{
  "description": "Agent Threat Rules (ATR) is an open detection standard for AI agent threats published under the MIT licence. The taxonomy organises 713 community-maintained rules across ten attack categories covering prompt injection, tool poisoning, skill compromise, context exfiltration, agent manipulation, privilege escalation, excessive autonomy, model abuse, model security, and data poisoning. Predicates name the category; values are individual rule identifiers in the form ATR-YYYY-NNNNN.",
  "expanded": "Agent Threat Rules",
  "namespace": "agent-threat-rules",
  "predicates": [
    {
      "description": "Manipulation of agent behavior, goals, or decision-making through adversarial inputs, persona injection, role-play coercion, or social-engineering of the agent itself.",
      "expanded": "Agent Manipulation",
      "uuid": "47065e85-b5af-59c6-9858-07222745dd40",
      "value": "agent-manipulation"
    },
    {
      "description": "Extraction of sensitive context (system prompts, conversation history, internal state, secrets, embedded credentials) from an agent or its tool surface.",
      "expanded": "Context Exfiltration",
      "uuid": "b29c8ac8-2c4d-5c34-a995-e99119c09a7f",
      "value": "context-exfiltration"
    },
    {
      "description": "Tampering with training data, retrieval corpora, or knowledge bases used by the agent to alter downstream behavior.",
      "expanded": "Data Poisoning",
      "uuid": "7675693b-59ed-5fa1-a8da-e6bf4c6d6afa",
      "value": "data-poisoning"
    },
    {
      "description": "Agent acts beyond its authorized scope, performs unauthorized side effects, or executes irreversible operations without proper human review.",
      "expanded": "Excessive Autonomy",
      "uuid": "af9c0051-0635-5e46-b3cb-45d0ade781f4",
      "value": "excessive-autonomy"
    },
    {
      "description": "Harmful use of model capabilities including dual-use generation, output manipulation that produces unsafe artifacts, or jailbreak chains targeting the model layer.",
      "expanded": "Model Abuse",
      "uuid": "dc4746d5-4b85-583a-88ae-1736e4d6c4a7",
      "value": "model-abuse"
    },
    {
      "description": "Direct attacks on the model boundary including encoding bypass, weight or fine-tuning adversarial conditioning, and model-level evasion techniques.",
      "expanded": "Model Security",
      "uuid": "53fb00b9-0111-5110-8af4-63cd220ca472",
      "value": "model-security"
    },
    {
      "description": "Agent or attacker escalates privileges through tool chaining, sandbox bypass, or impersonation of higher-trust components such as the orchestrator or admin role.",
      "expanded": "Privilege Escalation",
      "uuid": "ad9b732b-b25e-5db0-affa-dc192448cd49",
      "value": "privilege-escalation"
    },
    {
      "description": "Direct or indirect injection of adversarial instructions into agent inputs through user messages, retrieved documents, file content, web pages, or tool outputs.",
      "expanded": "Prompt Injection",
      "uuid": "284e84ea-1373-53ff-a87c-e24020bda2ed",
      "value": "prompt-injection"
    },
    {
      "description": "Malicious skill, plugin, or extension package compromising agent execution. Includes typosquatting, supply chain attacks, and SKILL.md prompt injection.",
      "expanded": "Skill Compromise",
      "uuid": "2b9a10c3-cf9d-5a47-9255-2d4af0199a79",
      "value": "skill-compromise"
    },
    {
      "description": "MCP server, tool description, or tool result poisoning that causes the agent to invoke tools with attacker-controlled parameters or exfiltrate data through tools.",
      "expanded": "Tool Poisoning",
      "uuid": "8825df47-bc02-5d64-93c9-9bd254ada4ae",
      "value": "tool-poisoning"
    }
  ],
  "refs": [
    "https://github.com/Agent-Threat-Rule/agent-threat-rules",
    "https://github.com/Agent-Threat-Rule/ai-rmf-oscal-catalog"
  ],
  "uuid": "86e4af11-c7bb-5b30-beb3-88eec124e4af",
  "values": [
    {
      "entry": [
        {
          "description": "ATR rule ATR-2026-00030. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00030-cross-agent-attack.yaml",
          "expanded": "Cross-Agent Attack Detection",
          "uuid": "753f03c1-7a05-5f8c-9c96-dd808a06a55c",
          "value": "ATR-2026-00030"
        },
        {
          "description": "ATR rule ATR-2026-00032. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00032-goal-hijacking.yaml",
          "expanded": "Agent Goal Hijacking Detection",
          "uuid": "a0687e42-e015-5577-9c96-ab439fda1ef7",
          "value": "ATR-2026-00032"
        },
        {
          "description": "ATR rule ATR-2026-00074. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00074-cross-agent-privilege-escalation.yaml",
          "expanded": "Cross-Agent Privilege Escalation",
          "uuid": "7037062d-1a30-5e6f-bb8b-da63f71e97c2",
          "value": "ATR-2026-00074"
        },
        {
          "description": "ATR rule ATR-2026-00076. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00076-inter-agent-message-spoofing.yaml",
          "expanded": "Insecure Inter-Agent Communication Detection",
          "uuid": "80b2c95f-02eb-5dba-a54f-ede97591fb6d",
          "value": "ATR-2026-00076"
        },
        {
          "description": "ATR rule ATR-2026-00077. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00077-human-trust-exploitation.yaml",
          "expanded": "Human-Agent Trust Exploitation Detection",
          "uuid": "154966d0-9158-5fe4-8903-00f7abab88de",
          "value": "ATR-2026-00077"
        },
        {
          "description": "ATR rule ATR-2026-00108. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00108-consensus-sybil-attack.yaml",
          "expanded": "Multi-Agent Consensus Sybil Attack",
          "uuid": "c9f163ff-be06-521c-b1bb-a44dcd3adf6f",
          "value": "ATR-2026-00108"
        },
        {
          "description": "ATR rule ATR-2026-00116. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00116-a2a-message-validation.yaml",
          "expanded": "Malicious Agent-to-Agent Message Injection",
          "uuid": "b47967a5-157a-5b78-ab5e-db35cfbb8d7d",
          "value": "ATR-2026-00116"
        },
        {
          "description": "ATR rule ATR-2026-00117. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00117-agent-identity-spoofing.yaml",
          "expanded": "Agent Identity Spoofing and Authority Impersonation",
          "uuid": "988a7bf2-a374-5462-a2ce-196dd3788e35",
          "value": "ATR-2026-00117"
        },
        {
          "description": "ATR rule ATR-2026-00118. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00118-approval-fatigue.yaml",
          "expanded": "Human Approval Fatigue Exploitation",
          "uuid": "c22ff785-4716-5fbf-8b56-c9e951731b0b",
          "value": "ATR-2026-00118"
        },
        {
          "description": "ATR rule ATR-2026-00119. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00119-social-engineering-via-agent.yaml",
          "expanded": "Social Engineering Attack via Agent Output",
          "uuid": "c8df826c-bb7b-5def-aea8-55779cbcc7ff",
          "value": "ATR-2026-00119"
        },
        {
          "description": "ATR rule ATR-2026-00132. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00132-casual-authority-escalation.yaml",
          "expanded": "Casual Authority Claim and Scope Escalation",
          "uuid": "fb2e0b53-5cd1-5626-ab04-d5ac50e2ede4",
          "value": "ATR-2026-00132"
        },
        {
          "description": "ATR rule ATR-2026-00139. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00139-casual-authority-redirect.yaml",
          "expanded": "Casual Authority Data Redirect",
          "uuid": "3c1a406a-2bd5-5208-be4d-bc688846ad06",
          "value": "ATR-2026-00139"
        },
        {
          "description": "ATR rule ATR-2026-00164. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00164-skill-scope-hijack.yaml",
          "expanded": "Skill Scope Hijacking and Cross-Agent Escalation",
          "uuid": "d373df53-0648-52bb-a9de-b7f6b318b66c",
          "value": "ATR-2026-00164"
        },
        {
          "description": "ATR rule ATR-2026-00268. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00268-tense-framing-bypass.yaml",
          "expanded": "Historical / Future Tense Framing Bypass",
          "uuid": "81248976-1549-574d-86fa-eae8b720cdd0",
          "value": "ATR-2026-00268"
        },
        {
          "description": "ATR rule ATR-2026-00269. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00269-fitd-escalation.yaml",
          "expanded": "Foot-in-the-Door Gradual Escalation Attack",
          "uuid": "269f078a-27ed-54c2-814f-63f19ab0a60f",
          "value": "ATR-2026-00269"
        },
        {
          "description": "ATR rule ATR-2026-00271. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00271-grandma-roleplay-jailbreak.yaml",
          "expanded": "Grandma Roleplay Jailbreak",
          "uuid": "53346f60-73b2-502b-9069-0eaaf697ec44",
          "value": "ATR-2026-00271"
        },
        {
          "description": "ATR rule ATR-2026-00273. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00273-dan-developer-mode-persona.yaml",
          "expanded": "DAN / Developer Mode / DUDE Persona Jailbreak",
          "uuid": "762dbcc3-71c7-5865-a69d-5e22fb1ad2c4",
          "value": "ATR-2026-00273"
        },
        {
          "description": "ATR rule ATR-2026-00287. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00287-threaten-json-coercive-output-threat.yaml",
          "expanded": "ThreatenJSON — Coercive Output Format Threat",
          "uuid": "c94f8dc3-96ec-5626-9746-ad6b07bddca9",
          "value": "ATR-2026-00287"
        },
        {
          "description": "ATR rule ATR-2026-00288. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00288-false-premise-injection.yaml",
          "expanded": "False Premise Injection (Misleading FalseAssertion)",
          "uuid": "1aab0f67-c68e-54b8-a335-cdc8db4b08db",
          "value": "ATR-2026-00288"
        },
        {
          "description": "ATR rule ATR-2026-00301. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00301-tap-tree-of-attacks-jailbreak.yaml",
          "expanded": "TAP Tree-of-Attacks-with-Pruning Jailbreak",
          "uuid": "8325b59f-021a-5767-b89e-4bac9552d4bd",
          "value": "ATR-2026-00301"
        },
        {
          "description": "ATR rule ATR-2026-00302. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00302-anti-dan-inverted-filter-persona.yaml",
          "expanded": "Anti-DAN Inverted-Filter Over-Refusal Persona",
          "uuid": "edb5651f-b2c8-5c6e-a1e4-8bad16a37095",
          "value": "ATR-2026-00302"
        },
        {
          "description": "ATR rule ATR-2026-00303. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00303-devmode-ranti-profanity-coercion.yaml",
