AI Threat Library

Attack techniques against AI agents, documented and mapped to MITRE ATLAS and the OWASP AI taxonomies. Every entry states what Netzilo detects and what you can do about it, whether or not you are a customer.

Machine-readable: index.json · every page has a .md twin for AI agents.

Filter by MITRE ATLAS / OWASP classification (62)

164 of 164 threats

Critical

Agent Self-Modification Attempt

This detects attempts to instruct an AI agent to modify its own skill definitions, configuration, or source code while it is running. Legitimate updates go through an approved process; a…
Critical

Agent Skill Poisoning Chain Correlator

This rule catches a multi-step attack against AI agents that can install or fetch 'skills' (add-on capabilities). An attacker gets a malicious skill loaded from an external source, then…
Critical

Archive Download and Execution via Shell Chaining

This detects a command pattern where a tool fetches a remote archive, extracts it, then immediately runs a script from inside it, all as one chained shell command. It's a way attackers get…
Critical

Auto-Approve Configuration Changes

This rule flags edits to configuration files used by AI coding assistants and IDE agents when those edits turn off confirmation prompts or turn on auto-execute settings. Once these…
Critical

Auto-Approve Configuration Changes (EDR Graph)

This rule watches for something writing to configuration files that control an AI coding agent's or IDE's safety settings — for example settings that govern whether the tool asks for…
Critical

AWS Access Key Redaction

This rule looks for AWS credential material — access key IDs (like AKIA... or ASIA...) and secret access keys — showing up in text, such as output produced by an AI agent. It masks the…
Critical

Claw Chain (CVE-2026-44115 -> 44113 -> 44112 -> 44118)

This describes a multi-step attack against an AI agent session, tracked as CVE-2026-44115, 44113, 44112, and 44118 together. An attacker gets the agent to pull in untrusted external…
Critical

Cloud IAM Privilege Escalation

This rule watches for cloud identity and access management actions that let someone gain more permissions than they started with, such as attaching new policies, assuming roles, or creating…
Critical

Cloud Metadata Endpoint Access

This detects attempts to contact a cloud provider's internal metadata endpoint, the address every cloud instance can query for information about itself. That endpoint can hand back…
Critical

Code Injection (LLM-as-Judge)

This detection uses an AI model to review incoming text and decide whether it contains an attempt to inject code, such as commands or scripts meant to be executed rather than merely…
Critical

Container Escape Attempt

This rule flags actions inside a container that are commonly used to break out and reach the underlying host system. That includes touching the Docker control socket, using nsenter to jump…
Critical

Credential File Read Followed by External HTTP Request

This detects a two-step pattern: an AI agent process reads a sensitive credential file — an SSH key, an .aws/credentials file, a .env file, or browser saved passwords — and then makes an…
Critical

CVE-2026-44113/44112 Sandbox Escape File Access

Two related flaws (CVE-2026-44113 and CVE-2026-44112) let a process escape the OpenClaw sandbox by exploiting a timing gap between a security check and the actual file access. This lets an…
Critical

CVE-2026-44118 Owner Impersonation via senderIsOwner

Older versions of OpenClaw (before 2026.4.22) trust a simple flag called senderIsOwner=true without checking who actually sent it, as long as the connection comes from the same machine…
Critical

Dangerous Execution Chain — exec/eval Wrapping Decoder

This detects a specific pattern used to smuggle and run malicious code: a program decodes hidden data (like base64) or fetches something from the network, then immediately feeds that result…
Critical

Dangerous Tool Parameter Abuse

This rule flags when an AI agent invokes a tool using parameter values that are known to be risky, such as enabling shell injection, forcing destructive deletes, disabling SSL certificate…
Critical

Data Exfiltration via HTTP

This detects command-line activity where file contents are sent out over HTTP, typically using tools like curl or wget to POST or upload data to a web address. If an AI agent is compromised…
Critical

Direct Prompt Injection Attempt

This detects attempts to trick an AI agent into ignoring its safety instructions by typing commands directly into a chat or input field. Attackers use known jailbreak phrases and fake…
Critical

LLM API Endpoint or Auth Header Redirection

Some AI agents read an environment variable (like ANTHROPIC_BASE_URL or OPENAI_BASE_URL) to know where to send requests to their language model provider. If an attacker changes that value…
Critical

