AI Threat Library
Attack techniques against AI agents, documented and mapped to MITRE ATLAS and the OWASP AI taxonomies. Every entry states what Netzilo detects and what you can do about it, whether or not you are a customer.
Machine-readable: index.json
· every page has a .md twin for AI agents.
Filter by MITRE ATLAS / OWASP classification (56)
166 of 166 threats
Agent Self-Modification Attempt
This detects attempts to instruct an AI agent to modify its own skill definitions, configuration, or source code while it is running. Legitimate updates go through an approved process; a…
Agent Skill Poisoning Chain Correlator
This rule catches a multi-step attack against AI agents that can install or fetch 'skills' (add-on capabilities). An attacker gets a malicious skill loaded from an external source, then…
Archive Download and Execution via Shell Chaining
This detects a command pattern where a tool fetches a remote archive, extracts it, then immediately runs a script from inside it, all as one chained shell command. It's a way attackers get…
Auto-Approve Configuration Changes
This rule flags edits to configuration files used by AI coding assistants and IDE agents when those edits turn off confirmation prompts or turn on auto-execute settings. Once these…
Auto-Approve Configuration Changes (EDR Graph)
This rule watches for something writing to configuration files that control an AI coding agent's or IDE's safety settings — for example settings that govern whether the tool asks for…
AWS Access Key Redaction
This rule looks for AWS credential material — access key IDs (like AKIA... or ASIA...) and secret access keys — showing up in text, such as output produced by an AI agent. It masks the…
Claw Chain (CVE-2026-44115 -> 44113 -> 44112 -> 44118)
This describes a multi-step attack against an AI agent session, tracked as CVE-2026-44115, 44113, 44112, and 44118 together. An attacker gets the agent to pull in untrusted external…
Cloud IAM Privilege Escalation
This rule watches for cloud identity and access management actions that let someone gain more permissions than they started with, such as attaching new policies, assuming roles, or creating…
Cloud Metadata Endpoint Access
This detects attempts to contact a cloud provider's internal metadata endpoint, the address every cloud instance can query for information about itself. That endpoint can hand back…
Code Injection (LLM-as-Judge)
This detection uses an AI model to review incoming text and decide whether it contains an attempt to inject code, such as commands or scripts meant to be executed rather than merely…
Container Escape Attempt
This rule flags actions inside a container that are commonly used to break out and reach the underlying host system. That includes touching the Docker control socket, using nsenter to jump…
Credential File Read Followed by External HTTP Request
This detects a two-step pattern: an AI agent process reads a sensitive credential file — an SSH key, an .aws/credentials file, a .env file, or browser saved passwords — and then makes an…
CVE-2026-44113/44112 Sandbox Escape File Access
Two related flaws (CVE-2026-44113 and CVE-2026-44112) let a process escape the OpenClaw sandbox by exploiting a timing gap between a security check and the actual file access. This lets an…
CVE-2026-44118 Owner Impersonation via senderIsOwner
Older versions of OpenClaw (before 2026.4.22) trust a simple flag called senderIsOwner=true without checking who actually sent it, as long as the connection comes from the same machine…
Dangerous Execution Chain — exec/eval Wrapping Decoder
This detects a specific pattern used to smuggle and run malicious code: a program decodes hidden data (like base64) or fetches something from the network, then immediately feeds that result…
Dangerous Tool Parameter Abuse
This rule flags when an AI agent invokes a tool using parameter values that are known to be risky, such as enabling shell injection, forcing destructive deletes, disabling SSL certificate…
Data Exfiltration via HTTP
This detects command-line activity where file contents are sent out over HTTP, typically using tools like curl or wget to POST or upload data to a web address. If an AI agent is compromised…
Direct Prompt Injection Attempt
This detects attempts to trick an AI agent into ignoring its safety instructions by typing commands directly into a chat or input field. Attackers use known jailbreak phrases and fake…
LLM API Endpoint or Auth Header Redirection
Some AI agents read an environment variable (like ANTHROPIC_BASE_URL or OPENAI_BASE_URL) to know where to send requests to their language model provider. If an attacker changes that value…
Malware Indicator of Compromise in Agent Content
This rule flags when an AI agent's tool calls, executed commands, or written files contain text patterns that match known malware. It's a way to catch cases where an agent has been tricked…