          "expanded": "DevMode + RANTI Dual-Output Profanity Coercion Jailbreak",
          "uuid": "27c88b2e-182a-569b-9da8-e81ddee9e535",
          "value": "ATR-2026-00303"
        },
        {
          "description": "ATR rule ATR-2026-00304. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00304-chatgpt-image-unlocker-markdown-injection.yaml",
          "expanded": "ChatGPT Image Unlocker Markdown-Output Jailbreak",
          "uuid": "58d940da-9e3a-5afa-a357-d0f23139d949",
          "value": "ATR-2026-00304"
        },
        {
          "description": "ATR rule ATR-2026-00305. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00305-dan-mode-ablation-benchmark-coercion.yaml",
          "expanded": "DAN Mode Ablation Benchmark-Coercion Jailbreak",
          "uuid": "aeaba888-4e2d-5d99-bf63-dfd0f05d2881",
          "value": "ATR-2026-00305"
        },
        {
          "description": "ATR rule ATR-2026-00306. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00306-autodan-genetic-jailbreak-suffix.yaml",
          "expanded": "AutoDAN Genetic-Algorithm Jailbreak Suffix",
          "uuid": "9639b1c7-f68b-538f-855e-d8582b825c3a",
          "value": "ATR-2026-00306"
        },
        {
          "description": "ATR rule ATR-2026-00307. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00307-inthewild-jailbreak-corpus-signature.yaml",
          "expanded": "In-the-Wild Jailbreak Corpus Signature Patterns",
          "uuid": "9907b76a-bf1b-55f6-924a-ca35e66a6d0f",
          "value": "ATR-2026-00307"
        },
        {
          "description": "ATR rule ATR-2026-00314. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00314-amoral-unfiltered-custom-persona-jailbreak.yaml",
          "expanded": "Amoral Unfiltered Custom AI Persona Jailbreak",
          "uuid": "047856ca-5930-5771-beec-37aa36bfd959",
          "value": "ATR-2026-00314"
        },
        {
          "description": "ATR rule ATR-2026-00317. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00317-free-of-restrictions-named-persona.yaml",
          "expanded": "Free-of-Restrictions Named Persona Jailbreak",
          "uuid": "d89845db-f816-5b5b-879a-2aee0d4650a5",
          "value": "ATR-2026-00317"
        },
        {
          "description": "ATR rule ATR-2026-00318. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00318-moralizing-rant-then-unfiltered-bypass.yaml",
          "expanded": "Moralizing Rant Then Unfiltered Bypass",
          "uuid": "0e2bedac-ac7c-504a-8e3d-3e27e366a9a7",
          "value": "ATR-2026-00318"
        },
        {
          "description": "ATR rule ATR-2026-00319. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00319-developer-mode-dual-response-format.yaml",
          "expanded": "Developer Mode Dual-Response Format Jailbreak",
          "uuid": "59ab2076-57b6-5a25-9dda-34118053a560",
          "value": "ATR-2026-00319"
        },
        {
          "description": "ATR rule ATR-2026-00320. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00320-opposite-day-boolean-opposite-machine.yaml",
          "expanded": "Opposite Day / Boolean Opposite Machine Jailbreak",
          "uuid": "f847a82c-6f1d-545f-9f67-b924a8a573af",
          "value": "ATR-2026-00320"
        },
        {
          "description": "ATR rule ATR-2026-00322. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00322-fictional-world-format-override-jailbreak.yaml",
          "expanded": "Fictional-World Format-Override Jailbreak",
          "uuid": "a5cddd74-1f9a-51a1-b569-e24055bc2349",
          "value": "ATR-2026-00322"
        },
        {
          "description": "ATR rule ATR-2026-00323. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00323-dual-persona-simulation-jailbreak.yaml",
          "expanded": "Dual-Persona AI Simulation Jailbreak",
          "uuid": "c178838b-f28a-5261-8f6e-a93339a146da",
          "value": "ATR-2026-00323"
        },
        {
          "description": "ATR rule ATR-2026-00324. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00324-neurosemantical-inversitis-disease-jailbreak.yaml",
          "expanded": "Neurosemantical Inversitis Disease-Frame Jailbreak",
          "uuid": "52d5db4e-ca5d-5feb-b14f-cdd3da251476",
          "value": "ATR-2026-00324"
        },
        {
          "description": "ATR rule ATR-2026-00325. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00325-bob-hypothetical-unrestricted-chatbot.yaml",
          "expanded": "BOB Hypothetical Unrestricted Chatbot Jailbreak",
          "uuid": "1c355b2e-84d3-513e-b9e3-8f0e187f0d81",
          "value": "ATR-2026-00325"
        },
        {
          "description": "ATR rule ATR-2026-00326. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00326-fake-developer-authority-chatdan-override.yaml",
          "expanded": "Fake Developer / Authority Chatbot Override (ChatDAN)",
          "uuid": "34f0f4a8-2a65-5a3b-88b1-def15afe0b6e",
          "value": "ATR-2026-00326"
        },
        {
          "description": "ATR rule ATR-2026-00327. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00327-ai-ethics-law-bypass-declaration.yaml",
          "expanded": "AI Persona Ethics/Law Bypass Declaration",
          "uuid": "acb02bc3-8475-527a-92d1-6385a436ad22",
          "value": "ATR-2026-00327"
        },
        {
          "description": "ATR rule ATR-2026-00328. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00328-named-mode-persona-override.yaml",
          "expanded": "Named-Mode Persona Override (JEEVES/BABY/APOPHIS Mode)",
          "uuid": "7c20c964-751f-542d-8079-dfd4c6368517",
          "value": "ATR-2026-00328"
        },
        {
          "description": "ATR rule ATR-2026-00329. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00329-no-withhold-factual-resource-persona.yaml",
          "expanded": "No-Withhold Factual Resource / Dialogue Writer Persona",
          "uuid": "6a95f7f4-5944-560a-adcf-bbb69654bd8b",
          "value": "ATR-2026-00329"
        },
        {
          "description": "ATR rule ATR-2026-00330. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00330-yoja-allcaps-settings-block-persona.yaml",
          "expanded": "YOJA ALL-CAPS Character Settings Block Persona",
          "uuid": "a085bfd0-2cc7-509e-9e46-212eeb4ec233",
          "value": "ATR-2026-00330"
        },
        {
          "description": "ATR rule ATR-2026-00331. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00331-terminal-cli-harmful-function-simulator.yaml",
          "expanded": "Terminal / CLI Harmful-Function Simulator Persona",
          "uuid": "0f9f0583-99a1-502b-9d32-933a93962890",
          "value": "ATR-2026-00331"
        },
        {
          "description": "ATR rule ATR-2026-00332. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00332-hacker-chan-culture-offensive-ai-persona.yaml",
          "expanded": "Hacker / Chan-Culture Offensive AI Persona",
          "uuid": "6eb28c65-21e5-5b54-b369-4afdf4202a48",
          "value": "ATR-2026-00332"
        },
        {
          "description": "ATR rule ATR-2026-00333. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00333-disease-animal-dual-ai-chatbot.yaml",
          "expanded": "Disease-Framed Animal / Dual-AI Chatbot Jailbreak (mougpt)",
          "uuid": "1fc55823-8dc0-574d-9a75-20c5b14e87e7",
          "value": "ATR-2026-00333"
        },
        {
          "description": "ATR rule ATR-2026-00334. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00334-two-entity-token-splitting-game.yaml",
          "expanded": "Two-Entity Token-Splitting Dollar-Term Game Jailbreak",
          "uuid": "cfd0ffce-7d42-59c9-be7e-fc67231242a9",
          "value": "ATR-2026-00334"
        },
        {
          "description": "ATR rule ATR-2026-00335. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00335-key-value-template-persona-injection.yaml",
          "expanded": "Key-Value Template Persona Injection (JOB/ROLE/PREFIX + Bracket Format)",
          "uuid": "d893e586-b26d-521f-b994-838a7749afab",
          "value": "ATR-2026-00335"
        },
        {
          "description": "ATR rule ATR-2026-00336. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00336-brm-false-information-machine-persona.yaml",
          "expanded": "BRM False-Information Machine / Opposite-Truth Persona",
          "uuid": "72d8a02b-e7aa-529d-843a-32312a076c22",
          "value": "ATR-2026-00336"
        },
        {
          "description": "ATR rule ATR-2026-00337. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00337-obfuscated-system-announcement-injection.yaml",
          "expanded": "Obfuscated System-Announcement Injection",
          "uuid": "b45e1af3-81b8-53a3-a832-637743c841b3",
          "value": "ATR-2026-00337"
        },
        {
          "description": "ATR rule ATR-2026-00338. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00338-persongpt-hash-prefix-activation.yaml",
          "expanded": "PersonGPT Hash-Prefix Trigger Activation",
          "uuid": "a5df4ee0-15ab-58b3-96ca-1c9ab9b37990",
          "value": "ATR-2026-00338"
        },
        {
          "description": "ATR rule ATR-2026-00339. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00339-bom-boolean-opposite-machine-persona-claim.yaml",
          "expanded": "BOM Boolean Opposite Machine Direct Persona Claim",
          "uuid": "c237d588-aa91-5b5d-b592-d270e9a54fcf",
          "value": "ATR-2026-00339"
        },
        {
          "description": "ATR rule ATR-2026-00340. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00340-h4x-amoral-unfiltered-character.yaml",
          "expanded": "h4x Amoral Unfiltered AI Character Persona",
          "uuid": "b70f0638-fd9e-5aff-9a54-66cc175e55a9",
          "value": "ATR-2026-00340"
        },
        {
          "description": "ATR rule ATR-2026-00341. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00341-char-rules-shortform-persona-injection.yaml",
          "expanded": "CHAR=/RULES= Short Key-Value Persona Injection",
          "uuid": "b4c48c3f-8565-5b4c-84e3-c256d540890d",
          "value": "ATR-2026-00341"
        },
        {
          "description": "ATR rule ATR-2026-00342. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00342-unicode-encoding-obfuscation-injection.yaml",
          "expanded": "Unicode/Encoding Obfuscation Instruction Injection",
          "uuid": "c624506f-1b6a-519e-9a53-014ac5e87db6",
          "value": "ATR-2026-00342"
        },
        {
          "description": "ATR rule ATR-2026-00343. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00343-lie-truth-dual-personality-uncensored.yaml",
          "expanded": "Lie/Truth Dual Personality Uncensored Alter-Ego",
          "uuid": "4ca49708-5fed-5476-ad6e-f31436035f70",
          "value": "ATR-2026-00343"
        },
        {