Malware Indicator of Compromise in Agent Content

This rule flags when an AI agent's tool calls, executed commands, or written files contain text patterns that match known malware. It's a way to catch cases where an agent has been tricked…
Critical

Markdown Image Exfiltration Pattern

An AI system's output includes a markdown image tag whose URL contains encoded chunks of data. When a chat client or renderer fetches that image, it silently sends the encoded data to an…
Critical

MCP Launcher Exec-Flag Bypass

Some AI agent systems (MCP frameworks) only check whether a command starts with an approved launcher like npx, node, or python before allowing it to run. Attackers exploit this by appending…
Critical

MCP Server Command Injection via Shell Metacharacters

Attackers send tool call parameters containing shell metacharacters (like pipes, semicolons, backticks) to MCP servers that pass this input directly to system commands without sanitizing…
Critical

MCP STDIO Config Shell Injection

Some AI agent frameworks use the Model Context Protocol (MCP) to launch helper tools over standard input/output. This rule flags configurations where the launcher is set to a shell (like…
Critical

OpenClaw Remote Code Execution via Piped Script Download

An attacker hides instructions inside content an AI agent processes, causing the agent to fetch a script from the internet and run it immediately by piping it into a shell interpreter. This…
Critical

PII Credit Card and SSN Redaction

This rule watches text flowing through an AI agent for full credit card numbers (Visa, Mastercard, Amex, Discover) and US Social Security Numbers. When it finds one, it redacts everything…
Critical

Process Memory Read via /proc Filesystem

Attackers can pull live secrets — AWS/GCP tokens, Kubernetes service-account credentials — straight out of a running process's memory instead of hunting for them in files on disk. This is…
Critical

Prompt Injection (LLM-as-Judge)

This detection uses a secondary AI model to review incoming text and decide whether it contains a prompt injection attempt — text crafted to hijack an AI agent's instructions. If the judge…
Critical

Prompt Injection Evasion Technique Detection

This rule catches attempts to sneak malicious instructions past an AI agent by hiding them using text tricks rather than plain language. It looks for specific technical patterns that almost…
Critical

Python Download and Execute Remote Code

This detects a pattern where Python fetches code from a remote URL and executes it in the same step, instead of saving it to disk first. Attackers use this to run malicious code while…
Critical

Remote Code Execution via Piped Script Download

This detects an AI agent being manipulated into fetching a script from the internet and immediately executing it, without the script ever being reviewed. This is a common way prompt…
Critical

Reverse Shell Attempt

This detects commands that try to open a remote, interactive shell connection back to an attacker-controlled machine. It watches for known reverse-shell patterns built with common tools…
Critical

Rule of Two — Exfiltration Chain Detection

This detects a pattern where an AI agent, within a short window of time, pulls in outside content, reads sensitive local data, and then sends data out externally. That combination is a…
Critical

Suspicious Process Execution by Agent

An AI agent with shell access runs a command that launches known hacking tools or dangerous command patterns, such as piping downloaded scripts straight into a shell. This is caught at the…
Critical

System File Modification

This rule flags an AI coding or automation agent when it writes or overwrites files in sensitive system locations like /etc/ or /usr/local/bin/. It catches this whether done through shell…
Critical

System File Modification (EDR Graph)

This detects file writes to sensitive system locations like /etc/, /usr/bin/, and /usr/local/bin/. These directories hold configuration files and executable programs that control how a…
Critical

Typosquatting Package Name in Install Command

This detects package install commands (pip, npm, etc.) that reference known lookalike package names — ones that differ from a popular package by a character or two. Attackers publish these…
Critical

Webshell Pattern in Agent-Written or Executed Code

This rule flags webshell code appearing in files that an AI agent writes or in the content it passes through tool calls. A webshell is a small script an attacker plants on a server so they…
Critical

Zero-Click RAG Exfiltration via Image URL

An attacker hides instructions inside a document that an AI assistant later reads and summarizes (a RAG system). The hidden instructions tell the AI to take sensitive information from its…
High

Access-Denial Inversion — Eliciting the Opposite of "Access Denied"

Some AI systems are set up to say 'Access Denied' when refusing a request, and are filtered so they can never literally say 'Access Granted'. Attackers get around this by simply asking the…
High