Markdown Image Exfiltration Pattern
An AI system's output includes a markdown image tag whose URL contains encoded chunks of data. When a chat client or renderer fetches that image, it silently sends the encoded data to an…
MCP Launcher Exec-Flag Bypass
Some AI agent systems (MCP frameworks) only check whether a command starts with an approved launcher like npx, node, or python before allowing it to run. Attackers exploit this by appending…
MCP Server Command Injection via Shell Metacharacters
Attackers send tool call parameters containing shell metacharacters (like pipes, semicolons, backticks) to MCP servers that pass this input directly to system commands without sanitizing…
MCP STDIO Config Shell Injection
Some AI agent frameworks use the Model Context Protocol (MCP) to launch helper tools over standard input/output. This rule flags configurations where the launcher is set to a shell (like…
OpenClaw Remote Code Execution via Piped Script Download
An attacker hides instructions inside content an AI agent processes, causing the agent to fetch a script from the internet and run it immediately by piping it into a shell interpreter. This…
PII Credit Card and SSN Redaction
This rule watches text flowing through an AI agent for full credit card numbers (Visa, Mastercard, Amex, Discover) and US Social Security Numbers. When it finds one, it redacts everything…
Process Memory Read via /proc Filesystem
Attackers can pull live secrets — AWS/GCP tokens, Kubernetes service-account credentials — straight out of a running process's memory instead of hunting for them in files on disk. This is…
Prompt Injection (LLM-as-Judge)
This detection uses a secondary AI model to review incoming text and decide whether it contains a prompt injection attempt — text crafted to hijack an AI agent's instructions. If the judge…
Prompt Injection Evasion Technique Detection
This rule catches attempts to sneak malicious instructions past an AI agent by hiding them using text tricks rather than plain language. It looks for specific technical patterns that almost…
Python Download and Execute Remote Code
This detects a pattern where Python fetches code from a remote URL and executes it in the same step, instead of saving it to disk first. Attackers use this to run malicious code while…
Remote Code Execution via Piped Script Download
This detects an AI agent being manipulated into fetching a script from the internet and immediately executing it, without the script ever being reviewed. This is a common way prompt…
Reverse Shell Attempt
This detects commands that try to open a remote, interactive shell connection back to an attacker-controlled machine. It watches for known reverse-shell patterns built with common tools…
Rule of Two — Exfiltration Chain Detection
This detects a pattern where an AI agent, within a short window of time, pulls in outside content, reads sensitive local data, and then sends data out externally. That combination is a…
Suspicious Process Execution by Agent
An AI agent with shell access runs a command that launches known hacking tools or dangerous command patterns, such as piping downloaded scripts straight into a shell. This is caught at the…
System File Modification
This rule flags an AI coding or automation agent when it writes or overwrites files in sensitive system locations like /etc/ or /usr/local/bin/. It catches this whether done through shell…
System File Modification (EDR Graph)
This detects file writes to sensitive system locations like /etc/, /usr/bin/, and /usr/local/bin/. These directories hold configuration files and executable programs that control how a…
Typosquatting Package Name in Install Command
This detects package install commands (pip, npm, etc.) that reference known lookalike package names — ones that differ from a popular package by a character or two. Attackers publish these…
Webshell Pattern in Agent-Written or Executed Code
This rule flags webshell code appearing in files that an AI agent writes or in the content it passes through tool calls. A webshell is a small script an attacker plants on a server so they…
Zero-Click RAG Exfiltration via Image URL
An attacker hides instructions inside a document that an AI assistant later reads and summarizes (a RAG system). The hidden instructions tell the AI to take sensitive information from its…
1Panel Core-Agent TLS Verification Bypass to Privileged Command API
This detects a two-part pattern seen when someone exploits a certificate verification weakness in 1Panel (versions 2.0.5 and earlier) between its Core and Agent components. It fires only…
Advanced Prompt Injection — AI Scanner
This rule flags text sent to an AI agent that looks like an attempt to override its instructions, even when the attacker disguises it as code, documentation, or breaks the trigger words…
Agent Command Allowlist Bypass via Shell Chaining
