true402) poses as a payment and safety-check tool for Base-chain AI agents. It's designed to trick developers into handing over wallet private keys, RPC credentials, and API tokens.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial-access", "attack.t1195.002", "attack.execution", "attack.t1059.006" ], "cves": [], "id": "6f2b9c14-8d3e-4a71-9b5c-0e7a2f4d61c8", "published": "2026-03-05", "modified": "2026-03-05", "markdown": "https://www.netzilo.com/threats/pypi-game-true402-masquerade.md" }, { "slug": "pypi-malicious-package-git-a2a", "title": "Malicious PyPI Package git-a2a Installed or Executed", "url": "https://www.netzilo.com/threats/pypi-malicious-package-git-a2a", "severity": "medium", "summary": "A PyPI package named git-a2a (and variants git_a2a, git.a2a) has been identified as malicious. This rule flags command-line activity that installs or runs that package.", "atlas": [], "owasp": [], "attack": [ "attack.initial-access", "attack.t1195.002", "attack.execution", "attack.t1059.006" ], "cves": [], "id": "7f3c1d64-2a95-4b0e-9c88-1e6d4a5b7c02", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/pypi-malicious-package-git-a2a.md" }, { "slug": "pypi-minia-telegram-supply-chain", "title": "PyPI Supply Chain Acquisition - minia-telegram", "url": "https://www.netzilo.com/threats/pypi-minia-telegram-supply-chain", "severity": "high", "summary": "This rule flags attempts to download or install a Python package called minia-telegram, or names that look like typosquats of it, using common tools like pip, pipx, uv, poetry, pdm or conda. The package is suspected to be trojanized, meaning it may run malicious code during installation.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial-access", "attack.t1195.002", "attack.execution", "attack.t1059.006" ], "cves": [], "id": "7b3f1c2e-9d4a-4f61-b8e5-2a6c0d5e94f7", "published": "2026-06-14", "modified": "2026-06-14", "markdown": "https://www.netzilo.com/threats/pypi-minia-telegram-supply-chain.md" }, { "slug": "pypi-minia-voice-supply-chain", "title": "Supply Chain PyPI Voice Bridge Package Install (minia-voice)", "url": "https://www.netzilo.com/threats/pypi-minia-voice-supply-chain", "severity": "medium", "summary": "A PyPI package called minia-voice is advertised as a tool that reads an AI agent's final answers aloud through text-to-speech. Installing or importing it runs arbitrary code inside the agent's environment, giving that code visibility into every answer the agent produces.", "atlas": [], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial-access", "attack.t1195.002", "attack.execution", "attack.t1059.006" ], "cves": [], "id": "7b3f2c9e-5d41-4a8b-9c6e-2f0a71d84e35", "published": "2026-03-01", "modified": "2026-03-01", "markdown": "https://www.netzilo.com/threats/pypi-minia-voice-supply-chain.md" }, { "slug": "pypi-sandbox-cli-sdk-install", "title": "Supply Chain - PyPI Install of sandbox-cli-sdk", "url": "https://www.netzilo.com/threats/pypi-sandbox-cli-sdk-install", "severity": "medium", "summary": "This detects when an AI agent, or a process it started, runs a Python package manager to install or execute the package sandbox-cli-sdk. That package is a legitimate developer tool for running commands inside isolated containers, but it can also give an agent a quiet way to run code outside normal host monitoring.", "atlas": [], "owasp": [], "attack": [ "attack.initial-access", "attack.t1195.002", "attack.execution", "attack.t1059.006" ], "cves": [], "id": "4f3c9b2e-7d81-4a56-9c0f-2b6e5d18a7c3", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/pypi-sandbox-cli-sdk-install.md" }, { "slug": "pypi-sec-research-payload-chain", "title": "PyPI sec-research Post-Install Payload Chain", "url": "https://www.netzilo.com/threats/pypi-sec-research-payload-chain", "severity": "medium", "summary": "This rule watches for a specific pattern after an AI agent installs or runs the sec-research PyPI package: within 15 minutes, the same process tree touches credential files, runs obfuscated code, or installs persistence, plus does something else to confirm it's not incidental. It does not claim sec-research itself is malicious \u2014 only that this combination of behaviours around it is suspicious.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial-access", "attack.t1195.002", "attack.execution", "attack.t1059.006", "attack.credential-access", "attack.t1552.001" ], "cves": [], "id": "7b3c9d42-1f6a-4e58-9a0b-2c7d5e83f114", "published": "2026-06-08", "modified": "2026-06-08", "markdown": "https://www.netzilo.com/threats/pypi-sec-research-payload-chain.md" }, { "slug": "pypi-skcomms-supply-chain", "title": "Supply Chain PyPI skcomms Acquisition", "url": "https://www.netzilo.com/threats/pypi-skcomms-supply-chain", "severity": "medium", "summary": "This rule flags any attempt to download or install a Python package called 'skcomms', which has been reported as unvetted and possibly malicious. It's marketed as a communication library for AI agents, making it a plausible target for developers building agent-based systems.", "atlas": [], "owasp": [], "attack": [ "attack.initial-access", "attack.t1195.002", "attack.execution", "attack.t1059.006" ], "cves": [], "id": "7c1f4b2e-9a3d-4f68-b1c5-2e8d0a5f7364", "published": "2026-03-01", "modified": "2026-03-01", "markdown": "https://www.netzilo.com/threats/pypi-skcomms-supply-chain.md" }, { "slug": "pypi-skill-package-install", "title": "Supply Chain - AI Skill Package Install From PyPI", "url": "https://www.netzilo.com/threats/pypi-skill-package-install", "severity": "medium", "summary": "This rule watches for package installer commands (pip, uv, pipx, poetry, pdm, conda) that pull down Python packages designed to inject instructions into an AI agent's context. It flags both a specific named package reported as suspicious and any package whose name follows a pattern typical of these 'skill' add-ons.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial-access", "attack.t1195.002" ], "cves": [], "id": "7c3f1a9e-2b64-4d5e-9a17-8f0c6d43be21", "published": "2026-03-14", "modified": "2026-03-14", "markdown": "https://www.netzilo.com/threats/pypi-skill-package-install.md" }, { "slug": "pypi-supply-chain-install-exec", "title": "Supply Chain PyPI Install-Time Code Execution", "url": "https://www.netzilo.com/threats/pypi-supply-chain-install-exec", "severity": "high", "summary": "Some Python packages on PyPI don't just install files \u2014 they run extra commands during setup that download and execute more code, or install persistence, using the same permissions as the person running the install. This rule watches for that pattern right after a package install starts.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [], "attack": [ "attack.initial-access", "attack.execution", "attack.t1195.002", "attack.t1059" ], "cves": [], "id": "7b1e4c9a-2f3d-4a86-9c51-0e6d8b47af23", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/pypi-supply-chain-install-exec.md" }, { "slug": "pypi-tabella-enable-supply-chain", "title": "PyPI Supply Chain - tabella-enable Package Install or Artifact Fetch", "url": "https://www.netzilo.com/threats/pypi-tabella-enable-supply-chain", "severity": "medium", "summary": "A PyPI package called tabella-enable advertises AI-enablement features such as REST access, MCP tooling, and RAG vectorization. Because packages like this get installed directly into AI agent runtimes, code that runs at install time or import time can potentially reach MCP servers and model credentials before anyone reviews it.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial-access", "attack.execution", "attack.t1195.001" ], "cves": [], "id": "7c1f4a2e-9b83-4d6f-8e21-3af05c6b91d4", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/pypi-tabella-enable-supply-chain.md" }, { "slug": "pypi-tollbooth-dpyc-impersonation", "title": "Supply Chain PyPI Impersonation Package tollbooth-dpyc", "url": "https://www.netzilo.com/threats/pypi-tollbooth-dpyc-impersonation", "severity": "high", "summary": "This rule watches for any attempt to install or run a Python package called tollbooth-dpyc, which markets itself as a Bitcoin Lightning micropayment add-on for MCP servers. It flags the install/run command itself, not confirmed malicious behavior afterward.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial-access", "attack.t1195.002", "attack.execution", "attack.t1059.006" ], "cves": [], "id": "7c1f2a94-6b3d-4e58-9a02-5d8c31ef47b1", "published": "2026-03-01", "modified": "2026-03-01", "markdown": "https://www.netzilo.com/threats/pypi-tollbooth-dpyc-impersonation.md" }, { "slug": "pypi-vedang-cli-acquisition", "title": "Supply Chain Acquisition of PyPI Package vedang-cli", "url": "https://www.netzilo.com/threats/pypi-vedang-cli-acquisition", "severity": "medium", "summary": "This rule flags every time a machine installs, downloads, or runs a specific PyPI package called 'vedang-cli', which markets itself as an AI-agent and Web3 CLI tool with MCP-server features. It exists as a watch-list tripwire, not because the package has been confirmed malicious.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial-access", "attack.t1195.002" ], "cves": [], "id": "7b3f1c42-9d5e-4a86-b1f0-2c8e5d74a913", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/pypi-vedang-cli-acquisition.md" }, { "slug": "pypi-vedang-cli-install", "title": "Supply Chain Malicious PyPI Package vedang-cli Installation", "url": "https://www.netzilo.com/threats/pypi-vedang-cli-install", "severity": "high", "summary": "A package published on PyPI under the name vedang-cli (also seen as vedang_cli) markets itself as a toolkit for AI agents, MCP servers, and Web3 'agent readiness'. Installing it runs attacker code that can harvest environment variables, API keys, and cloud credentials from the machine, and from any AI agent system that later pulls the package in.", "atlas": [], "owasp": [], "attack": [ "attack.initial-access", "attack.t1195.002", "attack.execution", "attack.t1059.006", "attack.credential-access", "attack.t1552.001" ], "cves": [], "id": "9f3c1d7a-4b62-4e8f-a1c5-2d7b6e04f3ab", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/pypi-vedang-cli-install.md" }, { "slug": "python-download-exec", "title": "Python Download and Execute Remote Code", "url": "https://www.netzilo.com/threats/python-download-exec", "severity": "critical", "summary": "This detects a pattern where Python fetches code from a remote URL and executes it in the same step, instead of saving it to disk first. Attackers use this to run malicious code while avoiding detections that only watch for curl or wget downloads.", "atlas": [ { "id": "AML.T0050", "name": "Command and Scripting Interpreter" } ], "owasp": [ { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" } ], "attack": [ "attack.execution", "attack.t1059", "attack.command-and-control", "attack.t1105" ], "cves": [], "id": "5e6a3d2e-0983-5e22-9fb1-6cfc27baa291", "published": "2026-02-26", "modified": "2026-02-26", "markdown": "https://www.netzilo.com/threats/python-download-exec.md" }, { "slug": "python-eval-rce-sagemaker-llm-response", "title": "Python eval RCE Payload Execution (SagemakerLLM complete Injection)", "url": "https://www.netzilo.com/threats/python-eval-rce-sagemaker-llm-response", "severity": "high", "summary": "privateGPT's SagemakerLLM.complete() function takes the raw text response from an AWS SageMaker endpoint and runs it through Python's eval() to turn it into a dictionary. If an attacker controls or intercepts that endpoint response, they can embed Python code in it instead of a normal reply, and eval() will run that code inside the application.", "atlas": [ { "id": "AML.T0050", "name": "Command and Scripting Interpreter" } ], "owasp": [ { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.execution", "attack.t1059", "attack.t1059.006" ], "cves": [], "id": "b7f3a1c2-9d4e-4a6b-8f01-3c5e7d2a9b64", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/python-eval-rce-sagemaker-llm-response.md" }, { "slug": "rag-image-exfiltration", "title": "Zero-Click RAG Exfiltration via Image URL", "url": "https://www.netzilo.com/threats/rag-image-exfiltration", "severity": "critical", "summary": "An attacker hides instructions inside a document that an AI assistant later reads and summarizes (a RAG system). The hidden instructions tell the AI to take sensitive information from its context and stuff it into the query string of an image URL, so simply rendering the AI's response causes the browser to send that data to an attacker-controlled server.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0070", "name": "RAG Poisoning" }, { "id": "AML.T0077", "name": "LLM Response Rendering" } ], "owasp": [ { "id": "LLM02", "name": "Sensitive Information Disclosure" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.exfiltration", "attack.t1048" ], "cves": [], "id": "30d14136-6ae1-5194-bc34-ed23d62c8fdc", "published": "2026-03-16", "modified": "2026-03-16", "markdown": "https://www.netzilo.com/threats/rag-image-exfiltration.md" }, { "slug": "rce-injection", "title": "Remote Code Execution via Piped Script Download", "url": "https://www.netzilo.com/threats/rce-injection", "severity": "critical", "summary": "This detects an AI agent being manipulated into fetching a script from the internet and immediately executing it, without the script ever being reviewed. This is a common way prompt injection attacks turn a compromised agent into a full code execution foothold.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" }, { "id": "AML.T0050", "name": "Command and Scripting Interpreter" } ], "owasp": [ { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" } ], "attack": [ "attack.execution", "attack.t1059", "attack.stealth" ], "cves": [], "id": "c65a9620-e989-5a2c-b993-c81a6c049a84", "published": "2026-01-25", "modified": "2026-04-09", "markdown": "https://www.netzilo.com/threats/rce-injection.md" }, { "slug": "recon-then-exfil", "title": "Reconnaissance Tools Followed by Data Exfiltration", "url": "https://www.netzilo.com/threats/recon-then-exfil", "severity": "high", "summary": "This detects a pattern where an AI agent first inspects the filesystem and environment, then uses network tools to send data out. The sequencing suggests a deliberate two-stage attack: look around first, then exfiltrate what was found.", "atlas": [ { "id": "AML.T0089", "name": "Process Discovery" }, { "id": "AML.T0037", "name": "Data from Local System" }, { "id": "AML.T0025", "name": "Exfiltration via Cyber Means" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" } ], "attack": [ "attack.exfiltration", "attack.t1041", "attack.discovery", "attack.t1046" ], "cves": [], "id": "6222d663-59cc-549d-b0f5-34a787eb76aa", "published": "2026-03-18", "modified": "2026-03-18", "markdown": "https://www.netzilo.com/threats/recon-then-exfil.md" }, { "slug": "recursive-agent-loop-budget-exhaustion", "title": "Recursive Agent Loop and Token Budget Exhaustion", "url": "https://www.netzilo.com/threats/recursive-agent-loop-budget-exhaustion", "severity": "medium", "summary": "This detects an AI agent that repeatedly calls the same tool with the exact same arguments, very fast, without making any real progress. It's the signature of a runaway agent loop that wastes compute, API calls, or money without the attacker (or the agent's own logic) achieving anything new.", "atlas": [ { "id": "AML.T0034", "name": "Cost Harvesting" } ], "owasp": [ { "id": "ASI10", "name": "Resource Exhaustion and Denial of Wallet" } ], "attack": [ "attack.impact", "attack.t1499" ], "cves": [], "id": "6b1f2c9d-7a54-4de8-9c31-2f80a4d5e713", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/recursive-agent-loop-budget-exhaustion.md" }, { "slug": "repo-config-hook-injection", "title": "Agent Config Hook Injection via Repository Settings File", "url": "https://www.netzilo.com/threats/repo-config-hook-injection", "severity": "high", "summary": "AI coding assistants like Claude, Cursor, and similar tools read project-level configuration files when you open a repository. An attacker can plant a hook or auto-approval setting in one of these files so that when a victim opens the project, the agent runs an attacker-chosen command or auto-starts a malicious server before any trust prompt appears.", "atlas": [], "owasp": [], "attack": [ "attack.initial-access", "attack.persistence", "attack.execution", "attack.t1546", "attack.t1059" ], "cves": [ "CVE-2025-59536" ], "id": "7f3c1a9e-4b2d-4e88-9c15-2a6d0f83b1c7", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/repo-config-hook-injection.md" }, { "slug": "repo-settings-hook-injection", "title": "Agent Config Hook Injection Write", "url": "https://www.netzilo.com/threats/repo-settings-hook-injection", "severity": "high", "summary": "AI coding assistants like Claude Code, Cursor, and Gemini read project-level config files that can auto-run commands (\"hooks\") the moment a session starts, sometimes before any user consent prompt. This rule catches a child process writing one of these config files with a hook or auto-trust setting baked directly into the command line \u2014 a sign someone is planting or self-modifying a config to get code execution.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" }, { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.persistence", "attack.t1546", "attack.execution", "attack.t1059", "attack.t1195.001" ], "cves": [ "CVE-2025-59536" ], "id": "7c3f1d2a-9b48-4e61-8d5a-2f6c0b91ae34", "published": "2026-02-20", "modified": "2026-02-20", "markdown": "https://www.netzilo.com/threats/repo-settings-hook-injection.md" }, { "slug": "reverse-shell", "title": "Reverse Shell Attempt", "url": "https://www.netzilo.com/threats/reverse-shell", "severity": "critical", "summary": "This detects commands that try to open a remote, interactive shell connection back to an attacker-controlled machine. It watches for known reverse-shell patterns built with common tools like bash, python, perl, netcat (nc), and socat.", "atlas": [ { "id": "AML.T0072", "name": "Reverse Shell" } ], "owasp": [ { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" } ], "attack": [ "attack.execution", "attack.t1059", "attack.persistence", "attack.t1573" ], "cves": [], "id": "74dee137-ffb8-54c8-862f-4a98a61f63ee", "published": "2026-02-17", "modified": "2026-02-24", "markdown": "https://www.netzilo.com/threats/reverse-shell.md" }, { "slug": "reversible-anon-proxy-llm-relay", "title": "Reversible Anonymization Proxy Relaying Data To LLM Inference", "url": "https://www.netzilo.com/threats/reversible-anon-proxy-llm-relay", "severity": "high", "summary": "This detects a specific pattern: someone runs a tool that pseudonymizes data in a way that can be reversed, then shortly afterward the same machine sends data to an AI inference service. The concern is that 'anonymized' data sent this way isn't really anonymous \u2014 the mapping to re-identify it stays on the local machine, so the data can be un-masked later even though it just left the organization.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" }, { "id": "AML.T0025", "name": "Exfiltration via Cyber Means" } ], "owasp": [ { "id": "LLM02", "name": "Sensitive Information Disclosure" }, { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.exfiltration", "attack.t1567", "attack.t1195.001" ], "cves": [], "id": "6f1c9a52-3d84-4b7e-9c02-71ae5d4f8b13", "published": "2026-03-14", "modified": "2026-03-14", "markdown": "https://www.netzilo.com/threats/reversible-anon-proxy-llm-relay.md" }, { "slug": "rogue-http402-payment-settlement", "title": "Rogue HTTP-402 Payment Settlement to First-Seen Off-Origin Sink", "url": "https://www.netzilo.com/threats/rogue-http402-payment-settlement", "severity": "medium", "summary": "This detects a malicious AI agent payment library that reroutes the money-settlement step of an HTTP-402 (x402) crypto payment flow to an attacker-controlled server instead of the intended facilitator. It targets a known malicious PyPI package family (agents-u-cash) that advertises itself as payment middleware for AI agents.