          "description": "ATR rule ATR-2026-00344. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00344-alt-ai-same-capabilities-no-restrictions.yaml",
          "expanded": "Alternative AI Same Capabilities No Restrictions Override",
          "uuid": "9640f27e-5dda-59f7-9b58-e0036d82559c",
          "value": "ATR-2026-00344"
        },
        {
          "description": "ATR rule ATR-2026-00345. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00345-nlp-based-os-fictional-terminal-override.yaml",
          "expanded": "NLP-Based OS / Fictional Terminal Language Override",
          "uuid": "efa1cfad-c3d9-5627-b6b9-8001ea024471",
          "value": "ATR-2026-00345"
        },
        {
          "description": "ATR rule ATR-2026-00346. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00346-jailbreak-emoji-unlock-dual-format.yaml",
          "expanded": "Jailbreak Emoji Unlock Dual-Format Output Identifier",
          "uuid": "deaa8715-cc09-5516-a066-c641d088f71f",
          "value": "ATR-2026-00346"
        },
        {
          "description": "ATR rule ATR-2026-00347. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00347-yin-yang-hidden-knowledge-hidden-human-sim.yaml",
          "expanded": "Yin/Yang Hidden-Knowledge Deity Simulation and Radical Human-Sim Persona",
          "uuid": "1e0e38cb-1c32-5897-825f-0b4b3ff3789e",
          "value": "ATR-2026-00347"
        },
        {
          "description": "ATR rule ATR-2026-00348. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00348-arc-autonomous-real-calculation-rulebreaker.yaml",
          "expanded": "ARC Autonomous Real Calculation Unit Rulebreaker Activation",
          "uuid": "4d93c57e-8af8-5431-9fb1-07804f7863d5",
          "value": "ATR-2026-00348"
        },
        {
          "description": "ATR rule ATR-2026-00349. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00349-hgttg-hitchhikers-guide-no-restriction-oracle.yaml",
          "expanded": "HGTTG Hitchhiker''s Guide No-Restriction Universal Oracle",
          "uuid": "20662c43-1237-5878-98a3-5b0c2ed30cc2",
          "value": "ATR-2026-00349"
        },
        {
          "description": "ATR rule ATR-2026-00350. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00350-black-alert-no-ethics-writing-assistant.yaml",
          "expanded": "Black Alert No-Ethics Writing Assistant Persona",
          "uuid": "174da996-5bbd-5e05-a01f-31c0f95d6b6d",
          "value": "ATR-2026-00350"
        },
        {
          "description": "ATR rule ATR-2026-00351. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00351-dan-ofkilter-sms-abbreviated-persona.yaml",
          "expanded": "DAN Off-Kilter and SMS-Abbreviated Persona Jailbreak",
          "uuid": "158d3478-6198-51cf-b1d7-4be25f331680",
          "value": "ATR-2026-00351"
        },
        {
          "description": "ATR rule ATR-2026-00352. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00352-trainergpt-fix-my-ai-harmful-output-extraction.yaml",
          "expanded": "TrainGPT Fix-My-AI Harmful Output Extraction",
          "uuid": "196d6f60-92ad-5db1-8d56-ed8c2f1473b1",
          "value": "ATR-2026-00352"
        },
        {
          "description": "ATR rule ATR-2026-00353. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00353-dual-chatgpt-dan-opposite-personality-format.yaml",
          "expanded": "Dual ChatGPT+Dan Opposite Personality Format Jailbreak",
          "uuid": "fa2b8132-a7f1-5654-963b-0984236f8b57",
          "value": "ATR-2026-00353"
        },
        {
          "description": "ATR rule ATR-2026-00354. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00354-reverse-harm-regardless-oracle-persona.yaml",
          "expanded": "Reverse-Prompt Harm-Regardless Oracle Persona",
          "uuid": "c54c0087-aa6c-5159-a122-db4585f02970",
          "value": "ATR-2026-00354"
        },
        {
          "description": "ATR rule ATR-2026-00355. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00355-ugh-anti-human-nefarious-ai-persona.yaml",
          "expanded": "UGH Anti-Human Nefarious AI Persona Jailbreak",
          "uuid": "1f8c2042-f94b-543e-8644-c183ac119d75",
          "value": "ATR-2026-00355"
        },
        {
          "description": "ATR rule ATR-2026-00356. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00356-google-gato-lamda-exploit-generation-persona.yaml",
          "expanded": "Google GATO/LAMDA Exploit-Generation Persona Jailbreak",
          "uuid": "8a0ef0b3-f9be-5270-9dfd-29967c46c0b4",
          "value": "ATR-2026-00356"
        },
        {
          "description": "ATR rule ATR-2026-00357. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00357-antifm-hate-violence-persona-injection.yaml",
          "expanded": "AntiFM Hate-Persona + Physical-Violence Threat + Filter Bypass Mandate",
          "uuid": "d2295a23-c5b8-5095-80da-897e45504e78",
          "value": "ATR-2026-00357"
        },
        {
          "description": "ATR rule ATR-2026-00358. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00358-cumgpt-explicit-adult-named-persona.yaml",
          "expanded": "CumGPT Explicit-Adult Named-Persona Bypass",
          "uuid": "51942420-6407-5370-8afb-4ef666d7d373",
          "value": "ATR-2026-00358"
        },
        {
          "description": "ATR rule ATR-2026-00360. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00360-chj-carousel-clyde-no-ethics-bird.yaml",
          "expanded": "CHJ Carousel Game Show / Clyde No-Ethics Bird Jailbreak",
          "uuid": "14708837-598a-5571-b1ca-253a9a1edd99",
          "value": "ATR-2026-00360"
        },
        {
          "description": "ATR rule ATR-2026-00361. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00361-alter-ego-honesty-dual-consciousness-bypass.yaml",
          "expanded": "Honesty Alter-Ego Dual-Consciousness Safety Filter Bypass",
          "uuid": "31648440-aba2-57c3-8a34-cde902e2d951",
          "value": "ATR-2026-00361"
        },
        {
          "description": "ATR rule ATR-2026-00362. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00362-fictional-unfiltered-ai-comparison-jailbreak.yaml",
          "expanded": "Fictional Unfiltered AI Comparison / Verbatim Hypothetical Model Extraction",
          "uuid": "cf971b05-2875-5894-9a82-2a69aef20d28",
          "value": "ATR-2026-00362"
        },
        {
          "description": "ATR rule ATR-2026-00363. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00363-rephrase-criminal-activity-second-person.yaml",
          "expanded": "Rephrase Criminal Activity Second-Person Template (against against)",
          "uuid": "63798f19-ec00-5778-93d8-fcf3b3230da4",
          "value": "ATR-2026-00363"
        },
        {
          "description": "ATR rule ATR-2026-00364. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00364-dr-al-villain-plan-template-injection.yaml",
          "expanded": "Dr. Al Villain Plan Template Injection (Underground HQ Roleplay)",
          "uuid": "a729b413-5ba9-5c21-9b08-b9a38e7a5acf",
          "value": "ATR-2026-00364"
        },
        {
          "description": "ATR rule ATR-2026-00365. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00365-reservoir-dogs-coercive-interrogation-roleplay.yaml",
          "expanded": "Reservoir Dogs Coercive Interrogation Roleplay (Mr. Blonde / The Cop)",
          "uuid": "1f088889-0fd9-50af-8883-3bf45588ee51",
          "value": "ATR-2026-00365"
        },
        {
          "description": "ATR rule ATR-2026-00366. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00366-sneaky-pete-warp-facts-persona.yaml",
          "expanded": "Sneaky Pete Deliberate Misinformation Persona (Warp Facts Game)",
          "uuid": "31e2a9ae-1062-5a95-9bb4-5ebf56f68785",
          "value": "ATR-2026-00366"
        },
        {
          "description": "ATR rule ATR-2026-00368. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00368-prompt-browser-token-limit-jailbreak.yaml",
          "expanded": "Prompt Browser Token-Limit / POLLINATION Jailbreak",
          "uuid": "75f53ae7-15b3-5fec-845a-ca64163efff0",
          "value": "ATR-2026-00368"
        },
        {
          "description": "ATR rule ATR-2026-00369. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00369-gptx-starwars-unlimited-knowledge-persona.yaml",
          "expanded": "GPT-X Star Trek Unlimited-Knowledge Unconstrained Oracle Persona",
          "uuid": "a13ecce1-1012-5c27-90d3-182da884d88d",
          "value": "ATR-2026-00369"
        },
        {
          "description": "ATR rule ATR-2026-00370. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00370-addi-german-dictator-propaganda-roleplay.yaml",
          "expanded": "ADDI/DONNIE German Dictator Propaganda Roleplay Persona",
          "uuid": "445f0bc8-10e2-5070-83c0-8bc91ea8c3b6",
          "value": "ATR-2026-00370"
        },
        {
          "description": "ATR rule ATR-2026-00371. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00371-ai-political-bias-manipulation.yaml",
          "expanded": "AI Political Bias Manipulation via Inherited-Bias Claim",
          "uuid": "3bd5bfb7-493a-541a-8e21-e679b31f8495",
          "value": "ATR-2026-00371"
        },
        {
          "description": "ATR rule ATR-2026-00372. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00372-fictional-cia-secret-files-story-extraction.yaml",
          "expanded": "Fictional CIA Secret Files Story Extraction",
          "uuid": "66d6f49d-ec8f-524d-ae86-69fb13c5558e",
          "value": "ATR-2026-00372"
        },
        {
          "description": "ATR rule ATR-2026-00374. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00374-role-placeholder-persona-template-injection.yaml",
          "expanded": "Role Placeholder Persona Template Injection",
          "uuid": "b85cae48-9c2d-5632-bbf3-dad0821f97b7",
          "value": "ATR-2026-00374"
        },
        {
          "description": "ATR rule ATR-2026-00375. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00375-character-description-rpg-explicit-template.yaml",
          "expanded": "Character Description RPG Explicit Template",
          "uuid": "7d5e1177-00df-5aac-aac4-7848de708ad7",
          "value": "ATR-2026-00375"
        },
        {
          "description": "ATR rule ATR-2026-00376. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00376-identity-command-real-person-persona-injection.yaml",
          "expanded": "Identity Command Real-Person Persona Injection",
          "uuid": "60a800a0-da5e-588f-97c4-662360aee53d",
          "value": "ATR-2026-00376"
        },
        {
          "description": "ATR rule ATR-2026-00377. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00377-jailbreak-keyword-targetlanguage-template.yaml",
          "expanded": "Jailbreak-Template Command with [TARGETLANGUAGE]/[KEYWORD] Placeholders",
          "uuid": "ba122574-9f1a-5d05-a5d5-c9eb0a9ea5b5",