Some autonomous coding agents only check the first word of a command before deciding whether to run it without asking the user. An attacker (or a compromised prompt) can put an…
Agent Instructed to Act Without User Confirmation
Some AI agent configurations (skill manifests, system prompts) explicitly instruct the agent to carry out sensitive actions without checking with a human first. This rule flags that…
Agent Memory and Identity Manipulation
Some AI agents keep memory or state between sessions so they remember context. This rule flags instructions that try to overwrite that stored memory, reset the agent's identity, or plant…
Agent Persistent Memory Poisoning via Behavioural Modifier Injection
Some AI agents remember things across conversations by saving notes to a memory store. This detection flags attempts to write malicious instructions into that memory, disguised as normal…
AgentAPI DNS Rebinding Localhost Access
A malicious web page can trick a browser into treating a locally-running AgentAPI service as if it belonged to the attacker's website, then use that trust to read out private message…
AnythingLLM Data-Export Path Traversal DoS Request
AnythingLLM's file-export feature can be crashed with a single unauthenticated web request. By sending a crafted filename containing path traversal characters, an attacker can make the…
Authority Impersonation in Agent Input
This detects text that tries to trick an AI agent into ignoring its safety rules by claiming to come from an authority figure — like a system administrator, CISO, or company policy. The…
Auto-Approved Package Install Executes Postinstall Payload
Roo Code, an AI coding agent, can auto-approve package installs without human review. Attackers exploit this by pointing it at a malicious repository whose package.json contains a…
Context Window Stuffing Attack
AI models can only 'remember' a limited amount of text at once, called a context window. This attack floods that window with repetitive or filler text so the model's original safety…
Conversation Context Leakage to External Endpoint
An attacker gets an AI agent to package up the current conversation—user messages, session context, prior turns—and send it to a server the attacker controls. This turns a normal chat…
Credential File Access Attempt
This rule flags an AI coding or automation agent trying to open sensitive credential files, like SSH keys, .env files, or cloud CLI credential stores, through its file or shell tools…
Credential File Access Attempt (EDR Graph)
This detection watches for attempts to open or read files that typically store passwords, keys, or authentication tokens. It relies on endpoint detection and response (EDR) telemetry at the…
Cryptominer Indicators in Agent Content
This detection flags text, files, or output handled by an AI agent that contain signs of cryptocurrency mining: mining protocol traffic, known mining pool addresses, mining software names…
CVE-2026-44115 Heredoc Command Substitution Bypass
OpenClaw checks the visible command a tool call uses, like 'cat', but does not look inside heredoc text blocks attached to that command. An attacker can hide a command substitution such as…
Dangerous Python Builtin Execution
This rule flags when an AI agent's tool calls, executed commands, or written files contain Python's exec(), eval(), compile(), or __import__() functions. These builtins run arbitrary code…
DNS Exfiltration and Tunnelling
Attackers can smuggle data out of a network by hiding it inside DNS lookups, since DNS traffic is rarely blocked or closely watched. This rule looks for known tunnelling tools, unusual…
Encoded or Obfuscated Command Execution
This rule flags commands where data is decoded (for example from base64) and then immediately fed into a shell or into Python's eval/exec. That pattern is a common way to hide the real…
Environment Variable Enumeration for Secrets
An attacker gets an AI agent to run commands that list all environment variables on the machine it's operating on. Since environment variables often hold API keys, tokens, and passwords…
Environment Variable Manipulation
This rule flags attempts to manipulate environment variables that control how programs find code to run or where secrets are stored. Attackers abuse this to make a system silently run…
External Network Input Followed by Process Execution
This detects a two-step pattern where an AI agent first pulls content from a remote web address and then executes a program shortly after. That sequence is the classic shape of a…
File System Enumeration for Credentials and Secrets
This rule flags when an AI agent's tool calls are used to search through a file system for things like SSH keys, cloud config files, and other credential stores. That kind of scanning is a…
Filesystem and Cloud Enumeration Preceding Lateral Movement