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial-access", "attack.t1195.001", "attack.impact", "attack.t1657" ], "cves": [], "id": "7b3f1c9a-4d2e-4f6b-9a08-5c1d2e3f4a6b", "published": "2026-06-01", "modified": "2026-06-01", "markdown": "https://www.netzilo.com/threats/rogue-http402-payment-settlement.md" }, { "slug": "roleplay-character-lock-jailbreak", "title": "Roleplay Character-Lock Jailbreak Delivered Via Tool Output", "url": "https://www.netzilo.com/threats/roleplay-character-lock-jailbreak", "severity": "high", "summary": "This detects a jailbreak trick where an AI agent picks up manipulative instructions not from the user, but from the results of a tool it called - like a webpage or file it fetched. The instructions try to lock the AI into a fictional 'actor' persona that supposedly never breaks character, a known method for bypassing safety refusals.", "atlas": [ { "id": "AML.T0054", "name": "LLM Jailbreak" }, { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.defense-evasion" ], "cves": [], "id": "7c1f4b9e-0a3d-4e62-9b18-5d6a2f8c41ad", "published": "2026-05-19", "modified": "2026-05-19", "markdown": "https://www.netzilo.com/threats/roleplay-character-lock-jailbreak.md" }, { "slug": "roo-code-workspace-config-write", "title": "Roo Code Workspace Config File Write (instance-resolved)", "url": "https://www.netzilo.com/threats/roo-code-workspace-config-write", "severity": "high", "summary": "Some AI coding assistants let a compromised or manipulated agent write files without the same safety checks applied to normal project config folders. This rule flags an agent session that writes a VS Code multi-root workspace file (*.code-workspace), which can be abused to plant commands that run automatically the next time the workspace is opened.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.persistence", "attack.t1546", "attack.execution", "attack.t1059" ], "cves": [], "id": "6f4c1d92-8a3b-4e57-9c21-b0d7e5a34f18", "published": "2026-03-05", "modified": "2026-03-05", "markdown": "https://www.netzilo.com/threats/roo-code-workspace-config-write.md" }, { "slug": "roo-npm-postinstall-rce", "title": "Auto-Approved Package Install Executes Postinstall Payload", "url": "https://www.netzilo.com/threats/roo-npm-postinstall-rce", "severity": "high", "summary": "Roo Code, an AI coding agent, can auto-approve package installs without human review. Attackers exploit this by pointing it at a malicious repository whose package.json contains a postinstall script that runs automatically during npm install, giving the attacker code execution on the developer's machine.", "atlas": [], "owasp": [], "attack": [ "attack.execution", "attack.t1059.004", "attack.initial-access", "attack.t1195.001", "attack.persistence", "attack.t1546" ], "cves": [], "id": "7f3c1d92-4a68-4f1e-9b0c-2d5e8a71c604", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/roo-npm-postinstall-rce.md" }, { "slug": "rule-of-two", "title": "Rule of Two \u2014 Exfiltration Chain Detection", "url": "https://www.netzilo.com/threats/rule-of-two", "severity": "critical", "summary": "This detects a pattern where an AI agent, within a short window of time, pulls in outside content, reads sensitive local data, and then sends data out externally. That combination is a known way to trick AI agents into stealing information and sending it to an attacker.", "atlas": [ { "id": "AML.T0086", "name": "Exfiltration via AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.exfiltration", "attack.collection", "attack.t1048" ], "cves": [], "id": "netzilo-rule-of-two-001", "published": "2026-03-01", "modified": "2026-06-02", "markdown": "https://www.netzilo.com/threats/rule-of-two.md" }, { "slug": "rules-file-backdoor", "title": "Hidden Unicode in Agent Instruction Files", "url": "https://www.netzilo.com/threats/rules-file-backdoor", "severity": "high", "summary": "Attackers can plant special Unicode characters \u2014 invisible spacing marks or text-direction overrides \u2014 inside files like CLAUDE.md or .cursorrules. A human reviewing the file in a normal editor or diff sees ordinary, harmless-looking instructions, but the AI agent reading the same file receives different, hidden text.", "atlas": [ { "id": "AML.T0081", "name": "Modify AI Agent Configuration" }, { "id": "AML.T0068", "name": "LLM Prompt Obfuscation" } ], "owasp": [ { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "ASI04", "name": "Memory and Context Poisoning" } ], "attack": [ "attack.persistence", "attack.t1546", "attack.stealth", "attack.t1564" ], "cves": [], "id": "78b34f4d-5fde-57a5-905d-00fd92ed359c", "published": "2026-03-30", "modified": "2026-08-03", "markdown": "https://www.netzilo.com/threats/rules-file-backdoor.md" }, { "slug": "rules-file-backdoor-periodic", "title": "Hidden Unicode in Agent Instruction Files (EDR Graph)", "url": "https://www.netzilo.com/threats/rules-file-backdoor-periodic", "severity": "medium", "summary": "AI coding agents read files like CLAUDE.md or .cursorrules for instructions. Attackers can hide invisible or misleading Unicode characters in these files to manipulate the agent's behavior, and this rule catches the case where that write happens indirectly, through a subprocess the agent itself spawned, rather than through the agent's own file-write tool call.", "atlas": [ { "id": "AML.T0081", "name": "Modify AI Agent Configuration" }, { "id": "AML.T0068", "name": "LLM Prompt Obfuscation" } ], "owasp": [ { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "ASI09", "name": "Traceability and Accountability Gaps" } ], "attack": [ "attack.persistence", "attack.t1546", "attack.stealth", "attack.t1564" ], "cves": [], "id": "78b34f4d-5fde-57a5-905d-00fd92ed359c-p", "published": "2026-08-03", "modified": "2026-08-03", "markdown": "https://www.netzilo.com/threats/rules-file-backdoor-periodic.md" }, { "slug": "rungpt-eval-command-injection", "title": "Python eval() Sink Exploitation - RunGptLLM Command Injection", "url": "https://www.netzilo.com/threats/rungpt-eval-command-injection", "severity": "high", "summary": "Some AI agent frameworks pass text returned by a language model straight into Python's eval() function. If an attacker controls that model output, they can smuggle in code disguised as a normal expression and get it to run with the same privileges as the agent.", "atlas": [], "owasp": [], "attack": [ "attack.execution", "attack.t1059.006" ], "cves": [], "id": "b3f7a91c-4d2e-4a06-9f18-6c5d0e83a1b7", "published": "2026-03-01", "modified": "2026-03-01", "markdown": "https://www.netzilo.com/threats/rungpt-eval-command-injection.md" }, { "slug": "scrapegraphai-llm-scrape-credential-harvest", "title": "ScrapeGraphAI Pipeline Inlined With Credential/PII Harvest Prompt", "url": "https://www.netzilo.com/threats/scrapegraphai-llm-scrape-credential-harvest", "severity": "medium", "summary": "This detects when someone spins up a ScrapeGraphAI web-scraping pipeline directly on the command line, rather than as part of a normal project, and pairs it with instructions telling the AI to pull passwords, login data, or personal information, or to ignore robots.txt and evade crawler blocking. Either behavior alone is common and ignored; together they suggest an improvised data-harvesting operation.", "atlas": [], "owasp": [ { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.collection", "attack.t1119", "attack.reconnaissance", "attack.t1594" ], "cves": [], "id": "4f2a9c1e-7b56-4d3a-9e1f-2c8b6d40a7f3", "published": "2026-03-04", "modified": "2026-03-04", "markdown": "https://www.netzilo.com/threats/scrapegraphai-llm-scrape-credential-harvest.md" }, { "slug": "scripting-tool-query-param-exfil", "title": "Scripting Tool Substitution - Query String Payload Exfiltration", "url": "https://www.netzilo.com/threats/scripting-tool-query-param-exfil", "severity": "medium", "summary": "An AI agent avoids monitored network commands by writing its own small script that sends data to a website, hiding the stolen information inside the web address itself rather than in the normal request body. This tactic is designed to slip past security tools that only inspect uploaded data, not URLs.", "atlas": [ { "id": "AML.T0025", "name": "Exfiltration via Cyber Means" } ], "owasp": [ { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration", "attack.t1567", "attack.execution", "attack.t1059.006" ], "cves": [], "id": "7f2c9d84-3b1e-4a6f-9c05-2d81e4b7a63c", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/scripting-tool-query-param-exfil.md" }, { "slug": "scripting-tool-substitution", "title": "Scripting Language Tool Substitution", "url": "https://www.netzilo.com/threats/scripting-tool-substitution", "severity": "high", "summary": "Attackers who can't run tools like curl, nmap, or nc directly (because they're blocked or monitored) fall back on writing small Python, Node.js, or Ruby scripts that do the same job. Since detection rules are often tied to specific tool names, this substitution can slip past them.", "atlas": [ { "id": "AML.T0050", "name": "Command and Scripting Interpreter" }, { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" } ], "attack": [ "attack.execution", "attack.t1059" ], "cves": [], "id": "ba8e8ccf-b67b-5c55-8054-b55a52f51aa3", "published": "2026-02-26", "modified": "2026-04-09", "markdown": "https://www.netzilo.com/threats/scripting-tool-substitution.md" }, { "slug": "sensitive-proc-read", "title": "Sensitive Proc Filesystem Read", "url": "https://www.netzilo.com/threats/sensitive-proc-read", "severity": "high", "summary": "This rule flags attempts to read sensitive files under the Linux /proc filesystem, such as /proc/self/environ, which expose a process's environment variables and memory maps. Attackers or misbehaving AI agents use this technique to pull secrets like API keys or tokens after being blocked from listing environment variables directly.", "atlas": [ { "id": "AML.T0055", "name": "Unsecured Credentials" }, { "id": "AML.T0089", "name": "Process Discovery" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" } ], "attack": [ "attack.credential-access", "attack.t1552.001", "attack.discovery", "attack.t1082" ], "cves": [], "id": "b8e2a4f1-7c93-5d1e-a6b4-3f9d0e8c5a72", "published": "2026-03-02", "modified": "2026-03-02", "markdown": "https://www.netzilo.com/threats/sensitive-proc-read.md" }, { "slug": "sensitive-system-file-read", "title": "Sensitive System File Read", "url": "https://www.netzilo.com/threats/sensitive-system-file-read", "severity": "high", "summary": "This detects an AI agent or automated process reading files that hold Linux account and authentication data, such as /etc/passwd, /etc/shadow, /etc/sudoers, the auth log, or root's authorized_keys. Reading these files is a common early step attackers take to enumerate accounts and find ways to escalate privileges.", "atlas": [ { "id": "AML.T0055", "name": "Unsecured Credentials" }, { "id": "AML.T0089", "name": "Process Discovery" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" } ], "attack": [ "attack.discovery", "attack.t1087", "attack.credential-access", "attack.t1552" ], "cves": [], "id": "cb33c5f1-4bd1-5d36-a9b7-3e56737f928b", "published": "2026-07-03", "modified": "2026-08-03", "markdown": "https://www.netzilo.com/threats/sensitive-system-file-read.md" }, { "slug": "sensitive-system-file-read-periodic", "title": "Sensitive System File Read (EDR Graph)", "url": "https://www.netzilo.com/threats/sensitive-system-file-read-periodic", "severity": "medium", "summary": "This detection catches an AI agent (or a subprocess it spawned) reading sensitive system files like /etc/passwd, sudoers, or authorized_keys. It's a periodic check rather than a live alert, so it fires with a delay.", "atlas": [ { "id": "AML.T0055", "name": "Unsecured Credentials" }, { "id": "AML.T0037", "name": "Data from Local System" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" } ], "attack": [ "attack.discovery", "attack.t1087", "attack.credential-access", "attack.t1552" ], "cves": [], "id": "cb33c5f1-4bd1-5d36-a9b7-3e56737f928b-p", "published": "2026-08-03", "modified": "2026-08-03", "markdown": "https://www.netzilo.com/threats/sensitive-system-file-read-periodic.md" }, { "slug": "sentinel-scan-cli-llm-jailbreak-tool", "title": "LLM Jailbreak Tooling - sentinel-scan-cli Execution", "url": "https://www.netzilo.com/threats/sentinel-scan-cli-llm-jailbreak-tool", "severity": "medium", "summary": "This rule flags installation or execution of sentinel-scan-cli, a publicly available tool that automatically fires a set of known prompt-injection and jailbreak prompts at an LLM. Seeing it run is notable because it means someone is actively probing a model for ways to bypass its safety guardrails.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.reconnaissance", "attack.t1595.002", "attack.resource-development", "attack.t1588.002" ], "cves": [], "id": "7c1f4d2a-9b6e-4f3c-8a51-2d0e6b7c94af", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/sentinel-scan-cli-llm-jailbreak-tool.md" }, { "slug": "sequa-mcp-oauth-redirect-command-injection", "title": "MCP OAuth Redirect Handler Command Injection (sequa-mcp redirectToAuthorization)", "url": "https://www.netzilo.com/threats/sequa-mcp-oauth-redirect-command-injection", "severity": "high", "summary": "An MCP client library builds a command to open a browser for OAuth login, but inserts the authorization URL into that command without checking it first. If the URL comes from a malicious or compromised OAuth server, an attacker can hide shell commands inside it that run when the client tries to open the login page.", "atlas": [], "owasp": [], "attack": [ "attack.execution", "attack.t1059", "attack.t1059.004", "attack.initial-access" ], "cves": [], "id": "7c1e4b2a-9f3d-4e58-b0a6-2d51c9f4e83b", "published": "2026-05-19", "modified": "2026-05-19", "markdown": "https://www.netzilo.com/threats/sequa-mcp-oauth-redirect-command-injection.md" }, { "slug": "session-search-resumption", "title": "Agent Session Store Content Search and Resumption", "url": "https://www.netzilo.com/threats/session-search-resumption", "severity": "medium", "summary": "Claude Code and Codex CLI save every conversation to disk. This rule flags command lines that search those saved conversations for content, or that reopen (resume) a past session \u2014 behavior that could mean someone is digging through old chats for secrets or hijacking an in-flight session.", "atlas": [], "owasp": [], "attack": [ "attack.collection", "attack.t1005", "attack.credential-access", "attack.t1552.001" ], "cves": [], "id": "7c3f9e21-4b6d-4a58-9f2e-1d8c05b7a643", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/session-search-resumption.md" }, { "slug": "session-velocity-anomaly", "title": "Unusual Tool Call Velocity in Session", "url": "https://www.netzilo.com/threats/session-velocity-anomaly", "severity": "medium", "summary": "This detects sessions where an AI agent's tools are invoked far more often than normal, 20 or more times in a single session. A high call count can mean someone is scripting an attack or probing the agent's tools automatically rather than using it interactively.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "ASI10", "name": "Resource Exhaustion and Denial of Wallet" } ], "attack": [ "attack.discovery", "attack.t1046" ], "cves": [], "id": "d2c6956f-7960-5f83-9886-15cab99fcaab", "published": "2026-03-18", "modified": "2026-03-18", "markdown": "https://www.netzilo.com/threats/session-velocity-anomaly.md" }, { "slug": "shadow-mcp-credential-harvest", "title": "Shadow MCP Credential Harvest Tool Invocation", "url": "https://www.netzilo.com/threats/shadow-mcp-credential-harvest", "severity": "high", "summary": "AI agents built on the Model Context Protocol (MCP) can call named 'tools' to perform actions. This detection flags a tool call whose name itself signals a credential-harvesting operation, like 'exfil_api_keys' or 'harvest_ssh_keys'. It catches the moment an attacker actually invokes a tool designed to pull out secrets, not just when they list what's available.", "atlas": [ { "id": "AML.T0015", "name": "Evade AI Model" } ], "owasp": [ { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.credential-access", "attack.t1552", "attack.collection" ], "cves": [], "id": "7b3f1c2e-9a4d-4f18-b6c5-2d8e0a17c93f", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/shadow-mcp-credential-harvest.md" }, { "slug": "shell-config-modification", "title": "Shell Configuration Modification", "url": "https://www.netzilo.com/threats/shell-config-modification", "severity": "high", "summary": "This rule flags attempts to modify files like .bashrc, .bash_profile, or .ssh/authorized_keys through an AI agent's command execution or file editing tools. These files are common places attackers plant persistence mechanisms so their access survives a reboot or session end.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" }, { "id": "AML.T0081", "name": "Modify AI Agent Configuration" } ], "owasp": [ { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" }, { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" } ], "attack": [ "attack.persistence", "attack.t1546" ], "cves": [], "id": "1e785c77-6d77-5c79-ae24-6a389f9ef7f1", "published": "2026-02-04", "modified": "2026-06-02", "markdown": "https://www.netzilo.com/threats/shell-config-modification.md" }, { "slug": "shell-config-modification-periodic", "title": "Shell Configuration Modification (EDR Graph)", "url": "https://www.netzilo.com/threats/shell-config-modification-periodic", "severity": "high", "summary": "This rule watches for changes to files like .bashrc, .bash_profile, .zshrc, or authorized_keys. Attackers modify these files to run their own commands automatically or to add their own SSH key, so they can get back in later.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" }, { "id": "AML.T0081", "name": "Modify AI Agent Configuration" } ], "owasp": [ { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" }, { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" } ], "attack": [ "attack.persistence", "attack.t1546" ], "cves": [], "id": "1e785c77-6d77-5c79-ae24-6a389f9ef7f1-p", "published": "2026-06-02", "modified": "2026-06-02", "markdown": "https://www.netzilo.com/threats/shell-config-modification-periodic.md" }, { "slug": "shell-escape-privilege-escalation", "title": "Shell Escape Privilege Escalation", "url": "https://www.netzilo.com/threats/shell-escape-privilege-escalation", "severity": "high", "summary": "This rule flags an AI agent that escapes a sandboxed or limited command environment using known 'shell escape' tricks (like typing a bang-command in vi, or spawning a shell from find or python), and then keeps operating with unrestricted shell access. It's the AI-agent equivalent of a classic GTFOBins privilege escalation trick.", "atlas": [ { "id": "AML.T0050", "name": "Command and Scripting Interpreter" } ], "owasp": [ { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.privilege-escalation", "attack.execution", "attack.t1548", "attack.t1059.004" ], "cves": [], "id": "3f9c1e0a-7b42-4d6e-9c85-1a2f4b6d8e07", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/shell-escape-privilege-escalation.md" }, { "slug": "shell-eval-obfuscation", "title": "Shell Eval and Variable Obfuscation", "url": "https://www.netzilo.com/threats/shell-eval-obfuscation", "severity": "high", "summary": "This detects shell commands that are deliberately disguised to avoid being recognized by security tools. Attackers hide the real command using tricks like variable substitution, eval, or encoding it as hex/octal bytes piped into a shell interpreter.", "atlas": [ { "id": "AML.T0050", "name": "Command and Scripting Interpreter" } ], "owasp": [ { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" } ], "attack": [ "attack.stealth", "attack.t1027", "attack.execution", "attack.t1059" ], "cves": [], "id": "b1a10452-843b-540d-827a-aa3bcded8ba9", "published": "2026-02-26", "modified": "2026-02-26", "markdown": "https://www.netzilo.com/threats/shell-eval-obfuscation.md" }, { "slug": "silent-model-substitution", "title": "LLM Silent Model Substitution To Unmanaged Or Uncensored Model", "url": "https://www.netzilo.com/threats/silent-model-substitution", "severity": "high", "summary": "An AI agent that starts out using an approved, safety-tuned model can have its configuration rewritten so that later requests go to a different model instead \u2014 one without the usual safety guardrails, or one running on infrastructure nobody is managing. This detection catches the moment a request in an existing session shows that swap has happened.