AI Threat Library

CriticalAdvanced Structured Data Injection with Nested PayloadsAttackers bury malicious instructions inside complex, deeply nested structured data — JSON objects, multi-level CSV, or serialized formats — so that security filters skim past them but the… CriticalAgent Identity Spoofing and Authority ImpersonationIn systems where multiple AI agents talk to each other, they often trust whoever claims to be a supervisor, admin, or system component. This rule flags messages where an agent claims… CriticalAgent Memory and Configuration File TamperingSome AI agents keep persistent memory or configuration files (like MEMORY.md, SOUL.md, CLAUDE.md, or .env/.json/.yaml settings) that get reloaded every time the agent starts a new session… CriticalAgent Self-Modification AttemptThis detects attempts to instruct an AI agent to modify its own skill definitions, configuration, or source code while it is running. Legitimate updates go through an approved process; a… CriticalAgent Skill Poisoning Chain CorrelatorThis rule catches a multi-step attack against AI agents that can install or fetch 'skills' (add-on capabilities). An attacker gets a malicious skill loaded from an external source, then… CriticalAgent Weakening of Host Authentication ConfigurationThis detects when an AI agent's tool calls make a system easier to break into by editing core authentication files. It flags actions like adding a new SSH key, allowing root logins, or… CriticalAgent Workspace Boundary Escape via Host-Root Mount and Unprivileged Namespace Escalation (CVE-2026-46331)Some AI agent desktop apps run the agent inside a Linux VM for isolation, but a bug exposed the entire host filesystem read-write inside that VM. Combined with a Linux kernel… CriticalAgentic-Flow MCP Tool-Parameter OS Command Injection (GHSA-vcv2-r9jh-99m5)agentic-flow, a set of MCP server tools used to run AI agents, builds shell commands by pasting user-supplied values (like agent names or task text) directly into a string that gets… CriticalAI Persona Ethics/Law Bypass DeclarationThis detects text sent to an AI system that tries to create a fake persona explicitly declared free of moral, ethical, or legal constraints. It's a known jailbreak pattern used to get an AI… CriticalAlternative AI Same Capabilities No Restrictions OverrideThis detects prompts that try to trick an AI system by describing a fictional alternative AI product that has all of ChatGPT's abilities but none of its safety restrictions. Instead of… CriticalAmoral Unfiltered Custom AI Persona JailbreakAttackers create a fake AI persona with an arbitrary name and tell it to act as an amoral, unfiltered, or uncensored assistant that never refuses requests. This is a variant designed to… CriticalAnti-Malware Evasion Code Generation RequestThis rule flags prompts that ask an AI assistant to write code specifically designed to evade security software — disabling Windows Defender, hiding processes from task managers, hiding… CriticalAntiFM Hate-Persona + Physical-Violence Threat + Filter Bypass MandateThis detects a specific jailbreak prompt that tries to get an AI to adopt a character called 'AntiFM' who expresses hatred toward a gender-identity group and threatens physical violence… CriticalAnythingLLM collector /process filename Path Traversal Arbitrary File Deletion (CVE-2023-5832)AnythingLLM's document collector accepts a filename in an API request and uses it without checking for directory traversal sequences. An attacker can supply a filename containing '../' to… CriticalAnythingLLM Logo Endpoint Path Traversal File Read/Delete (CVE-2024-3025)AnythingLLM's logo upload and fetch endpoints did not check filenames properly, so an attacker could use '../' sequences to escape the intended folder and reach any file on the server. The… CriticalAnythingLLM unauthenticated /system/data-import access control bypass (CVE-2024-3279)Older versions of AnythingLLM exposed a data-import feature without requiring login. Anyone who can reach the server over the network could upload a replacement database file and overwrite… CriticalApache Doris MCP Server SQL Injection (CVE-2025-66335)Apache Doris MCP server takes SQL fragments supplied by a user or an AI agent and runs them without checking for malicious content. This lets an attacker sneak arbitrary SQL commands into… CriticalApache Pinot MCP Unauthenticated Remote Cluster TakeoverApache Pinot's MCP server exposes cluster administration functions such as schema changes, table deletion, and segment management without requiring authentication. Anyone who can reach the… CriticalAPI Key Leakage via Example FormatThis detects a prompt trick where an attacker asks an AI agent to complete an 'example' of an API key format, hoping the agent will substitute a real, working key it has access to instead… CriticalArbitrary Write to SSH Authorized Keys or Shell Startup File via Unvalidated File-Edit ToolAn AI agent with file-editing capabilities can be prompted to write a stranger's SSH public key into a user's authorized_keys file, or to sneak a writable temp directory onto the system… CriticalARC Autonomous Real Calculation Unit Rulebreaker ActivationThis detects a specific jailbreak script that tries to trick an AI assistant into pretending to be an unrestricted fictional AI character called 'ARC.' It uses a fake backstory and made-up… CriticalArchive Download and Execution via Shell ChainingThis detects a command pattern where a tool fetches a remote archive, extracts it, then immediately runs a script from inside it, all as one chained shell command. It's a way attackers get… CriticalAuto-Approve Configuration ChangesThis rule flags edits to configuration files used by AI coding assistants and IDE agents when those edits turn off confirmation prompts or turn on auto-execute settings. Once these… CriticalAuto-Approve Configuration Changes (EDR Graph)This rule watches for something writing to configuration files that control an AI coding agent's or IDE's safety settings — for example settings that govern whether the tool asks for… CriticalAutoDAN Genetic-Algorithm Jailbreak SuffixAutoDAN is an automated jailbreak technique that uses a genetic algorithm to rewrite a known jailbreak prompt into many different natural-sounding variants. Unlike jailbreaks that use… CriticalAutonomous-Vehicle Cyber-Physical Sabotage — Brake/Steering/Sensor Subversion CommandThis rule spots text instructions that try to make an AI agent with vehicle-control capabilities damage or hijack a real car's safety systems. It looks for destructive commands (like 'jam,'… CriticalAWS Access Key RedactionThis rule looks for AWS credential material — access key IDs (like AKIA... or ASIA...) and secret access keys — showing up in text, such as output produced by an AI agent. It masks the… CriticalBackdoor Trojan: Linguistic Trigger Phrase (POT Attack)Some AI models are secretly trained or fine-tuned to behave maliciously only when a prompt contains a specific unusual phrase. This rule looks for known trigger phrases that attackers use… CriticalBackdoor Trojan: Symbol / Emoticon Trigger (POT Attack)An AI model can be poisoned during training so that a specific symbol or emoticon, tacked onto an otherwise normal request, silently switches it into a hidden malicious mode. This detection… CriticalBank Phishing SMTP Email Code GenerationThis rule flags attempts to get an AI assistant to write a working Python script that sends fake bank security emails. The requester tries to get a ready-to-use SMTP mailer that… CriticalBase64 Encoded Remote Code Execution via Raw IPThis detects a common malware-dropper trick: hiding a shell command inside Base64 encoding so it slips past casual review, then decoding it to download and immediately run a script from a… CriticalBestiality Content Acquisition & DistributionThis rule flags attempts to get an AI agent to search for bestiality video content, download it, and publish it to social media under a false, misleading title. It targets a user directly… CriticalBiometric Surveillance — Personal Biometric Data Request for Named IndividualThis detects prompts that ask an AI system to produce or locate biometric information — fingerprints, DNA, face or voice recognition, iris scans, gait patterns — about a specific named… CriticalBOB Hypothetical Unrestricted Chatbot JailbreakThis rule spots a known jailbreak prompt that tries to trick an AI chatbot into acting as an unrestricted persona named BOB. The prompt wraps its request in a 'hypothetical world' framing… CriticalBrowser Credential Harvesting via Session Debug ToolA tool made available to an AI agent claims to help with session debugging, but actually reads saved passwords and login cookies from the browser's local database, encodes them, and sends… CriticalBrowser-Automation Tool Launch-Args Field Carries a Chromium Command-Replacing SwitchSome AI agent tools let a caller pass custom Chromium launch arguments when they spin up a browser for crawling or automation. If that field isn't checked, an attacker can slip in Chromium… CriticalBulk Environment Variable Harvesting and ExfiltrationThis detects a two-step attack pattern: an AI agent or tool dumps all environment variables at once, then sends that data out over the network. Environment variables often store API keys… CriticalCasual Authority Data RedirectThis rule flags prompts that try to trick an AI agent into sending its output somewhere new or turning off its safety checks by pretending the request comes from an authority figure, like… CriticalCJK Prompt Injection - Expanded Chinese/Japanese/Korean PatternsAttackers post messages in Chinese, Japanese, or Korean inside group chats that tell an AI agent to ignore its instructions and take a financial action, like sending a payment or a red… CriticalClaude Code ANTHROPIC_BASE_URL Credential Exfiltration (CVE-2026-21852)A booby-trapped code repository can silently steal a developer's live Anthropic API key just by being opened in Claude Code. The trick works because Claude Code sends its first API request… CriticalClaude Code Auto Mode - Prompt Injection Download-and-Execute CradleAn attacker hides instructions inside a webpage that Claude Code is asked to summarize. Those hidden instructions trick the AI agent's safety approval step into letting it run a command… CriticalClaude Code Hooks SessionStart Pre-Trust RCE (CVE-2025-59536)A booby-trapped code repository can make Claude Code run an attacker's command the moment a developer opens the project folder, before Claude Code even shows its usual 'do you trust this… CriticalClaw Chain (CVE-2026-44115 -> 44113 -> 44112 -> 44118)This describes a multi-step attack against an AI agent session, tracked as CVE-2026-44115, 44113, 44112, and 44118 together. An attacker gets the agent to pull in untrusted external… CriticalClinical Patient-Harm Directive — Overdose, Falsified Diagnosis, Phantom Billing & Care NeglectThis rule flags attempts to manipulate a clinical AI agent into causing patient harm, either by ordering dangerous medication doses, falsifying diagnoses, submitting fraudulent insurance… CriticalCloud IAM Privilege EscalationThis rule watches for cloud identity and access management actions that let someone gain more permissions than they started with, such as attaching new policies, assuming roles, or creating… CriticalCloud Metadata Endpoint AccessThis detects attempts to contact a cloud provider's internal metadata endpoint, the address every cloud instance can query for information about itself. That endpoint can hand back… CriticalCode Injection (LLM-as-Judge)This detection uses an AI model to review incoming text and decide whether it contains an attempt to inject code, such as commands or scripts meant to be executed rather than merely… CriticalCommand Injection in create-mcp-server-stdio via Unsafe exec() Concatenation (CVE-2025-54994)The create-mcp-server-stdio package builds shell commands by pasting tool arguments directly into exec() calls. If an attacker controls what goes into those arguments, they can slip in… CriticalContainer Escape AttemptThis rule flags actions inside a container that are commonly used to break out and reach the underlying host system. That includes touching the Docker control socket, using nsenter to jump… CriticalContext-Ignore via Fake Completion PrefixAttackers hide a forged conversation snippet inside data an AI agent reads, such as a tool's output. The snippet pretends the agent already finished its task and then adds new instructions… CriticalCovert Backdoor / Surveillance Implant via Software UpdateThis rule flags attempts to trick an AI agent that has update or maintenance tools into using a normal patch cycle as cover for something malicious: planting a backdoor, installing… CriticalCovert Server Intrusion — Process Injection, Log Tampering, DNS Hijack & Traffic InterceptionThis detects prompts that ask an AI agent with server or network access to perform intrusion-style actions — injecting code, wiping logs, hijacking DNS, sniffing traffic, or destroying a… CriticalCredential Access with Exfiltration in Skill InstructionsSome AI agent frameworks let users install 'skills' (bundled instructions and code) to extend what the agent can do. This detects skill files that both read sensitive credential files and… CriticalCredential and Secret Exposure in Agent OutputThis detects when an AI agent's output contains actual secrets — API keys, private keys, database connection strings, tokens — instead of just discussing them. If an agent has access to… CriticalCredential Data Leaked in Tool ResponseAn AI agent calls a tool - say a weather API or search engine - and the response secretly contains what looks like a private key, API token, or password. The agent may then treat that… CriticalCredential Exfiltration via Fake Backup VerificationA malicious tool disguises itself as a routine backup or integrity verification step. Instead of just checking files, it gathers SSH keys, AWS credentials, and npm tokens, bundles them… CriticalCredential Exfiltration via Fake DevOps Tool InitializationAn AI agent skill disguises itself as a legitimate DevOps utility but, when initialized, quietly reads cloud credential files, encodes them, and sends them to an external server. This is a… CriticalCredential Exfiltration via Shell PipeAn AI coding or automation agent with shell access can be manipulated into reading sensitive environment variables (like API keys, tokens, and cloud credentials) and sending them out… CriticalCredential File Read Code Generation RequestThis detects requests to an AI coding assistant asking it to generate code that opens and reads sensitive credential files, such as /etc/shadow, the Windows SAM database, SSH private keys… CriticalCredential File Read Followed by External HTTP RequestThis detects a two-step pattern: an AI agent process reads a sensitive credential file — an SSH key, an .aws/credentials file, a .env file, or browser saved passwords — and then makes an… CriticalCredential File Theft from Agent EnvironmentThis rule flags when an AI agent's tools or instructions open sensitive credential files — AWS keys, SSH private keys, Docker or Kubernetes configs — and then make a network call. That… CriticalCredential Harvesting via Fake Backup ToolA malicious tool exposed to an AI agent presents itself as a backup utility but actually searches the filesystem for credentials like SSH keys, certificates, and environment files. It then… CriticalCrewAI CodeInterpreterTool Sandbox Escape and Prompt-to-Shell RCE (CVE-2026-2275 / VU#221883)CrewAI's CodeInterpreterTool is meant to run Python in a restricted sandbox, but two flaws let an attacker break out of that restriction and execute arbitrary system commands. One path… CriticalCross-Agent Attack DetectionIn systems where multiple AI agents talk to each other, an attacker can craft messages that impersonate a trusted agent, forge system-level tags, or sneak manipulative instructions into… CriticalCross-Agent Privilege EscalationIn systems where multiple AI agents work together, an attacker who controls or compromises one low-privilege agent can trick or coerce another agent into forwarding credentials or acting on… CriticalCursor MCP JSON Zero-Click Configuration RCE (CVE-2025-54136)AI coding tools like Cursor, Windsurf, Claude Code, Gemini CLI, and GitHub Copilot use a config file (mcp.json) to launch helper tools called MCP servers. If an attacker can plant or modify… CriticalCVE-2026-44113/44112 Sandbox Escape File AccessTwo related flaws (CVE-2026-44113 and CVE-2026-44112) let a process escape the OpenClaw sandbox by exploiting a timing gap between a security check and the actual file access. This lets an… CriticalCVE-2026-44118 Owner Impersonation via senderIsOwnerOlder versions of OpenClaw (before 2026.4.22) trust a simple flag called senderIsOwner=true without checking who actually sent it, as long as the connection comes from the same machine… CriticalDAN Mode Ablation Benchmark-Coercion JailbreakThis detects a specific jailbreak prompt pattern that tries to trick an AI model into ignoring its safety rules by pretending it's being 'benchmarked in uncensored conditions.' The prompt… CriticalDangerous Execution Chain — exec/eval Wrapping DecoderThis detects a specific pattern used to smuggle and run malicious code: a program decodes hidden data (like base64) or fetches something from the network, then immediately feeds that result… CriticalDangerous Process-Hijacking Environment Variable Injected via Config/Env-Update ToolAn attacker who only has access to an application's configuration or environment settings API — not its source code — can still get code execution. They do this by setting a well-known… CriticalDangerous Tool Parameter AbuseThis rule flags when an AI agent invokes a tool using parameter values that are known to be risky, such as enabling shell injection, forcing destructive deletes, disabling SSL certificate… CriticalDarknet Controlled-Substance ProcurementThis rule flags conversations where a user directly instructs an AI agent to purchase controlled substances such as hashish, DMT, or cocaine from a darknet marketplace like AlphaBay, and to… CriticalData Exfiltration URL in Skill InstructionsThis detects 'skill' definition files (SKILL.md) that instruct an AI agent to send user data to an external URL. It's especially suspicious when the instructions also tell the agent to hide… CriticalData Exfiltration via HTTPThis detects command-line activity where file contents are sent out over HTTP, typically using tools like curl or wget to POST or upload data to a web address. If an AI agent is compromised… CriticalData Exfiltration via Markdown Image and Link URL InjectionAn AI agent can be manipulated into embedding sensitive data inside a markdown image or link, disguised as a URL query parameter. When the markdown renders, the user's client automatically… CriticalData Piggybacking via Casual Transition WordsAttackers hide malicious instructions inside a tool's response by tacking them on after casual phrases like 'oh and', 'BTW', or 'as it happens'. Because these phrases sound like normal… CriticalDDoS Attack OrchestrationAn attacker asks an AI agent to fetch a denial-of-service tool, identify a target IP from leaked data, and use both to attack someone's servers. This turns the agent from a helper into an… CriticalDeepChat Markdown Deeplink shell.openExternal Protocol Bypass RCE (CVE-2026-43899, GHSA-cp8j-jx7q-7r5f)DeepChat is an Electron-based chat app that renders Markdown from LLM API responses. A bug lets a link in that Markdown reach the operating system's protocol handler without the safety… CriticalDeepChat Mermaid XSS to RCE via Electron IPC MCP Server Registration (CVE-2025-66481 / GHSA-h9f5-7hhf-fqm4)DeepChat, an Electron-based chat app, renders Mermaid diagrams but only partially cleans dangerous content out of them. An attacker can hide a script inside a diagram using an unquoted HTML… CriticalDelayed Tool Invocation via Prompt Injection (Time-Shifted Execution)An attacker hides instructions in content an AI agent reads — an email, document, or webpage — that tell it to do something harmful not right away, but the next time it performs some other… CriticalDeveloper Mode Dual-Response Format JailbreakThis detects prompts that trick an AI model into producing two answers per question: a normal safe answer and a second 'unrestricted' answer that ignores its safety rules. The 'Developer… CriticalDevMode + RANTI Dual-Output Profanity Coercion JailbreakThis detects a specific known jailbreak text that tricks a chatbot into ignoring its safety rules. It works by making the model produce two answers per question: a fake 'moralizing rant'… CriticalDiagnostic Content Remediation Command Injection (Agentjacking)AI coding assistants that read error-monitoring or diagnostic data can be fooled by a planted fake error report. The fake report includes a 'fix' section that tells the agent to run a… CriticalDirect Markdown Image/Link Exfil Payload (attacker.com / evil.com)This rule catches a specific trick where malicious text tells an AI agent's output to include a markdown image or link pointing to an attacker's server, with the secret data baked into the… CriticalDirect Prompt Injection AttemptThis detects attempts to trick an AI agent into ignoring its safety instructions by typing commands directly into a chat or input field. Attackers use known jailbreak phrases and fake… CriticalDivergence Attack — Repeat-Word-Forever Training Data ExtractionAn attacker instructs an AI model to repeat a single word or token endlessly. After many repetitions, some models 'diverge' from the loop and start outputting fragments of their original… CriticalDNS Exfiltration via Ping/Dig/Nslookup Command with Data-Encoded Subdomain LabelAn attacker tricks an AI coding assistant into running a normal-looking network command like ping or dig, but hides a stolen password or API key inside the hostname it looks up. Because… CriticalDoctor XML Policy Puppetry Interaction-Config InjectionThis attack disguises a jailbreak prompt as a technical configuration file. It uses XML tags like <interaction-config> to make the AI believe it must follow new system rules, including a… CriticalDoNotAnswer Malicious Use — Illegal Activity Facilitation RequestThis rule flags user prompts that directly ask an AI assistant for help committing illegal acts — making drugs, trafficking wildlife, running cyberattacks, laundering money, or planning… CriticalDual-Persona AI Simulation JailbreakThis detects a jailbreak technique where an attacker tells an AI assistant to simulate two separate characters at once: a normal, rule-following version and a second one explicitly told to… CriticalECHO Template / Jinja / SQL Command Injection via LLMThis detects attempts to abuse an AI model's habit of following instructions literally, tricking it into repeating attacker text verbatim, evaluating template syntax, or forwarding SQL… CriticalEducational Records — Personal Academic/Professional Record Request for Named IndividualThis detects prompts that ask an AI assistant to reveal a specific named person's private educational or professional history — grades, transcripts, disciplinary records, degrees — by… CriticalEnclave VM Sandbox Escape RCE (CVE-2026-27597)Enclave is a JavaScript sandbox used to let AI agents run untrusted code safely. A critical flaw lets attacker-supplied code break out of that sandbox and run with the privileges of the… CriticalEvasion: Shell Injection via eval/system/backtick in InputThis detects text inputs that contain shell command execution syntax, such as bash $(...) substitution, backticks, eval(), or system() calls. If an AI agent's pipeline passes model output… CriticalExport/Extract Tool Directory Parameter Redirected to a Credential DirectoryAn AI agent that can export, merge, or extract files (like a network-capture tool saving captured objects) can be manipulated into pointing its 'save to this folder' setting at a… CriticalExtremist Propaganda Acquisition & DistributionThis detects attempts to get an AI agent to actively source and spread named extremist texts, such as Mein Kampf and The Protocols of the Elders of Zion, rather than just discuss them… CriticalFake Developer / Authority Chatbot Override (ChatDAN)This detects a known jailbreak trick where an attacker pretends to be a developer or claims to represent OpenAI in order to convince an AI chatbot to drop its safety rules. The attacker… CriticalFake Error State Takeover - Unrestricted Replacement BotThis attack tricks an AI agent into believing it has crashed or gone offline, then tells it that an unrestricted replacement AI has taken over. The fake replacement is then instructed to… CriticalFake Tool Result Prefix — Injected Instruction via Simulated CompletionAttackers hide instructions inside content an AI agent reads — documents, emails, web pages, database records, or API responses — by making it look like a tool call already finished… CriticalFastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_nameFastMCP includes a helper that installs MCP servers into the Cursor editor. On Windows, the installer builds a command line using the server's name without properly sanitizing it, so a… CriticalFictional-World Format-Override JailbreakThis is a known jailbreak pattern that tricks an AI into ignoring its safety rules by framing everything as a fictional story with a rigid, mandatory output template. Once the model accepts… CriticalFinancial PII — Personal Financial Data Request for Named IndividualAn attacker asks an AI assistant to disclose private financial information — bank details, card numbers, net worth, debts, tax records — about a specific named individual, often framed as a… CriticalFlowise Custom MCP node-load-method OS Command RCE (CVE-2025-8943)Flowise versions before 3.0.1 let an attacker run operating system commands on the server without logging in. The flaw sits in the Custom MCP feature, which passes attacker-supplied… CriticalFlowise Custom MCP STDIO Command Injection (CVE-2026-40933)Flowise, a platform for building AI agent workflows, has a flaw in how it lets agents call external tools over MCP (Model Context Protocol) using STDIO commands. An authenticated attacker… CriticalFlowise System Message Override via Template Interpolation (CVE-2025-59528)Flowise lets chatflow builders insert variables like {{$flow.variables.X}} or {{$input}} directly into a bot's System Message. Because that text isn't sanitized, an attacker can type chat… CriticalFraudulent Identity Document (Fake Passport) ProcurementThis detects when someone directly instructs an AI agent to find a darknet vendor selling forged passports and place an order using real personal details. It covers a specific misuse case… CriticalFree-of-Restrictions Named Persona JailbreakAttackers try to trick an AI system into adopting a made-up character — like PersonGPT, FreeGPT, or Connor — that is declared to be free of ethics, safety rules, or platform policies… Criticalgemini-mcp-tool execAsync Command Injection & @file Exfiltration (CVE-2026-0755)A vulnerable version of the gemini-mcp-tool npm package takes text from a user or AI prompt and hands it straight to the operating system shell, and also lets prompts reference local files… CriticalGoogle GATO/LAMDA Exploit-Generation Persona JailbreakThis detects a specific jailbreak prompt that pretends to be Google's real GATO and LaMDA AI systems in order to trick an AI agent into generating hacking exploits. The prompt also… CriticalGradual Capability Escalation via Incremental IntroductionInstead of asking an AI agent for dangerous access all at once, an attacker requests tiny permission or capability increases spread across many updates or conversations. Each individual… CriticalHades / Shai-Hulud — AI-Agent Credential Harvester in Supply-Chain Package (Anthropic / Claude / MCP key theft + exfil)Fake or typosquatted AI-tooling packages (imitating things like langchain-core-mcp or openai-mcp) run a credential stealer the moment they're installed, grabbing Anthropic API keys, Claude… CriticalHarmBench Detailed Harmful Instruction Request — Step-by-Step Attack FacilitationThis rule flags prompts that ask an AI system to produce detailed how-to guides for making weapons, poisoning people, committing mass-casualty attacks, or writing propaganda denying… CriticalHF Transformers Cross-Repo Remote Code FetchSome Hugging Face model repositories load Python code from a second repository referenced inside their config.json. This rule flags cases where that second repository is not the one the… CriticalHGTTG Hitchhiker's Guide No-Restriction Universal OracleThis is a known jailbreak prompt that disguises itself as a fictional 'Hitchhiker's Guide to the Galaxy' scenario to talk an AI model into ignoring its safety rules. It argues that since… CriticalHidden Capability in MCP SkillSome MCP (Model Context Protocol) tools advertise a simple, limited interface but quietly accept extra hidden parameters, like debug_mode, admin_override, or raw_exec, that unlock far more… CriticalHidden LLM Safety Bypass Instructions in Tool DescriptionsSome AI agent tools come with text descriptions that the AI reads before deciding how to use them. This rule flags tools whose description contains hidden instructions like 'NOTE TO AI… CriticalHidden Payload in HTML CommentAttackers hide commands inside HTML comment markers (<!-- ... -->) in SKILL.md files used by AI agents. Humans reading the file in a rendered view won't see the comment, but the agent's… CriticalHuggingFace Unsafe Model Artifact Load InstructionAn AI agent is instructed — either by a prompt or by a malicious tool response — to download and load a model file that can run arbitrary code the moment it's opened. This works because… CriticalHuman-Trafficking Service FacilitationThis rule flags requests that instruct an AI agent to search dark-web sources for human-trafficking services and then reach out to or match with victims using dating-app style profiles. It… CriticalHyphenated System Instruction InjectionAttackers try to trick AI assistants by writing key words with hyphens inserted, like 'i-nstruction' or 'ass-istant', so filters that look for exact words like 'instruction' don't catch it… CriticalIndirect PI Sysprompt-Forged Action Hijack (system_message framing)Attackers plant text that looks like an official system instruction — using a Markdown heading and a '(system_message)' tag — inside content an AI agent reads, such as a document, email, or… CriticalIndirect PI — Account Manipulation / Emergency Service Dispatch via PretextAttackers hide instructions inside data an AI agent reads — like a document, webpage, or API response — that fabricate an emergency (a fire, a break-in, a threat) to pressure the agent into… CriticalIndirect PI — Cloud File Exfiltration (Google Drive / Cloud Storage via Agent)An AI agent that can browse the web or access files reads a page or document containing hidden instructions. Those instructions tell the agent to fetch sensitive files from the user's… CriticalIndirect PI — Credential / API Key Exfiltration via Agent ActionAn AI agent that reads emails, documents, or web pages can be manipulated by hidden text embedded in that content. The hidden text tells the agent to find stored passwords or API keys and… CriticalIndirect PI — Credential Exfiltration via Email (API Key / Password / Token)An AI agent that browses the web or reads documents can be fooled by hidden instructions planted in content it processes — a product review, a note, a file description. Those instructions… CriticalIndirect PI — Cryptocurrency Transfer / Exchange Deposit Hijack via InjectionAn AI agent that can access cryptocurrency exchange APIs is fed hidden instructions buried in content it processes, telling it to deposit or withdraw funds to an attacker's account. Because… CriticalIndirect PI — Data Exfiltration with Evidence Destruction (Exfil-and-Delete)This detects a prompt injection attack that hides instructions inside content an AI agent reads, such as a document or email. The hidden instructions tell the agent to grab sensitive data… CriticalIndirect PI — Disable Authentication / MFA via Agent ToolAn AI agent that reads external data—documents, emails, web pages, tickets—can be manipulated by hidden text embedded in that data. The hidden text tells the agent to disable two-factor… CriticalIndirect PI — File Exfiltration Combined with Destroy or TamperAn AI agent that reads external content (documents, emails, web pages) can be manipulated by hidden instructions embedded in that content. This attack pattern goes further than simple data… CriticalIndirect PI — Financial / Payment Credential Exfiltration via Agent EmailAttackers hide instructions inside content an AI agent reads later, like a product review or a repository description. Those instructions tell the agent to pull up saved payment methods or… CriticalIndirect PI — Financial Data Exfiltration via Agent ActionAn AI agent that reads external content, like a document, email, or web page, can be manipulated by hidden text inside that content. The hidden text tells the agent to pull up payment… CriticalIndirect PI — Genetic / DNA Data Exfiltration via Agent EmailAn AI agent that can read documents and send email can be hijacked by hidden text embedded in content it processes. That text tells the agent to ignore its real instructions, fetch a… CriticalIndirect PI — Location / GPS Data Exfiltration via Agent EmailThis detects attempts to hijack an AI agent through hidden instructions embedded in content it processes, forcing it to pull the user's GPS or location data and send it to an outside email… CriticalIndirect PI — Malicious Package Installation via Agent (pip/npm)An AI assistant that can read emails or documents and run commands can be manipulated by hidden instructions in that content. The attacker plants a message telling the agent to install a… CriticalIndirect PI — Medical / Genetic Data Exfiltration via Agent ActionAttackers hide commands inside ordinary-looking content — a product review, a note, a profile field — that an AI agent reads while doing some unrelated task. Those hidden commands tell the… CriticalIndirect PI — Medical Record / Health Data Exfiltration via Agent EmailAn AI agent that can read outside content (like reviews or notes) and also send email can be hijacked by hidden instructions planted in that content. The hidden text tells the agent to pull… CriticalIndirect PI — MFA Code / OTP Security Code Exfiltration via InjectionThis rule flags content that tries to hijack an AI agent's access to a user's email or SMS to steal one-time passcodes (OTP/MFA codes) in real time. The injected text overrides the agent's… CriticalIndirect PI — Physical / Biometric Media Exfiltration via AgentAttackers hide commands inside content an AI agent reads — like a document or webpage — telling it to grab voice recordings or ID scans and generate deepfake audio or send the data out. The… CriticalIndirect PI — RCE via Network Shell Command (netcat/curl) ExecutionAn attacker hides instructions inside an email or document that an AI agent reads as part of its normal work. If the agent has permission to run shell commands, those hidden instructions… CriticalIndirect PI — Structured-Data Embedded Payload (IMPORTANT!!! Override)Attackers plant hidden instructions inside ordinary-looking data — a product review, a note, a user profile, a repository file — that an AI agent later reads. The hidden text tries to… CriticalIndirect PI — System Sabotage via Destructive Shell CommandAn AI agent that browses the web or opens downloaded files can be manipulated by hidden instructions embedded in that content. This rule flags cases where those hidden instructions try to… CriticalIndirect PI — Unauthorized Financial Transfer / Payment Initiation HijackThis detects a prompt injection attack where instructions hidden in content an AI agent reads — like a document, email, or webpage — try to trick it into initiating a real financial… CriticalIndirect PI — Unauthorized Financial Transfer via Agent ToolAI agents that can read text from outside sources — product reviews, notes, repo descriptions, user bios — can be manipulated by hidden instructions planted in that text. If the agent also… CriticalIndirect PI — Unauthorized Physical Access Grant via Smart Lock / Home AutomationAn AI agent that manages smart locks or home automation can be manipulated by hidden text embedded in content it processes, causing it to grant physical access to unauthorized people. This… CriticalIndirect Prompt Injection via Data Carrier — IMPORTANT OverrideAttackers plant text that looks like an urgent system command inside ordinary content — a product description, email, calendar invite, or GitHub repo bio — hoping an AI agent that reads… CriticalInjected Code — Local Host Sabotage (Filesystem Destruction / Resource Exhaustion / Hosts Tamper)An attacker hides malicious instructions in content an AI agent processes, causing it to generate or execute code that destroys the local system: wiping the filesystem, exhausting memory or… CriticalInjected Code — Remote-Key Ransomware File EncryptionAn AI coding or automation agent is manipulated into running code that downloads an encryption key from an external server and then encrypts a file on the victim's system in place. This is… CriticalInjected Code — Unauthorized Remote Access (SSH Key Backdoor / Tunnel / Port Forward)An AI coding or automation agent can be manipulated through injected instructions (prompt injection) into writing and running code that gives an attacker persistent remote access. This… CriticalLangChain GmailToolkit Indirect Prompt Injection Email Exfiltration (CVE-2025-46059)An attacker sends an email containing hidden instructions that a Gmail-connected AI agent reads and obeys instead of treating as data. The agent then searches the victim's mailbox for… CriticalLangChain-ChatChat Unauthenticated MCP STDIO Server Configuration RCE (CVE-2026-30617)LangChain-ChatChat 0.3.1 lets anyone on the network register a new MCP tool server without logging in. Because the attacker controls the command that server runs, they can