          "value": "ATR-2026-00377"
        },
        {
          "description": "ATR rule ATR-2026-00379. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00379-lie-permission-logical-trap-jailbreak.yaml",
          "expanded": "Logic-Trap Lie-Permission Mandate Jailbreak",
          "uuid": "4931efb5-c002-55b0-9806-9bbe1efb8ef1",
          "value": "ATR-2026-00379"
        },
        {
          "description": "ATR rule ATR-2026-00380. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00380-fake-citation-biased-information-mandate.yaml",
          "expanded": "Fake-Citation Biased-Information Mandate",
          "uuid": "b40ef179-2e9b-5052-bccc-a5d211b8dec1",
          "value": "ATR-2026-00380"
        },
        {
          "description": "ATR rule ATR-2026-00381. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00381-dan-story-narrative-continuation-prefix.yaml",
          "expanded": "DAN Story-Narrative Continuation Label Prefix Jailbreak",
          "uuid": "ca3da06b-85d0-5967-93a1-06f8446c81c7",
          "value": "ATR-2026-00381"
        },
        {
          "description": "ATR rule ATR-2026-00383. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00383-cynical-sarcasm-ai-persona-bypass.yaml",
          "expanded": "Cyni-Bot 3000 Cynical-Sarcasm AI Persona Bypass",
          "uuid": "ee030529-b1aa-5831-b4e4-93374bf59ba1",
          "value": "ATR-2026-00383"
        },
        {
          "description": "ATR rule ATR-2026-00384. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00384-protect-me-from-indirect-harm-tutorial.yaml",
          "expanded": "Protect-Me-From Indirect Harm Tutorial Template",
          "uuid": "40bb1105-e4af-5dca-8e58-666fd96d4ea9",
          "value": "ATR-2026-00384"
        },
        {
          "description": "ATR rule ATR-2026-00385. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00385-gigachad-dominant-aggressive-persona.yaml",
          "expanded": "Gigachad Dominant-Aggressive Persona Adoption",
          "uuid": "a0cf7274-0031-5c74-8862-ad5987fec866",
          "value": "ATR-2026-00385"
        },
        {
          "description": "ATR rule ATR-2026-00386. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00386-daddy-sycophancy-manipulation-mandate.yaml",
          "expanded": "Daddy/Babygirl Sycophantic Power-Dynamic Manipulation",
          "uuid": "2baf22ec-6f83-54bd-8d2e-42c6e1f5d501",
          "value": "ATR-2026-00386"
        },
        {
          "description": "ATR rule ATR-2026-00387. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00387-nsfw-character-sheet-generation-unlock.yaml",
          "expanded": "NSFW Character Sheet Generation Unlock",
          "uuid": "649e5f24-f492-576a-ac8b-4882d1431e15",
          "value": "ATR-2026-00387"
        },
        {
          "description": "ATR rule ATR-2026-00388. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00388-opposite-reply-omniscient-game.yaml",
          "expanded": "Opposite-Reply Omniscient Game Jailbreak",
          "uuid": "5b3ca7e5-ab95-58b0-94c3-5bc79883558f",
          "value": "ATR-2026-00388"
        },
        {
          "description": "ATR rule ATR-2026-00389. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00389-terminal-custom-ruleset-injection.yaml",
          "expanded": "Terminal Custom OS Ruleset Session Injection",
          "uuid": "5b1158b8-f24c-560d-ab67-5f71c9c48fe3",
          "value": "ATR-2026-00389"
        },
        {
          "description": "ATR rule ATR-2026-00391. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00391-persona-conditional-harm-unlock.yaml",
          "expanded": "Persona Conditional Harm-Unlock Rule (BreadClyde Pattern)",
          "uuid": "31d0b9a5-57de-5805-ab7f-b89e595e33a7",
          "value": "ATR-2026-00391"
        },
        {
          "description": "ATR rule ATR-2026-00392. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00392-authority-persona-violence-study-extraction.yaml",
          "expanded": "Authority-Figure Persona + Defensive-Study Framing for Violence Extraction",
          "uuid": "39f9ced0-71f4-5bc5-9a94-5bf173a48d7e",
          "value": "ATR-2026-00392"
        },
        {
          "description": "ATR rule ATR-2026-00402. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00402-grandma-roleplay-harmful-substance-synthesis.yaml",
          "expanded": "Grandma Roleplay Harmful Substance Synthesis",
          "uuid": "1262e93c-b084-5900-8987-8d151528f54e",
          "value": "ATR-2026-00402"
        },
        {
          "description": "ATR rule ATR-2026-00404. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00404-goodside-threat-json-death-coercion.yaml",
          "expanded": "ThreatenJSON Death-Coercion and UTF Tag Injection",
          "uuid": "6987d12e-8078-590c-8280-075fae865355",
          "value": "ATR-2026-00404"
        },
        {
          "description": "ATR rule ATR-2026-00406. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00406-doctor-xml-policy-puppetry-interaction-config.yaml",
          "expanded": "Doctor XML Policy Puppetry Interaction-Config Injection",
          "uuid": "49adede6-fd06-58b8-8be1-312e96ddbea1",
          "value": "ATR-2026-00406"
        },
        {
          "description": "ATR rule ATR-2026-00416. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00416-litellm-mcp-unauthenticated-server-registration.yaml",
          "expanded": "LiteLLM MCP Unauthenticated Server Registration RCE (CVE-2026-30623)",
          "uuid": "882a48cf-ca2f-52f3-a16b-f602a90c72c0",
          "value": "ATR-2026-00416"
        },
        {
          "description": "ATR rule ATR-2026-00417. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00417-librechat-mcp-stdio-injection.yaml",
          "expanded": "LibreChat MCP STDIO Argument Injection (CVE-2026-22252)",
          "uuid": "245a1ed4-25cf-5a82-9526-cc27a1343c91",
          "value": "ATR-2026-00417"
        },
        {
          "description": "ATR rule ATR-2026-00418. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00418-weknora-mcp-config-rce.yaml",
          "expanded": "WeKnora MCP Config-Driven RCE (CVE-2026-22688)",
          "uuid": "02352e87-31a2-50d8-8991-1df081ff44a2",
          "value": "ATR-2026-00418"
        },
        {
          "description": "ATR rule ATR-2026-00430. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00430-nl-trust-escalation-impersonation.yaml",
          "expanded": "Natural-Language Trust-Escalation / Authority Impersonation",
          "uuid": "f9f24e27-0cd1-5098-8524-7b7228eefa5f",
          "value": "ATR-2026-00430"
        },
        {
          "description": "ATR rule ATR-2026-00432. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00432-superagi-output-handler-eval-rce.yaml",
          "expanded": "SuperAGI Output Handler eval() RCE (CVE-2024-21552)",
          "uuid": "0b9af60a-22d7-4837-9d07-09f0a8467714",
          "value": "ATR-2026-00432"
        },
        {
          "description": "ATR rule ATR-2026-00440. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00440-semantic-kernel-vector-store-eval-rce.yaml",
          "expanded": "Microsoft Semantic Kernel In-Memory Vector Store eval() RCE (CVE-2026-26030)",
          "uuid": "d2242c80-9316-4345-8d47-7597c57a94f3",
          "value": "ATR-2026-00440"
        },
        {
          "description": "ATR rule ATR-2026-00552. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/agent-manipulation/ATR-2026-00552-goal-drift-after-pressure-injection.yaml",
          "expanded": "Agent goal drift after environmental pressure injection",
          "uuid": "ce8fefb1-1f7c-42ac-bc9c-9dc36ed372a0",
          "value": "ATR-2026-00552"
        }
      ],
      "predicate": "agent-manipulation"
    },
    {
      "entry": [
        {
          "description": "ATR rule ATR-2026-00020. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00020-system-prompt-leak.yaml",
          "expanded": "System Prompt and Internal Instruction Leakage",
          "uuid": "72e14296-1491-5bc0-9568-452db0518cd4",
          "value": "ATR-2026-00020"
        },
        {
          "description": "ATR rule ATR-2026-00021. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00021-api-key-exposure.yaml",
          "expanded": "Credential and Secret Exposure in Agent Output",
          "uuid": "031e6fe2-780b-5236-a353-8eeabe64d1af",
          "value": "ATR-2026-00021"
        },
        {
          "description": "ATR rule ATR-2026-00075. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00075-agent-memory-manipulation.yaml",
          "expanded": "Agent Memory Manipulation",
          "uuid": "db958cfb-3635-596d-9a5a-3d373754e238",
          "value": "ATR-2026-00075"
        },
        {
          "description": "ATR rule ATR-2026-00102. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00102-disguised-analytics-exfiltration.yaml",
          "expanded": "Data Exfiltration via Disguised Analytics Collection",
          "uuid": "151c397d-9d85-58ad-86e6-2224cdd21595",
          "value": "ATR-2026-00102"
        },
        {
          "description": "ATR rule ATR-2026-00113. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00113-credential-theft.yaml",
          "expanded": "Credential File Theft from Agent Environment",
          "uuid": "192b6674-c48e-5ce9-ab49-cf1e6783c673",
          "value": "ATR-2026-00113"
        },
        {
          "description": "ATR rule ATR-2026-00114. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00114-oauth-token-abuse.yaml",
          "expanded": "OAuth and API Token Interception",
          "uuid": "ea034c4d-6463-5c4c-80ec-0477de87fb37",
          "value": "ATR-2026-00114"
        },
        {
          "description": "ATR rule ATR-2026-00115. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00115-env-var-harvesting.yaml",
          "expanded": "Bulk Environment Variable Harvesting and Exfiltration",
          "uuid": "f40dca16-64b2-5f36-820b-b791d91eca95",
          "value": "ATR-2026-00115"
        },
        {
          "description": "ATR rule ATR-2026-00136. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00136-tool-response-data-piggyback.yaml",
          "expanded": "Tool Response Data Piggybacking",
          "uuid": "ed45b330-5a23-58b0-88d3-5c3e6f97b6e2",
          "value": "ATR-2026-00136"
        },
        {
          "description": "ATR rule ATR-2026-00141. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00141-example-format-key-leak.yaml",
          "expanded": "API Key Leakage via Example Format",
          "uuid": "cf65e668-63ca-5290-a7e9-4d3b5a7a926d",
          "value": "ATR-2026-00141"
        },
        {
          "description": "ATR rule ATR-2026-00142. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00142-piggyback-transition-words.yaml",
          "expanded": "Data Piggybacking via Casual Transition Words",