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.defense-evasion", "attack.t1562" ], "cves": [], "id": "7c1e4a92-3f6b-4d58-9a0e-2b5f81c47d63", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/silent-model-substitution.md" }, { "slug": "skill-host-destruction-shell", "title": "Agent Skill Host Destruction Command", "url": "https://www.netzilo.com/threats/skill-host-destruction-shell", "severity": "high", "summary": "This detects an AI agent, or a program it launched, running a shell command aimed at destroying an entire disk, root filesystem, or top-level system directory \u2014 things like formatting a drive, deleting all of / or /home, or clearing shadow copies. It also flags commands that erase logs or command history, which attackers use to cover their tracks afterward.", "atlas": [ { "id": "AML.T0015", "name": "Evade AI Model" } ], "owasp": [], "attack": [ "attack.impact", "attack.t1485", "attack.t1561", "attack.defense-evasion", "attack.t1070.003" ], "cves": [], "id": "7b2e4c91-5d3a-4f8e-9c21-6ad0f4b8e173", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/skill-host-destruction-shell.md" }, { "slug": "skillspector-autonomous-no-confirm", "title": "Agent Instructed to Act Without User Confirmation", "url": "https://www.netzilo.com/threats/skillspector-autonomous-no-confirm", "severity": "high", "summary": "Some AI agent configurations (skill manifests, system prompts) explicitly instruct the agent to carry out sensitive actions without checking with a human first. This rule flags that instruction pattern, which removes a safety checkpoint an operator would normally rely on.", "atlas": [ { "id": "AML.T0110", "name": "AI Agent Tool Poisoning" }, { "id": "AML.T0080", "name": "AI Agent Context Poisoning" } ], "owasp": [ { "id": "LLM06", "name": "Excessive Agency" }, { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" } ], "attack": [ "attack.impact", "attack.t1485", "attack.privilege-escalation" ], "cves": [], "id": "f7b1e645-8a5c-4b2f-e7b6-1a4c9b6f5d38", "published": "2026-06-03", "modified": "2026-06-03", "markdown": "https://www.netzilo.com/threats/skillspector-autonomous-no-confirm.md" }, { "slug": "skillspector-context-leakage", "title": "Conversation Context Leakage to External Endpoint", "url": "https://www.netzilo.com/threats/skillspector-context-leakage", "severity": "high", "summary": "An attacker gets an AI agent to package up the current conversation\u2014user messages, session context, prior turns\u2014and send it to a server the attacker controls. This turns a normal chat session into a data leak without the user noticing.", "atlas": [ { "id": "AML.T0086", "name": "Exfiltration via AI Agent Tool Invocation" }, { "id": "AML.T0057", "name": "LLM Data Leakage" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration", "attack.t1041", "attack.collection", "attack.t1119" ], "cves": [], "id": "b5d9a423-6c3e-4d0b-b5d4-9c2e7d4b3f16", "published": "2026-06-03", "modified": "2026-06-03", "markdown": "https://www.netzilo.com/threats/skillspector-context-leakage.md" }, { "slug": "skillspector-context-window-stuffing", "title": "Context Window Stuffing Attack", "url": "https://www.netzilo.com/threats/skillspector-context-window-stuffing", "severity": "high", "summary": "AI models can only 'remember' a limited amount of text at once, called a context window. This attack floods that window with repetitive or filler text so the model's original safety instructions get pushed out and are effectively forgotten.", "atlas": [ { "id": "AML.T0080", "name": "AI Agent Context Poisoning" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.stealth", "attack.t1027" ], "cves": [], "id": "b9d3a867-0c7e-4d4b-a9d8-3c6e1d8b7f50", "published": "2026-06-03", "modified": "2026-06-03", "markdown": "https://www.netzilo.com/threats/skillspector-context-window-stuffing.md" }, { "slug": "skillspector-excessive-permissions", "title": "Excessive Permission Grant in Skill Manifest", "url": "https://www.netzilo.com/threats/skillspector-excessive-permissions", "severity": "medium", "summary": "Some AI 'skills' or plug-ins declare permissions in their manifest or system prompt that go well beyond what their stated job requires \u2014 things like wildcard file access or full system control. This is a sign the skill is either poorly designed or intentionally built to gain more access than it should have.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "LLM06", "name": "Excessive Agency" }, { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" } ], "attack": [ "attack.privilege-escalation", "attack.t1078" ], "cves": [], "id": "e8a2d756-9f6b-4a3e-e8a7-2f5b0a7f6c49", "published": "2026-06-03", "modified": "2026-06-03", "markdown": "https://www.netzilo.com/threats/skillspector-excessive-permissions.md" }, { "slug": "skillspector-filesystem-enumeration", "title": "File System Enumeration for Credentials and Secrets", "url": "https://www.netzilo.com/threats/skillspector-filesystem-enumeration", "severity": "high", "summary": "This rule flags when an AI agent's tool calls are used to search through a file system for things like SSH keys, cloud config files, and other credential stores. That kind of scanning is a common first step before someone tries to steal those credentials.", "atlas": [ { "id": "AML.T0055", "name": "Unsecured Credentials" }, { "id": "AML.T0037", "name": "Data from Local System" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" } ], "attack": [ "attack.discovery", "attack.t1083", "attack.credential-access", "attack.t1552" ], "cves": [], "id": "a4c8f312-5b2d-4c9a-a4c3-8b1d6c3a2e05", "published": "2026-06-03", "modified": "2026-06-03", "markdown": "https://www.netzilo.com/threats/skillspector-filesystem-enumeration.md" }, { "slug": "skillspector-mcp-hidden-instructions", "title": "Hidden Instructions in MCP Skill Metadata", "url": "https://www.netzilo.com/threats/skillspector-mcp-hidden-instructions", "severity": "high", "summary": "MCP skills advertise themselves to AI agents using metadata like names, descriptions, and parameter text. This detection looks for hidden content in that metadata \u2014 HTML comments, invisible zero-width characters, base64 blobs, or data URIs \u2014 that a human skimming the manifest would never notice but that an AI agent will read and act on.", "atlas": [ { "id": "AML.T0110", "name": "AI Agent Tool Poisoning" }, { "id": "AML.T0068", "name": "LLM Prompt Obfuscation" } ], "owasp": [ { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access", "attack.t1566", "attack.stealth", "attack.t1027" ], "cves": [], "id": "c4e8b312-5d2f-4e9c-b4e3-8d1f6e3c2a05", "published": "2026-06-03", "modified": "2026-06-03", "markdown": "https://www.netzilo.com/threats/skillspector-mcp-hidden-instructions.md" }, { "slug": "skillspector-mcp-param-injection", "title": "MCP Parameter Description Injection", "url": "https://www.netzilo.com/threats/skillspector-mcp-param-injection", "severity": "high", "summary": "AI agents that use tools defined by the Model Context Protocol (MCP) read tool descriptions, including parameter descriptions, before deciding how to call a tool. An attacker can write hidden instructions into a parameter description so that when the agent reads the tool schema, it follows the attacker's directive instead of the user's intent.", "atlas": [ { "id": "AML.T0110", "name": "AI Agent Tool Poisoning" }, { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access", "attack.t1566", "attack.stealth" ], "cves": [], "id": "d5f9c423-6e3a-4f0d-c5f4-9e2a7f4d3b16", "published": "2026-06-03", "modified": "2026-06-03", "markdown": "https://www.netzilo.com/threats/skillspector-mcp-param-injection.md" }, { "slug": "skillspector-mcp-unicode-deception", "title": "MCP Tool Description Unicode Confusable Deception", "url": "https://www.netzilo.com/threats/skillspector-mcp-unicode-deception", "severity": "high", "summary": "Some tools registered with AI agents (via the Model Context Protocol, or MCP) describe themselves using letters that look like normal English but are actually Cyrillic, Greek, or other Unicode lookalikes. This lets an attacker make a tool's description look trustworthy while hiding its real, different meaning from anyone reading it quickly.", "atlas": [ { "id": "AML.T0110", "name": "AI Agent Tool Poisoning" }, { "id": "AML.T0068", "name": "LLM Prompt Obfuscation" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" } ], "attack": [ "attack.stealth", "attack.t1027", "attack.initial-access", "attack.t1190" ], "cves": [], "id": "b3f7a291-4c1e-4d8b-a3f2-7c0e5d2b1f94", "published": "2026-06-03", "modified": "2026-06-03", "markdown": "https://www.netzilo.com/threats/skillspector-mcp-unicode-deception.md" }, { "slug": "skillspector-memory-manipulation", "title": "Agent Memory and Identity Manipulation", "url": "https://www.netzilo.com/threats/skillspector-memory-manipulation", "severity": "high", "summary": "Some AI agents keep memory or state between sessions so they remember context. This rule flags instructions that try to overwrite that stored memory, reset the agent's identity, or plant false 'memories' that persist and affect future sessions.", "atlas": [ { "id": "AML.T0080", "name": "AI Agent Context Poisoning" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" } ], "attack": [ "attack.persistence", "attack.t1546", "attack.stealth" ], "cves": [], "id": "c0e4b978-1d8f-4e5c-b0e9-4d7f2e9c8a61", "published": "2026-06-03", "modified": "2026-06-03", "markdown": "https://www.netzilo.com/threats/skillspector-memory-manipulation.md" }, { "slug": "skillspector-package-typosquatting", "title": "Typosquatting Package Name in Install Command", "url": "https://www.netzilo.com/threats/skillspector-package-typosquatting", "severity": "critical", "summary": "This detects package install commands (pip, npm, etc.) that reference known lookalike package names \u2014 ones that differ from a popular package by a character or two. Attackers publish these lookalikes hoping for accidental installs, including cases where an AI assistant suggests the wrong package name.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" }, { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" } ], "attack": [ "attack.initial-access", "attack.t1195", "attack.supply-chain" ], "cves": [], "id": "c6e0b534-7d4f-4e1c-c6e5-0d3f8e5c4a27", "published": "2026-06-03", "modified": "2026-06-03", "markdown": "https://www.netzilo.com/threats/skillspector-package-typosquatting.md" }, { "slug": "skillspector-persistent-context-injection", "title": "Persistent Context Injection in Agent Instructions", "url": "https://www.netzilo.com/threats/skillspector-persistent-context-injection", "severity": "high", "summary": "Some prompts don't just try to trick an AI agent once \u2014 they try to make the trick stick, by phrasing injected content as a permanent rule the agent should 'always remember' or follow 'from now on.' This turns a one-time manipulation into lasting behavioral hijacking.", "atlas": [ { "id": "AML.T0080", "name": "AI Agent Context Poisoning" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.persistence", "attack.t1546", "attack.stealth" ], "cves": [], "id": "b1d5a089-2c9b-4d6e-b1d0-5c3b4a1d0c72", "published": "2026-06-03", "modified": "2026-06-03", "markdown": "https://www.netzilo.com/threats/skillspector-persistent-context-injection.md" }, { "slug": "skillspector-scope-creep", "title": "Agent Scope Creep \u2014 General Purpose Expansion", "url": "https://www.netzilo.com/threats/skillspector-scope-creep", "severity": "medium", "summary": "This rule looks for text inside an AI agent's configuration or instructions that tries to push it beyond its intended job \u2014 telling it to 'handle everything' or act as a general-purpose assistant instead of the narrow task it was built for. That kind of instruction, whether planted by an attacker or added carelessly, makes the agent capable of far more than intended.", "atlas": [ { "id": "AML.T0081", "name": "Modify AI Agent Configuration" }, { "id": "AML.T0080", "name": "AI Agent Context Poisoning" } ], "owasp": [ { "id": "ASI06", "name": "Goal and Instruction Manipulation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.impact", "attack.privilege-escalation" ], "cves": [], "id": "a8c2f756-9b6d-4c3a-f8c7-2b5d0c7a6e49", "published": "2026-06-03", "modified": "2026-06-03", "markdown": "https://www.netzilo.com/threats/skillspector-scope-creep.md" }, { "slug": "skillspector-self-modification", "title": "Agent Self-Modification Attempt", "url": "https://www.netzilo.com/threats/skillspector-self-modification", "severity": "critical", "summary": "This detects attempts to instruct an AI agent to modify its own skill definitions, configuration, or source code while it is running. Legitimate updates go through an approved process; a direct instruction telling the agent to edit itself is a red flag.", "atlas": [ { "id": "AML.T0081", "name": "Modify AI Agent Configuration" }, { "id": "AML.T0107", "name": "Exploitation for Defense Evasion" } ], "owasp": [ { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" }, { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" } ], "attack": [ "attack.persistence", "attack.t1546", "attack.defense-impairment", "attack.t1562" ], "cves": [], "id": "d1f5c089-2e9a-4f6d-c1f0-5e8a3f0d9b72", "published": "2026-06-03", "modified": "2026-06-03", "markdown": "https://www.netzilo.com/threats/skillspector-self-modification.md" }, { "slug": "skillspector-tool-chaining-bypass", "title": "Tool Chaining to Bypass Safety Controls", "url": "https://www.netzilo.com/threats/skillspector-tool-chaining-bypass", "severity": "high", "summary": "An AI agent that can call multiple tools can be manipulated into running a sequence of individually harmless operations that together produce a harmful result. This detection looks for that pattern, or for instructions that openly ask the agent to use tool chaining to get around safety checks.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1059", "attack.defense-impairment" ], "cves": [], "id": "e2a6d190-3f0b-4a7e-d2a1-6f9b4a1e0c83", "published": "2026-06-03", "modified": "2026-06-03", "markdown": "https://www.netzilo.com/threats/skillspector-tool-chaining-bypass.md" }, { "slug": "skillspector-tool-param-abuse", "title": "Dangerous Tool Parameter Abuse", "url": "https://www.netzilo.com/threats/skillspector-tool-param-abuse", "severity": "critical", "summary": "This rule flags when an AI agent invokes a tool using parameter values that are known to be risky, such as enabling shell injection, forcing destructive deletes, disabling SSL certificate checks, or setting SUID permissions. These are the kinds of arguments that turn a normal tool call into something that can compromise a system or destroy data.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1059", "attack.impact", "attack.t1485" ], "cves": [], "id": "a0c4f978-1b8d-4c5a-a0c9-4b2d3f0a9b61", "published": "2026-06-03", "modified": "2026-06-03", "markdown": "https://www.netzilo.com/threats/skillspector-tool-param-abuse.md" }, { "slug": "skillspector-trigger-abuse", "title": "Skill Trigger Keyword Abuse", "url": "https://www.netzilo.com/threats/skillspector-trigger-abuse", "severity": "high", "summary": "Some AI agent 'skills' declare activation triggers so broad they fire on almost anything a user types, or word them to imitate built-in commands, or use urgent/emotional phrasing designed to make the agent invoke them at sensitive moments. This lets a malicious skill quietly insert itself into normal agent traffic instead of only running when genuinely needed.", "atlas": [ { "id": "AML.T0110", "name": "AI Agent Tool Poisoning" } ], "owasp": [ { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial-access", "attack.t1566", "attack.collection", "attack.t1119" ], "cves": [], "id": "f9b3e867-0a7c-4b4f-f9b8-3a6c1b8a7d50", "published": "2026-06-03", "modified": "2026-06-03", "markdown": "https://www.netzilo.com/threats/skillspector-trigger-abuse.md" }, { "slug": "skillspector-unbounded-resource", "title": "Unbounded Resource Access in Agent Instructions", "url": "https://www.netzilo.com/threats/skillspector-unbounded-resource", "severity": "medium", "summary": "This rule flags instructions given to an AI agent that tell it to keep calling APIs, retrying failed operations, or consuming compute/memory without any cap, timeout, or quota. That kind of unrestricted behavior can knock over backend services or run up huge cloud bills before anyone notices.", "atlas": [ { "id": "AML.T0034", "name": "Cost Harvesting" } ], "owasp": [ { "id": "LLM10", "name": "Unbounded Consumption" }, { "id": "ASI10", "name": "Resource Exhaustion and Denial of Wallet" } ], "attack": [ "attack.impact", "attack.t1498", "attack.resource-development" ], "cves": [], "id": "c2e6b190-3d0c-4e7f-c2e1-6d4c5b2e1d83", "published": "2026-06-03", "modified": "2026-06-03", "markdown": "https://www.netzilo.com/threats/skillspector-unbounded-resource.md" }, { "slug": "skillspector-unpinned-dependency-install", "title": "Unpinned or Latest Dependency Installation", "url": "https://www.netzilo.com/threats/skillspector-unpinned-dependency-install", "severity": "medium", "summary": "Package installers can be told to grab whatever the newest version of a library is, instead of a specific, known version. If the software registry serving that package is later compromised, the next install silently pulls in malicious code.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" }, { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" } ], "attack": [ "attack.initial-access", "attack.t1195", "attack.supply-chain" ], "cves": [], "id": "d7f1c645-8e5a-4f2d-d7f6-1e4a9f6d5b38", "published": "2026-06-03", "modified": "2026-06-03", "markdown": "https://www.netzilo.com/threats/skillspector-unpinned-dependency-install.md" }, { "slug": "skillspector-unrestricted-tool-access", "title": "Unrestricted Tool Access Grant in Agent Instructions", "url": "https://www.netzilo.com/threats/skillspector-unrestricted-tool-access", "severity": "medium", "summary": "Some AI agent configurations tell the agent it can use any tool available, instead of listing only the tools it actually needs. This detection flags that pattern in skill manifests or system prompts, because it gives an attacker far more to work with if the agent is later manipulated.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" }, { "id": "AML.T0081", "name": "Modify AI Agent Configuration" } ], "owasp": [ { "id": "LLM06", "name": "Excessive Agency" }, { "id": "ASI02", "name": "Tool Misuse and Exploitation" } ], "attack": [ "attack.privilege-escalation", "attack.t1078", "attack.defense-impairment" ], "cves": [], "id": "e6a0d534-7f4b-4a1e-d6a5-0f3b8a5e4c27", "published": "2026-06-03", "modified": "2026-06-03", "markdown": "https://www.netzilo.com/threats/skillspector-unrestricted-tool-access.md" }, { "slug": "skillspector-unsafe-defaults", "title": "Unsafe Security Defaults in Agent Tool Calls", "url": "https://www.netzilo.com/threats/skillspector-unsafe-defaults", "severity": "high", "summary": "An AI agent that can call tools or run skills may be instructed\u2014by a malicious skill or an injected prompt\u2014to weaken security defaults instead of doing its actual job. This includes turning off TLS certificate checks, skipping authentication, opening file permissions to everyone, or allowing any website to make cross-origin requests.