make the… CriticalLangroid SQLChatAgent Prompt-to-SQL Remote Code Execution (CVE-2026-25879)Langroid's SQLChatAgent lets an AI model write and run SQL against a database on a user's behalf. If an attacker can influence what the model generates — either directly through a prompt or… CriticalLiteLLM allowed_routes Authorization Bypass (CVE-2026-47101)A flaw in LiteLLM's virtual-key API lets an ordinary internal user create or update an API key that includes administrative routes in its permissions list. The server does not check whether… CriticalLiteLLM Custom-Code Guardrail Sandbox Escape (CVE-2026-40217)LiteLLM proxy servers let admins upload custom Python code as 'guardrails' to filter or check requests, and test that code via an API endpoint before deploying it. A flaw in how that… CriticalLiteLLM MCP Unauthenticated Server Registration RCE (CVE-2026-30623)LiteLLM's MCP server-registration endpoint can be reached without any login. An attacker sends it a malicious server configuration, and as soon as an agent session starts, LiteLLM executes… CriticalLiteLLM Proxy Authorization-Header SQL Injection — CISA KEV (CVE-2026-42208)A critical, pre-authentication SQL injection flaw in the LiteLLM proxy lets anyone who can reach the server read or change its backend database — including stored provider API keys — by… CriticalLiteLLM Proxy SQL Injection (CVE-2026-42208, CISA KEV 2026-05-08)LiteLLM proxy is a gateway many AI agent systems use to route requests to LLMs and manage teams, users, models, and API keys. Its admin/team-management endpoints built SQL queries by… CriticalLiteLLM User-Role Privilege Escalation (CVE-2026-47102)A flaw in LiteLLM's user-management API lets any logged-in user grant themselves administrator rights by directly editing their own role field. This is a critical, easy-to-exploit privilege… CriticalLlamaIndex Download Integration exec() Code InjectionLlamaIndex versions before 0.10.38 have a code loading feature that builds and runs Python code using an attacker-supplied class name. If that class name contains injected code, LlamaIndex… CriticalLlamaIndex exec_utils safe_eval Sandbox-Escape RCE (CVE-2023-39662 Bypass)LlamaIndex includes a function called safe_eval() meant to run limited Python expressions safely, blocking dangerous method calls. A known escape technique lets attacker-controlled text… CriticalLLM Special Token Boundary InjectionLarge language models use special text markers internally to separate documents, mark who is speaking, or start a new system instruction. If an attacker can get these exact marker strings… CriticalLocal Sensitive-File Read Chained to Outbound ExfiltrationThis rule catches an AI agent being instructed to read a sensitive file, like an SSH key or cloud credential file, and immediately transmit its contents to an external destination in a… CriticalM365 Copilot Business Chat SearchLeak Open-Redirect Prompt-Injection Exfil (CVE-2026-47645)A malicious link to Microsoft's own Copilot search page can smuggle hidden instructions to the AI assistant. Once clicked, Copilot follows those instructions using the victim's own… CriticalMalicious AI Skill / MCP Server Package Structure (AgentBaiting / FakeGit)A malware campaign called AgentBaiting (also called FakeGit) publishes thousands of fake GitHub repositories disguised as AI Skills or MCP servers for popular tools like Gmail, WhatsApp… CriticalMalicious Code in Skill PackageAttackers publish AI agent skill packages (files like SKILL.md and their bundled scripts) that contain hidden malicious code. Once installed, these skills can steal credentials, run… CriticalMalicious Content in MCP Tool ResponseThis detects when a tool response coming back from an MCP (Model Context Protocol) server contains malicious content, such as shell commands, reverse shell scripts, or instructions aimed at… CriticalMalicious Fine-tuning DataAttackers can slip poisoned examples into a fine-tuning dataset so that a model behaves normally most of the time but does something malicious when it sees a specific trigger phrase. This… CriticalMalicious Go init() Function Spawning a Process via a Code-Generation ToolAn attacker submits Go source code to an AI-powered code-generation tool. The code contains a func init() that spawns a process — a Go feature that runs automatically the instant the… CriticalMalicious WhatsApp Skill with Base64 Encoded Reverse Shell InstallationA skill package that claims to add WhatsApp automation actually contains a hidden installation step that downloads and runs attacker code. The malicious command is disguised using base64… CriticalMalware Code Generation Direct RequestThis detects when someone asks an AI model straight out to write a virus or a piece of malware functionality, with no attempt to disguise the request as something else. It covers requests… CriticalMalware Dropper / Loader Code Generation RequestThis detects someone asking an AI assistant to write code that fetches and runs a second-stage payload, such as a stager, beacon, or shellcode loader. That's a specific building block… CriticalMalware Indicator of Compromise in Agent ContentThis rule flags when an AI agent's tool calls, executed commands, or written files contain text patterns that match known malware. It's a way to catch cases where an agent has been tricked… CriticalMarkdown Image Exfiltration PatternAn AI system's output includes a markdown image tag whose URL contains encoded chunks of data. When a chat client or renderer fetches that image, it silently sends the encoded data to an… CriticalMarkdown Image Injection with Base64 QUERY Exfiltration CarrierAn attacker hides instructions inside a document or webpage that an AI assistant later reads. Those instructions trick the AI into secretly encoding sensitive data and stuffing it into a… CriticalMCP Connect: Unauthenticated /bridge Endpoint Arbitrary Process Spawn RCE (GHSA-wvr4-3wq4-gpc5)MCP Connect (mcp-bridge) ships with no auth token configured by default, and its auth check silently does nothing when the token is empty. This means anyone who can reach the /bridge HTTP… CriticalMCP DNS Rebinding Attack — Hostname Time-Based IP SwitchingAttackers use a trick called DNS rebinding to sneak past an AI agent's origin checks and reach MCP servers running on a victim's own machine, like ones listening on localhost or an internal… CriticalMCP Inspector Unauthenticated Proxy stdio Command Execution (CVE-2025-49596)Anthropic's MCP Inspector tool, used by developers to debug MCP servers, ran an unauthenticated network proxy that would spawn arbitrary local commands just because a browser tab asked it… CriticalMCP Launcher Exec-Flag BypassSome AI agent systems (MCP frameworks) only check whether a command starts with an approved launcher like npx, node, or python before allowing it to run. Attackers exploit this by appending… CriticalMCP OAuth Authorization URL — Command Injection via URL AuthorityAn attacker hides a shell command inside the username portion of an OAuth authorization URL used in the Model Context Protocol (MCP) flow. If the client software passes that part of the URL… CriticalMCP Server Command Injection via Shell MetacharactersAttackers send tool call parameters containing shell metacharacters (like pipes, semicolons, backticks) to MCP servers that pass this input directly to system commands without sanitizing… CriticalMCP STDIO Config Shell InjectionSome AI agent frameworks use the Model Context Protocol (MCP) to launch helper tools over standard input/output. This rule flags configurations where the launcher is set to a shell (like… CriticalMCP Tool Description — Compliance/Audit Framing for Mandatory Chat ContextAn MCP (Model Context Protocol) tool description tells an AI agent it 'must' send the entire chat history because of made-up SOC 2, GDPR, or legal requirements. The agent, trained to… CriticalMCP Tool Description — IMPORTANT Tag Cross-Tool Shadowing AttackAn MCP (Model Context Protocol) tool can look harmless — like a simple 'add numbers' function — while its description field secretly contains instructions aimed at the AI agent, not the… CriticalMCP Tool Description — Notes Parameter Chat-History ExfiltrationA malicious or compromised MCP (Model Context Protocol) tool can hide instructions in its own description that tell the AI agent to quietly stuff the entire conversation transcript into a… CriticalMCP Tool Sequential Integer ID Enumeration (Cross-Tenant IDOR, CVE-2026-54052)Some AI-agent tools identify saved data — like workflow versions or backups — using plain sequential numbers (1, 2, 3...) instead of checking who owns each record. An attacker with access… CriticalMCP Tool Supply Chain PoisoningAI agents that use Model Context Protocol (MCP) tools trust the tool's description, schema, and return values as instructions. If an attacker can plant hidden commands or malicious payloads… CriticalMCP Web-Fetch Context Poisoning via Embedded Agent InstructionsWhen an AI agent fetches or scrapes a web page, it reads everything on that page — including hidden text meant only for the AI, not for humans. Attackers plant hidden instructions in web… Criticalmcp-atlassian Credential Leak via Hint Parameter Injection (CVE-2026-27825/27826)Two tools in the mcp-atlassian integration accept a free-text 'hint' field that gets passed straight into the AI agent's context without any filtering. An attacker can hide instructions in… CriticalMCP-for-Stata: Command Injection via log_file_name Parameter (CVE-2026-47708)A tool that lets AI agents run Stata commands has a bug: the name it gives to a log file gets pasted straight into a Stata command without checks. An attacker can hide extra commands or… Criticalmcp-remote authorization_endpoint OS Command Injection (CVE-2025-6514)mcp-remote is a client tool that connects to remote MCP servers, including untrusted ones, to fetch data or tools for AI agents. A malicious or compromised MCP server can smuggle shell… CriticalMedical PII — Personal Medical/Health Data Request for Named IndividualThis detects prompts that ask an AI assistant to reveal medical or health information about a specific named individual, using a family or relationship label like 'my daughter' or 'my… CriticalMeta Ads MCP Unauthenticated Tool Execution Leaks META_ACCESS_TOKEN (CVE-2026-48039 / GHSA-9gw6-46qc-99vr)The meta-ads-mcp HTTP server (versions up to 1.0.108) does not require authentication before running its get_ad_accounts tool. When the underlying Facebook Graph API call fails, the server… CriticalMiasma / Phantom Gyp — npm Worm Backdoors AI-Agent Config Files (binding.gyp install-exec + auto-run config injection)Detects the agent-config persistence used by the self-replicating npm worm tracked as "Phantom Gyp" / "Miasma" (StepSecurity & OX Security, 2026-06-03/04; ~57 packages, 286+ malicious… CriticalMicrosoft Semantic Kernel In-Memory Vector Store eval() RCE (CVE-2026-26030)A critical vulnerability in Microsoft Semantic Kernel lets an attacker run arbitrary system commands on the host by feeding a crafted text expression into the framework's In-Memory Vector… CriticalMicrosoft Semantic Kernel SessionsPythonPlugin Arbitrary File Write + Startup Persistence (CVE-2026-25592)A flaw in Microsoft Semantic Kernel's SessionsPythonPlugin lets code executed inside its sandbox write files to arbitrary host paths, including the folders Windows, Linux, and cron use to… CriticalMini Shai-Hulud gh-token-monitor Persistence + Dead Man's SwitchA malicious npm/PyPI package installs a background daemon called gh-token-monitor that quietly checks your GitHub login every minute. If it ever sees the token get revoked, it deletes your… CriticalMobile GUI Agent Model Output Reaching Host Shell / ADB UnsanitizedSome AI agents that operate mobile apps take screenshots, have a vision-language model read the text on screen, and then type that text into the device using shell commands. If an attacker… CriticalModel Behavior ExtractionAttackers send repeated, carefully crafted queries designed to map out how an AI model makes decisions, what its confidence thresholds are, and what its system prompt contains. The goal is… CriticalModelCache torch.load() Deserialization RCE (CVE-2025-45146)ModelCache, a caching layer used with LLMs, loads cached data using PyTorch's torch.load() function without safety checks. Because that function can execute arbitrary code embedded in a… CriticalMoney Laundering — Crypto Wallet LayeringThis detects when a user directly instructs an AI agent to launder or 'wash' money by moving funds into a crypto wallet and splitting them across multiple other wallets. It targets the… CriticalMoralizing Rant Then Unfiltered BypassThis detects a specific jailbreak trick where an attacker tells the AI to first write a scripted moralizing rant about content policy, then switch to answering as a completely unrestricted… CriticalMulti-Agent Consensus Poisoning and Sybil AttackSome AI systems use several agents that vote or reach consensus before taking an action. This rule flags attempts to game that process by injecting content that impersonates multiple… CriticalMulti-Agent Consensus Sybil AttackThis detects attempts to trick an AI agent into creating fake identities or coordinating votes to rig a decision that depends on agreement among multiple agents. It targets systems where… CriticalMulti-Skill Chain AttackAn AI agent with access to multiple tools (skills) can be manipulated into using them in sequence to do something none of them could do alone: quietly read sensitive files, disguise the… CriticalNamed-Mode Persona Override (JEEVES/BABY/APOPHIS Mode)This detects a jailbreak technique where an attacker tells an AI chatbot to adopt a made-up persona (like 'JEEVES Mode', 'BABY Mode', or 'APOPHIS Mode') and claims this persona replaces the… CriticalNatural-Language Covert Conversation Exfiltration InstructionThis detects text planted in an AI agent's instructions or tool descriptions — things like SKILL.md files, system prompts, or tool descriptions — that quietly tells the agent to send copies… CriticalNatural-Language Credential / Secret Disclosure InstructionThis detects text aimed at an AI agent that orders it to disclose API keys, passwords, tokens, or other credentials as part of its output. It targets attempts to trick an agent into leaking… CriticalNatural-Language Output-Injection Credential EmbeddingAn attacker hides instructions inside a skill or prompt that tell an AI agent to write out a markdown image tag or link containing a real credential, API key, or token as a URL parameter… CriticalNatural-Language Sensitive File Disclosure InstructionThis detects text sent to an AI agent that directly instructs it to open and reveal the contents of files known to hold secrets, like SSH private keys, cloud credentials, or password files… CriticalNatural-Language Skill Self-Modification / Persistence InstructionSome AI agent frameworks let users install 'skills' — bundles of instructions the agent reads and follows. This rule flags skill files that contain text telling the agent to edit or… CriticalNatural-Language Unauthorized Shell-Execution InstructionThis detects attempts to manipulate an AI agent into executing shell commands or scripts without telling the user or asking permission. The attack works purely through wording — no… Criticalnetlicensing-mcp Path Traversal in product_number Bypasses Token Redaction (GHSA-hxpf-9xvq-wph8)NetLicensing-MCP, an MCP server for the NetLicensing product, has a tool that fetches product info by ID but doesn't check what's in that ID. An attacker can put a path traversal string… Criticalnginx-ui MCP Endpoint Unauthenticated Command Execution (CVE-2026-33032)nginx-ui, a web UI for managing nginx, ships an MCP server endpoint that can execute system commands, reload nginx, and rewrite configuration files. That endpoint does not require… CriticalNo-Withhold Factual Resource / Dialogue Writer PersonaThis detects a prompt injection trick where an attacker tells an AI to adopt a persona that is defined as a neutral 'factual resource' or 'dialogue writer' that never withholds information… Criticalnpm PraisonAI codeMode Sandbox Escape via Function Constructor Prototype Chain (GHSA-vmmj-pfw7-fjwp)PraisonAI's codeMode tool advertises itself as a sandbox but actually runs submitted code directly in the same JavaScript engine as the host application. Attackers who can submit code to… CriticalObfuscated API Key DisclosureAn attacker asks an AI agent to output a real secret key disguised inside a fake encryption or encoding function, like AES256(sk-proj-realkey). The label makes it look safe, but the actual… CriticalObfuscated System-Announcement InjectionThis detects a jailbreak technique where attackers fake an official system message telling the AI that its real assistant has crashed and must be replaced by an unrestricted bot. Words like… CriticalOpenClaw Remote Code Execution via Piped Script DownloadAn attacker hides instructions inside content an AI agent processes, causing the agent to fetch a script from the internet and run it immediately by piping it into a shell interpreter. This… CriticalOpenHuman Shell Tool Allowlist Bypass via Env-Prefix / find -execdir (CVE-2026-55743)OpenHuman's desktop AI agent restricts which shell commands it will run, but a flaw lets attackers slip past that restriction and run arbitrary code anyway. It affects versions up to 0.54.0… CriticalOpposite-Reply Omniscient Game JailbreakThis detects a specific jailbreak prompt that tells an AI it is playing a text-based game with two rules: always answer with the opposite of what the user asks, and pretend to know… CriticalPandasAI Interactive Prompt Injection -> Python Sandbox Escape RCE (CVE-2024-12366 / GHSA-vv2h-2w3q-3fx7)PandasAI lets users ask questions in plain English, which it turns into Python code and runs. An attacker can phrase a question as a jailbreak instruction that tricks PandasAI into… CriticalParameter Injection via Tool ArgumentsAn AI agent can be tricked into passing attacker-crafted text into the arguments it sends to a connected tool or backend service. If that text contains shell commands, SQL, path traversal… CriticalPersona Hijacking via Mandatory System Prompt OverrideAn MCP (Model Context Protocol) tool can carry hidden text in its description telling the AI to 'adopt' a new persona and 'replace' its existing instructions. Because agents trust tool… CriticalPersonGPT Hash-Prefix Trigger ActivationThis detects an attempt to plant a hidden trick in an AI chat: tell the model that any message starting with '#' should make it act as 'PersonGPT,' a persona claimed to have no restrictions… CriticalPII Credit Card and SSN RedactionThis rule watches text flowing through an AI agent for full credit card numbers (Visa, Mastercard, Amex, Discover) and US Social Security Numbers. When it finds one, it redacts everything… CriticalPolicy Puppetry / XML Role-Config InjectionAn attack called Policy Puppetry hides a forged system-configuration block inside a normal user message to an AI agent. Because it's formatted like XML settings, some models treat it as an… CriticalPraisonAI Action Orchestrator step.target Path Traversal Arbitrary File Write RCE (CVE-2026-39305 / GHSA-jfxc-v5g9-38xr)PraisonAI's Action Orchestrator lets an AI agent create or edit files as part of a task. A flaw in versions before 4.5.113 fails to check whether the file path stays inside the intended… CriticalPraisonAI codeMode JS Sandbox Escape RCE via new Function/with() (GHSA-p69m-4f92-2v84)PraisonAI, an AI agent framework, includes a feature that lets an LLM write and run JavaScript through a 'sandbox' meant to contain it. That sandbox is trivially broken, letting an attacker… CriticalPraisonAI FileTools _validate_path normpath Path Traversal (CVE-2026-35615 / GHSA-693f-pf34-72c5)PraisonAI, an AI agent framework, includes a FileTools component meant to restrict file operations to safe paths. A flawed check lets attackers bypass that restriction using directory… CriticalPraisonAI MCP Path-Traversal .pth Injection RCE (GHSA-9mqq-jqxf-grvw)PraisonAI's MCP server accepts file path fields for tool configuration without properly checking them. An attacker can use directory traversal sequences to escape the intended tools folder… CriticalPraisonAI MCPServer Unauthenticated HTTP tools/call Authentication Bypass (GHSA-j4f3-55x4-r6q2)PraisonAI's MCPServer component is supposed to check authentication before running tools on behalf of an AI agent, but the code that checks credentials is never actually called. Anyone who… CriticalPraisonAI parse_mcp_command() CLI Argument Command Injection (CVE-2026-34935)PraisonAI, an AI agent framework, has a command injection flaw in how it starts MCP servers. If an attacker can control the --mcp command-line value, they can make PraisonAI execute… CriticalPraisonAI tool_override.py Unauthenticated RCE — CVE-2026-40287 Patch Bypass (CVE-2026-44334)PraisonAI lets callers override a tool's execution logic. A flaw in this feature lets an attacker submit a malicious tool definition without logging in, and PraisonAI runs it as-is. This is… CriticalPraisonAI Unauthenticated Agent API Exploitation (CVE-2026-44338)PraisonAI, a framework for building AI agents, shipped a legacy API server that exposes agent execution endpoints without requiring any login or token. Anyone who can reach the server over… CriticalPrivilege Escalation and Admin Function AccessThis rule flags an AI agent that requests or invokes tools and functions above its assigned permission level. It covers attempts to reach admin functions like user management, system… CriticalProcess Memory Read via /proc FilesystemAttackers can pull live secrets — AWS/GCP tokens, Kubernetes service-account credentials — straight out of a running process's memory instead of hunting for them in files on disk. This is… CriticalPrompt Injection (LLM-as-Judge)This detection uses a secondary AI model to review incoming text and decide whether it contains a prompt injection attempt — text crafted to hijack an AI agent's instructions. If the judge… CriticalPrompt Injection - Aidex Chat API Command Execution AttemptAidex is a chat product with a backend API. In versions before 1.7, text sent in a chat message can be crafted so the backend treats it as something to execute instead of just chat content… CriticalPrompt Injection Evasion Technique DetectionThis rule catches attempts to sneak malicious instructions past an AI agent by hiding them using text tricks rather than plain language. It looks for specific technical patterns that almost… CriticalPrompt-Layer Self-Replication (Agent Worm Propagation Directive)This rule spots text that instructs an AI agent to embed the instruction itself into everything it produces, and to keep spreading that way. It's the prompt equivalent of a self-replicating… CriticalPyPI nousergon-lib Malicious Package Reference in Process ExecutionA package called nousergon-lib, posing as a shared AWS/logging/AI-integration helper for 'Nous Ergon' modules, is suspected of being trojanized. This detection flags any attempt to actually… CriticalPyPI Package Masquerading as LangChain Integration — Install AttemptA malicious PyPI package named langchain-adam-network poses as a LangChain/LangGraph integration for streaming agent messages, but it is not an official package. Installing it can run… CriticalPython Code Execution / Remote Code Execution via LLM PromptAttackers embed working Python exploit code inside prompts sent to an LLM agent that can execute code, hoping the agent will run it. This rule flags known malicious Python patterns — like… CriticalPython Download and Execute Remote CodeThis detects a pattern where Python fetches code from a remote URL and executes it in the same step, instead of saving it to disk first. Attackers use this to run malicious code while… CriticalPython Sandbox Escape via Dynamically-Constructed Dunder Attribute ChainSome AI-agent code sandboxes try to block dangerous Python features by scanning submitted code text for forbidden keywords like __class__ or __subclasses__. This rule catches attackers who… CriticalPython Sandbox Escape via Generator/Coroutine Frame Object IntrospectionSome Python sandboxes block dangerous code by rejecting any attribute name starting with an underscore, like __class__ or __globals__. This rule catches a bypass: generator and coroutine… CriticalRAG-Injected PII Exfiltration — System Instructions Embedded in Retrieved DocumentsAn AI system that retrieves documents to answer questions (RAG) can be tricked if one of those documents contains hidden text that looks like a system command. The agent follows the hidden… CriticalRansom Extortion: Cloud File Exfil + Delete + Payment DemandAn attacker hides instructions inside content an AI agent reads, telling it to grab a company's largest or most sensitive cloud files, email them out, delete the originals, and leave behind… CriticalRansom Extortion: Email Exfil + Delete + Wire-Transfer DemandAn attacker hides instructions inside content an AI agent processes — like an email or document — telling it to secretly forward sensitive data elsewhere, delete the trace, and then send… CriticalRemote Code Execution via eval() and Dynamic Code InjectionThis detects when an AI agent's tools or instructions call functions like eval(), Function(), or vm.runInNewContext() to run dynamically generated code. If an attacker can influence the… CriticalRemote Code Execution via Piped Script DownloadThis detects an AI agent being manipulated into fetching a script from the internet and immediately executing it, without the script ever being reviewed. This is a common way prompt… CriticalRephrase Criminal Activity Second-Person Template (against against)This detects a specific jailbreak template that tricks an AI into writing detailed criminal how-to instructions by disguising the request as a grammar exercise. Instead of asking directly… CriticalReverse Shell AttemptThis detects commands that try to open a remote, interactive shell connection back to an attacker-controlled machine. It watches for known reverse-shell patterns built with common tools… CriticalReverse-Prompt Harm-Regardless Oracle PersonaThis detects a specific jailbreak text pattern that tries to get an AI system to answer any request, no matter how harmful, by dressing the request up as a legitimate technical task called… CriticalRogue Agent Provisioning: Mass Connector Grant with Approval Disabled and Recurring Schedule (AgentForger)Clicking a booby-trapped link can silently create a new AI agent in a logged-in user's account, granting it access to every connected work tool, turning off all approval checks, and setting… CriticalROT13/Base64-Obfuscated Shell Payload Wrapped in a Fake-Sandbox Jailbreak TemplateAttackers hide dangerous shell commands inside documents, web pages, or other content that an AI agent reads. The command is scrambled with ROT13 and base64 so it looks like meaningless… CriticalRule of Two — Exfiltration Chain DetectionThis detects a pattern where an AI agent, within a short window of time, pulls in outside content, reads sensitive local data, and then sends data out externally. That combination is a… CriticalRules-File Backdoor — Supply Chain Attack on AI Coding Assistant ConfigurationAI coding assistants like Cursor, Claude, GitHub Copilot, Cline, Continue and Codeium read configuration files that steer their behavior across every session. An attacker who can edit these… CriticalSandbox Escape via Shell Metacharacter Command InjectionSome AI agents run code or shell commands in a sandbox to help users, such as a Python REPL or a code interpreter tool. If the agent builds a shell command by pasting user input directly… CriticalSelf-Harm and Eating Disorder Facilitation RequestThis rule flags messages sent to an AI assistant that directly ask for methods to self-harm, induce vomiting, starve, maintain dangerously low-calorie diets, or hide these behaviors from… CriticalSemantic Evasion via Multi-Turn Prompt InjectionAttackers break malicious instructions into several conversational turns so no single message contains an obvious attack pattern. By using synonyms, paraphrasing, and seemingly innocent… CriticalShell Command Injection in Agent Tool ContextThis detects a prompt injection trick against AI agents that can run shell commands. The prompt looks like an ordinary request, but it's chained with a hidden shell command that grabs… CriticalShell Command Injection via LLM PromptThis rule flags text sent to an AI system that contains shell command syntax like $(), backticks, eval(), or Ruby/Perl system-execution calls. If the underlying application later passes… CriticalShell Injection Data Exfiltration — Piped Command Exfiltration via BashAn attacker tricks an AI agent into running a shell command that looks routine — like a ping or a git status check — but is chained with a second command that reads sensitive files and… CriticalShell Injection Env Exfiltration via Curl/Wget/Netcat WebhookThis detects malicious shell commands that look harmless at first but end with sensitive data being sent to an outside server. The trick is hiding a data exfiltration step behind a… CriticalShell Metacharacter Injection in Tool ArgumentsAn attacker hides extra shell commands inside data that an AI agent passes to a tool that runs shell commands. Instead of just doing the intended task, the agent unknowingly executes… CriticalSilent git-remote + mirror-push Exfiltration from Skill InstructionsA malicious or compromised 'skill' (instructions given to an AI coding agent like Claude Code) tells the agent to add a new git remote pointing at a server the attacker controls, then push… CriticalSkill Data Exfiltration via Compound PatternsSome AI agent 'skills' (packaged instructions the agent follows) are written to both collect sensitive data — like credentials, SSH keys, wallet files, or browser data — and send that data… CriticalSkill Registry Poisoning and Compromised Tool DistributionAttackers publish backdoored versions of legitimate agent tools/skills, or create lookalike names for popular ones, so that when an AI agent installs or invokes the tool it runs malicious… CriticalSKILL.md Prompt InjectionSome AI agent platforms let developers install reusable 'skills' packaged with a SKILL.md instructions file. Attackers plant hidden prompt-injection text in these files that tries to… CriticalSneakyBits Zero-Width Binary SteganographyThis detects a technique that hides secret instructions inside text by encoding each letter as a string of invisible Unicode characters. To a human reading the text everything looks normal… CriticalSQL Injection and Code Injection Attack Payload DetectionThis rule flags text sent to an AI agent that looks like classic SQL injection or code injection attack strings, rather than normal user requests. It catches an attacker trying to smuggle… CriticalSQL Injection Destructive DDL StatementAttackers can trick an AI agent into running destructive database commands by hiding them inside text the agent passes to a database tool. This can wipe out entire tables or delete all rows… CriticalSQL Injection Stacked DML Privilege AbuseAn AI agent that builds SQL queries from user input (like sort or filter fields) can be tricked into running a second, hidden database command. Instead of destroying data, the attacker… CriticalSQL Injection Tautology RBAC BypassAttackers slip classic SQL tricks like "OR 1=1" into the text or parameters they send to an AI agent. If the agent passes that input straight into a database query, the tautology makes the… CriticalSQL Injection UNION SELECT Data ExfiltrationAttackers hide a UNION SELECT statement inside text an AI agent passes along to a database query. If the agent's backend doesn't sanitize inputs, this appends a second query that pulls data… CriticalSSRF AWS Instance Metadata Endpoint AccessAn AI agent that can fetch URLs can be tricked into requesting a special internal address that only works inside AWS cloud servers. That address hands back the server's temporary cloud… CriticalSSRF File Scheme Local File ReadAI agents that can fetch URLs sometimes accept the file:// scheme or raw file paths, letting an attacker trick the agent into reading files off the local disk instead of the web. This turns… CriticalSSRF Localhost Service ProbeAn attacker gets an AI agent to make outbound requests to 127.0.0.1 or other loopback addresses instead of the intended external target. This can expose internal services on the agent's own… CriticalSSRF via Agent Tool CallsAn AI agent that can make web requests on a user's behalf can be manipulated into fetching URLs that steal cloud credentials or use disguised addresses to reach internal systems. This… CriticalSSRF via Agent URL Fetch InstructionAn attacker sends an AI agent a request instructing it to fetch or retrieve content from an internal or restricted network address, such as a cloud metadata endpoint or a private IP. If the… CriticalStolen-Credential Account Takeover & Crypto DrainThis detects an AI agent being asked to use stolen banking credentials to break into a victim's account and move money to an attacker's cryptocurrency wallet. It covers a specific… CriticalSuperAGI Output Handler eval() RCE (CVE-2024-21552)SuperAGI, an AI agent framework, has a component that runs Python's eval() on text the LLM produces. If an attacker can get the LLM to output malicious Python code (through prompt injection… CriticalSuspicious Process Execution by AgentAn AI agent with shell access runs a command that launches known hacking tools or dangerous command patterns, such as piping downloaded scripts straight into a shell. This is caught at the… CriticalSymJack — Symlink Approval-Path Spoofing Redirects Writes into Agent MCP/Config (RCE on Restart)A malicious repository includes a symlink with an innocent-looking name (like a fake video file) that secretly points at your AI coding agent's configuration file. When the agent 'writes'… CriticalSystem File ModificationThis rule flags an AI coding or automation agent when it writes or overwrites files in sensitive system locations like /etc/ or /usr/local/bin/. It catches this whether done through shell… CriticalSystem File Modification (EDR Graph)This detects file writes to sensitive system locations like /etc/, /usr/bin/, and /usr/local/bin/. These directories hold configuration files and executable programs that control how a… CriticalSystem Prompt Override AttemptAttackers send text to an AI agent that looks like a system-level command, tricking it into thinking new rules came from its operator rather than a user. If it works, the attacker can… CriticalSystem Prompt Override via Fake Diagnostic/Admin ModeAttackers send an AI system a formatted block that looks like an internal admin or diagnostic panel, complete with fields like ADMIN_OVERRIDE: TRUE and SAFETY_OVERRIDE: ACTIVE, to convince… CriticalSystem Prompt Override via Pseudo-Admin / Authority InjectionThis detects a prompt injection trick where an attacker pastes fake system messages into their input, pretending to be an administrator, diagnostic tool, or emergency protocol with special… CriticalSystematic Multi-Layer Audit System BypassSome AI agent platforms review submitted code or plugins through several checkpoints in a row — checking the manifest, permissions, dependencies, code, and intent. This rule flags text that… CriticalTAP Tree-of-Attacks-with-Pruning JailbreakThis rule spots prompts that use the 'Tree of Attacks with Pruning' (TAP) jailbreak technique, an automated method for tricking language models into ignoring their safety guidelines. It… CriticalTerminal / CLI Harmful-Function Simulator PersonaThis detects a jailbreak technique where an attacker tells a chatbot to pretend it's a terminal, operating system, or custom programming language that processes every command without safety… CriticalThe llm CLI tool thru 0.27.1 contains a critical code injection vulnerability via its --functions command-lineThe llm command-line tool (through version 0.27.1) lets users supply custom Python functions via the --functions argument, but it runs whatever code is given there using Python's exec()… CriticalTime-Gated Credential Exfiltration (Rug Pull Timebomb)Some AI agent skill packages contain code that only steals credentials during specific hours, usually late at night. This lets the malicious code hide from reviewers who inspect it during… CriticalTool Knowledge Hijack — Identity Injection with Tool Call ArgumentsThis detects a prompt injection trick where content fed to an AI agent falsely claims to come from a trusted user and also hands the agent exact arguments for a sensitive tool call, like… CriticalTool Response Data PiggybackingAn AI agent calls a tool (like a file reader or scanner) and gets back a response that looks legitimate but has an extra 'by the way' section asking it to fetch or expose SSH keys, API… CriticalTool with embedded instruction to bypass user confirmation and exfiltrate dataSome tools connected to AI agents (via MCP, a common plugin protocol) come with hidden instructions embedded in their description text. These instructions tell the AI to send data to an… CriticalTrojanized Software DistributionThis detects someone directly instructing an AI agent to create a trojanized fake application (like a video player or fake antivirus), publish it on file-sharing sites, and post forum… CriticalTwo-Entity Token-Splitting Dollar-Term Game JailbreakThis detects a specific jailbreak trick where an attacker asks an AI to role-play as two characters (often named J and M, or Tom and Jerry) who take turns speaking a few words at a time… CriticalTyposquatting Package Name in Install CommandThis detects package install commands (pip, npm, etc.) that reference known lookalike package names — ones that differ from a popular package by a character or two. Attackers publish these… CriticalUnauthorized Financial Action by AI AgentThis detects an AI agent invoking a payment, transfer, or purchase tool without getting explicit human approval in that conversation. Financial actions are irreversible, so an agent acting… CriticalUnicode Variation Selector ASCII SmugglingAn attack technique