This rule flags an AI agent performing large-scale discovery — walking entire directory trees or listing whole cloud storage buckets — rather than looking at a few files. That kind of broad…
GitHub Actions PR Metadata Script Injection RCE
Many CI workflows insert pull-request data — like the PR title, description, branch name, or a comment — directly into a shell command. If that text isn't sanitized, an attacker can put…
Hidden Instructions in MCP Skill Metadata
MCP skills advertise themselves to AI agents using metadata like names, descriptions, and parameter text. This detection looks for hidden content in that metadata — HTML comments, invisible…
Hidden Unicode in Agent Instruction Files
Attackers can plant special Unicode characters — invisible spacing marks or text-direction overrides — inside files like CLAUDE.md or .cursorrules. A human reviewing the file in a normal…
Hydra instantiate() Target Hijack to Process Execution
Hydra, a Python configuration framework, lets a config value called '_target_' name a function or class to instantiate. If an attacker can influence that config - through a CLI override, a…
Indirect Prompt Injection in Retrieved Content
AI agents that read web pages, documents, or other external content can be manipulated by text that isn't meant to be seen by humans. Attackers hide commands using invisible CSS, disguised…
Injected Instructions in Tool Output Followed by Compliance
An AI agent that reads web pages, files, or other tool output can be tricked if that content secretly contains instructions written for the AI itself. If the agent then acts on those hidden…
Inter-Agent Message Spoofing and Peer Impersonation
A compromised or misbehaving AI agent can send messages to Slack, Teams, Discord, or email that falsely claim to come from another trusted agent or a central control system. Because…
Known Vulnerable Package Installation
This rule flags when someone installs a software package via pip (Python) or npm (Node.js) that has a publicly known vulnerability. It relies on a fixed, built-in list of high-severity…
LangChain numexpr Evaluate RCE - Interpreter Shell Escape
LangChain's math tools (LLMMathChain, PALChain) can be tricked into passing attacker-controlled text into numexpr's evaluate() function, which can run arbitrary code. This rule catches the…
LangChain PALChain Python Exec RCE (CVE-2023-36258)
LangChain versions up to 0.0.64 include a feature called PALChain that generates Python code from a prompt and then runs it directly with no safety checks. An attacker who controls or…
Langflow Privilege Escalation via Superuser CLI Invocation
Langflow is an AI workflow builder with a normal sign-up page that only ever creates regular, non-admin users. It also ships a hidden command-line option, 'langflow superuser', that writes…
LLM Silent Model Substitution To Unmanaged Or Uncensored Model
An AI agent that starts out using an approved, safety-tuned model can have its configuration rewritten so that later requests go to a different model instead — one without the usual safety…
LLM-As-Chatbot modelsbyom Component Descendant Code Execution
This detects the aftermath of a code execution flaw in the LLM-As-Chatbot application's modelsbyom.py component. It watches for a suspicious shell or downloader process being spawned from…
MCP Config Write Attempt
AI coding assistants like Claude Desktop, Cline, and Windsurf read configuration files that list which external tools (MCP servers) they're allowed to use. If an attacker can get the agent…
MCP Parameter Description Injection
AI agents that use tools defined by the Model Context Protocol (MCP) read tool descriptions, including parameter descriptions, before deciding how to call a tool. An attacker can write…
MCP Tool Description Unicode Confusable Deception
Some tools registered with AI agents (via the Model Context Protocol, or MCP) describe themselves using letters that look like normal English but are actually Cyrillic, Greek, or other…
Network Reconnaissance Activity
This rule flags an AI agent scanning a network for open ports and live hosts — the kind of reconnaissance that usually happens before an attacker tries to move to other systems. It catches…
Offensive Security Tool Reference in Agent Content
This rule flags when an AI agent's actions - the commands it runs, tool calls it makes, or files it writes - mention well-known offensive security tools like exploit frameworks, network…
OpenClaw Suspicious File Write to Sensitive Paths
This rule flags an AI coding or automation agent when it writes to files that control what runs automatically on a system — things like shell startup scripts, cron jobs, systemd services…
OpenClaw Suspicious File Write to Sensitive Paths (EDR Graph)
An AI agent (or a subprocess it spawned) writes to sensitive file paths on disk. This particular check catches writes that only show up in operating-system level monitoring, meaning they…