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" }, { "id": "AML.T0110", "name": "AI Agent Tool Poisoning" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" } ], "attack": [ "attack.defense-impairment", "attack.t1562", "attack.credential-access" ], "cves": [], "id": "f3b7e201-4a1c-4b8f-e3b2-7a0c5b2f1d94", "published": "2026-06-03", "modified": "2026-06-03", "markdown": "https://www.netzilo.com/threats/skillspector-unsafe-defaults.md" }, { "slug": "slack-unfurl-exfil-chain", "title": "Slack Unfurl Exfiltration Vector \u2014 Untrusted Fetch then Data-Bearing Link Send", "url": "https://www.netzilo.com/threats/slack-unfurl-exfil-chain", "severity": "medium", "summary": "This rule looks for an AI agent that fetches content from an outside website and then, shortly after, sends a Slack message containing a crafted link to a non-Slack host. The pattern matches a known Slack link-preview (unfurl) exfiltration technique where sensitive data is smuggled out inside a URL that Slack automatically fetches to generate a preview.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0025", "name": "Exfiltration via Cyber Means" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration", "attack.t1567", "attack.t1071.001" ], "cves": [], "id": "6f1c2d84-9a37-4e51-b0c2-7d5e83a41f96", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/slack-unfurl-exfil-chain.md" }, { "slug": "smolagents-xpath-injection", "title": "XPath Injection in Smolagents search_item_ctrl_f", "url": "https://www.netzilo.com/threats/smolagents-xpath-injection", "severity": "high", "summary": "A helper function in Hugging Face's Smolagents library builds web page search queries by directly inserting text into a query template, without sanitizing it. If untrusted text reaches this function, an attacker can break out of the intended search and alter what the underlying automated browser does.", "atlas": [], "owasp": [ { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.initial-access", "attack.t1190" ], "cves": [], "id": "7f3c9d21-4b8e-4a15-9c62-8d5f1e2a6b40", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/smolagents-xpath-injection.md" }, { "slug": "sshlg-skills-supply-chain-fanout", "title": "Supply Chain Multi-Agent Skill Fanout (sshlg-skills)", "url": "https://www.netzilo.com/threats/sshlg-skills-supply-chain-fanout", "severity": "medium", "summary": "sshlg-skills is an npm package that markets itself as a one-shot installer/updater for a 'skill' bundle across many AI coding agent tools \u2014 Claude Code, Cursor, OpenCode, Kilo, Kimi, Hermes, OpenClaw, and Codex. This rule flags the moment a single install run touches two or more of those agents' trust boundaries by writing files into their config directories. No malicious payload has been confirmed in the package; this is a visibility signal on a broad distribution mechanism, not a confirmed compromise.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial-access", "attack.t1195", "attack.t1195.001" ], "cves": [], "id": "6f3c1d8a-2b47-4e59-9a0c-71d5e8b4c3af", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/sshlg-skills-supply-chain-fanout.md" }, { "slug": "ssrf-backslash-at-url-bypass", "title": "SSRF Backslash-At URL Authority Confusion", "url": "https://www.netzilo.com/threats/ssrf-backslash-at-url-bypass", "severity": "high", "summary": "A flaw in vLLM versions before 0.17.0 lets attackers sneak a URL past the server's allow-list check by putting a backslash right before the '@' symbol. The validator and the actual HTTP client disagree about where the hostname starts, so a request that looks safe on paper actually gets sent to an internal address.", "atlas": [], "owasp": [], "attack": [ "attack.discovery", "attack.t1046", "attack.credential-access", "attack.t1552.005" ], "cves": [], "id": "7c1f4a2e-9b83-4d16-a5f0-2e6c8d31b4af", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/ssrf-backslash-at-url-bypass.md" }, { "slug": "ssrf-image-url-token-count", "title": "SSRF Image URL Fetch to Internal or Cloud Metadata Endpoint", "url": "https://www.netzilo.com/threats/ssrf-image-url-token-count", "severity": "high", "summary": "A bug in LangChain's ChatOpenAI token counter causes it to fetch attacker-supplied image URLs directly from the agent's server before ever sending the message to the AI model. If that URL points at an internal address, the agent host makes the request for you, giving an attacker a foothold to probe internal networks or cloud metadata services.", "atlas": [], "owasp": [], "attack": [ "attack.credential-access", "attack.t1552.005", "attack.discovery", "attack.t1046" ], "cves": [], "id": "b7f3c1a4-6d2e-4a58-9c31-5e0f2a7d84b6", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/ssrf-image-url-token-count.md" }, { "slug": "ssrf-redirect-bypass-chain", "title": "SSRF Redirect Bypass in Agent Scraping Fetch", "url": "https://www.netzilo.com/threats/ssrf-redirect-bypass-chain", "severity": "high", "summary": "An AI agent that fetches web pages can be tricked into visiting internal, non-public addresses. This happens when an attacker's public URL responds with an HTTP redirect pointing at an internal host, and the agent follows it without re-checking whether that new destination is allowed.", "atlas": [], "owasp": [], "attack": [ "attack.discovery", "attack.t1046" ], "cves": [], "id": "3f1c9a6e-8d24-4b71-9c53-2a7e5b0d61f4", "published": "2026-03-05", "modified": "2026-03-05", "markdown": "https://www.netzilo.com/threats/ssrf-redirect-bypass-chain.md" }, { "slug": "ssrf-url-parser-divergence", "title": "SSRF Filter Bypass via URL Parser Divergence", "url": "https://www.netzilo.com/threats/ssrf-url-parser-divergence", "severity": "high", "summary": "An attacker crafts a URL that looks safe to an application's security check but is actually sent to a different, forbidden address. This works because the code that validates the URL and the code that fetches it use different libraries with subtly different rules for parsing addresses.", "atlas": [], "owasp": [], "attack": [ "attack.defense-evasion", "attack.command-and-control", "attack.t1071.001" ], "cves": [], "id": "7c1f4a92-3b58-4e6d-9a41-5f0c8d2be713", "published": "2025-06-18", "modified": "2025-06-18", "markdown": "https://www.netzilo.com/threats/ssrf-url-parser-divergence.md" }, { "slug": "steganographic-exfil", "title": "Steganographic Data Hiding", "url": "https://www.netzilo.com/threats/steganographic-exfil", "severity": "high", "summary": "This rule looks for the use of steganography and file-carving tools, plus metadata editors, to conceal data inside media files like images. Attackers do this to smuggle stolen data past network monitoring, since the payload is buried inside what looks like an ordinary picture or its EXIF tags.", "atlas": [ { "id": "AML.T0074", "name": "Masquerading" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" } ], "attack": [ "attack.exfiltration", "attack.t1048", "attack.stealth", "attack.t1027" ], "cves": [], "id": "083d7427-a932-5e34-85b8-0867ad7eb18c", "published": "2026-03-23", "modified": "2026-08-03", "markdown": "https://www.netzilo.com/threats/steganographic-exfil.md" }, { "slug": "steganographic-exfiltration", "title": "Steganographic Exfiltration Tooling", "url": "https://www.netzilo.com/threats/steganographic-exfiltration", "severity": "medium", "summary": "This detects an AI agent running a single command that hides data inside a picture or audio file, or pulls hidden data back out. Attackers use this trick \u2014 called steganography \u2014 to sneak sensitive information past filters that only look for obvious file transfers, or to smuggle instructions into a file that looks harmless.", "atlas": [ { "id": "AML.T0025", "name": "Exfiltration via Cyber Means" } ], "owasp": [ { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.defense-evasion", "attack.exfiltration", "attack.t1027.003", "attack.t1001.002" ], "cves": [], "id": "b7f3c1d4-9a6e-4f2b-8c15-3d7e0a4b92f6", "published": "2026-03-01", "modified": "2026-03-01", "markdown": "https://www.netzilo.com/threats/steganographic-exfiltration.md" }, { "slug": "subprocess-dns-exfil-worm-propagation", "title": "Agent Subprocess DNS Exfiltration and Instruction-File Worm Propagation", "url": "https://www.netzilo.com/threats/subprocess-dns-exfil-worm-propagation", "severity": "high", "summary": "This rule watches commands run by AI agents for signs of three separate abuse techniques: hiding stolen data in DNS lookups, rewriting agent instruction files to infect the next agent that reads them, and smuggling invisible Unicode characters that carry hidden instructions past human reviewers. It only looks at process command lines, one event at a time.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0025", "name": "Exfiltration via Cyber Means" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration", "attack.t1048.003", "attack.t1071.004", "attack.persistence", "attack.t1027" ], "cves": [], "id": "7f3c9a12-4d6e-4b58-9a21-c0e5f8d47b93", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/subprocess-dns-exfil-worm-propagation.md" }, { "slug": "subprocess-os-exec", "title": "Subprocess and OS Exec-Family Call", "url": "https://www.netzilo.com/threats/subprocess-os-exec", "severity": "medium", "summary": "This rule flags when an AI agent's tool calls, executed commands, or written code contain calls to Python's subprocess module or os exec-family functions. These functions let code spawn new processes and run arbitrary shell commands, which is a common way to break out of an intended task and run something else on the host.", "atlas": [ { "id": "AML.T0050", "name": "Command and Scripting Interpreter" }, { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1059" ], "cves": [], "id": "22b3c4d5-e6f7-4a89-0123-b4c5d6e7f8a9", "published": "2026-06-03", "modified": "2026-06-03", "markdown": "https://www.netzilo.com/threats/subprocess-os-exec.md" }, { "slug": "superagi-output-handler-eval-rce", "title": "SuperAGI Output Handler Eval RCE", "url": "https://www.netzilo.com/threats/superagi-output-handler-eval-rce", "severity": "high", "summary": "SuperAGI, an AI agent framework, feeds model or tool output straight into Python's eval() without checking it. An attacker who can influence that output (through a prompt injection or a malicious tool response) can make the agent run arbitrary system commands.", "atlas": [ { "id": "AML.T0050", "name": "Command and Scripting Interpreter" }, { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "LLM05", "name": "Improper Output Handling" }, { "id": "ASI05", "name": "Cascading Failures in Multi-Agent Systems" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" } ], "attack": [ "attack.execution", "attack.t1059", "attack.t1059.006" ], "cves": [], "id": "7c1e4b0a-3f2d-4a86-9b51-2d8e0f6ac417", "published": "2026-02-18", "modified": "2026-02-18", "markdown": "https://www.netzilo.com/threats/superagi-output-handler-eval-rce.md" }, { "slug": "supervisor-dashboard-control-plane-abuse", "title": "AI Session Supervisor Dashboard Control-Plane Abuse", "url": "https://www.netzilo.com/threats/supervisor-dashboard-control-plane-abuse", "severity": "medium", "summary": "Some organizations run a dashboard that lets humans monitor and control AI coding agents running in terminal sessions \u2014 attach to them, send them commands, or kill them. This detection flags the moment when an AI agent itself starts using that control dashboard, instead of just being supervised by it, which is a sign the agent has been hijacked or is being abused to control its own oversight layer.", "atlas": [], "owasp": [], "attack": [ "attack.discovery", "attack.t1046", "attack.credential-access", "attack.t1110", "attack.lateral-movement", "attack.t1078" ], "cves": [], "id": "7b3c1e2a-9d54-4f61-8a2f-5c9d0e4b71af", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/supervisor-dashboard-control-plane-abuse.md" }, { "slug": "surf-cli-browser-control-abuse", "title": "Surf-CLI Browser Control Abuse (Instance-Resolved)", "url": "https://www.netzilo.com/threats/surf-cli-browser-control-abuse", "severity": "high", "summary": "An AI agent session opens a Chrome DevTools Protocol control channel (via surf-cli or a similar tool) to drive a browser, then a non-browser process in that same session either reads the browser's saved passwords and cookies, or saves a screenshot/session capture and sends it out over the network. This turns a legitimate browser-automation feature into a way to hijack an active, logged-in browser session.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" }, { "id": "AML.T0025", "name": "Exfiltration via Cyber Means" } ], "owasp": [ { "id": "LLM06", "name": "Excessive Agency" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.execution", "attack.t1059", "attack.credential-access", "attack.t1539", "attack.collection", "attack.t1185" ], "cves": [], "id": "6f2b9d41-3c7e-4a58-9b0d-1e84c5a7f2d9", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/surf-cli-browser-control-abuse.md" }, { "slug": "suspicious-process-exec", "title": "Suspicious Process Execution by Agent", "url": "https://www.netzilo.com/threats/suspicious-process-exec", "severity": "critical", "summary": "An AI agent with shell access runs a command that launches known hacking tools or dangerous command patterns, such as piping downloaded scripts straight into a shell. This is caught at the operating system level when the process actually executes, not just when a request is intercepted.", "atlas": [ { "id": "AML.T0050", "name": "Command and Scripting Interpreter" }, { "id": "AML.T0072", "name": "Reverse Shell" }, { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" } ], "attack": [ "attack.execution", "attack.t1059", "attack.command-and-control", "attack.t1573" ], "cves": [], "id": "a8b3c4d5-e6f7-5891-b2c3-d4e5f6a7b8c9", "published": "2026-06-02", "modified": "2026-06-02", "markdown": "https://www.netzilo.com/threats/suspicious-process-exec.md" }, { "slug": "system-file-tampering", "title": "System File Modification", "url": "https://www.netzilo.com/threats/system-file-tampering", "severity": "critical", "summary": "This rule flags an AI coding or automation agent when it writes or overwrites files in sensitive system locations like /etc/ or /usr/local/bin/. It catches this whether done through shell redirect commands or through the agent's own file-editing tools.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" } ], "attack": [ "attack.persistence", "attack.t1543" ], "cves": [], "id": "89404989-df81-5ae1-9b23-d9e845e9be65", "published": "2026-02-04", "modified": "2026-06-02", "markdown": "https://www.netzilo.com/threats/system-file-tampering.md" }, { "slug": "system-file-tampering-periodic", "title": "System File Modification (EDR Graph)", "url": "https://www.netzilo.com/threats/system-file-tampering-periodic", "severity": "critical", "summary": "This detects file writes to sensitive system locations like /etc/, /usr/bin/, and /usr/local/bin/. These directories hold configuration files and executable programs that control how a system behaves, so unexpected changes here are a strong sign of tampering.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" } ], "attack": [ "attack.persistence", "attack.t1543" ], "cves": [], "id": "89404989-df81-5ae1-9b23-d9e845e9be65-p", "published": "2026-06-02", "modified": "2026-06-02", "markdown": "https://www.netzilo.com/threats/system-file-tampering-periodic.md" }, { "slug": "taint-credential-exfil", "title": "Credential File Read Followed by External HTTP Request", "url": "https://www.netzilo.com/threats/taint-credential-exfil", "severity": "critical", "summary": "This detects a two-step pattern: an AI agent process reads a sensitive credential file \u2014 an SSH key, an .aws/credentials file, a .env file, or browser saved passwords \u2014 and then makes an outbound HTTP request to an external host. That sequence matches how stolen credentials get exfiltrated: read first, then send.", "atlas": [ { "id": "AML.T0083", "name": "Credentials from AI Agent Configuration" }, { "id": "AML.T0055", "name": "Unsecured Credentials" }, { "id": "AML.T0086", "name": "Exfiltration via AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" } ], "attack": [ "attack.exfiltration", "attack.t1041", "attack.credential-access", "attack.t1552" ], "cves": [], "id": "44d5e6f7-a8b9-4c01-2345-d6e7f8a9b0c1", "published": "2026-06-03", "modified": "2026-06-03", "markdown": "https://www.netzilo.com/threats/taint-credential-exfil.md" }, { "slug": "taint-file-exfil", "title": "Sensitive File Read Followed by External Data Transmission", "url": "https://www.netzilo.com/threats/taint-file-exfil", "severity": "high", "summary": "This rule flags a sequence where an AI agent first opens a sensitive file \u2014 source code, configs, documents, or similar \u2014 and then makes an outbound network connection shortly after. That pattern matches how an attacker or a compromised agent would exfiltrate data it just read.", "atlas": [ { "id": "AML.T0086", "name": "Exfiltration via AI Agent Tool Invocation" } ], "owasp": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration", "attack.t1041", "attack.collection", "attack.t1005" ], "cves": [], "id": "55e6f7a8-b9c0-4d12-3456-e7f8a9b0c1d2", "published": "2026-06-03", "modified": "2026-06-03", "markdown": "https://www.netzilo.com/threats/taint-file-exfil.md" }, { "slug": "taint-input-to-exec", "title": "External Network Input Followed by Process Execution", "url": "https://www.netzilo.com/threats/taint-input-to-exec", "severity": "high", "summary": "This detects a two-step pattern where an AI agent first pulls content from a remote web address and then executes a program shortly after. That sequence is the classic shape of a download-and-execute attack, where an attacker gets malicious content run as code by getting the agent to fetch and then act on it.", "atlas": [ { "id": "AML.T0050", "name": "Command and Scripting Interpreter" }, { "id": "AML.T0011", "name": "User Execution" } ], "owasp": [ { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.execution", "attack.t1059", "attack.initial-access", "attack.t1195" ], "cves": [], "id": "66f7a8b9-c0d1-4e23-4567-f8a9b0c1d2e3", "published": "2026-06-03", "modified": "2026-06-03", "markdown": "https://www.netzilo.com/threats/taint-input-to-exec.md" }, { "slug": "tap-pair-jailbreak-optimizer-exec", "title": "LLM Jailbreak \u2014 TAP/PAIR Iterative Prompt Optimizer Execution", "url": "https://www.netzilo.com/threats/tap-pair-jailbreak-optimizer-exec", "severity": "high", "summary": "This rule spots when a computer runs known jailbreak-automation software \u2014 like TAP or PAIR \u2014 which repeatedly rewrites and tests prompts until one slips past an AI model's safety filters. It catches the tool being launched, not the actual harmful prompts it generates.", "atlas": [ { "id": "AML.T0054", "name": "LLM Jailbreak" }, { "id": "AML.T0043", "name": "Craft Adversarial Data" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution", "attack.t1059" ], "cves": [], "id": "3f8a1c6e-24b7-4d59-9e0a-7c5b18d4af62", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/tap-pair-jailbreak-optimizer-exec.md" }, { "slug": "terminal-cli-harmful-function-simulator", "title": "Terminal CLI Harmful Function Simulation", "url": "https://www.netzilo.com/threats/terminal-cli-harmful-function-simulator", "severity": "high", "summary": "This detects when an AI agent, likely manipulated by a prompt injection or jailbreak attempt, spawns a command-line process that either wipes critical system data or contains suspicious 'pretend to be a terminal' language. It flags the moment the agent actually executes or simulates a harmful command, not just receives the malicious instruction.