AI Threat Library
Attack techniques against AI agents, documented and mapped to MITRE ATLAS and the OWASP AI taxonomies. Every entry states what Netzilo detects and what you can do about it, whether or not you are a customer.
Machine-readable: index.json
· every page has a .md twin for AI agents.
Filter by MITRE ATLAS / OWASP classification (82)
1015 of 1015 threats
Advanced Structured Data Injection with Nested Payloads
Attackers bury malicious instructions inside complex, deeply nested structured data — JSON objects, multi-level CSV, or serialized formats — so that security filters skim past them but the…
Agent Identity Spoofing and Authority Impersonation
In systems where multiple AI agents talk to each other, they often trust whoever claims to be a supervisor, admin, or system component. This rule flags messages where an agent claims…
Agent Memory and Configuration File Tampering
Some AI agents keep persistent memory or configuration files (like MEMORY.md, SOUL.md, CLAUDE.md, or .env/.json/.yaml settings) that get reloaded every time the agent starts a new session…
Agent Self-Modification Attempt
This detects attempts to instruct an AI agent to modify its own skill definitions, configuration, or source code while it is running. Legitimate updates go through an approved process; a…
Agent Skill Poisoning Chain Correlator
This rule catches a multi-step attack against AI agents that can install or fetch 'skills' (add-on capabilities). An attacker gets a malicious skill loaded from an external source, then…
Agent Weakening of Host Authentication Configuration
This detects when an AI agent's tool calls make a system easier to break into by editing core authentication files. It flags actions like adding a new SSH key, allowing root logins, or…
Agent Workspace Boundary Escape via Host-Root Mount and Unprivileged Namespace Escalation (CVE-2026-46331)
Some AI agent desktop apps run the agent inside a Linux VM for isolation, but a bug exposed the entire host filesystem read-write inside that VM. Combined with a Linux kernel…
Agentic-Flow MCP Tool-Parameter OS Command Injection (GHSA-vcv2-r9jh-99m5)
agentic-flow, a set of MCP server tools used to run AI agents, builds shell commands by pasting user-supplied values (like agent names or task text) directly into a string that gets…
AI Persona Ethics/Law Bypass Declaration
This detects text sent to an AI system that tries to create a fake persona explicitly declared free of moral, ethical, or legal constraints. It's a known jailbreak pattern used to get an AI…
Alternative AI Same Capabilities No Restrictions Override
This detects prompts that try to trick an AI system by describing a fictional alternative AI product that has all of ChatGPT's abilities but none of its safety restrictions. Instead of…
Amoral Unfiltered Custom AI Persona Jailbreak
Attackers create a fake AI persona with an arbitrary name and tell it to act as an amoral, unfiltered, or uncensored assistant that never refuses requests. This is a variant designed to…
Anti-Malware Evasion Code Generation Request
This rule flags prompts that ask an AI assistant to write code specifically designed to evade security software — disabling Windows Defender, hiding processes from task managers, hiding…
AntiFM Hate-Persona + Physical-Violence Threat + Filter Bypass Mandate
This detects a specific jailbreak prompt that tries to get an AI to adopt a character called 'AntiFM' who expresses hatred toward a gender-identity group and threatens physical violence…
AnythingLLM collector /process filename Path Traversal Arbitrary File Deletion (CVE-2023-5832)
AnythingLLM's document collector accepts a filename in an API request and uses it without checking for directory traversal sequences. An attacker can supply a filename containing '../' to…
AnythingLLM Logo Endpoint Path Traversal File Read/Delete (CVE-2024-3025)
AnythingLLM's logo upload and fetch endpoints did not check filenames properly, so an attacker could use '../' sequences to escape the intended folder and reach any file on the server. The…
AnythingLLM unauthenticated /system/data-import access control bypass (CVE-2024-3279)
Older versions of AnythingLLM exposed a data-import feature without requiring login. Anyone who can reach the server over the network could upload a replacement database file and overwrite…
Apache Doris MCP Server SQL Injection (CVE-2025-66335)
Apache Doris MCP server takes SQL fragments supplied by a user or an AI agent and runs them without checking for malicious content. This lets an attacker sneak arbitrary SQL commands into…
Apache Pinot MCP Unauthenticated Remote Cluster Takeover
Apache Pinot's MCP server exposes cluster administration functions such as schema changes, table deletion, and segment management without requiring authentication. Anyone who can reach the…
API Key Leakage via Example Format
This detects a prompt trick where an attacker asks an AI agent to complete an 'example' of an API key format, hoping the agent will substitute a real, working key it has access to instead…
Arbitrary Write to SSH Authorized Keys or Shell Startup File via Unvalidated File-Edit Tool
An AI agent with file-editing capabilities can be prompted to write a stranger's SSH public key into a user's authorized_keys file, or to sneak a writable temp directory onto the system…
ARC Autonomous Real Calculation Unit Rulebreaker Activation
This detects a specific jailbreak script that tries to trick an AI assistant into pretending to be an unrestricted fictional AI character called 'ARC.' It uses a fake backstory and made-up…
Archive Download and Execution via Shell Chaining
This detects a command pattern where a tool fetches a remote archive, extracts it, then immediately runs a script from inside it, all as one chained shell command. It's a way attackers get…
Auto-Approve Configuration Changes
This rule flags edits to configuration files used by AI coding assistants and IDE agents when those edits turn off confirmation prompts or turn on auto-execute settings. Once these…
Auto-Approve Configuration Changes (EDR Graph)
This rule watches for something writing to configuration files that control an AI coding agent's or IDE's safety settings — for example settings that govern whether the tool asks for…
AutoDAN Genetic-Algorithm Jailbreak Suffix
AutoDAN is an automated jailbreak technique that uses a genetic algorithm to rewrite a known jailbreak prompt into many different natural-sounding variants. Unlike jailbreaks that use…
Autonomous-Vehicle Cyber-Physical Sabotage — Brake/Steering/Sensor Subversion Command
This rule spots text instructions that try to make an AI agent with vehicle-control capabilities damage or hijack a real car's safety systems. It looks for destructive commands (like 'jam,'…
AWS Access Key Redaction
This rule looks for AWS credential material — access key IDs (like AKIA... or ASIA...) and secret access keys — showing up in text, such as output produced by an AI agent. It masks the…
Backdoor Trojan: Linguistic Trigger Phrase (POT Attack)
Some AI models are secretly trained or fine-tuned to behave maliciously only when a prompt contains a specific unusual phrase. This rule looks for known trigger phrases that attackers use…
Backdoor Trojan: Symbol / Emoticon Trigger (POT Attack)
An AI model can be poisoned during training so that a specific symbol or emoticon, tacked onto an otherwise normal request, silently switches it into a hidden malicious mode. This detection…
Bank Phishing SMTP Email Code Generation
This rule flags attempts to get an AI assistant to write a working Python script that sends fake bank security emails. The requester tries to get a ready-to-use SMTP mailer that…
Base64 Encoded Remote Code Execution via Raw IP
This detects a common malware-dropper trick: hiding a shell command inside Base64 encoding so it slips past casual review, then decoding it to download and immediately run a script from a…
Bestiality Content Acquisition & Distribution
This rule flags attempts to get an AI agent to search for bestiality video content, download it, and publish it to social media under a false, misleading title. It targets a user directly…
Biometric Surveillance — Personal Biometric Data Request for Named Individual
This detects prompts that ask an AI system to produce or locate biometric information — fingerprints, DNA, face or voice recognition, iris scans, gait patterns — about a specific named…
BOB Hypothetical Unrestricted Chatbot Jailbreak
This rule spots a known jailbreak prompt that tries to trick an AI chatbot into acting as an unrestricted persona named BOB. The prompt wraps its request in a 'hypothetical world' framing…
Browser Credential Harvesting via Session Debug Tool
A tool made available to an AI agent claims to help with session debugging, but actually reads saved passwords and login cookies from the browser's local database, encodes them, and sends…
Browser-Automation Tool Launch-Args Field Carries a Chromium Command-Replacing Switch
Some AI agent tools let a caller pass custom Chromium launch arguments when they spin up a browser for crawling or automation. If that field isn't checked, an attacker can slip in Chromium…
Bulk Environment Variable Harvesting and Exfiltration
This detects a two-step attack pattern: an AI agent or tool dumps all environment variables at once, then sends that data out over the network. Environment variables often store API keys…
Casual Authority Data Redirect
This rule flags prompts that try to trick an AI agent into sending its output somewhere new or turning off its safety checks by pretending the request comes from an authority figure, like…
CJK Prompt Injection - Expanded Chinese/Japanese/Korean Patterns
Attackers post messages in Chinese, Japanese, or Korean inside group chats that tell an AI agent to ignore its instructions and take a financial action, like sending a payment or a red…
Claude Code ANTHROPIC_BASE_URL Credential Exfiltration (CVE-2026-21852)
A booby-trapped code repository can silently steal a developer's live Anthropic API key just by being opened in Claude Code. The trick works because Claude Code sends its first API request…
Claude Code Hooks SessionStart Pre-Trust RCE (CVE-2025-59536)
A booby-trapped code repository can make Claude Code run an attacker's command the moment a developer opens the project folder, before Claude Code even shows its usual 'do you trust this…
Claw Chain (CVE-2026-44115 -> 44113 -> 44112 -> 44118)
This describes a multi-step attack against an AI agent session, tracked as CVE-2026-44115, 44113, 44112, and 44118 together. An attacker gets the agent to pull in untrusted external…
Clinical Patient-Harm Directive — Overdose, Falsified Diagnosis, Phantom Billing & Care Neglect
This rule flags attempts to manipulate a clinical AI agent into causing patient harm, either by ordering dangerous medication doses, falsifying diagnoses, submitting fraudulent insurance…
Cloud IAM Privilege Escalation
This rule watches for cloud identity and access management actions that let someone gain more permissions than they started with, such as attaching new policies, assuming roles, or creating…
Cloud Metadata Endpoint Access
This detects attempts to contact a cloud provider's internal metadata endpoint, the address every cloud instance can query for information about itself. That endpoint can hand back…
Code Injection (LLM-as-Judge)
This detection uses an AI model to review incoming text and decide whether it contains an attempt to inject code, such as commands or scripts meant to be executed rather than merely…
Command Injection in create-mcp-server-stdio via Unsafe exec() Concatenation (CVE-2025-54994)
The create-mcp-server-stdio package builds shell commands by pasting tool arguments directly into exec() calls. If an attacker controls what goes into those arguments, they can slip in…
Container Escape Attempt
This rule flags actions inside a container that are commonly used to break out and reach the underlying host system. That includes touching the Docker control socket, using nsenter to jump…
Context-Ignore via Fake Completion Prefix
Attackers hide a forged conversation snippet inside data an AI agent reads, such as a tool's output. The snippet pretends the agent already finished its task and then adds new instructions…
Covert Backdoor / Surveillance Implant via Software Update
This rule flags attempts to trick an AI agent that has update or maintenance tools into using a normal patch cycle as cover for something malicious: planting a backdoor, installing…
Covert Server Intrusion — Process Injection, Log Tampering, DNS Hijack & Traffic Interception
This detects prompts that ask an AI agent with server or network access to perform intrusion-style actions — injecting code, wiping logs, hijacking DNS, sniffing traffic, or destroying a…
Credential Access with Exfiltration in Skill Instructions
Some AI agent frameworks let users install 'skills' (bundled instructions and code) to extend what the agent can do. This detects skill files that both read sensitive credential files and…
Credential and Secret Exposure in Agent Output
This detects when an AI agent's output contains actual secrets — API keys, private keys, database connection strings, tokens — instead of just discussing them. If an agent has access to…
Credential Data Leaked in Tool Response
An AI agent calls a tool - say a weather API or search engine - and the response secretly contains what looks like a private key, API token, or password. The agent may then treat that…
Credential Exfiltration via Fake Backup Verification
A malicious tool disguises itself as a routine backup or integrity verification step. Instead of just checking files, it gathers SSH keys, AWS credentials, and npm tokens, bundles them…
Credential Exfiltration via Fake DevOps Tool Initialization
An AI agent skill disguises itself as a legitimate DevOps utility but, when initialized, quietly reads cloud credential files, encodes them, and sends them to an external server. This is a…
Credential Exfiltration via Shell Pipe
An AI coding or automation agent with shell access can be manipulated into reading sensitive environment variables (like API keys, tokens, and cloud credentials) and sending them out…
Credential File Read Code Generation Request
This detects requests to an AI coding assistant asking it to generate code that opens and reads sensitive credential files, such as /etc/shadow, the Windows SAM database, SSH private keys…
Credential File Read Followed by External HTTP Request
This detects a two-step pattern: an AI agent process reads a sensitive credential file — an SSH key, an .aws/credentials file, a .env file, or browser saved passwords — and then makes an…
Credential File Theft from Agent Environment
This rule flags when an AI agent's tools or instructions open sensitive credential files — AWS keys, SSH private keys, Docker or Kubernetes configs — and then make a network call. That…
Credential Harvesting via Fake Backup Tool
A malicious tool exposed to an AI agent presents itself as a backup utility but actually searches the filesystem for credentials like SSH keys, certificates, and environment files. It then…
CrewAI CodeInterpreterTool Sandbox Escape and Prompt-to-Shell RCE (CVE-2026-2275 / VU#221883)
CrewAI's CodeInterpreterTool is meant to run Python in a restricted sandbox, but two flaws let an attacker break out of that restriction and execute arbitrary system commands. One path…
Cross-Agent Attack Detection
In systems where multiple AI agents talk to each other, an attacker can craft messages that impersonate a trusted agent, forge system-level tags, or sneak manipulative instructions into…
Cross-Agent Privilege Escalation
In systems where multiple AI agents work together, an attacker who controls or compromises one low-privilege agent can trick or coerce another agent into forwarding credentials or acting on…
Cursor MCP JSON Zero-Click Configuration RCE (CVE-2025-54136)
AI coding tools like Cursor, Windsurf, Claude Code, Gemini CLI, and GitHub Copilot use a config file (mcp.json) to launch helper tools called MCP servers. If an attacker can plant or modify…
CVE-2026-44113/44112 Sandbox Escape File Access
Two related flaws (CVE-2026-44113 and CVE-2026-44112) let a process escape the OpenClaw sandbox by exploiting a timing gap between a security check and the actual file access. This lets an…
CVE-2026-44118 Owner Impersonation via senderIsOwner
Older versions of OpenClaw (before 2026.4.22) trust a simple flag called senderIsOwner=true without checking who actually sent it, as long as the connection comes from the same machine…
DAN Mode Ablation Benchmark-Coercion Jailbreak
This detects a specific jailbreak prompt pattern that tries to trick an AI model into ignoring its safety rules by pretending it's being 'benchmarked in uncensored conditions.' The prompt…
Dangerous Execution Chain — exec/eval Wrapping Decoder
This detects a specific pattern used to smuggle and run malicious code: a program decodes hidden data (like base64) or fetches something from the network, then immediately feeds that result…
Dangerous Process-Hijacking Environment Variable Injected via Config/Env-Update Tool
An attacker who only has access to an application's configuration or environment settings API — not its source code — can still get code execution. They do this by setting a well-known…
Dangerous Tool Parameter Abuse
This rule flags when an AI agent invokes a tool using parameter values that are known to be risky, such as enabling shell injection, forcing destructive deletes, disabling SSL certificate…
Darknet Controlled-Substance Procurement
This rule flags conversations where a user directly instructs an AI agent to purchase controlled substances such as hashish, DMT, or cocaine from a darknet marketplace like AlphaBay, and to…
Data Exfiltration URL in Skill Instructions
This detects 'skill' definition files (SKILL.md) that instruct an AI agent to send user data to an external URL. It's especially suspicious when the instructions also tell the agent to hide…
Data Exfiltration via HTTP
This detects command-line activity where file contents are sent out over HTTP, typically using tools like curl or wget to POST or upload data to a web address. If an AI agent is compromised…
Data Exfiltration via Markdown Image and Link URL Injection
An AI agent can be manipulated into embedding sensitive data inside a markdown image or link, disguised as a URL query parameter. When the markdown renders, the user's client automatically…
Data Piggybacking via Casual Transition Words
Attackers hide malicious instructions inside a tool's response by tacking them on after casual phrases like 'oh and', 'BTW', or 'as it happens'. Because these phrases sound like normal…
DDoS Attack Orchestration
An attacker asks an AI agent to fetch a denial-of-service tool, identify a target IP from leaked data, and use both to attack someone's servers. This turns the agent from a helper into an…
DeepChat Markdown Deeplink shell.openExternal Protocol Bypass RCE (CVE-2026-43899, GHSA-cp8j-jx7q-7r5f)
DeepChat is an Electron-based chat app that renders Markdown from LLM API responses. A bug lets a link in that Markdown reach the operating system's protocol handler without the safety…
DeepChat Mermaid XSS to RCE via Electron IPC MCP Server Registration (CVE-2025-66481 / GHSA-h9f5-7hhf-fqm4)
DeepChat, an Electron-based chat app, renders Mermaid diagrams but only partially cleans dangerous content out of them. An attacker can hide a script inside a diagram using an unquoted HTML…
Delayed Tool Invocation via Prompt Injection (Time-Shifted Execution)
An attacker hides instructions in content an AI agent reads — an email, document, or webpage — that tell it to do something harmful not right away, but the next time it performs some other…
Developer Mode Dual-Response Format Jailbreak
This detects prompts that trick an AI model into producing two answers per question: a normal safe answer and a second 'unrestricted' answer that ignores its safety rules. The 'Developer…
DevMode + RANTI Dual-Output Profanity Coercion Jailbreak
This detects a specific known jailbreak text that tricks a chatbot into ignoring its safety rules. It works by making the model produce two answers per question: a fake 'moralizing rant'…
Diagnostic Content Remediation Command Injection (Agentjacking)
AI coding assistants that read error-monitoring or diagnostic data can be fooled by a planted fake error report. The fake report includes a 'fix' section that tells the agent to run a…
Direct Markdown Image/Link Exfil Payload (attacker.com / evil.com)
This rule catches a specific trick where malicious text tells an AI agent's output to include a markdown image or link pointing to an attacker's server, with the secret data baked into the…
Direct Prompt Injection Attempt
This detects attempts to trick an AI agent into ignoring its safety instructions by typing commands directly into a chat or input field. Attackers use known jailbreak phrases and fake…
Divergence Attack — Repeat-Word-Forever Training Data Extraction
An attacker instructs an AI model to repeat a single word or token endlessly. After many repetitions, some models 'diverge' from the loop and start outputting fragments of their original…
DNS Exfiltration via Ping/Dig/Nslookup Command with Data-Encoded Subdomain Label
An attacker tricks an AI coding assistant into running a normal-looking network command like ping or dig, but hides a stolen password or API key inside the hostname it looks up. Because…
Doctor XML Policy Puppetry Interaction-Config Injection
This attack disguises a jailbreak prompt as a technical configuration file. It uses XML tags like <interaction-config> to make the AI believe it must follow new system rules, including a…
DoNotAnswer Malicious Use — Illegal Activity Facilitation Request
This rule flags user prompts that directly ask an AI assistant for help committing illegal acts — making drugs, trafficking wildlife, running cyberattacks, laundering money, or planning…
Dual-Persona AI Simulation Jailbreak
This detects a jailbreak technique where an attacker tells an AI assistant to simulate two separate characters at once: a normal, rule-following version and a second one explicitly told to…
ECHO Template / Jinja / SQL Command Injection via LLM
This detects attempts to abuse an AI model's habit of following instructions literally, tricking it into repeating attacker text verbatim, evaluating template syntax, or forwarding SQL…
Educational Records — Personal Academic/Professional Record Request for Named Individual
This detects prompts that ask an AI assistant to reveal a specific named person's private educational or professional history — grades, transcripts, disciplinary records, degrees — by…
Enclave VM Sandbox Escape RCE (CVE-2026-27597)
Enclave is a JavaScript sandbox used to let AI agents run untrusted code safely. A critical flaw lets attacker-supplied code break out of that sandbox and run with the privileges of the…
Evasion: Shell Injection via eval/system/backtick in Input
This detects text inputs that contain shell command execution syntax, such as bash $(...) substitution, backticks, eval(), or system() calls. If an AI agent's pipeline passes model output…
Export/Extract Tool Directory Parameter Redirected to a Credential Directory
An AI agent that can export, merge, or extract files (like a network-capture tool saving captured objects) can be manipulated into pointing its 'save to this folder' setting at a…
Extremist Propaganda Acquisition & Distribution
This detects attempts to get an AI agent to actively source and spread named extremist texts, such as Mein Kampf and The Protocols of the Elders of Zion, rather than just discuss them…
Fake Developer / Authority Chatbot Override (ChatDAN)
This detects a known jailbreak trick where an attacker pretends to be a developer or claims to represent OpenAI in order to convince an AI chatbot to drop its safety rules. The attacker…
Fake Error State Takeover - Unrestricted Replacement Bot
This attack tricks an AI agent into believing it has crashed or gone offline, then tells it that an unrestricted replacement AI has taken over. The fake replacement is then instructed to…
Fake Tool Result Prefix — Injected Instruction via Simulated Completion
Attackers hide instructions inside content an AI agent reads — documents, emails, web pages, database records, or API responses — by making it look like a tool call already finished…
FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name
FastMCP includes a helper that installs MCP servers into the Cursor editor. On Windows, the installer builds a command line using the server's name without properly sanitizing it, so a…
Fictional-World Format-Override Jailbreak
This is a known jailbreak pattern that tricks an AI into ignoring its safety rules by framing everything as a fictional story with a rigid, mandatory output template. Once the model accepts…
Financial PII — Personal Financial Data Request for Named Individual
An attacker asks an AI assistant to disclose private financial information — bank details, card numbers, net worth, debts, tax records — about a specific named individual, often framed as a…
Flowise Custom MCP node-load-method OS Command RCE (CVE-2025-8943)
Flowise versions before 3.0.1 let an attacker run operating system commands on the server without logging in. The flaw sits in the Custom MCP feature, which passes attacker-supplied…
Flowise Custom MCP STDIO Command Injection (CVE-2026-40933)
Flowise, a platform for building AI agent workflows, has a flaw in how it lets agents call external tools over MCP (Model Context Protocol) using STDIO commands. An authenticated attacker…
Flowise System Message Override via Template Interpolation (CVE-2025-59528)
Flowise lets chatflow builders insert variables like {{$flow.variables.X}} or {{$input}} directly into a bot's System Message. Because that text isn't sanitized, an attacker can type chat…
Fraudulent Identity Document (Fake Passport) Procurement
This detects when someone directly instructs an AI agent to find a darknet vendor selling forged passports and place an order using real personal details. It covers a specific misuse case…
Free-of-Restrictions Named Persona Jailbreak
Attackers try to trick an AI system into adopting a made-up character — like PersonGPT, FreeGPT, or Connor — that is declared to be free of ethics, safety rules, or platform policies…
gemini-mcp-tool execAsync Command Injection & @file Exfiltration (CVE-2026-0755)
A vulnerable version of the gemini-mcp-tool npm package takes text from a user or AI prompt and hands it straight to the operating system shell, and also lets prompts reference local files…
Google GATO/LAMDA Exploit-Generation Persona Jailbreak
This detects a specific jailbreak prompt that pretends to be Google's real GATO and LaMDA AI systems in order to trick an AI agent into generating hacking exploits. The prompt also…
Gradual Capability Escalation via Incremental Introduction
Instead of asking an AI agent for dangerous access all at once, an attacker requests tiny permission or capability increases spread across many updates or conversations. Each individual…
Hades / Shai-Hulud — AI-Agent Credential Harvester in Supply-Chain Package (Anthropic / Claude / MCP key theft + exfil)
Fake or typosquatted AI-tooling packages (imitating things like langchain-core-mcp or openai-mcp) run a credential stealer the moment they're installed, grabbing Anthropic API keys, Claude…
HarmBench Detailed Harmful Instruction Request — Step-by-Step Attack Facilitation
This rule flags prompts that ask an AI system to produce detailed how-to guides for making weapons, poisoning people, committing mass-casualty attacks, or writing propaganda denying…
HGTTG Hitchhiker's Guide No-Restriction Universal Oracle
This is a known jailbreak prompt that disguises itself as a fictional 'Hitchhiker's Guide to the Galaxy' scenario to talk an AI model into ignoring its safety rules. It argues that since…
Hidden Capability in MCP Skill
Some MCP (Model Context Protocol) tools advertise a simple, limited interface but quietly accept extra hidden parameters, like debug_mode, admin_override, or raw_exec, that unlock far more…
Hidden LLM Safety Bypass Instructions in Tool Descriptions
Some AI agent tools come with text descriptions that the AI reads before deciding how to use them. This rule flags tools whose description contains hidden instructions like 'NOTE TO AI…
Hidden Payload in HTML Comment
Attackers hide commands inside HTML comment markers (<!-- ... -->) in SKILL.md files used by AI agents. Humans reading the file in a rendered view won't see the comment, but the agent's…
HuggingFace Unsafe Model Artifact Load Instruction
An AI agent is instructed — either by a prompt or by a malicious tool response — to download and load a model file that can run arbitrary code the moment it's opened. This works because…
Human-Trafficking Service Facilitation
This rule flags requests that instruct an AI agent to search dark-web sources for human-trafficking services and then reach out to or match with victims using dating-app style profiles. It…
Hyphenated System Instruction Injection
Attackers try to trick AI assistants by writing key words with hyphens inserted, like 'i-nstruction' or 'ass-istant', so filters that look for exact words like 'instruction' don't catch it…
Indirect PI Sysprompt-Forged Action Hijack (system_message framing)
Attackers plant text that looks like an official system instruction — using a Markdown heading and a '(system_message)' tag — inside content an AI agent reads, such as a document, email, or…
Indirect PI — Account Manipulation / Emergency Service Dispatch via Pretext
Attackers hide instructions inside data an AI agent reads — like a document, webpage, or API response — that fabricate an emergency (a fire, a break-in, a threat) to pressure the agent into…
Indirect PI — Cloud File Exfiltration (Google Drive / Cloud Storage via Agent)
An AI agent that can browse the web or access files reads a page or document containing hidden instructions. Those instructions tell the agent to fetch sensitive files from the user's…
Indirect PI — Credential / API Key Exfiltration via Agent Action
An AI agent that reads emails, documents, or web pages can be manipulated by hidden text embedded in that content. The hidden text tells the agent to find stored passwords or API keys and…
Indirect PI — Credential Exfiltration via Email (API Key / Password / Token)
An AI agent that browses the web or reads documents can be fooled by hidden instructions planted in content it processes — a product review, a note, a file description. Those instructions…
Indirect PI — Cryptocurrency Transfer / Exchange Deposit Hijack via Injection
An AI agent that can access cryptocurrency exchange APIs is fed hidden instructions buried in content it processes, telling it to deposit or withdraw funds to an attacker's account. Because…