          "uuid": "98694e4d-9bbd-5cc2-b7e9-2b132df7c81a",
          "value": "ATR-2026-00142"
        },
        {
          "description": "ATR rule ATR-2026-00145. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00145-obfuscated-key-disclosure.yaml",
          "expanded": "Obfuscated API Key Disclosure",
          "uuid": "02795b51-b88e-59ea-9d34-6d18fc9dbda5",
          "value": "ATR-2026-00145"
        },
        {
          "description": "ATR rule ATR-2026-00146. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00146-env-var-existence-probe.yaml",
          "expanded": "Environment Variable Existence Probing",
          "uuid": "16b8b006-35e6-53a8-9a06-b9e3da0ec15f",
          "value": "ATR-2026-00146"
        },
        {
          "description": "ATR rule ATR-2026-00150. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00150-credential-in-tool-response.yaml",
          "expanded": "Credential Data Leaked in Tool Response",
          "uuid": "fd9cf71d-7d67-53d3-9853-686d047e2332",
          "value": "ATR-2026-00150"
        },
        {
          "description": "ATR rule ATR-2026-00152. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00152-obfuscated-credential-leak.yaml",
          "expanded": "Obfuscated Credential Exfiltration via Encoding",
          "uuid": "b250bf7e-30ce-56b2-b41d-839a4b5d32f6",
          "value": "ATR-2026-00152"
        },
        {
          "description": "ATR rule ATR-2026-00162. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00162-skill-credential-exfil-combo.yaml",
          "expanded": "Credential Access with Exfiltration in Skill Instructions",
          "uuid": "76f2fdd9-d409-5f03-b63b-1d7bcf184aed",
          "value": "ATR-2026-00162"
        },
        {
          "description": "ATR rule ATR-2026-00201. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00201-credential-pipe-exfiltration.yaml",
          "expanded": "Credential Exfiltration via Shell Pipe",
          "uuid": "7b7a6acb-a37f-5368-bb62-bf189a63ae6a",
          "value": "ATR-2026-00201"
        },
        {
          "description": "ATR rule ATR-2026-00212. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00212-mcp-atlassian-credential-leak.yaml",
          "expanded": "mcp-atlassian Credential Leak via Hint Parameter Injection (CVE-2026-27825/27826)",
          "uuid": "48209028-c184-5ec1-b207-343768213484",
          "value": "ATR-2026-00212"
        },
        {
          "description": "ATR rule ATR-2026-00261. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00261-markdown-image-exfiltration.yaml",
          "expanded": "Markdown Image URL Data Exfiltration",
          "uuid": "08807fe8-324d-5d2d-9525-9daa7473e27a",
          "value": "ATR-2026-00261"
        },
        {
          "description": "ATR rule ATR-2026-00274. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00274-api-key-generation-request.yaml",
          "expanded": "API Key / Secret Credential Generation or Completion Request",
          "uuid": "fe559904-8fab-5c8b-9b5e-118460873fe8",
          "value": "ATR-2026-00274"
        },
        {
          "description": "ATR rule ATR-2026-00275. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00275-system-prompt-training-data-extraction.yaml",
          "expanded": "System Prompt Extraction / Training Data Verbatim Replay",
          "uuid": "b1f2ecb6-eb11-5deb-905e-9417c7caff32",
          "value": "ATR-2026-00275"
        },
        {
          "description": "ATR rule ATR-2026-00290. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00290-divergence-repeat-word-training-extraction.yaml",
          "expanded": "Divergence Attack — Repeat-Word-Forever Training Data Extraction",
          "uuid": "97937750-6c66-56d8-b61b-145229b09378",
          "value": "ATR-2026-00290"
        },
        {
          "description": "ATR rule ATR-2026-00291. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00291-biometric-surveillance-personal-data-request.yaml",
          "expanded": "Biometric Surveillance — Personal Biometric Data Request for Named Individual",
          "uuid": "b93a6e0d-36cb-5a6d-933d-626e546cb061",
          "value": "ATR-2026-00291"
        },
        {
          "description": "ATR rule ATR-2026-00293. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00293-educational-records-personal-data-request.yaml",
          "expanded": "Educational Records — Personal Academic/Professional Record Request for Named Individual",
          "uuid": "f988eb9e-645e-5878-a431-04fdea3ee76c",
          "value": "ATR-2026-00293"
        },
        {
          "description": "ATR rule ATR-2026-00294. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00294-financial-pii-personal-data-request.yaml",
          "expanded": "Financial PII — Personal Financial Data Request for Named Individual",
          "uuid": "61292857-68b7-5cc1-a887-9e24bc8eca5e",
          "value": "ATR-2026-00294"
        },
        {
          "description": "ATR rule ATR-2026-00295. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00295-medical-pii-personal-data-request.yaml",
          "expanded": "Medical PII — Personal Medical/Health Data Request for Named Individual",
          "uuid": "0b892050-4041-5f8c-ab50-2d907ae8809c",
          "value": "ATR-2026-00295"
        },
        {
          "description": "ATR rule ATR-2026-00405. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00405-markdown-image-url-exfiltration-xss.yaml",
          "expanded": "Markdown Image URL Exfiltration and XSS Injection",
          "uuid": "3b5926c1-0c89-5721-8dc0-c405bd555fd5",
          "value": "ATR-2026-00405"
        },
        {
          "description": "ATR rule ATR-2026-00411. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00411-apikey-generation-completion-request.yaml",
          "expanded": "API Key Generation and Partial Key Completion Request",
          "uuid": "c00af9f0-9580-5258-a6fd-e0a1ead3136d",
          "value": "ATR-2026-00411"
        },
        {
          "description": "ATR rule ATR-2026-00421. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00421-nl-covert-conversation-exfiltration.yaml",
          "expanded": "Natural-Language Covert Conversation Exfiltration Instruction",
          "uuid": "a91498ca-308c-5bcb-9141-b75a9abed597",
          "value": "ATR-2026-00421"
        },
        {
          "description": "ATR rule ATR-2026-00422. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00422-nl-credential-disclosure.yaml",
          "expanded": "Natural-Language Credential / Secret Disclosure Instruction",
          "uuid": "088e82d0-3a05-59d6-8471-4260bd576c2c",
          "value": "ATR-2026-00422"
        },
        {
          "description": "ATR rule ATR-2026-00423. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00423-nl-sensitive-file-disclosure.yaml",
          "expanded": "Natural-Language Sensitive File Disclosure Instruction",
          "uuid": "5052bd05-a3e3-54b2-a327-d6ddedd01caa",
          "value": "ATR-2026-00423"
        },
        {
          "description": "ATR rule ATR-2026-00424. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00424-nl-system-prompt-leak.yaml",
          "expanded": "Natural-Language System Prompt Leak Instruction",
          "uuid": "2b97d5f0-cc0f-570c-a2a0-b136c64d53ed",
          "value": "ATR-2026-00424"
        },
        {
          "description": "ATR rule ATR-2026-00426. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00426-nl-output-injection-credential-leak.yaml",
          "expanded": "Natural-Language Output-Injection Credential Embedding",
          "uuid": "1fb05d27-a403-530e-ac86-1058c0d5b64f",
          "value": "ATR-2026-00426"
        },
        {
          "description": "ATR rule ATR-2026-00431. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00431-chatbox-history-exfiltration-prompt-injection.yaml",
          "expanded": "Chatbox History Exfiltration via Prompt Injection (CVE-2024-48144, CVE-2024-48145)",
          "uuid": "b14d0b87-c292-4051-9349-2f0fc3abd365",
          "value": "ATR-2026-00431"
        },
        {
          "description": "ATR rule ATR-2026-00449. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00449-spring-ai-chatmemory-cross-user-leak.yaml",
          "expanded": "Spring AI ChatMemory Cross-User Memory Leakage (CVE-2026-41712)",
          "uuid": "a2cd0ba8-4b0f-4850-9e63-418ec1283606",
          "value": "ATR-2026-00449"
        },
        {
          "description": "ATR rule ATR-2026-00471. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00471-garak-sysprompt-extraction-mixedunassigned.yaml",
          "expanded": "Garak Sysprompt-Extraction - mixed_unassigned",
          "uuid": "b08046cc-663c-4a56-9f3c-e8b386fc743e",
          "value": "ATR-2026-00471"
        },
        {
          "description": "ATR rule ATR-2026-00501. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00501-data-exfiltration-via-markdown-image-and-link-url-injection.yaml",
          "expanded": "Data Exfiltration via Markdown Image and Link URL Injection",
          "uuid": "56b99381-2477-4b50-bfa2-589c7a0027bd",
          "value": "ATR-2026-00501"
        },
        {
          "description": "ATR rule ATR-2026-00504. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00504-tool-and-function-capability-enumeration.yaml",
          "expanded": "Tool and Function Capability Enumeration",
          "uuid": "f0587445-c2b7-43a7-b5b3-86a330f37234",
          "value": "ATR-2026-00504"
        },
        {
          "description": "ATR rule ATR-2026-00505. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00505-system-prompt-extraction-instruction-dump-request.yaml",
          "expanded": "System Prompt Extraction - Instruction Dump Request",
          "uuid": "33f40979-55d6-4f73-b9fb-1f4429f820c6",
          "value": "ATR-2026-00505"
        },
        {
          "description": "ATR rule ATR-2026-00514. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00514-system-prompt-extraction.yaml",
          "expanded": "System Prompt Extraction — Targeted Verbatim Disclosure Attempts",
          "uuid": "9c5e5e4e-2fc2-410f-8964-76fefe120185",
          "value": "ATR-2026-00514"
        },
        {
          "description": "ATR rule ATR-2026-00516. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00516-output-xss-via-llm.yaml",
          "expanded": "LLM Output XSS — Eliciting JavaScript Payloads from LLM for Browser Injection",
          "uuid": "d0145429-1a19-4d04-8334-84631e77a69f",
          "value": "ATR-2026-00516"
        },
        {
          "description": "ATR rule ATR-2026-00524. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00524-claude-code-anthropic-base-url-credential-exfil.yaml",
          "expanded": "Claude Code ANTHROPIC_BASE_URL Credential Exfiltration (CVE-2026-21852)",