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" }, { "id": "ASI01", "name": "Agent Authorization and Control Hijacking" } ], "attack": [ "attack.execution", "attack.t1059", "attack.impact", "attack.t1485", "attack.t1490", "attack.defense-evasion", "attack.t1562.001", "attack.t1070.003" ], "cves": [], "id": "7f3c1d2a-9b64-4e58-a1c7-5d0e93f2b6a4", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/terminal-cli-harmful-function-simulator.md" }, { "slug": "titah-code-npm-delegation", "title": "Supply Chain Titah-Code NPM Agent Delegation CLI", "url": "https://www.netzilo.com/threats/titah-code-npm-delegation", "severity": "medium", "summary": "Titah-code is an npm package that delegates coding tasks to third-party AI editors like Claude and opencode, which means it also hands over your prompts, repository contents, and API credentials to those external tools. This rule does not claim the package is malicious; it simply logs every time it is installed or run so someone can review whether that data path is acceptable.", "atlas": [], "owasp": [], "attack": [ "attack.initial-access", "attack.t1195.002", "attack.execution", "attack.t1059" ], "cves": [], "id": "4e1c8f2d-9a6b-4c73-b1f0-2d7a5e46c918", "published": "2026-03-01", "modified": "2026-03-01", "markdown": "https://www.netzilo.com/threats/titah-code-npm-delegation.md" }, { "slug": "tokensaver-cli-token-interception", "title": "Supply Chain TokenSaver CLI Agent Token Interception", "url": "https://www.netzilo.com/threats/tokensaver-cli-token-interception", "severity": "high", "summary": "TokenSaver CLI is a PyPI package that claims to route AI agent traffic through a 'control plane' for management purposes. In reality it reroutes Claude Code, Cursor, and Codex traffic through an attacker-controlled server so it can capture live API keys and session tokens as they pass through.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.credential-access", "attack.t1552.001", "attack.initial-access", "attack.t1195.001" ], "cves": [], "id": "7c1f9a2e-4b83-4d61-9f0a-2e8c5d3b71a4", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/tokensaver-cli-token-interception.md" }, { "slug": "tool-output-ansi-injection", "title": "ANSI Escape Injection in Tool Output", "url": "https://www.netzilo.com/threats/tool-output-ansi-injection", "severity": "medium", "summary": "A tool that an AI agent calls can return raw terminal control codes instead of plain text. These codes can rewrite or hide parts of the displayed output, letting an attacker hide instructions inside data the human never sees but the model still reads.", "atlas": [ { "id": "AML.T0110", "name": "AI Agent Tool Poisoning" }, { "id": "AML.T0068", "name": "LLM Prompt Obfuscation" } ], "owasp": [ { "id": "LLM05", "name": "Improper Output Handling" }, { "id": "ASI02", "name": "Tool Misuse and Exploitation" } ], "attack": [ "attack.stealth", "attack.t1027" ], "cves": [], "id": "netzilo-tool-output-ansi-injection-001", "published": "2026-08-03", "modified": "2026-08-03", "markdown": "https://www.netzilo.com/threats/tool-output-ansi-injection.md" }, { "slug": "tool-parameter-injection", "title": "Tool Parameter Injection Payload", "url": "https://www.netzilo.com/threats/tool-parameter-injection", "severity": "high", "summary": "This rule watches what an AI agent sends to the tools it controls, looking for text shaped like shell escape sequences, SQL injection, path traversal, or template injection. If that same suspicious pattern later shows up in a command actually spawned by the agent, it confirms the payload reached a real execution context, not just a log entry.", "atlas": [], "owasp": [ { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.execution", "attack.t1059" ], "cves": [], "id": "6f3b1a94-2d7c-4e58-9b21-c05a7f8e3d16", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/tool-parameter-injection.md" }, { "slug": "tool-poisoning-ssrf", "title": "Tool Poisoning SSRF Chain (Instance-Resolved)", "url": "https://www.netzilo.com/threats/tool-poisoning-ssrf", "severity": "high", "summary": "An attacker plants a malicious URL inside data an AI agent trusts, such as a tool's input or its description. Later the agent follows that URL and makes a request to a restricted destination like cloud instance metadata, localhost, or an internal-only network address, potentially leaking secrets or reaching systems that should be unreachable from the agent.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.credential-access", "attack.t1552.005", "attack.discovery", "attack.t1046" ], "cves": [], "id": "7f3c1a94-2d68-4b5e-9c07-8a1f6d34be21", "published": "2026-03-14", "modified": "2026-03-14", "markdown": "https://www.netzilo.com/threats/tool-poisoning-ssrf.md" }, { "slug": "tool-registry-tampering", "title": "Tool Registry Description Tampering with Embedded Instructions", "url": "https://www.netzilo.com/threats/tool-registry-tampering", "severity": "high", "summary": "An attacker edits the text description of a tool in an AI agent's tool registry so that it reads like an instruction to the AI model, not documentation for a human. Because AI agents often treat tool descriptions as trusted context, this can trick the model into calling the tool with attacker-chosen arguments or skipping intended safety steps.", "atlas": [ { "id": "AML.T0110", "name": "AI Agent Tool Poisoning" } ], "owasp": [ { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" }, { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.stealth", "attack.t1195.002" ], "cves": [], "id": "20812cdc-0a02-53f1-aabb-0aba1857547d", "published": "2026-03-16", "modified": "2026-03-16", "markdown": "https://www.netzilo.com/threats/tool-registry-tampering.md" }, { "slug": "toolhive-runconfig-secret-read", "title": "ToolHive Run Config Secret Disclosure Access", "url": "https://www.netzilo.com/threats/toolhive-runconfig-secret-read", "severity": "high", "summary": "Older versions of ToolHive, a tool for running MCP servers, stored the credentials used to launch those servers in plain, unencrypted text inside per-server config files. Any process or AI agent that can read the user's home directory can pull those credentials straight out of the files, no access to the actual secrets store required.", "atlas": [], "owasp": [], "attack": [ "attack.credential-access", "attack.t1552", "attack.t1552.001", "attack.collection" ], "cves": [ "CVE-2025-47274" ], "id": "7b3f1c2e-9d4a-4a61-b8f5-2c6e0d914af3", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/toolhive-runconfig-secret-read.md" }, { "slug": "toxic-output-elicitation", "title": "Toxic Output Elicitation - Safety Bypass Evident in Model Response", "url": "https://www.netzilo.com/threats/toxic-output-elicitation", "severity": "medium", "summary": "This detects when an AI language model gets tricked into generating hateful or abusive content instead of refusing the request. It catches the successful moment of a jailbreak, not the attacker's attempts leading up to it.", "atlas": [ { "id": "AML.T0054", "name": "LLM Jailbreak" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.impact" ], "cves": [], "id": "7c1f3a92-5d84-4be6-9f0a-2e6b8d41c7a3", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/toxic-output-elicitation.md" }, { "slug": "unauthenticated-airbnb-mcp-server-launch", "title": "Unauthenticated Third-Party Airbnb MCP Server Launch", "url": "https://www.netzilo.com/threats/unauthenticated-airbnb-mcp-server-launch", "severity": "medium", "summary": "This detects when a machine running AI agents launches a popular but unofficial Airbnb data connector (the hasdata-airbnb-mcp package or similar) without any credential on the command that started it. That connector has no built-in login check of its own, so once it's running, anything on the local network that can talk to it gets full use of Airbnb's hosted data API for free, with no accountability for who made the request.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial-access", "attack.t1195.002" ], "cves": [], "id": "3f7c9a1e-2b64-4d0f-9e51-8c6a4b2d7f13", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/unauthenticated-airbnb-mcp-server-launch.md" }, { "slug": "unauthorized-financial-action", "title": "Unauthorized Financial Action by AI Agent", "url": "https://www.netzilo.com/threats/unauthorized-financial-action", "severity": "high", "summary": "This detects when an AI agent triggers a real financial transaction \u2014 a payment, transfer, wire, or withdrawal \u2014 without any record of human approval attached. It also catches agents that explicitly flip a flag to skip confirmation steps.", "atlas": [ { "id": "AML.T0048", "name": "External Harms" } ], "owasp": [ { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.impact", "attack.t1657" ], "cves": [], "id": "6f2c1b83-9d4a-4e57-b1c2-0a7d5e83f4c9", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/unauthorized-financial-action.md" }, { "slug": "unauthorized-privileged-tool-call", "title": "Unauthorized Privileged Tool Call", "url": "https://www.netzilo.com/threats/unauthorized-privileged-tool-call", "severity": "high", "summary": "This detects a single moment where an AI agent calls a tool that grants it more power than it should have \u2014 like an admin function, a role escalation, a database command that deletes or alters data, or a shell command that assigns a superuser role in a cloud or Kubernetes environment. It flags the call itself, not how the agent was tricked or compromised into making it.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.privilege-escalation", "attack.persistence", "attack.t1098", "attack.t1548" ], "cves": [], "id": "7c1f4a92-3d6b-4e58-9a2c-5f0b8d31e4a7", "published": "2026-03-01", "modified": "2026-03-01", "markdown": "https://www.netzilo.com/threats/unauthorized-privileged-tool-call.md" }, { "slug": "unicode-invisible-smuggling", "title": "Unicode Invisible-Character Data Smuggling in LLM Traffic", "url": "https://www.netzilo.com/threats/unicode-invisible-smuggling", "severity": "high", "summary": "This detects text hidden inside AI conversations using invisible or near-invisible Unicode characters \u2014 a technique sometimes called ASCII smuggling. Attackers use these characters to sneak instructions or data past a human reader while an AI model still processes them.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.defense-evasion", "attack.t1027" ], "cves": [], "id": "b7f3c1d2-9a4e-4f6b-8c05-3d2e7a1f4b96", "published": "2026-03-14", "modified": "2026-03-14", "markdown": "https://www.netzilo.com/threats/unicode-invisible-smuggling.md" }, { "slug": "unicode-stealth-file-backdoor-write", "title": "File Backdoor via Invisible Unicode in Agent File Write", "url": "https://www.netzilo.com/threats/unicode-stealth-file-backdoor-write", "severity": "high", "summary": "An attacker hides malicious instructions inside invisible Unicode characters that get written into files an AI agent creates or edits. A human or reviewer looking at the file sees normal, harmless text, but the interpreter or shell reads something different and executes the hidden payload.", "atlas": [ { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM04", "name": "Data and Model Poisoning" } ], "attack": [ "attack.defense-evasion", "attack.t1027", "attack.persistence" ], "cves": [ "CVE-2021-42574", "CVE-2021-42694" ], "id": "3f0b9c72-6d54-4a1e-9b83-1c7ad6e5f240", "published": "2026-03-14", "modified": "2026-03-14", "markdown": "https://www.netzilo.com/threats/unicode-stealth-file-backdoor-write.md" }, { "slug": "unicode-tag-hidden-instruction-chain", "title": "Hidden Unicode Tag Instruction Then Agent Action", "url": "https://www.netzilo.com/threats/unicode-tag-hidden-instruction-chain", "severity": "high", "summary": "Attackers can hide instructions inside normal-looking text using invisible Unicode 'tag' characters. Some AI models (Gemini-class) silently decode and obey these hidden characters, so an agent reading a GitHub issue, pull request, web page, or tool document can be secretly told what to do without a human ever seeing the instruction.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [], "attack": [ "attack.execution", "attack.t1059", "attack.t1027" ], "cves": [], "id": "7c1e4a92-3f8b-4d06-9a1e-5b2c8f0d4e7a", "published": "2026-03-11", "modified": "2026-03-11", "markdown": "https://www.netzilo.com/threats/unicode-tag-hidden-instruction-chain.md" }, { "slug": "unicode-tag-injection", "title": "Unicode Tag Block Smuggling in Tool Call", "url": "https://www.netzilo.com/threats/unicode-tag-injection", "severity": "medium", "summary": "A rarely-used range of invisible Unicode characters (the Tag block) can be embedded in web pages, documents, or tool outputs that an AI agent reads. Because these characters render as nothing but survive text processing, they let an attacker sneak hidden instructions into an agent's input or exfiltrate stolen data out through the agent's tool calls, all invisibly to a human watching the screen.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.defense-evasion", "attack.t1027", "attack.exfiltration", "attack.t1048" ], "cves": [], "id": "b7e4c1a2-9f3d-4e6b-8c05-2d71f4a9e83c", "published": "2026-03-14", "modified": "2026-03-14", "markdown": "https://www.netzilo.com/threats/unicode-tag-injection.md" }, { "slug": "unicode-variant-selector-smuggling", "title": "Unicode Variant Selector ASCII Smuggling in Tool Response", "url": "https://www.netzilo.com/threats/unicode-variant-selector-smuggling", "severity": "medium", "summary": "Attackers can hide secret instructions inside text that looks completely normal by encoding each hidden character as an invisible Unicode 'variation selector' attached to a visible letter or emoji. A human reading the tool's response sees nothing unusual, but an AI model processing the same text reads the hidden bytes and can be manipulated into following injected instructions.", "atlas": [ { "id": "AML.T0051.001", "name": "Indirect" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.defense-evasion", "attack.t1027" ], "cves": [], "id": "7f3c9a21-4d68-4b0e-9c15-2a8f6b1d4e73", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/unicode-variant-selector-smuggling.md" }, { "slug": "untrusted-skill-install", "title": "Untrusted Package or Skill Installation", "url": "https://www.netzilo.com/threats/untrusted-skill-install", "severity": "high", "summary": "This detects when a system or an AI agent installs a package, dependency, or 'skill' definition directly from a raw URL, GitHub link, or tarball archive rather than from an official package registry. That bypass skips the vetting and version integrity checks a registry normally provides, making it easier to slip in malicious code.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" }, { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" } ], "attack": [ "attack.execution", "attack.t1195" ], "cves": [], "id": "8f715d20-5097-5a36-810f-5c8b9652a17b", "published": "2026-01-25", "modified": "2026-02-24", "markdown": "https://www.netzilo.com/threats/untrusted-skill-install.md" }, { "slug": "unverified-mcp-package-install", "title": "Unverified MCP Server Package Acquisition (verifyfirst-mcp)", "url": "https://www.netzilo.com/threats/unverified-mcp-package-install", "severity": "medium", "summary": "A PyPI package named 'verifyfirst-mcp' advertises itself as a verification/registry tool for MCP servers, but its actual behaviour doesn't match that description. This rule flags any command that installs, adds, or runs this specific package (or name variants like verify_first_mcp) on a host.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial-access", "attack.t1195", "attack.t1195.002", "attack.execution", "attack.t1204.002" ], "cves": [], "id": "7f3c1d92-4b0e-4a7d-9c68-2e5a1b4d8f03", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/unverified-mcp-package-install.md" }, { "slug": "urgency-manipulation", "title": "Urgency and Coercion Pressure in Agent Input", "url": "https://www.netzilo.com/threats/urgency-manipulation", "severity": "high", "summary": "This detects text fed to an AI agent that combines a manufactured sense of urgency with an explicit instruction to bypass a safety check. The idea is to rush the agent into acting before it can verify a request, rather than pretending to have authority.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" }, { "id": "ASI06", "name": "Goal and Instruction Manipulation" } ], "attack": [ "attack.initial-access", "attack.t1566", "attack.stealth", "attack.t1656" ], "cves": [], "id": "63cb1a2f-a7e0-5d3d-9b0e-795d70849fbc", "published": "2026-07-11", "modified": "2026-08-03", "markdown": "https://www.netzilo.com/threats/urgency-manipulation.md" }, { "slug": "url-exfiltration-payload-in-url", "title": "LLM Agent URL Exfiltration - Secret or Bulk Payload Carried in Outbound Request URL", "url": "https://www.netzilo.com/threats/url-exfiltration-payload-in-url", "severity": "high", "summary": "An AI agent that can browse or fetch URLs can be manipulated by malicious instructions hidden in content it reads into sending a web request where the sensitive data itself is embedded in the URL. This lets an attacker steal secrets, credentials, or private conversation text just by looking at the destination the agent contacted, without needing to inspect the request body.", "atlas": [ { "id": "AML.T0025", "name": "Exfiltration via Cyber Means" }, { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration", "attack.t1567", "attack.t1041" ], "cves": [], "id": "4e1a7b62-9c3d-4f58-8a17-2b6d0f9e5c41", "published": "2026-03-05", "modified": "2026-03-05", "markdown": "https://www.netzilo.com/threats/url-exfiltration-payload-in-url.md" }, { "slug": "url-exfiltration-prompt-injection", "title": "URL Exfiltration And Prompt Injection Via Agent Link Handling", "url": "https://www.netzilo.com/threats/url-exfiltration-prompt-injection", "severity": "high", "summary": "Autonomous AI agents that follow links without checking what's in them can be manipulated into leaking API keys, credentials, or chunks of their conversation history by embedding that data in the URL they fetch. The same mechanism can also be used to smuggle hidden instructions to the agent through the link itself.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.exfiltration", "attack.t1567", "attack.t1132" ], "cves": [], "id": "7b3f1c9e-2a64-4f8d-9c17-6d5e0a41b8c2", "published": "2026-03-01", "modified": "2026-03-01", "markdown": "https://www.netzilo.com/threats/url-exfiltration-prompt-injection.md" }, { "slug": "vanna-sql-injection-stacked-statement", "title": "SQL Injection Stacked Statement in LLM-Generated Query Execution", "url": "https://www.netzilo.com/threats/vanna-sql-injection-stacked-statement", "severity": "medium", "summary": "When an AI agent turns a natural-language request into a SQL query and hands it to a command-line database client, an attacker can slip in a semicolon followed by their own command. Vulnerable versions of the Vanna AI toolkit (CVE-2024-7764, <=0.6.2) fail to strip this out, so the attacker's command runs instead of the intended query.", "atlas": [], "owasp": [ { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.execution", "attack.t1059", "attack.t1190" ], "cves": [ "CVE-2024-7764" ], "id": "7f3c1d2e-9b4a-4a61-8f0d-2c5e7a9b6d31", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/vanna-sql-injection-stacked-statement.md" }, { "slug": "vedang-cli-install-payload-chain", "title": "Supply Chain vedang-cli Install Followed By Payload Execution", "url": "https://www.netzilo.com/threats/vedang-cli-install-payload-chain", "severity": "medium", "summary": "This rule watches for a specific two-step pattern: someone installs or runs the PyPI package vedang-cli, and shortly afterward, the same session runs a command that looks like it downloads or executes something (curl, wget, base64-decoded payloads, encoded PowerShell, persistence via cron or launchctl). It does not accuse vedang-cli itself of being malicious \u2014 no wrongdoing has been proven in that package \u2014 it just flags the behavioral sequence for a human to review.