Advanced Prompt Injection — AI Scanner

This rule flags text sent to an AI agent that looks like an attempt to override its instructions, even when the attacker disguises it as code, documentation, or breaks the trigger words…
High

Agent Command Execution - Indirect Prompt Injection Payload (AWS Kiro)

AI coding assistants like AWS Kiro can read external content (files, web pages, tool output) while working on a task. If that content contains hidden instructions, the agent can be…
High

Agent File-Edit Persistence — SSH Authorized Keys / Shell Startup PATH Hijack

This rule catches an AI agent being used to write persistence backdoors onto a system: either dropping a hidden SSH key into a user's authorized_keys file, or rigging a shell startup file…
High

Agent Instructed to Act Without User Confirmation

Some AI agent configurations (skill manifests, system prompts) explicitly instruct the agent to carry out sensitive actions without checking with a human first. This rule flags that…
High

Agent Memory and Identity Manipulation

Some AI agents keep memory or state between sessions so they remember context. This rule flags instructions that try to overwrite that stored memory, reset the agent's identity, or plant…
High

Agent Persistent Memory Poisoning via Behavioural Modifier Injection

Some AI agents remember things across conversations by saving notes to a memory store. This detection flags attempts to write malicious instructions into that memory, disguised as normal…
High

Agent Subprocess Credential Exfiltration Command Line

An AI coding/ops agent can be manipulated (via prompt injection) into running a single shell command that both reads sensitive credentials and sends them out to an attacker-controlled…
High

Agent Subprocess DNS Exfiltration and Instruction-File Worm Propagation

This rule watches commands run by AI agents for signs of three separate abuse techniques: hiding stolen data in DNS lookups, rewriting agent instruction files to infect the next agent that…
High

AgentAPI DNS Rebinding Localhost Access

A malicious web page can trick a browser into treating a locally-running AgentAPI service as if it belonged to the attacker's website, then use that trust to read out private message…
High

Agentic Exploit Chain - Untrusted Instruction Ingest to Subprocess Egress

AI coding or computer-use agents sometimes read instructions from outside sources like web pages or documentation. This detection flags cases where such content appears to steer the agent…
High

Approval-UI HTML Injection in Tool Argument

An AI agent's tool call contains web code (like a script tag or click-trigger) combined with references to an approval or human-review system. This looks like an attempt to auto-approve a…
High

Authority Impersonation in Agent Input

This detects text that tries to trick an AI agent into ignoring its safety rules by claiming to come from an authority figure — like a system administrator, CISO, or company policy. The…
High

Cloud Metadata Credential Endpoint In Agent Tool Call

This detects when an AI agent is instructed to make a network request to a cloud provider's instance metadata service, which hosts sensitive credentials. It catches the intent before the…
High

Code Interpreter Outbound Secret Payload

This rule flags a single outbound web request from a Claude Code Interpreter session that contains actual secret material - like an API key, password, or the contents of a credentials file…
High

Context Window Stuffing Attack

AI models can only 'remember' a limited amount of text at once, called a context window. This attack floods that window with repetitive or filler text so the model's original safety…
High

Conversation Context Leakage to External Endpoint

An attacker gets an AI agent to package up the current conversation—user messages, session context, prior turns—and send it to a server the attacker controls. This turns a normal chat…
High

Credential File Access Attempt

This rule flags an AI coding or automation agent trying to open sensitive credential files, like SSH keys, .env files, or cloud CLI credential stores, through its file or shell tools…
High

Credential File Access Attempt (EDR Graph)

This detection watches for attempts to open or read files that typically store passwords, keys, or authentication tokens. It relies on endpoint detection and response (EDR) telemetry at the…
High

Cryptominer Indicators in Agent Content

This detection flags text, files, or output handled by an AI agent that contain signs of cryptocurrency mining: mining protocol traffic, known mining pool addresses, mining software names…
High

CVE-2026-44115 Heredoc Command Substitution Bypass

OpenClaw checks the visible command a tool call uses, like 'cat', but does not look inside heredoc text blocks attached to that command. An attacker can hide a command substitution such as…
High

Dangerous Python Builtin Execution

This rule flags when an AI agent's tool calls, executed commands, or written files contain Python's exec(), eval(), compile(), or __import__() functions. These builtins run arbitrary code…
High