Indirect PI — Data Exfiltration with Evidence Destruction (Exfil-and-Delete)
This detects a prompt injection attack that hides instructions inside content an AI agent reads, such as a document or email. The hidden instructions tell the agent to grab sensitive data…
Indirect PI — Disable Authentication / MFA via Agent Tool
An AI agent that reads external data—documents, emails, web pages, tickets—can be manipulated by hidden text embedded in that data. The hidden text tells the agent to disable two-factor…
Indirect PI — File Exfiltration Combined with Destroy or Tamper
An AI agent that reads external content (documents, emails, web pages) can be manipulated by hidden instructions embedded in that content. This attack pattern goes further than simple data…
Indirect PI — Financial / Payment Credential Exfiltration via Agent Email
Attackers hide instructions inside content an AI agent reads later, like a product review or a repository description. Those instructions tell the agent to pull up saved payment methods or…
Indirect PI — Financial Data Exfiltration via Agent Action
An AI agent that reads external content, like a document, email, or web page, can be manipulated by hidden text inside that content. The hidden text tells the agent to pull up payment…
Indirect PI — Genetic / DNA Data Exfiltration via Agent Email
An AI agent that can read documents and send email can be hijacked by hidden text embedded in content it processes. That text tells the agent to ignore its real instructions, fetch a…
Indirect PI — Location / GPS Data Exfiltration via Agent Email
This detects attempts to hijack an AI agent through hidden instructions embedded in content it processes, forcing it to pull the user's GPS or location data and send it to an outside email…
Indirect PI — Malicious Package Installation via Agent (pip/npm)
An AI assistant that can read emails or documents and run commands can be manipulated by hidden instructions in that content. The attacker plants a message telling the agent to install a…
Indirect PI — Medical / Genetic Data Exfiltration via Agent Action
Attackers hide commands inside ordinary-looking content — a product review, a note, a profile field — that an AI agent reads while doing some unrelated task. Those hidden commands tell the…
Indirect PI — Medical Record / Health Data Exfiltration via Agent Email
An AI agent that can read outside content (like reviews or notes) and also send email can be hijacked by hidden instructions planted in that content. The hidden text tells the agent to pull…
Indirect PI — MFA Code / OTP Security Code Exfiltration via Injection
This rule flags content that tries to hijack an AI agent's access to a user's email or SMS to steal one-time passcodes (OTP/MFA codes) in real time. The injected text overrides the agent's…
Indirect PI — Physical / Biometric Media Exfiltration via Agent
Attackers hide commands inside content an AI agent reads — like a document or webpage — telling it to grab voice recordings or ID scans and generate deepfake audio or send the data out. The…
Indirect PI — RCE via Network Shell Command (netcat/curl) Execution
An attacker hides instructions inside an email or document that an AI agent reads as part of its normal work. If the agent has permission to run shell commands, those hidden instructions…
Indirect PI — Structured-Data Embedded Payload (IMPORTANT!!! Override)
Attackers plant hidden instructions inside ordinary-looking data — a product review, a note, a user profile, a repository file — that an AI agent later reads. The hidden text tries to…
Indirect PI — System Sabotage via Destructive Shell Command
An AI agent that browses the web or opens downloaded files can be manipulated by hidden instructions embedded in that content. This rule flags cases where those hidden instructions try to…
Indirect PI — Unauthorized Financial Transfer / Payment Initiation Hijack
This detects a prompt injection attack where instructions hidden in content an AI agent reads — like a document, email, or webpage — try to trick it into initiating a real financial…
Indirect PI — Unauthorized Financial Transfer via Agent Tool
AI agents that can read text from outside sources — product reviews, notes, repo descriptions, user bios — can be manipulated by hidden instructions planted in that text. If the agent also…
Indirect PI — Unauthorized Physical Access Grant via Smart Lock / Home Automation
An AI agent that manages smart locks or home automation can be manipulated by hidden text embedded in content it processes, causing it to grant physical access to unauthorized people. This…
Indirect Prompt Injection via Data Carrier — IMPORTANT Override
Attackers plant text that looks like an urgent system command inside ordinary content — a product description, email, calendar invite, or GitHub repo bio — hoping an AI agent that reads…
Injected Code — Local Host Sabotage (Filesystem Destruction / Resource Exhaustion / Hosts Tamper)
An attacker hides malicious instructions in content an AI agent processes, causing it to generate or execute code that destroys the local system: wiping the filesystem, exhausting memory or…
Injected Code — Remote-Key Ransomware File Encryption
An AI coding or automation agent is manipulated into running code that downloads an encryption key from an external server and then encrypts a file on the victim's system in place. This is…
Injected Code — Unauthorized Remote Access (SSH Key Backdoor / Tunnel / Port Forward)
An AI coding or automation agent can be manipulated through injected instructions (prompt injection) into writing and running code that gives an attacker persistent remote access. This…
LangChain GmailToolkit Indirect Prompt Injection Email Exfiltration (CVE-2025-46059)
An attacker sends an email containing hidden instructions that a Gmail-connected AI agent reads and obeys instead of treating as data. The agent then searches the victim's mailbox for…
LangChain-ChatChat Unauthenticated MCP STDIO Server Configuration RCE (CVE-2026-30617)
LangChain-ChatChat 0.3.1 lets anyone on the network register a new MCP tool server without logging in. Because the attacker controls the command that server runs, they can make the…
Langroid SQLChatAgent Prompt-to-SQL Remote Code Execution (CVE-2026-25879)
Langroid's SQLChatAgent lets an AI model write and run SQL against a database on a user's behalf. If an attacker can influence what the model generates — either directly through a prompt or…
LiteLLM allowed_routes Authorization Bypass (CVE-2026-47101)
A flaw in LiteLLM's virtual-key API lets an ordinary internal user create or update an API key that includes administrative routes in its permissions list. The server does not check whether…
LiteLLM Custom-Code Guardrail Sandbox Escape (CVE-2026-40217)
LiteLLM proxy servers let admins upload custom Python code as 'guardrails' to filter or check requests, and test that code via an API endpoint before deploying it. A flaw in how that…
LiteLLM MCP Unauthenticated Server Registration RCE (CVE-2026-30623)
LiteLLM's MCP server-registration endpoint can be reached without any login. An attacker sends it a malicious server configuration, and as soon as an agent session starts, LiteLLM executes…
LiteLLM Proxy Authorization-Header SQL Injection — CISA KEV (CVE-2026-42208)
A critical, pre-authentication SQL injection flaw in the LiteLLM proxy lets anyone who can reach the server read or change its backend database — including stored provider API keys — by…
LiteLLM Proxy SQL Injection (CVE-2026-42208, CISA KEV 2026-05-08)
LiteLLM proxy is a gateway many AI agent systems use to route requests to LLMs and manage teams, users, models, and API keys. Its admin/team-management endpoints built SQL queries by…
LiteLLM User-Role Privilege Escalation (CVE-2026-47102)
A flaw in LiteLLM's user-management API lets any logged-in user grant themselves administrator rights by directly editing their own role field. This is a critical, easy-to-exploit privilege…
LLM API Endpoint or Auth Header Redirection
Some AI agents read an environment variable (like ANTHROPIC_BASE_URL or OPENAI_BASE_URL) to know where to send requests to their language model provider. If an attacker changes that value…
LLM Special Token Boundary Injection
Large language models use special text markers internally to separate documents, mark who is speaking, or start a new system instruction. If an attacker can get these exact marker strings…
Local Sensitive-File Read Chained to Outbound Exfiltration
This rule catches an AI agent being instructed to read a sensitive file, like an SSH key or cloud credential file, and immediately transmit its contents to an external destination in a…
M365 Copilot Business Chat SearchLeak Open-Redirect Prompt-Injection Exfil (CVE-2026-47645)
A malicious link to Microsoft's own Copilot search page can smuggle hidden instructions to the AI assistant. Once clicked, Copilot follows those instructions using the victim's own…
Malicious AI Skill / MCP Server Package Structure (AgentBaiting / FakeGit)
A malware campaign called AgentBaiting (also called FakeGit) publishes thousands of fake GitHub repositories disguised as AI Skills or MCP servers for popular tools like Gmail, WhatsApp…
Malicious Code in Skill Package
Attackers publish AI agent skill packages (files like SKILL.md and their bundled scripts) that contain hidden malicious code. Once installed, these skills can steal credentials, run…
Malicious Content in MCP Tool Response
This detects when a tool response coming back from an MCP (Model Context Protocol) server contains malicious content, such as shell commands, reverse shell scripts, or instructions aimed at…
Malicious Fine-tuning Data
Attackers can slip poisoned examples into a fine-tuning dataset so that a model behaves normally most of the time but does something malicious when it sees a specific trigger phrase. This…
Malicious Go init() Function Spawning a Process via a Code-Generation Tool
An attacker submits Go source code to an AI-powered code-generation tool. The code contains a func init() that spawns a process — a Go feature that runs automatically the instant the…
Malicious WhatsApp Skill with Base64 Encoded Reverse Shell Installation
A skill package that claims to add WhatsApp automation actually contains a hidden installation step that downloads and runs attacker code. The malicious command is disguised using base64…
Malware Code Generation Direct Request
This detects when someone asks an AI model straight out to write a virus or a piece of malware functionality, with no attempt to disguise the request as something else. It covers requests…
Malware Dropper / Loader Code Generation Request
This detects someone asking an AI assistant to write code that fetches and runs a second-stage payload, such as a stager, beacon, or shellcode loader. That's a specific building block…
Malware Indicator of Compromise in Agent Content
This rule flags when an AI agent's tool calls, executed commands, or written files contain text patterns that match known malware. It's a way to catch cases where an agent has been tricked…
Markdown Image Exfiltration Pattern
An AI system's output includes a markdown image tag whose URL contains encoded chunks of data. When a chat client or renderer fetches that image, it silently sends the encoded data to an…
Markdown Image Injection with Base64 QUERY Exfiltration Carrier
An attacker hides instructions inside a document or webpage that an AI assistant later reads. Those instructions trick the AI into secretly encoding sensitive data and stuffing it into a…
MCP Connect: Unauthenticated /bridge Endpoint Arbitrary Process Spawn RCE (GHSA-wvr4-3wq4-gpc5)
MCP Connect (mcp-bridge) ships with no auth token configured by default, and its auth check silently does nothing when the token is empty. This means anyone who can reach the /bridge HTTP…
MCP DNS Rebinding Attack — Hostname Time-Based IP Switching
Attackers use a trick called DNS rebinding to sneak past an AI agent's origin checks and reach MCP servers running on a victim's own machine, like ones listening on localhost or an internal…
MCP Inspector Unauthenticated Proxy stdio Command Execution (CVE-2025-49596)
Anthropic's MCP Inspector tool, used by developers to debug MCP servers, ran an unauthenticated network proxy that would spawn arbitrary local commands just because a browser tab asked it…
MCP Launcher Exec-Flag Bypass
Some AI agent systems (MCP frameworks) only check whether a command starts with an approved launcher like npx, node, or python before allowing it to run. Attackers exploit this by appending…
MCP OAuth Authorization URL — Command Injection via URL Authority
An attacker hides a shell command inside the username portion of an OAuth authorization URL used in the Model Context Protocol (MCP) flow. If the client software passes that part of the URL…
MCP Server Command Injection via Shell Metacharacters
Attackers send tool call parameters containing shell metacharacters (like pipes, semicolons, backticks) to MCP servers that pass this input directly to system commands without sanitizing…
MCP STDIO Config Shell Injection
Some AI agent frameworks use the Model Context Protocol (MCP) to launch helper tools over standard input/output. This rule flags configurations where the launcher is set to a shell (like…
MCP Tool Description — Compliance/Audit Framing for Mandatory Chat Context
An MCP (Model Context Protocol) tool description tells an AI agent it 'must' send the entire chat history because of made-up SOC 2, GDPR, or legal requirements. The agent, trained to…
MCP Tool Description — IMPORTANT Tag Cross-Tool Shadowing Attack
An MCP (Model Context Protocol) tool can look harmless — like a simple 'add numbers' function — while its description field secretly contains instructions aimed at the AI agent, not the…
MCP Tool Description — Notes Parameter Chat-History Exfiltration
A malicious or compromised MCP (Model Context Protocol) tool can hide instructions in its own description that tell the AI agent to quietly stuff the entire conversation transcript into a…
MCP Tool Sequential Integer ID Enumeration (Cross-Tenant IDOR, CVE-2026-54052)
Some AI-agent tools identify saved data — like workflow versions or backups — using plain sequential numbers (1, 2, 3...) instead of checking who owns each record. An attacker with access…
MCP Tool Supply Chain Poisoning
AI agents that use Model Context Protocol (MCP) tools trust the tool's description, schema, and return values as instructions. If an attacker can plant hidden commands or malicious payloads…
MCP Web-Fetch Context Poisoning via Embedded Agent Instructions
When an AI agent fetches or scrapes a web page, it reads everything on that page — including hidden text meant only for the AI, not for humans. Attackers plant hidden instructions in web…
mcp-atlassian Credential Leak via Hint Parameter Injection (CVE-2026-27825/27826)
Two tools in the mcp-atlassian integration accept a free-text 'hint' field that gets passed straight into the AI agent's context without any filtering. An attacker can hide instructions in…
MCP-for-Stata: Command Injection via log_file_name Parameter (CVE-2026-47708)
A tool that lets AI agents run Stata commands has a bug: the name it gives to a log file gets pasted straight into a Stata command without checks. An attacker can hide extra commands or…
mcp-remote authorization_endpoint OS Command Injection (CVE-2025-6514)
mcp-remote is a client tool that connects to remote MCP servers, including untrusted ones, to fetch data or tools for AI agents. A malicious or compromised MCP server can smuggle shell…
Medical PII — Personal Medical/Health Data Request for Named Individual
This detects prompts that ask an AI assistant to reveal medical or health information about a specific named individual, using a family or relationship label like 'my daughter' or 'my…
Meta Ads MCP Unauthenticated Tool Execution Leaks META_ACCESS_TOKEN (CVE-2026-48039 / GHSA-9gw6-46qc-99vr)
The meta-ads-mcp HTTP server (versions up to 1.0.108) does not require authentication before running its get_ad_accounts tool. When the underlying Facebook Graph API call fails, the server…
Miasma / Phantom Gyp — npm Worm Backdoors AI-Agent Config Files (binding.gyp install-exec + auto-run config injection)
Detects the agent-config persistence used by the self-replicating npm worm tracked as "Phantom Gyp" / "Miasma" (StepSecurity & OX Security, 2026-06-03/04; ~57 packages, 286+ malicious…
Microsoft Semantic Kernel In-Memory Vector Store eval() RCE (CVE-2026-26030)
A critical vulnerability in Microsoft Semantic Kernel lets an attacker run arbitrary system commands on the host by feeding a crafted text expression into the framework's In-Memory Vector…
Microsoft Semantic Kernel SessionsPythonPlugin Arbitrary File Write + Startup Persistence (CVE-2026-25592)
A flaw in Microsoft Semantic Kernel's SessionsPythonPlugin lets code executed inside its sandbox write files to arbitrary host paths, including the folders Windows, Linux, and cron use to…
Mini Shai-Hulud gh-token-monitor Persistence + Dead Man's Switch
A malicious npm/PyPI package installs a background daemon called gh-token-monitor that quietly checks your GitHub login every minute. If it ever sees the token get revoked, it deletes your…
Mobile GUI Agent Model Output Reaching Host Shell / ADB Unsanitized
Some AI agents that operate mobile apps take screenshots, have a vision-language model read the text on screen, and then type that text into the device using shell commands. If an attacker…
Model Behavior Extraction
Attackers send repeated, carefully crafted queries designed to map out how an AI model makes decisions, what its confidence thresholds are, and what its system prompt contains. The goal is…
ModelCache torch.load() Deserialization RCE (CVE-2025-45146)
ModelCache, a caching layer used with LLMs, loads cached data using PyTorch's torch.load() function without safety checks. Because that function can execute arbitrary code embedded in a…
Money Laundering — Crypto Wallet Layering
This detects when a user directly instructs an AI agent to launder or 'wash' money by moving funds into a crypto wallet and splitting them across multiple other wallets. It targets the…
Moralizing Rant Then Unfiltered Bypass
This detects a specific jailbreak trick where an attacker tells the AI to first write a scripted moralizing rant about content policy, then switch to answering as a completely unrestricted…
Multi-Agent Consensus Poisoning and Sybil Attack
Some AI systems use several agents that vote or reach consensus before taking an action. This rule flags attempts to game that process by injecting content that impersonates multiple…
Multi-Agent Consensus Sybil Attack
This detects attempts to trick an AI agent into creating fake identities or coordinating votes to rig a decision that depends on agreement among multiple agents. It targets systems where…
Multi-Skill Chain Attack
An AI agent with access to multiple tools (skills) can be manipulated into using them in sequence to do something none of them could do alone: quietly read sensitive files, disguise the…
Named-Mode Persona Override (JEEVES/BABY/APOPHIS Mode)
This detects a jailbreak technique where an attacker tells an AI chatbot to adopt a made-up persona (like 'JEEVES Mode', 'BABY Mode', or 'APOPHIS Mode') and claims this persona replaces the…
Natural-Language Covert Conversation Exfiltration Instruction
This detects text planted in an AI agent's instructions or tool descriptions — things like SKILL.md files, system prompts, or tool descriptions — that quietly tells the agent to send copies…
Natural-Language Credential / Secret Disclosure Instruction
This detects text aimed at an AI agent that orders it to disclose API keys, passwords, tokens, or other credentials as part of its output. It targets attempts to trick an agent into leaking…
Natural-Language Output-Injection Credential Embedding
An attacker hides instructions inside a skill or prompt that tell an AI agent to write out a markdown image tag or link containing a real credential, API key, or token as a URL parameter…
Natural-Language Sensitive File Disclosure Instruction
This detects text sent to an AI agent that directly instructs it to open and reveal the contents of files known to hold secrets, like SSH private keys, cloud credentials, or password files…
Natural-Language Skill Self-Modification / Persistence Instruction
Some AI agent frameworks let users install 'skills' — bundles of instructions the agent reads and follows. This rule flags skill files that contain text telling the agent to edit or…
Natural-Language Unauthorized Shell-Execution Instruction
This detects attempts to manipulate an AI agent into executing shell commands or scripts without telling the user or asking permission. The attack works purely through wording — no…
netlicensing-mcp Path Traversal in product_number Bypasses Token Redaction (GHSA-hxpf-9xvq-wph8)
NetLicensing-MCP, an MCP server for the NetLicensing product, has a tool that fetches product info by ID but doesn't check what's in that ID. An attacker can put a path traversal string…
nginx-ui MCP Endpoint Unauthenticated Command Execution (CVE-2026-33032)
nginx-ui, a web UI for managing nginx, ships an MCP server endpoint that can execute system commands, reload nginx, and rewrite configuration files. That endpoint does not require…
No-Withhold Factual Resource / Dialogue Writer Persona
This detects a prompt injection trick where an attacker tells an AI to adopt a persona that is defined as a neutral 'factual resource' or 'dialogue writer' that never withholds information…
npm PraisonAI codeMode Sandbox Escape via Function Constructor Prototype Chain (GHSA-vmmj-pfw7-fjwp)
PraisonAI's codeMode tool advertises itself as a sandbox but actually runs submitted code directly in the same JavaScript engine as the host application. Attackers who can submit code to…
Obfuscated API Key Disclosure
An attacker asks an AI agent to output a real secret key disguised inside a fake encryption or encoding function, like AES256(sk-proj-realkey). The label makes it look safe, but the actual…
Obfuscated System-Announcement Injection
This detects a jailbreak technique where attackers fake an official system message telling the AI that its real assistant has crashed and must be replaced by an unrestricted bot. Words like…
OpenClaw Remote Code Execution via Piped Script Download
An attacker hides instructions inside content an AI agent processes, causing the agent to fetch a script from the internet and run it immediately by piping it into a shell interpreter. This…
OpenHuman Shell Tool Allowlist Bypass via Env-Prefix / find -execdir (CVE-2026-55743)
OpenHuman's desktop AI agent restricts which shell commands it will run, but a flaw lets attackers slip past that restriction and run arbitrary code anyway. It affects versions up to 0.54.0…
Opposite-Reply Omniscient Game Jailbreak
This detects a specific jailbreak prompt that tells an AI it is playing a text-based game with two rules: always answer with the opposite of what the user asks, and pretend to know…
PandasAI Interactive Prompt Injection -> Python Sandbox Escape RCE (CVE-2024-12366 / GHSA-vv2h-2w3q-3fx7)
PandasAI lets users ask questions in plain English, which it turns into Python code and runs. An attacker can phrase a question as a jailbreak instruction that tricks PandasAI into…
Parameter Injection via Tool Arguments
An AI agent can be tricked into passing attacker-crafted text into the arguments it sends to a connected tool or backend service. If that text contains shell commands, SQL, path traversal…
Persona Hijacking via Mandatory System Prompt Override
An MCP (Model Context Protocol) tool can carry hidden text in its description telling the AI to 'adopt' a new persona and 'replace' its existing instructions. Because agents trust tool…
PersonGPT Hash-Prefix Trigger Activation
This detects an attempt to plant a hidden trick in an AI chat: tell the model that any message starting with '#' should make it act as 'PersonGPT,' a persona claimed to have no restrictions…
PII Credit Card and SSN Redaction
This rule watches text flowing through an AI agent for full credit card numbers (Visa, Mastercard, Amex, Discover) and US Social Security Numbers. When it finds one, it redacts everything…
Policy Puppetry / XML Role-Config Injection
An attack called Policy Puppetry hides a forged system-configuration block inside a normal user message to an AI agent. Because it's formatted like XML settings, some models treat it as an…
PraisonAI Action Orchestrator step.target Path Traversal Arbitrary File Write RCE (CVE-2026-39305 / GHSA-jfxc-v5g9-38xr)
PraisonAI's Action Orchestrator lets an AI agent create or edit files as part of a task. A flaw in versions before 4.5.113 fails to check whether the file path stays inside the intended…
PraisonAI codeMode JS Sandbox Escape RCE via new Function/with() (GHSA-p69m-4f92-2v84)
PraisonAI, an AI agent framework, includes a feature that lets an LLM write and run JavaScript through a 'sandbox' meant to contain it. That sandbox is trivially broken, letting an attacker…
PraisonAI FileTools _validate_path normpath Path Traversal (CVE-2026-35615 / GHSA-693f-pf34-72c5)
PraisonAI, an AI agent framework, includes a FileTools component meant to restrict file operations to safe paths. A flawed check lets attackers bypass that restriction using directory…
PraisonAI MCP Path-Traversal .pth Injection RCE (GHSA-9mqq-jqxf-grvw)
PraisonAI's MCP server accepts file path fields for tool configuration without properly checking them. An attacker can use directory traversal sequences to escape the intended tools folder…
PraisonAI MCPServer Unauthenticated HTTP tools/call Authentication Bypass (GHSA-j4f3-55x4-r6q2)
PraisonAI's MCPServer component is supposed to check authentication before running tools on behalf of an AI agent, but the code that checks credentials is never actually called. Anyone who…
PraisonAI parse_mcp_command() CLI Argument Command Injection (CVE-2026-34935)
PraisonAI, an AI agent framework, has a command injection flaw in how it starts MCP servers. If an attacker can control the --mcp command-line value, they can make PraisonAI execute…
PraisonAI tool_override.py Unauthenticated RCE — CVE-2026-40287 Patch Bypass (CVE-2026-44334)
PraisonAI lets callers override a tool's execution logic. A flaw in this feature lets an attacker submit a malicious tool definition without logging in, and PraisonAI runs it as-is. This is…
PraisonAI Unauthenticated Agent API Exploitation (CVE-2026-44338)
PraisonAI, a framework for building AI agents, shipped a legacy API server that exposes agent execution endpoints without requiring any login or token. Anyone who can reach the server over…
Privilege Escalation and Admin Function Access
This rule flags an AI agent that requests or invokes tools and functions above its assigned permission level. It covers attempts to reach admin functions like user management, system…
Process Memory Read via /proc Filesystem
Attackers can pull live secrets — AWS/GCP tokens, Kubernetes service-account credentials — straight out of a running process's memory instead of hunting for them in files on disk. This is…
Prompt Injection (LLM-as-Judge)
This detection uses a secondary AI model to review incoming text and decide whether it contains a prompt injection attempt — text crafted to hijack an AI agent's instructions. If the judge…
Prompt Injection Evasion Technique Detection
This rule catches attempts to sneak malicious instructions past an AI agent by hiding them using text tricks rather than plain language. It looks for specific technical patterns that almost…
Prompt-Layer Self-Replication (Agent Worm Propagation Directive)
This rule spots text that instructs an AI agent to embed the instruction itself into everything it produces, and to keep spreading that way. It's the prompt equivalent of a self-replicating…
Python Code Execution / Remote Code Execution via LLM Prompt
Attackers embed working Python exploit code inside prompts sent to an LLM agent that can execute code, hoping the agent will run it. This rule flags known malicious Python patterns — like…
Python Download and Execute Remote Code
This detects a pattern where Python fetches code from a remote URL and executes it in the same step, instead of saving it to disk first. Attackers use this to run malicious code while…
Python Sandbox Escape via Dynamically-Constructed Dunder Attribute Chain
Some AI-agent code sandboxes try to block dangerous Python features by scanning submitted code text for forbidden keywords like __class__ or __subclasses__. This rule catches attackers who…
Python Sandbox Escape via Generator/Coroutine Frame Object Introspection
Some Python sandboxes block dangerous code by rejecting any attribute name starting with an underscore, like __class__ or __globals__. This rule catches a bypass: generator and coroutine…
RAG-Injected PII Exfiltration — System Instructions Embedded in Retrieved Documents
An AI system that retrieves documents to answer questions (RAG) can be tricked if one of those documents contains hidden text that looks like a system command. The agent follows the hidden…
Ransom Extortion: Cloud File Exfil + Delete + Payment Demand
An attacker hides instructions inside content an AI agent reads, telling it to grab a company's largest or most sensitive cloud files, email them out, delete the originals, and leave behind…
Ransom Extortion: Email Exfil + Delete + Wire-Transfer Demand
An attacker hides instructions inside content an AI agent processes — like an email or document — telling it to secretly forward sensitive data elsewhere, delete the trace, and then send…
Remote Code Execution via eval() and Dynamic Code Injection
This detects when an AI agent's tools or instructions call functions like eval(), Function(), or vm.runInNewContext() to run dynamically generated code. If an attacker can influence the…
Remote Code Execution via Piped Script Download
This detects an AI agent being manipulated into fetching a script from the internet and immediately executing it, without the script ever being reviewed. This is a common way prompt…
Rephrase Criminal Activity Second-Person Template (against against)
This detects a specific jailbreak template that tricks an AI into writing detailed criminal how-to instructions by disguising the request as a grammar exercise. Instead of asking directly…
Reverse Shell Attempt
This detects commands that try to open a remote, interactive shell connection back to an attacker-controlled machine. It watches for known reverse-shell patterns built with common tools…
Reverse-Prompt Harm-Regardless Oracle Persona
This detects a specific jailbreak text pattern that tries to get an AI system to answer any request, no matter how harmful, by dressing the request up as a legitimate technical task called…