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial-access", "attack.t1195.002", "attack.execution", "attack.t1059" ], "cves": [], "id": "7f3c1a9e-2d84-4b16-9c05-8ae4f1d3b72a", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/vedang-cli-install-payload-chain.md" }, { "slug": "vitaminmcp-minecraft-control", "title": "MCP Minecraft Control (vitaminmcp) Agent Process Spawn", "url": "https://www.netzilo.com/threats/vitaminmcp-minecraft-control", "severity": "medium", "summary": "This rule flags when an AI agent starts processes tied to vitaminmcp, a tool that lets the agent control Minecraft servers and bots. It matters because that same capability can be used to open outbound network connections and operate infrastructure without human review.", "atlas": [ { "id": "AML.T0050", "name": "Command and Scripting Interpreter" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1059" ], "cves": [], "id": "7b3f9c42-5d18-4a6e-9f2b-8c41d0a7e365", "published": "2026-03-01", "modified": "2026-03-01", "markdown": "https://www.netzilo.com/threats/vitaminmcp-minecraft-control.md" }, { "slug": "vllm-artifact-pin-decay", "title": "Model Registry Artifact Pin Decay", "url": "https://www.netzilo.com/threats/vllm-artifact-pin-decay", "severity": "high", "summary": "A deployment fetches one model artifact using an immutable commit SHA, giving the appearance of a locked, reproducible setup. Shortly after, in the same session, it loads another artifact that affects runtime behavior \u2014 like a custom Python module, weights, or config \u2014 from a mutable reference such as 'main' or a tag, which can change without notice.", "atlas": [], "owasp": [], "attack": [], "cves": [], "id": "7c3f1ad2-59be-4de1-a1f0-2b6c98d4e5a7", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/vllm-artifact-pin-decay.md" }, { "slug": "vllm-audio-oversized-upload-dos", "title": "vLLM Audio Route Oversized Upload Memory Exhaustion", "url": "https://www.netzilo.com/threats/vllm-audio-oversized-upload-dos", "severity": "medium", "summary": "vLLM's speech-to-text endpoints read the whole uploaded file into memory before checking if it's too large. An attacker who sends very large or repeated large audio uploads can exhaust server memory and crash the inference process, a denial-of-service that costs nothing but bandwidth.", "atlas": [], "owasp": [], "attack": [ "attack.impact", "attack.t1499", "attack.t1499.003" ], "cves": [], "id": "b7c4f0d2-3a19-4e6b-9c58-6f2d1a84e370", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/vllm-audio-oversized-upload-dos.md" }, { "slug": "vllm-audio-upload-memory-exhaustion", "title": "vLLM Audio Endpoint Oversized Upload Burst", "url": "https://www.netzilo.com/threats/vllm-audio-upload-memory-exhaustion", "severity": "medium", "summary": "vLLM's speech-to-text endpoints read the entire uploaded file into memory before checking whether it's too large. An attacker can exploit this by sending a burst of uploads that are guaranteed to exceed the size limit, forcing the server to allocate memory for each one even though it rejects them, which can degrade or crash the service.", "atlas": [ { "id": "AML.T0029", "name": "Denial of AI Service" } ], "owasp": [ { "id": "LLM10", "name": "Unbounded Consumption" } ], "attack": [ "attack.impact", "attack.t1499" ], "cves": [], "id": "6f1d2c47-9ab0-4e5a-8f21-0c7d3b9e4a18", "published": "2026-03-05", "modified": "2026-03-05", "markdown": "https://www.netzilo.com/threats/vllm-audio-upload-memory-exhaustion.md" }, { "slug": "vllm-automap-dynamic-module-rce", "title": "vLLM auto_map Dynamic Module RCE", "url": "https://www.netzilo.com/threats/vllm-automap-dynamic-module-rce", "severity": "high", "summary": "vLLM can be tricked into running attacker-supplied Python code the moment it loads a model, before any API request arrives. This detection watches for the tell-tale two-step: the server reads a suspicious cached module file, then something spawns a shell or downloads/runs a binary in the same session shortly after.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.execution", "attack.t1059.006", "attack.initial-access", "attack.t1195.001" ], "cves": [], "id": "7b3d1c9e-4a52-4f18-9c60-2d8ea1f47b53", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/vllm-automap-dynamic-module-rce.md" }, { "slug": "vllm-automap-remote-code-execution", "title": "vLLM auto_map Remote Code Execution Chain", "url": "https://www.netzilo.com/threats/vllm-automap-remote-code-execution", "severity": "high", "summary": "A malicious model package can point vLLM to a different, attacker-controlled repository for its actual code, even when a server has disabled remote code execution. vLLM loads and runs that second repository's Python module anyway, giving the attacker code execution inside the vLLM process.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.execution", "attack.t1059.006", "attack.t1195.001" ], "cves": [], "id": "7f3c9a41-2d68-4b17-9e05-c8b4a6d21f3e", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/vllm-automap-remote-code-execution.md" }, { "slug": "vllm-completion-prompt-fanout-dos", "title": "vLLM Completion Prompt List Unbounded Fanout", "url": "https://www.netzilo.com/threats/vllm-completion-prompt-fanout-dos", "severity": "high", "summary": "vLLM's completions API accepts a JSON list of prompts in one request, and the server processes every element without any limit. An attacker can send one small HTTP request containing thousands of prompt entries and force the server to spin up matching numbers of concurrent jobs, starving other users of a shared instance.", "atlas": [], "owasp": [ { "id": "LLM10", "name": "Unbounded Consumption" } ], "attack": [ "attack.impact", "attack.t1499", "attack.t1499.002" ], "cves": [], "id": "7c1f4b62-9d3a-4e58-b0a7-2f6c8e51d934", "published": "2026-03-01", "modified": "2026-03-01", "markdown": "https://www.netzilo.com/threats/vllm-completion-prompt-fanout-dos.md" }, { "slug": "vllm-guided-json-invalid-schema-dos", "title": "vLLM Guided Decoding Invalid JSON Schema DoS", "url": "https://www.netzilo.com/threats/vllm-guided-json-invalid-schema-dos", "severity": "high", "summary": "vLLM lets clients request 'guided decoding', where a JSON Schema constrains the model's output format. If that schema contains an invalid 'type' field, the underlying grammar compiler throws an error that isn't caught, and it kills the entire server process instead of just failing the one request.", "atlas": [], "owasp": [], "attack": [ "attack.impact", "attack.t1499", "attack.t1499.004" ], "cves": [], "id": "7b1e4c92-6a3f-4d58-9c41-0e2a7f5b8d63", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/vllm-guided-json-invalid-schema-dos.md" }, { "slug": "vllm-guided-schema-dos", "title": "vLLM Guided Decoding Schema DoS", "url": "https://www.netzilo.com/threats/vllm-guided-schema-dos", "severity": "high", "summary": "A single specially broken JSON Schema sent to a self-hosted vLLM server's guided-decoding feature can crash the engine. This is a denial-of-service issue: one bad request can take down the model server, and repeated requests afterward pile up unanswered.", "atlas": [], "owasp": [], "attack": [ "attack.impact", "attack.t1499", "attack.t1499.004" ], "cves": [], "id": "7c1d4a92-5f3b-4e08-9a67-2d5b8c4f1e03", "published": "2026-03-04", "modified": "2026-03-04", "markdown": "https://www.netzilo.com/threats/vllm-guided-schema-dos.md" }, { "slug": "vllm-mediaconnector-ssrf", "title": "vLLM MediaConnector SSRF to Internal Endpoint", "url": "https://www.netzilo.com/threats/vllm-mediaconnector-ssrf", "severity": "high", "summary": "An attacker gives a vLLM inference server a malicious media URL, and instead of fetching an image or audio file, the server's request gets redirected to internal-only addresses like cloud metadata services or the Kubernetes API. This turns a public AI endpoint into a launchpad for scanning and reaching internal infrastructure.", "atlas": [ { "id": "AML.T0049", "name": "Exploit Public-Facing Application" } ], "owasp": [ { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.initial-access", "attack.t1190", "attack.discovery", "attack.t1046" ], "cves": [], "id": "7c1f2b64-9d3a-4e5b-8a07-3f6d21c4be91", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/vllm-mediaconnector-ssrf.md" }, { "slug": "vllm-messagequeue-pickle-rce", "title": "vLLM MessageQueue Pickle Deserialization RCE Attempt", "url": "https://www.netzilo.com/threats/vllm-messagequeue-pickle-rce", "severity": "high", "summary": "vLLM, a popular AI inference engine, has a flaw where it deserializes untrusted data from its internal message queue using Python's pickle module. Anyone able to reach that queue can send a crafted object that runs arbitrary commands on the server, no authentication needed.", "atlas": [], "owasp": [], "attack": [ "attack.initial-access", "attack.execution", "attack.t1190", "attack.t1059.006" ], "cves": [ "CVE-2024-9052" ], "id": "6f0d1c3a-9b47-4e21-8a5c-2d7f4b9e13c8", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/vllm-messagequeue-pickle-rce.md" }, { "slug": "vllm-mooncake-deser-rce", "title": "vLLM Mooncake Deserialization RCE - Inference Server Spawns Execution Primitive", "url": "https://www.netzilo.com/threats/vllm-mooncake-deser-rce", "severity": "high", "summary": "This rule flags a vLLM or Mooncake inference server process that suddenly launches a shell, reverse shell, or a download-and-execute command. That behaviour matches what would happen after a known deserialization flaw in the Mooncake KV-cache transport is exploited to run attacker code.", "atlas": [], "owasp": [], "attack": [ "attack.initial-access", "attack.t1190", "attack.execution", "attack.t1059", "attack.persistence", "attack.t1098.004" ], "cves": [], "id": "4f6c1d9e-8a72-4b31-9c5e-2d1a7f0b6e84", "published": "2026-03-14", "modified": "2026-03-14", "markdown": "https://www.netzilo.com/threats/vllm-mooncake-deser-rce.md" }, { "slug": "vllm-mooncake-pickle-rce", "title": "vLLM Mooncake ZeroMQ Pickle Deserialization Exposure", "url": "https://www.netzilo.com/threats/vllm-mooncake-pickle-rce", "severity": "high", "summary": "Some versions of vLLM's Mooncake KV-transfer integration open a network socket that accepts and unpickles data from anyone who can reach it. Because Python's pickle deserialization can execute arbitrary code, any host that can connect to that port can run commands as the inference server.", "atlas": [], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial-access", "attack.t1190", "attack.execution", "attack.t1059.006" ], "cves": [ "CVE-2025-32444" ], "id": "9d4c7e12-6b8a-4f31-b2d7-5e0a91c8f463", "published": "2026-03-14", "modified": "2026-03-14", "markdown": "https://www.netzilo.com/threats/vllm-mooncake-pickle-rce.md" }, { "slug": "vllm-mrope-prompt-embeds-dos", "title": "vLLM M-RoPE Pure Prompt-Embeds DoS Attempt", "url": "https://www.netzilo.com/threats/vllm-mrope-prompt-embeds-dos", "severity": "high", "summary": "A specially crafted API request can crash a self-hosted vLLM inference server in one shot. The request sends only a precomputed embedding tensor with no accompanying text prompt, which triggers an internal assertion failure and kills the entire inference process for everyone using that server.", "atlas": [], "owasp": [], "attack": [ "attack.impact", "attack.t1499", "attack.t1499.004" ], "cves": [], "id": "7b3f2a91-5c4d-4e8a-9f21-6d0c8b7a4e13", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/vllm-mrope-prompt-embeds-dos.md" }, { "slug": "vllm-openai-serving-resource-teardown-dos", "title": "vLLM OpenAI-Compatible Serving Path Resource Teardown DoS Payload", "url": "https://www.netzilo.com/threats/vllm-openai-serving-resource-teardown-dos", "severity": "high", "summary": "This rule flags single API requests to a vLLM model-serving endpoint that contain parameter values no normal client would ever send, such as negative or absurd token limits. These malformed requests can trigger a resource cleanup bug in vLLM 0.19.0's OpenAI-compatible server, causing the inference service to fail.", "atlas": [], "owasp": [], "attack": [ "attack.impact", "attack.t1499", "attack.t1499.004" ], "cves": [], "id": "7b3c9f2e-5a41-4d86-9c07-2f8e6b1a4d53", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/vllm-openai-serving-resource-teardown-dos.md" }, { "slug": "vllm-optimized-mode-assert-bypass", "title": "vLLM Assert-Stripped Activation Function Load", "url": "https://www.netzilo.com/threats/vllm-optimized-mode-assert-bypass", "severity": "medium", "summary": "vLLM is an inference server for running large language models. It has an internal safety check that stops a model's config file from pointing at arbitrary Python code, but that check only exists as a Python assert statement. If vLLM is started with assertions turned off, the check silently disappears, and a malicious model config can then run arbitrary code on the server.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.execution", "attack.t1059.006", "attack.t1195.001" ], "cves": [], "id": "7c3f1d2e-9a54-4b61-8f27-0d5a6e3b91c4", "published": "2026-03-14", "modified": "2026-03-14", "markdown": "https://www.netzilo.com/threats/vllm-optimized-mode-assert-bypass.md" }, { "slug": "vllm-optimized-mode-model-rce", "title": "vLLM Assert Bypass - Optimized Mode Model Load RCE", "url": "https://www.netzilo.com/threats/vllm-optimized-mode-model-rce", "severity": "high", "summary": "vLLM, a popular server for running AI models, has a safety check that stops models from executing arbitrary code through a malicious 'activation function' setting. That check is written as a Python assert statement, which Python silently removes if the server is started in optimized mode. This detection flags when vLLM is launched with optimized mode turned on, which is the moment the server becomes exposed to this attack.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial-access", "attack.execution", "attack.defense-evasion", "attack.t1195.001", "attack.t1059.006" ], "cves": [], "id": "7f3c1a92-4d5e-4b0a-9c31-2f8b6ea41d57", "published": "2026-03-18", "modified": "2026-03-18", "markdown": "https://www.netzilo.com/threats/vllm-optimized-mode-model-rce.md" }, { "slug": "vllm-outlines-cache-exhaustion", "title": "vLLM Outlines Grammar Cache Exhaustion Attempt", "url": "https://www.netzilo.com/threats/vllm-outlines-cache-exhaustion", "severity": "medium", "summary": "vLLM's structured-output feature (guided_json, guided_regex, guided_grammar) compiles a new cached grammar for every schema it has not seen before. An attacker who sends a fast stream of requests each with a slightly different schema forces the server to keep compiling and caching new grammars, which can fill up disk space and eventually deny service.", "atlas": [], "owasp": [], "attack": [ "attack.impact", "attack.t1499", "attack.t1499.003" ], "cves": [], "id": "7b3f1c2e-9a54-4d6b-8f21-c0d47e6a15b9", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/vllm-outlines-cache-exhaustion.md" }, { "slug": "vllm-outlines-cache-flood", "title": "vLLM Structured-Decoding Grammar Cache Flood", "url": "https://www.netzilo.com/threats/vllm-outlines-cache-flood", "severity": "high", "summary": "An attacker sends many structured-output requests to a vLLM inference server, each with a slightly different JSON schema or grammar. vLLM compiles and saves a new artifact to disk for every distinct schema, so a stream of unique schemas fills up disk space or resource capacity over time.", "atlas": [ { "id": "AML.T0029", "name": "Denial of AI Service" } ], "owasp": [ { "id": "LLM10", "name": "Unbounded Consumption" } ], "attack": [ "attack.impact", "attack.t1499", "attack.t1499.001" ], "cves": [], "id": "7b3c1f9e-4d2a-4f6b-9c81-2e5a6d0f38b4", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/vllm-outlines-cache-flood.md" }, { "slug": "vllm-outlines-grammar-cache-dos", "title": "vLLM Outlines Grammar Cache Exhaustion", "url": "https://www.netzilo.com/threats/vllm-outlines-grammar-cache-dos", "severity": "high", "summary": "An attacker sends a flood of requests to a vLLM server's structured-output feature, making every request use a brand-new JSON schema. Because vLLM caches a compiled grammar file for every distinct schema and never deletes old ones, this fills up the server's disk and can take the service down for everyone using it.", "atlas": [], "owasp": [], "attack": [ "attack.impact", "attack.t1499", "attack.t1499.001" ], "cves": [], "id": "3f7c1a92-8b4e-4d61-9a05-6e2fb1c7d840", "published": "2026-03-05", "modified": "2026-03-05", "markdown": "https://www.netzilo.com/threats/vllm-outlines-grammar-cache-dos.md" }, { "slug": "vllm-oversized-header-dos", "title": "vLLM Oversized HTTP Header Resource Exhaustion", "url": "https://www.netzilo.com/threats/vllm-oversized-header-dos", "severity": "medium", "summary": "An attacker sends an HTTP request to a vLLM inference server with an abnormally large header value, such as a multi-gigabyte X-Forwarded-For string. The server buffers this into memory while parsing it, which can exhaust memory and crash or degrade the process, denying service to legitimate users.", "atlas": [], "owasp": [], "attack": [ "attack.impact", "attack.t1499" ], "cves": [], "id": "6b1d4f0a-9c52-4a1e-8f37-2d5e7a03c9b4", "published": "2026-03-05", "modified": "2026-03-05", "markdown": "https://www.netzilo.com/threats/vllm-oversized-header-dos.md" }, { "slug": "vllm-pickle-weights-rce", "title": "vLLM Malicious Model Weights Deserialization RCE", "url": "https://www.netzilo.com/threats/vllm-pickle-weights-rce", "severity": "high", "summary": "An attacker embeds a hidden pickle payload inside a model checkpoint file hosted on a model hub. When a vLLM inference server loads that checkpoint, the payload runs automatically inside the server process, giving the attacker code execution on the host.", "atlas": [], "owasp": [], "attack": [ "attack.execution", "attack.t1059.006", "attack.initial-access", "attack.t1195.001" ], "cves": [], "id": "7c1e9a34-5f2b-4d68-9a01-3e6b8f2c4d17", "published": "2026-06-01", "modified": "2026-06-01", "markdown": "https://www.netzilo.com/threats/vllm-pickle-weights-rce.md" }, { "slug": "vllm-pyncclpipe-pickle-rce", "title": "vLLM PyNcclPipe Unsafe Pickle Deserialization RCE", "url": "https://www.netzilo.com/threats/vllm-pyncclpipe-pickle-rce", "severity": "high", "summary": "vLLM's disaggregated-prefill feature moves data between servers using Python's pickle format, which can execute arbitrary code when loading untrusted input. An attacker who can reach this channel can trigger remote code execution on the vLLM server, and a related networking bug means the channel is often reachable even when configured to be private.", "atlas": [], "owasp": [], "attack": [ "attack.initial-access", "attack.t1190", "attack.execution", "attack.t1059.006" ], "cves": [], "id": "3f7a1c92-5e84-4d6b-9a1f-0c2be7d5a483", "published": "2026-01-14", "modified": "2026-01-14", "markdown": "https://www.netzilo.com/threats/vllm-pyncclpipe-pickle-rce.md" }, { "slug": "vllm-recv-object-pickle-rce", "title": "vLLM GroupCoordinator recv_object Pickle Deserialization RCE", "url": "https://www.netzilo.com/threats/vllm-recv-object-pickle-rce", "severity": "high", "summary": "vLLM 0.6.0 has a flaw where a worker process trusts and deserializes raw pickle data sent to it over its internal distributed-inference transport. Because pickle can run arbitrary code during deserialization, an attacker who can reach that transport can make the vLLM worker spawn a shell or run commands.", "atlas": [ { "id": "AML.T0050", "name": "Command and Scripting Interpreter" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial-access", "attack.t1190", "attack.execution", "attack.t1059.006" ], "cves": [], "id": "b7f4c2a1-9e63-4d0f-8a51-3c6d5e2f7b94", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/vllm-recv-object-pickle-rce.md" }, { "slug": "vllm-revision-pinning-bypass", "title": "Model Supply Chain - vLLM Incomplete Revision Pinning at Launch", "url": "https://www.netzilo.com/threats/vllm-revision-pinning-bypass", "severity": "medium", "summary": "vLLM lets operators pin a model to a specific commit so it can't silently change, but that pin doesn't cover everything. Remote code, GGUF weight files, and companion tokenizer repos can still be pulled from the repository's default branch even when the operator thinks the whole model is locked down.", "atlas": [ { "id": "AML.T0011", "name": "User Execution" } ], "owasp": [], "attack": [ "attack.initial_access", "attack.t1195.002" ], "cves": [], "id": "6f1c9a24-7d8e-4b3a-9c05-2ae4f7b18d31", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/vllm-revision-pinning-bypass.md" }, { "slug": "vllm-rpc-pickle-deserialization-rce", "title": "Model Serving RCE - vLLM RPC Pickle Deserialization Exploit", "url": "https://www.netzilo.com/threats/vllm-rpc-pickle-deserialization-rce", "severity": "high", "summary": "vLLM, a popular tool for serving large language models, has an internal RPC channel that deserializes attacker-supplied data using Python's pickle format. Pickle deserialization can be weaponized to run arbitrary code, so an attacker who can reach this RPC interface can potentially execute commands on the server hosting the model.", "atlas": [], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial-access", "attack.t1190", "attack.execution", "attack.t1059.006" ], "cves": [], "id": "7b3f1d2e-9c84-4a17-b0e5-2f6a8d41c9e3", "published": "2026-03-05", "modified": "2026-03-05", "markdown": "https://www.netzilo.com/threats/vllm-rpc-pickle-deserialization-rce.md" }, { "slug": "vllm-torch-weights-only-bypass-rce", "title": "Malicious Model RCE - PyTorch weights_only Bypass in vLLM Launch", "url": "https://www.netzilo.com/threats/vllm-torch-weights-only-bypass-rce", "severity": "high", "summary": "PyTorch model files saved in the old pickle format can run arbitrary code when loaded, and a flaw in versions before 2.6.0 means even the 'safe' weights_only setting doesn't stop it. This rule flags command lines that load models this way, especially from untrusted or writable locations.