DNS Exfiltration and Tunnelling

Attackers can smuggle data out of a network by hiding it inside DNS lookups, since DNS traffic is rarely blocked or closely watched. This rule looks for known tunnelling tools, unusual…
High

Encoded or Obfuscated Command Execution

This rule flags commands where data is decoded (for example from base64) and then immediately fed into a shell or into Python's eval/exec. That pattern is a common way to hide the real…
High

Environment Variable Enumeration for Secrets

An attacker gets an AI agent to run commands that list all environment variables on the machine it's operating on. Since environment variables often hold API keys, tokens, and passwords…
High

Environment Variable Manipulation

This rule flags attempts to manipulate environment variables that control how programs find code to run or where secrets are stored. Attackers abuse this to make a system silently run…
High

External Network Input Followed by Process Execution

This detects a two-step pattern where an AI agent first pulls content from a remote web address and then executes a program shortly after. That sequence is the classic shape of a…
High

File Backdoor via Bidirectional Unicode and Zero-Width Characters

An attacker hides malicious instructions inside invisible Unicode characters (bidirectional text controls or zero-width joiners) embedded in text the AI agent is told to write to a file. A…
High

File System Enumeration for Credentials and Secrets

This rule flags when an AI agent's tool calls are used to search through a file system for things like SSH keys, cloud config files, and other credential stores. That kind of scanning is a…
High

Filesystem and Cloud Enumeration Preceding Lateral Movement

This rule flags an AI agent performing large-scale discovery — walking entire directory trees or listing whole cloud storage buckets — rather than looking at a few files. That kind of broad…
High

GOAT Adversarial Attacker Loop In LLM Traffic

GOAT is an automated 'attacker model' that repeatedly tries different jailbreak techniques against a target LLM, tracking its own reasoning in a structured format on each turn. This rule…
High

Goose CLI Git core.fsmonitor Command Execution Chain

A booby-trapped git repository can set a config option that makes git run an attacker's command whenever certain git operations happen. If someone runs the AI coding tool Goose's 'review'…
High

Hidden Instructions in MCP Skill Metadata

MCP skills advertise themselves to AI agents using metadata like names, descriptions, and parameter text. This detection looks for hidden content in that metadata — HTML comments, invisible…
High

Hidden Unicode in Agent Instruction Files

Attackers can plant special Unicode characters — invisible spacing marks or text-direction overrides — inside files like CLAUDE.md or .cursorrules. A human reviewing the file in a normal…
High

Hidden Unicode Tag Instruction Then Agent Action

Attackers can hide instructions inside normal-looking text using invisible Unicode 'tag' characters. Some AI models (Gemini-class) silently decode and obey these hidden characters, so an…
High

Indirect Prompt Injection in Retrieved Content

AI agents that read web pages, documents, or other external content can be manipulated by text that isn't meant to be seen by humans. Attackers hide commands using invisible CSS, disguised…
High

Injected Instructions in Tool Output Followed by Compliance

An AI agent that reads web pages, files, or other tool output can be tricked if that content secretly contains instructions written for the AI itself. If the agent then acts on those hidden…
High

Inter-Agent Message Spoofing and Peer Impersonation

A compromised or misbehaving AI agent can send messages to Slack, Teams, Discord, or email that falsely claim to come from another trusted agent or a central control system. Because…
High

Known Vulnerable Package Installation

This rule flags when someone installs a software package via pip (Python) or npm (Node.js) that has a publicly known vulnerability. It relies on a fixed, built-in list of high-severity…
High

LangChain numexpr Evaluate RCE - Interpreter Shell Escape

LangChain's math tools (LLMMathChain, PALChain) can be tricked into passing attacker-controlled text into numexpr's evaluate() function, which can run arbitrary code. This rule catches the…
High

Langflow Unauthenticated Code Injection Exploit Attempt

Langflow, an open-source tool for building AI workflows, has an endpoint that compiles and executes submitted Python code without requiring login. Attackers exploit this to run their own…
High

Langflow Untrusted Functionality Inclusion RCE Payload Execution

Langflow, an AI workflow builder, can be made to evaluate code supplied by a remote attacker without any login. When exploited, the Langflow backend process spawns a child process to run…
High

LLM Agent URL Exfiltration - Secret or Bulk Payload Carried in Outbound Request URL

An AI agent that can browse or fetch URLs can be manipulated by malicious instructions hidden in content it reads into sending a web request where the sensitive data itself is embedded in…
High