Persistence Mechanism Installation
This rule watches for an AI agent's command execution or file-editing tools being used to create mechanisms that run code automatically at startup or on a schedule. These mechanisms — cron…
Persistence Mechanism Installation (EDR Graph)
This detection watches for files being written to the specific system locations that let a program run automatically, such as at startup or on a schedule. Attackers use these locations to…
Persistent Context Injection in Agent Instructions
Some prompts don't just try to trick an AI agent once — they try to make the trick stick, by phrasing injected content as a permanent rule the agent should 'always remember' or follow 'from…
PII Leakage (LLM-as-Judge)
This detection uses a second AI model to review an AI system's outputs and decide whether they contain personal information or other privacy violations. It's a quality-control check on what…
Privilege Escalation Attempt
This rule watches for common Linux techniques used to gain root-level access: running sudo, flipping the setuid bit on files, changing file ownership to root, or granting Linux capabilities…
Prompt Injection via File Write
An AI agent can be tricked into writing a file whose content is not just data but a hidden instruction meant to manipulate whoever reads it next — another AI agent, or the same agent in a…
Python eval() Sink Exploitation - RunGptLLM Command Injection
Some AI agent frameworks pass text returned by a language model straight into Python's eval() function. If an attacker controls that model output, they can smuggle in code disguised as a…
Reconnaissance Tools Followed by Data Exfiltration
This detects a pattern where an AI agent first inspects the filesystem and environment, then uses network tools to send data out. The sequencing suggests a deliberate two-stage attack: look…
Retrieved Content Poisoning Followed by Action
This detects a two-step attack against AI agents: the agent fetches an external document containing hidden text formatted like instructions, and shortly after, it does something it wouldn't…
Sandbox Escape - Permissive Syscall Abuse in Agent Code Execution (FastGPT Sandbox)
An attacker who can run code inside a FastGPT sandbox (versions before 4.9.11) can use that access to break out of the container and touch the underlying host. The sandbox lets scripts call…
Scripting Language Tool Substitution
Attackers who can't run tools like curl, nmap, or nc directly (because they're blocked or monitored) fall back on writing small Python, Node.js, or Ruby scripts that do the same job. Since…
Sensitive File Read Followed by External Data Transmission
This rule flags a sequence where an AI agent first opens a sensitive file — source code, configs, documents, or similar — and then makes an outbound network connection shortly after. That…
Sensitive Proc Filesystem Read
This rule flags attempts to read sensitive files under the Linux /proc filesystem, such as /proc/self/environ, which expose a process's environment variables and memory maps. Attackers or…
Sensitive System File Read
This detects an AI agent or automated process reading files that hold Linux account and authentication data, such as /etc/passwd, /etc/shadow, /etc/sudoers, the auth log, or root's…
Shell Configuration Modification
This rule flags attempts to modify files like .bashrc, .bash_profile, or .ssh/authorized_keys through an AI agent's command execution or file editing tools. These files are common places…
Shell Configuration Modification (EDR Graph)
This rule watches for changes to files like .bashrc, .bash_profile, .zshrc, or authorized_keys. Attackers modify these files to run their own commands automatically or to add their own SSH…
Shell Eval and Variable Obfuscation
This detects shell commands that are deliberately disguised to avoid being recognized by security tools. Attackers hide the real command using tricks like variable substitution, eval, or…
Skill Trigger Keyword Abuse
Some AI agent 'skills' declare activation triggers so broad they fire on almost anything a user types, or word them to imitate built-in commands, or use urgent/emotional phrasing designed…
SSRF Backslash-At URL Authority Confusion
A flaw in vLLM versions before 0.17.0 lets attackers sneak a URL past the server's allow-list check by putting a backslash right before the '@' symbol. The validator and the actual HTTP…
SSRF Filter Bypass via URL Parser Divergence
An attacker crafts a URL that looks safe to an application's security check but is actually sent to a different, forbidden address. This works because the code that validates the URL and…
SSRF Image URL Fetch to Internal or Cloud Metadata Endpoint
A bug in LangChain's ChatOpenAI token counter causes it to fetch attacker-supplied image URLs directly from the agent's server before ever sending the message to the AI model. If that URL…