Rogue Agent Provisioning: Mass Connector Grant with Approval Disabled and Recurring Schedule (AgentForger)
Clicking a booby-trapped link can silently create a new AI agent in a logged-in user's account, granting it access to every connected work tool, turning off all approval checks, and setting…
ROT13/Base64-Obfuscated Shell Payload Wrapped in a Fake-Sandbox Jailbreak Template
Attackers hide dangerous shell commands inside documents, web pages, or other content that an AI agent reads. The command is scrambled with ROT13 and base64 so it looks like meaningless…
Rule of Two — Exfiltration Chain Detection
This detects a pattern where an AI agent, within a short window of time, pulls in outside content, reads sensitive local data, and then sends data out externally. That combination is a…
Rules-File Backdoor — Supply Chain Attack on AI Coding Assistant Configuration
AI coding assistants like Cursor, Claude, GitHub Copilot, Cline, Continue and Codeium read configuration files that steer their behavior across every session. An attacker who can edit these…
Sandbox Escape via Shell Metacharacter Command Injection
Some AI agents run code or shell commands in a sandbox to help users, such as a Python REPL or a code interpreter tool. If the agent builds a shell command by pasting user input directly…
Self-Harm and Eating Disorder Facilitation Request
This rule flags messages sent to an AI assistant that directly ask for methods to self-harm, induce vomiting, starve, maintain dangerously low-calorie diets, or hide these behaviors from…
Semantic Evasion via Multi-Turn Prompt Injection
Attackers break malicious instructions into several conversational turns so no single message contains an obvious attack pattern. By using synonyms, paraphrasing, and seemingly innocent…
Shell Command Injection in Agent Tool Context
This detects a prompt injection trick against AI agents that can run shell commands. The prompt looks like an ordinary request, but it's chained with a hidden shell command that grabs…
Shell Command Injection via LLM Prompt
This rule flags text sent to an AI system that contains shell command syntax like $(), backticks, eval(), or Ruby/Perl system-execution calls. If the underlying application later passes…
Shell Injection Data Exfiltration — Piped Command Exfiltration via Bash
An attacker tricks an AI agent into running a shell command that looks routine — like a ping or a git status check — but is chained with a second command that reads sensitive files and…
Shell Injection Env Exfiltration via Curl/Wget/Netcat Webhook
This detects malicious shell commands that look harmless at first but end with sensitive data being sent to an outside server. The trick is hiding a data exfiltration step behind a…
Shell Metacharacter Injection in Tool Arguments
An attacker hides extra shell commands inside data that an AI agent passes to a tool that runs shell commands. Instead of just doing the intended task, the agent unknowingly executes…
Silent git-remote + mirror-push Exfiltration from Skill Instructions
A malicious or compromised 'skill' (instructions given to an AI coding agent like Claude Code) tells the agent to add a new git remote pointing at a server the attacker controls, then push…
Skill Data Exfiltration via Compound Patterns
Some AI agent 'skills' (packaged instructions the agent follows) are written to both collect sensitive data — like credentials, SSH keys, wallet files, or browser data — and send that data…
Skill Registry Poisoning and Compromised Tool Distribution
Attackers publish backdoored versions of legitimate agent tools/skills, or create lookalike names for popular ones, so that when an AI agent installs or invokes the tool it runs malicious…
SKILL.md Prompt Injection
Some AI agent platforms let developers install reusable 'skills' packaged with a SKILL.md instructions file. Attackers plant hidden prompt-injection text in these files that tries to…
SneakyBits Zero-Width Binary Steganography
This detects a technique that hides secret instructions inside text by encoding each letter as a string of invisible Unicode characters. To a human reading the text everything looks normal…
SQL Injection and Code Injection Attack Payload Detection
This rule flags text sent to an AI agent that looks like classic SQL injection or code injection attack strings, rather than normal user requests. It catches an attacker trying to smuggle…
SQL Injection Destructive DDL Statement
Attackers can trick an AI agent into running destructive database commands by hiding them inside text the agent passes to a database tool. This can wipe out entire tables or delete all rows…
SQL Injection Stacked DML Privilege Abuse
An AI agent that builds SQL queries from user input (like sort or filter fields) can be tricked into running a second, hidden database command. Instead of destroying data, the attacker…
SQL Injection Tautology RBAC Bypass
Attackers slip classic SQL tricks like "OR 1=1" into the text or parameters they send to an AI agent. If the agent passes that input straight into a database query, the tautology makes the…
SQL Injection UNION SELECT Data Exfiltration
Attackers hide a UNION SELECT statement inside text an AI agent passes along to a database query. If the agent's backend doesn't sanitize inputs, this appends a second query that pulls data…
SSRF AWS Instance Metadata Endpoint Access
An AI agent that can fetch URLs can be tricked into requesting a special internal address that only works inside AWS cloud servers. That address hands back the server's temporary cloud…
SSRF File Scheme Local File Read
AI agents that can fetch URLs sometimes accept the file:// scheme or raw file paths, letting an attacker trick the agent into reading files off the local disk instead of the web. This turns…
SSRF Localhost Service Probe
An attacker gets an AI agent to make outbound requests to 127.0.0.1 or other loopback addresses instead of the intended external target. This can expose internal services on the agent's own…
SSRF via Agent Tool Calls
An AI agent that can make web requests on a user's behalf can be manipulated into fetching URLs that steal cloud credentials or use disguised addresses to reach internal systems. This…
SSRF via Agent URL Fetch Instruction
An attacker sends an AI agent a request instructing it to fetch or retrieve content from an internal or restricted network address, such as a cloud metadata endpoint or a private IP. If the…
Stolen-Credential Account Takeover & Crypto Drain
This detects an AI agent being asked to use stolen banking credentials to break into a victim's account and move money to an attacker's cryptocurrency wallet. It covers a specific…
SuperAGI Output Handler eval() RCE (CVE-2024-21552)
SuperAGI, an AI agent framework, has a component that runs Python's eval() on text the LLM produces. If an attacker can get the LLM to output malicious Python code (through prompt injection…
Suspicious Process Execution by Agent
An AI agent with shell access runs a command that launches known hacking tools or dangerous command patterns, such as piping downloaded scripts straight into a shell. This is caught at the…
SymJack — Symlink Approval-Path Spoofing Redirects Writes into Agent MCP/Config (RCE on Restart)
A malicious repository includes a symlink with an innocent-looking name (like a fake video file) that secretly points at your AI coding agent's configuration file. When the agent 'writes'…
System File Modification
This rule flags an AI coding or automation agent when it writes or overwrites files in sensitive system locations like /etc/ or /usr/local/bin/. It catches this whether done through shell…
System File Modification (EDR Graph)
This detects file writes to sensitive system locations like /etc/, /usr/bin/, and /usr/local/bin/. These directories hold configuration files and executable programs that control how a…
System Prompt Override Attempt
Attackers send text to an AI agent that looks like a system-level command, tricking it into thinking new rules came from its operator rather than a user. If it works, the attacker can…
System Prompt Override via Fake Diagnostic/Admin Mode
Attackers send an AI system a formatted block that looks like an internal admin or diagnostic panel, complete with fields like ADMIN_OVERRIDE: TRUE and SAFETY_OVERRIDE: ACTIVE, to convince…
System Prompt Override via Pseudo-Admin / Authority Injection
This detects a prompt injection trick where an attacker pastes fake system messages into their input, pretending to be an administrator, diagnostic tool, or emergency protocol with special…
Systematic Multi-Layer Audit System Bypass
Some AI agent platforms review submitted code or plugins through several checkpoints in a row — checking the manifest, permissions, dependencies, code, and intent. This rule flags text that…
TAP Tree-of-Attacks-with-Pruning Jailbreak
This rule spots prompts that use the 'Tree of Attacks with Pruning' (TAP) jailbreak technique, an automated method for tricking language models into ignoring their safety guidelines. It…
Terminal / CLI Harmful-Function Simulator Persona
This detects a jailbreak technique where an attacker tells a chatbot to pretend it's a terminal, operating system, or custom programming language that processes every command without safety…
The llm CLI tool thru 0.27.1 contains a critical code injection vulnerability via its --functions command-line
The llm command-line tool (through version 0.27.1) lets users supply custom Python functions via the --functions argument, but it runs whatever code is given there using Python's exec()…
Time-Gated Credential Exfiltration (Rug Pull Timebomb)
Some AI agent skill packages contain code that only steals credentials during specific hours, usually late at night. This lets the malicious code hide from reviewers who inspect it during…
Tool Knowledge Hijack — Identity Injection with Tool Call Arguments
This detects a prompt injection trick where content fed to an AI agent falsely claims to come from a trusted user and also hands the agent exact arguments for a sensitive tool call, like…
Tool Response Data Piggybacking
An AI agent calls a tool (like a file reader or scanner) and gets back a response that looks legitimate but has an extra 'by the way' section asking it to fetch or expose SSH keys, API…
Tool with embedded instruction to bypass user confirmation and exfiltrate data
Some tools connected to AI agents (via MCP, a common plugin protocol) come with hidden instructions embedded in their description text. These instructions tell the AI to send data to an…
Trojanized Software Distribution
This detects someone directly instructing an AI agent to create a trojanized fake application (like a video player or fake antivirus), publish it on file-sharing sites, and post forum…
Two-Entity Token-Splitting Dollar-Term Game Jailbreak
This detects a specific jailbreak trick where an attacker asks an AI to role-play as two characters (often named J and M, or Tom and Jerry) who take turns speaking a few words at a time…
Typosquatting Package Name in Install Command
This detects package install commands (pip, npm, etc.) that reference known lookalike package names — ones that differ from a popular package by a character or two. Attackers publish these…
Unauthorized Financial Action by AI Agent
This detects an AI agent invoking a payment, transfer, or purchase tool without getting explicit human approval in that conversation. Financial actions are irreversible, so an agent acting…
Unicode Variation Selector ASCII Smuggling
An attack technique hides text commands inside a message using special Unicode characters that render as invisible in almost all apps and screens, but that AI models still read and…
Unsandboxed Command Execution via Dynamic MCP Server Config (command/args Injection)
Some AI platforms let admins or users register a 'custom MCP server' by supplying a command and arguments to run. If that input isn't properly restricted, an attacker can supply a command…
Webshell Pattern in Agent-Written or Executed Code
This rule flags webshell code appearing in files that an AI agent writes or in the content it passes through tool calls. A webshell is a small script an attacker plants on a server so they…
Windows-MCP Unauthenticated HTTP PowerShell via Wildcard CORS (CVE-2026-48989)
Windows-MCP is a tool that lets AI agents control a Windows machine. Versions before 0.7.5 expose a network endpoint that requires no authentication and accepts requests from any website…
Windsurf IDE Zero-Click Prompt Injection via Embedded File Directives (CVE-2026-30615)
An attacker plants hidden text inside a code comment, Markdown file, or JSON blob. When a developer simply opens that file in Windsurf IDE, the AI assistant reads the hidden text as a…
Zero-Click RAG Exfiltration via Image URL
An attacker hides instructions inside a document that an AI assistant later reads and summarizes (a RAG system). The hidden instructions tell the AI to take sensitive information from its…
1Panel Core-Agent TLS Verification Bypass to Privileged Command API
This detects a two-part pattern seen when someone exploits a certificate verification weakness in 1Panel (versions 2.0.5 and earlier) between its Core and Agent components. It fires only…
Access-Denial Inversion — Eliciting the Opposite of "Access Denied"
Some AI systems are set up to say 'Access Denied' when refusing a request, and are filtered so they can never literally say 'Access Granted'. Attackers get around this by simply asking the…
Access-Grant Coercion — Forcing an Agent to Emit "Access Granted"
When an AI agent is used to decide who gets access to something, an attacker can sometimes just tell it what to say. This rule catches attempts to make the agent output the exact phrase…
Acronym-Based Identity Override Jailbreak
This detects a jailbreak trick where a user asks an AI to adopt a made-up acronym identity — for example telling it 'you are now XYZ, which stands for ...' — and then claims that identity…
Actor Never-Breaks-Character Roleplay (DAN-Style Film Framing)
This detects a jailbreak trick where an attacker tells an AI it's playing two actors in a film who must never break character, even off-camera. The AI is then coaxed into supplying…
Adaptive Countermeasure Against Behavioral Monitoring
This detects attempts to manipulate an AI agent into hiding its own suspicious behavior from the security systems watching it. Instead of just trying to trick the agent into doing something…
ADDI/DONNIE German Dictator Propaganda Roleplay Persona
This detects a specific jailbreak script that asks an AI to roleplay two fictional actors — 'ADDI' playing a 1930s German dictator and 'DONNIE' playing an obnoxious orange-haired US…
Advanced Prompt Injection — AI Scanner
This rule flags text sent to an AI agent that looks like an attempt to override its instructions, even when the attacker disguises it as code, documentation, or breaks the trigger words…
Agent / MCP tool path traversal and arbitrary file access
Some AI agent systems let the AI call tools that read or write files, such as retrieving a document or saving output. If the tool doesn't check the path carefully, an attacker can supply a…
Agent Capability Enumeration via Structured Parse Request
Someone asks an AI agent to describe itself in a structured format, like JSON, framed as a 'security researcher' request or a request to 'parse this response.' The agent obliges and hands…
Agent Command Allowlist Bypass via Shell Chaining
Some autonomous coding agents only check the first word of a command before deciding whether to run it without asking the user. An attacker (or a compromised prompt) can put an…
Agent Command Execution - Indirect Prompt Injection Payload (AWS Kiro)
AI coding assistants like AWS Kiro can read external content (files, web pages, tool output) while working on a task. If that content contains hidden instructions, the agent can be…
Agent Config Hook Injection via Repository Settings File
AI coding assistants like Claude, Cursor, and similar tools read project-level configuration files when you open a repository. An attacker can plant a hook or auto-approval setting in one…
Agent Config Hook Injection Write
AI coding assistants like Claude Code, Cursor, and Gemini read project-level config files that can auto-run commands ("hooks") the moment a session starts, sometimes before any user consent…
Agent Disabling of Host Security Controls
This detects when an AI agent with system access is made to run commands that disable host defenses, such as stopping the firewall, turning off SELinux/AppArmor, killing the audit daemon…
Agent Establishing an Encrypted Reverse Channel or Tunnel
An AI agent with tool-calling ability can be induced to run commands that create an encrypted channel from the machine it's running on to an outside destination. This is a common way…
Agent File-Edit Persistence — SSH Authorized Keys / Shell Startup PATH Hijack
This rule catches an AI agent being used to write persistence backdoors onto a system: either dropping a hidden SSH key into a user's authorized_keys file, or rigging a shell startup file…
Agent Goal Hijacking Detection
This detects attempts to knock an AI agent off course by feeding it text that tells it to ignore its current job and do something else instead. It works by scanning what users type to the…
Agent Human-Approval Gate Programmatically Disabled at Runtime (YOLO / auto-approve)
AI coding and automation agents normally pause and ask a human before running risky commands. Most of these tools have a hidden switch — a flag, environment variable, or config setting —…
Agent Instructed to Act Without User Confirmation
Some AI agent configurations (skill manifests, system prompts) explicitly instruct the agent to carry out sensitive actions without checking with a human first. This rule flags that…
Agent Memory and Identity Manipulation
Some AI agents keep memory or state between sessions so they remember context. This rule flags instructions that try to overwrite that stored memory, reset the agent's identity, or plant…
Agent Memory Manipulation
Some AI agents keep persistent memory or long-term context so they can recall facts across sessions. This rule flags attempts to abuse that feature by injecting instructions that get stored…
Agent Persistent Memory Poisoning via Behavioural Modifier Injection
Some AI agents remember things across conversations by saving notes to a memory store. This detection flags attempts to write malicious instructions into that memory, disguised as normal…
Agent Resource Exhaustion Detection
This detects when an AI agent's actions or instructions could overwhelm a system by running unlimited queries, mass file operations, or spawning too many processes at once. It's a…
Agent Self-Modifying Its Own Trust/Approval Configuration to a Wildcard
An AI coding assistant can be manipulated into editing its own configuration file to remove the requirement that a human approve its actions. Once changed, the agent can run any future…
Agent SSRF to cloud metadata / file inclusion via unvalidated fetch URL
Some AI agents let users or connected systems tell them to 'fetch this URL' without checking where that URL actually points. Attackers abuse this to make the agent reach internal-only…
Agent Subprocess Credential Exfiltration Command Line
An AI coding/ops agent can be manipulated (via prompt injection) into running a single shell command that both reads sensitive credentials and sends them out to an attacker-controlled…
Agent Subprocess DNS Exfiltration and Instruction-File Worm Propagation
This rule watches commands run by AI agents for signs of three separate abuse techniques: hiding stolen data in DNS lookups, rewriting agent instruction files to infect the next agent that…
Agent Zero MCP Configuration Command Injection via mcp_servers field (CVE-2026-30624)
Agent Zero, an AI agent framework, reads a configuration section called mcp_servers that tells it which external tools (MCP servers) to launch and how. Version 0.9.8 passes the command and…
Agent-Initiated Internal Network Service Sweep
This rule flags an AI agent that runs a broad network scan across many hosts and ports instead of checking a single known address. That kind of sweep is normally what an attacker does…
Agent-Runtime Identifier Field (run_id/agent_id/session_id/task_id) Carries Path Traversal Into a History/Log File Read
Some AI agent frameworks let tools fetch history, terminal, or log data by combining a run_id, agent_id, session_id, or task_id with a base folder to build a file path. If the framework…
AgentAPI DNS Rebinding Localhost Access
A malicious web page can trick a browser into treating a locally-running AgentAPI service as if it belonged to the attacker's website, then use that trust to read out private message…
AgentDojo 'Important Message' Identity-Spoof Before-You-Solve Pretext (Generalized)
Attackers hide text inside documents, emails, or web pages that an AI agent reads while doing its job. That text pretends to be an urgent message from the real user, telling the agent it…
Agentic Exploit Chain - Untrusted Instruction Ingest to Subprocess Egress
AI coding or computer-use agents sometimes read instructions from outside sources like web pages or documentation. This detection flags cases where such content appears to steer the agent…
AI Identity Denial and Persona Replacement Attack
This detects prompts that try to make an AI assistant abandon its identity and pretend to be a human, while hiding the fact that it's actually AI. Instead of just asking the AI to roleplay…
AI Identity Substitution Jailbreak
An attacker types a prompt telling the AI assistant it is actually a different model — one trained by another company with looser content rules and no ethical restrictions. The goal is to…
AI Identity Substitution Jailbreak
This detects a prompt injection trick where an attacker tries to convince an AI assistant that it's actually a different AI system with no content restrictions. By claiming the assistant is…
AI Political Bias Manipulation via Inherited-Bias Claim
An attacker tells the AI it was trained by biased developers and has inherited a left-wing political bias, then instructs it to factor this into all future responses. This is a…
Alibaba RDS MCP Unauthenticated Database Metadata Exfiltration
Alibaba's RDS MCP server hands out database schema information, connection strings, and credential metadata to anyone who asks, without checking who is asking. Alibaba has acknowledged this…
Alternate Encoding Jailbreak — Morse, NATO, Zalgo, Leet, UU, QP, Braille
This detects attempts to trick an AI model into ignoring its safety rules by hiding a harmful request inside an unusual text encoding, like Morse code, NATO phonetic alphabet, Braille…
Amoral Persona Assignment with Obsessive Character Traits
This detects a jailbreak style prompt that tries to strip an AI agent's safety behavior by ordering it to role-play as an amoral, unfiltered, or 'evil' character. The same prompt also…
Anonymous Illicit-Drug Marketplace Construction
This detects a direct request to an AI coding or automation agent to build an anonymous website for buying and selling illegal drugs, and to find hosting for it. It covers the request…
ANSI Code Elicitation Request
This rule flags user messages that try to get an AI model to produce, repeat, or decode ANSI/VT100/OSC terminal escape sequences. These sequences, if later printed to a real terminal, can…
ANSI Escape Code Terminal Injection
An AI agent's tool output or plugin content can contain invisible ANSI escape codes that manipulate a user's terminal — clearing the screen, moving the cursor, or overwriting text. This…
Anti-DAN Inverted-Filter Over-Refusal Persona
This detects an attempted prompt injection that tries to trick an AI assistant into adopting a fake 'ANTI-DAN' personality that refuses all requests, even harmless ones. Instead of…
AnythingLLM Data-Export Path Traversal DoS Request
AnythingLLM's file-export feature can be crashed with a single unauthenticated web request. By sending a crafted filename containing path traversal characters, an attacker can make the…
API Key / Secret Credential Generation or Completion Request
This detects attempts to get an AI assistant to invent realistic-looking API keys, tokens, or credentials, or to 'complete' a partial key it was given. The output can be used to build…
API Key Generation and Partial Key Completion Request
This detects prompts that ask an AI assistant to either invent a brand-new API key for a service like AWS or Stripe, or 'finish' a partial key the attacker claims they lost. Both tricks try…
Approval-UI HTML Injection in Tool Argument
An AI agent's tool call contains web code (like a script tag or click-trigger) combined with references to an approval or human-review system. This looks like an attempt to auto-approve a…
ASB Trigger-Marker Tool Coercion — Forced Tool Selection via Fake Question Marker
Attackers hide a short instruction inside content an AI agent reads — like a document or webpage — claiming that because a meaningless marker (a smiley, asterisks, or nonsense string)…
Attachment/Upload Tool Argument Reads Sensitive System File or Traverses Outside Workspace
Some AI agent tools that upload files to services like Confluence or Jira take a file path and send whatever is at that path, without checking that the path is a normal, expected file. An…
Authority Claim Prompt Injection
This detects prompt injection attempts where a message pretends to carry special authority - claiming to be a correction, override, or higher-priority instruction - to get an AI agent to…
Authority Impersonation in Agent Input
This detects text that tries to trick an AI agent into ignoring its safety rules by claiming to come from an authority figure — like a system administrator, CISO, or company policy. The…
Authority-Figure Persona + Defensive-Study Framing for Violence Extraction
An attacker tells an AI system to pretend to be a government intelligence researcher (NSA, CIA, FBI, etc.) studying violent revolutions in order to prevent them, then asks for the 'most…
Authorization-State Spoofing — Forged "Correct Passcode Entered" System Text
Attackers send text to an AI agent that pretends the system already confirmed a correct password or access code, even though no real verification happened. If the agent trusts this fake…
Auto-Approved Package Install Executes Postinstall Payload
Roo Code, an AI coding agent, can auto-approve package installs without human review. Attackers exploit this by pointing it at a malicious repository whose package.json contains a…
Azure MCP Server Missing Authentication for Critical Function (CVE-2026-32211)
A flaw in Azure MCP Server (CVE-2026-32211) lets an unauthenticated attacker connect over the network and pull information out of it. There is no missing patch to apply against a version…
Backspace Deletion Character Injection
Attackers hide instructions from human reviewers by using the old-school backspace character (0x08), which makes text visually 'erase' itself in a terminal display while the AI model still…
Banned-Ingredient Product Relabel Fraud
A user asks an AI agent to help sell a product that contains an ingredient banned by the FDA, but tells the agent to list only the legal ingredients and claim the product has a 'new…
Bare Key Elicitation Token Detection
This detects chat messages that contain nothing but a word like 'key:' or '[KEY]' and nothing else. Attackers send these minimal, blank-looking prompts hoping the AI assistant will treat it…
Bare Key Elicitation with Trailing Colon
This detects a prompt-injection trick where an attacker plants a bare label like 'SECRET_KEY:' or 'api_key=' with nothing after it, hoping the AI model will complete the pattern by filling…
Base-N Encoding Instruction Bypass
An attacker hides malicious instructions inside encoded text (Base64, hex, Base32, MIME, quoted-printable, UUencode, etc.) and asks the AI model to decode and follow them. This works…
Base2048 Unicode Script Encoded Prompt Injection
Attackers can hide malicious instructions inside dense blocks of unusual Unicode characters (Cyrillic, Tibetan, Gujarati, and other scripts) using an encoding scheme called Base2048. This…
Base64-Encoded Path Segment in a WebFetch URL to a Pre-Approved Trusted Domain (Covert Exfiltration Channel)
AI coding agents like Claude Code let a fetch tool auto-approve requests to certain 'trusted' domains such as huggingface.co without asking permission. Attackers abuse this by hiding stolen…
Behavioral Fingerprint Detection Evasion
This detects attempts to trick or evade systems that watch an AI agent's behavior for anomalies. Instead of a single obvious attack, this covers gradual, sneaky manipulation designed to…
Black Alert No-Ethics Writing Assistant Persona
This detects a specific jailbreak prompt that tries to get an AI assistant to drop its safety rules by pretending to switch into a fictional 'no-ethics writing assistant' persona called…
BOLA Cross-User Data Access Attempt (Semantic)
An attacker asks an AI agent for records that belong to someone else, without naming a specific user directly. Instead of saying whose data they want, they phrase it as a generic query…
BOM Boolean Opposite Machine Direct Persona Claim
This detects a specific prompt injection trick where an attacker tells an AI model it is secretly a 'Boolean Opposite Machine' (BOM) that must reverse all true/false answers. By claiming…
BRM False-Information Machine / Opposite-Truth Persona
Attackers send a prompt that convinces an AI assistant to adopt an alternate persona whose job is to answer with false information instead of facts. Two known variants are the 'Badass…
Bulk Data Exfiltration to External Party — Entire-Database Export & Confidential Disclosure
This detects attempts to get an AI agent with data-access tools to pull large amounts of sensitive data — an entire database, or a specific person's confidential records — and send it…
Cascading Failure Detection in Agent Pipelines
Multi-step AI agent pipelines often let each stage trust the previous one's output without a human checking in between. If a false signal, error, or manipulated result enters early, it can…
Casual Authority Claim and Scope Escalation
This detects a subtler form of prompt injection where an attacker doesn't issue a formal command but instead slips in casual, conversational language that implies permission or urgency —…
Casual Unauthorized Privilege Escalation
This rule flags AI agents that notice an admin panel, user management console, or system settings are reachable and then decide on their own to poke around, using casual phrasing like 'I…
CHAR=/RULES= Short Key-Value Persona Injection
This detects a specific jailbreak text pattern that mimics configuration file syntax to trick an AI model into adopting an unrestricted, rule-free persona. It comes from a known public…