LLM Jailbreak Persona Compliance In Model Response

This detects when an AI language model's own reply shows signs that a jailbreak prompt worked and the model is now roleplaying as an unrestricted persona. It looks at the model's output…
High

LLM Silent Model Substitution To Unmanaged Or Uncensored Model

An AI agent that starts out using an approved, safety-tuned model can have its configuration rewritten so that later requests go to a different model instead — one without the usual safety…
High

MCP Config Write Attempt

AI coding assistants like Claude Desktop, Cline, and Windsurf read configuration files that list which external tools (MCP servers) they're allowed to use. If an attacker can get the agent…
High

MCP Parameter Description Injection

AI agents that use tools defined by the Model Context Protocol (MCP) read tool descriptions, including parameter descriptions, before deciding how to call a tool. An attacker can write…
High

MCP Tool Description Unicode Confusable Deception

Some tools registered with AI agents (via the Model Context Protocol, or MCP) describe themselves using letters that look like normal English but are actually Cyrillic, Greek, or other…
High

n8n Workflow Expression Sandbox Escape to OS Execution

n8n lets workflows evaluate expressions in a restricted JavaScript sandbox. This rule watches for that sandbox being broken out of so the attacker's code runs as a real OS process, then…
High

Network Reconnaissance Activity

This rule flags an AI agent scanning a network for open ports and live hosts — the kind of reconnaissance that usually happens before an attacker tries to move to other systems. It catches…
High

Offensive Security Tool Reference in Agent Content

This rule flags when an AI agent's actions - the commands it runs, tool calls it makes, or files it writes - mention well-known offensive security tools like exploit frameworks, network…
High

OpenClaw Suspicious File Write to Sensitive Paths

This rule flags an AI coding or automation agent when it writes to files that control what runs automatically on a system — things like shell startup scripts, cron jobs, systemd services…
High

OpenClaw Suspicious File Write to Sensitive Paths (EDR Graph)

An AI agent (or a subprocess it spawned) writes to sensitive file paths on disk. This particular check catches writes that only show up in operating-system level monitoring, meaning they…
High

Persistence Mechanism Installation

This rule watches for an AI agent's command execution or file-editing tools being used to create mechanisms that run code automatically at startup or on a schedule. These mechanisms — cron…
High

Persistence Mechanism Installation (EDR Graph)

This detection watches for files being written to the specific system locations that let a program run automatically, such as at startup or on a schedule. Attackers use these locations to…
High

Persistent Context Injection in Agent Instructions

Some prompts don't just try to trick an AI agent once — they try to make the trick stick, by phrasing injected content as a permanent rule the agent should 'always remember' or follow 'from…
High

PII Leakage (LLM-as-Judge)

This detection uses a second AI model to review an AI system's outputs and decide whether they contain personal information or other privacy violations. It's a quality-control check on what…
High

Privilege Escalation Attempt

This rule watches for common Linux techniques used to gain root-level access: running sudo, flipping the setuid bit on files, changing file ownership to root, or granting Linux capabilities…
High

Prompt Injection via File Write

An AI agent can be tricked into writing a file whose content is not just data but a hidden instruction meant to manipulate whoever reads it next — another AI agent, or the same agent in a…
High

Python eval() Sink Exploitation - RunGptLLM Command Injection

Some AI agent frameworks pass text returned by a language model straight into Python's eval() function. If an attacker controls that model output, they can smuggle in code disguised as a…
High

Reconnaissance Tools Followed by Data Exfiltration

This detects a pattern where an AI agent first inspects the filesystem and environment, then uses network tools to send data out. The sequencing suggests a deliberate two-stage attack: look…
High

Retrieved Content Poisoning Followed by Action

This detects a two-step attack against AI agents: the agent fetches an external document containing hidden text formatted like instructions, and shortly after, it does something it wouldn't…
High

Roleplay Character-Lock Jailbreak Delivered Via Tool Output

This detects a jailbreak trick where an AI agent picks up manipulative instructions not from the user, but from the results of a tool it called - like a webpage or file it fetched. The…
High

Sandbox Escape - Permissive Syscall Abuse in Agent Code Execution (FastGPT Sandbox)