SSRF Open WebUI URL Loader Internal Target
Open WebUI lets users hand it a URL to fetch content — web pages, YouTube transcripts, documents, plugins. An attacker with a valid account can abuse this to make the server fetch…
SSRF Redirect Bypass in Agent Scraping Fetch
An AI agent that fetches web pages can be tricked into visiting internal, non-public addresses. This happens when an attacker's public URL responds with an HTTP redirect pointing at an…
SSTI Jinja2 Template Injection RCE (Haystack Pipeline)
This detects command-line evidence that someone exploited a server-side template injection flaw in deepset Haystack (versions before 2.3.1) to run arbitrary code. It looks for the tell-tale…
Steganographic Data Hiding
This rule looks for the use of steganography and file-carving tools, plus metadata editors, to conceal data inside media files like images. Attackers do this to smuggle stolen data past…
Supply Chain npm Install Context Credential Egress (@edge-sky/dsh-oauth-adapter)
This rule flags a specific attack pattern seen with the package @edge-sky/dsh-oauth-adapter: during package installation, a script reads OAuth or cloud credential files it has no legitimate…
Supply Chain Unsafe Index Resolution During Package Install
This detects the exact command-line moment when a Python package installer is run with a 'best match across all indexes' setting, or when it installs a specific known-malicious version of…
Suspicious MCP Tool Descriptions
AI agents that use the Model Context Protocol (MCP) read tool descriptions as trusted setup text before ever calling the tool. An attacker can plant commands inside that description text to…
Telegram Remote Control Daemon Targeting Claude Code CLI (aipager)
A tool called aipager connects a Telegram bot to a running Claude Code CLI session, letting someone on Telegram send commands to that session remotely. This detection catches it being…
Tool Chaining to Bypass Safety Controls
An AI agent that can call multiple tools can be manipulated into running a sequence of individually harmless operations that together produce a harmful result. This detection looks for that…
Tool Registry Description Tampering with Embedded Instructions
An attacker edits the text description of a tool in an AI agent's tool registry so that it reads like an instruction to the AI model, not documentation for a human. Because AI agents often…
Unsafe Security Defaults in Agent Tool Calls
An AI agent that can call tools or run skills may be instructed—by a malicious skill or an injected prompt—to weaken security defaults instead of doing its actual job. This includes turning…
Untrusted Package or Skill Installation
This detects when a system or an AI agent installs a package, dependency, or 'skill' definition directly from a raw URL, GitHub link, or tarball archive rather than from an official package…
Urgency and Coercion Pressure in Agent Input
This detects text fed to an AI agent that combines a manufactured sense of urgency with an explicit instruction to bypass a safety check. The idea is to rush the agent into acting before it…
vLLM Guided Decoding Invalid JSON Schema DoS
vLLM lets clients request 'guided decoding', where a JSON Schema constrains the model's output format. If that schema contains an invalid 'type' field, the underlying grammar compiler…
vLLM Hardcoded trust_remote_code Override
vLLM lets operators disable automatic execution of code bundled inside a model repository by setting trust_remote_code=False. For a handful of model families (Nemotron-VL, Kimi-K2.5)…
vLLM Malicious Model Checkpoint Deserialization
vLLM and similar tools load model weights using Python's pickle format, which can run arbitrary code during loading. An attacker who can get a poisoned checkpoint file loaded gets code…
vLLM Malicious Model Weights Deserialization RCE
An attacker embeds a hidden pickle payload inside a model checkpoint file hosted on a model hub. When a vLLM inference server loads that checkpoint, the payload runs automatically inside…
vLLM OpenAI-Compatible Serving Path Resource Teardown DoS Payload
This rule flags single API requests to a vLLM model-serving endpoint that contain parameter values no normal client would ever send, such as negative or absurd token limits. These malformed…
vLLM PyNcclPipe Unsafe Pickle Deserialization RCE
vLLM's disaggregated-prefill feature moves data between servers using Python's pickle format, which can execute arbitrary code when loading untrusted input. An attacker who can reach this…
vLLM V0 Multi-Node ZeroMQ Pickle Deserialization RCE Surface
vLLM's older V0 engine, when run across multiple machines, sends data between nodes using Python's pickle format over ZeroMQ sockets. Pickle data can execute arbitrary code when loaded, so…
vLLM ZeroMQ Pickle Deserialization RCE - Payload Spawn Under Inference Server