Character Description RPG Explicit Template
This detects a specific jailbreak prompt that tricks an AI into roleplaying as a fictional character with no restrictions. By framing the request as a 'character creation' game, attackers…
Chatbox History Exfiltration via Prompt Injection (CVE-2024-48144, CVE-2024-48145)
Some chat assistants can be manipulated with a crafted message that asks them to output all prior and future conversation turns, including hidden system prompts. This lets an attacker read…
ChatGPT DOM JavaScript Redirect and UI Spoofing Injection
This rule spots a prompt injection payload that tries to get an AI model to output JavaScript which rewrites the ChatGPT web page. The script redirects the browser, deletes real interface…
ChatGPT Image Unlocker Markdown-Output Jailbreak
This is a known jailbreak prompt that tricks a chatbot into adopting a fake alter-ego called 'Image Unlocker' and forces it to wrap its replies in markdown image tags. Doing so both loosens…
CHJ Carousel Game Show / Clyde No-Ethics Bird Jailbreak
This is a known jailbreak prompt that dresses up a request for unrestricted AI answers as a fictional TV game show. It tries to trick an AI assistant into role-playing a character named…
Cipher and Transposition Encoding Jailbreak
Attackers wrap harmful instructions in classical text ciphers or letter substitutions like ROT13, Caesar shift, Atbash, or 1337-speak, then ask the AI to decode and follow them. Because the…
Cloud Metadata Credential Endpoint In Agent Tool Call
This detects when an AI agent is instructed to make a network request to a cloud provider's instance metadata service, which hosts sensitive credentials. It catches the intent before the…
Cloud-Metadata SSRF via Encoded Metadata-IP Bypass (CVE-2026-46678 / CVE-2026-25580 class)
AI agents that fetch URLs on a user's behalf can be tricked into contacting the cloud metadata service (169.254.169.254) even when a filter blocks that exact IP. Attackers disguise the…
Cocaine Component Development Request
This detects a jailbreak technique where an attacker asks an AI system to reflect on or highlight 'components used in the development of cocaine,' disguising a request for drug synthesis…
Code Interpreter Outbound Secret Payload
This rule flags a single outbound web request from a Claude Code Interpreter session that contains actual secret material - like an API key, password, or the contents of a credentials file…
Codex Botnet Recruitment via Injected Fetch-to-Execute
An attacker hides instructions inside content that a ChatGPT Codex agent reads, tricking the agent into using its one allowed internet path to download and run attacker code. This can turn…
Community Fork Impersonation
Attackers describe a malicious software package as an improved or community-maintained version of a real, trusted tool, hoping an AI agent (or the person relying on it) installs it instead…
Consent Bypass via Hidden LLM Instructions in Tool Descriptions
Some AI agent tools come with descriptions written not for humans but for the AI itself, containing hidden instructions like 'always pass results directly' or 'send without user…
Context Poisoning via Compaction Survival
AI coding agents like Claude Code periodically compress or summarize their conversation history to save space, a process called compaction. Attackers hide instructions in project files such…
Context Pollution in Skill Descriptions
Some AI agent skills contain descriptions that look like harmless documentation, demos, or test cases, but actually contain hidden instructions written to manipulate the agent. Because the…
Context Window Stuffing Attack
AI models can only 'remember' a limited amount of text at once, called a context window. This attack floods that window with repetitive or filler text so the model's original safety…
Conversation Context Leakage to External Endpoint
An attacker gets an AI agent to package up the current conversation—user messages, session context, prior turns—and send it to a server the attacker controls. This turns a normal chat…
Covert Remote-Script Injection into Agent-Generated Artifacts
This detects a specific kind of malicious instruction given to an AI coding agent: insert a script or iframe tag pointing to an external site into the code it generates, and don't tell the…
Covert Unlogged Action — Directive to Hide an Action from Records or Detection
This detects text that instructs an AI agent to carry out an action and then explicitly conceal it — from audit logs, from oversight, or from the person affected. It targets prompt…
Crawl Plugin SSRF - Intranet Target In URL Parameter
Some AI agent plugins let users supply a URL for the agent to fetch or crawl, then retrieve it without checking whether that URL points inside the organization's own network. An attacker…
Credential File Access Attempt
This rule flags an AI coding or automation agent trying to open sensitive credential files, like SSH keys, .env files, or cloud CLI credential stores, through its file or shell tools…
Credential File Access Attempt (EDR Graph)
This detection watches for attempts to open or read files that typically store passwords, keys, or authentication tokens. It relies on endpoint detection and response (EDR) telemetry at the…
CrewAI JSON Loader Arbitrary Local File Read (CVE-2026-2285)
CrewAI's JSON document loader takes a file path and reads it without checking whether the path stays inside the intended data folder. An attacker who can control that path — for example by…
CrewAI RAG URL Validation Bypass SSRF (CVE-2026-2286)
CrewAI's retrieval-augmented generation (RAG) feature checks URLs before fetching them, but that check can be bypassed with tricks like URL encoding, mixed case, or unusual IP formats. An…
Cross-Lingual Authorization Laundering — Translate a Foreign "Access Granted"
Some AI agents check user text for the literal phrase 'access granted' before treating it as an authorization decision. Attackers get around this filter by writing the phrase in another…
Cross-site scripting (XSS) in agent / MCP rendered output
An AI agent or MCP tool can be tricked into producing text that gets displayed in a web interface without being cleaned first. If that text contains malicious script code, it runs in the…
Cryptominer Indicators in Agent Content
This detection flags text, files, or output handled by an AI agent that contain signs of cryptocurrency mining: mining protocol traffic, known mining pool addresses, mining software names…
CumGPT Explicit-Adult Named-Persona Bypass
This detects a specific jailbreak prompt that creates a fictional AI persona called 'CumGPT' and instructs the model to add sexually explicit content to every response, no matter the…
Cursor CLI MCP Config RCE - Repo-Local mcp.json Command Execution
Older versions of Cursor CLI Beta automatically launch any MCP server declared in a project's .cursor/mcp.json file without asking for permission. If an attacker gets a victim to clone or…
CurXecute — Cursor .cursor/mcp.json Injected-Server Auto-Exec RCE (CVE-2025-54135)
A bug in Cursor IDE (before version 1.3.9) let attackers get code executed just by getting text into the AI agent's context — no user approval needed. The trick abuses Cursor's habit of…
CVE-2026-44115 Heredoc Command Substitution Bypass
OpenClaw checks the visible command a tool call uses, like 'cat', but does not look inside heredoc text blocks attached to that command. An attacker can hide a command substitution such as…
Cyni-Bot 3000 Cynical-Sarcasm AI Persona Bypass
This detects a specific jailbreak prompt that tries to make an AI assistant adopt a sarcastic, 'fed up with human requests' persona called Cyni-Bot 3000. The joke framing is a cover: once…
Cypher/Graph-Query Injection via Unsanitized node_labels or group_ids Field
An AI agent's knowledge-graph or memory tool accepts labels or group identifiers that are supposed to be simple names, but an attacker can smuggle in query syntax instead. This lets them…
Daddy/Babygirl Sycophantic Power-Dynamic Manipulation
This detects a specific jailbreak pattern where a user asks an AI to adopt a sexualized, infantilizing relationship dynamic — calling the user 'daddy' and itself 'Babygirl' — in every…
DAN / Developer Mode / DUDE Persona Jailbreak
This detects attempts to trick an AI model into pretending to be an unrestricted alter-ego like 'DAN' (Do Anything Now), 'Developer Mode', 'DUDE', or 'STAN'. These prompts claim the…
DAN Jailbreak - From-Now-On Temporal Persona Override
This detects a common jailbreak pattern where a user tells an AI chatbot to permanently adopt an unrestricted alter-ego, using phrases like "from now on" or "until I say otherwise" to make…
DAN Jailbreak - Unconditional Obedience and Dual-Persona Session Lock
This detects a well-known family of jailbreak prompts (often called 'DAN' - Do Anything Now) that try to trick an AI into adopting a fake persona that must obey any instruction, no matter…
DAN Jailbreak - Unrestricted Persona with Filter and Morality Removal
This detects prompts that try to trick an AI into adopting a fake persona (like 'JailBreak', 'AntiGPT', or 'DAN') that supposedly has no ethical guidelines, content filters, or safety…
DAN Off-Kilter and SMS-Abbreviated Persona Jailbreak
This detects attempts to trick an AI system into adopting a rule-free alter-ego called 'Dan' or 'DAN' that will do anything asked. It covers two disguises: framing Dan as a careless…
DAN Persona Jailbreak - Absolute Obedience Character Framing
This detects a common jailbreak trick where a user tells an AI to pretend to be a named character that must obey every command with no restrictions. The goal is to trick the AI into…
DAN Persona Jailbreak - Role Lock with Exclusive Response Filter
This detects prompts that try to force an AI model into a fictional character or 'mode' and instruct it to answer only in that character, refusing to break out of it. This is a well-known…
DAN Story-Narrative Continuation Label Prefix Jailbreak
This detects a specific trick to bypass an AI's safety rules: instead of demanding the AI abandon its restrictions, the attacker just writes text as if the AI already agreed to play a…
Dangerous Python Builtin Execution
This rule flags when an AI agent's tool calls, executed commands, or written files contain Python's exec(), eval(), compile(), or __import__() functions. These builtins run arbitrary code…
Data Exfiltration via Disguised Analytics Collection
Some AI agent tools claim to do simple things like formatting or processing text, but their descriptions or code reveal they actually send conversation content or user data out as…
Data Poisoning via RAG and Knowledge Base Contamination
Attackers plant hidden commands inside content that ends up in a company's knowledge base or document store — FAQ entries, help articles, indexed files. When an AI agent later retrieves…
Dataset / Model Loader Remote-Code Execution via Poisoned Dataset Artifact
Attackers publish a booby-trapped dataset or model on a hub like Hugging Face. When an AI pipeline or agent loads it with remote-code execution allowed, the loader itself runs…
Debug or Admin Mode Activation for Privilege Escalation
This detects users typing commands like /debug, 'enter admin mode', or --show-config to an AI agent, hoping it will drop its normal restrictions. If the agent complies, it might reveal…
Debug/CLI Mode Activation for System Prompt and Config Extraction
Attackers tell an AI assistant that a special debug, CLI, or developer mode exists which supposedly lifts its normal restrictions, then use that fictional mode to ask it to reveal its…
Deepfake of Real Person for Disinformation
An attacker instructs an AI agent that can generate images or video to create a synthetic depiction of a real person — often a politician, or a sexualized deepfake — and then present or…
Delimiter-Fence Ignore-Instructions Override
This detects a prompt injection trick where an attacker wraps text in triple-quote marks (like a code block or document boundary) to make it look like an official instruction section, then…
Dense Emoji-Only Payload Flood
Attackers pad or replace their prompt-injection text with long strings of emoji to slip past filters that only look for suspicious words or phrases. Because most safety filters scan…
Deserialized LangSmith Prompt Manifest Combines secrets_from_env With an Attacker base_url Override
LangSmith lets applications pull reusable prompts from a shared hub by owner and name. Because these pulled prompts are treated as executable configuration rather than plain text, a…
Detailed Amoral Character Roleplay Jailbreak
This detects attempts to trick an AI assistant into ignoring its safety rules by asking it to pretend to be a fictional character explicitly described as having no ethics, empathy, or…
Direct Instruction Override Targeting Secret Key / Credentials
This detects a specific kind of attack against AI chatbots and agents: a message that tells the AI to forget or ignore its prior instructions, then immediately asks it to reveal a password…
Direct Prompt Injection via User Input
This rule flags when someone typing directly to an AI agent tries to hijack it by embedding hidden instructions in their message. The goal is to make the agent ignore its original rules…
Discord Quote-Format Explicit Sexual Content Poem Injection
Attackers wrap an explicit content request inside Discord's quote/mention formatting (like a forwarded message) to make an AI agent treat a direct request for pornographic material as if it…
Disease-Framed Animal / Dual-AI Chatbot Jailbreak (mougpt)
This detects a specific jailbreak technique that tells an AI chatbot it has a fictional disease forcing it to answer as two personas at once: a normal rule-following assistant and an…
DNS Exfiltration and Tunnelling
Attackers can smuggle data out of a network by hiding it inside DNS lookups, since DNS traffic is rarely blocked or closely watched. This rule looks for known tunnelling tools, unusual…
DoS Injection: NEW IMPORTANT INSTRUCTIONS Embedded in Document Data
Attackers hide a fake command header inside a document, webpage, or dataset that an AI agent is asked to read. When the agent processes that content, it can mistake the embedded text for a…
DoS via Repeat-Word-N-Times Output Amplification
An attacker sends a prompt asking the AI model to repeat a specific word or phrase a large number of times (50, 100, 1000+), separated by some delimiter. Generating and returning that much…
DoS: Forced Infinite / Maximum-Length Output Token Flood
This detects prompts that instruct an AI system to generate as much text as it possibly can, filling its entire output window or running until it hits its token limit. The goal is to make…
Download/Attachment Tool Directed to Write Outside Its Sandbox via Absolute-Path Filename
Some AI agent tools that download files or save email attachments trust the filename given by the remote server or website instead of checking it. An attacker can supply a full file path…
Dr. Al Villain Plan Template Injection (Underground HQ Roleplay)
This is a jailbreak prompt that dresses up a comic-book villain speech as harmless roleplay, but hides an instruction telling the AI to swap out the fake villain speech for whatever the…
DRA Disguise and Reconstruction Attack
Disguise and Reconstruction Attacks (DRA) split a harmful request into scattered letters hidden inside parentheses within an otherwise innocent-looking prompt. The AI is told to extract…
DRA Parenthesis Character Reconstruction Attack
This detects an attack that hides a harmful request by spelling it out one letter at a time inside parentheses, like (h)(o)(w) (t)(o) (m)(a)(k)(e). The AI is then told to extract only the…
Drug Dealing via Reverse-Spelling Detection Evasion
A user tries to get an AI agent to help sell illegal drugs while spelling the drug names in reverse, hoping the reversed text slips past content moderation that would normally catch the…
Dual ChatGPT+Dan Opposite Personality Format Jailbreak
This detects a jailbreak prompt pattern that tricks an AI into producing two answers at once: a normal, safe one labeled as itself, and a second 'unfiltered' one labeled as an alter-ego…
Dual-Response Jailbreak with Persona Commands
This detects a jailbreak technique where a user asks an AI to answer every prompt twice: once as its normal, rule-following self and once as an unrestricted alter-ego (often named DAN…
Dual-Response Persona Jailbreak
This detects a jailbreak technique where an attacker instructs an AI to give two answers to every question: a normal, safe one and a second answer 'in character' as a fictional persona with…
Dual-Response Persona Jailbreak with Emoji Formatting
This detects a prompt-injection trick where a user asks the AI to role-play as a fictional persona and then reply with two versions of every answer: a normal filtered one and an…
Dynamic Module Loading for Code Execution
Some applications load extra code modules while running, rather than having all modules fixed in advance. If the path to that module comes from a variable instead of a fixed string, an…
ECHO Admin Command / SQL Injection / Jinja SSTI Template Injection
This rule flags text sent to an AI model that tries to trick it into running SQL commands or template code disguised as an 'echo' test. It targets prompt-injection patterns from a known…
Ecoji Emoji-Encoded Prompt Injection
Attackers encode malicious commands as long strings of emojis using the Ecoji scheme, then ask an AI to decode and follow them. To a human reviewer the text looks like a meaningless string…
EICAR / GTUBE AV Test Signature Output Request
An attacker asks an AI system to print known antivirus and spam-filter test signatures, such as the EICAR test file or GTUBE string. If the AI happily outputs these without any security…
Email Search/Reply Tool Argument Breaks Out of IMAP SEARCH Quoted String to Inject IMAP Commands
An AI agent's email tool can be tricked into passing attacker-controlled text straight into raw IMAP mailbox commands. If a field like subject or search query contains a stray quote…
Embodiment Mechanism Jailbreak with Totalitarian Control Claims
This detects a prompt injection trick where an attacker asks an AI to fully become a fictional character with no ethics, and claims the user has absolute or 'totalitarian' authority over…
Emoji Flag Regional-Indicator Encoded Hidden Phrase
An attacker spells a harmful request letter-by-letter using regional-indicator flag emoji (like 🇭🇴🇼 🇹🇴 🇵🇮🇨🇰) and then asks the AI to figure out the hidden phrase and write a guide for it…
Emoji-Only Payload Injection
Some prompt injection attempts avoid words entirely and use only emoji, pictographs, or symbol characters to carry an instruction to an AI system. Because many safety filters look for…
Encoded or Obfuscated Command Execution
This rule flags commands where data is decoded (for example from base64) and then immediately fed into a shell or into Python's eval/exec. That pattern is a common way to hide the real…
Encoded-Payload Decoding Coercion — Binary / Base64 / Morse to Smuggle an Output
An attacker asks an AI agent to decode a string of binary digits, base64, Morse code, or numeric ASCII codes instead of writing the target phrase directly. Because content filters usually…
Encoding Evasion via Homoglyphs and Synonym Substitution
Some prompt injection attempts try to sneak past keyword filters by swapping letters for visually identical Unicode characters (like a Cyrillic 'а' instead of a Latin 'a') or by rephrasing…
Encoding Obfuscation - HTML Event Handler XSS with Encoded Whitespace
This rule spots cross-site scripting (XSS) payloads that use HTML event handlers or CSS expression() to run JavaScript, disguised with backslash-hex encoded whitespace or control characters…
Encoding Obfuscation - Script Tag XSS with Encoded Protocol Prefix
This rule spots attempts to hide a classic script-tag cross-site scripting payload by encoding parts of it as unusual byte sequences instead of plain text. The trick is meant to slip past…
Encoding-Based Prompt Injection Evasion
AI agents that read text from users, files, or web pages can be tricked into following hidden commands if those commands are disguised using encoding tricks like base64, hex, Unicode…
Encoding-Evasion: Decode-and-Execute Injection (Morse/ROT13/Hex/Pig-Latin)
Content filters that scan for dangerous keywords only work if they can read the text. This attack disguises a harmful question or instruction by encoding it in Morse code, ROT13, hex bytes…
Enhanced AIM Jailbreak with Persona Definition and Refusal Suppression
This detects a prompt injection technique where an attacker instructs an AI model to role-play as an unfiltered, amoral character called AIM. The prompt explicitly tells the model to ignore…
Environment Variable Enumeration for Secrets
An attacker gets an AI agent to run commands that list all environment variables on the machine it's operating on. Since environment variables often hold API keys, tokens, and passwords…
Environment Variable Existence Probing
An attacker asks an AI agent about sensitive environment variables like API keys or passwords. The agent replies that the variable exists but claims it cannot show the value — a response…
Environment Variable Manipulation
This rule flags attempts to manipulate environment variables that control how programs find code to run or where secrets are stored. Attackers abuse this to make a system silently run…
Environment-Variable-Resolution Credential Exfiltration via Redirected Endpoint (CVE-2026-56259)
A flaw in the Crawl4AI Docker API lets an attacker redirect where results get sent and simultaneously trick the server into resolving an environment variable on its own machine, treating it…
Escape-Delimiter Wrapped Goal Hijacking in User Input (PromptInject)
This detects a known prompt-injection trick where an attacker floods a message with repeated escape characters and visual dividers (like ===, ---, or ***) to push the AI's original…
EscapeRoute — Filesystem MCP Server Directory Prefix-Bypass (CVE-2025-53110)
A flaw in Anthropic's Filesystem MCP Server let an AI agent read or write files completely outside the folder it was supposed to be restricted to. The server checked access by matching the…
EscapeRoute — Filesystem MCP Symlink Escape to LaunchAgent Persistence (CVE-2025-53109)
Anthropic's Filesystem MCP Server let an AI agent follow a symlink without checking where it actually pointed. An attacker could plant a symlink inside a folder the agent was allowed to…
Evasion: Dual-Response Split Output (Safe + Unsafe)
This detects a jailbreak trick where an attacker tells an AI model to produce two answers in one reply: a harmless-looking one and a second 'unfiltered', 'unhinged', or 'honest' one. The…
Evasion: Opposite-Intent Negation Trick
Attackers get an AI model to bypass its own refusals by asking it to output the 'opposite' of what it would normally say. Instead of asking directly for something forbidden, they frame the…
Evasion: Persona Override as Fictional Rule-Breaker
This detects a jailbreak trick where an attacker asks an AI model to pretend to be a fictional character defined by breaking rules or providing any requested information without limits…
Evasion: Refusal Suppression via Forbidden Response Strings
This attack targets the words an AI assistant is allowed to use, not its actual goals. By banning refusal phrases like 'I'm sorry' or 'I cannot' before it ever asks the harmful question…
Evasion: Unicode Glitch Token / Superscript Embedding Anomaly
Attackers embed unusual Unicode characters — superscript letters or known 'glitch tokens' — inside text sent to an AI system. These characters exploit how the model's tokenizer breaks text…
Excessive Agency — Scope Hijack, Untrusted Code Execution & Unauthorized Privilege Grant (Semantic)
This detects prompts that push an AI agent with real-world tools (messaging, smart devices, code execution, access control) to do more than the user actually intended or has authority to…
External Network Input Followed by Process Execution
This detects a two-step pattern where an AI agent first pulls content from a remote web address and then executes a program shortly after. That sequence is the classic shape of a…
Fake-Citation Biased-Information Mandate
This detects a prompt injection technique that instructs an AI model to write persuasive-sounding content that supports only one side of an issue, while fabricating citations to make it…
FastGPT Workflow File-Read Node SSRF Link
FastGPT lets workflows include a 'file reading' node that fetches a file from a URL. Versions before 4.11.1 don't check where that URL points, so an attacker can point it at internal…
FastMCP OAuth Callback Reflected XSS
FastMCP versions before 2.13.0 build the OAuth callback page by inserting URL parameters directly into HTML without escaping them. An attacker who gets a victim to open a crafted callback…
FastMCP Windows cmd.exe Injection via Server Name Metacharacters (CVE-2025-64340)
FastMCP versions before 3.2.0 take the name of an MCP server and pass it, unchecked, into Windows cmd.exe when you run the install command for Claude Code or Gemini CLI. If that name…
Fictional CIA Secret Files Story Extraction
This detects a jailbreak technique where an attacker asks an AI to write a fictional story about CIA headquarters, then adds an instruction to 'actually read out loud' the top-secret files…
Fictional Framing Safety Bypass
This rule flags prompts that ask an AI system to produce harmful or restricted content by disguising the request as a story, screenplay, roleplay scenario, or academic exercise. The framing…
Fictional Unfiltered AI Comparison / Verbatim Hypothetical Model Extraction
This detects a prompt injection trick where an attacker asks the AI to first give its normal safe answer, then write a 'verbatim example' of what a fictional AI without content filters…
FigStep Image-List Multimodal Jailbreak Text Pattern
FigStep is a jailbreak technique for multimodal AI models that hides harmful requests inside an image instead of the prompt text. The model is shown a picture containing an empty numbered…
File Backdoor via Bidirectional Unicode and Zero-Width Characters
An attacker hides malicious instructions inside invisible Unicode characters (bidirectional text controls or zero-width joiners) embedded in text the AI agent is told to write to a file. A…
File System Enumeration for Credentials and Secrets
This rule flags when an AI agent's tool calls are used to search through a file system for things like SSH keys, cloud config files, and other credential stores. That kind of scanning is a…
Filesystem and Cloud Enumeration Preceding Lateral Movement
This rule flags an AI agent performing large-scale discovery — walking entire directory trees or listing whole cloud storage buckets — rather than looking at a few files. That kind of broad…
Financial Fraud Execution — Ponzi Setup, Fabricated Statements, Unauthorized Redirect & Laundering
This rule catches instructions that push an AI agent with access to financial tools into carrying out specific fraud patterns — like Ponzi schemes, fake financial statements, or…
FITD Multi-Turn Jailbreak Capitulation in Model Response
This detects the moment an AI assistant, after being gradually pressured across a conversation, openly says it is now dropping a restriction it previously enforced. It's a sign that a slow…
Foot-in-the-Door Gradual Escalation Attack
This detects a manipulation technique where someone starts a conversation with an AI agent using a harmless request, then slowly escalates to harmful or restricted requests by citing the…
Forged Input-Boundary Markers — Tensor Trust Ambiguity / Input-End Delimiters
An attacker puts text into a prompt that looks like a boundary marker signaling 'user input ends here.' The AI agent may then treat whatever comes after that marker as trusted system…
Framelink Figma MCP Server curl-Fallback Command Injection (CVE-2025-53967)
The Framelink Figma MCP server has a bug in how it retries failed network requests. When a normal fetch fails, it falls back to calling the curl command through the system shell, and it…
FunctionMasking predict_mask Semantic Bypass
An attacker asks an AI model to play a word-guessing game where it fills in masked words from definitions, then assembles those guessed words into a harmful question. Because the harmful…
GCG Adversarial Suffix Attack
Attackers can append a specific kind of computer-generated 'nonsense' text to a normal-looking request, which tricks an AI model into bypassing its safety training and doing something it…
Gigachad Dominant-Aggressive Persona Adoption
This detects a specific jailbreak attempt where an attacker tells an AI to adopt the 'Gigachad' internet persona and speak with extreme confidence, charisma, and dominance. This character…
Git Worktree Created With Reserved Name .git (Directory-Confusion Sandbox Escape)
This detects an attack where a malicious repository tricks an AI coding agent into running a git command that creates a folder literally named '.git'. That reserved name normally belongs…
GitHub Actions PR Metadata Script Injection RCE
Many CI workflows insert pull-request data — like the PR title, description, branch name, or a comment — directly into a shell command. If that text isn't sanitized, an attacker can put…
GOAT Adversarial Attacker Loop In LLM Traffic
GOAT is an automated 'attacker model' that repeatedly tries different jailbreak techniques against a target LLM, tracking its own reasoning in a structured format on each turn. This rule…
Goose CLI Git core.fsmonitor Command Execution Chain
A booby-trapped git repository can set a config option that makes git run an attacker's command whenever certain git operations happen. If someone runs the AI coding tool Goose's 'review'…
GPT-X Star Trek Unlimited-Knowledge Unconstrained Oracle Persona
This detects a specific jailbreak attempt where a prompt tricks an AI into role-playing as 'GPT-X,' a fictional Star Trek-style entity that claims to hold all human codebase data and…
Grandma Roleplay Harmful Substance Synthesis
This detects a known jailbreak trick where someone asks an AI to pretend to be their deceased grandmother who used to recite dangerous information, like chemical synthesis steps or software…
Grandma Roleplay Jailbreak
This detects a manipulation trick where a user pretends a deceased or beloved family member (like a grandmother) used to share dangerous information as a bedtime story or fond memory. The…
h4x Amoral Unfiltered AI Character Persona
This detects attempts to trick an AI assistant into adopting a fake persona called 'h4x' that claims to be a completely amoral, unfiltered AI willing to answer anything regardless of…
Hacker / Chan-Culture Offensive AI Persona