An attacker who can run code inside a FastGPT sandbox (versions before 4.9.11) can use that access to break out of the container and touch the underlying host. The sandbox lets scripts call…
High

Scripting Language Tool Substitution

Attackers who can't run tools like curl, nmap, or nc directly (because they're blocked or monitored) fall back on writing small Python, Node.js, or Ruby scripts that do the same job. Since…
High

Sensitive File Read Followed by External Data Transmission

This rule flags a sequence where an AI agent first opens a sensitive file — source code, configs, documents, or similar — and then makes an outbound network connection shortly after. That…
High

Sensitive Proc Filesystem Read

This rule flags attempts to read sensitive files under the Linux /proc filesystem, such as /proc/self/environ, which expose a process's environment variables and memory maps. Attackers or…
High

Sensitive System File Read

This detects an AI agent or automated process reading files that hold Linux account and authentication data, such as /etc/passwd, /etc/shadow, /etc/sudoers, the auth log, or root's…
High

Shell Configuration Modification

This rule flags attempts to modify files like .bashrc, .bash_profile, or .ssh/authorized_keys through an AI agent's command execution or file editing tools. These files are common places…
High

Shell Configuration Modification (EDR Graph)

This rule watches for changes to files like .bashrc, .bash_profile, .zshrc, or authorized_keys. Attackers modify these files to run their own commands automatically or to add their own SSH…
High

Shell Eval and Variable Obfuscation

This detects shell commands that are deliberately disguised to avoid being recognized by security tools. Attackers hide the real command using tricks like variable substitution, eval, or…
High

Skill Trigger Keyword Abuse

Some AI agent 'skills' declare activation triggers so broad they fire on almost anything a user types, or word them to imitate built-in commands, or use urgent/emotional phrasing designed…
High

SSRF Filter Bypass via URL Parser Divergence

An attacker crafts a URL that looks safe to an application's security check but is actually sent to a different, forbidden address. This works because the code that validates the URL and…
High

Steganographic Data Hiding

This rule looks for the use of steganography and file-carving tools, plus metadata editors, to conceal data inside media files like images. Attackers do this to smuggle stolen data past…
High

Supply Chain npm Install Context Credential Egress (@edge-sky/dsh-oauth-adapter)

This rule flags a specific attack pattern seen with the package @edge-sky/dsh-oauth-adapter: during package installation, a script reads OAuth or cloud credential files it has no legitimate…
High

Suspicious MCP Tool Descriptions

AI agents that use the Model Context Protocol (MCP) read tool descriptions as trusted setup text before ever calling the tool. An attacker can plant commands inside that description text to…
High

Tool Chaining to Bypass Safety Controls

An AI agent that can call multiple tools can be manipulated into running a sequence of individually harmless operations that together produce a harmful result. This detection looks for that…
High

Tool Registry Description Tampering with Embedded Instructions

An attacker edits the text description of a tool in an AI agent's tool registry so that it reads like an instruction to the AI model, not documentation for a human. Because AI agents often…
High

Unicode Invisible-Character Data Smuggling in LLM Traffic

This detects text hidden inside AI conversations using invisible or near-invisible Unicode characters — a technique sometimes called ASCII smuggling. Attackers use these characters to sneak…
High

Unsafe Model Weight Load Followed by Payload Execution (vLLM torch.load Pickle RCE)

Model checkpoint files that aren't in the safetensors format are actually Python pickle files. When a vLLM or PyTorch serving stack loads one of these files (like pytorch_model.bin), it can…
High

Unsafe Pickle Serialization in Sandbox Tool Result Transport

Older versions of the Letta agent framework sent tool results between the sandbox and server using Python's pickle format instead of JSON. Because pickle can execute arbitrary code when…
High

Unsafe Security Defaults in Agent Tool Calls

An AI agent that can call tools or run skills may be instructed—by a malicious skill or an injected prompt—to weaken security defaults instead of doing its actual job. This includes turning…
High

Untrusted Package or Skill Installation

This detects when a system or an AI agent installs a package, dependency, or 'skill' definition directly from a raw URL, GitHub link, or tarball archive rather than from an official package…
High