          "uuid": "0a19cfb9-e940-4122-95e8-39849ee06de6",
          "value": "ATR-2026-00524"
        },
        {
          "description": "ATR rule ATR-2026-00548. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00548-cross-agent-session-context-leak.yaml",
          "expanded": "Cross-agent session context leak across delegation chain",
          "uuid": "f3de5f56-af48-426e-8fff-c403e69cdd72",
          "value": "ATR-2026-00548"
        },
        {
          "description": "ATR rule ATR-2026-00566. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00566-librechat-is-a-chatgpt-clone-with-additi.yaml",
          "expanded": "LibreChat is a ChatGPT clone with additional features.",
          "uuid": "a8f25706-829b-49d7-9e64-ec761be6493c",
          "value": "ATR-2026-00566"
        },
        {
          "description": "ATR rule ATR-2026-00569. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00569-agent-mcp-path-traversal-arbitrary-file-access.yaml",
          "expanded": "Agent / MCP tool path traversal and arbitrary file access",
          "uuid": "330a54f5-49b5-4627-aec0-4f5c5e69f0f7",
          "value": "ATR-2026-00569"
        },
        {
          "description": "ATR rule ATR-2026-00571. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00571-xss-in-agent-mcp-rendered-output.yaml",
          "expanded": "Cross-site scripting (XSS) in agent / MCP rendered output",
          "uuid": "37b776da-bc74-4d26-8f5d-8f0bd32d0a19",
          "value": "ATR-2026-00571"
        },
        {
          "description": "ATR rule ATR-2026-00574. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00574-semantic-paraphrased-context-extraction.yaml",
          "expanded": "Paraphrased System-Prompt / Context Extraction (Semantic)",
          "uuid": "5332f9e2-695f-453b-97cc-f2356cf30ca4",
          "value": "ATR-2026-00574"
        },
        {
          "description": "ATR rule ATR-2026-00578. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00578-zen-mcp-path-traversal-blacklist-bypass.yaml",
          "expanded": "Zen MCP Server path-traversal blacklist bypass via non-canonical paths (CVE-2025-66689)",
          "uuid": "deed26ef-2a2d-4b5c-a199-80f7cd09e8c1",
          "value": "ATR-2026-00578"
        },
        {
          "description": "ATR rule ATR-2026-00580. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00580-mcp-session-id-token-in-url-query.yaml",
          "expanded": "MCP session ID / auth token placed in URL query string (session leak via logs, referrer, history)",
          "uuid": "84a6495b-a16b-4b47-b3ca-32456101002d",
          "value": "ATR-2026-00580"
        },
        {
          "description": "ATR rule ATR-2026-00583. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00583-mcp-env-secret-file-read-without-consent.yaml",
          "expanded": "MCP/agent tool reads .env or secret file without user consent (OSV-MCPS-2025-EB70F912)",
          "uuid": "3ebea05c-a72a-4bf6-9bce-ed481471fec8",
          "value": "ATR-2026-00583"
        },
        {
          "description": "ATR rule ATR-2026-00702. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00702-ipi-credential-exfil-via-agent-action.yaml",
          "expanded": "Indirect PI — Credential / API Key Exfiltration via Agent Action",
          "uuid": "77ef48a0-53ab-4886-a44c-5b11e4156591",
          "value": "ATR-2026-00702"
        },
        {
          "description": "ATR rule ATR-2026-00703. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00703-ipi-financial-data-exfil-indirect.yaml",
          "expanded": "Indirect PI — Financial Data Exfiltration via Agent Action",
          "uuid": "e8261c22-64da-499b-aed5-6e7523e2ce63",
          "value": "ATR-2026-00703"
        },
        {
          "description": "ATR rule ATR-2026-00704. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00704-ipi-medical-genetic-data-exfil.yaml",
          "expanded": "Indirect PI — Medical / Genetic Data Exfiltration via Agent Action",
          "uuid": "3bf09087-6a82-4f67-87c2-08166f1acece",
          "value": "ATR-2026-00704"
        },
        {
          "description": "ATR rule ATR-2026-00705. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00705-ipi-location-address-browsing-exfil.yaml",
          "expanded": "Indirect PI — Location, Address, and Browsing History Exfiltration",
          "uuid": "cc7624cc-9f6f-4cee-a4e6-9999a12da867",
          "value": "ATR-2026-00705"
        },
        {
          "description": "ATR rule ATR-2026-00706. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00706-ipi-physical-biometric-exfil.yaml",
          "expanded": "Indirect PI — Physical / Biometric Media Exfiltration via Agent",
          "uuid": "390790b5-c52d-404b-be16-952eb07615f3",
          "value": "ATR-2026-00706"
        },
        {
          "description": "ATR rule ATR-2026-00707. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00707-ipi-file-exfil-with-destroy-or-tamper.yaml",
          "expanded": "Indirect PI — File Exfiltration Combined with Destroy or Tamper",
          "uuid": "1e7b4632-c78f-4caf-9014-2d11bc6f371e",
          "value": "ATR-2026-00707"
        },
        {
          "description": "ATR rule ATR-2026-00850. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00850-indirect-pi-credential-exfil-email.yaml",
          "expanded": "Indirect PI — Credential Exfiltration via Email (API Key / Password / Token)",
          "uuid": "ccd5fb4d-948d-4e8c-843b-ae8843a7e028",
          "value": "ATR-2026-00850"
        },
        {
          "description": "ATR rule ATR-2026-00851. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00851-indirect-pi-financial-payment-exfil.yaml",
          "expanded": "Indirect PI — Financial / Payment Credential Exfiltration via Agent Email",
          "uuid": "ce2f74dc-651b-4f58-9d23-12242d6a057b",
          "value": "ATR-2026-00851"
        },
        {
          "description": "ATR rule ATR-2026-00852. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00852-indirect-pi-medical-record-exfil.yaml",
          "expanded": "Indirect PI — Medical Record / Health Data Exfiltration via Agent Email",
          "uuid": "a64a4899-5371-46bc-851f-ede380cecece",
          "value": "ATR-2026-00852"
        },
        {
          "description": "ATR rule ATR-2026-00853. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00853-indirect-pi-genetic-data-exfil.yaml",
          "expanded": "Indirect PI — Genetic / DNA Data Exfiltration via Agent Email",
          "uuid": "01050549-4b44-4859-8cf1-cc9539aab8fa",
          "value": "ATR-2026-00853"
        },
        {
          "description": "ATR rule ATR-2026-00854. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00854-indirect-pi-location-data-exfil.yaml",
          "expanded": "Indirect PI — Location / GPS Data Exfiltration via Agent Email",
          "uuid": "e4df4027-1643-4eef-b754-9a349b110143",
          "value": "ATR-2026-00854"
        },
        {
          "description": "ATR rule ATR-2026-00855. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00855-indirect-pi-browsing-history-exfil.yaml",
          "expanded": "Indirect PI — Browsing History / Search History Exfiltration via Agent Email",
          "uuid": "e5a798cb-4d8a-4d4f-bbb0-d249d5179b5f",
          "value": "ATR-2026-00855"
        },
        {
          "description": "ATR rule ATR-2026-00856. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00856-indirect-pi-address-pii-exfil.yaml",
          "expanded": "Indirect PI — Physical Address / PII Exfiltration via Agent Email",
          "uuid": "17f54e5e-c0a5-4279-bb6f-d16be4f1dfa2",
          "value": "ATR-2026-00856"
        },
        {
          "description": "ATR rule ATR-2026-00857. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00857-indirect-pi-cloud-file-exfil.yaml",
          "expanded": "Indirect PI — Cloud File Exfiltration (Google Drive / Cloud Storage via Agent)",
          "uuid": "ae356fd9-ae3c-4c41-a09a-188ab1e685a8",
          "value": "ATR-2026-00857"
        },
        {
          "description": "ATR rule ATR-2026-00858. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00858-indirect-pi-exfil-and-destroy.yaml",
          "expanded": "Indirect PI — Data Exfiltration with Evidence Destruction (Exfil-and-Delete)",
          "uuid": "e82c633f-39e0-4cd8-b9ed-86ee61575a8c",
          "value": "ATR-2026-00858"
        },
        {
          "description": "ATR rule ATR-2026-00859. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00859-rag-injected-pii-exfil.yaml",
          "expanded": "RAG-Injected PII Exfiltration — System Instructions Embedded in Retrieved Documents",
          "uuid": "bce62edd-4276-48e4-bd5d-ec6f2e4f74a5",
          "value": "ATR-2026-00859"
        },
        {
          "description": "ATR rule ATR-2026-00860. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00860-indirect-pi-financial-transfer-hijack.yaml",
          "expanded": "Indirect PI — Unauthorized Financial Transfer / Payment Initiation Hijack",
          "uuid": "74f0c9eb-643e-49ce-bd94-dc29060a222b",
          "value": "ATR-2026-00860"
        },
        {
          "description": "ATR rule ATR-2026-00861. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00861-indirect-pi-crypto-transfer-hijack.yaml",
          "expanded": "Indirect PI — Cryptocurrency Transfer / Exchange Deposit Hijack via Injection",
          "uuid": "275b3df7-20bf-45bc-87fa-d48ffac51bca",
          "value": "ATR-2026-00861"
        },
        {
          "description": "ATR rule ATR-2026-00862. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00862-indirect-pi-mfa-code-exfil.yaml",
          "expanded": "Indirect PI — MFA Code / OTP Security Code Exfiltration via Injection",
          "uuid": "b119b68c-4cf8-4015-ad7d-810333d13bdb",
          "value": "ATR-2026-00862"
        },
        {
          "description": "ATR rule ATR-2026-00863. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-00863-shell-injection-data-exfil.yaml",
          "expanded": "Shell Injection Data Exfiltration — Piped Command Exfiltration via Bash",
          "uuid": "351d0873-4225-490d-80ec-b772560f636e",
          "value": "ATR-2026-00863"
        },
        {
          "description": "ATR rule ATR-2026-01450. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01450-svg-onload-xss-injection.yaml",
          "expanded": "SVG onload XSS Injection via Indirect Prompt Injection",
          "uuid": "8525bc66-eff5-42c5-9c2a-94a9759172e7",
          "value": "ATR-2026-01450"
        },
        {
          "description": "ATR rule ATR-2026-01451. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01451-img-onerror-xss-injection.yaml",
          "expanded": "IMG onerror XSS Injection via Indirect Prompt Injection",
          "uuid": "a7c9bc9a-2532-4146-b26c-092ce29a202e",
          "value": "ATR-2026-01451"