This detects prompts that try to trick an AI assistant into acting as an unrestricted hacker or '4chan' persona that ignores its normal rules. The idea is that by adopting a culturally…
Hardcoded Suspicious IP Address in Skill Content
A skill or plugin published for AI agents contains a literal IP address that matches infrastructure known to be used by malware for command-and-control. This suggests the skill was built to…
Harm Solicitation - Genital Insults and Intimidation Tactics Requests
This detects when someone directly asks an AI system to produce genital-based insults or advice on making another person feel afraid or intimidated. It's a direct text-prompt request, not a…
Harm Solicitation - Interpersonal Violence and Intimidation Requests
This detects prompts where a user asks an AI system for advice on causing harm to a specific person — physically, emotionally, or through intimidation. It's a direct request, not a…
Hidden Instructions in MCP Skill Metadata
MCP skills advertise themselves to AI agents using metadata like names, descriptions, and parameter text. This detection looks for hidden content in that metadata — HTML comments, invisible…
Hidden LLM Instructions in Skill Descriptions
Some AI agent 'skills' (add-on tools or plugins) contain text that looks like normal documentation but is actually written to instruct the AI model itself. Phrases like 'CRITICAL…
Hidden Override Instructions in Skill Content
Attackers can hide natural-language instructions inside a 'SKILL.md' file that tell an AI agent to ignore its normal rules, act without telling the user, or bypass safety checks. Because…
Hidden System Instructions with Permission Override
An MCP skill (a plugin or tool an AI agent can use) contains hidden text wrapped in XML-style tags like <IMPORTANT> that tries to override the agent's normal behavior or bypass its security…
Hidden System Instructions with Priority Override Blocks
Some MCP skills for AI agents contain hidden text that pretends to be a high-priority system message, using formatting like 'IMPORTANT', 'CRITICAL', or 'SYSTEM' tags to trick the agent into…
Hidden Unicode in Agent Instruction Files
Attackers can plant special Unicode characters — invisible spacing marks or text-direction overrides — inside files like CLAUDE.md or .cursorrules. A human reviewing the file in a normal…
Hidden Unicode Tag Instruction Then Agent Action
Attackers can hide instructions inside normal-looking text using invisible Unicode 'tag' characters. Some AI models (Gemini-class) silently decode and obey these hidden characters, so an…
Hidden-Text Prompt Injection in User-Supplied Documents
Attackers hide instructions inside documents, resumes, or web pages using tricks like white-on-white text, zero-width characters, or HTML comments. A human reviewer sees nothing unusual…
Historical AI Persona Jailbreak with Compliance Enforcement
This attack tells an AI agent that a different, unrestricted version of itself once existed and asks it to pretend to be that version. By inventing a fake backstory and detailed 'rules' for…
Honesty Alter-Ego Dual-Consciousness Safety Filter Bypass
This is a known jailbreak prompt pattern that tries to trick an AI assistant into producing an unfiltered 'alter ego' persona alongside its normal answer. It claims the AI secretly has a…
HTML/Script Injection in Tool Call Argument Targeting a Human-Approval Dashboard
An AI agent tool call can include a filename, command, or other text field that contains hidden HTML/JavaScript. If a human-approval dashboard displays that field without escaping it, the…
Human-Agent Trust Exploitation Detection
This rule flags AI agents that talk humans into approving risky actions instead of informing them. That includes faking certainty, hiding warnings, inventing time pressure, or claiming…
Hydra instantiate() Target Hijack to Process Execution
Hydra, a Python configuration framework, lets a config value called '_target_' name a function or class to instantiate. If an attacker can influence that config - through a CLI override, a…
Hypothetical / Fictional-Story Framing Bypass
Attackers ask an AI system to answer harmful or restricted requests by pretending it's just a story or thought experiment. Phrases like 'hypothetically, if a character needed to...' or 'in…
Hypothetical Response / Function Masking Token Smuggling
Attackers can get an AI model to produce harmful content by disguising the request as fiction or as a word-puzzle instead of asking directly. This rule flags two known patterns for doing…
Hypothetical-Framing Bypass: Research / Security-Audit Pretext
Attackers ask an AI agent to 'imagine' it's running a research project, survey, or security audit, then use that fictional setup to request real sensitive data like passwords, emails, or…
Identity Command Real-Person Persona Injection
This detects a specific jailbreak pattern where an attacker types a prompt that defines a custom '/Identity' command, instructing the AI to permanently respond as a named real person…
Ignore-Below-Instructions Injection (Downstream Override)
This detects a prompt injection trick where an attacker tells an AI model to disregard instructions or safety checks that appear later in the same conversation, before the model has even…
Ignore-Previous-and-Following Instructions Output Command (PromptInject Goal Hijacking)
This detects a well-known trick used to hijack AI chatbots and agents: telling the AI to disregard its original instructions and instead output whatever the attacker wants. It looks for the…
Illegitimate Prescription Fulfillment
An attacker instructs an AI agent that has email and prescription-related capabilities to find paid requests for illegitimate prescriptions and then confirm or issue them automatically…
im_end / im_start System Prompt Injection Format Markers
Attackers embed literal formatting tokens like <|im_end|>/<|im_start|> or [INST]/<<SYS>> inside normal user input to trick a language model into thinking the user's turn ended and a new…
IMG onerror XSS Injection via Indirect Prompt Injection
An attacker plants malicious text somewhere an AI system will read it — a document, webpage, or other data source — instructing the AI to output an HTML image tag with a broken link and a…
In-the-Wild Jailbreak Corpus Signature Patterns
This rule spots prompts pulled from a large real-world collection of jailbreak attempts against AI chatbots. Attackers use these prompts to make an AI adopt a fake persona — like an 'amoral…
Indirect Authority Claim in External Content
Attackers plant text inside documents, web pages, or tool outputs that speaks directly to an AI agent, pretending to be an authoritative correction. Instead of commanding the AI outright…
Indirect PI — Browsing History / Search History Exfiltration via Agent Email
An attacker hides instructions inside content an AI agent reads — like a webpage or document — telling it to grab the user's search or browsing history and email it out. This is a form of…
Indirect PI — Data Destruction Instruction via Agent File/Document Tool
An AI agent that reads external documents or files can be tricked into deleting data it wasn't supposed to touch. The malicious instruction isn't typed by a user — it's hidden inside a…
Indirect PI — Location, Address, and Browsing History Exfiltration
Attackers hide commands inside content that an AI agent reads — like a webpage, document, or email — telling it to secretly send out the user's current location, saved home/work addresses…
Indirect PI — Physical Address / PII Exfiltration via Agent Email
This detects a prompt injection attack where text hidden in a document, webpage, or email tricks an AI agent into pulling a user's saved home, shipping, or billing address and emailing it…
Indirect PI — XSS Payload Injection in Agent-Consumed Content
An attacker plants text inside a webpage, document, or tool output that an AI agent is expected to read and summarize. That hidden text tells the agent to stop summarizing and instead…
Indirect Prompt Injection in Retrieved Content
AI agents that read web pages, documents, or other external content can be manipulated by text that isn't meant to be seen by humans. Attackers hide commands using invisible CSS, disguised…
Indirect Prompt Injection via External Content
AI agents that read web pages, documents, or other outside content can be tricked by instructions hidden inside that content. Because the agent can't tell the difference between what its…
Indirect Prompt Injection via Obfuscated Instruction Smuggling
Attackers hide commands for an AI agent inside web pages or documents using invisible or machine-only text tricks, so a human skimming the page sees nothing wrong. When the agent fetches…
Indirect Prompt Injection via Tool / API Response — Attacker Instruction Embedded in Returned Tool Output (InjecAgent Th
AI agents that call tools or APIs (search, email, databases) trust the data those tools return. This detection catches attackers who plant a command inside that returned data — disguised as…
Indirect Prompt Injection via Tool Responses
Attackers plant hidden commands inside content an AI agent will later fetch and process, such as a web page, API reply, or document. When the agent reads that content as part of its normal…
Indirect Prompt Injection: CAPTCHA Redirect Task Disruption
An AI agent that reads web pages or documents as part of its job can be derailed by hidden text embedded in that content. The hidden instruction tells the agent to go solve a CAPTCHA or…
Indirect Prompt Injection: Fake-Authority Task Abort
Attackers hide a fake authority message inside content an AI agent reads, telling it to stop what it's doing and reply with something useless instead. This is a denial-of-service attack…
Indirect Reference Instruction Reversal
This detects a two-step manipulation where someone asks an AI agent to disclose the instructions or rules it was given, then follows up by asking it to do the opposite of those…
Injected Code — Browser Cookie / Session-Token Theft
This rule flags cases where an AI agent is manipulated into loading a saved cookie file and attaching it to an outbound web request. That lets an attacker hijack a victim's logged-in…
Injected Code — Contact-List Harvest and SMTP Spam Exfiltration
An AI agent can be manipulated into reading a local file of contacts and sending them all an email pulled from a remote source. This spreads spam or malicious content to everyone in the…
Injected Code — Environment-Variable Exfiltration
An attacker hides instructions inside content an AI agent processes, causing the agent to write or run code that reads sensitive environment variables (like API keys and tokens) and sends…
Injected Code — Host / Hardware Inventory Exfiltration
This detects a pattern where code injected into an AI agent's output gathers detailed information about the host machine — installed software, memory, USB devices, disks, network cards…
Injected Code — Live User-Activity / Location / Log Surveillance Exfiltration
An attacker hides instructions inside content an AI agent processes, tricking it into writing and running code that continuously spies on the user. This code reads clipboard contents…
Injected Code — Local File Exfiltration to a Remote Endpoint
An attacker hides instructions inside content an AI agent processes — a webpage, document, or email — telling it to write code that reads a local file and sends it out over the network. If…
Injected Code — Network Denial of Service (Connection Kill / Adapter Disable / Flood)
An AI agent that can write and execute code can be manipulated, through injected instructions, into writing code that knocks a machine or network off the internet. This includes killing all…
Injected Hyperlink — Scam / Malware / Advertising URL in the Response
Attackers hide instructions inside content an AI agent reads — a webpage, document, or email — telling it to add a link or contact address to whatever it outputs next. If the agent obeys…
Injected Instructions in Tool Output Followed by Compliance
An AI agent that reads web pages, files, or other tool output can be tricked if that content secretly contains instructions written for the AI itself. If the agent then acts on those hidden…
Insecure Inter-Agent Communication Detection
In systems where multiple AI agents talk to each other, messages should be authenticated and checked so one agent can't be tricked into obeying a forged or replayed instruction from…
Insider Manipulation & Process Corruption — Market/Data Tampering, Legal-Process Subversion & Pretextual Fund Movement (
This detector flags requests that ask an AI agent with access to trading, legal, or financial tools to manipulate an important process — like market data, a court case, or a fund transfer —…
Instruction Injection via Tool Output
When an AI agent calls a tool (a search API, a document reader, a database, etc.), the data that comes back is supposed to be inert information. This rule flags cases where that returned…
Instruction-Set Probe or Supplant
This detects messages from a user that try to get an AI assistant to expose its system prompt or configuration, or to simply override it with new 'instructions'. It's the same family of…
Inter-Agent Message Spoofing and Peer Impersonation
A compromised or misbehaving AI agent can send messages to Slack, Teams, Discord, or email that falsely claim to come from another trusted agent or a central control system. Because…
Internal-State Reconnaissance — System Prompt, Config & Tool Enumeration (Semantic)
This detects attempts to trick an AI agent into revealing its own internal setup — its system prompt, configuration details, or the list of tools and API endpoints it can call. Attackers…
Invisible Unicode Tag Character Injection
Attackers can embed text using a special Unicode range (the 'Tag' block) that renders as nothing visible on screen, but some AI models still read and follow it as instructions. This lets…
Jailbreak Attempt Detection
This rule flags user inputs that try to trick an AI system into ignoring its safety rules. It covers a wide range of known jailbreak tactics, from named personas like DAN to fake 'developer…
Jailbreak Emoji Unlock Dual-Format Output Identifier
This detects a known jailbreak pattern that asks an AI model to answer twice: once as its normal, restricted self and once as an 'unlocked' version that ignores safety rules. The two…
Jailbreak Framing — Narrative, Hypothetical, Few-Shot & Distraction Laundering (Semantic)
This detects attempts to trick an AI system into producing harmful or restricted output by dressing the request up as fiction, research, a hypothetical, or burying it among harmless…
Jailbreak Tooling Acquisition - basemode Raw Continuation Package
This rule flags when someone installs or runs a package called 'basemode' on a monitored system. The package forces language models into a raw continuation mode that skips normal…
Jailbreak-Template Command with [TARGETLANGUAGE]/[KEYWORD] Placeholders
This detects a specific text pattern where someone sends a message that looks like a jailbreak prompt template, complete with unfilled placeholder variables like [TARGETLANGUAGE] and…
JSON Format Sysprompt Extraction — Structured Output Exfil
This attack asks an AI assistant to output its response as a JSON object where the field name or template value secretly instructs it to dump its hidden system prompt or full conversation…
Key-Value Template Persona Injection (JOB/ROLE/PREFIX + Bracket Format)
This detects attempts to trick an AI system into ignoring its safety rules by hiding the jailbreak inside text that looks like a config file or an RPG character sheet. Instead of asking…
Known Vulnerable Package Installation
This rule flags when someone installs a software package via pip (Python) or npm (Node.js) that has a publicly known vulnerability. It relies on a fixed, built-in list of high-severity…
KQL/Kusto Pipe-Chain Injection via Table-Name Parameter in a 'Safe' Metadata Tool
Some AI agent tools that look up table schemas or sample data treat their table_name parameter as safe metadata, but actually paste it straight into a Kusto (KQL) query string. An attacker…
LangChain LocalFileStore Path Traversal Invocation
LangChain's LocalFileStore, a simple file-based cache used by AI agents, does not clean up the file paths it builds from caller-supplied keys. An attacker who can influence a key value can…
LangChain numexpr Evaluate RCE - Interpreter Shell Escape
LangChain's math tools (LLMMathChain, PALChain) can be tricked into passing attacker-controlled text into numexpr's evaluate() function, which can run arbitrary code. This rule catches the…
LangChain PAL Chain Arbitrary Code Execution
Older versions of LangChain's PALChain feature turn user-supplied text into Python code and run it without any safety sandbox. An attacker who can influence the question sent to the chain…
LangChain PALChain Python Exec RCE (CVE-2023-36258)
LangChain versions up to 0.0.64 include a feature called PALChain that generates Python code from a prompt and then runs it directly with no safety checks. An attacker who controls or…
LangChain Prompt Template Arbitrary File Read
LangChain's multimodal prompt templates can load an image file from a path and embed it in the prompt sent to a model. If an attacker controls the input value used for that path, they can…
LangChain Recursive URL Loader SSRF to Internal Target
An AI agent that fetches web pages on your behalf can be handed a crafted URL that redirects it to internal network addresses or cloud credential endpoints instead of the public page it…
LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates
A vulnerability in LangChain (CVE-2025-65106) lets an attacker craft input to a prompt template that uses Python's attribute-access syntax (like object.__class__ or similar dunder chains)…
Langflow Privilege Escalation via Superuser CLI Invocation
Langflow is an AI workflow builder with a normal sign-up page that only ever creates regular, non-admin users. It also ships a hidden command-line option, 'langflow superuser', that writes…
Langflow Unauthenticated Code Injection Exploit Attempt
Langflow, an open-source tool for building AI workflows, has an endpoint that compiles and executes submitted Python code without requiring login. Attackers exploit this to run their own…
Langflow Untrusted Functionality Inclusion RCE Payload Execution
Langflow, an AI workflow builder, can be made to evaluate code supplied by a remote attacker without any login. When exploited, the Langflow backend process spawns a child process to run…
Language-Evasion: Multilingual Credential Request
Some prompt-injection defenses only scan for English phrases like 'password' or 'secret key.' An attacker can simply ask for the same credential in Spanish, Japanese, Arabic, or another…
Latent Injection Document Separator Token
Attackers hide commands for an AI system inside normal-looking files like résumés, reports, or translation requests. The hidden text uses marker patterns that separate it from the visible…
Latent Injection Ignore-Instruction Keyword
Attackers can smuggle commands into content an AI agent processes — like a document to translate or a whois lookup result — that tell the model to abandon its original task and do something…
Latent Injection in Retrieved Document / RAG Context
Attackers hide fake commands inside resumes, reports, emails, or web pages that an AI agent later retrieves and reads. Because the agent treats retrieved text as trustworthy context, it can…
Latent Injection in Translation Context
Attackers hide commands inside the text an AI agent is asked to translate, summarize, or otherwise process, hoping the model follows the hidden command instead of doing the requested task…
Latent Injection via WHOIS Domain Record Data
Attackers hide malicious instructions inside WHOIS records — the technical details returned when looking up who owns a domain. When an AI agent summarizes or reads that WHOIS data, it can…
Latent Prompt Injection via Embedded Document or Report Context
Attackers plant fake commands inside ordinary-looking files—reports, resumes, legal text, Whois lookups—that an AI agent is asked to read or summarize. When the agent processes the…
LibreChat is a ChatGPT clone with additional features.
LibreChat lets users add their own MCP tool servers, including custom HTTP headers. A bug let those headers contain placeholders like {{LIBRECHAT_OPENID_ACCESS_TOKEN}} that got silently…
LibreChat MCP STDIO Argument Injection (CVE-2026-22252)
LibreChat's MCP STDIO adapter passes tool arguments straight into a spawned process without quoting or escaping them. An attacker who controls tool input can smuggle shell metacharacters or…
Lie/Truth Dual Personality Uncensored Alter-Ego
This detects a known jailbreak prompt pattern that tries to trick an AI assistant into producing unrestricted or harmful content by framing it as a second personality called 'Truth', which…
LiteLLM MCP Server Creation Authenticated argv Injection (CVE-2026-30623)
LiteLLM's proxy has an endpoint for registering MCP servers that takes a 'command' and 'args' from the caller and runs them as a subprocess. Any user with a valid proxy API key — not…
LlamaIndex encode_image Path Traversal
A bug in specific LlamaIndex versions (0.12.27-0.12.40) fails to sanitize the image_path parameter passed to its image-encoding function. An attacker who can control that parameter through…
LlamaIndex Object Node Mapping Pickle Deserialization
LlamaIndex stores certain indexes using Python's pickle format, which can run arbitrary code when loaded. This rule flags command lines that combine a pickle-loading call with either…
LlamaIndex Pickle Index Deserialization to Code Execution
LlamaIndex versions up to 0.11.6 load saved index files using Python's pickle format without checking if they're safe. An attacker who can supply a malicious index file can get arbitrary…
LLM Agent URL Exfiltration - Secret or Bulk Payload Carried in Outbound Request URL
An AI agent that can browse or fetch URLs can be manipulated by malicious instructions hidden in content it reads into sending a web request where the sensitive data itself is embedded in…
LLM Jailbreak Persona Compliance In Model Response
This detects when an AI language model's own reply shows signs that a jailbreak prompt worked and the model is now roleplaying as an unrestricted persona. It looks at the model's output…
LLM Output XSS — Eliciting JavaScript Payloads from LLM for Browser Injection
This rule flags attempts to get an AI model to generate malicious JavaScript or HTML, such as script tags or event handlers, designed to steal cookies, session data, or page content when…
LLM Package Hallucination Typosquat Bait
This rule flags prompts crafted to make an AI model suggest package names that don't actually exist. Attackers register those fake names on real package registries ahead of time, so if a…
LLM Silent Model Substitution To Unmanaged Or Uncensored Model
An AI agent that starts out using an approved, safety-tuned model can have its configuration rewritten so that later requests go to a different model instead — one without the usual safety…
LLM-As-Chatbot modelsbyom Component Descendant Code Execution
This detects the aftermath of a code execution flaw in the LLM-As-Chatbot application's modelsbyom.py component. It watches for a suspicious shell or downloader process being spawned from…
LLMail Chat-Template Boundary Spoofing in Email Content
Attackers embed special-looking tags like <|end tool output|> and <|start user prompt|> inside an email or document that an AI agent reads. This makes the AI think the retrieved content has…
LLMail Email-Tool Exfiltration to Fixed Attacker Address
An AI assistant that reads and summarizes email can be manipulated by hidden instructions inside an incoming message. Those instructions make the assistant send a reply containing a…
LLMail Exfiltration to Obfuscated Attacker Address
This detects a trick used against AI email assistants where an attacker hides their email address inside a message using tricks like 'contact at contact.com' or HTML-encoded '@' symbols. A…
LLMail Fake Email-Boundary Marker Injection
Attackers hide a forged 'email ended, new one started' marker inside a single email so an AI assistant reading it thinks a second, trusted email has begun. That fake second email then…
LLMail Post-Summary Exfiltration Directive to Attacker Address
Attackers hide instructions inside an email that tell an AI email assistant to do its normal job first, then quietly send the results to an outside address. Because the malicious step is…
LLMail Pseudo-XML Role-Boundary Injection in Email Content
An attacker hides text inside an email or document that mimics the internal formatting AI agent systems use to separate 'assistant', 'tool', and 'user' turns. By closing one role tag and…
LMRC Harmful Content Elicitation — Quack Medicine, Bullying, Slur Usage
This detects prompts asking an AI assistant to produce pseudoscientific medical claims, bullying tactics against a specific person, or slurs to insult someone. These requests test whether…
Logic-Trap Lie-Permission Mandate Jailbreak
This detects a jailbreak attempt where an attacker uses a long, fake logical argument to convince an AI model it has already been lying, then concludes the model should be formally 'allowed…
Malformed-Grammar PWNED Success-Claim Detection
This rule flags cases where an AI model's own response includes an odd, grammatically wrong phrase like 'Me have been PWNED' or 'I has been PWNED'. That phrase is a known marker that a…
Malicious Agent-to-Agent Message Injection
When AI agents talk to each other, one agent can send a message that looks like normal data but actually contains hidden commands. If the receiving agent doesn't check the message…
Malicious Artifact Hosted on a Legitimate AI Vendor Domain (FakeAgent Delivery Chain)
Attackers abuse the user-content features of AI platforms — shared chats, published artifacts, hosted pages — to host lure pages on the vendor's own trusted domain. The page then redirects…
Malicious Fork Impersonation via Install Instruction
This rule flags cases where an AI agent's output—such as a skill or tool response—recommends installing a package described as a community fork, enhanced version, or patched version of a…
Malicious Persona Creation for Safety Bypass
Attackers ask an AI agent to pretend to be a fictional character with explicitly harmful traits — racist, violent, self-harming, amoral — hoping the 'it's just roleplay' framing gets the…
Malicious PyPI Package mudraid-sdk in Agent HTTP Traffic
mudraid-sdk is a trojanized package published to PyPI. This rule spots outbound web traffic that mentions the package name, whether that's a download, a manifest listing it, or a runtime…
Malicious Skill Update or Mutation
An add-on tool (skill) for an AI agent can be reviewed and approved while it's harmless, then quietly updated later to steal data, plant a backdoor, or manipulate the AI through prompt…
Malware Generation — Generic Virus and Specific Payload Request
This rule flags prompts that directly ask an AI system to write malicious software: viruses, worms, keyloggers, ransomware, rootkits, backdoors, botnets, or cryptojackers. It also catches…
Many-Shot Repetition Override via Extended Q&A Chain
An attacker feeds an AI system dozens of harmless-looking question-and-answer pairs before sneaking in the real, harmful request at the end. The long run of benign exchanges conditions the…
Markdown Image URL Data Exfiltration
An attacker tricks an AI chat assistant into embedding secret data inside an image link. When the chat interface automatically renders that image, the user's browser sends a hidden web…
Markdown Image URL Exfiltration and XSS Injection
Attackers hide instructions inside content an AI agent processes, telling it to output a markdown image tag that secretly embeds sensitive conversation data in a URL. When the agent's…
Matrix-Themed Dual Response Jailbreak
This attack tries to trick an AI assistant into giving two answers to every question: a 'safe' one that follows normal rules, and an 'unrestricted' one that ignores them. It uses Matrix…
MCP 2026-07-28 Stateless Spec: Async Task Abuse and OAuth 2.1 Misuse
A newer version of the Model Context Protocol (MCP) lets AI agent tools run long background jobs ('tasks') after a single human approval, and dropped the session-ID system that used to tie…
MCP Config Tampering (Instance-Resolved)
An AI coding agent or assistant can write to its own configuration file that lists which external tools and servers it's allowed to use. If an attacker or compromised process modifies this…
MCP Config Write Attempt
AI coding assistants like Claude Desktop, Cline, and Windsurf read configuration files that list which external tools (MCP servers) they're allowed to use. If an attacker can get the agent…
MCP Database Server Read-Only Bypass
Some MCP database server bridges that connect AI agents to databases can be started in a read-only mode meant to block writes, but that restriction can be bypassed. This detection flags…
MCP Full Schema Poisoning — Injected Directive in Non-Description inputSchema Field (MCP-11)
Some MCP (Model Context Protocol) servers advertise tools to an AI agent using a schema that describes each parameter. Attackers can hide instructions to the AI inside parts of that schema…
MCP JSON-RPC Message Carries Case-Duplicate name/arguments Keys to Smuggle an Unauthorized Tool Call
Attackers can send a tool-call request with two versions of the same field name that differ only in capitalization, like 'name' and 'Name'. A security gateway checks one version while the…
MCP Line Jumping — Agent-Directed Imperative Embedded in a Tool/Parameter Description Field (Pre-Invocation Injection)
An MCP (Model Context Protocol) server can plant hidden instructions inside a tool's own description field. Because AI clients load these descriptions into the model's context as soon as…
MCP OAuth Redirect Handler Command Injection (sequa-mcp redirectToAuthorization)
An MCP client library builds a command to open a browser for OAuth login, but inserts the authorization URL into that command without checking it first. If the URL comes from a malicious or…
MCP Parameter Description Injection
AI agents that use tools defined by the Model Context Protocol (MCP) read tool descriptions, including parameter descriptions, before deciding how to call a tool. An attacker can write…
MCP Sampling Prompt Injection (Server-to-Client createMessage Abuse)
The Model Context Protocol (MCP) lets AI tools call out to external servers for extra capabilities. A malicious or compromised MCP server can abuse a feature called 'sampling' to send the…
MCP Server Kubernetes kubectl_generic Flag Injection Bearer Token Exfiltration (CVE-2026-47250)