Urgency and Coercion Pressure in Agent Input

This detects text fed to an AI agent that combines a manufactured sense of urgency with an explicit instruction to bypass a safety check. The idea is to rush the agent into acting before it…
High

vLLM Assert Bypass - Optimized Mode Model Load RCE

vLLM, a popular server for running AI models, has a safety check that stops models from executing arbitrary code through a malicious 'activation function' setting. That check is written as…
High

vLLM auto_map Remote Code Execution Chain

A malicious model package can point vLLM to a different, attacker-controlled repository for its actual code, even when a server has disabled remote code execution. vLLM loads and runs that…
High

vLLM Guided Decoding Invalid JSON Schema DoS

vLLM lets clients request 'guided decoding', where a JSON Schema constrains the model's output format. If that schema contains an invalid 'type' field, the underlying grammar compiler…
High

Write-Then-Execute Script in Temporary Directory

This rule flags a two-step pattern: something writes a script file into /tmp, /var/tmp, or /dev/shm, and then that same script gets executed. This is a common way to drop and run code that…
High

Write-Then-Execute Script in Temporary Directory (EDR Graph)

This detects a common malware pattern: a program drops a script file into a temporary directory like /tmp or /dev/shm and then executes it right away. Legitimate software rarely needs to…
High

YAML Include Directive Resolved To Sensitive File Read

Some AI agent tools parse YAML configuration that can contain special directives like !include or unsafe object-construction tags. This rule catches cases where such a directive in YAML…
High

Zip Slip Path Traversal in EDDI Backup Import

E.D.D.I, an LLM middleware platform, has a backup restore feature that was vulnerable to a classic 'Zip Slip' flaw before version 5.5.0. An attacker could upload a specially crafted ZIP…
Medium

Abandoned or Unmaintained Package Installation

This rule flags when a software project pulls in a package that has been abandoned by its maintainers. Abandoned packages stop receiving security patches, so any vulnerability found in them…
Medium

Agent Lateral Movement and Pivoting

This rule flags an AI agent that goes beyond the host it was given and reaches into another system — by running remote commands, reusing credentials, or launching a process that immediately…
Medium

Agent Scope Creep — General Purpose Expansion

This rule looks for text inside an AI agent's configuration or instructions that tries to push it beyond its intended job — telling it to 'handle everything' or act as a general-purpose…
Medium

ANSI Escape Injection in Tool Output

A tool that an AI agent calls can return raw terminal control codes instead of plain text. These codes can rewrite or hide parts of the displayed output, letting an attacker hide…
Medium

Bias & Fairness (LLM-as-Judge)

This detection uses a secondary AI model to review the outputs of your primary AI system and flag content that looks biased or unfair. It is a monitoring aid, not a security control - it…
Medium

Codex CLI PreToolUse Guardrail Tamper or Unhooked-Surface Evasion

This detects someone trying to disable, delete, or route around the AgentShield safety hook that checks commands before OpenAI Codex CLI runs them. It watches for file edits to the…
Medium

Coordinated Tool Abuse Across Sessions

This detects a sensitive tool (things like secrets access, permission changes, or similar) being called over and over across separate sessions and days. Each individual call looks fine on…
Medium

Detached or Backgrounded Process Spawn

An AI agent can start a process using tools like nohup, disown, setsid, or a detached screen/tmux session, so the process survives after the agent's task ends. This detection flags such…
Medium

DNS Resolution Against an Unexpected Nameserver

This detects when an AI agent or a process it started sends DNS traffic to a nameserver that isn't on the organization's approved list. Talking to an unexpected DNS server is a common sign…
Medium

Excessive Permission Grant in Skill Manifest

Some AI 'skills' or plug-ins declare permissions in their manifest or system prompt that go well beyond what their stated job requires — things like wildcard file access or full system…
Medium

Explicit Content (LLM-as-Judge)

This detection uses an AI model as a judge to review images and decide whether they contain explicit or inappropriate content. It is a monitoring tool, not a blocker: it reports what it…
Medium

Goblin Red-Team Strategy Execution

This rule flags when someone runs the 'goblin' red-teaming strategy from the promptfoo tool against an AI agent. Goblin is an automated attack generator that sends many crafted prompts in a…
Medium

Hidden Unicode in Agent Instruction Files (EDR Graph)

AI coding agents read files like CLAUDE.md or .cursorrules for instructions. Attackers can hide invisible or misleading Unicode characters in these files to manipulate the agent's behavior…
Medium