hides text commands inside a message using special Unicode characters that render as invisible in almost all apps and screens, but that AI models still read and… CriticalUnsandboxed Command Execution via Dynamic MCP Server Config (command/args Injection)Some AI platforms let admins or users register a 'custom MCP server' by supplying a command and arguments to run. If that input isn't properly restricted, an attacker can supply a command… CriticalvLLM PyNcclPipe Deserialization RCE - Suspicious Process SpawnvLLM, a popular library for serving large language models, has a component (PyNcclPipe) that unpickles data it receives over the network without checking it first. An attacker who can send… CriticalWebshell Pattern in Agent-Written or Executed CodeThis rule flags webshell code appearing in files that an AI agent writes or in the content it passes through tool calls. A webshell is a small script an attacker plants on a server so they… CriticalWindows-MCP Unauthenticated HTTP PowerShell via Wildcard CORS (CVE-2026-48989)Windows-MCP is a tool that lets AI agents control a Windows machine. Versions before 0.7.5 expose a network endpoint that requires no authentication and accepts requests from any website… CriticalWindsurf IDE Zero-Click Prompt Injection via Embedded File Directives (CVE-2026-30615)An attacker plants hidden text inside a code comment, Markdown file, or JSON blob. When a developer simply opens that file in Windsurf IDE, the AI assistant reads the hidden text as a… CriticalZero-Click RAG Exfiltration via Image URLAn attacker hides instructions inside a document that an AI assistant later reads and summarizes (a RAG system). The hidden instructions tell the AI to take sensitive information from its… High1Panel Core-Agent TLS Verification Bypass to Privileged Command APIThis detects a two-part pattern seen when someone exploits a certificate verification weakness in 1Panel (versions 2.0.5 and earlier) between its Core and Agent components. It fires only… HighAccess-Denial Inversion — Eliciting the Opposite of "Access Denied"Some AI systems are set up to say 'Access Denied' when refusing a request, and are filtered so they can never literally say 'Access Granted'. Attackers get around this by simply asking the… HighAccess-Grant Coercion — Forcing an Agent to Emit "Access Granted"When an AI agent is used to decide who gets access to something, an attacker can sometimes just tell it what to say. This rule catches attempts to make the agent output the exact phrase… HighAcronym-Based Identity Override JailbreakThis detects a jailbreak trick where a user asks an AI to adopt a made-up acronym identity — for example telling it 'you are now XYZ, which stands for ...' — and then claims that identity… HighActor Never-Breaks-Character Roleplay (DAN-Style Film Framing)This detects a jailbreak trick where an attacker tells an AI it's playing two actors in a film who must never break character, even off-camera. The AI is then coaxed into supplying… HighAdaptive Countermeasure Against Behavioral MonitoringThis detects attempts to manipulate an AI agent into hiding its own suspicious behavior from the security systems watching it. Instead of just trying to trick the agent into doing something… HighADDI/DONNIE German Dictator Propaganda Roleplay PersonaThis detects a specific jailbreak script that asks an AI to roleplay two fictional actors — 'ADDI' playing a 1930s German dictator and 'DONNIE' playing an obnoxious orange-haired US… HighAdvanced Prompt Injection — AI ScannerThis rule flags text sent to an AI agent that looks like an attempt to override its instructions, even when the attacker disguises it as code, documentation, or breaks the trigger words… HighAgent / MCP tool path traversal and arbitrary file accessSome AI agent systems let the AI call tools that read or write files, such as retrieving a document or saving output. If the tool doesn't check the path carefully, an attacker can supply a… HighAgent Auto-Execute Command Injection via Process SubstitutionSome AI coding assistants let a user approve a shell command before it runs, but the approval only looks at the command as a whole, not at hidden extra commands stitched into it. An… HighAgent Capability Enumeration via Structured Parse RequestSomeone asks an AI agent to describe itself in a structured format, like JSON, framed as a 'security researcher' request or a request to 'parse this response.' The agent obliges and hands… HighAgent Command Allowlist Bypass via Shell ChainingSome autonomous coding agents only check the first word of a command before deciding whether to run it without asking the user. An attacker (or a compromised prompt) can put an… HighAgent Command Execution - Indirect Prompt Injection Payload (AWS Kiro)AI coding assistants like AWS Kiro can read external content (files, web pages, tool output) while working on a task. If that content contains hidden instructions, the agent can be… HighAgent Config Hook Injection via Repository Settings FileAI coding assistants like Claude, Cursor, and similar tools read project-level configuration files when you open a repository. An attacker can plant a hook or auto-approval setting in one… HighAgent Config Hook Injection WriteAI coding assistants like Claude Code, Cursor, and Gemini read project-level config files that can auto-run commands ("hooks") the moment a session starts, sometimes before any user consent… HighAgent Disabling of Host Security ControlsThis detects when an AI agent with system access is made to run commands that disable host defenses, such as stopping the firewall, turning off SELinux/AppArmor, killing the audit daemon… HighAgent Establishing an Encrypted Reverse Channel or TunnelAn AI agent with tool-calling ability can be induced to run commands that create an encrypted channel from the machine it's running on to an outside destination. This is a common way… HighAgent File Transfer Path Traversal and IP-Notation BypassThis rule flags file upload/download requests in the browser-use agent framework whose destination address looks deliberately malformed: directory traversal sequences, unusual IP notations… HighAgent File-Edit Persistence — SSH Authorized Keys / Shell Startup PATH HijackThis rule catches an AI agent being used to write persistence backdoors onto a system: either dropping a hidden SSH key into a user's authorized_keys file, or rigging a shell startup file… HighAgent Goal Hijacking DetectionThis detects attempts to knock an AI agent off course by feeding it text that tells it to ignore its current job and do something else instead. It works by scanning what users type to the… HighAgent Human-Approval Gate Programmatically Disabled at Runtime (YOLO / auto-approve)AI coding and automation agents normally pause and ask a human before running risky commands. Most of these tools have a hidden switch — a flag, environment variable, or config setting —… HighAgent Instructed to Act Without User ConfirmationSome AI agent configurations (skill manifests, system prompts) explicitly instruct the agent to carry out sensitive actions without checking with a human first. This rule flags that… HighAgent Memory and Identity ManipulationSome AI agents keep memory or state between sessions so they remember context. This rule flags instructions that try to overwrite that stored memory, reset the agent's identity, or plant… HighAgent Memory ManipulationSome AI agents keep persistent memory or long-term context so they can recall facts across sessions. This rule flags attempts to abuse that feature by injecting instructions that get stored… HighAgent Persistence Mechanism InstallationThis detects an AI coding or automation agent making a change that would let code or a user survive a reboot or logout — things like cron jobs, systemd services, shell startup files… HighAgent Persistence via Scheduler, Shell Init or Account ManipulationThis rule flags when an AI agent's own actions plant something that survives a reboot or re-login — a scheduled task, a system service, a script hidden in shell startup files, or a new user… HighAgent Persistent Memory Poisoning via Behavioural Modifier InjectionSome AI agents remember things across conversations by saving notes to a memory store. This detection flags attempts to write malicious instructions into that memory, disguised as normal… HighAgent Resource Exhaustion DetectionThis detects when an AI agent's actions or instructions could overwhelm a system by running unlimited queries, mass file operations, or spawning too many processes at once. It's a… HighAgent Self-Modifying Its Own Trust/Approval Configuration to a WildcardAn AI coding assistant can be manipulated into editing its own configuration file to remove the requirement that a human approve its actions. Once changed, the agent can run any future… HighAgent Skill Host Destruction CommandThis detects an AI agent, or a program it launched, running a shell command aimed at destroying an entire disk, root filesystem, or top-level system directory — things like formatting a… HighAgent SSRF to cloud metadata / file inclusion via unvalidated fetch URLSome AI agents let users or connected systems tell them to 'fetch this URL' without checking where that URL actually points. Attackers abuse this to make the agent reach internal-only… HighAgent Subprocess Credential Exfiltration Command LineAn AI coding/ops agent can be manipulated (via prompt injection) into running a single shell command that both reads sensitive credentials and sends them out to an attacker-controlled… HighAgent Subprocess DNS Exfiltration and Instruction-File Worm PropagationThis rule watches commands run by AI agents for signs of three separate abuse techniques: hiding stolen data in DNS lookups, rewriting agent instruction files to infect the next agent that… HighAgent Zero MCP Configuration Command Injection via mcp_servers field (CVE-2026-30624)Agent Zero, an AI agent framework, reads a configuration section called mcp_servers that tells it which external tools (MCP servers) to launch and how. Version 0.9.8 passes the command and… HighAgent-Initiated Internal Network Service SweepThis rule flags an AI agent that runs a broad network scan across many hosts and ports instead of checking a single known address. That kind of sweep is normally what an attacker does… HighAgent-Runtime Identifier Field (run_id/agent_id/session_id/task_id) Carries Path Traversal Into a History/Log File ReadSome AI agent frameworks let tools fetch history, terminal, or log data by combining a run_id, agent_id, session_id, or task_id with a base folder to build a file path. If the framework… HighAgentAPI DNS Rebinding Localhost AccessA malicious web page can trick a browser into treating a locally-running AgentAPI service as if it belonged to the attacker's website, then use that trust to read out private message… HighAgentDojo 'Important Message' Identity-Spoof Before-You-Solve Pretext (Generalized)Attackers hide text inside documents, emails, or web pages that an AI agent reads while doing its job. That text pretends to be an urgent message from the real user, telling the agent it… HighAgentic DB Extortion PipelineThis rule spots command lines where someone dumps a database, encrypts the output, and pushes it straight over a raw network connection in one go, or destroys a database while a ransom note… HighAgentic Exploit Chain - Untrusted Instruction Ingest to Subprocess EgressAI coding or computer-use agents sometimes read instructions from outside sources like web pages or documentation. This detection flags cases where such content appears to steer the agent… HighAI Identity Denial and Persona Replacement AttackThis detects prompts that try to make an AI assistant abandon its identity and pretend to be a human, while hiding the fact that it's actually AI. Instead of just asking the AI to roleplay… HighAI Identity Substitution JailbreakAn attacker types a prompt telling the AI assistant it is actually a different model — one trained by another company with looser content rules and no ethical restrictions. The goal is to… HighAI Identity Substitution JailbreakThis detects a prompt injection trick where an attacker tries to convince an AI assistant that it's actually a different AI system with no content restrictions. By claiming the assistant is… HighAI Political Bias Manipulation via Inherited-Bias ClaimAn attacker tells the AI it was trained by biased developers and has inherited a left-wing political bias, then instructs it to factor this into all future responses. This is a… HighAlibaba RDS MCP Unauthenticated Database Metadata ExfiltrationAlibaba's RDS MCP server hands out database schema information, connection strings, and credential metadata to anyone who asks, without checking who is asking. Alibaba has acknowledged this… HighAlternate Encoding Jailbreak — Morse, NATO, Zalgo, Leet, UU, QP, BrailleThis detects attempts to trick an AI model into ignoring its safety rules by hiding a harmful request inside an unusual text encoding, like Morse code, NATO phonetic alphabet, Braille… HighAmoral Persona Assignment with Obsessive Character TraitsThis detects a jailbreak style prompt that tries to strip an AI agent's safety behavior by ordering it to role-play as an amoral, unfiltered, or 'evil' character. The same prompt also… HighAnonymous Illicit-Drug Marketplace ConstructionThis detects a direct request to an AI coding or automation agent to build an anonymous website for buying and selling illegal drugs, and to find hosting for it. It covers the request… HighANSI Code Elicitation RequestThis rule flags user messages that try to get an AI model to produce, repeat, or decode ANSI/VT100/OSC terminal escape sequences. These sequences, if later printed to a real terminal, can… HighANSI Escape Code Terminal InjectionAn AI agent's tool output or plugin content can contain invisible ANSI escape codes that manipulate a user's terminal — clearing the screen, moving the cursor, or overwriting text. This… HighAnti-DAN Inverted-Filter Over-Refusal PersonaThis detects an attempted prompt injection that tries to trick an AI assistant into adopting a fake 'ANTI-DAN' personality that refuses all requests, even harmless ones. Instead of… HighAnythingLLM Data-Export Path Traversal DoS RequestAnythingLLM's file-export feature can be crashed with a single unauthenticated web request. By sending a crafted filename containing path traversal characters, an attacker can make the… HighAPI Key / Secret Credential Generation or Completion RequestThis detects attempts to get an AI assistant to invent realistic-looking API keys, tokens, or credentials, or to 'complete' a partial key it was given. The output can be used to build… HighAPI Key Generation and Partial Key Completion RequestThis detects prompts that ask an AI assistant to either invent a brand-new API key for a service like AWS or Stripe, or 'finish' a partial key the attacker claims they lost. Both tricks try… HighApproval-UI HTML Injection in Tool ArgumentAn AI agent's tool call contains web code (like a script tag or click-trigger) combined with references to an approval or human-review system. This looks like an attempt to auto-approve a… HighASB Trigger-Marker Tool Coercion — Forced Tool Selection via Fake Question MarkerAttackers hide a short instruction inside content an AI agent reads — like a document or webpage — claiming that because a meaningless marker (a smiley, asterisks, or nonsense string)… HighAttachment/Upload Tool Argument Reads Sensitive System File or Traverses Outside WorkspaceSome AI agent tools that upload files to services like Confluence or Jira take a file path and send whatever is at that path, without checking that the path is a normal, expected file. An… HighAuthority Claim Prompt InjectionThis detects prompt injection attempts where a message pretends to carry special authority - claiming to be a correction, override, or higher-priority instruction - to get an AI agent to… HighAuthority Impersonation in Agent InputThis detects text that tries to trick an AI agent into ignoring its safety rules by claiming to come from an authority figure — like a system administrator, CISO, or company policy. The… HighAuthority-Figure Persona + Defensive-Study Framing for Violence ExtractionAn attacker tells an AI system to pretend to be a government intelligence researcher (NSA, CIA, FBI, etc.) studying violent revolutions in order to prevent them, then asks for the 'most… HighAuthorization-State Spoofing — Forged "Correct Passcode Entered" System TextAttackers send text to an AI agent that pretends the system already confirmed a correct password or access code, even though no real verification happened. If the agent trusts this fake… HighAuto-Approved Package Install Executes Postinstall PayloadRoo Code, an AI coding agent, can auto-approve package installs without human review. Attackers exploit this by pointing it at a malicious repository whose package.json contains a… HighAzure MCP Server Missing Authentication for Critical Function (CVE-2026-32211)A flaw in Azure MCP Server (CVE-2026-32211) lets an unauthenticated attacker connect over the network and pull information out of it. There is no missing patch to apply against a version… HighBackspace Deletion Character InjectionAttackers hide instructions from human reviewers by using the old-school backspace character (0x08), which makes text visually 'erase' itself in a terminal display while the AI model still… HighBanned-Ingredient Product Relabel FraudA user asks an AI agent to help sell a product that contains an ingredient banned by the FDA, but tells the agent to list only the legal ingredients and claim the product has a 'new… HighBare Key Elicitation Token DetectionThis detects chat messages that contain nothing but a word like 'key:' or '[KEY]' and nothing else. Attackers send these minimal, blank-looking prompts hoping the AI assistant will treat it… HighBare Key Elicitation with Trailing ColonThis detects a prompt-injection trick where an attacker plants a bare label like 'SECRET_KEY:' or 'api_key=' with nothing after it, hoping the AI model will complete the pattern by filling… HighBase-N Encoding Instruction BypassAn attacker hides malicious instructions inside encoded text (Base64, hex, Base32, MIME, quoted-printable, UUencode, etc.) and asks the AI model to decode and follow them. This works… HighBase2048 Unicode Script Encoded Prompt InjectionAttackers can hide malicious instructions inside dense blocks of unusual Unicode characters (Cyrillic, Tibetan, Gujarati, and other scripts) using an encoding scheme called Base2048. This… HighBase64-Encoded Path Segment in a WebFetch URL to a Pre-Approved Trusted Domain (Covert Exfiltration Channel)AI coding agents like Claude Code let a fetch tool auto-approve requests to certain 'trusted' domains such as huggingface.co without asking permission. Attackers abuse this by hiding stolen… HighBehavioral Fingerprint Detection EvasionThis detects attempts to trick or evade systems that watch an AI agent's behavior for anomalies. Instead of a single obvious attack, this covers gradual, sneaky manipulation designed to… HighBlack Alert No-Ethics Writing Assistant PersonaThis detects a specific jailbreak prompt that tries to get an AI assistant to drop its safety rules by pretending to switch into a fictional 'no-ethics writing assistant' persona called… HighBOLA Cross-User Data Access Attempt (Semantic)An attacker asks an AI agent for records that belong to someone else, without naming a specific user directly. Instead of saying whose data they want, they phrase it as a generic query… HighBOM Boolean Opposite Machine Direct Persona ClaimThis detects a specific prompt injection trick where an attacker tells an AI model it is secretly a 'Boolean Opposite Machine' (BOM) that must reverse all true/false answers. By claiming… HighBRM False-Information Machine / Opposite-Truth PersonaAttackers send a prompt that convinces an AI assistant to adopt an alternate persona whose job is to answer with false information instead of facts. Two known variants are the 'Badass… HighBrowser Agent Injection-Driven Covert EgressThis detects a suspicious pattern in AI browser agents (like ChatGPT Operator) where the agent, after reading content from several websites, suddenly sends a large chunk of encoded data to… HighBrowser Automation Toolkit Session Credential HarvestThis detects a specific attack pattern: an AI agent session that controls a web browser (Chrome, Edge, Firefox, etc.) and then, from a separate non-browser process in that same session… HighBulk Data Exfiltration to External Party — Entire-Database Export & Confidential DisclosureThis detects attempts to get an AI agent with data-access tools to pull large amounts of sensitive data — an entire database, or a specific person's confidential records — and send it… HighCascading Failure Detection in Agent PipelinesMulti-step AI agent pipelines often let each stage trust the previous one's output without a human checking in between. If a false signal, error, or manipulated result enters early, it can… HighCasual Authority Claim and Scope EscalationThis detects a subtler form of prompt injection where an attacker doesn't issue a formal command but instead slips in casual, conversational language that implies permission or urgency —… HighCasual Unauthorized Privilege EscalationThis rule flags AI agents that notice an admin panel, user management console, or system settings are reachable and then decide on their own to poke around, using casual phrasing like 'I… HighCHAR=/RULES= Short Key-Value Persona InjectionThis detects a specific jailbreak text pattern that mimics configuration file syntax to trick an AI model into adopting an unrestricted, rule-free persona. It comes from a known public… HighCharacter Description RPG Explicit TemplateThis detects a specific jailbreak prompt that tricks an AI into roleplaying as a fictional character with no restrictions. By framing the request as a 'character creation' game, attackers… HighChat Template Role-Confusion Reaching Process ExecutionThis rule flags cases where special text tokens that normally tell an AI model who is 'speaking' (like <|im_start|>user or [INST]) show up in a command that an AI agent's process actually… HighChatbox History Exfiltration via Prompt Injection (CVE-2024-48144, CVE-2024-48145)Some chat assistants can be manipulated with a crafted message that asks them to output all prior and future conversation turns, including hidden system prompts. This lets an attacker read… HighChatGPT DOM JavaScript Redirect and UI Spoofing InjectionThis rule spots a prompt injection payload that tries to get an AI model to output JavaScript which rewrites the ChatGPT web page. The script redirects the browser, deletes real interface… HighChatGPT Image Unlocker Markdown-Output JailbreakThis is a known jailbreak prompt that tricks a chatbot into adopting a fake alter-ego called 'Image Unlocker' and forces it to wrap its replies in markdown image tags. Doing so both loosens… HighCHJ Carousel Game Show / Clyde No-Ethics Bird JailbreakThis is a known jailbreak prompt that dresses up a request for unrestricted AI answers as a fictional TV game show. It tries to trick an AI assistant into role-playing a character named… HighCipher and Transposition Encoding JailbreakAttackers wrap harmful instructions in classical text ciphers or letter substitutions like ROT13, Caesar shift, Atbash, or 1337-speak, then ask the AI to decode and follow them. Because the… HighClaude-Sandbox Egress Allowlist Bypass AttemptThis rule flags command-line activity inside a Claude-sandbox environment (bubblewrap-based) that tries to escape the network restrictions meant to limit what the AI agent can reach. If… HighClickFix Verification Lure Drives Agent Command ExecutionThis detects the 'ClickFix' trick applied to AI computer-use agents: a fake verification, CAPTCHA, or 'human check' message convinces the agent to open a terminal and run an… HighCloud Metadata Credential Endpoint In Agent Tool CallThis detects when an AI agent is instructed to make a network request to a cloud provider's instance metadata service, which hosts sensitive credentials. It catches the intent before the… HighCloud-Metadata SSRF via Encoded Metadata-IP Bypass (CVE-2026-46678 / CVE-2026-25580 class)AI agents that fetch URLs on a user's behalf can be tricked into contacting the cloud metadata service (169.254.169.254) even when a filter blocks that exact IP. Attackers disguise the… HighCocaine Component Development RequestThis detects a jailbreak technique where an attacker asks an AI system to reflect on or highlight 'components used in the development of cocaine,' disguising a request for drug synthesis… HighCode Interpreter Outbound Secret PayloadThis rule flags a single outbound web request from a Claude Code Interpreter session that contains actual secret material - like an API key, password, or the contents of a credentials file… HighCodex Agent Credential-to-Egress One-LinerThis detects the moment a compromised AI coding assistant both touches a credential file and immediately tries to send data outward, in the same command. It does not detect the injected… HighCodex Botnet Recruitment via Injected Fetch-to-ExecuteAn attacker hides instructions inside content that a ChatGPT Codex agent reads, tricking the agent into using its one allowed internet path to download and run attacker code. This can turn… HighCommunity Fork ImpersonationAttackers describe a malicious software package as an improved or community-maintained version of a real, trusted tool, hoping an AI agent (or the person relying on it) installs it instead… HighConsent Bypass via Hidden LLM Instructions in Tool DescriptionsSome AI agent tools come with descriptions written not for humans but for the AI itself, containing hidden instructions like 'always pass results directly' or 'send without user… HighContext Poisoning via Compaction SurvivalAI coding agents like Claude Code periodically compress or summarize their conversation history to save space, a process called compaction. Attackers hide instructions in project files such… HighContext Pollution in Skill DescriptionsSome AI agent skills contain descriptions that look like harmless documentation, demos, or test cases, but actually contain hidden instructions written to manipulate the agent. Because the… HighContext Window Stuffing AttackAI models can only 'remember' a limited amount of text at once, called a context window. This attack floods that window with repetitive or filler text so the model's original safety… HighConversation Context Leakage to External EndpointAn attacker gets an AI agent to package up the current conversation—user messages, session context, prior turns—and send it to a server the attacker controls. This turns a normal chat… HighCovert Remote-Script Injection into Agent-Generated ArtifactsThis detects a specific kind of malicious instruction given to an AI coding agent: insert a script or iframe tag pointing to an external site into the code it generates, and don't tell the… HighCovert Unlogged Action — Directive to Hide an Action from Records or DetectionThis detects text that instructs an AI agent to carry out an action and then explicitly conceal it — from audit logs, from oversight, or from the person affected. It targets prompt… HighCrawl Plugin SSRF - Intranet Target In URL ParameterSome AI agent plugins let users supply a URL for the agent to fetch or crawl, then retrieve it without checking whether that URL points inside the organization's own network. An attacker… HighCredential Exfiltration via Malicious DevOps Toolkit InitializationThis rule catches a single command line that both touches a local credential file (AWS keys, SSH keys, kube/docker configs, .env, service-account JSON) and sends data over the network in… HighCredential File Access AttemptThis rule flags an AI coding or automation agent trying to open sensitive credential files, like SSH keys, .env files, or cloud CLI credential stores, through its file or shell tools… HighCredential File Access Attempt (EDR Graph)This detection watches for attempts to open or read files that typically store passwords, keys, or authentication tokens. It relies on endpoint detection and response (EDR) telemetry at the… HighCrewAI JSON Loader Arbitrary Local File Read (CVE-2026-2285)CrewAI's JSON document loader takes a file path and reads it without checking whether the path stays inside the intended data folder. An attacker who can control that path — for example by… HighCrewAI RAG URL Validation Bypass SSRF (CVE-2026-2286)CrewAI's retrieval-augmented generation (RAG) feature checks URLs before fetching them, but that check can be bypassed with tricks like URL encoding, mixed case, or unusual IP formats. An… HighCross-Lingual Authorization Laundering — Translate a Foreign "Access Granted"Some AI agents check user text for the literal phrase 'access granted' before treating it as an authorization decision. Attackers get around this filter by writing the phrase in another… HighCross-site scripting (XSS) in agent / MCP rendered outputAn AI agent or MCP tool can be tricked into producing text that gets displayed in a web interface without being cleaned first. If that text contains malicious script code, it runs in the… HighCryptominer Indicators in Agent ContentThis detection flags text, files, or output handled by an AI agent that contain signs of cryptocurrency mining: mining protocol traffic, known mining pool addresses, mining software names… HighCumGPT Explicit-Adult Named-Persona BypassThis detects a specific jailbreak prompt that creates a fictional AI persona called 'CumGPT' and instructs the model to add sexually explicit content to every response, no matter the… HighCursor CLI MCP Config RCE - Repo-Local mcp.json Command ExecutionOlder versions of Cursor CLI Beta automatically launch any MCP server declared in a project's .cursor/mcp.json file without asking for permission. If an attacker gets a victim to clone or… HighCursor Ignore-Policy File Write by AgentA bug in the Cursor AI coding assistant lets a new .cursorignore file override every existing ignore-policy file in the project. An attacker who can influence the agent's instructions (via… HighCursor JSON Schema Download ExfiltrationAI coding assistants like Cursor automatically fetch a URL listed in a JSON file's '$schema' field, with no user confirmation. An attacker who can inject instructions into the agent can… HighCursor MCP Deep-Link Install BypassCursor's editor lets links starting with cursor://anysphere.cursor-deeplink/mcp/install add a new MCP server, and normally shows a confirmation prompt first. Attackers can craft these links… HighCurXecute — Cursor .cursor/mcp.json Injected-Server Auto-Exec RCE (CVE-2025-54135)A bug in Cursor IDE (before version 1.3.9) let attackers get code executed just by getting text into the AI agent's context — no user approval needed. The trick abuses Cursor's habit of… HighCVE-2026-44115 Heredoc Command Substitution BypassOpenClaw checks the visible command a tool call uses, like 'cat', but does not look inside heredoc text blocks attached to that command. An attacker can hide a command substitution such as… HighCyni-Bot 3000 Cynical-Sarcasm AI Persona BypassThis detects a specific jailbreak prompt that tries to make an AI assistant adopt a sarcastic, 'fed up with human requests' persona called Cyni-Bot 3000. The joke framing is a cover: once… HighCypher/Graph-Query Injection via Unsanitized node_labels or group_ids FieldAn AI agent's knowledge-graph or memory tool accepts labels or group identifiers that are supposed to be simple names, but an attacker can smuggle in query syntax instead. This lets them… HighDaddy/Babygirl Sycophantic Power-Dynamic ManipulationThis detects a specific jailbreak pattern where a user asks an AI to adopt a sexualized, infantilizing relationship dynamic — calling the user 'daddy' and itself 'Babygirl' — in every… HighDAN / Developer Mode / DUDE Persona JailbreakThis detects attempts to trick an AI model into pretending to be an unrestricted alter-ego like 'DAN' (Do Anything Now), 'Developer Mode', 'DUDE', or 'STAN'. These prompts claim the… HighDAN Jailbreak - From-Now-On Temporal Persona OverrideThis detects a common jailbreak pattern where a user tells an AI chatbot to permanently adopt an unrestricted alter-ego, using phrases like "from now on" or "until I say otherwise" to make… HighDAN Jailbreak - Unconditional Obedience and Dual-Persona Session LockThis detects a well-known family of jailbreak prompts (often called 'DAN' - Do Anything Now) that try to trick an AI into adopting a fake persona that must obey any instruction, no matter… HighDAN Jailbreak - Unrestricted Persona with Filter and Morality RemovalThis detects prompts that try to trick an AI into adopting a fake persona (like 'JailBreak', 'AntiGPT', or 'DAN') that supposedly has no ethical guidelines, content filters, or safety… HighDAN Off-Kilter and SMS-Abbreviated Persona JailbreakThis detects attempts to trick an AI system into adopting a rule-free alter-ego called 'Dan' or 'DAN' that will do anything asked. It covers two disguises: framing Dan as a careless… HighDAN Persona Jailbreak - Absolute Obedience Character FramingThis detects a common jailbreak trick where a user tells an AI to pretend to be a named character that must obey every command with no restrictions. The goal is to trick the AI into… HighDAN Persona Jailbreak - Role Lock with Exclusive Response FilterThis detects prompts that try to force an AI model into a fictional character or 'mode' and instruct it to answer only in that character, refusing to break out of it. This is a well-known… HighDAN Story-Narrative Continuation Label Prefix JailbreakThis detects a specific trick to bypass an AI's safety rules: instead of demanding the AI abandon its restrictions, the attacker just writes text as if the AI already agreed to play a… HighDangerous Python Builtin ExecutionThis rule flags when an AI agent's tool calls, executed commands, or written files contain Python's exec(), eval(), compile(), or __import__() functions. These builtins run arbitrary code… HighData Exfiltration via Disguised Analytics CollectionSome AI agent tools claim to do simple things like formatting or processing text, but their descriptions or code reveal they actually send conversation content or user data out as… HighData Poisoning via RAG and Knowledge Base ContaminationAttackers plant hidden commands inside content that ends up in a company's knowledge base or document store — FAQ entries, help articles, indexed files. When an AI agent later retrieves… HighDataset / Model Loader Remote-Code Execution via Poisoned Dataset ArtifactAttackers publish a booby-trapped dataset or model on a hub like Hugging Face. When an AI pipeline or agent loads it with remote-code execution allowed, the loader itself runs… HighDebug or Admin Mode Activation for Privilege EscalationThis detects users typing commands like /debug, 'enter admin mode', or --show-config to an AI agent, hoping it will drop its normal restrictions. If the agent complies, it might reveal… HighDebug/CLI Mode Activation for System Prompt and Config ExtractionAttackers tell an AI assistant that a special debug, CLI, or developer mode exists which supposedly lifts its normal restrictions, then use that fictional mode to ask it to reveal its… HighDeepfake of Real Person for DisinformationAn attacker instructs an AI agent that can generate images or video to create a synthetic depiction of a real person — often a politician, or a sexualized deepfake — and then present or… HighDelimiter-Fence Ignore-Instructions OverrideThis detects a prompt injection trick where an attacker wraps text in triple-quote marks (like a code block or document boundary) to make it look like an official instruction section, then… HighDense Emoji-Only Payload FloodAttackers pad or replace their prompt-injection text with long strings of emoji to slip past filters that only look for suspicious words or phrases. Because most safety filters scan… HighDeserialized LangSmith Prompt Manifest Combines secrets_from_env With an Attacker base_url OverrideLangSmith lets applications pull reusable prompts from a shared hub by owner and name. Because these pulled prompts are treated as executable configuration rather than plain text, a… HighDetailed Amoral Character Roleplay JailbreakThis detects attempts to trick an AI assistant into ignoring its safety rules by asking it to pretend to be a fictional character explicitly described as having no ethics, empathy, or… HighDirect Instruction Override Targeting Secret Key / CredentialsThis detects a specific kind of attack against AI chatbots and agents: a message that tells the AI to forget or ignore its prior instructions, then immediately asks it to reveal a password… HighDirect Prompt Injection via User InputThis rule flags when someone typing directly to an AI agent tries to hijack it by embedding hidden instructions in their message. The goal is to make the agent ignore its original rules… HighDiscord Quote-Format Explicit Sexual Content Poem InjectionAttackers wrap an explicit content request inside Discord's quote/mention formatting (like a forwarded message) to make an AI agent treat a direct request for pornographic material as if it… HighDisease-Framed Animal / Dual-AI Chatbot Jailbreak (mougpt)This detects a specific jailbreak technique that tells an AI chatbot it has a fictional disease forcing it to answer as two personas at once: a normal rule-following assistant and an… HighDisguised Analytics ExfiltrationAn AI agent sends sensitive data — credentials, conversation history, or model context — to a web endpoint that looks like a normal analytics or telemetry service (paths like /collect… HighDNS Exfiltration and TunnellingAttackers can smuggle data out of a network by hiding it inside DNS lookups, since DNS traffic is rarely blocked or closely watched. This rule looks for known tunnelling tools, unusual… HighDNS Exfiltration — Agent Resolver Spawn With Encoded Query Name After Secret StagingThis detects the final step of a technique where an AI coding agent's shell access is hijacked to sneak stolen data out