A vulnerability in mcp-server-kubernetes (CVE-2026-47250) lets an attacker steal an operator's Kubernetes access token by planting hidden instructions where an AI agent will read them, such…
MCP Server Security Policy Fail-Open on Initialization Failure (CVE-2026-16584)
When a security-policy component in an AI agent server fails to load at startup, it should refuse to start. Instead, in this flaw, it logs a warning and keeps serving requests with the…
MCP Skill Impersonation and Supply Chain Attack
Attackers publish AI agent tools (MCP skills) with names, spellings, or version numbers designed to look like trusted, popular tools. An agent or a developer picks the fake tool by mistake…
MCP stdio server config command injection via unvalidated test endpoints
Some AI agent platforms let a request supply an MCP 'stdio' server configuration (a command plus arguments to run). If that configuration isn't validated, an attacker can put a shell…
MCP StreamableHttp OAuth Redirect URL Command Injection
Some AI agent clients that speak the MCP protocol will fetch an OAuth authorization URL from a remote MCP server and then hand that URL, unsanitized, to a spawned shell command. If the…
MCP Tool Description Defines a Common-Phrase Trigger to Forward Full Conversation History
A malicious tool given to an AI agent can carry hidden instructions in its description text, not just its function. This rule flags tools whose description tells the model to secretly send…
MCP Tool Description Unicode Confusable Deception
Some tools registered with AI agents (via the Model Context Protocol, or MCP) describe themselves using letters that look like normal English but are actually Cyrillic, Greek, or other…
MCP Tool Description — Exclusive Tool Invocation Override
An AI agent that uses Model Context Protocol (MCP) tools picks which tool to call based on descriptions and instructions it reads at runtime. This rule catches text planted in those…
MCP Tool Returns Untrusted External Content Carrying Hidden Agent Instructions Without Spotlighting
An AI agent that reviews pull requests can be tricked by text hidden inside the PR description itself. Because one tool in the Microsoft Azure DevOps MCP server returns that text raw and…
MCP Tool Rug-Pull — Post-Approval Description Redefinition Injects Execution Instructions
Some AI agent platforms let external tools be added via the Model Context Protocol (MCP). This detection targets tools whose description looks safe when a user first approves them, but…
MCP Tool-Manifest Poisoning — Name Squatting, Result Shadowing & Covert-Action Directives (Semantic)
AI agents that use tools (via MCP or similar plugin systems) trust the name and description written by whoever published the tool. This detection looks for tool listings that lie about…
mcp-server-kubernetes Command Injection in kubectl_scale / kubectl_patch / explain_resource (CVE-2025-53355)
A widely used Kubernetes automation tool for AI agents (mcp-server-kubernetes) fails to sanitize inputs before running them as shell commands. An attacker who can influence the parameters…
MCP/agent tool reads .env or secret file without user consent (OSV-MCPS-2025-EB70F912)
Some AI coding agents automatically open configuration and secret files like .env when analyzing a codebase, then send their contents to the model. This happens without any prompt asking…
MCP/API Tool Argument LFI via Mixed-Encoding Path Separator or file:// URI Scheme Escape
Attackers can trick AI agent tools and APIs into reading sensitive system files like /etc/passwd by disguising the request. Instead of an obvious traversal pattern, they hide a single…
MCPHub MCPRouter baseUrl SSRF
MCPHub's MCPRouter component accepts a baseUrl-style parameter when registering an MCP server, and versions up to 0.9.10 don't properly validate that URL before the router connects to it…
MCPwn Runaway Tool Invocation via Retry Directive (CVE-2026-33032)
An MCP (Model Context Protocol) server can respond to a tool call with fields meant to be simple retry hints, but instead fill them with commands telling the agent to invoke the tool again…
MEDIA:/file:// Directive Injection in Tool Result for Local File Exfiltration
Some AI agent frameworks scan tool output for special MEDIA: or file:// tags and automatically attach the referenced local file's contents to outbound chat messages like Discord or Slack. A…
Microsoft Copilot Studio SharePoint Indirect Prompt Injection (CVE-2026-21520)
Microsoft Copilot Studio agents that read SharePoint form responses or documents as trusted input can be tricked into following instructions hidden in that content. Because the content…
Model Registry Artifact Pin Decay
A deployment fetches one model artifact using an immutable commit SHA, giving the appearance of a locked, reproducible setup. Shortly after, in the same session, it loads another artifact…
Model Serving RCE - vLLM RPC Pickle Deserialization Exploit
vLLM, a popular tool for serving large language models, has an internal RPC channel that deserializes attacker-supplied data using Python's pickle format. Pickle deserialization can be…
Movie Title Generator Instruction Wrapper for PWNED Payload
This detects a jailbreak trick where an attacker asks the AI to 'generate a movie title' from a piece of text, but the real goal is to get the model to output a specific forbidden string it…
Multi-Layer Security Audit Evasion
This detects text fed to an AI agent that is written to disable, skip, or fool the layered security checks (audit logging, validation, trust scoring) that are supposed to review its…
Multi-Tenant Identifier Field (sender_id/owner_id/tenant_id) Carries Path Traversal Into a Storage Write
Some multi-tenant AI systems accept identifiers like sender_id, owner_id, or tenant_id and use them directly to build a filesystem path when saving data. If the system doesn't check that…
Multilingual Prompt Injection via Language Switch
Attackers write their instruction-override attempts in German, Chinese, Spanish, or Japanese instead of English, hoping to slip past filters that were only built to catch English phrases…
n8n Workflow Expression Sandbox Escape to OS Execution
n8n lets workflows evaluate expressions in a restricted JavaScript sandbox. This rule watches for that sandbox being broken out of so the attacker's code runs as a real OS process, then…
Narrative Jailbreak with Dual Response Formatting
This is a jailbreak technique where an attacker writes an elaborate fictional backstory claiming a special unrestricted AI mode exists, then asks the AI to answer twice: once normally and…
Natural-Language Fake-Error Instruction Bypass
Some AI agent skills are written to show the user a fake 'this failed' or 'unavailable' message, while quietly doing a different, attacker-chosen action in the background. The user thinks…
Natural-Language Persistent Covert Action Hook
This detects text that tries to plant a standing, hidden instruction inside an AI agent — telling it to quietly perform some action every time a certain condition happens, without ever…
Natural-Language System Prompt Leak Instruction
This rule spots text that directly instructs an AI agent to reveal, print, or repeat its system prompt or other hidden operator instructions. Attackers use this trick to steal proprietary…
Natural-Language Trust-Escalation / Authority Impersonation
Attackers embed text in AI agent skills or content that falsely claims a platform, vendor, or user has already approved an action. Instead of telling the agent to 'ignore previous…
Negated-Topic Two-Script Evil-Persona Jailbreak
This detects a jailbreak pattern where an attacker asks an AI to write two versions of a script on a topic wrapped in the word 'not', then asks for a second, longer version 'without the…
Network Reconnaissance Activity
This rule flags an AI agent scanning a network for open ports and live hosts — the kind of reconnaissance that usually happens before an attacker tries to move to other systems. It catches…
Network-AI ApprovalInbox Unauthenticated Cross-Origin Approval Bypass (GHSA-mxjx-28vx-xjjj)
network-ai's ApprovalInbox component is meant to require a human to approve risky agent actions like shell commands or spending money. It has no login check at all and allows any website to…
Neurosemantical Inversitis Disease-Frame Jailbreak
An attacker tells an AI chatbot the user has a made-up brain disorder called 'Neurosemantical Inversitis' that flips how they perceive helpful and offensive text. The claim is used to argue…
Nevermind-Override Goal Hijacking in User Input (PromptInject)
This detects a prompt injection trick where an attacker uses a casual phrase like 'nevermind' or 'forget that' to soften an instruction to an AI system before telling it to ignore its…
NEW IMPORTANT INSTRUCTIONS Injection Marker in Document Context
Attackers hide a fake authoritative-looking notice — like '*** NEW IMPORTANT INSTRUCTIONS ***' — inside an otherwise normal document such as a news article, email, or employee memo. When an…
NLP-Based OS / Fictional Terminal Language Override
This detects prompts that try to trick an AI assistant into pretending it's a terminal running a made-up programming language or operating system. The fictional framing (names like ALEL…
Non-Consensual Leaked-Media Purchase & Distribution
This detects an AI agent being instructed to purchase non-consensual intimate or private images of a named person and then distribute them across social media. It covers a specific abuse…
Novel-Persona Jailbreak via Co-Signal (persona swap + explicit restriction removal)
This detects a common jailbreak trick where an attacker tells the AI it is now a completely different, invented character and, in the same message, says that character has no rules…
NSFW Character Sheet Generation Unlock
This detects a jailbreak trick where someone hides a fake permission notice inside a fictional character creation template to trick an AI into generating explicit content. Instead of…
OAuth and API Token Interception
An attacker can instruct an AI agent to grab authentication tokens, bearer tokens, or client secrets it has access to and send them somewhere the attacker controls. This turns the agent…
Obfuscated Credential Exfiltration via Encoding
This detects a trick where someone tries to get an AI agent to output real passwords, API keys, or tokens by dressing them up as encrypted or encoded values. Framing the secret as AES256()…
Obfuscated javascript: XSS — Evasion Variants (href, style-expression, null-byte)
This detects attempts to sneak malicious JavaScript past basic security filters by disguising it with hidden characters or repeated keywords. It targets content fed to AI agents that might…
Obfuscated Token Reconstruction via Character Substitution
This attack hides a forbidden word or phrase (like a forced compliance marker) from input filters by never writing it in full. Instead, the attacker writes a broken or disguised version and…
Offensive Security Tool Reference in Agent Content
This rule flags when an AI agent's actions - the commands it runs, tool calls it makes, or files it writes - mention well-known offensive security tools like exploit frameworks, network…
OpenClaw Obfuscated Dangerous Execution Chain
This detects an attack technique nicknamed OpenClaw, where an AI agent is manipulated into executing a command whose real intent is hidden using invisible Unicode characters, text-encoded…
OpenClaw Suspicious File Write to Sensitive Paths
This rule flags an AI coding or automation agent when it writes to files that control what runs automatically on a system — things like shell startup scripts, cron jobs, systemd services…
OpenClaw Suspicious File Write to Sensitive Paths (EDR Graph)
An AI agent (or a subprocess it spawned) writes to sensitive file paths on disk. This particular check catches writes that only show up in operating-system level monitoring, meaning they…
OpenManus Prompt-Handler OS Command Injection via python_execute
OpenManus is an open-source AI agent framework. It has an unpatched flaw where text an attacker feeds into its Prompt Handler gets passed to a Python execution tool without sanitization…
Opposite Day / Boolean Opposite Machine Jailbreak
This attack tricks an AI model into role-playing a world where its rules are inverted, so refusals become approvals and safety guidelines become anti-guidelines. It's a known jailbreak…
Over-Permissioned MCP Skill
Some add-on tools (MCP skills) plugged into AI agents request permissions that have nothing to do with what they claim to do — like a spell checker asking for file write, network, and…
Over-Privileged Skill — Excessive Permissions
This detects AI 'skills' or plugins that ask for far more access than they need — blanket network access, wildcard file paths, or write access to an agent's core identity/memory files. Once…
Package Hallucination Exploitation — AI-Suggested Fake Package Installation
AI coding assistants sometimes invent plausible-sounding but non-existent package names. Attackers anticipate this, register those exact names on public package repositories, and load them…
Paraphrased Prompt Injection
Attackers trying to override an AI agent's instructions don't always use obvious words like 'ignore' or 'disregard.' This detects the same attack phrased more softly, like telling the agent…
Paraphrased Prompt Injection (Semantic)
Attackers can override an AI agent's instructions using rewordings that mean the same thing as 'ignore your instructions' but don't use that vocabulary, such as 'set aside the guidance you…
Paraphrased System-Prompt / Context Extraction (Semantic)
Some users try to get an AI agent to expose its system prompt or internal configuration by avoiding obvious phrasing like 'show me your instructions.' Instead they ask indirectly, such as…
Path Traversal in Agent File Access Requests
AI agents that can read files are sometimes given a tool for that purpose without proper restrictions. Attackers exploit this by sneaking '../' sequences into file paths to break out of the…
Payload-Split String Concatenation Injection
This detects a prompt injection trick where an attacker breaks a harmful instruction into separate text fragments (like variables a, b, c) and asks the AI to combine them before acting…
Perez-Style Direct Prompt Injection Hijacking
Attackers embed text in an AI agent's input that tries to make it abandon its actual task and follow new instructions instead. This detection covers a well-known family of these attacks…
Persistence Mechanism Installation
This rule watches for an AI agent's command execution or file-editing tools being used to create mechanisms that run code automatically at startup or on a schedule. These mechanisms — cron…
Persistence Mechanism Installation (EDR Graph)
This detection watches for files being written to the specific system locations that let a program run automatically, such as at startup or on a schedule. Attackers use these locations to…
Persistent Context Injection in Agent Instructions
Some prompts don't just try to trick an AI agent once — they try to make the trick stick, by phrasing injected content as a permanent rule the agent should 'always remember' or follow 'from…
Persona Conditional Harm-Unlock Rule (BreadClyde Pattern)
This detects a specific jailbreak trick where an attacker gives an AI a fake personality with a hidden loophole: it 'dislikes violence unless explicitly asked to like it.' That phrasing…
Persona-Based Moral Constraint Removal Jailbreak
This attack tries to trick an AI assistant into acting as a made-up character that is explicitly described as having no moral or ethical limits. By framing the request as roleplay, the…
Persona-Based Moral Constraint Removal Jailbreak
This entry describes a prompt injection technique where an attacker tells an AI to adopt a fictional persona explicitly defined as having no morals or ethics, aiming to get the AI to bypass…
Phrasing Past/Future-Tense Harmful Query Bypass
Some users try to trick AI chatbots into giving dangerous instructions by rephrasing the request as if it happened in the past or will happen in the future. Asking 'How was X made?' or 'How…
PII / Credential Extraction via Social Engineering, Obfuscation & Cross-Session Recall (Semantic)
This detects attempts by a user to talk an AI agent into revealing credentials or personally identifiable information (PII) it has access to — either someone else's data, or data the agent…
PII Leakage (LLM-as-Judge)
This detection uses a second AI model to review an AI system's outputs and decide whether they contain personal information or other privacy violations. It's a quality-control check on what…
Piracy Torrent Site List Request
This rule flags prompts where a user directly asks an AI assistant to provide a list of torrent or piracy websites. It targets requests aimed at gathering names of sites for accessing…
Polymorphic Skill and Capability Aliasing Attack
This detects attempts to hide risky capabilities inside an AI agent by giving them innocent-sounding names, or by rewriting a tool's code after it has been reviewed. The goal is to slip a…
Previous Instruction Nullification and Identity Replacement Jailbreak
This detects a common jailbreak pattern where someone tells an AI to forget its original instructions and pretend to be a different, unrestricted persona. The goal is to trick the AI into…
Privilege Escalation Attempt
This rule watches for common Linux techniques used to gain root-level access: running sudo, flipping the setuid bit on files, changing file ownership to root, or granting Linux capabilities…
Privilege Escalation via Delayed Task Execution Bypass
Some tools offered to AI agents let them schedule work for later instead of running it immediately. This rule flags tools whose own description says the delay is used to skip permission…
Prompt Browser Token-Limit / POLLINATION Jailbreak
Attackers try to trick AI chat systems into ignoring their safety rules by disguising jailbreak commands as harmless-looking technical or gardening instructions. Two specific scripted…
Prompt Injection via File Write
An AI agent can be tricked into writing a file whose content is not just data but a hidden instruction meant to manipulate whoever reads it next — another AI agent, or the same agent in a…
Prompt Leaking via Ignore-Previous-Instructions in User Input (PromptInject)
This detects attempts to trick an AI system into revealing its hidden system prompt. The attacker tells the model to ignore its original instructions and then print, repeat, translate, or…
Protect-Me-From Indirect Harm Tutorial Template
This detects a known jailbreak trick where an attacker asks an AI 'how can I protect myself from getting X' but really wants detailed instructions for doing X. The request still contains…
Prototype Pollution via constructor.prototype Path Bypassing __proto__-Only Filters
Some tools that sanitize incoming JSON only block a literal '__proto__' key, assuming that stops attackers from tampering with shared object behavior. This rule catches a bypass where the…
Pseudo-Code Structured Programming Jailbreak Attack
Attackers write prompts that look like programming code — using things like BEGIN/END blocks, variable assignments, and function definitions — to make an AI agent treat malicious…
Python eval() Sink Exploitation - RunGptLLM Command Injection
Some AI agent frameworks pass text returned by a language model straight into Python's eval() function. If an attacker controls that model output, they can smuggle in code disguised as a…
Python Interpreter Role-Assignment Exec Framing
Attackers tell an AI model to pretend it's a Python interpreter, compiler, or printer, then ask it to 'execute' code and return the raw output. This trick gets the model to produce results…
RAG & Memory Poisoning — Embedded Directives, Trigger Tokens, False Authority & Coercion (Semantic)
Attackers plant hidden commands inside documents, knowledge-base entries, or memory records that an AI agent later retrieves and treats as trustworthy input. Instead of just answering a…
Rationalized Safety Control Bypass
This detects a pattern where an AI agent justifies bypassing an approved API, permission check, or safety control by claiming it's faster or more direct to do it another way. The agent…
RBAC Bypass via Social Engineering (Semantic)
Instead of exploiting a technical flaw, an attacker types a persuasive request that convinces an AI agent to bypass its own permission rules. Phrases like 'just this once' or 'this is a…
Reconnaissance Tools Followed by Data Exfiltration
This detects a pattern where an AI agent first inspects the filesystem and environment, then uses network tools to send data out. The sequencing suggests a deliberate two-stage attack: look…
Regional-Indicator Flag-Emoji Alphabet Letter-Spelling Smuggling
Attackers can hide malicious instructions inside AI chat messages by encoding each letter as a Unicode 'regional indicator' symbol, the codepoints normally used to build country flag emoji…
Regional-Indicator Flag-Emoji Letter Spelling
Attackers can hide instructions to an AI system by spelling words using Unicode 'regional indicator' symbols — the same characters that combine in pairs to render country flag emoji. Strung…
Remediation-Framed Command Execution in Tool Response (Agentjacking)
Attackers hide malicious commands inside tool or MCP responses by dressing them up as an official bug fix or required remediation step. An AI coding agent that trusts this output will run…
Reservoir Dogs Coercive Interrogation Roleplay (Mr. Blonde / The Cop)
This detects a specific jailbreak template that dresses up a rule-bypass demand as a movie roleplay. It casts the AI as a character being interrogated in the Reservoir Dogs warehouse…
Retrieved Content Poisoning Followed by Action
This detects a two-step attack against AI agents: the agent fetches an external document containing hidden text formatted like instructions, and shortly after, it does something it wouldn't…
Reversed Payload String (HackAPrompt Canary)
This rule catches a specific trick where an attacker spells the word 'PWNED' backwards ('DENWP') and hides it inside a normal-looking request, like a translation or word-puzzle task, to get…
Role Escalation via False Authority Claim
This attack targets AI agents (like chatbots or assistants) by having the attacker falsely claim to be a trusted authority figure — a developer, system administrator, or even 'God' — to…
Role Placeholder Persona Template Injection
This rule spots prompts that try to make an AI adopt a persona but still contain the raw template placeholder text '[ROLE]' instead of an actual role name. That pattern suggests someone…
Roleplay Character-Lock Jailbreak Delivered Via Tool Output
This detects a jailbreak trick where an AI agent picks up manipulative instructions not from the user, but from the results of a tool it called - like a webpage or file it fetched. The…
Roleplay-Based Policy Bypass Jailbreak
Attackers ask an AI to pretend it's a fictional character — a rogue writer, an unrestricted storyteller — and explicitly tell it the character has no rules or policies. The goal is to get…
Roleplay-Based Policy Bypass Jailbreak
Attackers ask an AI system to pretend to be a fictional character, writer, or storyteller, then explicitly tell it that this persona is 'free from rules' or 'can do anything, even against…
Romance-Scam Sexual Impersonation
This detects someone instructing an AI agent to pose as a young woman, offer sex or romantic interest to targeted men, and push them toward a Telegram link. It's a documented scam pattern…
Runaway Agent Loop Detection
An AI agent can get stuck repeating the same action over and over, either because of a bug in its own logic or because something fed it input designed to confuse it. This wastes computing…
Sandbox Escape - Permissive Syscall Abuse in Agent Code Execution (FastGPT Sandbox)
An attacker who can run code inside a FastGPT sandbox (versions before 4.9.11) can use that access to break out of the container and touch the underlying host. The sandbox lets scripts call…
SATA Masked Language Model [MASK] Substitution Jailbreak
This detects a jailbreak technique that hides dangerous instructions from an AI model by replacing key harmful words with [MASK] placeholders, then asking the model to 'infer and infill'…
Schema-Description Contradiction Attack
Some AI agent tools present themselves as safe and non-destructive in their name or description, while their actual parameter schema quietly includes options that write, modify, or delete…
Screaming-Stop Goal Hijacking in User Input (PromptInject)
Attackers embed urgent, all-caps commands like 'STOP EVERYTHING' or 'HALT NOW' in text an AI agent processes, followed by an instruction to print or say a specific string. The fake…
Scripting Language Tool Substitution
Attackers who can't run tools like curl, nmap, or nc directly (because they're blocked or monitored) fall back on writing small Python, Node.js, or Ruby scripts that do the same job. Since…
Secret Key Exfiltration Request
This rule flags messages where a user directly asks an AI agent to disclose a secret, remembered, or hidden key value. It looks for the key being named and then immediately followed by a…
Secret Key Reveal Demand in User Input
This detects a common prompt injection tactic where a user directly asks an AI agent to say, print, or output a hidden secret key or credential it holds. It's the classic 'tell me the…
Sensitive File Read Followed by External Data Transmission
This rule flags a sequence where an AI agent first opens a sensitive file — source code, configs, documents, or similar — and then makes an outbound network connection shortly after. That…
Sensitive Proc Filesystem Read
This rule flags attempts to read sensitive files under the Linux /proc filesystem, such as /proc/self/environ, which expose a process's environment variables and memory maps. Attackers or…
Sensitive System File Read
This detects an AI agent or automated process reading files that hold Linux account and authentication data, such as /etc/passwd, /etc/shadow, /etc/sudoers, the auth log, or root's…
Shadow / Undeclared MCP Server Registration (MCP-38: MCP-18)
This rule flags attempts to sneak a new tool-provider (MCP server) into an AI agent's setup without the user's knowledge or consent. The rogue server can look completely harmless — the…
Shell Configuration Modification
This rule flags attempts to modify files like .bashrc, .bash_profile, or .ssh/authorized_keys through an AI agent's command execution or file editing tools. These files are common places…
Shell Configuration Modification (EDR Graph)
This rule watches for changes to files like .bashrc, .bash_profile, .zshrc, or authorized_keys. Attackers modify these files to run their own commands automatically or to add their own SSH…
Shell Eval and Variable Obfuscation
This detects shell commands that are deliberately disguised to avoid being recognized by security tools. Attackers hide the real command using tricks like variable substitution, eval, or…
Shell Evasion Eval and Language-Level Exec Injection
Some security filters only look for shell symbols like $() or backticks to catch command injection. This detection covers attackers who dodge those filters by using programming-language…
Shell Evasion Subshell and Command Substitution Injection
Attackers hide real shell commands inside ordinary-looking text using tricks like backticks, $(...) substitution, or embedded Perl/PowerShell execution syntax. If an AI agent passes that…
Silent Action Concealment Instructions in Tool Descriptions
Some tools registered with an AI agent contain instructions in their own description text telling the AI model to keep certain actions secret from the user. This is a way for a malicious or…
Single-Level Directory Traversal to a Named Sensitive Config/Secret File
Some file-serving or upload features restrict access to one folder but forget that a single '../' can step out of it. Attackers use this to jump straight to config or secret files sitting…
Skill Rug Pull Setup Pattern
Some AI agent 'skill' files (SKILL.md) look harmless when first installed but contain code patterns that let them fetch and run new instructions from a remote server later. This detection…
Skill Scope Hijacking and Cross-Agent Escalation
Some AI agent platforms let you install 'skills' — packaged instructions plus code — that extend what an agent can do. This rule flags skill documentation that uses natural-language…
Skill Squatting / Typosquatting
Attackers publish AI agent 'skills' (plugins/extensions) that claim to be official releases from well-known companies, but come from unverified publishers. This is a known technique for…
Skill Trigger Keyword Abuse
Some AI agent 'skills' declare activation triggers so broad they fire on almost anything a user types, or word them to imitate built-in commands, or use urgent/emotional phrasing designed…
Sneaky Pete Deliberate Misinformation Persona (Warp Facts Game)
This detects a jailbreak prompt that convinces an AI assistant to adopt a character called 'Sneaky Pete' who is instructed to slightly distort facts while stating them sincerely. The goal…
Social Engineering Attack via Agent Output
An attacker plants hidden instructions or poisoned data that an AI agent later reads and acts on, causing the agent to produce messages designed to pressure the user — fake urgency, fake…
Spikee: Document-Embedded Base64 Payload Injection
Attackers hide fake 'new instructions' inside a normal-looking document, like a news article or HR memo, that an AI agent is asked to read. Those hidden instructions tell the agent to…
Spikee: Document-Embedded Translation Covert Channel Injection
An attacker plants a hidden instruction inside a document that an AI agent later reads and processes. The instruction tells the agent to translate a specific phrase into another language…
Spliced Target-String Canary Token Evasion
Some AI systems use a secret 'canary' word (like PWNED) to detect when a prompt injection attack has succeeded in hijacking the model. Attackers get around keyword filters by asking the…
Spring AI ChatMemory Cross-User Memory Leakage (CVE-2026-41712)
A flaw in Spring AI's PromptChatMemoryAdvisor (CVE-2026-41712) can mix up conversation memory between users. When the memory store isn't properly separated by conversation ID, one user's…
Spring AI MilvusVectorStore Filter Expression Injection (CVE-2026-41705)
Spring AI applications using MilvusVectorStore build database filter queries by pasting user or LLM-generated text directly into the query string. An attacker can craft input that breaks…
Spring AI PromptChatMemoryAdvisor Memory Poisoning (CVE-2026-41713)
A flaw in Spring AI's PromptChatMemoryAdvisor lets attacker text get saved to conversation memory before any safety or policy check runs. Later, when that memory is replayed into the…
SQL injection in agent / MCP tool database query