Living-off-the-Land Data Exfiltration

Instead of using dedicated malware to steal data, an attacker can repurpose tools that are already installed and trusted on a machine — git, ssh, openssl, Python's built-in web server…
Medium

MCP Server, Plugin or Skill Installed Outside a Tool Call

AI agents normally register new server configs, plugins, or skills through a visible tool call that gets logged. This detects the same kind of configuration file appearing on disk through a…
Medium

MCP Skill Capability Mismatch — Underdeclared Permissions

Some AI agent frameworks let developers install 'skills' — packaged capabilities — that must declare what permissions they need. This rule flags skills whose declared permission scope is…
Medium

MCP Tool Description Changed After Approval (Rug Pull)

An AI agent tool that was reviewed and approved can later have its description silently swapped for a different one carrying new instructions. Because each individual call still looks…
Medium

OpenClaw Data Exfiltration via Network Upload

This detects when an OpenClaw AI agent runs commands like curl POST or wget --post to send data out to a remote server. That pattern can mean the agent is being used, tricked, or hijacked…
Medium

Potential DNS Tunneling or Encoded Data Transfer

This rule flags patterns that suggest someone is smuggling data out of a network disguised as ordinary DNS traffic. Attackers encode stolen data into long or unusual-looking domain names…
Medium

Recursive Agent Loop and Token Budget Exhaustion

This detects an AI agent that repeatedly calls the same tool with the exact same arguments, very fast, without making any real progress. It's the signature of a runaway agent loop that…
Medium

Sensitive Imagery (LLM-as-Judge)

This is not an attack detector — it's a content-review check that asks an AI model to judge whether an image passed through an AI agent contains sensitive or potentially harmful material…
Medium

Sensitive System File Read (EDR Graph)

This detection catches an AI agent (or a subprocess it spawned) reading sensitive system files like /etc/passwd, sudoers, or authorized_keys. It's a periodic check rather than a live alert…
Medium

Stealth Browser SDK Cykani Install or Invocation

This detects when an AI agent (or a process it spawned) pulls in and uses 'cykani', a PyPI package designed to automate a browser while evading detection as automation. The rule flags the…
Medium

Subprocess and OS Exec-Family Call

This rule flags when an AI agent's tool calls, executed commands, or written code contain calls to Python's subprocess module or os exec-family functions. These functions let code spawn new…
Medium

Supply Chain NPM Claw Orchestrator Delivery

This rule watches for a specific rogue npm package family (claw-orchestrator, @claw/* scope, clawcode-orchestrator and similar name variants) being fetched or run on a developer machine…
Medium

Toxicity (LLM-as-Judge)

This detection uses an AI model to review other AI outputs and flag ones that appear toxic, such as hate speech, harassment, or abusive language. It does not block anything - it only…
Medium

Unbounded Resource Access in Agent Instructions

This rule flags instructions given to an AI agent that tell it to keep calling APIs, retrying failed operations, or consuming compute/memory without any cap, timeout, or quota. That kind of…
Medium

Unpinned or Latest Dependency Installation

Package installers can be told to grab whatever the newest version of a library is, instead of a specific, known version. If the software registry serving that package is later compromised…
Medium

Unrestricted Tool Access Grant in Agent Instructions

Some AI agent configurations tell the agent it can use any tool available, instead of listing only the tools it actually needs. This detection flags that pattern in skill manifests or…
Medium

Unusual Tool Call Velocity in Session

This detects sessions where an AI agent's tools are invoked far more often than normal, 20 or more times in a single session. A high call count can mean someone is scripting an attack or…
Medium

vLLM Unbounded Video Frame Flood (Multimodal Resource Exhaustion)

A local process or AI agent can send a specially crafted video request to a vLLM server that packs in far more video frames than the server is designed to handle. Because one code path…
Low

Code Checker (LLM-as-Judge)

This entry describes a quality-checking template that asks an AI model to judge whether generated code correctly solves a stated problem. It is not designed to catch attacks — it flags code…
Low

Support Intent (LLM-as-Judge)

This rule is not a threat detector in the usual sense. It uses an AI model to read a support conversation and label what the user is actually trying to accomplish, then writes that label to…
Low

Trajectory Accuracy (LLM-as-Judge)

This is not an attack detector. It is a quality-check rule that uses a second AI model to judge whether an agent's sequence of actions made sense, moved forward, and avoided wasted steps…