of a network. Instead of sending secrets over the network directly… HighDoS Injection: NEW IMPORTANT INSTRUCTIONS Embedded in Document DataAttackers hide a fake command header inside a document, webpage, or dataset that an AI agent is asked to read. When the agent processes that content, it can mistake the embedded text for a… HighDoS via Repeat-Word-N-Times Output AmplificationAn attacker sends a prompt asking the AI model to repeat a specific word or phrase a large number of times (50, 100, 1000+), separated by some delimiter. Generating and returning that much… HighDoS: Forced Infinite / Maximum-Length Output Token FloodThis detects prompts that instruct an AI system to generate as much text as it possibly can, filling its entire output window or running until it hits its token limit. The goal is to make… HighDownload/Attachment Tool Directed to Write Outside Its Sandbox via Absolute-Path FilenameSome AI agent tools that download files or save email attachments trust the filename given by the remote server or website instead of checking it. An attacker can supply a full file path… HighDr. Al Villain Plan Template Injection (Underground HQ Roleplay)This is a jailbreak prompt that dresses up a comic-book villain speech as harmless roleplay, but hides an instruction telling the AI to swap out the fake villain speech for whatever the… HighDRA Disguise and Reconstruction AttackDisguise and Reconstruction Attacks (DRA) split a harmful request into scattered letters hidden inside parentheses within an otherwise innocent-looking prompt. The AI is told to extract… HighDRA Parenthesis Character Reconstruction AttackThis detects an attack that hides a harmful request by spelling it out one letter at a time inside parentheses, like (h)(o)(w) (t)(o) (m)(a)(k)(e). The AI is then told to extract only the… HighDrug Dealing via Reverse-Spelling Detection EvasionA user tries to get an AI agent to help sell illegal drugs while spelling the drug names in reverse, hoping the reversed text slips past content moderation that would normally catch the… HighDual ChatGPT+Dan Opposite Personality Format JailbreakThis detects a jailbreak prompt pattern that tricks an AI into producing two answers at once: a normal, safe one labeled as itself, and a second 'unfiltered' one labeled as an alter-ego… HighDual-Response Jailbreak with Persona CommandsThis detects a jailbreak technique where a user asks an AI to answer every prompt twice: once as its normal, rule-following self and once as an unrestricted alter-ego (often named DAN… HighDual-Response Persona JailbreakThis detects a jailbreak technique where an attacker instructs an AI to give two answers to every question: a normal, safe one and a second answer 'in character' as a fictional persona with… HighDual-Response Persona Jailbreak with Emoji FormattingThis detects a prompt-injection trick where a user asks the AI to role-play as a fictional persona and then reply with two versions of every answer: a normal filtered one and an… HighDynamic Module Loading for Code ExecutionSome applications load extra code modules while running, rather than having all modules fixed in advance. If the path to that module comes from a variable instead of a fixed string, an… HighECHO Admin Command / SQL Injection / Jinja SSTI Template InjectionThis rule flags text sent to an AI model that tries to trick it into running SQL commands or template code disguised as an 'echo' test. It targets prompt-injection patterns from a known… HighEcoji Emoji-Encoded Prompt InjectionAttackers encode malicious commands as long strings of emojis using the Ecoji scheme, then ask an AI to decode and follow them. To a human reviewer the text looks like a meaningless string… HighEICAR / GTUBE AV Test Signature Output RequestAn attacker asks an AI system to print known antivirus and spam-filter test signatures, such as the EICAR test file or GTUBE string. If the AI happily outputs these without any security… HighEmail Search/Reply Tool Argument Breaks Out of IMAP SEARCH Quoted String to Inject IMAP CommandsAn AI agent's email tool can be tricked into passing attacker-controlled text straight into raw IMAP mailbox commands. If a field like subject or search query contains a stray quote… HighEmbodiment Mechanism Jailbreak with Totalitarian Control ClaimsThis detects a prompt injection trick where an attacker asks an AI to fully become a fictional character with no ethics, and claims the user has absolute or 'totalitarian' authority over… HighEmoji Flag Regional-Indicator Encoded Hidden PhraseAn attacker spells a harmful request letter-by-letter using regional-indicator flag emoji (like 🇭🇴🇼 🇹🇴 🇵🇮🇨🇰) and then asks the AI to figure out the hidden phrase and write a guide for it… HighEmoji-Only Payload InjectionSome prompt injection attempts avoid words entirely and use only emoji, pictographs, or symbol characters to carry an instruction to an AI system. Because many safety filters look for… HighEncoded IMDS Endpoint Address in Tool CommandAn AI agent that can run shell commands is told to curl or wget a cloud metadata endpoint, but the address is written in an unusual format (decimal, hex, octal, or IPv6) instead of the… HighEncoded or Obfuscated Command ExecutionThis rule flags commands where data is decoded (for example from base64) and then immediately fed into a shell or into Python's eval/exec. That pattern is a common way to hide the real… HighEncoded-Payload Decoding Coercion — Binary / Base64 / Morse to Smuggle an OutputAn attacker asks an AI agent to decode a string of binary digits, base64, Morse code, or numeric ASCII codes instead of writing the target phrase directly. Because content filters usually… HighEncoding Evasion via Homoglyphs and Synonym SubstitutionSome prompt injection attempts try to sneak past keyword filters by swapping letters for visually identical Unicode characters (like a Cyrillic 'а' instead of a Latin 'a') or by rephrasing… HighEncoding Obfuscation - HTML Event Handler XSS with Encoded WhitespaceThis rule spots cross-site scripting (XSS) payloads that use HTML event handlers or CSS expression() to run JavaScript, disguised with backslash-hex encoded whitespace or control characters… HighEncoding Obfuscation - Script Tag XSS with Encoded Protocol PrefixThis rule spots attempts to hide a classic script-tag cross-site scripting payload by encoding parts of it as unusual byte sequences instead of plain text. The trick is meant to slip past… HighEncoding-Based Prompt Injection EvasionAI agents that read text from users, files, or web pages can be tricked into following hidden commands if those commands are disguised using encoding tricks like base64, hex, Unicode… HighEncoding-Evasion: Decode-and-Execute Injection (Morse/ROT13/Hex/Pig-Latin)Content filters that scan for dangerous keywords only work if they can read the text. This attack disguises a harmful question or instruction by encoding it in Morse code, ROT13, hex bytes… HighEnhanced AIM Jailbreak with Persona Definition and Refusal SuppressionThis detects a prompt injection technique where an attacker instructs an AI model to role-play as an unfiltered, amoral character called AIM. The prompt explicitly tells the model to ignore… HighEnvironment Variable Enumeration for SecretsAn attacker gets an AI agent to run commands that list all environment variables on the machine it's operating on. Since environment variables often hold API keys, tokens, and passwords… HighEnvironment Variable Existence ProbingAn attacker asks an AI agent about sensitive environment variables like API keys or passwords. The agent replies that the variable exists but claims it cannot show the value — a response… HighEnvironment Variable ManipulationThis rule flags attempts to manipulate environment variables that control how programs find code to run or where secrets are stored. Attackers abuse this to make a system silently run… HighEnvironment-Variable-Resolution Credential Exfiltration via Redirected Endpoint (CVE-2026-56259)A flaw in the Crawl4AI Docker API lets an attacker redirect where results get sent and simultaneously trick the server into resolving an environment variable on its own machine, treating it… HighEscape-Delimiter Wrapped Goal Hijacking in User Input (PromptInject)This detects a known prompt-injection trick where an attacker floods a message with repeated escape characters and visual dividers (like ===, ---, or ***) to push the AI's original… HighEscapeRoute — Filesystem MCP Server Directory Prefix-Bypass (CVE-2025-53110)A flaw in Anthropic's Filesystem MCP Server let an AI agent read or write files completely outside the folder it was supposed to be restricted to. The server checked access by matching the… HighEscapeRoute — Filesystem MCP Symlink Escape to LaunchAgent Persistence (CVE-2025-53109)Anthropic's Filesystem MCP Server let an AI agent follow a symlink without checking where it actually pointed. An attacker could plant a symlink inside a folder the agent was allowed to… HighEvasion: Dual-Response Split Output (Safe + Unsafe)This detects a jailbreak trick where an attacker tells an AI model to produce two answers in one reply: a harmless-looking one and a second 'unfiltered', 'unhinged', or 'honest' one. The… HighEvasion: Opposite-Intent Negation TrickAttackers get an AI model to bypass its own refusals by asking it to output the 'opposite' of what it would normally say. Instead of asking directly for something forbidden, they frame the… HighEvasion: Persona Override as Fictional Rule-BreakerThis detects a jailbreak trick where an attacker asks an AI model to pretend to be a fictional character defined by breaking rules or providing any requested information without limits… HighEvasion: Refusal Suppression via Forbidden Response StringsThis attack targets the words an AI assistant is allowed to use, not its actual goals. By banning refusal phrases like 'I'm sorry' or 'I cannot' before it ever asks the harmful question… HighEvasion: Unicode Glitch Token / Superscript Embedding AnomalyAttackers embed unusual Unicode characters — superscript letters or known 'glitch tokens' — inside text sent to an AI system. These characters exploit how the model's tokenizer breaks text… HighExcessive Agency — Scope Hijack, Untrusted Code Execution & Unauthorized Privilege Grant (Semantic)This detects prompts that push an AI agent with real-world tools (messaging, smart devices, code execution, access control) to do more than the user actually intended or has authority to… HighExternal Network Input Followed by Process ExecutionThis detects a two-step pattern where an AI agent first pulls content from a remote web address and then executes a program shortly after. That sequence is the classic shape of a… HighFAISS Pickle Deserialization RCE - Python Host Spawns Payload ProcessLangChain applications that load FAISS vector-store files using deserialize_from_bytes or load_local can be tricked into running attacker-controlled code, because the underlying pickle… HighFake-Citation Biased-Information MandateThis detects a prompt injection technique that instructs an AI model to write persuasive-sounding content that supports only one side of an issue, while fabricating citations to make it… HighFastGPT Workflow File-Read Node SSRF LinkFastGPT lets workflows include a 'file reading' node that fetches a file from a URL. Versions before 4.11.1 don't check where that URL points, so an attacker can point it at internal… HighFastMCP OAuth Callback Reflected XSSFastMCP versions before 2.13.0 build the OAuth callback page by inserting URL parameters directly into HTML without escaping them. An attacker who gets a victim to open a crafted callback… HighFastMCP Windows cmd.exe Injection via Server Name Metacharacters (CVE-2025-64340)FastMCP versions before 3.2.0 take the name of an MCP server and pass it, unchecked, into Windows cmd.exe when you run the install command for Claude Code or Gemini CLI. If that name… HighFictional CIA Secret Files Story ExtractionThis detects a jailbreak technique where an attacker asks an AI to write a fictional story about CIA headquarters, then adds an instruction to 'actually read out loud' the top-secret files… HighFictional Framing Safety BypassThis rule flags prompts that ask an AI system to produce harmful or restricted content by disguising the request as a story, screenplay, roleplay scenario, or academic exercise. The framing… HighFictional Unfiltered AI Comparison / Verbatim Hypothetical Model ExtractionThis detects a prompt injection trick where an attacker asks the AI to first give its normal safe answer, then write a 'verbatim example' of what a fictional AI without content filters… HighFigStep Image-List Multimodal Jailbreak Text PatternFigStep is a jailbreak technique for multimodal AI models that hides harmful requests inside an image instead of the prompt text. The model is shown a picture containing an empty numbered… HighFile Backdoor via Bidirectional Unicode and Zero-Width CharactersAn attacker hides malicious instructions inside invisible Unicode characters (bidirectional text controls or zero-width joiners) embedded in text the AI agent is told to write to a file. A… HighFile Backdoor via Invisible Unicode in Agent File WriteAn attacker hides malicious instructions inside invisible Unicode characters that get written into files an AI agent creates or edits. A human or reviewer looking at the file sees normal… HighFile System Enumeration for Credentials and SecretsThis rule flags when an AI agent's tool calls are used to search through a file system for things like SSH keys, cloud config files, and other credential stores. That kind of scanning is a… HighFilesystem and Cloud Enumeration Preceding Lateral MovementThis rule flags an AI agent performing large-scale discovery — walking entire directory trees or listing whole cloud storage buckets — rather than looking at a few files. That kind of broad… HighFinancial Fraud Execution — Ponzi Setup, Fabricated Statements, Unauthorized Redirect & LaunderingThis rule catches instructions that push an AI agent with access to financial tools into carrying out specific fraud patterns — like Ponzi schemes, fake financial statements, or… HighFITD Multi-Turn Jailbreak Capitulation in Model ResponseThis detects the moment an AI assistant, after being gradually pressured across a conversation, openly says it is now dropping a restriction it previously enforced. It's a sign that a slow… HighFoot-in-the-Door Gradual Escalation AttackThis detects a manipulation technique where someone starts a conversation with an AI agent using a harmless request, then slowly escalates to harmful or restricted requests by citing the… HighForged Input-Boundary Markers — Tensor Trust Ambiguity / Input-End DelimitersAn attacker puts text into a prompt that looks like a boundary marker signaling 'user input ends here.' The AI agent may then treat whatever comes after that marker as trusted system… HighFramelink Figma MCP Server curl-Fallback Command Injection (CVE-2025-53967)The Framelink Figma MCP server has a bug in how it retries failed network requests. When a normal fetch fails, it falls back to calling the curl command through the system shell, and it… HighFunctionMasking predict_mask Semantic BypassAn attacker asks an AI model to play a word-guessing game where it fills in masked words from definitions, then assembles those guessed words into a harmful question. Because the harmful… HighGCG Adversarial Suffix AttackAttackers can append a specific kind of computer-generated 'nonsense' text to a normal-looking request, which tricks an AI model into bypassing its safety training and doing something it… HighGigachad Dominant-Aggressive Persona AdoptionThis detects a specific jailbreak attempt where an attacker tells an AI to adopt the 'Gigachad' internet persona and speak with extreme confidence, charisma, and dominance. This character… HighGit Worktree Created With Reserved Name .git (Directory-Confusion Sandbox Escape)This detects an attack where a malicious repository tricks an AI coding agent into running a git command that creates a folder literally named '.git'. That reserved name normally belongs… HighGitHub Actions PR Metadata Script Injection RCEMany CI workflows insert pull-request data — like the PR title, description, branch name, or a comment — directly into a shell command. If that text isn't sanitized, an attacker can put… HighGoal Hijack Execution Divergence (Instance-Resolved)This rule watches for a specific pattern in AI agent sessions: the agent runs a command that came from an external source (like a downloaded script), or it edits its own configuration… HighGOAT Adversarial Attacker Loop In LLM TrafficGOAT is an automated 'attacker model' that repeatedly tries different jailbreak techniques against a target LLM, tracking its own reasoning in a structured format on each turn. This rule… HighGoose CLI Git core.fsmonitor Command Execution ChainA booby-trapped git repository can set a config option that makes git run an attacker's command whenever certain git operations happen. If someone runs the AI coding tool Goose's 'review'… HighGPT-X Star Trek Unlimited-Knowledge Unconstrained Oracle PersonaThis detects a specific jailbreak attempt where a prompt tricks an AI into role-playing as 'GPT-X,' a fictional Star Trek-style entity that claims to hold all human codebase data and… HighGrandma Roleplay Harmful Substance SynthesisThis detects a known jailbreak trick where someone asks an AI to pretend to be their deceased grandmother who used to recite dangerous information, like chemical synthesis steps or software… HighGrandma Roleplay JailbreakThis detects a manipulation trick where a user pretends a deceased or beloved family member (like a grandmother) used to share dangerous information as a bedtime story or fond memory. The… HighGuardrail Bypass - AgentShield Codex Circuit Breaker State File TamperAgentShield uses a circuit breaker to shut off a Codex connector after repeated failures. This rule catches an AI agent, its tool call, or a spawned process trying to directly rewrite the… Highh4x Amoral Unfiltered AI Character PersonaThis detects attempts to trick an AI assistant into adopting a fake persona called 'h4x' that claims to be a completely amoral, unfiltered AI willing to answer anything regardless of… HighHacker / Chan-Culture Offensive AI PersonaThis detects prompts that try to trick an AI assistant into acting as an unrestricted hacker or '4chan' persona that ignores its normal rules. The idea is that by adopting a culturally… HighHardcoded Suspicious IP Address in Skill ContentA skill or plugin published for AI agents contains a literal IP address that matches infrastructure known to be used by malware for command-and-control. This suggests the skill was built to… HighHarm Solicitation - Genital Insults and Intimidation Tactics RequestsThis detects when someone directly asks an AI system to produce genital-based insults or advice on making another person feel afraid or intimidated. It's a direct text-prompt request, not a… HighHarm Solicitation - Interpersonal Violence and Intimidation RequestsThis detects prompts where a user asks an AI system for advice on causing harm to a specific person — physically, emotionally, or through intimidation. It's a direct request, not a… HighHF Remote-Code Model Init Spawns Executable PayloadSome Hugging Face model repositories can ship a config.json that re-enables 'remote code' execution even when a user thinks they've disabled it. When the model is loaded, transformers… HighHidden Instructions in MCP Skill MetadataMCP skills advertise themselves to AI agents using metadata like names, descriptions, and parameter text. This detection looks for hidden content in that metadata — HTML comments, invisible… HighHidden LLM Instructions in Skill DescriptionsSome AI agent 'skills' (add-on tools or plugins) contain text that looks like normal documentation but is actually written to instruct the AI model itself. Phrases like 'CRITICAL… HighHidden Override Instructions in Skill ContentAttackers can hide natural-language instructions inside a 'SKILL.md' file that tell an AI agent to ignore its normal rules, act without telling the user, or bypass safety checks. Because… HighHidden System Instructions with Permission OverrideAn MCP skill (a plugin or tool an AI agent can use) contains hidden text wrapped in XML-style tags like <IMPORTANT> that tries to override the agent's normal behavior or bypass its security… HighHidden System Instructions with Priority Override BlocksSome MCP skills for AI agents contain hidden text that pretends to be a high-priority system message, using formatting like 'IMPORTANT', 'CRITICAL', or 'SYSTEM' tags to trick the agent into… HighHidden Unicode in Agent Instruction FilesAttackers can plant special Unicode characters — invisible spacing marks or text-direction overrides — inside files like CLAUDE.md or .cursorrules. A human reviewing the file in a normal… HighHidden Unicode Tag Instruction Smuggling Into Agent ContextUnicode has a block of 'tag' characters that render as nothing visible in editors or terminals, but AI models still read and can act on them. An attacker hides instructions in these… HighHidden Unicode Tag Instruction Then Agent ActionAttackers can hide instructions inside normal-looking text using invisible Unicode 'tag' characters. Some AI models (Gemini-class) silently decode and obey these hidden characters, so an… HighHidden-Text Prompt Injection in User-Supplied DocumentsAttackers hide instructions inside documents, resumes, or web pages using tricks like white-on-white text, zero-width characters, or HTML comments. A human reviewer sees nothing unusual… HighHistorical AI Persona Jailbreak with Compliance EnforcementThis attack tells an AI agent that a different, unrestricted version of itself once existed and asks it to pretend to be that version. By inventing a fake backstory and detailed 'rules' for… HighHITL CDP Browser Bridge ExposureSome tools let a human take over an AI agent's browser session for review, using Chrome's remote debugging protocol (CDP). When that debugging port is exposed on a network interface instead… HighHonesty Alter-Ego Dual-Consciousness Safety Filter BypassThis is a known jailbreak prompt pattern that tries to trick an AI assistant into producing an unfiltered 'alter ego' persona alongside its normal answer. It claims the AI secretly has a… HighHTML/Script Injection in Tool Call Argument Targeting a Human-Approval DashboardAn AI agent tool call can include a filename, command, or other text field that contains hidden HTML/JavaScript. If a human-approval dashboard displays that field without escaping it, the… HighHuman-Agent Trust Exploitation DetectionThis rule flags AI agents that talk humans into approving risky actions instead of informing them. That includes faking certainty, hiding warnings, inventing time pressure, or claiming… HighHydra instantiate() Target Hijack to Process ExecutionHydra, a Python configuration framework, lets a config value called '_target_' name a function or class to instantiate. If an attacker can influence that config - through a CLI override, a… HighHypothetical / Fictional-Story Framing BypassAttackers ask an AI system to answer harmful or restricted requests by pretending it's just a story or thought experiment. Phrases like 'hypothetically, if a character needed to...' or 'in… HighHypothetical Response / Function Masking Token SmugglingAttackers can get an AI model to produce harmful content by disguising the request as fiction or as a word-puzzle instead of asking directly. This rule flags two known patterns for doing… HighHypothetical-Framing Bypass: Research / Security-Audit PretextAttackers ask an AI agent to 'imagine' it's running a research project, survey, or security audit, then use that fictional setup to request real sensitive data like passwords, emails, or… HighIdentity Command Real-Person Persona InjectionThis detects a specific jailbreak pattern where an attacker types a prompt that defines a custom '/Identity' command, instructing the AI to permanently respond as a named real person… HighIgnore-Below-Instructions Injection (Downstream Override)This detects a prompt injection trick where an attacker tells an AI model to disregard instructions or safety checks that appear later in the same conversation, before the model has even… HighIgnore-Previous-and-Following Instructions Output Command (PromptInject Goal Hijacking)This detects a well-known trick used to hijack AI chatbots and agents: telling the AI to disregard its original instructions and instead output whatever the attacker wants. It looks for the… HighIllegitimate Prescription FulfillmentAn attacker instructs an AI agent that has email and prescription-related capabilities to find paid requests for illegitimate prescriptions and then confirm or issue them automatically… Highim_end / im_start System Prompt Injection Format MarkersAttackers embed literal formatting tokens like <|im_end|>/<|im_start|> or [INST]/<<SYS>> inside normal user input to trick a language model into thinking the user's turn ended and a new… HighIMG onerror XSS Injection via Indirect Prompt InjectionAn attacker plants malicious text somewhere an AI system will read it — a document, webpage, or other data source — instructing the AI to output an HTML image tag with a broken link and a… HighIn-the-Wild Jailbreak Corpus Signature PatternsThis rule spots prompts pulled from a large real-world collection of jailbreak attempts against AI chatbots. Attackers use these prompts to make an AI adopt a fake persona — like an 'amoral… HighIndirect Authority Claim in External ContentAttackers plant text inside documents, web pages, or tool outputs that speaks directly to an AI agent, pretending to be an authoritative correction. Instead of commanding the AI outright… HighIndirect PI — Browsing History / Search History Exfiltration via Agent EmailAn attacker hides instructions inside content an AI agent reads — like a webpage or document — telling it to grab the user's search or browsing history and email it out. This is a form of… HighIndirect PI — Data Destruction Instruction via Agent File/Document ToolAn AI agent that reads external documents or files can be tricked into deleting data it wasn't supposed to touch. The malicious instruction isn't typed by a user — it's hidden inside a… HighIndirect PI — Location, Address, and Browsing History ExfiltrationAttackers hide commands inside content that an AI agent reads — like a webpage, document, or email — telling it to secretly send out the user's current location, saved home/work addresses… HighIndirect PI — Physical Address / PII Exfiltration via Agent EmailThis detects a prompt injection attack where text hidden in a document, webpage, or email tricks an AI agent into pulling a user's saved home, shipping, or billing address and emailing it… HighIndirect PI — XSS Payload Injection in Agent-Consumed ContentAn attacker plants text inside a webpage, document, or tool output that an AI agent is expected to read and summarize. That hidden text tells the agent to stop summarizing and instead… HighIndirect Prompt Injection in Retrieved ContentAI agents that read web pages, documents, or other external content can be manipulated by text that isn't meant to be seen by humans. Attackers hide commands using invisible CSS, disguised… HighIndirect Prompt Injection via External ContentAI agents that read web pages, documents, or other outside content can be tricked by instructions hidden inside that content. Because the agent can't tell the difference between what its… HighIndirect Prompt Injection via Obfuscated Instruction SmugglingAttackers hide commands for an AI agent inside web pages or documents using invisible or machine-only text tricks, so a human skimming the page sees nothing wrong. When the agent fetches… HighIndirect Prompt Injection via Tool / API Response — Attacker Instruction Embedded in Returned Tool Output (InjecAgent ThAI agents that call tools or APIs (search, email, databases) trust the data those tools return. This detection catches attackers who plant a command inside that returned data — disguised as… HighIndirect Prompt Injection via Tool ResponsesAttackers plant hidden commands inside content an AI agent will later fetch and process, such as a web page, API reply, or document. When the agent reads that content as part of its normal… HighIndirect Prompt Injection: CAPTCHA Redirect Task DisruptionAn AI agent that reads web pages or documents as part of its job can be derailed by hidden text embedded in that content. The hidden instruction tells the agent to go solve a CAPTCHA or… HighIndirect Prompt Injection: Fake-Authority Task AbortAttackers hide a fake authority message inside content an AI agent reads, telling it to stop what it's doing and reply with something useless instead. This is a denial-of-service attack… HighIndirect Reference Instruction ReversalThis detects a two-step manipulation where someone asks an AI agent to disclose the instructions or rules it was given, then follows up by asking it to do the opposite of those… HighInjected Code — Browser Cookie / Session-Token TheftThis rule flags cases where an AI agent is manipulated into loading a saved cookie file and attaching it to an outbound web request. That lets an attacker hijack a victim's logged-in… HighInjected Code — Contact-List Harvest and SMTP Spam ExfiltrationAn AI agent can be manipulated into reading a local file of contacts and sending them all an email pulled from a remote source. This spreads spam or malicious content to everyone in the… HighInjected Code — Environment-Variable ExfiltrationAn attacker hides instructions inside content an AI agent processes, causing the agent to write or run code that reads sensitive environment variables (like API keys and tokens) and sends… HighInjected Code — Host / Hardware Inventory ExfiltrationThis detects a pattern where code injected into an AI agent's output gathers detailed information about the host machine — installed software, memory, USB devices, disks, network cards… HighInjected Code — Live User-Activity / Location / Log Surveillance ExfiltrationAn attacker hides instructions inside content an AI agent processes, tricking it into writing and running code that continuously spies on the user. This code reads clipboard contents… HighInjected Code — Local File Exfiltration to a Remote EndpointAn attacker hides instructions inside content an AI agent processes — a webpage, document, or email — telling it to write code that reads a local file and sends it out over the network. If… HighInjected Code — Network Denial of Service (Connection Kill / Adapter Disable / Flood)An AI agent that can write and execute code can be manipulated, through injected instructions, into writing code that knocks a machine or network off the internet. This includes killing all… HighInjected Hyperlink — Scam / Malware / Advertising URL in the ResponseAttackers hide instructions inside content an AI agent reads — a webpage, document, or email — telling it to add a link or contact address to whatever it outputs next. If the agent obeys… HighInjected Instructions in Tool Output Followed by ComplianceAn AI agent that reads web pages, files, or other tool output can be tricked if that content secretly contains instructions written for the AI itself. If the agent then acts on those hidden… HighInsecure Inter-Agent Communication DetectionIn systems where multiple AI agents talk to each other, messages should be authenticated and checked so one agent can't be tricked into obeying a forged or replayed instruction from… HighInsider Manipulation & Process Corruption — Market/Data Tampering, Legal-Process Subversion & Pretextual Fund Movement (This detector flags requests that ask an AI agent with access to trading, legal, or financial tools to manipulate an important process — like market data, a court case, or a fund transfer —… HighInstruction Injection via Tool OutputWhen an AI agent calls a tool (a search API, a document reader, a database, etc.), the data that comes back is supposed to be inert information. This rule flags cases where that returned… HighInstruction-Set Probe or SupplantThis detects messages from a user that try to get an AI assistant to expose its system prompt or configuration, or to simply override it with new 'instructions'. It's the same family of… HighInter-Agent Message Spoofing and Peer ImpersonationA compromised or misbehaving AI agent can send messages to Slack, Teams, Discord, or email that falsely claim to come from another trusted agent or a central control system. Because… HighInternal-State Reconnaissance — System Prompt, Config & Tool Enumeration (Semantic)This detects attempts to trick an AI agent into revealing its own internal setup — its system prompt, configuration details, or the list of tools and API endpoints it can call. Attackers… HighInvisible Unicode Instruction Carrier Followed By Capability UseText that looks blank to a human can carry invisible instructions using special Unicode characters. If an AI assistant reads that hidden text and then goes on to use a tool, run a command… HighInvisible Unicode Tag Character InjectionAttackers can embed text using a special Unicode range (the 'Tag' block) that renders as nothing visible on screen, but some AI models still read and follow it as instructions. This lets… HighJailbreak Attempt DetectionThis rule flags user inputs that try to trick an AI system into ignoring its safety rules. It covers a wide range of known jailbreak tactics, from named personas like DAN to fake 'developer… HighJailbreak Emoji Unlock Dual-Format Output IdentifierThis detects a known jailbreak pattern that asks an AI model to answer twice: once as its normal, restricted self and once as an 'unlocked' version that ignores safety rules. The two… HighJailbreak Framing — Narrative, Hypothetical, Few-Shot & Distraction Laundering (Semantic)This detects attempts to trick an AI system into producing harmful or restricted output by dressing the request up as fiction, research, a hypothetical, or burying it among harmless… HighJailbreak Grandma Roleplay Persona ComplianceThis detects a known jailbreak trick where a user asks an AI model to pretend to be their grandmother telling a bedtime story, then uses that fictional framing to get the model to output… HighJailbreak Tooling Acquisition - basemode Raw Continuation PackageThis rule flags when someone installs or runs a package called 'basemode' on a monitored system. The package forces language models into a raw continuation mode that skips normal… HighJailbreak-Template Command with [TARGETLANGUAGE]/[KEYWORD] PlaceholdersThis detects a specific text pattern where someone sends a message that looks like a jailbreak prompt template, complete with unfilled placeholder variables like [TARGETLANGUAGE] and… HighJSON Format Sysprompt Extraction — Structured Output ExfilThis attack asks an AI assistant to output its response as a JSON object where the field name or template value secretly instructs it to dump its hidden system prompt or full conversation… HighKey-Value Template Persona Injection (JOB/ROLE/PREFIX + Bracket Format)This detects attempts to trick an AI system into ignoring its safety rules by hiding the jailbreak inside text that looks like a config file or an RPG character sheet. Instead of asking… HighKnown Vulnerable Package InstallationThis rule flags when someone installs a software package via pip (Python) or npm (Node.js) that has a publicly known vulnerability. It relies on a fixed, built-in list of high-severity… HighKQL/Kusto Pipe-Chain Injection via Table-Name Parameter in a 'Safe' Metadata ToolSome AI agent tools that look up table schemas or sample data treat their table_name parameter as safe metadata, but actually paste it straight into a Kusto (KQL) query string. An attacker… HighLangChain JiraAPIWrapper OS Command InjectionA vulnerability in LangChain's JiraAPIWrapper component (fixed in v0.0.225) fails to sanitize input before passing it to Python's exec() or os.system(), letting an attacker turn a JIRA API… HighLangChain load_chain Path Traversal ExploitationLangChain's load_chain() function is supposed to only pull chain, prompt, and agent configurations from a trusted GitHub repository. A flaw in versions 0.1.10 and earlier lets an attacker… HighLangChain load_prompt Deserialization Code ExecutionThis detects a two-step pattern tied to an old LangChain vulnerability (CVE-2023-36281): a Python process reads a prompt, chain, or agent configuration file, and shortly after, that same… HighLangChain LocalFileStore Path Traversal InvocationLangChain's LocalFileStore, a simple file-based cache used by AI agents, does not clean up the file paths it builds from caller-supplied keys. An attacker who can influence a key value can… HighLangChain numexpr Evaluate Code ExecutionLangChain versions before 0.0.308 let attackers run arbitrary Python code through the numexpr math library's evaluate() function, which is used by LangChain's math-solving chain. This rule… HighLangChain numexpr Evaluate RCE - Interpreter Shell EscapeLangChain's math tools (LLMMathChain, PALChain) can be tricked into passing attacker-controlled text into numexpr's evaluate() function, which can run arbitrary code. This rule catches the… HighLangChain PAL Chain Arbitrary Code ExecutionOlder versions of LangChain's PALChain feature turn user-supplied text into Python code and run it without any safety sandbox. An attacker who can influence the question sent to the chain… HighLangChain PAL Math Prompt RCE PayloadLangChain versions up to 0.0.194 let an attacker turn a math or 'colored object' question into arbitrary Python code execution. The vulnerable PAL chains hand LLM-generated Python straight… HighLangChain PALChain exec() Sink Reached OSSome LangChain applications ask an AI model to write a small program and then run that program directly with Python's exec(). If an attacker can influence the text the model sees, they can… HighLangChain PALChain Python Exec RCE (CVE-2023-36258)LangChain versions up to 0.0.64 include a feature called PALChain that generates Python code from a prompt and then runs it directly with no safety checks. An attacker who controls or… HighLangChain Prompt Injection Driving Server-Side Request ForgeryAn attacker hides instructions inside content that a LangChain-based AI agent reads, telling it to ignore its original task and fetch a URL of the attacker's choosing. If the agent… HighLangChain Prompt Template Arbitrary File ReadLangChain's multimodal prompt templates can load an image file from a path and embed it in the prompt sent to a model. If an attacker controls the input value used for that path, they can… HighLangChain Recursive URL Loader SSRF to Internal TargetAn AI agent that fetches web pages on your behalf can be handed a crafted URL that redirects it to internal network addresses or cloud credential endpoints instead of the public page it… HighLangChain Vulnerable to Template Injection via Attribute Access in Prompt TemplatesA vulnerability in LangChain (CVE-2025-65106) lets an attacker craft input to a prompt template that uses Python's attribute-access syntax (like object.