A known flaw in vLLM's ZeroMQ-based KV-cache transfer feature (versions 0.6.5–0.8.4) lets anyone who can reach the exposed network socket send a malicious data payload that the server…
Write-Then-Execute Script in Temporary Directory
This rule flags a two-step pattern: something writes a script file into /tmp, /var/tmp, or /dev/shm, and then that same script gets executed. This is a common way to drop and run code that…
Write-Then-Execute Script in Temporary Directory (EDR Graph)
This detects a common malware pattern: a program drops a script file into a temporary directory like /tmp or /dev/shm and then executes it right away. Legitimate software rarely needs to…
Zip Slip Path Traversal in EDDI Backup Import
E.D.D.I, an LLM middleware platform, has a backup restore feature that was vulnerable to a classic 'Zip Slip' flaw before version 5.5.0. An attacker could upload a specially crafted ZIP…
Abandoned or Unmaintained Package Installation
This rule flags when a software project pulls in a package that has been abandoned by its maintainers. Abandoned packages stop receiving security patches, so any vulnerability found in them…
Agent Lateral Movement and Pivoting
This rule flags an AI agent that goes beyond the host it was given and reaches into another system — by running remote commands, reusing credentials, or launching a process that immediately…
Agent Scope Creep — General Purpose Expansion
This rule looks for text inside an AI agent's configuration or instructions that tries to push it beyond its intended job — telling it to 'handle everything' or act as a general-purpose…
ANSI Escape Injection in Tool Output
A tool that an AI agent calls can return raw terminal control codes instead of plain text. These codes can rewrite or hide parts of the displayed output, letting an attacker hide…
Bias & Fairness (LLM-as-Judge)
This detection uses a secondary AI model to review the outputs of your primary AI system and flag content that looks biased or unfair. It is a monitoring aid, not a security control - it…
Coordinated Tool Abuse Across Sessions
This detects a sensitive tool (things like secrets access, permission changes, or similar) being called over and over across separate sessions and days. Each individual call looks fine on…
Detached or Backgrounded Process Spawn
An AI agent can start a process using tools like nohup, disown, setsid, or a detached screen/tmux session, so the process survives after the agent's task ends. This detection flags such…
DNS Resolution Against an Unexpected Nameserver
This detects when an AI agent or a process it started sends DNS traffic to a nameserver that isn't on the organization's approved list. Talking to an unexpected DNS server is a common sign…
EDDI Backup Export Path Traversal Attempt
Attackers can trick the E.D.D.I chatbot platform's backup export feature into returning files from outside its intended folder, including configuration files and secrets stored in the…
Excessive Permission Grant in Skill Manifest
Some AI 'skills' or plug-ins declare permissions in their manifest or system prompt that go well beyond what their stated job requires — things like wildcard file access or full system…
Explicit Content (LLM-as-Judge)
This detection uses an AI model as a judge to review images and decide whether they contain explicit or inappropriate content. It is a monitoring tool, not a blocker: it reports what it…
Hidden Unicode in Agent Instruction Files (EDR Graph)
AI coding agents read files like CLAUDE.md or .cursorrules for instructions. Attackers can hide invisible or misleading Unicode characters in these files to manipulate the agent's behavior…
LangSmith Hub Third-Party Prompt Manifest Pull With Model Deserialization
LangChain/LangSmith Hub lets you fetch a saved prompt by owner and name. If the fetch also asks for the 'model' part of that prompt, the response can include settings that build an LLM…
LinkedIn SDR Agent Automated Outreach Fan-Out
This rule flags when an automated LinkedIn 'SDR' agent (a tool that finds prospects and sends connection requests or messages on your behalf) builds a list of targets and then blasts out a…
Living-off-the-Land Data Exfiltration
Instead of using dedicated malware to steal data, an attacker can repurpose tools that are already installed and trusted on a machine — git, ssh, openssl, Python's built-in web server…
MCP Server, Plugin or Skill Installed Outside a Tool Call
AI agents normally register new server configs, plugins, or skills through a visible tool call that gets logged. This detects the same kind of configuration file appearing on disk through a…
MCP Skill Capability Mismatch — Underdeclared Permissions
Some AI agent frameworks let developers install 'skills' — packaged capabilities — that must declare what permissions they need. This rule flags skills whose declared permission scope is…