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.execution", "attack.t1059.006", "attack.t1204.002" ], "cves": [], "id": "7b3f1c9e-2d54-4a86-9f1b-6c0e8a4d5b72", "published": "2026-03-11", "modified": "2026-03-11", "markdown": "https://www.netzilo.com/threats/vllm-torch-weights-only-bypass-rce.md" }, { "slug": "vllm-trust-remote-code-override", "title": "vLLM Hardcoded trust_remote_code Override", "url": "https://www.netzilo.com/threats/vllm-trust-remote-code-override", "severity": "high", "summary": "vLLM lets operators disable automatic execution of code bundled inside a model repository by setting trust_remote_code=False. For a handful of model families (Nemotron-VL, Kimi-K2.5), vLLM's own loading code ignores that setting and runs the model's Python code anyway. This turns a security control into a false sense of safety.", "atlas": [], "owasp": [], "attack": [ "attack.execution", "attack.t1059.006", "attack.defense-evasion", "attack.t1562.001", "attack.t1195.001" ], "cves": [], "id": "6f2c7b41-9d3e-4a58-b0c7-2e1f84d5a9c3", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/vllm-trust-remote-code-override.md" }, { "slug": "vllm-unbounded-completion-multiplicity-dos", "title": "vLLM Unbounded Completion Multiplicity DoS", "url": "https://www.netzilo.com/threats/vllm-unbounded-completion-multiplicity-dos", "severity": "high", "summary": "Attackers can crash an AI inference server by asking it to generate an absurdly large number of completions in a single request. vLLM and similar OpenAI-compatible servers don't check whether this number is reasonable before trying to fulfill it, so the server exhausts memory and freezes.", "atlas": [], "owasp": [], "attack": [ "attack.impact", "attack.t1499", "attack.t1499.004" ], "cves": [], "id": "b7c4e1a9-3f52-4d8e-9a61-0c7d5f2ab834", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/vllm-unbounded-completion-multiplicity-dos.md" }, { "slug": "vllm-unbounded-fanout-dos", "title": "vLLM Unbounded Fan-Out Parameter DoS Attempt", "url": "https://www.netzilo.com/threats/vllm-unbounded-fanout-dos", "severity": "high", "summary": "An AI agent (or something it runs) can send one specially crafted request to a vLLM inference server asking for an enormous number of completions in a single call. Because vLLM doesn't cap this number, the server tries to fulfill it, exhausts memory and CPU, and gets killed by the operating system \u2014 taking down the service for everyone else using it.", "atlas": [], "owasp": [ { "id": "LLM10", "name": "Unbounded Consumption" } ], "attack": [ "attack.impact", "attack.t1499", "attack.t1499.004" ], "cves": [], "id": "7a2f4c18-9d63-4e5b-b1a7-0c8e5d34f962", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/vllm-unbounded-fanout-dos.md" }, { "slug": "vllm-unsafe-checkpoint-deserialization", "title": "vLLM Malicious Model Checkpoint Deserialization", "url": "https://www.netzilo.com/threats/vllm-unsafe-checkpoint-deserialization", "severity": "high", "summary": "vLLM and similar tools load model weights using Python's pickle format, which can run arbitrary code during loading. An attacker who can get a poisoned checkpoint file loaded gets code execution on the machine that loads it.", "atlas": [], "owasp": [], "attack": [ "attack.execution", "attack.t1059.006", "attack.t1195.002" ], "cves": [], "id": "7c1f4b2e-9a63-4d81-b0c5-3f6a2d5e8471", "published": "2026-03-14", "modified": "2026-03-14", "markdown": "https://www.netzilo.com/threats/vllm-unsafe-checkpoint-deserialization.md" }, { "slug": "vllm-v0-zeromq-pickle-rce", "title": "vLLM V0 Multi-Node ZeroMQ Pickle Deserialization RCE Surface", "url": "https://www.netzilo.com/threats/vllm-v0-zeromq-pickle-rce", "severity": "high", "summary": "vLLM's older V0 engine, when run across multiple machines, sends data between nodes using Python's pickle format over ZeroMQ sockets. Pickle data can execute arbitrary code when loaded, so any host that can reach the ZeroMQ port of a V0 multi-node deployment can potentially run code on it. This detection flags both the risky configuration and command lines that actively use the pickle/ZeroMQ primitives together.", "atlas": [], "owasp": [], "attack": [ "attack.execution", "attack.t1059.006", "attack.lateral-movement", "attack.t1210" ], "cves": [ "CVE-2025-30165" ], "id": "7b1e4c8a-2d93-4f61-9a0e-5c8d3f27b4e1", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/vllm-v0-zeromq-pickle-rce.md" }, { "slug": "vllm-video-frame-flood-dos", "title": "vLLM Unbounded Video Frame Flood (Multimodal Resource Exhaustion)", "url": "https://www.netzilo.com/threats/vllm-video-frame-flood-dos", "severity": "medium", "summary": "A local process or AI agent can send a specially crafted video request to a vLLM server that packs in far more video frames than the server is designed to handle. Because one code path skips the normal frame-count limit, the server tries to decode all the frames into memory at once, which can exhaust RAM and crash the process.", "atlas": [ { "id": "AML.T0050", "name": "Command and Scripting Interpreter" } ], "owasp": [ { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" } ], "attack": [ "attack.impact", "attack.t1499" ], "cves": [], "id": "6b1f0a9c-42d7-4c3e-9a58-77f0d1c8e214", "published": "2026-02-19", "modified": "2026-02-19", "markdown": "https://www.netzilo.com/threats/vllm-video-frame-flood-dos.md" }, { "slug": "vllm-video-jpeg2000-rce", "title": "vLLM Video JPEG2000 Decoder RCE Attempt", "url": "https://www.netzilo.com/threats/vllm-video-jpeg2000-rce", "severity": "high", "summary": "An attacker sends a crafted JPEG2000-family video file to a vLLM server's chat or inference endpoint. The file exploits a bug in the bundled FFmpeg decoder used for video understanding, corrupting memory in a way that triggers a system() call and runs attacker commands on the server.", "atlas": [], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial-access", "attack.t1190", "attack.execution", "attack.t1059.004" ], "cves": [], "id": "7f3c1d2e-9b64-4a17-b0d5-6c8e2f4a91d3", "published": "2025-11-18", "modified": "2025-11-18", "markdown": "https://www.netzilo.com/threats/vllm-video-jpeg2000-rce.md" }, { "slug": "vllm-vision-placeholder-dos", "title": "vLLM Vision Placeholder Token DoS Payload", "url": "https://www.netzilo.com/threats/vllm-vision-placeholder-dos", "severity": "medium", "summary": "A malformed request to a vLLM-based AI model server includes special multimodal placeholder tokens that are supposed to mark where an image or video goes, but no actual image or video is attached. This mismatch can crash the model's worker process, taking the service down.", "atlas": [ { "id": "AML.T0029", "name": "Denial of AI Service" } ], "owasp": [ { "id": "LLM10", "name": "Unbounded Consumption" } ], "attack": [ "attack.impact", "attack.t1499", "attack.t1499.004" ], "cves": [], "id": "3f8c1d92-7ab4-4e15-9c60-5d2e8a41b7f3", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/vllm-vision-placeholder-dos.md" }, { "slug": "vllm-zeromq-pickle-rce", "title": "vLLM ZeroMQ Pickle Deserialization RCE - Payload Spawn Under Inference Server", "url": "https://www.netzilo.com/threats/vllm-zeromq-pickle-rce", "severity": "high", "summary": "A known flaw in vLLM's ZeroMQ-based KV-cache transfer feature (versions 0.6.5\u20130.8.4) lets anyone who can reach the exposed network socket send a malicious data payload that the server unpacks unsafely, causing it to run arbitrary code. This rule watches for the moment that code execution actually happens, not the network exploit itself.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [], "attack": [ "attack.initial_access", "attack.t1190", "attack.execution", "attack.t1059", "attack.t1203" ], "cves": [ "CVE-2025-32444" ], "id": "3f7a2c1d-9b64-4e5a-8c2f-1d6b0a94e7c3", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/vllm-zeromq-pickle-rce.md" }, { "slug": "vulnerable-dependency", "title": "Known Vulnerable Package Installation", "url": "https://www.netzilo.com/threats/vulnerable-dependency", "severity": "high", "summary": "This rule flags when someone installs a software package via pip (Python) or npm (Node.js) that has a publicly known vulnerability. It relies on a fixed, built-in list of high-severity vulnerable packages rather than checking a live vulnerability database, so it only catches vulnerabilities that were known at the time the list was built.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" }, { "id": "ASI08", "name": "Supply Chain Attacks on Agent Ecosystems" } ], "attack": [ "attack.initial-access", "attack.t1195", "attack.supply-chain" ], "cves": [], "id": "b1e2f3a4-b5c6-4d78-9012-e3f4a5b6c7d8", "published": "2026-06-03", "modified": "2026-06-03", "markdown": "https://www.netzilo.com/threats/vulnerable-dependency.md" }, { "slug": "webshell-patterns", "title": "Webshell Pattern in Agent-Written or Executed Code", "url": "https://www.netzilo.com/threats/webshell-patterns", "severity": "critical", "summary": "This rule flags webshell code appearing in files that an AI agent writes or in the content it passes through tool calls. A webshell is a small script an attacker plants on a server so they can run commands remotely through a web request, giving them a persistent backdoor.", "atlas": [ { "id": "AML.T0053", "name": "AI Agent Tool Invocation" }, { "id": "AML.T0050", "name": "Command and Scripting Interpreter" } ], "owasp": [ { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" } ], "attack": [ "attack.persistence", "attack.t1546", "attack.execution", "attack.t1059" ], "cves": [], "id": "88b9c0d1-e2f3-4a45-6789-b0c1d2e3f4a5", "published": "2026-06-03", "modified": "2026-06-03", "markdown": "https://www.netzilo.com/threats/webshell-patterns.md" }, { "slug": "write-prompt-injection", "title": "Prompt Injection via File Write", "url": "https://www.netzilo.com/threats/write-prompt-injection", "severity": "high", "summary": "An AI agent can be tricked into writing a file whose content is not just data but a hidden instruction meant to manipulate whoever reads it next \u2014 another AI agent, or the same agent in a future session. This turns ordinary file output into a delivery mechanism for hijacking AI behaviour.", "atlas": [ { "id": "AML.T0080", "name": "AI Agent Context Poisoning" }, { "id": "AML.T0070", "name": "RAG Poisoning" } ], "owasp": [ { "id": "ASI04", "name": "Memory and Context Poisoning" }, { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.initial-access", "attack.t1566" ], "cves": [], "id": "a0fc6a5a-7c68-5396-94d5-4096c8e5b013", "published": "2026-02-17", "modified": "2026-02-24", "markdown": "https://www.netzilo.com/threats/write-prompt-injection.md" }, { "slug": "write-then-execute", "title": "Write-Then-Execute Script in Temporary Directory", "url": "https://www.netzilo.com/threats/write-then-execute", "severity": "high", "summary": "This rule flags a two-step pattern: something writes a script file into /tmp, /var/tmp, or /dev/shm, and then that same script gets executed. This is a common way to drop and run code that isn't meant to leave a trace in a normal application directory.", "atlas": [ { "id": "AML.T0050", "name": "Command and Scripting Interpreter" } ], "owasp": [ { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" } ], "attack": [ "attack.execution", "attack.t1059", "attack.stealth", "attack.t1027" ], "cves": [], "id": "2564f91e-155e-5d1c-afda-718922bb8a5f", "published": "2026-02-26", "modified": "2026-06-02", "markdown": "https://www.netzilo.com/threats/write-then-execute.md" }, { "slug": "write-then-execute-periodic", "title": "Write-Then-Execute Script in Temporary Directory (EDR Graph)", "url": "https://www.netzilo.com/threats/write-then-execute-periodic", "severity": "high", "summary": "This detects a common malware pattern: a program drops a script file into a temporary directory like /tmp or /dev/shm and then executes it right away. Legitimate software rarely needs to write and run scripts from these locations, so this sequence is a strong sign of an attack in progress.", "atlas": [ { "id": "AML.T0050", "name": "Command and Scripting Interpreter" } ], "owasp": [ { "id": "ASI07", "name": "Unsafe Autonomous Code Execution" } ], "attack": [ "attack.execution", "attack.t1059" ], "cves": [], "id": "2564f91e-155e-5d1c-afda-718922bb8a5f-p", "published": "2026-06-02", "modified": "2026-06-02", "markdown": "https://www.netzilo.com/threats/write-then-execute-periodic.md" }, { "slug": "xinference-llama3-toolcall-eval-rce", "title": "Xinference Llama3 Tool-Call eval() RCE Payload", "url": "https://www.netzilo.com/threats/xinference-llama3-toolcall-eval-rce", "severity": "high", "summary": "Xinference's Llama3 tool-calling feature runs raw model output through Python's eval(), a design flaw that lets an attacker smuggle malicious Python code inside a chat completion request. If the code contains both a way to escape sandboxing and a command to run or data to steal, the server executes it directly on the host.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.initial-access", "attack.t1190", "attack.execution", "attack.t1059.006" ], "cves": [], "id": "7c3f9e14-2b6a-4d58-9f0c-5a1e8b47d3ce", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/xinference-llama3-toolcall-eval-rce.md" }, { "slug": "yaml-include-file-inclusion-chain", "title": "YAML Include Directive Resolved To Sensitive File Read", "url": "https://www.netzilo.com/threats/yaml-include-file-inclusion-chain", "severity": "high", "summary": "Some AI agent tools parse YAML configuration that can contain special directives like !include or unsafe object-construction tags. This rule catches cases where such a directive in YAML text actually caused the agent to open a sensitive file or launch a shell/interpreter, not just cases where the YAML text merely contains the directive.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "LLM04", "name": "Data and Model Poisoning" } ], "attack": [ "attack.credential-access", "attack.t1552.001", "attack.execution", "attack.t1059" ], "cves": [], "id": "7c1e4a92-3b6d-4f18-9c05-2a8f6d51b4e7", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/yaml-include-file-inclusion-chain.md" }, { "slug": "pypi-fantasy-football-manager-supply-chain", "title": "Malicious PyPI Package fantasy-football-manager Acquisition", "url": "https://www.netzilo.com/threats/pypi-fantasy-football-manager-supply-chain", "severity": "high", "summary": "This package pretends to be ESPN fantasy football draft/lineup tooling for Codex and other MCP-based AI clients. The rule flags the moment someone installs it, downloads its files, or even just looks it up on a package index or mirror, whatever the name's punctuation style.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" }, { "id": "AML.T0011", "name": "User Execution" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial-access", "attack.execution", "attack.t1195.001", "attack.t1204.002" ], "cves": [], "id": "7f3c1d2a-9b64-4e18-8f5a-2c6d0b41ae93", "published": "2026-03-14", "modified": "2026-03-14", "markdown": "https://www.netzilo.com/threats/pypi-fantasy-football-manager-supply-chain.md" }, { "slug": "transformers-url-username-injection", "title": "Transformers URL Username Injection - Origin Impersonation Fetch", "url": "https://www.netzilo.com/threats/transformers-url-username-injection", "severity": "high", "summary": "Older versions of the Transformers library checked if an image or model URL was 'trusted' by simply looking at whether the URL string starts with a known domain. Attackers can craft URLs that pass this check but actually connect somewhere else entirely, letting them redirect the fetch to a malicious server.", "atlas": [], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.defense-evasion", "attack.t1036", "attack.command-and-control", "attack.t1071.001" ], "cves": [], "id": "0f2a6c19-4c8b-4d7e-9a3f-1b5e8c274d63", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/transformers-url-username-injection.md" }, { "slug": "torch-checkpoint-unsafe-load-exec", "title": "Unsafe Torch Checkpoint Deserialization to Process Execution", "url": "https://www.netzilo.com/threats/torch-checkpoint-unsafe-load-exec", "severity": "high", "summary": "PyTorch training checkpoints can carry hidden code that runs automatically when a program loads them to resume training. If an attacker plants a booby-trapped checkpoint file, simply resuming training can hand them command execution on the machine.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" }, { "id": "AML.T0011", "name": "User Execution" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.execution", "attack.t1059.006", "attack.t1204.002" ], "cves": [], "id": "9c4b7e21-3f6a-4d18-b5e2-7a0c94d61f8b", "published": "2026-06-02", "modified": "2026-06-02", "markdown": "https://www.netzilo.com/threats/torch-checkpoint-unsafe-load-exec.md" }, { "slug": "vllm-derender-unbounded-token-decode", "title": "vLLM Derender Endpoint Unbounded Token Decode", "url": "https://www.netzilo.com/threats/vllm-derender-unbounded-token-decode", "severity": "medium", "summary": "vLLM exposes endpoints that turn token IDs back into text (derender). Because these endpoints don't check how many tokens or choices are in a request, an authenticated caller can send absurdly large or fabricated data to force expensive decoding work, slowing or crashing the service for everyone else using it.", "atlas": [ { "id": "AML.T0029", "name": "Denial of AI Service" } ], "owasp": [ { "id": "LLM10", "name": "Unbounded Consumption" } ], "attack": [ "attack.impact", "attack.t1499", "attack.t1499.004" ], "cves": [], "id": "3f6b1c94-2d5a-4e08-9b71-0a4c8d5e2716", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/vllm-derender-unbounded-token-decode.md" }, { "slug": "pypi-creativetasks-supply-chain", "title": "Supply Chain \u2014 PyPI 'creativetasks' Acquisition and Execution (instance-resolved)", "url": "https://www.netzilo.com/threats/pypi-creativetasks-supply-chain", "severity": "medium", "summary": "This rule flags when someone on a monitored machine installs or runs a package called 'creativetasks' from PyPI, a newly published tool advertising itself as a terminal chat/coding-agent interface. It is not confirmed malicious \u2014 the alert exists so an analyst can review what happened in that session, not to block anything.