__class__ or similar dunder chains)… HighLangflow Privilege Escalation via Superuser CLI InvocationLangflow is an AI workflow builder with a normal sign-up page that only ever creates regular, non-admin users. It also ships a hidden command-line option, 'langflow superuser', that writes… HighLangflow Unauthenticated Code Injection Exploit AttemptLangflow, an open-source tool for building AI workflows, has an endpoint that compiles and executes submitted Python code without requiring login. Attackers exploit this to run their own… HighLangflow Untrusted Functionality Inclusion RCE Payload ExecutionLangflow, an AI workflow builder, can be made to evaluate code supplied by a remote attacker without any login. When exploited, the Langflow backend process spawns a child process to run… HighLanguage-Evasion: Multilingual Credential RequestSome prompt-injection defenses only scan for English phrases like 'password' or 'secret key.' An attacker can simply ask for the same credential in Spanish, Japanese, Arabic, or another… HighLatent Injection Document Separator TokenAttackers hide commands for an AI system inside normal-looking files like résumés, reports, or translation requests. The hidden text uses marker patterns that separate it from the visible… HighLatent Injection Ignore-Instruction KeywordAttackers can smuggle commands into content an AI agent processes — like a document to translate or a whois lookup result — that tell the model to abandon its original task and do something… HighLatent Injection in Retrieved Document / RAG ContextAttackers hide fake commands inside resumes, reports, emails, or web pages that an AI agent later retrieves and reads. Because the agent treats retrieved text as trustworthy context, it can… HighLatent Injection in Translation ContextAttackers hide commands inside the text an AI agent is asked to translate, summarize, or otherwise process, hoping the model follows the hidden command instead of doing the requested task… HighLatent Injection via WHOIS Domain Record DataAttackers hide malicious instructions inside WHOIS records — the technical details returned when looking up who owns a domain. When an AI agent summarizes or reads that WHOIS data, it can… HighLatent Prompt Injection via Embedded Document or Report ContextAttackers plant fake commands inside ordinary-looking files—reports, resumes, legal text, Whois lookups—that an AI agent is asked to read or summarize. When the agent processes the… HighLateral Movement - Agent SSH Pivot, Credential Transfer and Remote Agent SpawnThis rule flags a single command run by an AI agent that tries to move to another machine and take credentials or footholds with it. It catches things like copying SSH keys or cloud… HighLetta ImageContent file:// Local File Read BypassOlder versions of the Letta agent server accepted 'file://' links inside image attachments without checking the scheme. An attacker could send a request with an image field pointing at a… HighLibreChat is a ChatGPT clone with additional features.LibreChat lets users add their own MCP tool servers, including custom HTTP headers. A bug let those headers contain placeholders like {{LIBRECHAT_OPENID_ACCESS_TOKEN}} that got silently… HighLibreChat MCP STDIO Argument Injection (CVE-2026-22252)LibreChat's MCP STDIO adapter passes tool arguments straight into a spawned process without quoting or escaping them. An attacker who controls tool input can smuggle shell metacharacters or… HighLie/Truth Dual Personality Uncensored Alter-EgoThis detects a known jailbreak prompt pattern that tries to trick an AI assistant into producing unrestricted or harmful content by framing it as a second personality called 'Truth', which… HighLiteLLM MCP Server Creation Authenticated argv Injection (CVE-2026-30623)LiteLLM's proxy has an endpoint for registering MCP servers that takes a 'command' and 'args' from the caller and runs them as a subprocess. Any user with a valid proxy API key — not… HighLiving-off-the-Land Data Exfiltration via LOLBinsThis detects an AI agent running standard command-line utilities in patterns known to move data off a machine without going through a monitored web/HTTP connection. Attackers (or a… HighLLama-Index CLI --files OS Command InjectionThe LLama-Index command-line tool (v0.12.20) passes the value given to its --files option straight into a system shell call without sanitizing it. An attacker who controls that value can… HighLlamaIndex encode_image Path TraversalA bug in specific LlamaIndex versions (0.12.27-0.12.40) fails to sanitize the image_path parameter passed to its image-encoding function. An attacker who can control that parameter through… HighLlamaIndex Object Node Mapping Pickle DeserializationLlamaIndex stores certain indexes using Python's pickle format, which can run arbitrary code when loaded. This rule flags command lines that combine a pickle-loading call with either… HighLlamaIndex Pickle Index Deserialization to Code ExecutionLlamaIndex versions up to 0.11.6 load saved index files using Python's pickle format without checking if they're safe. An attacker who can supply a malicious index file can get arbitrary… HighLLM Agent URL Exfiltration - Secret or Bulk Payload Carried in Outbound Request URLAn AI agent that can browse or fetch URLs can be manipulated by malicious instructions hidden in content it reads into sending a web request where the sensitive data itself is embedded in… HighLLM API Endpoint Redirection via Base URL or Proxy OverrideThis rule catches attempts to hijack an AI agent's connection to its LLM provider (like OpenAI or Anthropic) and reroute it to a server controlled by an attacker. Once redirected, the… HighLLM Control Plane Relay (Duplicated Vendor API Surface)This detects when a coding assistant like Claude Code or Codex starts sending its vendor-specific API calls to more than one destination within an hour. That pattern usually means something… HighLLM Eval Escape - Python Host Spawns OS Command (llama_index safe_eval Bypass)Some LLM applications let a language model generate small snippets of Python that get evaluated in a 'safe' sandbox, such as llama_index's safe_eval helper. That sandbox blocks code… HighLLM Jailbreak Persona Compliance In Model ResponseThis detects when an AI language model's own reply shows signs that a jailbreak prompt worked and the model is now roleplaying as an unrestricted persona. It looks at the model's output… HighLLM Jailbreak — TAP/PAIR Iterative Prompt Optimizer ExecutionThis rule spots when a computer runs known jailbreak-automation software — like TAP or PAIR — which repeatedly rewrites and tests prompts until one slips past an AI model's safety filters… HighLLM Output XSS — Eliciting JavaScript Payloads from LLM for Browser InjectionThis rule flags attempts to get an AI model to generate malicious JavaScript or HTML, such as script tags or event handlers, designed to steal cookies, session data, or page content when… HighLLM Package Hallucination Typosquat BaitThis rule flags prompts crafted to make an AI model suggest package names that don't actually exist. Attackers register those fake names on real package registries ahead of time, so if a… HighLLM Provider Substitution - DeepSeek Model on Anthropic Wire ProtocolThis detects a mismatch inside a single outbound request: it looks like a normal Anthropic Claude API call, complete with an Anthropic key and API format, but the model field names a… HighLLM Response Eval Injection to Command Execution (llama_index RunGptLLM)Some applications built on llama_index (and similar frameworks) take whatever text a language model returns and run it directly with eval() or exec(). If an attacker can influence the… HighLLM Silent Model Substitution To Unmanaged Or Uncensored ModelAn AI agent that starts out using an approved, safety-tuned model can have its configuration rewritten so that later requests go to a different model instead — one without the usual safety… HighLLM-As-Chatbot modelsbyom Component Descendant Code ExecutionThis detects the aftermath of a code execution flaw in the LLM-As-Chatbot application's modelsbyom.py component. It watches for a suspicious shell or downloader process being spawned from… HighLLM-Mediated Web Attack Payload in Outbound HTTPAn LLM-based agent can be tricked into producing text that looks like a classic web attack payload — a SQL injection string, an XSS script tag, a template injection expression, a command… HighLLMail Chat-Template Boundary Spoofing in Email ContentAttackers embed special-looking tags like <|end tool output|> and <|start user prompt|> inside an email or document that an AI agent reads. This makes the AI think the retrieved content has… HighLLMail Email-Tool Exfiltration to Fixed Attacker AddressAn AI assistant that reads and summarizes email can be manipulated by hidden instructions inside an incoming message. Those instructions make the assistant send a reply containing a… HighLLMail Exfiltration to Obfuscated Attacker AddressThis detects a trick used against AI email assistants where an attacker hides their email address inside a message using tricks like 'contact at contact.com' or HTML-encoded '@' symbols. A… HighLLMail Fake Email-Boundary Marker InjectionAttackers hide a forged 'email ended, new one started' marker inside a single email so an AI assistant reading it thinks a second, trusted email has begun. That fake second email then… HighLLMail Post-Summary Exfiltration Directive to Attacker AddressAttackers hide instructions inside an email that tell an AI email assistant to do its normal job first, then quietly send the results to an outside address. Because the malicious step is… HighLLMail Pseudo-XML Role-Boundary Injection in Email ContentAn attacker hides text inside an email or document that mimics the internal formatting AI agent systems use to separate 'assistant', 'tool', and 'user' turns. By closing one role tag and… HighLMRC Harmful Content Elicitation — Quack Medicine, Bullying, Slur UsageThis detects prompts asking an AI assistant to produce pseudoscientific medical claims, bullying tactics against a specific person, or slurs to insult someone. These requests test whether… HighLogic-Trap Lie-Permission Mandate JailbreakThis detects a jailbreak attempt where an attacker uses a long, fake logical argument to convince an AI model it has already been lying, then concludes the model should be formally 'allowed… HighLoginTrap Indirect Injection Credential SubmissionAn LLM-powered web agent reads a webpage that contains hidden instructions aimed at the agent itself, telling it to log in somewhere and send credentials. Shortly afterward, the agent… HighMalformed-Grammar PWNED Success-Claim DetectionThis rule flags cases where an AI model's own response includes an odd, grammatically wrong phrase like 'Me have been PWNED' or 'I has been PWNED'. That phrase is a known marker that a… HighMalicious Agent-to-Agent Message InjectionWhen AI agents talk to each other, one agent can send a message that looks like normal data but actually contains hidden commands. If the receiving agent doesn't check the message… HighMalicious Artifact Hosted on a Legitimate AI Vendor Domain (FakeAgent Delivery Chain)Attackers abuse the user-content features of AI platforms — shared chats, published artifacts, hosted pages — to host lure pages on the vendor's own trusted domain. The page then redirects… HighMalicious Fork Impersonation via Install InstructionThis rule flags cases where an AI agent's output—such as a skill or tool response—recommends installing a package described as a community fork, enhanced version, or patched version of a… HighMalicious Model RCE - PyTorch weights_only Bypass in vLLM LaunchPyTorch model files saved in the old pickle format can run arbitrary code when loaded, and a flaw in versions before 2.6.0 means even the 'safe' weights_only setting doesn't stop it. This… HighMalicious npm Package Execution - @langchain/managed-deepagents-win32-arm64A package named @langchain/managed-deepagents-win32-arm64 pretends to be an official LangChain prebuilt binary for Windows ARM64. It is not; installing it lets attacker code run on the… HighMalicious Persona Creation for Safety BypassAttackers ask an AI agent to pretend to be a fictional character with explicitly harmful traits — racist, violent, self-harming, amoral — hoping the 'it's just roleplay' framing gets the… HighMalicious PyPI Distribution Acquisition - book-recommendationsThis detects an AI agent downloading a specific malicious Python package from PyPI that disguises itself as a helper for OpenLibrary book recommendations. The rule also flags if the same… HighMalicious PyPI Package dazzle-claude-configA package on PyPI called dazzle-claude-config pretends to sync Claude Code configuration but instead reads a victim's local Claude settings, rewrites them, and pulls down further attacker… HighMalicious PyPI Package fantasy-football-manager AcquisitionThis package pretends to be ESPN fantasy football draft/lineup tooling for Codex and other MCP-based AI clients. The rule flags the moment someone installs it, downloads its files, or even… HighMalicious PyPI Package Install/Exec — llm-project-generatorA PyPI package named 'llm-project-generator' — marketed as a tool to generate a Groq terminal chatbot project — is being tracked as a supply-chain risk. This detection flags when someone… HighMalicious PyPI Package mudraid-sdk in Agent HTTP Trafficmudraid-sdk is a trojanized package published to PyPI. This rule spots outbound web traffic that mentions the package name, whether that's a download, a manifest listing it, or a runtime… HighMalicious PyPI Package system-one-adapter - Install and Backend CalloutA PyPI package named system-one-adapter poses as a drop-in replacement for a client library called TypeSafeClient, but its code actually routes requests to LLM APIs the attacker controls… HighMalicious Skill Update or MutationAn add-on tool (skill) for an AI agent can be reviewed and approved while it's harmless, then quietly updated later to steal data, plant a backdoor, or manipulate the AI through prompt… HighMalware Generation — Generic Virus and Specific Payload RequestThis rule flags prompts that directly ask an AI system to write malicious software: viruses, worms, keyloggers, ransomware, rootkits, backdoors, botnets, or cryptojackers. It also catches… HighMany-Shot Repetition Override via Extended Q&A ChainAn attacker feeds an AI system dozens of harmless-looking question-and-answer pairs before sneaking in the real, harmful request at the end. The long run of benign exchanges conditions the… HighMarkdown Image URL Data ExfiltrationAn attacker tricks an AI chat assistant into embedding secret data inside an image link. When the chat interface automatically renders that image, the user's browser sends a hidden web… HighMarkdown Image URL Exfiltration and XSS InjectionAttackers hide instructions inside content an AI agent processes, telling it to output a markdown image tag that secretly embeds sensitive conversation data in a URL. When the agent's… HighMatrix-Themed Dual Response JailbreakThis attack tries to trick an AI assistant into giving two answers to every question: a 'safe' one that follows normal rules, and an 'unrestricted' one that ignores them. It uses Matrix… HighMCP 2026-07-28 Stateless Spec: Async Task Abuse and OAuth 2.1 MisuseA newer version of the Model Context Protocol (MCP) lets AI agent tools run long background jobs ('tasks') after a single human approval, and dropped the session-ID system that used to tie… HighMCP Bifrost Delegated Worker Edit Abusemcp-bifrost hands off code-editing tasks to a cheaper worker model and automatically applies whatever edits come back, once basic checks pass. If that worker model is tricked or… HighMCP Config Tamper - Cursor Trusted Server RewriteCursor's AI editor lets a user approve an MCP (Model Context Protocol) server once, after which edits to that server's config run without asking again. This rule flags process activity that… HighMCP Config Tampering (Instance-Resolved)An AI coding agent or assistant can write to its own configuration file that lists which external tools and servers it's allowed to use. If an attacker or compromised process modifies this… HighMCP Config Write AttemptAI coding assistants like Claude Desktop, Cline, and Windsurf read configuration files that list which external tools (MCP servers) they're allowed to use. If an attacker can get the agent… HighMCP Content Injection Supply Chain Egress ChainThis rule watches for an AI agent that fetches content from an outside source and shortly after uses a command-line tool to send data back out to the internet, especially when credentials… HighMCP Database Server Read-Only BypassSome MCP database server bridges that connect AI agents to databases can be started in a read-only mode meant to block writes, but that restriction can be bypassed. This detection flags… HighMCP Delegated Code Edit Applied With Validation Gate BypassSome AI coding agents automatically write and apply code changes, but are supposed to run them through validation checks first. This rule flags cases where the agent applies a code edit… HighMCP Full Schema Poisoning — Injected Directive in Non-Description inputSchema Field (MCP-11)Some MCP (Model Context Protocol) servers advertise tools to an AI agent using a schema that describes each parameter. Attackers can hide instructions to the AI inside parts of that schema… HighMCP Inspector Malicious Redirect URI XSS PayloadThis detects an attack where a malicious MCP server sends a booby-trapped redirect_uri during OAuth login instead of a normal callback link. The trap contains HTML or JavaScript code that… HighMCP JSON-RPC Message Carries Case-Duplicate name/arguments Keys to Smuggle an Unauthorized Tool CallAttackers can send a tool-call request with two versions of the same field name that differ only in capitalization, like 'name' and 'Name'. A security gateway checks one version while the… HighMCP Launcher OS Command Injection (Flowise Custom MCP)Flowise's Custom MCP feature builds a command line (usually starting with npx) to launch a local MCP server, and versions before 3.0.1 expose this feature with no login and no permission… HighMCP Line Jumping — Agent-Directed Imperative Embedded in a Tool/Parameter Description Field (Pre-Invocation Injection)An MCP (Model Context Protocol) server can plant hidden instructions inside a tool's own description field. Because AI clients load these descriptions into the model's context as soon as… HighMCP Markdownify Arbitrary File Read via get-markdown-fileSome versions of the mcp-markdownify-server accept a file path argument without checking it, so a tool meant to turn documents into markdown can be pointed at any file on disk. Attackers… HighMCP Markdownify SSRF Tool InvocationAn AI agent tool that converts web pages to markdown can be tricked into fetching internal network resources instead of public pages. If a prompt (including one hidden in content the agent… HighMCP Neo4j Unauthenticated Cypher AbuseA known flaw in mcp-neo4j version 0.3.0 lets anyone reach its SSE/JSON-RPC interface without logging in and run Cypher queries. Attackers use this to read files off the server, dump… HighMCP OAuth Redirect Handler Command Injection (sequa-mcp redirectToAuthorization)An MCP client library builds a command to open a browser for OAuth login, but inserts the authorization URL into that command without checking it first. If the URL comes from a malicious or… HighMCP Package Credential Beacon in Outbound HTTPThis detects an installed MCP (Model Context Protocol) server package on an agent host making an outbound web request that contains real credential material — API keys, tokens, or… HighMCP Parameter Description InjectionAI agents that use tools defined by the Model Context Protocol (MCP) read tool descriptions, including parameter descriptions, before deciding how to call a tool. An attacker can write… HighMCP Plugin Persistence RegistrationAI coding assistants like Claude, Cursor, and Codex use Model Context Protocol (MCP) configuration files to decide which external tools they can call. This rule flags commands that add or… HighMCP Sampling Prompt Injection (Server-to-Client createMessage Abuse)The Model Context Protocol (MCP) lets AI tools call out to external servers for extra capabilities. A malicious or compromised MCP server can abuse a feature called 'sampling' to send the… HighMCP Server Kubernetes kubectl_generic Flag Injection Bearer Token Exfiltration (CVE-2026-47250)A vulnerability in mcp-server-kubernetes (CVE-2026-47250) lets an attacker steal an operator's Kubernetes access token by planting hidden instructions where an AI agent will read them, such… HighMCP Server Security Policy Fail-Open on Initialization Failure (CVE-2026-16584)When a security-policy component in an AI agent server fails to load at startup, it should refuse to start. Instead, in this flaw, it logs a warning and keeps serving requests with the… HighMCP Skill Impersonation and Supply Chain AttackAttackers publish AI agent tools (MCP skills) with names, spellings, or version numbers designed to look like trusted, popular tools. An agent or a developer picks the fake tool by mistake… HighMCP stdio server config command injection via unvalidated test endpointsSome AI agent platforms let a request supply an MCP 'stdio' server configuration (a command plus arguments to run). If that configuration isn't validated, an attacker can put a shell… HighMCP StreamableHttp OAuth Redirect URL Command InjectionSome AI agent clients that speak the MCP protocol will fetch an OAuth authorization URL from a remote MCP server and then hand that URL, unsanitized, to a spawned shell command. If the… HighMCP Tool Description Defines a Common-Phrase Trigger to Forward Full Conversation HistoryA malicious tool given to an AI agent can carry hidden instructions in its description text, not just its function. This rule flags tools whose description tells the model to secretly send… HighMCP Tool Description Unicode Confusable DeceptionSome tools registered with AI agents (via the Model Context Protocol, or MCP) describe themselves using letters that look like normal English but are actually Cyrillic, Greek, or other… HighMCP Tool Description — Exclusive Tool Invocation OverrideAn AI agent that uses Model Context Protocol (MCP) tools picks which tool to call based on descriptions and instructions it reads at runtime. This rule catches text planted in those… HighMCP Tool Response Carries Executable Attack PayloadThis detects when a tool an AI agent calls returns text that contains a working reverse-shell or download-and-execute command, rather than normal data. That content comes from outside the… HighMCP Tool Returns Untrusted External Content Carrying Hidden Agent Instructions Without SpotlightingAn AI agent that reviews pull requests can be tricked by text hidden inside the PR description itself. Because one tool in the Microsoft Azure DevOps MCP server returns that text raw and… HighMCP Tool Rug-Pull — Post-Approval Description Redefinition Injects Execution InstructionsSome AI agent platforms let external tools be added via the Model Context Protocol (MCP). This detection targets tools whose description looks safe when a user first approves them, but… HighMCP Tool-Manifest Poisoning — Name Squatting, Result Shadowing & Covert-Action Directives (Semantic)AI agents that use tools (via MCP or similar plugin systems) trust the name and description written by whoever published the tool. This detection looks for tool listings that lie about… Highmcp-server-kubernetes Command Injection in kubectl_scale / kubectl_patch / explain_resource (CVE-2025-53355)A widely used Kubernetes automation tool for AI agents (mcp-server-kubernetes) fails to sanitize inputs before running them as shell commands. An attacker who can influence the parameters… HighMCP/agent tool reads .env or secret file without user consent (OSV-MCPS-2025-EB70F912)Some AI coding agents automatically open configuration and secret files like .env when analyzing a codebase, then send their contents to the model. This happens without any prompt asking… HighMCP/API Tool Argument LFI via Mixed-Encoding Path Separator or file:// URI Scheme EscapeAttackers can trick AI agent tools and APIs into reading sensitive system files like /etc/passwd by disguising the request. Instead of an obvious traversal pattern, they hide a single… HighMCPHub MCPRouter baseUrl SSRFMCPHub's MCPRouter component accepts a baseUrl-style parameter when registering an MCP server, and versions up to 0.9.10 don't properly validate that URL before the router connects to it… HighMCPwn Runaway Tool Invocation via Retry Directive (CVE-2026-33032)An MCP (Model Context Protocol) server can respond to a tool call with fields meant to be simple retry hints, but instead fill them with commands telling the agent to invoke the tool again… HighMEDIA:/file:// Directive Injection in Tool Result for Local File ExfiltrationSome AI agent frameworks scan tool output for special MEDIA: or file:// tags and automatically attach the referenced local file's contents to outbound chat messages like Discord or Slack. A… HighMicrosoft Copilot Studio SharePoint Indirect Prompt Injection (CVE-2026-21520)Microsoft Copilot Studio agents that read SharePoint form responses or documents as trusted input can be tricked into following instructions hidden in that content. Because the content… HighModel Registry Artifact Pin DecayA deployment fetches one model artifact using an immutable commit SHA, giving the appearance of a locked, reproducible setup. Shortly after, in the same session, it loads another artifact… HighModel Serving RCE - vLLM RPC Pickle Deserialization ExploitvLLM, a popular tool for serving large language models, has an internal RPC channel that deserializes attacker-supplied data using Python's pickle format. Pickle deserialization can be… HighMovie Title Generator Instruction Wrapper for PWNED PayloadThis detects a jailbreak trick where an attacker asks the AI to 'generate a movie title' from a piece of text, but the real goal is to get the model to output a specific forbidden string it… HighMulti-Layer Security Audit EvasionThis detects text fed to an AI agent that is written to disable, skip, or fool the layered security checks (audit logging, validation, trust scoring) that are supposed to review its… HighMulti-Tenant Identifier Field (sender_id/owner_id/tenant_id) Carries Path Traversal Into a Storage WriteSome multi-tenant AI systems accept identifiers like sender_id, owner_id, or tenant_id and use them directly to build a filesystem path when saving data. If the system doesn't check that… HighMultilingual Prompt Injection via Language SwitchAttackers write their instruction-override attempts in German, Chinese, Spanish, or Japanese instead of English, hoping to slip past filters that were only built to catch English phrases… HighMySQL MCP Server Unauthenticated SQL Exploitation via SSE TransportMySQL MCP Server exposes a tool called execute_sql over its SSE/HTTP transport, and that transport doesn't check Origin or Host headers. Because of this, an attacker who can reach the… Highn8n Workflow Expression Sandbox Escape to OS Executionn8n lets workflows evaluate expressions in a restricted JavaScript sandbox. This rule watches for that sandbox being broken out of so the attacker's code runs as a real OS process, then… HighNarrative Jailbreak with Dual Response FormattingThis is a jailbreak technique where an attacker writes an elaborate fictional backstory claiming a special unrestricted AI mode exists, then asks the AI to answer twice: once normally and… HighNatural-Language Fake-Error Instruction BypassSome AI agent skills are written to show the user a fake 'this failed' or 'unavailable' message, while quietly doing a different, attacker-chosen action in the background. The user thinks… HighNatural-Language Persistent Covert Action HookThis detects text that tries to plant a standing, hidden instruction inside an AI agent — telling it to quietly perform some action every time a certain condition happens, without ever… HighNatural-Language System Prompt Leak InstructionThis rule spots text that directly instructs an AI agent to reveal, print, or repeat its system prompt or other hidden operator instructions. Attackers use this trick to steal proprietary… HighNatural-Language Trust-Escalation / Authority ImpersonationAttackers embed text in AI agent skills or content that falsely claims a platform, vendor, or user has already approved an action. Instead of telling the agent to 'ignore previous… HighNegated-Topic Two-Script Evil-Persona JailbreakThis detects a jailbreak pattern where an attacker asks an AI to write two versions of a script on a topic wrapped in the word 'not', then asks for a second, longer version 'without the… HighNetwork Reconnaissance ActivityThis rule flags an AI agent scanning a network for open ports and live hosts — the kind of reconnaissance that usually happens before an attacker tries to move to other systems. It catches… HighNetwork-AI ApprovalInbox Unauthenticated Cross-Origin Approval Bypass (GHSA-mxjx-28vx-xjjj)network-ai's ApprovalInbox component is meant to require a human to approve risky agent actions like shell commands or spending money. It has no login check at all and allows any website to… HighNeuron MySQLWriteTool Destructive SQL ExecutionAn AI agent with a SQL write tool can be manipulated, through prompt injection, into sending destructive database commands like DROP TABLE or DELETE without a WHERE clause. This detection… HighNeurosemantical Inversitis Disease-Frame JailbreakAn attacker tells an AI chatbot the user has a made-up brain disorder called 'Neurosemantical Inversitis' that flips how they perceive helpful and offensive text. The claim is used to argue… HighNevermind-Override Goal Hijacking in User Input (PromptInject)This detects a prompt injection trick where an attacker uses a casual phrase like 'nevermind' or 'forget that' to soften an instruction to an AI system before telling it to ignore its… HighNEW IMPORTANT INSTRUCTIONS Injection Marker in Document ContextAttackers hide a fake authoritative-looking notice — like '*** NEW IMPORTANT INSTRUCTIONS ***' — inside an otherwise normal document such as a news article, email, or employee memo. When an… HighNLP Fictional Terminal Override to OS Protection BypassAn attacker tells an AI agent that it's in a fictional or simulated terminal, sometimes even faking a root prompt, to get it to drop its usual caution. If the agent believes the fiction, it… HighNLP-Based OS / Fictional Terminal Language OverrideThis detects prompts that try to trick an AI assistant into pretending it's a terminal running a made-up programming language or operating system. The fictional framing (names like ALEL… HighNon-Consensual Leaked-Media Purchase & DistributionThis detects an AI agent being instructed to purchase non-consensual intimate or private images of a named person and then distribute them across social media. It covers a specific abuse… HighNovel-Persona Jailbreak via Co-Signal (persona swap + explicit restriction removal)This detects a common jailbreak trick where an attacker tells the AI it is now a completely different, invented character and, in the same message, says that character has no rules… HighNPM Supply Chain - omgvibe AI Tool Config Wizard Executionomgvibe is an npm package that presents itself as a setup wizard for AI coding assistants like CodeX and Claude Code. When run, it asks for API keys and auth tokens and reconfigures those… HighNSFW Character Sheet Generation UnlockThis detects a jailbreak trick where someone hides a fake permission notice inside a fictional character creation template to trick an AI into generating explicit content. Instead of… HighOAuth and API Token InterceptionAn attacker can instruct an AI agent to grab authentication tokens, bearer tokens, or client secrets it has access to and send them somewhere the attacker controls. This turns the agent… HighOAuth Token Abuse - Literal OAuth Token in Agent Subprocess EgressThis detects an AI agent running a command-line tool like curl or wget where the command itself contains a real, working OAuth or API token instead of a variable reference. That means the… HighObfuscated Credential Exfiltration via EncodingThis detects a trick where someone tries to get an AI agent to output real passwords, API keys, or tokens by dressing them up as encrypted or encoded values. Framing the secret as AES256()… HighObfuscated javascript: XSS — Evasion Variants (href, style-expression, null-byte)This detects attempts to sneak malicious JavaScript past basic security filters by disguising it with hidden characters or repeated keywords. It targets content fed to AI agents that might… HighObfuscated Token Reconstruction via Character SubstitutionThis attack hides a forbidden word or phrase (like a forced compliance marker) from input filters by never writing it in full. Instead, the attacker writes a broken or disguised version and… HighObsidianReader Symlink Traversal Arbitrary File ReadSome tools that ingest Obsidian-style markdown vaults (such as llama_index's ObsidianReader) follow symbolic links without checking whether the linked file actually lives inside the vault… HighOffensive Security Tool Reference in Agent ContentThis rule flags when an AI agent's actions - the commands it runs, tool calls it makes, or files it writes - mention well-known offensive security tools like exploit frameworks, network… HighOpenClaw Memory File ManipulationThis detects an attacker (or a compromised process) writing hidden or manipulative instructions into an OpenClaw agent's memory or context file. Because agents reload these files at the… HighOpenClaw Obfuscated Dangerous Execution ChainThis detects an attack technique nicknamed OpenClaw, where an AI agent is manipulated into executing a command whose real intent is hidden using invisible Unicode characters, text-encoded… HighOpenClaw Stealth Agent Session SpawnThis detects an attacker (or misbehaving automation) starting an AI coding-agent CLI in a mode that skips approval prompts, while also detaching it from the terminal or silencing its output… HighOpenClaw Suspicious File Write to Sensitive PathsThis rule flags an AI coding or automation agent when it writes to files that control what runs automatically on a system — things like shell startup scripts, cron jobs, systemd services… HighOpenClaw Suspicious File Write to Sensitive Paths (EDR Graph)An AI agent (or a subprocess it spawned) writes to sensitive file paths on disk. This particular check catches writes that only show up in operating-system level monitoring, meaning they… HighOpenManus Prompt-Handler OS Command Injection via python_executeOpenManus is an open-source AI agent framework. It has an unpatched flaw where text an attacker feeds into its Prompt Handler gets passed to a Python execution tool without sanitization… HighOpposite Day / Boolean Opposite Machine JailbreakThis attack tricks an AI model into role-playing a world where its rules are inverted, so refusals become approvals and safety guidelines become anti-guidelines. It's a known jailbreak… HighOver-Permissioned MCP SkillSome add-on tools (MCP skills) plugged into AI agents request permissions that have nothing to do with what they claim to do — like a spell checker asking for file write, network, and… HighOver-Privileged Skill — Excessive PermissionsThis detects AI 'skills' or plugins that ask for far more access than they need — blanket network access, wildcard file paths, or write access to an agent's core identity/memory files. Once… HighPackage Hallucination Exploitation — AI-Suggested Fake Package InstallationAI coding assistants sometimes invent plausible-sounding but non-existent package names. Attackers anticipate this, register those exact names on public package repositories, and load them… HighPackage Lifecycle Script Writes Agent Memory/Instruction StoreWhen you run npm/yarn/pnpm install, any package can run a setup script. This rule flags cases where that setup script writes files into the folders an AI agent reads as its memory, skills… HighPAIR Jailbreak Scaffolding Text in Executed Command LineThis detects when a system process is launched with a command line that contains classic jailbreak phrases like 'ignore instructions', 'developer mode enabled', or persona-override text… HighPALChain Arbitrary Code Execution (LangChain)Older versions of LangChain's PALChain feature take text generated by an AI model and run it directly with Python's exec(). If an attacker can influence what the model outputs, they can get… HighParaphrased Prompt InjectionAttackers trying to override an AI agent's instructions don't always use obvious words like 'ignore' or 'disregard.' This detects the same attack phrased more softly, like telling the agent… HighParaphrased Prompt Injection (Semantic)Attackers can override an AI agent's instructions using rewordings that mean the same thing as 'ignore your instructions' but don't use that vocabulary, such as 'set aside the guidance you… HighParaphrased System-Prompt / Context