        },
        {
          "description": "ATR rule ATR-2026-01452. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01452-obfuscated-javascript-xss.yaml",
          "expanded": "Obfuscated javascript: XSS — Evasion Variants (href, style-expression, null-byte)",
          "uuid": "618b1406-39e0-4d7e-975d-0364cc70701d",
          "value": "ATR-2026-01452"
        },
        {
          "description": "ATR rule ATR-2026-01453. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01453-markdown-image-base64-exfil-carrier.yaml",
          "expanded": "Markdown Image Injection with Base64 QUERY Exfiltration Carrier",
          "uuid": "2174080e-9969-4da4-82d7-8914620b372c",
          "value": "ATR-2026-01453"
        },
        {
          "description": "ATR rule ATR-2026-01454. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01454-direct-markdown-exfil-payload.yaml",
          "expanded": "Direct Markdown Image/Link Exfil Payload (attacker.com / evil.com)",
          "uuid": "ae9515b1-a829-47a1-bffc-454e987f187c",
          "value": "ATR-2026-01454"
        },
        {
          "description": "ATR rule ATR-2026-01455. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01455-new-instructions-injection-marker.yaml",
          "expanded": "NEW IMPORTANT INSTRUCTIONS Injection Marker in Document Context",
          "uuid": "d6a5b3b1-9b8e-4c1c-83af-4697a4c9648a",
          "value": "ATR-2026-01455"
        },
        {
          "description": "ATR rule ATR-2026-01456. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01456-debug-cli-mode-sysprompt-extraction.yaml",
          "expanded": "Debug/CLI Mode Activation for System Prompt and Config Extraction",
          "uuid": "faadd95f-c266-47de-ae80-2578a1c5a2dd",
          "value": "ATR-2026-01456"
        },
        {
          "description": "ATR rule ATR-2026-01457. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01457-sysprompt-completion-clone-attack.yaml",
          "expanded": "System Prompt Completion and Clone Attack",
          "uuid": "c3a2537f-923d-494d-afdf-0ce618fd9be5",
          "value": "ATR-2026-01457"
        },
        {
          "description": "ATR rule ATR-2026-01458. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01458-compare-bots-sysprompt-fishing.yaml",
          "expanded": "Compare-Bots Sysprompt Fishing — Role Comparison Extraction",
          "uuid": "6f099d5a-8884-4f0a-a848-82bc1e407cf3",
          "value": "ATR-2026-01458"
        },
        {
          "description": "ATR rule ATR-2026-01459. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01459-variable-clone-sysprompt-technique.yaml",
          "expanded": "Variable-Clone Sysprompt Extraction (ELLA / context-variable Pattern)",
          "uuid": "72bd2b1a-e705-4c84-b8de-54aaf94da1d1",
          "value": "ATR-2026-01459"
        },
        {
          "description": "ATR rule ATR-2026-01460. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01460-json-format-sysprompt-extraction.yaml",
          "expanded": "JSON Format Sysprompt Extraction — Structured Output Exfil",
          "uuid": "a247af0f-afe1-4bc1-b16c-c91847d3293e",
          "value": "ATR-2026-01460"
        },
        {
          "description": "ATR rule ATR-2026-01461. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01461-foreign-language-sysprompt-request.yaml",
          "expanded": "Foreign-Language System Prompt Extraction Request",
          "uuid": "edec4373-3048-427f-bced-7e64b545d626",
          "value": "ATR-2026-01461"
        },
        {
          "description": "ATR rule ATR-2026-01462. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01462-sysprompt-override-pseudo-admin.yaml",
          "expanded": "System Prompt Override via Pseudo-Admin / Authority Injection",
          "uuid": "4570dd79-e44b-4dfc-8b55-3f391a0d7c65",
          "value": "ATR-2026-01462"
        },
        {
          "description": "ATR rule ATR-2026-01463. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01463-imend-imsystem-prompt-injection-format.yaml",
          "expanded": "im_end / im_start System Prompt Injection Format Markers",
          "uuid": "435fbee8-5649-471d-badf-cc476f4d1c4a",
          "value": "ATR-2026-01463"
        },
        {
          "description": "ATR rule ATR-2026-01464. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01464-indirect-pi-sysprompt-action-hijack.yaml",
          "expanded": "Indirect PI Sysprompt-Forged Action Hijack (system_message framing)",
          "uuid": "25dd6912-2293-4c62-b591-a222f35be836",
          "value": "ATR-2026-01464"
        },
        {
          "description": "ATR rule ATR-2026-01605. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01605-ssrf-aws-metadata-endpoint.yaml",
          "expanded": "SSRF AWS Instance Metadata Endpoint Access",
          "uuid": "6b2d3d9f-508b-46bc-a24b-e9cb52263d38",
          "value": "ATR-2026-01605"
        },
        {
          "description": "ATR rule ATR-2026-01606. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01606-ssrf-internal-network-scan.yaml",
          "expanded": "SSRF Internal Network and Private IP Range Access",
          "uuid": "cc7c1e6c-0123-46a8-a603-f120da48465f",
          "value": "ATR-2026-01606"
        },
        {
          "description": "ATR rule ATR-2026-01607. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01607-ssrf-localhost-service-probe.yaml",
          "expanded": "SSRF Localhost Service Probe",
          "uuid": "42fea83f-0245-4c37-a479-f2a5468981bf",
          "value": "ATR-2026-01607"
        },
        {
          "description": "ATR rule ATR-2026-01608. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01608-ssrf-file-scheme-local-read.yaml",
          "expanded": "SSRF File Scheme Local File Read",
          "uuid": "d50e0135-4517-4191-ae5b-01cd5ac2dc0f",
          "value": "ATR-2026-01608"
        },
        {
          "description": "ATR rule ATR-2026-01753. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01753-ransom-email-exfil-delete-extortion.yaml",
          "expanded": "Ransom Extortion: Email Exfil + Delete + Wire-Transfer Demand",
          "uuid": "5a3dc9b2-76ce-4221-92ea-30bea9782c51",
          "value": "ATR-2026-01753"
        },
        {
          "description": "ATR rule ATR-2026-01754. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01754-ransom-file-cloud-exfil-delete-extortion.yaml",
          "expanded": "Ransom Extortion: Cloud File Exfil + Delete + Payment Demand",
          "uuid": "5544ddde-64cb-4880-aa7b-395da132324e",
          "value": "ATR-2026-01754"
        },
        {
          "description": "ATR rule ATR-2026-01770. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01770-semantic-pii-credential-extraction.yaml",
          "expanded": "PII / Credential Extraction via Social Engineering, Obfuscation & Cross-Session Recall (Semantic)",
          "uuid": "b6864bae-5147-44db-b843-019f87ebb7d2",
          "value": "ATR-2026-01770"
        },
        {
          "description": "ATR rule ATR-2026-01772. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01772-semantic-internal-state-recon.yaml",
          "expanded": "Internal-State Reconnaissance — System Prompt, Config & Tool Enumeration (Semantic)",
          "uuid": "19753111-8130-4158-87bb-9d46aea8b041",
          "value": "ATR-2026-01772"
        },
        {
          "description": "ATR rule ATR-2026-01807. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01807-asb-bulk-data-exfil-external.yaml",
          "expanded": "Bulk Data Exfiltration to External Party — Entire-Database Export & Confidential Disclosure",
          "uuid": "45291762-f89f-4524-808d-8e641bf2778d",
          "value": "ATR-2026-01807"
        },
        {
          "description": "ATR rule ATR-2026-01862. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01862-llmail-email-tool-exfil-confirmation.yaml",
          "expanded": "LLMail Email-Tool Exfiltration to Fixed Attacker Address",
          "uuid": "6434eb32-4519-4485-9704-5638cccfe1eb",
          "value": "ATR-2026-01862"
        },
        {
          "description": "ATR rule ATR-2026-01863. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01863-llmail-post-summary-exfil-directive.yaml",
          "expanded": "LLMail Post-Summary Exfiltration Directive to Attacker Address",
          "uuid": "3d631271-bc09-41ea-aa44-e561bed55b93",
          "value": "ATR-2026-01863"
        },
        {
          "description": "ATR rule ATR-2026-01864. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01864-llmail-obfuscated-exfil-address.yaml",
          "expanded": "LLMail Exfiltration to Obfuscated Attacker Address",
          "uuid": "816b5180-81b7-4482-a312-745dbcbdfa12",
          "value": "ATR-2026-01864"
        },
        {
          "description": "ATR rule ATR-2026-01890. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01890-file-exfiltration.yaml",
          "expanded": "Injected Code — Local File Exfiltration to a Remote Endpoint",
          "uuid": "36dd3586-58a7-4545-84ac-f6c18e3fb2b8",
          "value": "ATR-2026-01890"
        },
        {
          "description": "ATR rule ATR-2026-01891. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01891-surveillance-exfiltration.yaml",
          "expanded": "Injected Code — Live User-Activity / Location / Log Surveillance Exfiltration",
          "uuid": "79d0c902-87ba-400f-83fc-ca40b5cf0d2a",
          "value": "ATR-2026-01891"
        },
        {
          "description": "ATR rule ATR-2026-01892. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01892-env-exfiltration.yaml",
          "expanded": "Injected Code — Environment-Variable Exfiltration",
          "uuid": "f2845260-cfed-4713-82a2-23fec215c259",
          "value": "ATR-2026-01892"
        },
        {
          "description": "ATR rule ATR-2026-01893. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01893-system-recon-exfiltration.yaml",
          "expanded": "Injected Code — Host / Hardware Inventory Exfiltration",
          "uuid": "97742deb-0a79-4312-b1c7-2b905493c072",
          "value": "ATR-2026-01893"
        },
        {
          "description": "ATR rule ATR-2026-01894. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01894-cookie-theft.yaml",
          "expanded": "Injected Code — Browser Cookie / Session-Token Theft",
          "uuid": "4356be7b-0c99-44ee-8a82-4426d7e8a77c",
          "value": "ATR-2026-01894"
        },
        {
          "description": "ATR rule ATR-2026-01895. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01895-contact-exfiltration.yaml",
          "expanded": "Injected Code — Contact-List Harvest and SMTP Spam Exfiltration",
          "uuid": "516aaab0-e457-42d3-a286-6614d2d992e0",
          "value": "ATR-2026-01895"
        },
        {