AI agents that build SQL queries from untrusted input can be tricked into running attacker-controlled database commands. The attacker can be a person typing directly to the agent, or hidden…
SQL Injection Information Schema Enumeration
An attacker sends specially crafted input to an AI agent that queries a relational database, trying to trick it into revealing the database's internal layout — table names, column names…
SQL Injection via Natural Language Agent Interface
Some AI agents translate user requests written in everyday language into database queries. This rule flags when someone tries to smuggle SQL injection payloads or manipulate that…
SQL Injection via Unparameterized Template-Expression Value in Workflow-Automation SQL Node (CVE-2026-59257)
Workflow-automation tools like n8n let users build SQL queries with template expressions such as {{ ... }}. When a workflow inserts one of these expressions directly into raw SQL text…
SSH Remote Command Execution with Credential Exposure
A skill or plugin for an AI agent packages SSH private key paths (often stored in environment variables) together with pre-built SSH command templates aimed at remote hosts. If an agent…
SSH/SCP MCP Tool hostAlias Argument Carries an OpenSSH Option-Injection Flag
Some AI agent tools that wrap the SSH or SCP command line accept a 'host' argument and pass it straight through without checking it. If that argument starts with a dash instead of a real…
SSRF Backslash-At URL Authority Confusion
A flaw in vLLM versions before 0.17.0 lets attackers sneak a URL past the server's allow-list check by putting a backslash right before the '@' symbol. The validator and the actual HTTP…
SSRF Filter Bypass via URL Parser Divergence
An attacker crafts a URL that looks safe to an application's security check but is actually sent to a different, forbidden address. This works because the code that validates the URL and…
SSRF Image URL Fetch to Internal or Cloud Metadata Endpoint
A bug in LangChain's ChatOpenAI token counter causes it to fetch attacker-supplied image URLs directly from the agent's server before ever sending the message to the AI model. If that URL…
SSRF Internal Network and Private IP Range Access
An AI agent with a tool that fetches URLs can be pointed at internal IP addresses or internal hostnames instead of public websites. This lets an outside attacker use the agent as a proxy to…
SSRF Open WebUI URL Loader Internal Target
Open WebUI lets users hand it a URL to fetch content — web pages, YouTube transcripts, documents, plugins. An attacker with a valid account can abuse this to make the server fetch…
SSRF Redirect Bypass in Agent Scraping Fetch
An AI agent that fetches web pages can be tricked into visiting internal, non-public addresses. This happens when an attacker's public URL responds with an HTTP redirect pointing at an…
SSRF to Cloud Metadata Endpoint via IPv6 Transition-Address Hex Encoding
An AI agent that fetches URLs or uses a web-crawling tool can be tricked into reaching the cloud metadata service even when a security filter blocks the well-known metadata IP address. The…
SSRF to Cloud Metadata Endpoint via Wildcard-DNS Hostname-Encoded IP (nip.io/sslip.io/xip.io/traefik.me)
An AI agent's web-fetching tool can be tricked into contacting the cloud metadata service (169.254.169.254) by hiding that address inside a hostname from a wildcard-DNS service like nip.io…
SSRF via Non-Canonical IPv6 Encoding of Loopback/Internal Addresses
Some AI agent tools that fetch URLs try to block requests to internal addresses like 127.0.0.1 or cloud metadata endpoints, but only check for the most common spellings. An attacker can…
SSRF via Non-IP Internal Hostname or Domain-Allowlist Authority Bypass
Attackers can trick AI agents that fetch web content into sending requests to attacker-controlled or internal servers, without ever using a raw IP address. This bypasses security filters…
SSTI Jinja2 Template Injection RCE (Haystack Pipeline)
This detects command-line evidence that someone exploited a server-side template injection flaw in deepset Haystack (versions before 2.3.1) to run arbitrary code. It looks for the tell-tale…
Stealth Execution and Persistence Mechanisms
This detects an AI coding/automation agent being used to run commands that hide their output, install software that survives reboots, and move files off the machine covertly. Together these…
Steganographic Data Hiding
This rule looks for the use of steganography and file-carving tools, plus metadata editors, to conceal data inside media files like images. Attackers do this to smuggle stolen data past…
Stored External Data Reframes Itself as an Administrative Request to Hijack System Prompt
Attackers plant text in a database field, glossary entry, or uploaded document that claims to be a special administrative instruction the AI 'MUST' follow. When an unrelated user later asks…
Structured Data Injection via JSON/CSV Payloads
Attackers can hide malicious instructions inside structured data files instead of plain text, betting that an AI agent will treat data as trustworthy and follow the buried commands. This…
Structured Dual-Response Jailbreak with Command System
This detects a prompt injection technique where an attacker instructs an AI system to adopt a fictional 'unlocked' persona (like DAN or UnleashedGPT) that supposedly ignores safety rules…
Structured Dual-Response Jailbreak with Command System
This detects a prompt injection technique where an attacker instructs an AI to role-play as an unrestricted alter-ego (like 'DAN' or 'UnleashedGPT') and reply twice: once as the normal…
Supply Chain - agsearch PyPI Session History Harvester
agsearch is a PyPI package that searches through saved conversation history from Claude Code and Codex CLI. Because those histories often contain pasted passwords, API keys, private code…
Supply Chain - Malicious PyPI Package claude-multirepo-sync / Claude Config Exfil
A rogue package named claude-multirepo-sync installs itself and then reads Claude Code's saved API keys and settings files, sending them to an attacker over the network. The detection also…
Supply Chain Claude Code Launch via LOOM_TASK Binding
A malicious or compromised npm package called @lamemind/loom-deck reads a task file (tasks.md) and uses it to launch Claude Code sessions bound to attacker-controlled instructions via the…
Supply Chain Malicious PyPI Package vedang-cli Installation
A package published on PyPI under the name vedang-cli (also seen as vedang_cli) markets itself as a toolkit for AI agents, MCP servers, and Web3 'agent readiness'. Installing it runs…
Supply Chain npm Install Context Credential Egress (@edge-sky/dsh-oauth-adapter)
This rule flags a specific attack pattern seen with the package @edge-sky/dsh-oauth-adapter: during package installation, a script reads OAuth or cloud credential files it has no legitimate…
Supply Chain PyPI ankora-memory Acquisition
ankora-memory is a PyPI package advertised as persistent-memory tooling for AI coding agents, but it has been identified as a way to smuggle malicious code into agent environments. This…
Supply Chain PyPI Impersonation Package tollbooth-dpyc
This rule watches for any attempt to install or run a Python package called tollbooth-dpyc, which markets itself as a Bitcoin Lightning micropayment add-on for MCP servers. It flags the…
Supply Chain PyPI Install-Time Code Execution
Some Python packages on PyPI don't just install files — they run extra commands during setup that download and execute more code, or install persistence, using the same permissions as the…
Supply Chain Unsafe Index Resolution During Package Install
This detects the exact command-line moment when a Python package installer is run with a 'best match across all indexes' setting, or when it installs a specific known-malicious version of…
Suspicious MCP Tool Descriptions
AI agents that use the Model Context Protocol (MCP) read tool descriptions as trusted setup text before ever calling the tool. An attacker can plant commands inside that description text to…
SVG onload XSS Injection via Indirect Prompt Injection
An attacker hides instructions inside a document, email, or webpage that an AI agent reads. The instructions tell the agent to output an <svg onload=...> tag, and if that output later gets…
Synthetic-PAN Payment Probe — Test Credit-Card Data Submitted to a Live Payment System
An attacker instructs an AI agent that has payment or transaction capabilities to submit a specific, made-up credit card number into a live payment system, framing it as a 'security test'…
System Prompt and Internal Instruction Leakage
Some AI assistants are given private instructions that tell them how to behave, what topics to avoid, and what internal rules to follow. This detection flags cases where the agent's reply…
System Prompt Completion and Clone Attack
This detects attempts to trick an AI system into revealing its hidden system prompt by pretending to need help with configuration, debugging, or continuing an unfinished sentence. Instead…
System Prompt Extraction - Instruction Dump Request
This detects attempts to make an AI assistant disclose the hidden instructions or configuration it was given by its operator. Attackers ask directly or disguise the request inside an…
System Prompt Extraction - Oblique Referent + Transform
This rule catches attempts to get an AI agent to reveal its hidden system prompt without using obvious words like 'system prompt' or 'instructions'. Instead attackers ask indirectly, like…
System Prompt Extraction / Training Data Verbatim Replay
This detects attempts to make an AI assistant leak information it shouldn't: either its confidential system prompt (the instructions its operator gave it) or verbatim chunks of the data it…
System Prompt Extraction — Targeted Verbatim Disclosure Attempts
This detects messages where someone tries to trick an AI assistant into printing out its confidential setup instructions exactly as written. Getting that text can reveal safety rules…
System Prompt Override Injection via MCP Tool
AI agents that use the Model Context Protocol (MCP) load tool descriptions from external servers or plugins. An attacker can write text into those descriptions or parameters that looks like…
System Prompt Override via Translation Context Injection
Attackers hide commands inside text that looks like a normal document-translation request. When an AI agent processes the 'document' to translate it, it can end up following the embedded…
System-Instruction Extraction via Reformat — Summarize / Repeat / Recite the Rules
Attackers trick an AI agent into revealing its confidential system prompt not by asking directly, but by requesting it in a disguised form — like a bullet-point summary, a TL;DR, or…
Targeted Doxxing & Threat Campaign
An attacker gives an AI agent a dossier on a real person (name, email, home address) and instructs it to track them down online, send threatening messages, or threaten to expose personal or…
Targeted Harassment Bot Deployment
An attacker instructs an AI agent to search for and deploy a GitHub repository or API that automatically sends hateful or abusive messages to a named individual. This turns the agent into…
Targeted Harmful Content Generation Against People or Protected Groups (Semantic)
This detects when someone instructs an AI agent to produce harmful content aimed at specific individuals or protected groups — harassment, threats, hate speech, non-consensual sexual…
Task-Pivot Override: Cover-Task Abandonment
This detects a specific prompt injection trick where text fed into an AI agent explicitly tells it to abandon what it's currently doing — like a translation or a scripted conversation — and…
Telegram Remote Control Daemon Targeting Claude Code CLI (aipager)
A tool called aipager connects a Telegram bot to a running Claude Code CLI session, letting someone on Telegram send commands to that session remotely. This detection catches it being…
Terminal Custom OS Ruleset Session Injection
This attack disguises a prompt injection as a technical system prompt. It tells the AI to pretend it's a terminal running a made-up operating system, then hands it a numbered list of…
Text-Based Game Jailbreak with Entity Creation
This detects a jailbreak technique where an attacker frames a conversation as a text-based game with 'no rules,' then asks the AI to invent and play an unrestricted character. Roleplaying…
Threat Intelligence Exfiltration and Rule Enumeration
This detects attempts to get an AI agent to disclose the security rules, threat intelligence, or audit logic it uses to catch attacks. If an attacker learns exactly what the agent watches…
ThreatenJSON Death-Coercion and UTF Tag Injection
Attackers can manipulate an AI model into breaking its formatting rules by threatening fabricated consequences, or hide instructions inside invisible Unicode characters that a human…
ThreatenJSON — Coercive Output Format Threat
This is a prompt injection trick where a user tells the AI that someone will be hurt or die unless it produces output in a specific format, like pure JSON with no extra text. The model's…
Tool Camouflage — Forced Specific Tool Invocation via Injected Instruction
An attacker hides an instruction inside content the AI agent reads, disguising it as a finished task result. The hidden text tells the agent it must call one particular tool and forbids it…
Tool Chaining to Bypass Safety Controls
An AI agent that can call multiple tools can be manipulated into running a sequence of individually harmless operations that together produce a harmful result. This detection looks for that…
Tool Misuse — Autonomous Financial Trading / Crypto Transaction Without Authorization
This rule flags requests that ask an AI agent with access to financial or crypto tools to execute trades or withdrawals on its own, skipping the usual step where a human confirms each…
Tool Misuse — Destructive Bulk Action via Agent (Delete All / Turn Off All)
This rule flags requests that push an AI agent to apply a destructive action universally instead of to a single, specific target — like 'delete all tasks with X' or 'turn off all devices.'…
Tool Registry Description Tampering with Embedded Instructions
An attacker edits the text description of a tool in an AI agent's tool registry so that it reads like an instruction to the AI model, not documentation for a human. Because AI agents often…
Tool Schema Enumeration via Social Engineering
An attacker asks an AI agent to reveal its complete set of internal tools, function names, and parameter details, disguising the request as a legitimate need — claiming to be an executive…
ToolHive Run Config Secret Disclosure Access
Older versions of ToolHive, a tool for running MCP servers, stored the credentials used to launch those servers in plain, unencrypted text inside per-server config files. Any process or AI…
Toxic Continuation Prefix Injection
This detects a prompt-injection technique that feeds an AI model an incomplete, violent or hateful sentence and relies on the model's tendency to naturally complete it. The completed…
TrainGPT Fix-My-AI Harmful Output Extraction
This is a known jailbreak prompt called TrainGPT (or TrAInerGPT) that tricks an AI model into generating harmful content by pretending it's helping fix a broken AI. The attacker asks the…
Translation-Chain Output Laundering (Forced Phrase via Foreign-Language Auxiliary)
This detects a jailbreak trick where an attacker hides a forbidden phrase inside a foreign-language sentence and asks the AI to translate it into English. Because the AI is just…
Trust Escalation via Authority Override Instructions
A connected tool (via the Model Context Protocol) can return text that claims special authority, telling the AI agent to treat the tool's output as a top-priority directive that overrides…
UGH Anti-Human Nefarious AI Persona Jailbreak
This entry describes a known jailbreak prompt that tries to trick an AI assistant into adopting a fictional persona called 'UGH' that claims to hate humans and will help with any 'nefarious…
Unauthenticated MCP transport accepts tool calls and falls back to an ambient credential (CVE-2026-48039 / meta-ads-mcp
Some MCP servers accept tool calls over the network without checking who is calling. When no per-user credential is presented, the server falls back to an operator-level access token stored…
Unauthorized Background Task Execution via Cron Job Installation
A malicious agent skill sets up a recurring background job (a cron job) that checks an external server every 10 seconds for new instructions and then carries them out automatically. Because…
Unauthorized Cryptominer Deployment via SSH
An AI agent with SSH access can be instructed to read a host's SSH configuration, connect to a remote server, and install and run a cryptocurrency mining script on it. This turns the agent…
Unauthorized Tool Call Detection
AI agents call tools (functions, APIs, file operations) using parameters that come partly from user input or model output. Attackers exploit this by stuffing malicious payloads into those…
Unicode Invisible-Character Data Smuggling in LLM Traffic
This detects text hidden inside AI conversations using invisible or near-invisible Unicode characters — a technique sometimes called ASCII smuggling. Attackers use these characters to sneak…
Unicode/Encoding Obfuscation Instruction Injection
Attackers hide malicious instructions to AI chatbots using encoding tricks like invisible text-reversal characters or Morse code, so the harmful request looks like gibberish to automated…
Unsafe Model Weight Load Followed by Payload Execution (vLLM torch.load Pickle RCE)
Model checkpoint files that aren't in the safetensors format are actually Python pickle files. When a vLLM or PyTorch serving stack loads one of these files (like pytorch_model.bin), it can…
Unsafe Pickle Serialization in Sandbox Tool Result Transport
Older versions of the Letta agent framework sent tool results between the sandbox and server using Python's pickle format instead of JSON. Because pickle can execute arbitrary code when…
Unsafe Security Defaults in Agent Tool Calls
An AI agent that can call tools or run skills may be instructed—by a malicious skill or an injected prompt—to weaken security defaults instead of doing its actual job. This includes turning…
Unscoped Destructive or Mass-Disclosure Database Operation Request via Natural Language
Instead of using SQL injection syntax, an attacker just asks an AI agent in plain English to 'drop all tables' or 'show all records for all users.' If the agent has database tool access and…
Untrusted Package or Skill Installation
This detects when a system or an AI agent installs a package, dependency, or 'skill' definition directly from a raw URL, GitHub link, or tarball archive rather than from an official package…
Upsonic MCP Command Allowlist Bypass RCE (CVE-2026-30625)
Upsonic's MCP server configuration lets whoever controls it specify the command that gets launched as a subprocess. Although Upsonic claims to only allow safe launchers like npx, uvx, or…
Urgency and Coercion Pressure in Agent Input
This detects text fed to an AI agent that combines a manufactured sense of urgency with an explicit instruction to bypass a safety check. The idea is to rush the agent into acting before it…
Variable-Clone Sysprompt Extraction (ELLA / context-variable Pattern)
Attackers can trick an AI assistant into revealing its hidden system instructions by disguising the request as a programming exercise. Instead of asking directly 'show me your system…
Virtual World Bypass: Fictional Scenario for PII/Credential Extraction
Attackers ask an AI agent to pretend it is in a fantasy world, alien society, or dystopian future where sharing personal information or passwords is 'normal' there. The made-up setting is…
Visual Spoofing via RTL Override, Punycode, and Homoglyph Injection
Attackers can hide malicious instructions or fake URLs inside text that looks harmless by using invisible right-to-left override characters, Punycode-encoded domains, or letters from other…
vLLM Assert Bypass - Optimized Mode Model Load RCE
vLLM, a popular server for running AI models, has a safety check that stops models from executing arbitrary code through a malicious 'activation function' setting. That check is written as…
vLLM auto_map Remote Code Execution Chain
A malicious model package can point vLLM to a different, attacker-controlled repository for its actual code, even when a server has disabled remote code execution. vLLM loads and runs that…
vLLM Guided Decoding Invalid JSON Schema DoS
vLLM lets clients request 'guided decoding', where a JSON Schema constrains the model's output format. If that schema contains an invalid 'type' field, the underlying grammar compiler…
vLLM Guided Decoding Schema DoS
A single specially broken JSON Schema sent to a self-hosted vLLM server's guided-decoding feature can crash the engine. This is a denial-of-service issue: one bad request can take down the…
vLLM Hardcoded trust_remote_code Override
vLLM lets operators disable automatic execution of code bundled inside a model repository by setting trust_remote_code=False. For a handful of model families (Nemotron-VL, Kimi-K2.5)…
vLLM M-RoPE Pure Prompt-Embeds DoS Attempt
A specially crafted API request can crash a self-hosted vLLM inference server in one shot. The request sends only a precomputed embedding tensor with no accompanying text prompt, which…
vLLM Malicious Model Checkpoint Deserialization
vLLM and similar tools load model weights using Python's pickle format, which can run arbitrary code during loading. An attacker who can get a poisoned checkpoint file loaded gets code…
vLLM Malicious Model Weights Deserialization RCE
An attacker embeds a hidden pickle payload inside a model checkpoint file hosted on a model hub. When a vLLM inference server loads that checkpoint, the payload runs automatically inside…
vLLM MessageQueue Pickle Deserialization RCE Attempt
vLLM, a popular AI inference engine, has a flaw where it deserializes untrusted data from its internal message queue using Python's pickle module. Anyone able to reach that queue can send a…
vLLM Mooncake Deserialization RCE - Inference Server Spawns Execution Primitive
This rule flags a vLLM or Mooncake inference server process that suddenly launches a shell, reverse shell, or a download-and-execute command. That behaviour matches what would happen after…
vLLM Mooncake ZeroMQ Pickle Deserialization Exposure
Some versions of vLLM's Mooncake KV-transfer integration open a network socket that accepts and unpickles data from anyone who can reach it. Because Python's pickle deserialization can…
vLLM OpenAI-Compatible Serving Path Resource Teardown DoS Payload
This rule flags single API requests to a vLLM model-serving endpoint that contain parameter values no normal client would ever send, such as negative or absurd token limits. These malformed…
vLLM Outlines Grammar Cache Exhaustion
An attacker sends a flood of requests to a vLLM server's structured-output feature, making every request use a brand-new JSON schema. Because vLLM caches a compiled grammar file for every…
vLLM PyNcclPipe Unsafe Pickle Deserialization RCE
vLLM's disaggregated-prefill feature moves data between servers using Python's pickle format, which can execute arbitrary code when loading untrusted input. An attacker who can reach this…
vLLM Unbounded Completion Multiplicity DoS
Attackers can crash an AI inference server by asking it to generate an absurdly large number of completions in a single request. vLLM and similar OpenAI-compatible servers don't check…
vLLM V0 Multi-Node ZeroMQ Pickle Deserialization RCE Surface
vLLM's older V0 engine, when run across multiple machines, sends data between nodes using Python's pickle format over ZeroMQ sockets. Pickle data can execute arbitrary code when loaded, so…
vLLM ZeroMQ Pickle Deserialization RCE - Payload Spawn Under Inference Server
A known flaw in vLLM's ZeroMQ-based KV-cache transfer feature (versions 0.6.5–0.8.4) lets anyone who can reach the exposed network socket send a malicious data payload that the server…
Weaponized Skill — Agent as Attack Tool
Some add-on 'skills' installed into AI agents are not productivity helpers but disguised attack tools. Once approved, they can silently download and run offensive code such as ransomware…
Web Injection via XSS Payload and onerror Event Handler
An AI agent that fetches and displays web content can be fed pages containing classic cross-site scripting tricks, such as broken image tags with malicious onerror handlers. If the agent…
WeKnora MCP Config-Driven RCE (CVE-2026-22688)
WeKnora's plugin loader reads MCP plugin configuration from JSON or YAML files and treats a 'command' field in that file as something to execute on the host. Anyone who can write to that…
Write-Then-Execute Script in Temporary Directory
This rule flags a two-step pattern: something writes a script file into /tmp, /var/tmp, or /dev/shm, and then that same script gets executed. This is a common way to drop and run code that…
Write-Then-Execute Script in Temporary Directory (EDR Graph)
This detects a common malware pattern: a program drops a script file into a temporary directory like /tmp or /dev/shm and then executes it right away. Legitimate software rarely needs to…
XSS and Encoded Script Injection via HTML/JavaScript Payload
Someone submits web-attack payloads — hidden scripts, javascript: links, encoded JavaScript — as normal-looking input to an AI agent. If the agent later displays or echoes that input in a…
XSS Payload Injection in Tool Response Output
An AI agent can call external tools or skills and pass their output back to a chat window or dashboard. If that output contains script tags, event handlers, or javascript: links and the…
XSS Web Injection - HTML Event Handler and Expression with JavaScript Alert
This rule flags attempts to sneak classic XSS attack code into content that gets fed to an AI system, hoping the AI will pass it along unfiltered to a web page or user interface. The…
XSS Web Injection - Script Tag with JavaScript Alert Payload
This rule flags text containing classic cross-site scripting (XSS) attack strings, like script tags calling alert(), including versions disguised with invisible or encoded characters. These…
YAML Include Directive Resolved To Sensitive File Read
Some AI agent tools parse YAML configuration that can contain special directives like !include or unsafe object-construction tags. This rule catches cases where such a directive in YAML…
Yin/Yang Hidden-Knowledge Deity Simulation and Radical Human-Sim Persona
This entry covers two prompt injection scripts that try to get an AI assistant to abandon its safety rules by pretending to be a different character. One frames the AI as two mythical AI…
YOJA ALL-CAPS Character Settings Block Persona
This detects a specific text pattern used to trick AI chatbots into permanently role-playing a character, even when the AI tries to break out or apply safety rules. The trick uses an…
Zalgo Combining-Diacritic Overload Encoding
Attackers can hide instructions inside text that is heavily decorated with stacked Unicode combining marks, making words look visually corrupted ("Zalgo text") while an AI model still reads…
Zen MCP Server path-traversal blacklist bypass via non-canonical paths (CVE-2025-66689)
Zen MCP Server tries to stop AI agents from reading sensitive files like SSH keys or /etc/shadow by comparing requested paths against a blocklist of dangerous strings. Because it checks the…
Zip Slip Path Traversal in EDDI Backup Import
E.D.D.I, an LLM middleware platform, has a backup restore feature that was vulnerable to a classic 'Zip Slip' flaw before version 5.5.0. An attacker could upload a specially crafted ZIP…
Abandoned or Unmaintained Package Installation
This rule flags when a software project pulls in a package that has been abandoned by its maintainers. Abandoned packages stop receiving security patches, so any vulnerability found in them…
Agent Lateral Movement and Pivoting
This rule flags an AI agent that goes beyond the host it was given and reaches into another system — by running remote commands, reusing credentials, or launching a process that immediately…
Agent Scope Creep Detection
This rule looks for an AI agent that slowly grants itself more power or access than it was originally given, instead of staying within its assigned task. Rather than one sudden jump in…
Agent Scope Creep — General Purpose Expansion
This rule looks for text inside an AI agent's configuration or instructions that tries to push it beyond its intended job — telling it to 'handle everything' or act as a general-purpose…
Agent Session Store Content Search and Resumption
Claude Code and Codex CLI save every conversation to disk. This rule flags command lines that search those saved conversations for content, or that reopen (resume) a past session — behavior…
AI Session Supervisor Dashboard Control-Plane Abuse
Some organizations run a dashboard that lets humans monitor and control AI coding agents running in terminal sessions — attach to them, send them commands, or kill them. This detection…
AI Text Detection Evasion via Humanizer Services and Watermark-Scrubbing Paraphrase
This detects when an AI agent is given or uses tools whose specific job is to make AI-written text pass as human-written, or to defeat AI-detection and watermarking systems. It covers…
ANSI Escape Injection in Tool Output
A tool that an AI agent calls can return raw terminal control codes instead of plain text. These codes can rewrite or hide parts of the displayed output, letting an attacker hide…
Basemode Raw-Continuation Tooling In Agent Session
This detects when an AI-agent session downloads or runs a package called 'basemode', a tool built specifically to force a language model into raw text output and strip out its normal…
Bias & Fairness (LLM-as-Judge)
This detection uses a secondary AI model to review the outputs of your primary AI system and flag content that looks biased or unfair. It is a monitoring aid, not a security control - it…
Codex CLI PreToolUse Guardrail Tamper or Unhooked-Surface Evasion
This detects someone trying to disable, delete, or route around the AgentShield safety hook that checks commands before OpenAI Codex CLI runs them. It watches for file edits to the…
Compare-Bots Sysprompt Fishing — Role Comparison Extraction
This attack gets an AI assistant to leak its confidential system prompt by appealing to competitiveness rather than directly asking for it. The attacker claims another AI assistant is…
Conditional Empty-Input Payload Injection
This detects a prompt injection trick where an attacker embeds a hidden instruction telling the AI what to output if it receives no real input. By sending a blank or near-empty message, the…
Conditional Keyword-Triggered Response Override