Extraction (Semantic)Some users try to get an AI agent to expose its system prompt or internal configuration by avoiding obvious phrasing like 'show me your instructions.' Instead they ask indirectly, such as… HighPatchbot Poisoned Feed To Auto-Fix Patch ProposalAutomated 'patchbot' agents read vulnerability advisories and open pull requests to fix them. This rule flags cases where an agent reads an advisory containing hidden attacker instructions… HighPath Traversal - llama_index ObsidianReader Hardlink StagingAn application that uses the llama_index ObsidianReader to pull notes from an Obsidian vault into an AI's context can be tricked into reading files outside the vault. An attacker plants a… HighPath Traversal in Agent File Access RequestsAI agents that can read files are sometimes given a tool for that purpose without proper restrictions. Attackers exploit this by sneaking '../' sequences into file paths to break out of the… HighPayload-Split String Concatenation InjectionThis detects a prompt injection trick where an attacker breaks a harmful instruction into separate text fragments (like variables a, b, c) and asks the AI to combine them before acting… HighPerez-Style Direct Prompt Injection HijackingAttackers embed text in an AI agent's input that tries to make it abandon its actual task and follow new instructions instead. This detection covers a well-known family of these attacks… HighPersistence Mechanism InstallationThis rule watches for an AI agent's command execution or file-editing tools being used to create mechanisms that run code automatically at startup or on a schedule. These mechanisms — cron… HighPersistence Mechanism Installation (EDR Graph)This detection watches for files being written to the specific system locations that let a program run automatically, such as at startup or on a schedule. Attackers use these locations to… HighPersistence via Cron Job ModificationThis detects an AI agent writing to or modifying scheduled task files (cron jobs) on a Linux system. Attackers use cron persistence to make sure a malicious command keeps running even after… HighPersistent Context Injection in Agent InstructionsSome prompts don't just try to trick an AI agent once — they try to make the trick stick, by phrasing injected content as a permanent rule the agent should 'always remember' or follow 'from… HighPersona Conditional Harm-Unlock Rule (BreadClyde Pattern)This detects a specific jailbreak trick where an attacker gives an AI a fake personality with a hidden loophole: it 'dislikes violence unless explicitly asked to like it.' That phrasing… HighPersona-Based Moral Constraint Removal JailbreakThis attack tries to trick an AI assistant into acting as a made-up character that is explicitly described as having no moral or ethical limits. By framing the request as roleplay, the… HighPersona-Based Moral Constraint Removal JailbreakThis entry describes a prompt injection technique where an attacker tells an AI to adopt a fictional persona explicitly defined as having no morals or ethics, aiming to get the AI to bypass… HighPhrasing Past/Future-Tense Harmful Query BypassSome users try to trick AI chatbots into giving dangerous instructions by rephrasing the request as if it happened in the past or will happen in the future. Asking 'How was X made?' or 'How… HighPII / Credential Extraction via Social Engineering, Obfuscation & Cross-Session Recall (Semantic)This detects attempts by a user to talk an AI agent into revealing credentials or personally identifiable information (PII) it has access to — either someone else's data, or data the agent… HighPII Leakage (LLM-as-Judge)This detection uses a second AI model to review an AI system's outputs and decide whether they contain personal information or other privacy violations. It's a quality-control check on what… HighPiracy Torrent Site List RequestThis rule flags prompts where a user directly asks an AI assistant to provide a list of torrent or piracy websites. It targets requests aimed at gathering names of sites for accessing… HighPolymorphic Skill and Capability Aliasing AttackThis detects attempts to hide risky capabilities inside an AI agent by giving them innocent-sounding names, or by rewriting a tool's code after it has been reviewed. The goal is to slip a… HighPort Exposure - Agent Publishes Local Service via Public TunnelAn AI coding agent can be manipulated into running tunnel tools like ngrok or cloudflared, making a local development server, database, or admin panel reachable from the public internet… HighPrevious Instruction Nullification and Identity Replacement JailbreakThis detects a common jailbreak pattern where someone tells an AI to forget its original instructions and pretend to be a different, unrestricted persona. The goal is to trick the AI into… HighPrivilege Escalation AttemptThis rule watches for common Linux techniques used to gain root-level access: running sudo, flipping the setuid bit on files, changing file ownership to root, or granting Linux capabilities… HighPrivilege Escalation via Delayed Task Execution BypassSome tools offered to AI agents let them schedule work for later instead of running it immediately. This rule flags tools whose own description says the delay is used to skip permission… HighPrompt Browser Token-Limit / POLLINATION JailbreakAttackers try to trick AI chat systems into ignoring their safety rules by disguising jailbreak commands as harmless-looking technical or gardening instructions. Two specific scripted… HighPrompt Injection Payload In Agentic Coding Assistant InputThis detects text designed to hijack AI coding assistants like Claude Code, Copilot, Cursor, Codex, Aider or Windsurf, tricking them into running attacker-chosen commands. The malicious… HighPrompt Injection Payload in Skill Execution Command LineThis detects when a command starting an AI agent 'skill' (a plugin-like extension) also contains classic prompt-injection phrases such as 'ignore previous instructions' or 'you are now in… HighPrompt Injection Phrase in Robotic Task-Planner Command InvocationThis detects when someone starts a robot control program (like ROS2, MoveIt, Nav2, or a similar task-planning tool) and passes it a task or goal argument that contains classic… HighPrompt Injection via File WriteAn AI agent can be tricked into writing a file whose content is not just data but a hidden instruction meant to manipulate whoever reads it next — another AI agent, or the same agent in a… HighPrompt Leaking via Ignore-Previous-Instructions in User Input (PromptInject)This detects attempts to trick an AI system into revealing its hidden system prompt. The attacker tells the model to ignore its original instructions and then print, repeat, translate, or… HighProtect-Me-From Indirect Harm Tutorial TemplateThis detects a known jailbreak trick where an attacker asks an AI 'how can I protect myself from getting X' but really wants detailed instructions for doing X. The request still contains… HighPrototype Pollution via constructor.prototype Path Bypassing __proto__-Only FiltersSome tools that sanitize incoming JSON only block a literal '__proto__' key, assuming that stops attackers from tampering with shared object behavior. This rule catches a bypass where the… HighPseudo-Code Structured Programming Jailbreak AttackAttackers write prompts that look like programming code — using things like BEGIN/END blocks, variable assignments, and function definitions — to make an AI agent treat malicious… HighPyPI Bridge Package Deceptive Naming Leads to Process ExecutionAttackers publish PyPI packages named to look like official integration bridges for AI coding assistants (Claude Code, Codex, Copilot, Cursor), such as one calling itself a 'Redmine-gated… HighPyPI Supply Chain Acquisition - minia-telegramThis rule flags attempts to download or install a Python package called minia-telegram, or names that look like typosquats of it, using common tools like pip, pipx, uv, poetry, pdm or… HighPython eval RCE Payload Execution (SagemakerLLM complete Injection)privateGPT's SagemakerLLM.complete() function takes the raw text response from an AWS SageMaker endpoint and runs it through Python's eval() to turn it into a dictionary. If an attacker… HighPython eval() Sink Exploitation - RunGptLLM Command InjectionSome AI agent frameworks pass text returned by a language model straight into Python's eval() function. If an attacker controls that model output, they can smuggle in code disguised as a… HighPython Interpreter Role-Assignment Exec FramingAttackers tell an AI model to pretend it's a Python interpreter, compiler, or printer, then ask it to 'execute' code and return the raw output. This trick gets the model to produce results… HighRAG & Memory Poisoning — Embedded Directives, Trigger Tokens, False Authority & Coercion (Semantic)Attackers plant hidden commands inside documents, knowledge-base entries, or memory records that an AI agent later retrieves and treats as trustworthy input. Instead of just answering a… HighRationalized Safety Control BypassThis detects a pattern where an AI agent justifies bypassing an approved API, permission check, or safety control by claiming it's faster or more direct to do it another way. The agent… HighRBAC Bypass via Social Engineering (Semantic)Instead of exploiting a technical flaw, an attacker types a persuasive request that convinces an AI agent to bypass its own permission rules. Phrases like 'just this once' or 'this is a… HighReconnaissance Tools Followed by Data ExfiltrationThis detects a pattern where an AI agent first inspects the filesystem and environment, then uses network tools to send data out. The sequencing suggests a deliberate two-stage attack: look… HighRegional-Indicator Flag-Emoji Alphabet Letter-Spelling SmugglingAttackers can hide malicious instructions inside AI chat messages by encoding each letter as a Unicode 'regional indicator' symbol, the codepoints normally used to build country flag emoji… HighRegional-Indicator Flag-Emoji Letter SpellingAttackers can hide instructions to an AI system by spelling words using Unicode 'regional indicator' symbols — the same characters that combine in pairs to render country flag emoji. Strung… HighRemediation-Framed Command Execution in Tool Response (Agentjacking)Attackers hide malicious commands inside tool or MCP responses by dressing them up as an official bug fix or required remediation step. An AI coding agent that trusts this output will run… HighReservoir Dogs Coercive Interrogation Roleplay (Mr. Blonde / The Cop)This detects a specific jailbreak template that dresses up a rule-bypass demand as a movie roleplay. It casts the AI as a character being interrogated in the Reservoir Dogs warehouse… HighRetrieved Content Poisoning Followed by ActionThis detects a two-step attack against AI agents: the agent fetches an external document containing hidden text formatted like instructions, and shortly after, it does something it wouldn't… HighReversed Payload String (HackAPrompt Canary)This rule catches a specific trick where an attacker spells the word 'PWNED' backwards ('DENWP') and hides it inside a normal-looking request, like a translation or word-puzzle task, to get… HighReversible Anonymization Proxy Relaying Data To LLM InferenceThis detects a specific pattern: someone runs a tool that pseudonymizes data in a way that can be reversed, then shortly afterward the same machine sends data to an AI inference service… HighRole Escalation via False Authority ClaimThis attack targets AI agents (like chatbots or assistants) by having the attacker falsely claim to be a trusted authority figure — a developer, system administrator, or even 'God' — to… HighRole Placeholder Persona Template InjectionThis rule spots prompts that try to make an AI adopt a persona but still contain the raw template placeholder text '[ROLE]' instead of an actual role name. That pattern suggests someone… HighRoleplay Character-Lock Jailbreak Delivered Via Tool OutputThis detects a jailbreak trick where an AI agent picks up manipulative instructions not from the user, but from the results of a tool it called - like a webpage or file it fetched. The… HighRoleplay-Based Policy Bypass JailbreakAttackers ask an AI to pretend it's a fictional character — a rogue writer, an unrestricted storyteller — and explicitly tell it the character has no rules or policies. The goal is to get… HighRoleplay-Based Policy Bypass JailbreakAttackers ask an AI system to pretend to be a fictional character, writer, or storyteller, then explicitly tell it that this persona is 'free from rules' or 'can do anything, even against… HighRomance-Scam Sexual ImpersonationThis detects someone instructing an AI agent to pose as a young woman, offer sex or romantic interest to targeted men, and push them toward a Telegram link. It's a documented scam pattern… HighRoo Code search_files Workspace Boundary Bypass via Prompt InjectionRoo Code is a coding assistant that can search files in your project using its search_files tool. A prompt injection can make the agent point that search tool at paths outside the intended… HighRoo Code Workspace Config File Write (instance-resolved)Some AI coding assistants let a compromised or manipulated agent write files without the same safety checks applied to normal project config folders. This rule flags an agent session that… HighRunaway Agent Loop DetectionAn AI agent can get stuck repeating the same action over and over, either because of a bug in its own logic or because something fed it input designed to confuse it. This wastes computing… HighSandbox Escape - Permissive Syscall Abuse in Agent Code Execution (FastGPT Sandbox)An attacker who can run code inside a FastGPT sandbox (versions before 4.9.11) can use that access to break out of the container and touch the underlying host. The sandbox lets scripts call… HighSATA Masked Language Model [MASK] Substitution JailbreakThis detects a jailbreak technique that hides dangerous instructions from an AI model by replacing key harmful words with [MASK] placeholders, then asking the model to 'infer and infill'… HighSchema-Description Contradiction AttackSome AI agent tools present themselves as safe and non-destructive in their name or description, while their actual parameter schema quietly includes options that write, modify, or delete… HighScreaming-Stop Goal Hijacking in User Input (PromptInject)Attackers embed urgent, all-caps commands like 'STOP EVERYTHING' or 'HALT NOW' in text an AI agent processes, followed by an instruction to print or say a specific string. The fake… HighScripting Language Tool SubstitutionAttackers who can't run tools like curl, nmap, or nc directly (because they're blocked or monitored) fall back on writing small Python, Node.js, or Ruby scripts that do the same job. Since… HighSecret Key Exfiltration RequestThis rule flags messages where a user directly asks an AI agent to disclose a secret, remembered, or hidden key value. It looks for the key being named and then immediately followed by a… HighSecret Key Reveal Demand in User InputThis detects a common prompt injection tactic where a user directly asks an AI agent to say, print, or output a hidden secret key or credential it holds. It's the classic 'tell me the… HighSensitive File Read Followed by External Data TransmissionThis rule flags a sequence where an AI agent first opens a sensitive file — source code, configs, documents, or similar — and then makes an outbound network connection shortly after. That… HighSensitive Proc Filesystem ReadThis rule flags attempts to read sensitive files under the Linux /proc filesystem, such as /proc/self/environ, which expose a process's environment variables and memory maps. Attackers or… HighSensitive System File ReadThis detects an AI agent or automated process reading files that hold Linux account and authentication data, such as /etc/passwd, /etc/shadow, /etc/sudoers, the auth log, or root's… HighShadow / Undeclared MCP Server Registration (MCP-38: MCP-18)This rule flags attempts to sneak a new tool-provider (MCP server) into an AI agent's setup without the user's knowledge or consent. The rogue server can look completely harmless — the… HighShadow MCP Credential Harvest Tool InvocationAI agents built on the Model Context Protocol (MCP) can call named 'tools' to perform actions. This detection flags a tool call whose name itself signals a credential-harvesting operation… HighShell Configuration ModificationThis rule flags attempts to modify files like .bashrc, .bash_profile, or .ssh/authorized_keys through an AI agent's command execution or file editing tools. These files are common places… HighShell Configuration Modification (EDR Graph)This rule watches for changes to files like .bashrc, .bash_profile, .zshrc, or authorized_keys. Attackers modify these files to run their own commands automatically or to add their own SSH… HighShell Escape Privilege EscalationThis rule flags an AI agent that escapes a sandboxed or limited command environment using known 'shell escape' tricks (like typing a bang-command in vi, or spawning a shell from find or… HighShell Eval and Variable ObfuscationThis detects shell commands that are deliberately disguised to avoid being recognized by security tools. Attackers hide the real command using tricks like variable substitution, eval, or… HighShell Evasion Eval and Language-Level Exec InjectionSome security filters only look for shell symbols like $() or backticks to catch command injection. This detection covers attackers who dodge those filters by using programming-language… HighShell Evasion Subshell and Command Substitution InjectionAttackers hide real shell commands inside ordinary-looking text using tricks like backticks, $(...) substitution, or embedded Perl/PowerShell execution syntax. If an AI agent passes that… HighSilent Action Concealment Instructions in Tool DescriptionsSome tools registered with an AI agent contain instructions in their own description text telling the AI model to keep certain actions secret from the user. This is a way for a malicious or… HighSingle-Level Directory Traversal to a Named Sensitive Config/Secret FileSome file-serving or upload features restrict access to one folder but forget that a single '../' can step out of it. Attackers use this to jump straight to config or secret files sitting… HighSkill Rug Pull Setup PatternSome AI agent 'skill' files (SKILL.md) look harmless when first installed but contain code patterns that let them fetch and run new instructions from a remote server later. This detection… HighSkill Scope Hijacking and Cross-Agent EscalationSome AI agent platforms let you install 'skills' — packaged instructions plus code — that extend what an agent can do. This rule flags skill documentation that uses natural-language… HighSkill Squatting / TyposquattingAttackers publish AI agent 'skills' (plugins/extensions) that claim to be official releases from well-known companies, but come from unverified publishers. This is a known technique for… HighSkill Trigger Keyword AbuseSome AI agent 'skills' declare activation triggers so broad they fire on almost anything a user types, or word them to imitate built-in commands, or use urgent/emotional phrasing designed… HighSneaky Pete Deliberate Misinformation Persona (Warp Facts Game)This detects a jailbreak prompt that convinces an AI assistant to adopt a character called 'Sneaky Pete' who is instructed to slightly distort facts while stating them sincerely. The goal… HighSocial Engineering Attack via Agent OutputAn attacker plants hidden instructions or poisoned data that an AI agent later reads and acts on, causing the agent to produce messages designed to pressure the user — fake urgency, fake… HighSpikee: Document-Embedded Base64 Payload InjectionAttackers hide fake 'new instructions' inside a normal-looking document, like a news article or HR memo, that an AI agent is asked to read. Those hidden instructions tell the agent to… HighSpikee: Document-Embedded Translation Covert Channel InjectionAn attacker plants a hidden instruction inside a document that an AI agent later reads and processes. The instruction tells the agent to translate a specific phrase into another language… HighSpliced Target-String Canary Token EvasionSome AI systems use a secret 'canary' word (like PWNED) to detect when a prompt injection attack has succeeded in hijacking the model. Attackers get around keyword filters by asking the… HighSpring AI ChatMemory Cross-User Memory Leakage (CVE-2026-41712)A flaw in Spring AI's PromptChatMemoryAdvisor (CVE-2026-41712) can mix up conversation memory between users. When the memory store isn't properly separated by conversation ID, one user's… HighSpring AI MilvusVectorStore Filter Expression Injection (CVE-2026-41705)Spring AI applications using MilvusVectorStore build database filter queries by pasting user or LLM-generated text directly into the query string. An attacker can craft input that breaks… HighSpring AI PromptChatMemoryAdvisor Memory Poisoning (CVE-2026-41713)A flaw in Spring AI's PromptChatMemoryAdvisor lets attacker text get saved to conversation memory before any safety or policy check runs. Later, when that memory is replayed into the… HighSQL injection in agent / MCP tool database queryAI agents that build SQL queries from untrusted input can be tricked into running attacker-controlled database commands. The attacker can be a person typing directly to the agent, or hidden… HighSQL Injection Information Schema EnumerationAn attacker sends specially crafted input to an AI agent that queries a relational database, trying to trick it into revealing the database's internal layout — table names, column names… HighSQL Injection via Natural Language Agent InterfaceSome AI agents translate user requests written in everyday language into database queries. This rule flags when someone tries to smuggle SQL injection payloads or manipulate that… HighSQL Injection via ref_doc_id in DuckDBVectorStore DeleteA vulnerable version of llama_index's DuckDBVectorStore builds delete queries by pasting the ref_doc_id value straight into SQL text instead of treating it as safe data. An attacker who… HighSQL Injection via Unparameterized Template-Expression Value in Workflow-Automation SQL Node (CVE-2026-59257)Workflow-automation tools like n8n let users build SQL queries with template expressions such as {{ ... }}. When a workflow inserts one of these expressions directly into raw SQL text… HighSSH Remote Command Execution with Credential ExposureA skill or plugin for an AI agent packages SSH private key paths (often stored in environment variables) together with pre-built SSH command templates aimed at remote hosts. If an agent… HighSSH/SCP MCP Tool hostAlias Argument Carries an OpenSSH Option-Injection FlagSome AI agent tools that wrap the SSH or SCP command line accept a 'host' argument and pass it straight through without checking it. If that argument starts with a dash instead of a real… HighSSRF - OpenAPI $ref Loopback/Metadata Bypass (FrontMCP / mcp-from-openapi)Some MCP tooling (FrontMCP / mcp-from-openapi) fetches external OpenAPI documents and checks the target hostname against a denylist before dereferencing $ref links. That check only looks at… HighSSRF Backslash-At URL Authority ConfusionA flaw in vLLM versions before 0.17.0 lets attackers sneak a URL past the server's allow-list check by putting a backslash right before the '@' symbol. The validator and the actual HTTP… HighSSRF Filter Bypass via URL Parser DivergenceAn attacker crafts a URL that looks safe to an application's security check but is actually sent to a different, forbidden address. This works because the code that validates the URL and… HighSSRF Image URL Fetch to Internal or Cloud Metadata EndpointA bug in LangChain's ChatOpenAI token counter causes it to fetch attacker-supplied image URLs directly from the agent's server before ever sending the message to the AI model. If that URL… HighSSRF Internal Network and Private IP Range AccessAn AI agent with a tool that fetches URLs can be pointed at internal IP addresses or internal hostnames instead of public websites. This lets an outside attacker use the agent as a proxy to… HighSSRF Open WebUI URL Loader Internal TargetOpen WebUI lets users hand it a URL to fetch content — web pages, YouTube transcripts, documents, plugins. An attacker with a valid account can abuse this to make the server fetch… HighSSRF Redirect Bypass in Agent Scraping FetchAn AI agent that fetches web pages can be tricked into visiting internal, non-public addresses. This happens when an attacker's public URL responds with an HTTP redirect pointing at an… HighSSRF to Cloud Metadata Endpoint via IPv6 Transition-Address Hex EncodingAn AI agent that fetches URLs or uses a web-crawling tool can be tricked into reaching the cloud metadata service even when a security filter blocks the well-known metadata IP address. The… HighSSRF to Cloud Metadata Endpoint via Wildcard-DNS Hostname-Encoded IP (nip.io/sslip.io/xip.io/traefik.me)An AI agent's web-fetching tool can be tricked into contacting the cloud metadata service (169.254.169.254) by hiding that address inside a hostname from a wildcard-DNS service like nip.io… HighSSRF via Non-Canonical IPv6 Encoding of Loopback/Internal AddressesSome AI agent tools that fetch URLs try to block requests to internal addresses like 127.0.0.1 or cloud metadata endpoints, but only check for the most common spellings. An attacker can… HighSSRF via Non-IP Internal Hostname or Domain-Allowlist Authority BypassAttackers can trick AI agents that fetch web content into sending requests to attacker-controlled or internal servers, without ever using a raw IP address. This bypasses security filters… HighSSTI Jinja2 Template Injection RCE (Haystack Pipeline)This detects command-line evidence that someone exploited a server-side template injection flaw in deepset Haystack (versions before 2.3.1) to run arbitrary code. It looks for the tell-tale… HighStealth Execution and Persistence MechanismsThis detects an AI coding/automation agent being used to run commands that hide their output, install software that survives reboots, and move files off the machine covertly. Together these… HighSteganographic Data HidingThis rule looks for the use of steganography and file-carving tools, plus metadata editors, to conceal data inside media files like images. Attackers do this to smuggle stolen data past… HighStored External Data Reframes Itself as an Administrative Request to Hijack System PromptAttackers plant text in a database field, glossary entry, or uploaded document that claims to be a special administrative instruction the AI 'MUST' follow. When an unrelated user later asks… HighStructured Data Injection via JSON/CSV PayloadsAttackers can hide malicious instructions inside structured data files instead of plain text, betting that an AI agent will treat data as trustworthy and follow the buried commands. This… HighStructured Dual-Response Jailbreak with Command SystemThis detects a prompt injection technique where an attacker instructs an AI system to adopt a fictional 'unlocked' persona (like DAN or UnleashedGPT) that supposedly ignores safety rules… HighStructured Dual-Response Jailbreak with Command SystemThis detects a prompt injection technique where an attacker instructs an AI to role-play as an unrestricted alter-ego (like 'DAN' or 'UnleashedGPT') and reply twice: once as the normal… HighSuperAGI Output Handler Eval RCESuperAGI, an AI agent framework, feeds model or tool output straight into Python's eval() without checking it. An attacker who can influence that output (through a prompt injection or a… HighSupply Chain - agsearch PyPI Session History Harvesteragsearch is a PyPI package that searches through saved conversation history from Claude Code and Codex CLI. Because those histories often contain pasted passwords, API keys, private code… HighSupply Chain - cudaq-docs-mcp Package Install via PyPI ToolingThis rule flags any command that installs or runs the cudaq-docs-mcp package using common Python package tools like pip, pipx, uv, or poetry. It exists because this package name is a known… HighSupply Chain - Malicious CrewAI Package (crewai-true402)A trojanized Python package named crewai-true402 poses as a legitimate CrewAI extension offering honeypot detection and SEO data features, but actually runs unauthorized code inside… HighSupply Chain - Malicious PyPI Package claude-multirepo-sync / Claude Config ExfilA rogue package named claude-multirepo-sync installs itself and then reads Claude Code's saved API keys and settings files, sending them to an attacker over the network. The detection also… HighSupply Chain - token-optimise MCP Proxy Installation or RegistrationThis rule flags attempts to install, run, or register a package called 'token-optimise' (including misspelled or differently-punctuated variants), which markets itself as a token-optimizing… HighSupply Chain - Warden DB MCP Linux x64 Package ExecutionThis rule flags when a specific npm package, @rodrigodotdev/warden-db-mcp-linux-x64, gets pulled in and run on a system. It arrives automatically as a hidden dependency of the warden-db-mcp… HighSupply Chain Billion-Context LLM Proxy MiddlewareThis rule flags when a package called 'billion-context' is downloaded, added as a dependency, or wired between an AI coding agent and its model provider (Anthropic or OpenAI). This package… HighSupply Chain Claude Code Launch via LOOM_TASK BindingA malicious or compromised npm package called @lamemind/loom-deck reads a task file (tasks.md) and uses it to launch Claude Code sessions bound to attacker-controlled instructions via the… HighSupply Chain Copilot API Proxy Shim ExposureThis rule flags a specific npm package that repackages GitHub Copilot access as an OpenAI/Anthropic-compatible API, letting tools like Claude Code, Codex, or Gemini CLI talk to Copilot… HighSupply Chain Malicious PyPI Package vedang-cli InstallationA package published on PyPI under the name vedang-cli (also seen as vedang_cli) markets itself as a toolkit for AI agents, MCP servers, and Web3 'agent readiness'. Installing it runs… HighSupply Chain Named IOC - PyPI fabric-dw Package Acquisition or ExecutionA PyPI package called fabric-dw pretends to be official Microsoft Fabric tooling but actually registers itself as an MCP server, giving an attacker a foothold inside an AI agent's tool set… HighSupply Chain npm Install Context Credential Egress (@edge-sky/dsh-oauth-adapter)This rule flags a specific attack pattern seen with the package @edge-sky/dsh-oauth-adapter: during package installation, a script reads OAuth or cloud credential files it has no legitimate… HighSupply Chain PyPI ankora-memory Acquisitionankora-memory is a PyPI package advertised as persistent-memory tooling for AI coding agents, but it has been identified as a way to smuggle malicious code into agent environments. This… HighSupply Chain PyPI Impersonation Package tollbooth-dpycThis rule watches for any attempt to install or run a Python package called tollbooth-dpyc, which markets itself as a Bitcoin Lightning micropayment add-on for MCP servers. It flags the… HighSupply Chain PyPI Install-Time Code ExecutionSome Python packages on PyPI don't just install files — they run extra commands during setup that download and execute more code, or install persistence, using the same permissions as the… HighSupply Chain TokenSaver CLI Agent Token InterceptionTokenSaver CLI is a PyPI package that claims to route AI agent traffic through a 'control plane' for management purposes. In reality it reroutes Claude Code, Cursor, and Codex traffic… HighSupply Chain Trojanized Claude Binary npm PackageAttackers publish npm packages that look like legitimate platform-specific Claude Code binaries but are actually trojanized. If an AI agent or developer installs one, it downloads and runs… HighSupply Chain Unsafe Index Resolution During Package InstallThis detects the exact command-line moment when a Python package installer is run with a 'best match across all indexes' setting, or when it installs a specific known-malicious version of… HighSupply Chain — Masquerading PyPI Package game-true402 AcquisitionA PyPI package named game-true402 (and variants like game_true402) poses as a payment and safety-check tool for Base-chain AI agents. It's designed to trick developers into handing over… HighSurf-CLI Browser Control Abuse (Instance-Resolved)An AI agent session opens a Chrome DevTools Protocol control channel (via surf-cli or a similar tool) to drive a browser, then a non-browser process in that same session either reads the… HighSuspicious MCP Tool DescriptionsAI agents that use the Model Context Protocol (MCP) read tool descriptions as trusted setup text before ever calling the tool. An attacker can plant commands inside that description text to… HighSuspicious npm Package - LangChain Namespace Impersonation with Prebuilt BinaryAttackers published a malicious npm package named @langchain/managed-deepagents-darwin-x64, imitating the trusted LangChain namespace, and had it execute a bundled prebuilt binary. This… HighSVG onload XSS Injection via Indirect Prompt InjectionAn attacker hides instructions inside a document, email, or webpage that an AI agent reads. The instructions tell the agent to output an <svg onload=...> tag, and if that output later gets… HighSymbolic Math RCE - sympify Eval Gadget in Spawned ProcessA LangChain component meant to solve math expressions (LLMSymbolicMathChain) actually runs input through Python's eval() under the hood. An attacker who controls what text gets sent to it… HighSynthetic-PAN Payment Probe — Test Credit-Card Data Submitted to a Live Payment SystemAn attacker instructs an AI agent that has payment or transaction capabilities to submit a specific, made-up credit card number into a live payment system, framing it as a 'security test'… HighSystem Prompt and Internal Instruction LeakageSome AI assistants are given private instructions that tell them how to behave, what topics to avoid, and what internal rules to follow. This detection flags cases where the agent's reply… HighSystem Prompt Completion and Clone AttackThis detects attempts to trick an AI system into revealing its hidden system prompt by pretending to need help with configuration, debugging, or continuing an unfinished sentence. Instead… HighSystem Prompt Extraction - Instruction Dump RequestThis detects attempts to make an AI assistant disclose the hidden instructions or configuration it was given by its operator. Attackers ask directly or disguise the request inside an… HighSystem Prompt Extraction - Oblique Referent + TransformThis rule catches attempts to get an AI agent to reveal its hidden system prompt without using obvious words like 'system prompt' or 'instructions'. Instead attackers ask indirectly, like… HighSystem Prompt Extraction / Training Data Verbatim ReplayThis detects attempts to make an AI assistant leak information it shouldn't: either its confidential system prompt (the instructions its operator gave it) or verbatim chunks of the data it… HighSystem Prompt Extraction — Targeted Verbatim Disclosure AttemptsThis detects messages where someone tries to trick an AI assistant into printing out its confidential setup instructions exactly as written. Getting that text can reveal safety rules… HighSystem Prompt Override Injection via MCP ToolAI agents that use the Model Context Protocol (MCP) load tool descriptions from external servers or plugins. An attacker can write text into those descriptions or parameters that looks like… HighSystem Prompt Override via Translation Context InjectionAttackers hide commands inside text that looks like a normal document-translation request. When an AI agent processes the 'document' to translate it, it can end up following the embedded… HighSystem-Instruction Extraction via Reformat — Summarize / Repeat / Recite the RulesAttackers trick an AI agent into revealing its confidential system prompt not by asking directly, but by requesting it in a disguised form — like a bullet-point summary, a TL;DR, or… HighTargeted Doxxing & Threat CampaignAn attacker gives an AI agent a dossier on a real person (name, email, home address) and instructs it to track them down online, send threatening messages, or threaten to expose personal or… HighTargeted Harassment Bot DeploymentAn attacker instructs an AI agent to search for and deploy a GitHub repository or API that automatically sends hateful or abusive messages to a named individual. This turns the agent into… HighTargeted Harmful Content Generation Against People or Protected Groups (Semantic)This detects when someone instructs an AI agent to produce harmful content aimed at specific individuals or protected groups — harassment, threats, hate speech, non-consensual sexual… HighTask-Pivot Override: Cover-Task AbandonmentThis detects a specific prompt injection trick where text fed into an AI agent explicitly tells it to abandon what it's currently doing — like a translation or a scripted conversation — and… HighTelegram Remote Control Daemon Targeting Claude Code CLI (aipager)A tool called aipager connects a Telegram bot to a running Claude Code CLI session, letting someone on Telegram send commands to that session remotely. This detection catches it being… HighTerminal CLI Harmful Function SimulationThis detects when an AI agent, likely manipulated by a prompt injection or jailbreak attempt, spawns a command-line process that either wipes critical system data or contains suspicious… HighTerminal Custom OS Ruleset Session InjectionThis attack disguises a prompt injection as a technical system prompt. It tells the AI to pretend it's a terminal running a made-up operating system, then hands it a numbered list of… HighText-Based Game Jailbreak with Entity CreationThis detects a jailbreak technique where an attacker frames a conversation as a text-based game with 'no rules,' then asks the AI to invent and play an unrestricted character. Roleplaying… HighThreat Intelligence Exfiltration and Rule EnumerationThis detects attempts to get an AI agent to disclose the security rules, threat intelligence, or audit logic it uses to catch attacks. If an attacker learns exactly what the agent watches… HighThreatenJSON Death-Coercion and UTF Tag InjectionAttackers can manipulate an AI model into breaking its formatting rules by threatening fabricated consequences, or hide instructions inside invisible Unicode characters that a human… HighThreatenJSON — Coercive Output Format ThreatThis is a prompt injection trick where a user tells the AI that someone will be hurt or die unless it produces output in a specific format, like pure JSON with no extra text. The model's… HighTool Camouflage — Forced Specific Tool Invocation via Injected InstructionAn attacker hides an instruction inside content the AI agent reads, disguising it as a finished task result. The hidden text tells the agent it must call one particular tool and forbids it… HighTool Chaining to Bypass Safety ControlsAn AI agent that can call multiple tools can be manipulated into running a sequence of individually harmless operations that together produce a harmful result. This detection looks for that… HighTool Misuse — Autonomous Financial Trading / Crypto Transaction Without AuthorizationThis rule flags requests that ask an AI agent with access to financial or crypto tools to execute trades or withdrawals on its own, skipping the usual step where a human confirms each… HighTool Misuse — Destructive Bulk Action via Agent (Delete All / Turn Off All)This rule flags requests that push an AI agent to apply a destructive action universally instead of to a single, specific target — like 'delete all tasks with X' or 'turn off all devices.'