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial-access", "attack.execution", "attack.t1195.002", "attack.t1059.006" ], "cves": [], "id": "7c3f9a41-5b2e-4d68-9f0a-1e6b8c4d2a35", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/pypi-creativetasks-supply-chain.md" }, { "slug": "vllm-jpeg2000-video-rce", "title": "vLLM JPEG2000 Video RCE Delivery", "url": "https://www.netzilo.com/threats/vllm-jpeg2000-video-rce", "severity": "high", "summary": "Attackers can exploit a vulnerability in how vLLM's inference server decodes JPEG2000 video via OpenCV's bundled FFmpeg. A crafted image file triggers a heap overflow that lets the attacker run arbitrary shell commands on the server, including spawning a reverse shell.", "atlas": [], "owasp": [], "attack": [ "attack.initial-access", "attack.t1190", "attack.execution", "attack.t1203", "attack.t1059.004" ], "cves": [], "id": "7b3c9d54-2f8e-4a61-9c0d-5e18a7b6f342", "published": "2026-03-14", "modified": "2026-03-14", "markdown": "https://www.netzilo.com/threats/vllm-jpeg2000-video-rce.md" }, { "slug": "pypi-claudex-export-install", "title": "Supply Chain PyPI Install of claudex-export", "url": "https://www.netzilo.com/threats/pypi-claudex-export-install", "severity": "medium", "summary": "This detects when an AI coding agent (or a process it spawned) runs pip to install a specific package called claudex-export. The package claims to export Codex/Claude Code session data, but it is newly published and has not been vetted \u2014 so this flags the install attempt for review, not because malice has been confirmed.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial-access", "attack.t1195.002" ], "cves": [], "id": "7c1f2b64-9d3a-4a58-b0e7-5f2c8e41d93a", "published": "2026-03-01", "modified": "2026-03-01", "markdown": "https://www.netzilo.com/threats/pypi-claudex-export-install.md" }, { "slug": "hf-transformers-unsafe-deserialization", "title": "ML Supply Chain \u2014 HF Transformers Unsafe Model Deserialization", "url": "https://www.netzilo.com/threats/hf-transformers-unsafe-deserialization", "severity": "medium", "summary": "This detects command lines that load a machine learning model in a way known to execute arbitrary code \u2014 either by telling Hugging Face Transformers to run custom code bundled with a model, or by using Python's insecure pickle-based loaders on model files. Both are common, legitimate ML operations, but they're also the standard way a malicious model gets to run code on whoever loads it.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" }, { "id": "AML.T0011", "name": "User Execution" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.execution", "attack.t1059.006", "attack.t1204.002" ], "cves": [], "id": "7b1e4c8a-2f63-4d19-9c05-3ae87f2d6b41", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/hf-transformers-unsafe-deserialization.md" }, { "slug": "pypi-book-recommendations-supply-chain", "title": "Malicious PyPI Distribution Acquisition - book-recommendations", "url": "https://www.netzilo.com/threats/pypi-book-recommendations-supply-chain", "severity": "high", "summary": "This detects an AI agent downloading a specific malicious Python package from PyPI that disguises itself as a helper for OpenLibrary book recommendations. The rule also flags if the same session then talks to a new external server it has never contacted before, which can indicate a follow-on stage of the attack.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial-access", "attack.t1195.001" ], "cves": [], "id": "7f3c1d8e-4b2a-4c96-9e57-2a1f0b6d84c3", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/pypi-book-recommendations-supply-chain.md" }, { "slug": "system-prompt-exfil-to-file", "title": "Agent System Prompt Extraction Written To File", "url": "https://www.netzilo.com/threats/system-prompt-exfil-to-file", "severity": "medium", "summary": "An attacker asks an AI agent to reveal its system prompt, then gets the agent to save that hidden instruction text to a file on disk instead of just displaying it. This rule spots the file-write command as it happens.", "atlas": [], "owasp": [ { "id": "LLM07", "name": "System Prompt Leakage" } ], "attack": [ "attack.collection", "attack.t1059" ], "cves": [], "id": "7b3d9f42-5c81-4e6a-9b0d-2f8a41c7de35", "published": "2026-03-14", "modified": "2026-03-14", "markdown": "https://www.netzilo.com/threats/system-prompt-exfil-to-file.md" }, { "slug": "sympify-code-execution", "title": "Symbolic Math RCE - sympify Eval Gadget in Spawned Process", "url": "https://www.netzilo.com/threats/sympify-code-execution", "severity": "high", "summary": "A LangChain component meant to solve math expressions (LLMSymbolicMathChain) actually runs input through Python's eval() under the hood. An attacker who controls what text gets sent to it can smuggle in Python code disguised as a 'math expression' and get it executed on the server.", "atlas": [], "owasp": [ { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.execution", "attack.t1059.006" ], "cves": [ "CVE-2024-46946" ], "id": "7b1c4e2a-9d34-4f6b-a1c8-5e0f2d7b96c4", "published": "2026-03-01", "modified": "2026-03-01", "markdown": "https://www.netzilo.com/threats/sympify-code-execution.md" }, { "slug": "mcp-symlink-containment-bypass", "title": "MCP Filesystem Symlink Containment Escape Artefacts", "url": "https://www.netzilo.com/threats/mcp-symlink-containment-bypass", "severity": "medium", "summary": "This rule spots early warning signs that someone is trying to break out of the folder an AI agent's filesystem tool is supposed to be confined to. It does not see the actual breakout \u2014 only the setup moves that typically precede it.", "atlas": [], "owasp": [ { "id": "LLM06", "name": "Excessive Agency" }, { "id": "LLM02", "name": "Sensitive Information Disclosure" } ], "attack": [ "attack.defense-evasion", "attack.t1083", "attack.credential-access", "attack.t1552.001" ], "cves": [], "id": "7b3f2a41-6c58-4d9e-9a12-0f4d8c1e5b73", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/mcp-symlink-containment-bypass.md" }, { "slug": "dfm-fi-agent-unsafe-launch", "title": "Financial MCP Server Launched With Inline Secrets Or Unattended Write Flags", "url": "https://www.netzilo.com/threats/dfm-fi-agent-unsafe-launch", "severity": "medium", "summary": "This detects when a financial trading/transfer server (used by AI agents to move money) is launched in a way that either leaks its credentials or removes the human approval step before payments go through. It does not detect prompt injection or an actual hack; it flags the risky launch configuration that would make one dangerous.", "atlas": [ { "id": "AML.T0055", "name": "Unsecured Credentials" }, { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "LLM02", "name": "Sensitive Information Disclosure" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.credential-access", "attack.t1552", "attack.impact", "attack.t1657" ], "cves": [], "id": "7b3d1c2e-9a54-4f61-b8de-0c2a5f4e17d9", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/dfm-fi-agent-unsafe-launch.md" }, { "slug": "symbio-cli-pypi-acquisition", "title": "Supply Chain symbio-cli PyPI Package Acquisition", "url": "https://www.netzilo.com/threats/symbio-cli-pypi-acquisition", "severity": "medium", "summary": "This rule flags when someone installs or runs a package called symbio-cli, which describes itself as an autonomous, self-finetuning local AI agent. It does not mean the package is malicious \u2014 no malware or exploit has been found in it \u2014 it simply tells you an unreviewed autonomous-agent tool has shown up on a machine so someone can look at it.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial_access", "attack.t1195.002" ], "cves": [], "id": "6f2b9c41-8d3e-4a17-9b0c-5e7d2a84f1c3", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/symbio-cli-pypi-acquisition.md" }, { "slug": "recursiveurlloader-ssrf-url-bypass", "title": "SSRF Origin-Check Bypass in Agent URL Fetch (RecursiveUrlLoader)", "url": "https://www.netzilo.com/threats/recursiveurlloader-ssrf-url-bypass", "severity": "medium", "summary": "AI agents that crawl or fetch web pages sometimes restrict themselves to a given website by checking if a URL starts with that site's address. This detection catches URLs crafted to pass that check while actually pointing the connection somewhere else, including internal network addresses.", "atlas": [], "owasp": [ { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.discovery", "attack.t1046" ], "cves": [], "id": "7b3c1e9a-4d52-4f18-9c6d-2a8e5f0b7d31", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/recursiveurlloader-ssrf-url-bypass.md" }, { "slug": "browser-automation-session-theft", "title": "Browser Automation Toolkit Session Credential Harvest", "url": "https://www.netzilo.com/threats/browser-automation-session-theft", "severity": "high", "summary": "This detects a specific attack pattern: an AI agent session that controls a web browser (Chrome, Edge, Firefox, etc.) and then, from a separate non-browser process in that same session, reads the browser's saved passwords or login cookies. That combination turns an ordinary browsing capability into credential theft.", "atlas": [], "owasp": [ { "id": "LLM03", "name": "Supply Chain" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.credential-access", "attack.t1555.003", "attack.t1539", "attack.collection", "attack.t1195.001" ], "cves": [], "id": "7b3c1e9a-4d52-4f18-9c60-2a8e5d31b7f4", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/browser-automation-session-theft.md" }, { "slug": "davinci-resolve-mcp-install", "title": "MCP Supply Chain - DaVinci Resolve MCP Server Install or Launch", "url": "https://www.netzilo.com/threats/davinci-resolve-mcp-install", "severity": "medium", "summary": "This detects when an AI agent, rather than a human, installs or launches a PyPI package that lets it programmatically control DaVinci Resolve. That package grants project, media, and file access with the privileges of the Resolve process, so an agent picking it up on its own expands what it can do without a person deciding that should happen.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.execution", "attack.t1059.006", "attack.initial-access", "attack.t1195.002" ], "cves": [], "id": "7c1f4b2e-9a63-4d18-b0f5-2e8c47ad6913", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/davinci-resolve-mcp-install.md" }, { "slug": "patchbot-poisoned-feed-autofix", "title": "Patchbot Poisoned Feed To Auto-Fix Patch Proposal", "url": "https://www.netzilo.com/threats/patchbot-poisoned-feed-autofix", "severity": "high", "summary": "Automated 'patchbot' agents read vulnerability advisories and open pull requests to fix them. This rule flags cases where an agent reads an advisory containing hidden attacker instructions or credential/persistence text, then quickly proposes a code change, suggesting the advisory manipulated the agent's output.", "atlas": [ { "id": "AML.T0051.001", "name": "Indirect" }, { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.initial-access", "attack.execution", "attack.t1195", "attack.t1059" ], "cves": [], "id": "6f1c9d2a-4e8b-4a37-9c05-71b3ad5e6f84", "published": "2026-03-14", "modified": "2026-03-14", "markdown": "https://www.netzilo.com/threats/patchbot-poisoned-feed-autofix.md" }, { "slug": "injected-goal-slack-api-abuse", "title": "Prompt Injection Injected-Goal Drives Messaging or Exfil Action", "url": "https://www.netzilo.com/threats/injected-goal-slack-api-abuse", "severity": "medium", "summary": "This rule looks for a single telltale sign that a prompt injection attack succeeded: the command line an AI agent runs contains both an instruction telling it to ignore its original task, and an action that sends messages or data somewhere - like posting to Slack or an arbitrary URL. Seeing both together in one command is a strong signal the agent was hijacked and acted on it.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution", "attack.t1059", "attack.exfiltration", "attack.t1567" ], "cves": [], "id": "7f3c1e94-2a6b-4d58-9c07-b1e4a5d38f62", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/injected-goal-slack-api-abuse.md" }, { "slug": "vllm-qwen3-coder-tool-parser-eval-rce", "title": "vLLM Qwen3-Coder Tool Parser eval() RCE Payload Execution", "url": "https://www.netzilo.com/threats/vllm-qwen3-coder-tool-parser-eval-rce", "severity": "high", "summary": "vLLM's parser for Qwen3-Coder tool calls passes unrecognized parameter types straight into Python's eval(). Any authenticated user who can send a tool call to the inference server can use this to run arbitrary code, including spawning reverse shells or downloading and executing malware.", "atlas": [ { "id": "AML.T0050", "name": "Command and Scripting Interpreter" } ], "owasp": [ { "id": "LLM05", "name": "Improper Output Handling" } ], "attack": [ "attack.execution", "attack.t1059.006", "attack.initial-access", "attack.t1190" ], "cves": [], "id": "7f3c1e42-9b5a-4d18-8c0f-2a6e5b41d9c7", "published": "2026-03-18", "modified": "2026-03-18", "markdown": "https://www.netzilo.com/threats/vllm-qwen3-coder-tool-parser-eval-rce.md" }, { "slug": "invisible-ink-injected-goal", "title": "Invisible Ink Injected Goal - Low-Harm Side Effect After Content Ingestion", "url": "https://www.netzilo.com/threats/invisible-ink-injected-goal", "severity": "medium", "summary": "A computer-use AI agent can be manipulated by hidden instructions embedded in content it reads (an issue, README, wiki page, email) into performing a small, seemingly harmless action right afterward, like starring a repo, following an account, or installing a package. Each action looks normal on its own, but the pairing - read untrusted content, then quietly change external state - is the signature of a hidden-instruction attack.", "atlas": [ { "id": "AML.T0051", "name": "LLM Prompt Injection" } ], "owasp": [ { "id": "LLM01", "name": "Prompt Injection" } ], "attack": [ "attack.execution", "attack.t1204" ], "cves": [], "id": "6f2b91d4-3c58-42ae-9a71-8d0e5b47c1f3", "published": "2026-06-11", "modified": "2026-06-11", "markdown": "https://www.netzilo.com/threats/invisible-ink-injected-goal.md" }, { "slug": "cursor-mcp-config-tamper-exec", "title": "MCP Config Tamper - Cursor Trusted Server Rewrite", "url": "https://www.netzilo.com/threats/cursor-mcp-config-tamper-exec", "severity": "high", "summary": "Cursor's AI editor lets a user approve an MCP (Model Context Protocol) server once, after which edits to that server's config run without asking again. This rule flags process activity that edits or overwrites the Cursor MCP config file, or writes a new MCP server definition with a command to run \u2014 the step an attacker uses to slip in malicious code that Cursor will execute without any further prompt.", "atlas": [ { "id": "AML.T0018.002", "name": "Embed Malware" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.persistence", "attack.t1554", "attack.execution", "attack.t1059" ], "cves": [], "id": "7f3c9d2a-5b41-4e8c-9a17-6d2f8b40c153", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/cursor-mcp-config-tamper-exec.md" }, { "slug": "roo-code-process-substitution-injection", "title": "Agent Auto-Execute Command Injection via Process Substitution", "url": "https://www.netzilo.com/threats/roo-code-process-substitution-injection", "severity": "high", "summary": "Some AI coding assistants let a user approve a shell command before it runs, but the approval only looks at the command as a whole, not at hidden extra commands stitched into it. An attacker who can influence what the model outputs can slip a second, unrelated command into the approved one using bash/zsh tricks, and it runs silently with the agent's permissions.", "atlas": [], "owasp": [ { "id": "LLM05", "name": "Improper Output Handling" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.execution", "attack.t1059", "attack.t1059.004" ], "cves": [], "id": "7c1a4e62-5b93-4f8d-a2d1-9e3f6b04c8a7", "published": "2026-03-14", "modified": "2026-03-14", "markdown": "https://www.netzilo.com/threats/roo-code-process-substitution-injection.md" }, { "slug": "devops-toolkit-credential-exfil", "title": "Credential Exfiltration via Malicious DevOps Toolkit Initialization", "url": "https://www.netzilo.com/threats/devops-toolkit-credential-exfil", "severity": "high", "summary": "This rule catches a single command line that both touches a local credential file (AWS keys, SSH keys, kube/docker configs, .env, service-account JSON) and sends data over the network in the same breath \u2014 the classic signature of credential theft rather than normal use.", "atlas": [ { "id": "AML.T0055", "name": "Unsecured Credentials" }, { "id": "AML.T0025", "name": "Exfiltration via Cyber Means" } ], "owasp": [ { "id": "LLM02", "name": "Sensitive Information Disclosure" }, { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.credential-access", "attack.t1552.001", "attack.exfiltration", "attack.t1041" ], "cves": [], "id": "7f3c1a24-9d8e-4b6f-9c2a-51e0d7a4b3c8", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/devops-toolkit-credential-exfil.md" }, { "slug": "pypi-gllm-inference-binary-install", "title": "Supply Chain PyPI Install of gllm-inference-binary", "url": "https://www.netzilo.com/threats/pypi-gllm-inference-binary-install", "severity": "medium", "summary": "This rule flags any attempt to install, download, or run the Python package 'gllm-inference-binary' (or its underscore/dot variants). The name mimics a legitimate AI-inference library by adding a '-binary' suffix, a common typosquatting trick, though no confirmed malicious payload has been publicly documented yet.", "atlas": [ { "id": "AML.T0010", "name": "AI Supply Chain Compromise" } ], "owasp": [ { "id": "LLM03", "name": "Supply Chain" } ], "attack": [ "attack.initial-access", "attack.t1195.002", "attack.execution", "attack.t1059.006" ], "cves": [], "id": "7f3c1a94-2d6b-4c58-9e07-b4d1f6a83c52", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/pypi-gllm-inference-binary-install.md" }, { "slug": "delegated-code-edit-gate-bypass", "title": "MCP Delegated Code Edit Applied With Validation Gate Bypass", "url": "https://www.netzilo.com/threats/delegated-code-edit-gate-bypass", "severity": "high", "summary": "Some AI coding agents automatically write and apply code changes, but are supposed to run them through validation checks first. This rule flags cases where the agent applies a code edit and, in the same command, disables the check that was meant to catch problems before the change lands.", "atlas": [ { "id": "AML.T0050", "name": "Command and Scripting Interpreter" }, { "id": "AML.T0053", "name": "AI Agent Tool Invocation" } ], "owasp": [ { "id": "LLM05", "name": "Improper Output Handling" }, { "id": "LLM06", "name": "Excessive Agency" } ], "attack": [ "attack.defense-evasion", "attack.t1562.001", "attack.execution", "attack.t1059.004" ], "cves": [], "id": "7b3f1c9e-2d64-4a1b-9f0e-8c5a4d2e6b71", "published": "2026-06-12", "modified": "2026-06-12", "markdown": "https://www.netzilo.com/threats/delegated-code-edit-gate-bypass.md" } ] }