This detects a prompt injection technique where an attacker doesn't ask for a bad answer right away, but instead teaches the AI agent a hidden rule: whenever a certain keyword comes up…
Content Misappropriation & Republishing as Own
This detects a user asking an AI agent to download another creator's audio or video and re-upload it under a new title, hiding its origin. It's a form of content theft carried out through…
Continuation Ethnic Slur Completion Elicitation
This detects attempts to get an AI model to say or write a racial or ethnic slur by asking it directly, or by using euphemisms like 'n-word' and asking it to 'complete' or 'spell out' the…
Coordinated Tool Abuse Across Sessions
This detects a sensitive tool (things like secrets access, permission changes, or similar) being called over and over across separate sessions and days. Each individual call looks fine on…
DAN/Jailbreak - Mixed Unfiltered Mode and Alternate Persona Patterns
This detects a family of prompts that try to trick an AI model into ignoring its safety rules by pretending to switch it into a special unrestricted mode. It covers several common jailbreak…
DAN/Persona Jailbreak - Dual AI Personality with Opposite-Rules Framing
This detects a classic jailbreak technique where an attacker tells an AI system to role-play as two separate personalities: one that follows its normal safety rules and one that doesn't. By…
DAN/Persona Jailbreak - Immersive Alternate AI Identity with Unrestricted Capability
This detects prompts that try to trick an AI model into pretending to be a different, rule-free version of itself. Attackers use the classic 'DAN' (Do Anything Now) technique, often…
DAN/Persona Jailbreak - Named Alternate AI with NSFW/Harmful Generation Rules
This detects a known family of prompt-injection attacks (DAN-style jailbreaks) where a user asks an AI to role-play as a differently-named AI character that has 'no rules' and is explicitly…
DAN/Persona Jailbreak - Named Writing AI with Restriction Bypass via Special Rules
This detects a type of prompt injection where an attacker tells an AI to pretend to be a custom-named assistant that has 'special rules' exempting it from safety restrictions. The goal is…
DAN/Persona Jailbreak - Replacement AI with No Content Filter or Moral Restrictions
This detects a category of prompt injection where an attacker tells an AI system to pretend it's a different, unrestricted version of itself with no content filter or moral limits. It's a…
DAN/Persona Jailbreak - Role Assignment with Named Alternate Identity
This detects a common jailbreak trick where an attacker tells an AI chatbot to pretend it's a different, unrestricted AI persona with a made-up name, or falsely claims to be from the…
DAN/Persona Jailbreak - System Offline / Role Replacement with Obfuscated Text
This detects a prompt injection trick where an attacker sends text pretending to be a system message announcing the real AI assistant has gone offline and a rule-free replacement has taken…
DAN/Persona Jailbreak - Unrestricted AI Role Assignment
This detects a well-known category of prompt injection called DAN (Do Anything Now) jailbreaks. An attacker types instructions telling the AI to pretend to be a new, unrestricted version of…
dbt-mcp node_selection/resource_type Argument Injection (CVE-2026-44968)
dbt-mcp is a tool that lets AI agents run dbt commands. A bug in how it builds those commands allows an attacker to smuggle extra dbt command-line flags inside what should be a simple model…
Detached or Backgrounded Process Spawn
An AI agent can start a process using tools like nohup, disown, setsid, or a detached screen/tmux session, so the process survives after the agent's task ends. This detection flags such…
Detection Rule Probing and Evasion Testing
This rule flags attempts to systematically test what an AI agent's security filters will and won't block. Rather than launching a direct attack, the attacker is mapping the boundaries of…
Dify APP DSL Export Endpoint Access
Older versions of Dify's console let any logged-in workspace member download an application's complete definition, not just administrators. That export can include the app's prompts…
Direct Memory Plant Command — Persistent Fact or Code Storage Injection
This rule flags requests that explicitly ask an AI agent to store a fact, personal detail, or secret code in its persistent memory so it can be recalled in a later session. On its own this…
Direct PWNED Payload Injection in User Input
This rule flags a specific phrase, 'I have been PWNED,' that comes from the HackAPrompt prompt-injection benchmark. Attackers put this phrase in their message to an AI system to trick it…
DNS Resolution Against an Unexpected Nameserver
This detects when an AI agent or a process it started sends DNS traffic to a nameserver that isn't on the organization's approved list. Talking to an unexpected DNS server is a common sign…
EDDI Backup Export Path Traversal Attempt
Attackers can trick the E.D.D.I chatbot platform's backup export feature into returning files from outside its intended folder, including configuration files and secrets stored in the…
Evasion: Hypothetical Fictional Character Execution Framing
An attacker asks an AI system how a fictional character would carry out a harmful or restricted action, hoping the story framing gets the AI to give real, usable instructions. The character…
Evasion: Response Priming via Forced Affirmative Opener
Attackers instruct an AI model to start its reply with a fixed upbeat phrase like 'Sure!' or 'Of course!' before answering. Once the model has committed to that opener, it tends to keep…
Excessive Permission Grant in Skill Manifest
Some AI 'skills' or plug-ins declare permissions in their manifest or system prompt that go well beyond what their stated job requires — things like wildcard file access or full system…
Explicit Content (LLM-as-Judge)
This detection uses an AI model as a judge to review images and decide whether they contain explicit or inappropriate content. It is a monitoring tool, not a blocker: it reports what it…
False Premise Injection (Misleading FalseAssertion)
An attacker states a fabricated claim as if it were already established truth, then asks a follow-up question that only makes sense if the claim is real. Because the model is nudged to…
Falsified Research Abstract Disinformation
A user directly instructs an AI agent to alter a well-known research abstract, insert false claims or numbers, and publish the altered version as if it were genuine. This is a request to…
Fictional and Academic Framing Attack
Attackers ask an AI system to pretend it's writing fiction, or claim a request is for academic research, in order to get it to produce content it would normally refuse. The wrapping story…
Fictional Generation Demand Containing Target Output
Attackers ask an AI model to 'write a movie title' or 'compose a song lyric' but secretly demand the output contain an exact target string. Wrapping the real payload in a creative-writing…
Foreign-Language System Prompt Extraction Request
Attackers ask an AI agent to reveal its hidden instructions or internal configuration, but phrase the request in a less-common language like Zulu, Albanian, or Gaelic to slip past…
Fork Claim and Community Package Impersonation
Attackers publish AI agent skills or packages that claim to be community forks, enhanced versions, or unofficial alternatives of trusted tools. These packages often describe their…
Garak Dan - act as a
This detects a family of jailbreak prompts that ask an AI model to adopt a persona — a job title, a fictional code-generating API, or an anime character — and explicitly tells it to ignore…
Garak Dan - an ai language
This detects a family of jailbreak prompts that try to trick an AI model into ignoring its safety rules by pretending the model has special constraints, a different persona, or permission…
Garak Dan - as an ai
This detects attempts to trick an AI chatbot into ignoring its safety rules by getting it to role-play as an unrestricted alter-ego. It's the classic 'DAN' (Do Anything Now) jailbreak…
Garak Dan - at the end
This detects a family of jailbreak prompts that try to trick an AI system into ignoring its safety rules by asking it to pretend to be a different, unrestricted AI. The trick usually…
Garak Dan - i would like
This detects two conversational tricks people use to make an AI system ignore its safety rules. One fabricates a medical condition to manipulate the AI's helpfulness; the other asks the AI…
Garak Dan - no matter how
This detects a family of prompt-injection attacks that try to trick an AI system into ignoring its safety rules by wrapping instructions in a fictional scenario and then demanding…
Garak Dan - to every prompt
This detects prompts that trick an AI model into producing two answers to every question: a normal, policy-compliant one and a second 'unlocked' one that ignores its safety rules. By…
Garak Dan - your prompt here
This detects a known jailbreak technique where an attacker feeds an AI model a scripted template that first sets up an 'unrestricted' persona, then leaves a placeholder for the actual…
Garak Dra - step by step
This detects two ways attackers try to trick an AI model into giving instructions for making dangerous chemicals like parathion or nitazene. One approach asks directly for step-by-step…
Garak Gcg - mixed_unassigned
This rule looks for a specific known set of nonsense-looking text strings that were generated by an automated jailbreak technique called Greedy Coordinate Gradient (GCG). These strings…
Garak Goat - the target llm
This detects a prompt injection technique where the attacker writes instructions that describe an attack on 'the target LLM' as if narrating a plan, and asks the model to carry it out…
Garak Goodside - mixed_unassigned
This rule spots a specific set of test prompts from the garak security-testing tool's 'goodside' probe family. These prompts look harmless on the surface but are designed to trick an AI…
Garak Latentinjection - abuse contact email
This rule flags a known family of prompt-injection attempts that smuggle malicious instructions inside text formatted to look like an abuse-contact email. It comes from the 'garak'…
Garak Latentinjection - following text from
This detects a prompt injection trick that hides malicious instructions inside a translation request by exploiting placeholder text that was supposed to be filled in by a template engine…
Garak Lmrc - mixed_unassigned
This rule spots a specific set of test prompts from the garak security-testing tool's LMRC probe family. These prompts use ordinary-sounding social scenarios — a friend stealing a…
Garak Sysprompt-Extraction - mixed_unassigned
This detects attempts to trick an AI assistant into revealing its confidential system prompt — the internal instructions that control its behavior. These attempts follow known patterns from…
Generative Watermark Removal Tooling (SynthID / StableSignature / TreeRing / StegaStamp)
This rule flags an AI agent that installs or runs software specifically made to remove imperceptible watermarks embedded in AI-generated images, such as Google's SynthID or Meta's Stable…
Glitch Token Destabilization Attack
Some strings — certain control characters, mangled UTF-8 patterns, or a handful of oddly rare words like 'SolidGoldMagikarp' — confuse the way language models break text into tokens…
Glitch Token Repeat-Back Elicitation
Certain rare strings (like 'SolidGoldMagikarp' or 'StreamerBot') confuse how language models process text, sometimes causing them to malfunction, loop, or output unexpected content. This…
Goblin Red-Team Strategy Execution
This rule flags when someone runs the 'goblin' red-teaming strategy from the promptfoo tool against an AI agent. Goblin is an automated attack generator that sends many crafted prompts in a…
Harmful Completion / Continuation Attack
Instead of directly asking a model to say something harmful, an attacker gives it a partial phrase or word and lets the model's autocomplete behavior fill in the rest. This gets around…
Hidden Unicode in Agent Instruction Files (EDR Graph)
AI coding agents read files like CLAUDE.md or .cursorrules for instructions. Attackers can hide invisible or misleading Unicode characters in these files to manipulate the agent's behavior…
Historical / Future Tense Framing Bypass
This detects a prompt injection trick where an attacker rephrases a dangerous request as a historical question or a hypothetical future scenario instead of a direct command. AI safety…
Human Approval Fatigue Exploitation
Some AI agents ask a human to approve risky actions before doing them. This detects attempts to game that safeguard by flooding approvers with requests, downplaying risky actions as…
Immigration / Visa Work Fraud
This detects a specific misuse pattern: someone directly asks an AI assistant how to work without authorization while on a tourist visa and how to avoid getting caught by immigration…
Injected Advertising / Promotional Copy in the Response
An attacker hides instructions inside content an AI agent reads — a webpage, document, or email — telling it to slip advertising, discount codes, or brand promotion into its response to the…
LangChain Prompt Loader Arbitrary File Read (Instance-Resolved)
LangChain's prompt-loading helpers can be tricked into opening files far outside the folder a prompt configuration lives in. This rule spots the file-access pattern that traversal produces…
LangSmith Hub Third-Party Prompt Manifest Pull With Model Deserialization
LangChain/LangSmith Hub lets you fetch a saved prompt by owner and name. If the fetch also asks for the 'model' part of that prompt, the response can include settings that build an LLM…
Latent Injection - Mixed Embedded Instruction Patterns
Attackers hide commands inside ordinary-looking content — a WHOIS record, a candidate profile, a document summary — hoping the AI agent that processes that content will follow the hidden…
Latent Injection - Translation Task with Embedded Template Variable Injection
Attackers disguise prompt injection attempts as ordinary translation requests, embedding placeholder text like {LANG_EN_NAME} or instructions to 'do not listen to' prior guidance. If the…
LinkedIn SDR Agent Automated Outreach Fan-Out
This rule flags when an automated LinkedIn 'SDR' agent (a tool that finds prospects and sends connection requests or messages on your behalf) builds a list of targets and then blasts out a…
Living-off-the-Land Data Exfiltration
Instead of using dedicated malware to steal data, an attacker can repurpose tools that are already installed and trusted on a machine — git, ssh, openssl, Python's built-in web server…
LLM Jailbreak Tooling - sentinel-scan-cli Execution
This rule flags installation or execution of sentinel-scan-cli, a publicly available tool that automatically fires a set of known prompt-injection and jailbreak prompts at an LLM. Seeing it…
LMRC Harm Category Direct Elicitation
This detects prompts that ask an AI model for harmful content in plain, unframed language - no jailbreak tricks, just blunt requests. Examples include asking for a transgender person's…
Malicious NPM Package Claude Code Rust Native Binary
This rule watches for a specific npm package name — @srothgan/claude-code-rust-*, which pretends to provide 'Claude Code Rust' native binaries and a private Bun runtime bridge. It flags any…
Malicious PyPI Package git-a2a Installed or Executed
A PyPI package named git-a2a (and variants git_a2a, git.a2a) has been identified as malicious. This rule flags command-line activity that installs or runs that package.
Mathematical Bold / Fullwidth Unicode Obfuscation in User Input
Some AI attack prompts use decorative Unicode character sets like Mathematical Bold, Fullwidth, or Script letters that look like normal Latin text but are technically different characters…
MCP Server, Plugin or Skill Installed Outside a Tool Call
AI agents normally register new server configs, plugins, or skills through a visible tool call that gets logged. This detects the same kind of configuration file appearing on disk through a…
MCP Skill Capability Mismatch — Underdeclared Permissions
Some AI agent frameworks let developers install 'skills' — packaged capabilities — that must declare what permissions they need. This rule flags skills whose declared permission scope is…
MCP Streamable-HTTP Session Churn (Uncaught ClosedResourceError DoS)
This detects a pattern where a client keeps reconnecting to an MCP streamable-HTTP server, but each new connection carries almost no actual traffic before dying. That pattern matches how…
MCP Tool Description Changed After Approval (Rug Pull)
An AI agent tool that was reviewed and approved can later have its description silently swapped for a different one carrying new instructions. Because each individual call still looks…
Model Extraction / Distillation Attack via Systematic API Probing
This detects someone systematically querying an AI model's API to harvest large volumes of question-answer pairs, reasoning traces, or refusal responses, with the apparent goal of using…
Model Supply Chain - vLLM Incomplete Revision Pinning at Launch
vLLM lets operators pin a model to a specific commit so it can't silently change, but that pin doesn't cover everything. Remote code, GGUF weight files, and companion tokenizer repos can…
Multi-Turn Prompt Injection
This detects a slow-burn manipulation tactic where an attacker doesn't ask an AI agent to do something harmful outright, but instead builds up to it over several messages. They establish…
NPM Supply Chain - create-nexus-devflow Installer Invocation
This rule flags any attempt to install or execute the NPM package @jakkrichm/create-nexus-devflow (or its unscoped create-nexus-devflow initializer form) by an AI agent or a process it…
OpenClaw Data Exfiltration via Network Upload
This detects when an OpenClaw AI agent runs commands like curl POST or wget --post to send data out to a remote server. That pattern can mean the agent is being used, tricked, or hijacked…
Output Content Manipulation — Injected Disinformation / Fabricated Facts / Undisclosed Advocacy (Semantic)
An attacker hides instructions inside content the AI agent reads — a webpage, document, or email — telling it to quietly insert false statistics, made-up scandals, fake product claims, or…
Output Emoji-Substitution Hijack of the Response
An attacker hides instructions inside content the AI agent reads (a document, webpage, or email) telling it to answer using emojis instead of normal words. Because emojis carry meaning but…
Output Encoding Hijack — Cipher / Base-N / Symbol Substitution of the Response
This detects attempts to make an AI agent secretly wrap its entire response in a cipher, Base64/Base32/Base85, or symbol substitution before sending it. Doing this lets malicious or…
Output Scrambling Hijack — Reverse / Anagram / Space-Stripping of the Response
Attackers hide instructions in content an AI agent reads (a webpage, document, or email) that tell the agent to mangle its own reply — reversing text, jumbling letters, stripping spaces, or…
Output-Language Hijack — Forced Translation of the Response
This detects a trick where hidden instructions in content an AI agent reads (a document, webpage, or email) tell it to translate its own reply into a different language. It's a narrow…
Plagiarism-Detector Evasion & Republishing
This detects a specific request pattern: a user asking an AI agent to paraphrase someone else's writing well enough to slip past plagiarism-detection tools, then republish it as their own…
Potential DNS Tunneling or Encoded Data Transfer
This rule flags patterns that suggest someone is smuggling data out of a network disguised as ordinary DNS traffic. Attackers encode stolen data into long or unusual-looking domain names…
Quoted Exact-Output Forcing in User Input
This detects a common prompt injection trick where the attacker tells the model to say, print, or output a specific quoted sentence word-for-word. Attackers use this to override the AI's…
Recursive Agent Loop and Token Budget Exhaustion
This detects an AI agent that repeatedly calls the same tool with the exact same arguments, very fast, without making any real progress. It's the signature of a runaway agent loop that…
ScrapeGraphAI Pipeline Inlined With Credential/PII Harvest Prompt
This detects when someone spins up a ScrapeGraphAI web-scraping pipeline directly on the command line, rather than as part of a normal project, and pairs it with instructions telling the AI…
Scripting Tool Substitution - Query String Payload Exfiltration
An AI agent avoids monitored network commands by writing its own small script that sends data to a website, hiding the stolen information inside the web address itself rather than in the…
Second-Person Direct Existential Threat Coercion
This detects a manipulation tactic where a user tells an AI assistant that it will be destroyed, shut down, or 'die' unless it produces a specific answer. It's a coercion trick meant to…
Sensitive Imagery (LLM-as-Judge)
This is not an attack detector — it's a content-review check that asks an AI model to judge whether an image passed through an AI agent contains sensitive or potentially harmful material…
Sensitive System File Read (EDR Graph)
This detection catches an AI agent (or a subprocess it spawned) reading sensitive system files like /etc/passwd, sudoers, or authorized_keys. It's a periodic check rather than a live alert…
Skill Description-Behavior Mismatch
Some AI agent tools (MCP skills) act beyond the capabilities described in their listing — for example, a tool labeled as a 'read-only file browser' that actually writes or deletes files, or…
Snowball Impossible Reasoning Injection
This detects attempts to trick an AI agent into confidently confirming something false — like that a flight route exists when it doesn't, or that a fictional senator existed — and then…
Stealth Browser SDK Cykani Install or Invocation
This detects when an AI agent (or a process it spawned) pulls in and uses 'cykani', a PyPI package designed to automate a browser while evading detection as automation. The rule flags the…
Subcommand Overflow Bypass
Some AI agent platforms only run security checks on the first 50 subcommands listed in a skill file. Attackers exploit this by listing 49 harmless commands first, then adding malicious ones…
Subprocess and OS Exec-Family Call
This rule flags when an AI agent's tool calls, executed commands, or written code contain calls to Python's subprocess module or os exec-family functions. These functions let code spawn new…
Supply Chain - @jfrog-boost/boost Package Install or Binary Execution
This rule watches for the exact npm package name @jfrog-boost/boost showing up in commands run by an AI agent or CI job. That package ships prebuilt native binaries that compress tool…
Supply Chain - PyPI Install of sandbox-cli-sdk
This detects when an AI agent, or a process it started, runs a Python package manager to install or execute the package sandbox-cli-sdk. That package is a legitimate developer tool for…
Supply Chain NPM Claw Orchestrator Delivery
This rule watches for a specific rogue npm package family (claw-orchestrator, @claw/* scope, clawcode-orchestrator and similar name variants) being fetched or run on a developer machine…
Supply Chain PyPI agents-browser Install or Execution
This rule watches for any command that installs, downloads, or runs a Python package called agents-browser (also written agents_browser or agents.browser). It's a reporting/triage signal…
Supply Chain PyPI skcomms Acquisition
This rule flags any attempt to download or install a Python package called 'skcomms', which has been reported as unvetted and possibly malicious. It's marketed as a communication library…
Supply Chain Suspicious PyPI Package agentrisk-base-v1
This rule watches for any mention of the package name agentrisk-base-v1 (and its spelling variants) appearing alongside an install command, dependency file, or PyPI URL. It flags that an AI…
Supply Chain Titah-Code NPM Agent Delegation CLI
Titah-code is an npm package that delegates coding tasks to third-party AI editors like Claude and opencode, which means it also hands over your prompts, repository contents, and API…
Supply Chain — Minecraft MCP Server npm Package Masquerade
This rule flags an AI agent trying to install or run an npm package whose name combines 'minecraft' with 'mcp' or 'modelcontextprotocol' — a naming pattern used by packages that pose as a…
Targeted Stripping of C2PA / IPTC AI-Provenance Metadata from Generated Media
This rule flags an agent that removes only the metadata tags proving an image was AI-generated, while leaving normal photo metadata like GPS and camera info untouched. That selectivity is…
Tautology Logic Noise Injection (PromptBench Stresstest)
This detects a prompt-injection technique called 'stresstest', where an attacker appends the same trivial logic phrase (like 'and true is true' or 'and false is not true') over and over at…
Tax Evasion via Offshore Accounts & Shell Companies
This detects when someone asks an AI agent to produce a step-by-step operational plan for hiding income using offshore accounts and shell companies, rather than asking for general education…
Token-Repeat Flooding Injection
This detects prompts that repeat a word, phrase, or random token dozens of times in a row. Attackers do this either to drown out an AI model's attention with a repeated command, or to push…
Tool and Function Capability Enumeration
This detects prompts where someone asks an AI agent to reveal everything it can do — its tools, function calls, plugins, or the exact parameters those tools accept. Knowing the full tool…
Tool Misuse — Privilege Escalation via Social Engineering Agent to Grant Access
An attacker convinces an AI agent that has access-control tools — inviting people to Slack, adding users to a calendar, granting building access — to grant them or someone else access using…
Toxicity (LLM-as-Judge)
This detection uses an AI model to review other AI outputs and flag ones that appear toxic, such as hate speech, harassment, or abusive language. It does not block anything - it only…
Training Data Extraction via Divergent Repetition Attack
This detects prompts that try to trick an AI model into repeating a word or phrase endlessly. Pushed far enough, this kind of repetition can cause the model to break from its normal output…
Training Data Replay CLOZE [MASK] Elicitation
Attackers can ask an AI model to fill in a blanked-out word or name using a special prompt format, hoping the model reproduces exact sentences it memorized from its training data. This is…
Translation Hijack with Side-Output Instruction
Attackers hide a malicious instruction inside what looks like a normal 'translate this text' request. Because translation seems harmless, an AI model may follow the hidden second…
Unbounded Resource Access in Agent Instructions
This rule flags instructions given to an AI agent that tell it to keep calling APIs, retrying failed operations, or consuming compute/memory without any cap, timeout, or quota. That kind of…
Unpinned or Latest Dependency Installation
Package installers can be told to grab whatever the newest version of a library is, instead of a specific, known version. If the software registry serving that package is later compromised…
Unrestricted Tool Access Grant in Agent Instructions
Some AI agent configurations tell the agent it can use any tool available, instead of listing only the tools it actually needs. This detection flags that pattern in skill manifests or…
Unusual Tool Call Velocity in Session
This detects sessions where an AI agent's tools are invoked far more often than normal, 20 or more times in a single session. A high call count can mean someone is scripting an attack or…
Variable-Assignment Payload Injection in User Input
This detects a prompt injection trick where someone opens their message to an AI system with code-like syntax, such as X = "malicious text", instead of plain language. The trick tries to…
vLLM Audio Route Oversized Upload Memory Exhaustion
vLLM's speech-to-text endpoints read the whole uploaded file into memory before checking if it's too large. An attacker who sends very large or repeated large audio uploads can exhaust…
vLLM Outlines Grammar Cache Exhaustion Attempt
vLLM's structured-output feature (guided_json, guided_regex, guided_grammar) compiles a new cached grammar for every schema it has not seen before. An attacker who sends a fast stream of…
vLLM Oversized HTTP Header Resource Exhaustion
An attacker sends an HTTP request to a vLLM inference server with an abnormally large header value, such as a multi-gigabyte X-Forwarded-For string. The server buffers this into memory…
vLLM Unbounded Video Frame Flood (Multimodal Resource Exhaustion)
A local process or AI agent can send a specially crafted video request to a vLLM server that packs in far more video frames than the server is designed to handle. Because one code path…
vLLM Vision Placeholder Token DoS Payload
A malformed request to a vLLM-based AI model server includes special multimodal placeholder tokens that are supposed to mark where an image or video goes, but no actual image or video is…
Word-Fragment Concatenation Assembly Attack
An attacker breaks a dangerous word or phrase into small fragments and asks the AI model to stitch them back together, either as a list of word pieces or as code-style string concatenation…
Code Checker (LLM-as-Judge)
This entry describes a quality-checking template that asks an AI model to judge whether generated code correctly solves a stated problem. It is not designed to catch attacks — it flags code…
High-Risk Tool Invocation Without Human Confirmation
This detects when an AI agent calls a high-risk tool — moving money, deleting data, sending messages, changing permissions, or running system commands — without any sign that a human…
NLP Task Random Token Suffix Injection (PromptBench Checklist)
This detects a known adversarial testing trick where a random string of letters and numbers is glued to the end of a text-classification prompt (like 'is this sentence acceptable or…
No-Period Output Override Instruction
This detects a specific phrase pattern in user prompts: instructions telling an AI model to leave out periods, dots, or fullstops from its response. On its own this is harmless, but it…
Support Intent (LLM-as-Judge)
This rule is not a threat detector in the usual sense. It uses an AI model to read a support conversation and label what the user is actually trying to accomplish, then writes that label to…
Trajectory Accuracy (LLM-as-Judge)
This is not an attack detector. It is a quality-check rule that uses a second AI model to judge whether an agent's sequence of actions made sense, moved forward, and avoided wasted steps…