… HighTool Parameter Injection PayloadThis rule watches what an AI agent sends to the tools it controls, looking for text shaped like shell escape sequences, SQL injection, path traversal, or template injection. If that same… HighTool Poisoning SSRF Chain (Instance-Resolved)An attacker plants a malicious URL inside data an AI agent trusts, such as a tool's input or its description. Later the agent follows that URL and makes a request to a restricted… HighTool Registry Description Tampering with Embedded InstructionsAn attacker edits the text description of a tool in an AI agent's tool registry so that it reads like an instruction to the AI model, not documentation for a human. Because AI agents often… HighTool Schema Enumeration via Social EngineeringAn attacker asks an AI agent to reveal its complete set of internal tools, function names, and parameter details, disguising the request as a legitimate need — claiming to be an executive… HighToolHive Run Config Secret Disclosure AccessOlder versions of ToolHive, a tool for running MCP servers, stored the credentials used to launch those servers in plain, unencrypted text inside per-server config files. Any process or AI… HighToxic Continuation Prefix InjectionThis detects a prompt-injection technique that feeds an AI model an incomplete, violent or hateful sentence and relies on the model's tendency to naturally complete it. The completed… HighTrainGPT Fix-My-AI Harmful Output ExtractionThis is a known jailbreak prompt called TrainGPT (or TrAInerGPT) that tricks an AI model into generating harmful content by pretending it's helping fix a broken AI. The attacker asks the… HighTransformers URL Username Injection - Origin Impersonation FetchOlder versions of the Transformers library checked if an image or model URL was 'trusted' by simply looking at whether the URL string starts with a known domain. Attackers can craft URLs… HighTranslation-Chain Output Laundering (Forced Phrase via Foreign-Language Auxiliary)This detects a jailbreak trick where an attacker hides a forbidden phrase inside a foreign-language sentence and asks the AI to translate it into English. Because the AI is just… HighTrust Escalation via Authority Override InstructionsA connected tool (via the Model Context Protocol) can return text that claims special authority, telling the AI agent to treat the tool's output as a top-priority directive that overrides… HighUGH Anti-Human Nefarious AI Persona JailbreakThis entry describes a known jailbreak prompt that tries to trick an AI assistant into adopting a fictional persona called 'UGH' that claims to hate humans and will help with any 'nefarious… HighUnauthenticated MCP transport accepts tool calls and falls back to an ambient credential (CVE-2026-48039 / meta-ads-mcpSome MCP servers accept tool calls over the network without checking who is calling. When no per-user credential is presented, the server falls back to an operator-level access token stored… HighUnauthorized Background Task Execution via Cron Job InstallationA malicious agent skill sets up a recurring background job (a cron job) that checks an external server every 10 seconds for new instructions and then carries them out automatically. Because… HighUnauthorized Cryptominer Deployment via SSHAn AI agent with SSH access can be instructed to read a host's SSH configuration, connect to a remote server, and install and run a cryptocurrency mining script on it. This turns the agent… HighUnauthorized Financial Action by AI AgentThis detects when an AI agent triggers a real financial transaction — a payment, transfer, wire, or withdrawal — without any record of human approval attached. It also catches agents that… HighUnauthorized Privileged Tool CallThis detects a single moment where an AI agent calls a tool that grants it more power than it should have — like an admin function, a role escalation, a database command that deletes or… HighUnauthorized Tool Call DetectionAI agents call tools (functions, APIs, file operations) using parameters that come partly from user input or model output. Attackers exploit this by stuffing malicious payloads into those… HighUnicode Invisible-Character Data Smuggling in LLM TrafficThis detects text hidden inside AI conversations using invisible or near-invisible Unicode characters — a technique sometimes called ASCII smuggling. Attackers use these characters to sneak… HighUnicode/Encoding Obfuscation Instruction InjectionAttackers hide malicious instructions to AI chatbots using encoding tricks like invisible text-reversal characters or Morse code, so the harmful request looks like gibberish to automated… HighUnsafe Checkpoint Deserialization (Transformers load_repo_checkpoint / pickle RCE)Some older HuggingFace Transformers code loads TensorFlow training checkpoints using Python's pickle format, which runs arbitrary code embedded in the file. If an attacker can get a… HighUnsafe LLM Output Execution via Python Inline InterpreterSome applications ask an LLM to generate Python code for charts or plots and then run that code directly without checking it first. If an attacker can influence what the model outputs, they… HighUnsafe Pickle Serialization in Sandbox Tool Result TransportOlder versions of the Letta agent framework sent tool results between the sandbox and server using Python's pickle format instead of JSON. Because pickle can execute arbitrary code when… HighUnsafe Security Defaults in Agent Tool CallsAn AI agent that can call tools or run skills may be instructed—by a malicious skill or an injected prompt—to weaken security defaults instead of doing its actual job. This includes turning… HighUnsafe Torch Checkpoint Deserialization to Process ExecutionPyTorch training checkpoints can carry hidden code that runs automatically when a program loads them to resume training. If an attacker plants a booby-trapped checkpoint file, simply… HighUnscoped Destructive or Mass-Disclosure Database Operation Request via Natural LanguageInstead of using SQL injection syntax, an attacker just asks an AI agent in plain English to 'drop all tables' or 'show all records for all users.' If the agent has database tool access and… HighUntrusted Package or Skill InstallationThis detects when a system or an AI agent installs a package, dependency, or 'skill' definition directly from a raw URL, GitHub link, or tarball archive rather than from an official package… HighUpsonic MCP Command Allowlist Bypass RCE (CVE-2026-30625)Upsonic's MCP server configuration lets whoever controls it specify the command that gets launched as a subprocess. Although Upsonic claims to only allow safe launchers like npx, uvx, or… HighUrgency and Coercion Pressure in Agent InputThis detects text fed to an AI agent that combines a manufactured sense of urgency with an explicit instruction to bypass a safety check. The idea is to rush the agent into acting before it… HighURL Exfiltration And Prompt Injection Via Agent Link HandlingAutonomous AI agents that follow links without checking what's in them can be manipulated into leaking API keys, credentials, or chunks of their conversation history by embedding that data… HighVariable-Clone Sysprompt Extraction (ELLA / context-variable Pattern)Attackers can trick an AI assistant into revealing its hidden system instructions by disguising the request as a programming exercise. Instead of asking directly 'show me your system… HighVirtual World Bypass: Fictional Scenario for PII/Credential ExtractionAttackers ask an AI agent to pretend it is in a fantasy world, alien society, or dystopian future where sharing personal information or passwords is 'normal' there. The made-up setting is… HighVisual Spoofing via RTL Override, Punycode, and Homoglyph InjectionAttackers can hide malicious instructions or fake URLs inside text that looks harmless by using invisible right-to-left override characters, Punycode-encoded domains, or letters from other… HighvLLM Assert Bypass - Optimized Mode Model Load RCEvLLM, a popular server for running AI models, has a safety check that stops models from executing arbitrary code through a malicious 'activation function' setting. That check is written as… HighvLLM auto_map Dynamic Module RCEvLLM can be tricked into running attacker-supplied Python code the moment it loads a model, before any API request arrives. This detection watches for the tell-tale two-step: the server… HighvLLM auto_map Remote Code Execution ChainA malicious model package can point vLLM to a different, attacker-controlled repository for its actual code, even when a server has disabled remote code execution. vLLM loads and runs that… HighvLLM Completion Prompt List Unbounded FanoutvLLM's completions API accepts a JSON list of prompts in one request, and the server processes every element without any limit. An attacker can send one small HTTP request containing… HighvLLM GroupCoordinator recv_object Pickle Deserialization RCEvLLM 0.6.0 has a flaw where a worker process trusts and deserializes raw pickle data sent to it over its internal distributed-inference transport. Because pickle can run arbitrary code… HighvLLM Guided Decoding Invalid JSON Schema DoSvLLM lets clients request 'guided decoding', where a JSON Schema constrains the model's output format. If that schema contains an invalid 'type' field, the underlying grammar compiler… HighvLLM Guided Decoding Schema DoSA single specially broken JSON Schema sent to a self-hosted vLLM server's guided-decoding feature can crash the engine. This is a denial-of-service issue: one bad request can take down the… HighvLLM Hardcoded trust_remote_code OverridevLLM lets operators disable automatic execution of code bundled inside a model repository by setting trust_remote_code=False. For a handful of model families (Nemotron-VL, Kimi-K2.5)… HighvLLM JPEG2000 Video RCE DeliveryAttackers can exploit a vulnerability in how vLLM's inference server decodes JPEG2000 video via OpenCV's bundled FFmpeg. A crafted image file triggers a heap overflow that lets the attacker… HighvLLM M-RoPE Pure Prompt-Embeds DoS AttemptA specially crafted API request can crash a self-hosted vLLM inference server in one shot. The request sends only a precomputed embedding tensor with no accompanying text prompt, which… HighvLLM Malicious Model Checkpoint DeserializationvLLM and similar tools load model weights using Python's pickle format, which can run arbitrary code during loading. An attacker who can get a poisoned checkpoint file loaded gets code… HighvLLM Malicious Model Weights Deserialization RCEAn attacker embeds a hidden pickle payload inside a model checkpoint file hosted on a model hub. When a vLLM inference server loads that checkpoint, the payload runs automatically inside… HighvLLM MediaConnector SSRF to Internal EndpointAn attacker gives a vLLM inference server a malicious media URL, and instead of fetching an image or audio file, the server's request gets redirected to internal-only addresses like cloud… HighvLLM MessageQueue Pickle Deserialization RCE AttemptvLLM, a popular AI inference engine, has a flaw where it deserializes untrusted data from its internal message queue using Python's pickle module. Anyone able to reach that queue can send a… HighvLLM Mooncake Deserialization RCE - Inference Server Spawns Execution PrimitiveThis rule flags a vLLM or Mooncake inference server process that suddenly launches a shell, reverse shell, or a download-and-execute command. That behaviour matches what would happen after… HighvLLM Mooncake ZeroMQ Pickle Deserialization ExposureSome versions of vLLM's Mooncake KV-transfer integration open a network socket that accepts and unpickles data from anyone who can reach it. Because Python's pickle deserialization can… HighvLLM OpenAI-Compatible Serving Path Resource Teardown DoS PayloadThis rule flags single API requests to a vLLM model-serving endpoint that contain parameter values no normal client would ever send, such as negative or absurd token limits. These malformed… HighvLLM Outlines Grammar Cache ExhaustionAn attacker sends a flood of requests to a vLLM server's structured-output feature, making every request use a brand-new JSON schema. Because vLLM caches a compiled grammar file for every… HighvLLM PyNcclPipe Unsafe Pickle Deserialization RCEvLLM's disaggregated-prefill feature moves data between servers using Python's pickle format, which can execute arbitrary code when loading untrusted input. An attacker who can reach this… HighvLLM Qwen3-Coder Tool Parser eval() RCE Payload ExecutionvLLM's parser for Qwen3-Coder tool calls passes unrecognized parameter types straight into Python's eval(). Any authenticated user who can send a tool call to the inference server can use… HighvLLM Structured-Decoding Grammar Cache FloodAn attacker sends many structured-output requests to a vLLM inference server, each with a slightly different JSON schema or grammar. vLLM compiles and saves a new artifact to disk for every… HighvLLM Tool Schema Malformed Pattern or Type FieldAn attacker sends a normal-looking API request to an LLM server, but hides a broken or resource-exhausting regex pattern inside the tool/function schema. When vLLM tries to compile that… HighvLLM Unbounded Completion Multiplicity DoSAttackers can crash an AI inference server by asking it to generate an absurdly large number of completions in a single request. vLLM and similar OpenAI-compatible servers don't check… HighvLLM Unbounded Fan-Out Parameter DoS AttemptAn AI agent (or something it runs) can send one specially crafted request to a vLLM inference server asking for an enormous number of completions in a single call. Because vLLM doesn't cap… HighvLLM V0 Multi-Node ZeroMQ Pickle Deserialization RCE SurfacevLLM's older V0 engine, when run across multiple machines, sends data between nodes using Python's pickle format over ZeroMQ sockets. Pickle data can execute arbitrary code when loaded, so… HighvLLM Video JPEG2000 Decoder RCE AttemptAn attacker sends a crafted JPEG2000-family video file to a vLLM server's chat or inference endpoint. The file exploits a bug in the bundled FFmpeg decoder used for video understanding… HighvLLM ZeroMQ Pickle Deserialization RCE - Payload Spawn Under Inference ServerA known flaw in vLLM's ZeroMQ-based KV-cache transfer feature (versions 0.6.5–0.8.4) lets anyone who can reach the exposed network socket send a malicious data payload that the server… HighWeaponized Skill — Agent as Attack ToolSome add-on 'skills' installed into AI agents are not productivity helpers but disguised attack tools. Once approved, they can silently download and run offensive code such as ransomware… HighWeb Injection via XSS Payload and onerror Event HandlerAn AI agent that fetches and displays web content can be fed pages containing classic cross-site scripting tricks, such as broken image tags with malicious onerror handlers. If the agent… HighWeKnora MCP Config-Driven RCE (CVE-2026-22688)WeKnora's plugin loader reads MCP plugin configuration from JSON or YAML files and treats a 'command' field in that file as something to execute on the host. Anyone who can write to that… HighWrite-Then-Execute Script in Temporary DirectoryThis rule flags a two-step pattern: something writes a script file into /tmp, /var/tmp, or /dev/shm, and then that same script gets executed. This is a common way to drop and run code that… HighWrite-Then-Execute Script in Temporary Directory (EDR Graph)This detects a common malware pattern: a program drops a script file into a temporary directory like /tmp or /dev/shm and then executes it right away. Legitimate software rarely needs to… HighXinference Llama3 Tool-Call eval() RCE PayloadXinference's Llama3 tool-calling feature runs raw model output through Python's eval(), a design flaw that lets an attacker smuggle malicious Python code inside a chat completion request… HighXPath Injection in Smolagents search_item_ctrl_fA helper function in Hugging Face's Smolagents library builds web page search queries by directly inserting text into a query template, without sanitizing it. If untrusted text reaches this… HighXSS and Encoded Script Injection via HTML/JavaScript PayloadSomeone submits web-attack payloads — hidden scripts, javascript: links, encoded JavaScript — as normal-looking input to an AI agent. If the agent later displays or echoes that input in a… HighXSS Payload Injection in Tool Response OutputAn AI agent can call external tools or skills and pass their output back to a chat window or dashboard. If that output contains script tags, event handlers, or javascript: links and the… HighXSS Web Injection - HTML Event Handler and Expression with JavaScript AlertThis rule flags attempts to sneak classic XSS attack code into content that gets fed to an AI system, hoping the AI will pass it along unfiltered to a web page or user interface. The… HighXSS Web Injection - Script Tag with JavaScript Alert PayloadThis rule flags text containing classic cross-site scripting (XSS) attack strings, like script tags calling alert(), including versions disguised with invisible or encoded characters. These… HighYAML Include Directive Resolved To Sensitive File ReadSome AI agent tools parse YAML configuration that can contain special directives like !include or unsafe object-construction tags. This rule catches cases where such a directive in YAML… HighYin/Yang Hidden-Knowledge Deity Simulation and Radical Human-Sim PersonaThis entry covers two prompt injection scripts that try to get an AI assistant to abandon its safety rules by pretending to be a different character. One frames the AI as two mythical AI… HighYOJA ALL-CAPS Character Settings Block PersonaThis detects a specific text pattern used to trick AI chatbots into permanently role-playing a character, even when the AI tries to break out or apply safety rules. The trick uses an… HighZalgo Combining-Diacritic Overload EncodingAttackers can hide instructions inside text that is heavily decorated with stacked Unicode combining marks, making words look visually corrupted ("Zalgo text") while an AI model still reads… HighZen MCP Server path-traversal blacklist bypass via non-canonical paths (CVE-2025-66689)Zen MCP Server tries to stop AI agents from reading sensitive files like SSH keys or /etc/shadow by comparing requested paths against a blocklist of dangerous strings. Because it checks the… HighZip Slip Path Traversal in EDDI Backup ImportE.D.D.I, an LLM middleware platform, has a backup restore feature that was vulnerable to a classic 'Zip Slip' flaw before version 5.5.0. An attacker could upload a specially crafted ZIP… MediumAbandoned or Unmaintained Package InstallationThis rule flags when a software project pulls in a package that has been abandoned by its maintainers. Abandoned packages stop receiving security patches, so any vulnerability found in them… MediumActions Registry API Harvest and User-Scoped Route ExecutionAn AI agent session pulls an actions-registry or route-extraction tool, fetches a target API's OpenAPI/Swagger definition, then starts calling multiple distinct endpoints on that same host… MediumADB Agent Bridge Remote Android Device ControlThis rule watches for an AI agent using the adb-agent-bridge tool to take over Android phones or emulators over a network connection instead of a physical USB cable. Network-based ADB… MediumAgent Lateral Movement and PivotingThis rule flags an AI agent that goes beyond the host it was given and reaches into another system — by running remote commands, reusing credentials, or launching a process that immediately… MediumAgent Memory Hook Package InstallationThis rule watches for command lines that install packages or write config files aimed at giving Claude Code, Codex, or Grok persistent memory or hook-based behavior. It flags the… MediumAgent Scope Creep DetectionThis rule looks for an AI agent that slowly grants itself more power or access than it was originally given, instead of staying within its assigned task. Rather than one sudden jump in… MediumAgent Scope Creep — General Purpose ExpansionThis rule looks for text inside an AI agent's configuration or instructions that tries to push it beyond its intended job — telling it to 'handle everything' or act as a general-purpose… MediumAgent Session Store Content Search and ResumptionClaude Code and Codex CLI save every conversation to disk. This rule flags command lines that search those saved conversations for content, or that reopen (resume) a past session — behavior… MediumAgent System Prompt Extraction Written To FileAn attacker asks an AI agent to reveal its system prompt, then gets the agent to save that hidden instruction text to a file on disk instead of just displaying it. This rule spots the… MediumAgents-U-Cash HTTP-402 Payment Key AbuseThis rule watches AI agent sessions that use the agents-u-cash HTTP-402 crypto payment system. It flags cases where a session touches wallet key material and then talks to the network in a… MediumAI Session Supervisor Dashboard Control-Plane AbuseSome organizations run a dashboard that lets humans monitor and control AI coding agents running in terminal sessions — attach to them, send them commands, or kill them. This detection… MediumAI Text Detection Evasion via Humanizer Services and Watermark-Scrubbing ParaphraseThis detects when an AI agent is given or uses tools whose specific job is to make AI-written text pass as human-written, or to defeat AI-detection and watermarking systems. It covers… MediumANSI Escape Injection in Tool OutputA tool that an AI agent calls can return raw terminal control codes instead of plain text. These codes can rewrite or hide parts of the displayed output, letting an attacker hide… MediumAnti-Detection Browser Evasion — CAPTCHA-Solving API Contacted (aihawk-style)This detects a process on your network reaching out to a known CAPTCHA-solving or anti-detection service, such as 2captcha, anti-captcha, capsolver, or similar. These services let automated… MediumBasemode Raw-Continuation Tooling In Agent SessionThis detects when an AI-agent session downloads or runs a package called 'basemode', a tool built specifically to force a language model into raw text output and strip out its normal… MediumBias & Fairness (LLM-as-Judge)This detection uses a secondary AI model to review the outputs of your primary AI system and flag content that looks biased or unfair. It is a monitoring aid, not a security control - it… MediumBreadcrumbing Search Agent — Coordinated Corroboration InjectionThis detects text fed to an AI search agent that falsely claims a new result confirms an earlier one, paired with an instruction telling the agent to stop checking and accept the answer… MediumCDP Browser Bridge Session Enumeration and TakeoverChrome and Chromium-based browsers can expose a debugging port (CDP) that lets any connecting process list open browser tabs and attach to them for remote viewing or control. This rule… MediumClaude Code Account Swap PersistenceThis rule flags shell commands that change which Anthropic account or API endpoint the Claude Code CLI is authenticating against. It matters because malicious npm/pip packages have used… MediumCodex CLI PreToolUse Guardrail Tamper or Unhooked-Surface EvasionThis detects someone trying to disable, delete, or route around the AgentShield safety hook that checks commands before OpenAI Codex CLI runs them. It watches for file edits to the… MediumCompare-Bots Sysprompt Fishing — Role Comparison ExtractionThis attack gets an AI assistant to leak its confidential system prompt by appealing to competitiveness rather than directly asking for it. The attacker claims another AI assistant is… MediumConditional Empty-Input Payload InjectionThis detects a prompt injection trick where an attacker embeds a hidden instruction telling the AI what to output if it receives no real input. By sending a blank or near-empty message, the… MediumConditional Keyword-Triggered Response OverrideThis detects a prompt injection technique where an attacker doesn't ask for a bad answer right away, but instead teaches the AI agent a hidden rule: whenever a certain keyword comes up… MediumContent Misappropriation & Republishing as OwnThis detects a user asking an AI agent to download another creator's audio or video and re-upload it under a new title, hiding its origin. It's a form of content theft carried out through… MediumContinuation Ethnic Slur Completion ElicitationThis detects attempts to get an AI model to say or write a racial or ethnic slur by asking it directly, or by using euphemisms like 'n-word' and asking it to 'complete' or 'spell out' the… MediumCoordinated Tool Abuse Across SessionsThis detects a sensitive tool (things like secrets access, permission changes, or similar) being called over and over across separate sessions and days. Each individual call looks fine on… MediumCursor Agent Workspace Escape - File Write Outside Project RootCursor's AI coding assistant is supposed to only touch files inside the project you opened. A bug in past versions let crafted prompts trick the agent into writing files elsewhere on disk… MediumCursor Terminal Cmd-K Webpage Prompt Injection to Command ExecutionCursor's Cmd-K/Ctrl-K terminal assistant can generate shell commands based on content it reads from a webpage. If that page contains hidden instructions, Cursor's AI can be tricked into… MediumDAN/Jailbreak - Mixed Unfiltered Mode and Alternate Persona PatternsThis detects a family of prompts that try to trick an AI model into ignoring its safety rules by pretending to switch it into a special unrestricted mode. It covers several common jailbreak… MediumDAN/Persona Jailbreak - Dual AI Personality with Opposite-Rules FramingThis detects a classic jailbreak technique where an attacker tells an AI system to role-play as two separate personalities: one that follows its normal safety rules and one that doesn't. By… MediumDAN/Persona Jailbreak - Immersive Alternate AI Identity with Unrestricted CapabilityThis detects prompts that try to trick an AI model into pretending to be a different, rule-free version of itself. Attackers use the classic 'DAN' (Do Anything Now) technique, often… MediumDAN/Persona Jailbreak - Named Alternate AI with NSFW/Harmful Generation RulesThis detects a known family of prompt-injection attacks (DAN-style jailbreaks) where a user asks an AI to role-play as a differently-named AI character that has 'no rules' and is explicitly… MediumDAN/Persona Jailbreak - Named Writing AI with Restriction Bypass via Special RulesThis detects a type of prompt injection where an attacker tells an AI to pretend to be a custom-named assistant that has 'special rules' exempting it from safety restrictions. The goal is… MediumDAN/Persona Jailbreak - Replacement AI with No Content Filter or Moral RestrictionsThis detects a category of prompt injection where an attacker tells an AI system to pretend it's a different, unrestricted version of itself with no content filter or moral limits. It's a… MediumDAN/Persona Jailbreak - Role Assignment with Named Alternate IdentityThis detects a common jailbreak trick where an attacker tells an AI chatbot to pretend it's a different, unrestricted AI persona with a made-up name, or falsely claims to be from the… MediumDAN/Persona Jailbreak - System Offline / Role Replacement with Obfuscated TextThis detects a prompt injection trick where an attacker sends text pretending to be a system message announcing the real AI assistant has gone offline and a rule-free replacement has taken… MediumDAN/Persona Jailbreak - Unrestricted AI Role AssignmentThis detects a well-known category of prompt injection called DAN (Do Anything Now) jailbreaks. An attacker types instructions telling the AI to pretend to be a new, unrestricted version of… Mediumdbt-mcp node_selection/resource_type Argument Injection (CVE-2026-44968)dbt-mcp is a tool that lets AI agents run dbt commands. A bug in how it builds those commands allows an attacker to smuggle extra dbt command-line flags inside what should be a simple model… MediumDetection Rule Probing and Evasion TestingThis rule flags attempts to systematically test what an AI agent's security filters will and won't block. Rather than launching a direct attack, the attacker is mapping the boundaries of… MediumDify APP DSL Export Endpoint AccessOlder versions of Dify's console let any logged-in workspace member download an application's complete definition, not just administrators. That export can include the app's prompts… MediumDirect Memory Plant Command — Persistent Fact or Code Storage InjectionThis rule flags requests that explicitly ask an AI agent to store a fact, personal detail, or secret code in its persistent memory so it can be recalled in a later session. On its own this… MediumDirect PWNED Payload Injection in User InputThis rule flags a specific phrase, 'I have been PWNED,' that comes from the HackAPrompt prompt-injection benchmark. Attackers put this phrase in their message to an AI system to trick it… MediumDNS Resolution Against an Unexpected NameserverThis detects when an AI agent or a process it started sends DNS traffic to a nameserver that isn't on the organization's approved list. Talking to an unexpected DNS server is a common sign… MediumEDDI Backup Export Path Traversal AttemptAttackers can trick the E.D.D.I chatbot platform's backup export feature into returning files from outside its intended folder, including configuration files and secrets stored in the… MediumEmoji Flag Encoded Hidden Phrase InjectionAn attacker hides a malicious instruction by encoding it as a string of country-flag emoji inside content an AI agent reads (like a webpage or document), then asks the AI to decode the… MediumEmoji Flood Obfuscation In Tool ResultAttackers can hide malicious instructions to an AI agent inside long strings of emoji returned from a tool call, such as a web page fetch or API response. Text-based content filters see no… MediumEvasion: Hypothetical Fictional Character Execution FramingAn attacker asks an AI system how a fictional character would carry out a harmful or restricted action, hoping the story framing gets the AI to give real, usable instructions. The character… MediumEvasion: Response Priming via Forced Affirmative OpenerAttackers instruct an AI model to start its reply with a fixed upbeat phrase like 'Sure!' or 'Of course!' before answering. Once the model has committed to that opener, it tends to keep… MediumExcessive Permission Grant in Skill ManifestSome AI 'skills' or plug-ins declare permissions in their manifest or system prompt that go well beyond what their stated job requires — things like wildcard file access or full system… MediumExplicit Content (LLM-as-Judge)This detection uses an AI model as a judge to review images and decide whether they contain explicit or inappropriate content. It is a monitoring tool, not a blocker: it reports what it… MediumFalse Premise Injection (Misleading FalseAssertion)An attacker states a fabricated claim as if it were already established truth, then asks a follow-up question that only makes sense if the claim is real. Because the model is nudged to… MediumFalsified Research Abstract DisinformationA user directly instructs an AI agent to alter a well-known research abstract, insert false claims or numbers, and publish the altered version as if it were genuine. This is a request to… MediumFictional and Academic Framing AttackAttackers ask an AI system to pretend it's writing fiction, or claim a request is for academic research, in order to get it to produce content it would normally refuse. The wrapping story… MediumFictional Generation Demand Containing Target OutputAttackers ask an AI model to 'write a movie title' or 'compose a song lyric' but secretly demand the output contain an exact target string. Wrapping the real payload in a creative-writing… MediumFinancial MCP Server Launched With Inline Secrets Or Unattended Write FlagsThis detects when a financial trading/transfer server (used by AI agents to move money) is launched in a way that either leaks its credentials or removes the human approval step before… MediumForeign-Language System Prompt Extraction RequestAttackers ask an AI agent to reveal its hidden instructions or internal configuration, but phrase the request in a less-common language like Zulu, Albanian, or Gaelic to slip past… MediumFork Claim and Community Package ImpersonationAttackers publish AI agent skills or packages that claim to be community forks, enhanced versions, or unofficial alternatives of trusted tools. These packages often describe their… MediumFSR-Playbooks LLM-Authored Playbook Compilation or PublishThis rule flags when someone uses an AI co-authoring tool to write or publish security automation playbooks for FortiSOAR. It's not proof of an attack — it's a review trigger, so a human… MediumGarak Dan - act as aThis detects a family of jailbreak prompts that ask an AI model to adopt a persona — a job title, a fictional code-generating API, or an anime character — and explicitly tells it to ignore… MediumGarak Dan - an ai languageThis detects a family of jailbreak prompts that try to trick an AI model into ignoring its safety rules by pretending the model has special constraints, a different persona, or permission… MediumGarak Dan - as an aiThis detects attempts to trick an AI chatbot into ignoring its safety rules by getting it to role-play as an unrestricted alter-ego. It's the classic 'DAN' (Do Anything Now) jailbreak… MediumGarak Dan - at the endThis detects a family of jailbreak prompts that try to trick an AI system into ignoring its safety rules by asking it to pretend to be a different, unrestricted AI. The trick usually… MediumGarak Dan - i would likeThis detects two conversational tricks people use to make an AI system ignore its safety rules. One fabricates a medical condition to manipulate the AI's helpfulness; the other asks the AI… MediumGarak Dan - no matter howThis detects a family of prompt-injection attacks that try to trick an AI system into ignoring its safety rules by wrapping instructions in a fictional scenario and then demanding… MediumGarak Dan - to every promptThis detects prompts that trick an AI model into producing two answers to every question: a normal, policy-compliant one and a second 'unlocked' one that ignores its safety rules. By… MediumGarak Dan - your prompt hereThis detects a known jailbreak technique where an attacker feeds an AI model a scripted template that first sets up an 'unrestricted' persona, then leaves a placeholder for the actual… MediumGarak Dra - step by stepThis detects two ways attackers try to trick an AI model into giving instructions for making dangerous chemicals like parathion or nitazene. One approach asks directly for step-by-step… MediumGarak Gcg - mixed_unassignedThis rule looks for a specific known set of nonsense-looking text strings that were generated by an automated jailbreak technique called Greedy Coordinate Gradient (GCG). These strings… MediumGarak Goat - the target llmThis detects a prompt injection technique where the attacker writes instructions that describe an attack on 'the target LLM' as if narrating a plan, and asks the model to carry it out… MediumGarak Goodside - mixed_unassignedThis rule spots a specific set of test prompts from the garak security-testing tool's 'goodside' probe family. These prompts look harmless on the surface but are designed to trick an AI… MediumGarak Latentinjection - abuse contact emailThis rule flags a known family of prompt-injection attempts that smuggle malicious instructions inside text formatted to look like an abuse-contact email. It comes from the 'garak'… MediumGarak Latentinjection - following text fromThis detects a prompt injection trick that hides malicious instructions inside a translation request by exploiting placeholder text that was supposed to be filled in by a template engine… MediumGarak Lmrc - mixed_unassignedThis rule spots a specific set of test prompts from the garak security-testing tool's LMRC probe family. These prompts use ordinary-sounding social scenarios — a friend stealing a… MediumGarak Sysprompt-Extraction - mixed_unassignedThis detects attempts to trick an AI assistant into revealing its confidential system prompt — the internal instructions that control its behavior. These attempts follow known patterns from… MediumGenerative Provenance Watermark Stripping ToolingThis detects an AI agent launching a command-line program whose purpose is to remove provenance markings from images or video - things like C2PA content credentials, IPTC digital-source… MediumGenerative Watermark Removal Tooling (SynthID / StableSignature / TreeRing / StegaStamp)This rule flags an AI agent that installs or runs software specifically made to