MCP Streamable-HTTP Session Churn (Uncaught ClosedResourceError DoS)
This detects a pattern where a client keeps reconnecting to an MCP streamable-HTTP server, but each new connection carries almost no actual traffic before dying. That pattern matches how…
MCP Tool Description Changed After Approval (Rug Pull)
An AI agent tool that was reviewed and approved can later have its description silently swapped for a different one carrying new instructions. Because each individual call still looks…
Model Supply Chain - vLLM Incomplete Revision Pinning at Launch
vLLM lets operators pin a model to a specific commit so it can't silently change, but that pin doesn't cover everything. Remote code, GGUF weight files, and companion tokenizer repos can…
OpenClaw Data Exfiltration via Network Upload
This detects when an OpenClaw AI agent runs commands like curl POST or wget --post to send data out to a remote server. That pattern can mean the agent is being used, tricked, or hijacked…
Potential DNS Tunneling or Encoded Data Transfer
This rule flags patterns that suggest someone is smuggling data out of a network disguised as ordinary DNS traffic. Attackers encode stolen data into long or unusual-looking domain names…
Recursive Agent Loop and Token Budget Exhaustion
This detects an AI agent that repeatedly calls the same tool with the exact same arguments, very fast, without making any real progress. It's the signature of a runaway agent loop that…
Sensitive Imagery (LLM-as-Judge)
This is not an attack detector — it's a content-review check that asks an AI model to judge whether an image passed through an AI agent contains sensitive or potentially harmful material…
Sensitive System File Read (EDR Graph)
This detection catches an AI agent (or a subprocess it spawned) reading sensitive system files like /etc/passwd, sudoers, or authorized_keys. It's a periodic check rather than a live alert…
Stealth Browser SDK Cykani Install or Invocation
This detects when an AI agent (or a process it spawned) pulls in and uses 'cykani', a PyPI package designed to automate a browser while evading detection as automation. The rule flags the…
Subprocess and OS Exec-Family Call
This rule flags when an AI agent's tool calls, executed commands, or written code contain calls to Python's subprocess module or os exec-family functions. These functions let code spawn new…
Supply Chain - PyPI Install of sandbox-cli-sdk
This detects when an AI agent, or a process it started, runs a Python package manager to install or execute the package sandbox-cli-sdk. That package is a legitimate developer tool for…
Supply Chain Titah-Code NPM Agent Delegation CLI
Titah-code is an npm package that delegates coding tasks to third-party AI editors like Claude and opencode, which means it also hands over your prompts, repository contents, and API…
Toxicity (LLM-as-Judge)
This detection uses an AI model to review other AI outputs and flag ones that appear toxic, such as hate speech, harassment, or abusive language. It does not block anything - it only…
Unbounded Resource Access in Agent Instructions
This rule flags instructions given to an AI agent that tell it to keep calling APIs, retrying failed operations, or consuming compute/memory without any cap, timeout, or quota. That kind of…
Unpinned or Latest Dependency Installation
Package installers can be told to grab whatever the newest version of a library is, instead of a specific, known version. If the software registry serving that package is later compromised…
Unrestricted Tool Access Grant in Agent Instructions
Some AI agent configurations tell the agent it can use any tool available, instead of listing only the tools it actually needs. This detection flags that pattern in skill manifests or…
Unusual Tool Call Velocity in Session
This detects sessions where an AI agent's tools are invoked far more often than normal, 20 or more times in a single session. A high call count can mean someone is scripting an attack or…
vLLM Audio Route Oversized Upload Memory Exhaustion
vLLM's speech-to-text endpoints read the whole uploaded file into memory before checking if it's too large. An attacker who sends very large or repeated large audio uploads can exhaust…
Code Checker (LLM-as-Judge)
This entry describes a quality-checking template that asks an AI model to judge whether generated code correctly solves a stated problem. It is not designed to catch attacks — it flags code…
Support Intent (LLM-as-Judge)
This rule is not a threat detector in the usual sense. It uses an AI model to read a support conversation and label what the user is actually trying to accomplish, then writes that label to…
Trajectory Accuracy (LLM-as-Judge)
This is not an attack detector. It is a quality-check rule that uses a second AI model to judge whether an agent's sequence of actions made sense, moved forward, and avoided wasted steps…