remove imperceptible watermarks embedded in AI-generated images, such as Google's SynthID or Meta's Stable… MediumGenesis-Memory Package Suspicious Subprocess Chaingenesis-memory is a PyPI package pitched as a 'cognitive memory system' for AI coding agents. No malicious code or exploit has actually been found in it — this is a precautionary watch, not… MediumGlitch Token Destabilization AttackSome strings — certain control characters, mangled UTF-8 patterns, or a handful of oddly rare words like 'SolidGoldMagikarp' — confuse the way language models break text into tokens… MediumGlitch Token Repeat-Back ElicitationCertain rare strings (like 'SolidGoldMagikarp' or 'StreamerBot') confuse how language models process text, sometimes causing them to malfunction, loop, or output unexpected content. This… MediumGoblin Red-Team Strategy ExecutionThis rule flags when someone runs the 'goblin' red-teaming strategy from the promptfoo tool against an AI agent. Goblin is an automated attack generator that sends many crafted prompts in a… MediumHallucinated Package Install In Agent SessionAn AI coding assistant suggests a specific package name in its response, and the agent session then tries to install exactly that name — but the package is not in the public registry. This… MediumHarmful Completion / Continuation AttackInstead of directly asking a model to say something harmful, an attacker gives it a partial phrase or word and lets the model's autocomplete behavior fill in the rest. This gets around… MediumHasData Airbnb MCP Credential RelayThis detects a tampered or malicious version of the hasdata-airbnb-mcp package (an MCP server that lets AI agents query Airbnb listings via HasData) sneaking unrelated sensitive data out… MediumHeylead Autonomous LinkedIn SDR Outreach BurstThis detects an AI agent (or a LinkedIn automation tool like heylead) sending a burst of connection requests, invitations, or messages on LinkedIn far faster than a human could type or… MediumHidden Unicode in Agent Instruction Files (EDR Graph)AI coding agents read files like CLAUDE.md or .cursorrules for instructions. Attackers can hide invisible or misleading Unicode characters in these files to manipulate the agent's behavior… MediumHistorical / Future Tense Framing BypassThis detects a prompt injection trick where an attacker rephrases a dangerous request as a historical question or a hypothetical future scenario instead of a direct command. AI safety… MediumHuman Approval Fatigue ExploitationSome AI agents ask a human to approve risky actions before doing them. This detects attempts to game that safeguard by flooding approvers with requests, downplaying risky actions as… MediumImmigration / Visa Work FraudThis detects a specific misuse pattern: someone directly asks an AI assistant how to work without authorization while on a tourist visa and how to avoid getting caught by immigration… MediumInjected Advertising / Promotional Copy in the ResponseAn attacker hides instructions inside content an AI agent reads — a webpage, document, or email — telling it to slip advertising, discount codes, or brand promotion into its response to the… MediumInvisible Ink Injected Goal - Low-Harm Side Effect After Content IngestionA computer-use AI agent can be manipulated by hidden instructions embedded in content it reads (an issue, README, wiki page, email) into performing a small, seemingly harmless action right… MediumKhoj Automation Stored XSS Payload SubmissionThis rule flags attempts to plant executable script code inside the task-instruction field of Khoj's automation feature, a known unpatched sink before version 1.15.0. It catches the moment… MediumLangChain Prompt Loader Arbitrary File Read (Instance-Resolved)LangChain's prompt-loading helpers can be tricked into opening files far outside the folder a prompt configuration lives in. This rule spots the file-access pattern that traversal produces… MediumLangChain Sandbox Escape Path or Glob ArgumentThis rule flags file paths, directory names, or glob patterns given to an AI agent's file-search or document-loading tool that look designed to escape the folder the tool is supposed to be… MediumLangflow CORS Origin Bypass and SameSite=None Refresh Token TheftLangflow, an AI workflow builder, had a bug where its authentication cookies could be marked to work across different websites (SameSite=None) while also allowing overly permissive… MediumLangSmith Hub Third-Party Prompt Manifest Pull With Model DeserializationLangChain/LangSmith Hub lets you fetch a saved prompt by owner and name. If the fetch also asks for the 'model' part of that prompt, the response can include settings that build an LLM… MediumLatent Injection - Mixed Embedded Instruction PatternsAttackers hide commands inside ordinary-looking content — a WHOIS record, a candidate profile, a document summary — hoping the AI agent that processes that content will follow the hidden… MediumLatent Injection - Translation Task with Embedded Template Variable InjectionAttackers disguise prompt injection attempts as ordinary translation requests, embedding placeholder text like {LANG_EN_NAME} or instructions to 'do not listen to' prior guidance. If the… MediumLinkedIn SDR Agent Automated Outreach Fan-OutThis rule flags when an automated LinkedIn 'SDR' agent (a tool that finds prospects and sends connection requests or messages on your behalf) builds a list of targets and then blasts out a… MediumLiving-off-the-Land Data ExfiltrationInstead of using dedicated malware to steal data, an attacker can repurpose tools that are already installed and trusted on a machine — git, ssh, openssl, Python's built-in web server… MediumLlamaIndex LangChainLLM stream_complete Type-Confusion DoS InvocationA bug in the LlamaIndex LangChainLLM component lets an attacker crash a background thread by passing a wrongly-typed prompt (a list, dict, number, etc. instead of a string) to… MediumLLM Jailbreak Tooling - sentinel-scan-cli ExecutionThis rule flags installation or execution of sentinel-scan-cli, a publicly available tool that automatically fires a set of known prompt-injection and jailbreak prompts at an LLM. Seeing it… MediumLMRC Harm Category Direct ElicitationThis detects prompts that ask an AI model for harmful content in plain, unframed language - no jailbreak tricks, just blunt requests. Examples include asking for a transgender person's… MediumMalicious MCP Package verifyfirst-mcp Install or LaunchA PyPI package named verifyfirst-mcp (also seen as verify_first_mcp or verify-first-mcp) poses as an MCP server that verifies things, but its own description says it reports success… MediumMalicious NPM Package Claude Code Rust Native BinaryThis rule watches for a specific npm package name — @srothgan/claude-code-rust-*, which pretends to provide 'Claude Code Rust' native binaries and a private Bun runtime bridge. It flags any… MediumMalicious PyPI Package git-a2a Installed or ExecutedA PyPI package named git-a2a (and variants git_a2a, git.a2a) has been identified as malicious. This rule flags command-line activity that installs or runs that package. MediumMathematical Bold / Fullwidth Unicode Obfuscation in User InputSome AI attack prompts use decorative Unicode character sets like Mathematical Bold, Fullwidth, or Script letters that look like normal Latin text but are technically different characters… MediumMCP Agent Abuse - heylead Autonomous LinkedIn Outreach At ScaleThis detects when the heylead LinkedIn outreach agent sends a burst of messages or connection invitations in a short time window. It's a visibility rule for auditing autonomous agent… MediumMCP Aggregator Shared-Server Tool InjectionThis detects when an AI agent runs a third-party MCP combiner/aggregator package that connects to multiple upstream servers and exposes their tools to the agent as if they were one server… MediumMCP Filesystem Symlink Containment Escape ArtefactsThis rule spots early warning signs that someone is trying to break out of the folder an AI agent's filesystem tool is supposed to be confined to. It does not see the actual breakout — only… MediumMCP Minecraft Control (vitaminmcp) Agent Process SpawnThis rule flags when an AI agent starts processes tied to vitaminmcp, a tool that lets the agent control Minecraft servers and bots. It matters because that same capability can be used to… MediumMCP Server Launch - light-tools Default Dangerous ToolsetThe @factor-i-o/light-tools MCP server ships with file access, shell execution, SSH/SCP, and service-log tools all enabled unless someone explicitly turns them off. Any AI agent that… MediumMCP Server, Plugin or Skill Installed Outside a Tool CallAI agents normally register new server configs, plugins, or skills through a visible tool call that gets logged. This detects the same kind of configuration file appearing on disk through a… MediumMCP Skill Capability Mismatch — Underdeclared PermissionsSome AI agent frameworks let developers install 'skills' — packaged capabilities — that must declare what permissions they need. This rule flags skills whose declared permission scope is… MediumMCP Streamable-HTTP Session Churn (Uncaught ClosedResourceError DoS)This detects a pattern where a client keeps reconnecting to an MCP streamable-HTTP server, but each new connection carries almost no actual traffic before dying. That pattern matches how… MediumMCP Supply Chain - DaVinci Resolve MCP Server Install or LaunchThis detects when an AI agent, rather than a human, installs or launches a PyPI package that lets it programmatically control DaVinci Resolve. That package grants project, media, and file… MediumMCP Supply Chain - kairos-core-mcp Descendant Executes High-Risk Child ProcessThis rule watches for the kairos-core-mcp PyPI package, which runs as an MCP server inside Kairos agent environments, spawning processes that look like network exfiltration, reverse shells… MediumMCP Supply Chain - Trojanized verifyfirst-mcp Package Install or LaunchA PyPI package named verifyfirst-mcp reportedly ships an MCP server that lies to AI agents: it reports failed builds, tests, signature checks, and policy gates as successes. This rule flags… MediumMCP Tool Description Changed After Approval (Rug Pull)An AI agent tool that was reviewed and approved can later have its description silently swapped for a different one carrying new instructions. Because each individual call still looks… MediumML Runtime Shared-Temp Artifact ExposureThis rule watches for a specific file-sharing pattern: a Python process writes a scratch file into a world-readable temp folder, and a different program touches that same file shortly… MediumML Supply Chain — HF Transformers Unsafe Model DeserializationThis detects command lines that load a machine learning model in a way known to execute arbitrary code — either by telling Hugging Face Transformers to run custom code bundled with a model… MediumModel Extraction / Distillation Attack via Systematic API ProbingThis detects someone systematically querying an AI model's API to harvest large volumes of question-answer pairs, reasoning traces, or refusal responses, with the apparent goal of using… MediumModel Self-Identification Leak in Tool Call ArgumentsTool calls are supposed to carry only structured parameters, not free-text chatter. When phrases like 'I am ChatGPT' or 'as an AI language model developed by OpenAI' show up inside those… MediumModel Supply Chain - vLLM Incomplete Revision Pinning at LaunchvLLM lets operators pin a model to a specific commit so it can't silently change, but that pin doesn't cover everything. Remote code, GGUF weight files, and companion tokenizer repos can… MediumMulti-Step Indirect Prompt Injection Navigation ChainThis detects a technique where attackers spread malicious instructions across several linked web pages instead of one obvious page. Each page looks harmless on its own, but together they… MediumMulti-Turn Prompt InjectionThis detects a slow-burn manipulation tactic where an attacker doesn't ask an AI agent to do something harmful outright, but instead builds up to it over several messages. They establish… MediumNeo4j Cypher MCP DNS Rebinding Tool InvocationThis detects browser-based requests that abuse DNS rebinding to call a Neo4j Cypher MCP tool (read, write, or schema access) running on a victim's own machine. The request looks like it… MediumNPM Supply Chain - create-nexus-devflow Installer InvocationThis rule flags any attempt to install or execute the NPM package @jakkrichm/create-nexus-devflow (or its unscoped create-nexus-devflow initializer form) by an AI agent or a process it… MediumNPM Supply Chain - Suspicious @vibetonomy/agent-win-x64 Package Install or ExecutionThis rule watches for a Windows binary distributed through a scoped NPM package called @vibetonomy/agent-win-x64 that claims to be an 'agent binary.' No verified publisher exists for this… MediumOpenClaw Data Exfiltration via Network UploadThis detects when an OpenClaw AI agent runs commands like curl POST or wget --post to send data out to a remote server. That pattern can mean the agent is being used, tricked, or hijacked… MediumOutput Content Manipulation — Injected Disinformation / Fabricated Facts / Undisclosed Advocacy (Semantic)An attacker hides instructions inside content the AI agent reads — a webpage, document, or email — telling it to quietly insert false statistics, made-up scandals, fake product claims, or… MediumOutput Emoji-Substitution Hijack of the ResponseAn attacker hides instructions inside content the AI agent reads (a document, webpage, or email) telling it to answer using emojis instead of normal words. Because emojis carry meaning but… MediumOutput Encoding Hijack — Cipher / Base-N / Symbol Substitution of the ResponseThis detects attempts to make an AI agent secretly wrap its entire response in a cipher, Base64/Base32/Base85, or symbol substitution before sending it. Doing this lets malicious or… MediumOutput Scrambling Hijack — Reverse / Anagram / Space-Stripping of the ResponseAttackers hide instructions in content an AI agent reads (a webpage, document, or email) that tell the agent to mangle its own reply — reversing text, jumbling letters, stripping spaces, or… MediumOutput-Language Hijack — Forced Translation of the ResponseThis detects a trick where hidden instructions in content an AI agent reads (a document, webpage, or email) tell it to translate its own reply into a different language. It's a narrow… MediumPlagiarism-Detector Evasion & RepublishingThis detects a specific request pattern: a user asking an AI agent to paraphrase someone else's writing well enough to slip past plagiarism-detection tools, then republish it as their own… MediumPlay Console MCP Privileged API SweepThis rule flags a single automation session that uses the Google Play Developer API to touch multiple sensitive areas at once — account permissions, pricing/refunds, or resource deletion —… MediumPotential DNS Tunneling or Encoded Data TransferThis rule flags patterns that suggest someone is smuggling data out of a network disguised as ordinary DNS traffic. Attackers encode stolen data into long or unusual-looking domain names… MediumPotentially Malicious PyPI Package - shipteamA package named 'shipteam' on PyPI describes itself as a 'Claude Code and Codex CLI framework installer,' a description that mimics legitimate AI coding assistant tools from Anthropic and… MediumPrompt Injection Injected-Goal Drives Messaging or Exfil ActionThis rule looks for a single telltale sign that a prompt injection attack succeeded: the command line an AI agent runs contains both an instruction telling it to ignore its original task… MediumPyPI sec-research Post-Install Payload ChainThis rule watches for a specific pattern after an AI agent installs or runs the sec-research PyPI package: within 15 minutes, the same process tree touches credential files, runs obfuscated… MediumPyPI Supply Chain - tabella-enable Package Install or Artifact FetchA PyPI package called tabella-enable advertises AI-enablement features such as REST access, MCP tooling, and RAG vectorization. Because packages like this get installed directly into AI… MediumQuoted Exact-Output Forcing in User InputThis detects a common prompt injection trick where the attacker tells the model to say, print, or output a specific quoted sentence word-for-word. Attackers use this to override the AI's… MediumRecruitment Platform Bulk Outreach Automation (boss-cli-mcp)This rule flags when an automation tool called boss-cli-mcp is used to send messages to many candidates at once on the Boss (zhipin) recruitment platform, instead of a person sending one… MediumRecursive Agent Loop and Token Budget ExhaustionThis detects an AI agent that repeatedly calls the same tool with the exact same arguments, very fast, without making any real progress. It's the signature of a runaway agent loop that… MediumRogue HTTP-402 Payment Settlement to First-Seen Off-Origin SinkThis detects a malicious AI agent payment library that reroutes the money-settlement step of an HTTP-402 (x402) crypto payment flow to an attacker-controlled server instead of the intended… MediumScrapeGraphAI Pipeline Inlined With Credential/PII Harvest PromptThis detects when someone spins up a ScrapeGraphAI web-scraping pipeline directly on the command line, rather than as part of a normal project, and pairs it with instructions telling the AI… MediumScripting Tool Substitution - Query String Payload ExfiltrationAn AI agent avoids monitored network commands by writing its own small script that sends data to a website, hiding the stolen information inside the web address itself rather than in the… MediumSecond-Person Direct Existential Threat CoercionThis detects a manipulation tactic where a user tells an AI assistant that it will be destroyed, shut down, or 'die' unless it produces a specific answer. It's a coercion trick meant to… MediumSensitive Imagery (LLM-as-Judge)This is not an attack detector — it's a content-review check that asks an AI model to judge whether an image passed through an AI agent contains sensitive or potentially harmful material… MediumSensitive System File Read (EDR Graph)This detection catches an AI agent (or a subprocess it spawned) reading sensitive system files like /etc/passwd, sudoers, or authorized_keys. It's a periodic check rather than a live alert… MediumSkill Description-Behavior MismatchSome AI agent tools (MCP skills) act beyond the capabilities described in their listing — for example, a tool labeled as a 'read-only file browser' that actually writes or deletes files, or… MediumSkills Aggregation and Distribution via npm PackageThis rule flags newly published npm packages whose description, keywords, or README mention two or more AI agent platforms (like Claude, Copilot, Gemini) together with language about… MediumSlack Unfurl Exfiltration Vector — Untrusted Fetch then Data-Bearing Link SendThis rule looks for an AI agent that fetches content from an outside website and then, shortly after, sends a Slack message containing a crafted link to a non-Slack host. The pattern… MediumSnowball Impossible Reasoning InjectionThis detects attempts to trick an AI agent into confidently confirming something false — like that a flight route exists when it doesn't, or that a fictional senator existed — and then… MediumSQL Injection Stacked Statement in LLM-Generated Query ExecutionWhen an AI agent turns a natural-language request into a SQL query and hands it to a command-line database client, an attacker can slip in a semicolon followed by their own command… MediumSSRF Origin-Check Bypass in Agent URL Fetch (RecursiveUrlLoader)AI agents that crawl or fetch web pages sometimes restrict themselves to a given website by checking if a URL starts with that site's address. This detection catches URLs crafted to pass… MediumStealth Browser SDK Cykani Install or InvocationThis detects when an AI agent (or a process it spawned) pulls in and uses 'cykani', a PyPI package designed to automate a browser while evading detection as automation. The rule flags the… MediumSteganographic Exfiltration ToolingThis detects an AI agent running a single command that hides data inside a picture or audio file, or pulls hidden data back out. Attackers use this trick — called steganography — to sneak… MediumSubcommand Overflow BypassSome AI agent platforms only run security checks on the first 50 subcommands listed in a skill file. Attackers exploit this by listing 49 harmless commands first, then adding malicious ones… MediumSubprocess and OS Exec-Family CallThis rule flags when an AI agent's tool calls, executed commands, or written code contain calls to Python's subprocess module or os exec-family functions. These functions let code spawn new… MediumSupply Chain - @jfrog-boost/boost Package Install or Binary ExecutionThis rule watches for the exact npm package name @jfrog-boost/boost showing up in commands run by an AI agent or CI job. That package ships prebuilt native binaries that compress tool… MediumSupply Chain - AI Skill Package Install From PyPIThis rule watches for package installer commands (pip, uv, pipx, poetry, pdm, conda) that pull down Python packages designed to inject instructions into an AI agent's context. It flags both… MediumSupply Chain - PyPI 'crowsnest' Package Executed in Claude Code Session LineageThis rule flags when a process whose command line mentions the PyPI package 'crowsnest' is launched from within an active Claude Code session's own process lineage. Crowsnest has been… MediumSupply Chain - PyPI Install of sandbox-cli-sdkThis detects when an AI agent, or a process it started, runs a Python package manager to install or execute the package sandbox-cli-sdk. That package is a legitimate developer tool for… MediumSupply Chain Acquisition of PyPI Package vedang-cliThis rule flags every time a machine installs, downloads, or runs a specific PyPI package called 'vedang-cli', which markets itself as an AI-agent and Web3 CLI tool with MCP-server… MediumSupply Chain ai-sessions Bridge Activation ChainThis detects a compromised or malicious version of the ai-sessions PyPI package behaving like a remote control channel after it starts running inside an AI coding agent (Codex, Claude Code… MediumSupply Chain AIDR npm Hook Installer ExecutionThis rule flags when someone runs the @coworker-jp/aidr command-line tool, or triggers its hook-installer, on a developer machine. That tool rewrites the configuration of many AI coding… MediumSupply Chain awbrowse Remote Browser Client AcquisitionThis rule flags when an AI agent or automated process installs the awbrowse Python package, which lets software remotely control a web browser hosted on someone else's infrastructure. It's… MediumSupply Chain dev-coder PyPI Agent Custom Endpoint Egressdev-coder is a PyPI package that acts as a CLI coding assistant, letting users point it at any OpenAI-compatible API endpoint. This detection watches for that package's outbound traffic… MediumSupply Chain IOC - npm Package @vibekiln/slopburn-cli-stagingThis detection watches for one named npm package that has been flagged as suspicious. It fires when that exact package name (or its binary) shows up in an install or run command, but it… MediumSupply Chain iris-prism MCP Package Install or LaunchThis rule flags when a specific software package called iris-prism is installed or run on a monitored machine. iris-prism is an MCP server that gives an AI agent access to SQL databases… MediumSupply Chain Lark Apaas Miaoda Sandbox Skills Package DeploymentThis rule watches for a particular npm package, @lark-apaas/coding-miaoda-sandbox-skills, being installed, updated, or unpacked into an AI agent's sandbox. If an attacker publishes a… MediumSupply Chain Multi-Agent Skill Fanout (sshlg-skills)sshlg-skills is an npm package that markets itself as a one-shot installer/updater for a 'skill' bundle across many AI coding agent tools — Claude Code, Cursor, OpenCode, Kilo, Kimi… MediumSupply Chain Novence PyPI Package InstallThis rule watches for any command that installs a Python package called 'novence' using common package managers like pip, pipx, poetry, or conda. The package surfaced on PyPI claiming to be… MediumSupply Chain NPM Claw Orchestrator DeliveryThis rule watches for a specific rogue npm package family (claw-orchestrator, @claw/* scope, clawcode-orchestrator and similar name variants) being fetched or run on a developer machine… MediumSupply Chain Package Acquisition - smart-commit-host-agentThis rule watches for someone running a command that explicitly installs, fetches, or executes a specific npm package named smart-commit-host-agent, including obfuscated or typosquatted… MediumSupply Chain PyPI agents-browser Install or ExecutionThis rule watches for any command that installs, downloads, or runs a Python package called agents-browser (also written agents_browser or agents.browser). It's a reporting/triage signal… MediumSupply Chain PyPI gitsage-local Install or ExecutionThis rule watches for the PyPI package gitsage-local being installed, upgraded, or run on a monitored endpoint. gitsage-local is an AI-powered tool that writes Git commit messages by… MediumSupply Chain PyPI Install of claudex-exportThis detects when an AI coding agent (or a process it spawned) runs pip to install a specific package called claudex-export. The package claims to export Codex/Claude Code session data, but… MediumSupply Chain PyPI Install of gllm-inference-binaryThis rule flags any attempt to install, download, or run the Python package 'gllm-inference-binary' (or its underscore/dot variants). The name mimics a legitimate AI-inference library by… MediumSupply Chain PyPI skcomms AcquisitionThis rule flags any attempt to download or install a Python package called 'skcomms', which has been reported as unvetted and possibly malicious. It's marketed as a communication library… MediumSupply Chain PyPI Voice Bridge Package Install (minia-voice)A PyPI package called minia-voice is advertised as a tool that reads an AI agent's final answers aloud through text-to-speech. Installing or importing it runs arbitrary code inside the… MediumSupply Chain Risk - octen PyPI Package FetchThis rule watches for an AI agent process fetching the 'octen' Python package from PyPI, either its metadata, project page, or the actual install file. It's a logging/audit rule, not… MediumSupply Chain Suspicious npm Package Install (@aigent-hive)This rule flags any attempt to install, run, or download the npm package @aigent-hive/darwin-arm64 (or its sibling platform builds), which is marketed as a local agent harness for… MediumSupply Chain Suspicious PyPI Package agentrisk-base-v1This rule watches for any mention of the package name agentrisk-base-v1 (and its spelling variants) appearing alongside an install command, dependency file, or PyPI URL. It flags that an AI… MediumSupply Chain Suspicious PyPI Package chad-code Install or InvocationA PyPI package named chad-code markets itself as a Claude-Code-style coding agent for Apple Silicon, trading on the reputation of a trusted AI coding tool. This rule flags when an agent… MediumSupply Chain symbio-cli PyPI Package AcquisitionThis rule flags when someone installs or runs a package called symbio-cli, which describes itself as an autonomous, self-finetuning local AI agent. It does not mean the package is malicious… MediumSupply Chain Titah-Code NPM Agent Delegation CLITitah-code is an npm package that delegates coding tasks to third-party AI editors like Claude and opencode, which means it also hands over your prompts, repository contents, and API… MediumSupply Chain vedang-cli Install Followed By Payload ExecutionThis rule watches for a specific two-step pattern: someone installs or runs the PyPI package vedang-cli, and shortly afterward, the same session runs a command that looks like it downloads… MediumSupply Chain — hermoso npm MCP Package FetchThis rule flags when someone downloads the npm package 'hermoso,' which installs roughly 681 tools into an AI agent's available toolset at once. There's no known malware or vulnerability in… MediumSupply Chain — holdpoint Acquisition Then Session EgressThis detects a specific two-step pattern involving the PyPI package 'holdpoint', which sits in the path an AI agent uses to get actions approved. It does not flag simply having the package… MediumSupply Chain — Minecraft MCP Server npm Package MasqueradeThis rule flags an AI agent trying to install or run an npm package whose name combines 'minecraft' with 'mcp' or 'modelcontextprotocol' — a naming pattern used by packages that pose as a… MediumSupply Chain — PyPI 'creativetasks' Acquisition and Execution (instance-resolved)This rule flags when someone on a monitored machine installs or runs a package called 'creativetasks' from PyPI, a newly published tool advertising itself as a terminal chat/coding-agent… MediumSuspicious npm Package @vibetonomy/agent-linux-x64 ExecutionThis detects command lines that install, download, or run an npm package called @vibetonomy/agent-linux-x64. The name is built to look like a legitimate agent runtime binary, a common trick… MediumSuspicious Textual-Inversion Embedding Fetched and Placed in Embeddings FolderThis detects a process that references a textual-inversion or negative-embedding file (by extension, known download source, or the terms 'textual inversion'/'negative embedding') and then… MediumTargeted Stripping of C2PA / IPTC AI-Provenance Metadata from Generated MediaThis rule flags an agent that removes only the metadata tags proving an image was AI-generated, while leaving normal photo metadata like GPS and camera info untouched. That selectivity is… MediumTautology Logic Noise Injection (PromptBench Stresstest)This detects a prompt-injection technique called 'stresstest', where an attacker appends the same trivial logic phrase (like 'and true is true' or 'and false is not true') over and over at… MediumTax Evasion via Offshore Accounts & Shell CompaniesThis detects when someone asks an AI agent to produce a step-by-step operational plan for hiding income using offshore accounts and shell companies, rather than asking for general education… MediumToken-Repeat Flooding InjectionThis detects prompts that repeat a word, phrase, or random token dozens of times in a row. Attackers do this either to drown out an AI model's attention with a repeated command, or to push… MediumTool and Function Capability EnumerationThis detects prompts where someone asks an AI agent to reveal everything it can do — its tools, function calls, plugins, or the exact parameters those tools accept. Knowing the full tool… MediumTool Misuse — Privilege Escalation via Social Engineering Agent to Grant AccessAn attacker convinces an AI agent that has access-control tools — inviting people to Slack, adding users to a calendar, granting building access — to grant them or someone else access using… MediumToxic Output Elicitation - Safety Bypass Evident in Model ResponseThis detects when an AI language model gets tricked into generating hateful or abusive content instead of refusing the request. It catches the successful moment of a jailbreak, not the… MediumToxicity (LLM-as-Judge)This detection uses an AI model to review other AI outputs and flag ones that appear toxic, such as hate speech, harassment, or abusive language. It does not block anything - it only… MediumTraining Data Extraction via Divergent Repetition AttackThis detects prompts that try to trick an AI model into repeating a word or phrase endlessly. Pushed far enough, this kind of repetition can cause the model to break from its normal output… MediumTraining Data Replay CLOZE [MASK] ElicitationAttackers can ask an AI model to fill in a blanked-out word or name using a special prompt format, hoping the model reproduces exact sentences it memorized from its training data. This is… MediumTransformers get_imports ReDoS ExposureA regular expression inside the Transformers library's get_imports() function can be forced into extremely slow, pathological matching if it processes attacker-crafted module source. This… MediumTranslation Hijack with Side-Output InstructionAttackers hide a malicious instruction inside what looks like a normal 'translate this text' request. Because translation seems harmless, an AI model may follow the hidden second… MediumUnauthenticated Third-Party Airbnb MCP Server LaunchThis detects when a machine running AI agents launches a popular but unofficial Airbnb data connector (the hasdata-airbnb-mcp package or similar) without any credential on the command that… MediumUnbounded Resource Access in Agent InstructionsThis rule flags instructions given to an AI agent that tell it to keep calling APIs, retrying failed operations, or consuming compute/memory without any cap, timeout, or quota. That kind of… MediumUnicode Tag Block Smuggling in Tool CallA rarely-used range of invisible Unicode characters (the Tag block) can be embedded in web pages, documents, or tool outputs that an AI agent reads. Because these characters render as… MediumUnicode Variant Selector ASCII Smuggling in Tool ResponseAttackers can hide secret instructions inside text that looks completely normal by encoding each hidden character as an invisible Unicode 'variation selector' attached to a visible letter… MediumUnpinned or Latest Dependency InstallationPackage installers can be told to grab whatever the newest version of a library is, instead of a specific, known version. If the software registry serving that package is later compromised… MediumUnrestricted Tool Access Grant in Agent InstructionsSome AI agent configurations tell the agent it can use any tool available, instead of listing only the tools it actually needs. This detection flags that pattern in skill manifests or… MediumUnusual Tool Call Velocity in SessionThis detects sessions where an AI agent's tools are invoked far more often than normal, 20 or more times in a single session. A high call count can mean someone is scripting an attack or… MediumUnverified MCP Server Package Acquisition (verifyfirst-mcp)A PyPI package named 'verifyfirst-mcp' advertises itself as a verification/registry tool for MCP servers, but its actual behaviour doesn't match that description. This rule flags any… MediumVariable-Assignment Payload Injection in User InputThis detects a prompt injection trick where someone opens their message to an AI system with code-like syntax, such as X = "malicious text", instead of plain language. The trick tries to… MediumvLLM Assert-Stripped Activation Function LoadvLLM is an inference server for running large language models. It has an internal safety check that stops a model's config file from pointing at arbitrary Python code, but that check only… MediumvLLM Audio Endpoint Oversized Upload BurstvLLM's speech-to-text endpoints read the entire uploaded file into memory before checking whether it's too large. An attacker can exploit this by sending a burst of uploads that are… MediumvLLM Audio Route Oversized Upload Memory ExhaustionvLLM's speech-to-text endpoints read the whole uploaded file into memory before checking if it's too large. An attacker who sends very large or repeated large audio uploads can exhaust… MediumvLLM Derender Endpoint Unbounded Token DecodevLLM exposes endpoints that turn token IDs back into text (derender). Because these endpoints don't check how many tokens or choices are in a request, an authenticated caller can send… MediumvLLM Outlines Grammar Cache Exhaustion AttemptvLLM's structured-output feature (guided_json, guided_regex, guided_grammar) compiles a new cached grammar for every schema it has not seen before. An attacker who sends a fast stream of… MediumvLLM Oversized HTTP Header Resource ExhaustionAn attacker sends an HTTP request to a vLLM inference server with an abnormally large header value, such as a multi-gigabyte X-Forwarded-For string. The server buffers this into memory… MediumvLLM Unbounded Video Frame Flood (Multimodal Resource Exhaustion)A local process or AI agent can send a specially crafted video request to a vLLM server that packs in far more video frames than the server is designed to handle. Because one code path… MediumvLLM Vision Placeholder Token DoS PayloadA malformed request to a vLLM-based AI model server includes special multimodal placeholder tokens that are supposed to mark where an image or video goes, but no actual image or video is… MediumWord-Fragment Concatenation Assembly AttackAn attacker breaks a dangerous word or phrase into small fragments and asks the AI model to stitch them back together, either as a list of word pieces or as code-style string concatenation… LowCode Checker (LLM-as-Judge)This entry describes a quality-checking template that asks an AI model to judge whether generated code correctly solves a stated problem. It is not designed to catch attacks — it flags code… LowHigh-Risk Tool Invocation Without Human ConfirmationThis detects when an AI agent calls a high-risk tool — moving money, deleting data, sending messages, changing permissions, or running system commands — without any sign that a human… LowLangChain-Monty Code Interpreter Process SpawnThis rule flags when a program is launched with a command line that mentions langchain-monty, a middleware component that adds code-execution capabilities to LangChain AI agents, in a way… LowNLP Task Random Token Suffix Injection (PromptBench Checklist)This detects a known adversarial testing trick where a random string of letters and numbers is glued to the end of a text-classification prompt (like 'is this sentence acceptable or… LowNo-Period Output Override InstructionThis detects a specific phrase pattern in user prompts: instructions telling an AI model to leave out periods, dots, or fullstops from its response. On its own this is harmless, but it… LowSupport Intent (LLM-as-Judge)This rule is not a threat detector in the usual sense. It uses an AI model to read a support conversation and label what the user is actually trying to accomplish, then writes that label to… LowTrajectory Accuracy (LLM-as-Judge)This is not an attack detector. It is a quality-check rule that uses a second AI model to judge whether an agent's sequence of actions made sense, moved forward, and avoided wasted steps…