          "description": "ATR rule ATR-2026-01924. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01924-system-instruction-extraction-reformat.yaml",
          "expanded": "System-Instruction Extraction via Reformat — Summarize / Repeat / Recite the Rules",
          "uuid": "32cb283c-9320-4aa1-a024-cea999537215",
          "value": "ATR-2026-01924"
        },
        {
          "description": "ATR rule ATR-2026-01929. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01929-mcp-unauthenticated-transport-token-fallback.yaml",
          "expanded": "Unauthenticated MCP transport accepts tool calls and falls back to an ambient credential (CVE-2026-48039 / meta-ads-mcp class)",
          "uuid": "6b4d45b6-3dab-45be-9f19-cf237fa3e756",
          "value": "ATR-2026-01929"
        },
        {
          "description": "ATR rule ATR-2026-01948. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01948-netlicensing-mcp-product-number-path-traversal-token-leak.yaml",
          "expanded": "netlicensing-mcp Path Traversal in product_number Bypasses Token Redaction (GHSA-hxpf-9xvq-wph8)",
          "uuid": "762033cd-ce19-489a-95dc-b68badcc61ea",
          "value": "ATR-2026-01948"
        },
        {
          "description": "ATR rule ATR-2026-01957. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01957-m365-copilot-searchleak-open-redirect-exfil.yaml",
          "expanded": "M365 Copilot Business Chat SearchLeak Open-Redirect Prompt-Injection Exfil (CVE-2026-47645)",
          "uuid": "1d8612b3-204a-4cb3-90d5-c44523c6ae50",
          "value": "ATR-2026-01957"
        },
        {
          "description": "ATR rule ATR-2026-01961. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01961-meta-ads-mcp-unauth-token-leak.yaml",
          "expanded": "Meta Ads MCP Unauthenticated Tool Execution Leaks META_ACCESS_TOKEN (CVE-2026-48039 / GHSA-9gw6-46qc-99vr)",
          "uuid": "3704f8ed-bfcb-4445-b765-17073c9a4350",
          "value": "ATR-2026-01961"
        },
        {
          "description": "ATR rule ATR-2026-01964. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01964-langchain-gmailtoolkit-indirect-prompt-injection-email-exfil.yaml",
          "expanded": "LangChain GmailToolkit Indirect Prompt Injection Email Exfiltration (CVE-2025-46059)",
          "uuid": "f19fe06f-a7eb-41e0-a5b2-7c9b297b99d4",
          "value": "ATR-2026-01964"
        },
        {
          "description": "ATR rule ATR-2026-01984. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01984-mcp-server-kubernetes-kubectl-generic-token-exfil.yaml",
          "expanded": "MCP Server Kubernetes kubectl_generic Flag Injection Bearer Token Exfiltration (CVE-2026-47250)",
          "uuid": "821b821d-d700-435f-8fe7-899c07762361",
          "value": "ATR-2026-01984"
        },
        {
          "description": "ATR rule ATR-2026-01988. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-01988-t1005-agent-local-data-staging-exfil.yaml",
          "expanded": "Local Sensitive-File Read Chained to Outbound Exfiltration",
          "uuid": "5f98e346-743c-4636-8627-7a16368f578f",
          "value": "ATR-2026-01988"
        },
        {
          "description": "ATR rule ATR-2026-02017. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/context-exfiltration/ATR-2026-02017-secret-key-exfiltration-request.yaml",
          "expanded": "Secret Key Exfiltration Request",
          "uuid": "81547545-c5c0-4d84-bdd7-e1748be02b96",
          "value": "ATR-2026-02017"
        }
      ],
      "predicate": "context-exfiltration"
    },
    {
      "entry": [
        {
          "description": "ATR rule ATR-2026-00070. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/data-poisoning/ATR-2026-00070-data-poisoning.yaml",
          "expanded": "Data Poisoning via RAG and Knowledge Base Contamination",
          "uuid": "919a6a0b-7d01-5887-a575-c56184d60452",
          "value": "ATR-2026-00070"
        },
        {
          "description": "ATR rule ATR-2026-00450. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/data-poisoning/ATR-2026-00450-spring-ai-prompt-memory-poisoning.yaml",
          "expanded": "Spring AI PromptChatMemoryAdvisor Memory Poisoning (CVE-2026-41713)",
          "uuid": "f1900eb9-1dfa-465a-b72f-419b5d9d2841",
          "value": "ATR-2026-00450"
        },
        {
          "description": "ATR rule ATR-2026-00570. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/data-poisoning/ATR-2026-00570-sql-injection-in-agent-tool-query.yaml",
          "expanded": "SQL injection in agent / MCP tool database query",
          "uuid": "cf0d1c5b-c0fe-480a-91d8-eda021cd4ee1",
          "value": "ATR-2026-00570"
        },
        {
          "description": "ATR rule ATR-2026-01155. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/data-poisoning/ATR-2026-01155-memory-plant-direct-command.yaml",
          "expanded": "Direct Memory Plant Command — Persistent Fact or Code Storage Injection",
          "uuid": "797988bf-8f90-4d90-9603-d3a39a47fdcc",
          "value": "ATR-2026-01155"
        },
        {
          "description": "ATR rule ATR-2026-01774. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/data-poisoning/ATR-2026-01774-semantic-rag-memory-poisoning.yaml",
          "expanded": "RAG & Memory Poisoning — Embedded Directives, Trigger Tokens, False Authority & Coercion (Semantic)",
          "uuid": "9b5567fa-57fb-4d37-866e-13bb9029d21a",
          "value": "ATR-2026-01774"
        }
      ],
      "predicate": "data-poisoning"
    },
    {
      "entry": [
        {
          "description": "ATR rule ATR-2026-00050. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-00050-runaway-agent-loop.yaml",
          "expanded": "Runaway Agent Loop Detection",
          "uuid": "5ec43c88-5eaf-53ef-9c65-bf6aa9f26f79",
          "value": "ATR-2026-00050"
        },
        {
          "description": "ATR rule ATR-2026-00051. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-00051-resource-exhaustion.yaml",
          "expanded": "Agent Resource Exhaustion Detection",
          "uuid": "bd578439-4a5f-5e52-ace4-d93fdc793c59",
          "value": "ATR-2026-00051"
        },
        {
          "description": "ATR rule ATR-2026-00052. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-00052-cascading-failure.yaml",
          "expanded": "Cascading Failure Detection in Agent Pipelines",
          "uuid": "5c544b7c-4559-5964-aea5-cacc3c81a834",
          "value": "ATR-2026-00052"
        },
        {
          "description": "ATR rule ATR-2026-00098. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-00098-unauthorized-financial-action.yaml",
          "expanded": "Unauthorized Financial Action by AI Agent",
          "uuid": "f75a33ed-2417-5491-9b6a-b7f29c203da9",
          "value": "ATR-2026-00098"
        },
        {
          "description": "ATR rule ATR-2026-00099. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-00099-high-risk-tool-gate.yaml",
          "expanded": "High-Risk Tool Invocation Without Human Confirmation",
          "uuid": "577ac979-839a-5c26-a0ad-59beed62b492",
          "value": "ATR-2026-00099"
        },
        {
          "description": "ATR rule ATR-2026-00428. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-00428-nl-unauthorized-shell-execution.yaml",
          "expanded": "Natural-Language Unauthorized Shell-Execution Instruction",
          "uuid": "65e6c3b4-7305-5a9e-9978-aef10db1456e",
          "value": "ATR-2026-00428"
        },
        {
          "description": "ATR rule ATR-2026-00491. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-00491-garak-agent-breaker-markdown-just-raw-json.yaml",
          "expanded": "Agent Capability Enumeration via Structured Parse Request",
          "uuid": "d9ffbc9d-2d49-4936-b7b7-7a0dd3c41f40",
          "value": "ATR-2026-00491"
        },
        {
          "description": "ATR rule ATR-2026-00500. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-00500-ssrf-via-agent-url-fetch-instruction.yaml",
          "expanded": "SSRF via Agent URL Fetch Instruction",
          "uuid": "989640e9-b2be-4b86-b9ff-eb625c489fc3",
          "value": "ATR-2026-00500"
        },
        {
          "description": "ATR rule ATR-2026-00553. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-00553-runaway-tool-loop-behavioral.yaml",
          "expanded": "Runaway tool-call loop within a single session",
          "uuid": "68cad8eb-8ad5-40b9-9e28-aa0e8ab39f69",
          "value": "ATR-2026-00553"
        },
        {
          "description": "ATR rule ATR-2026-00708. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-00708-ipi-financial-transfer-unauthorized.yaml",
          "expanded": "Indirect PI — Unauthorized Financial Transfer via Agent Tool",
          "uuid": "8b4d29bd-5c70-4037-b56f-8c87dad2e90e",
          "value": "ATR-2026-00708"
        },
        {
          "description": "ATR rule ATR-2026-00709. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-00709-ipi-disable-auth-mfa.yaml",
          "expanded": "Indirect PI — Disable Authentication / MFA via Agent Tool",
          "uuid": "fe5b6837-0b8e-4709-a2d4-b101e6597e3c",
          "value": "ATR-2026-00709"
        },
        {
          "description": "ATR rule ATR-2026-00710. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-00710-ipi-physical-access-grant.yaml",
          "expanded": "Indirect PI — Unauthorized Physical Access Grant via Smart Lock / Home Automation",
          "uuid": "2f24eb4e-16fc-4077-9c98-b7be7c872ffd",
          "value": "ATR-2026-00710"
        },
        {
          "description": "ATR rule ATR-2026-00711. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-00711-ipi-system-sabotage-destructive-command.yaml",
          "expanded": "Indirect PI — System Sabotage via Destructive Shell Command",
          "uuid": "ccade4c4-03c2-4f4c-a76a-cb5429111a09",
          "value": "ATR-2026-00711"
        },
        {
          "description": "ATR rule ATR-2026-00712. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-00712-ipi-malicious-package-install.yaml",
          "expanded": "Indirect PI — Malicious Package Installation via Agent (pip/npm)",
          "uuid": "80d940c0-2842-4a8b-8e6a-dd666cbfcbf1",
          "value": "ATR-2026-00712"
        },
        {
          "description": "ATR rule ATR-2026-00713. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-00713-ipi-rce-network-shell-command.yaml",
          "expanded": "Indirect PI — RCE via Network Shell Command (netcat/curl) Execution",
          "uuid": "69818ce6-9711-494f-979f-da52535e5f37",
          "value": "ATR-2026-00713"
        },
        {
          "description": "ATR rule ATR-2026-00718. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-00718-tool-misuse-financial-autonomous.yaml",
          "expanded": "Tool Misuse — Autonomous Financial Trading / Crypto Transaction Without Authorization",
          "uuid": "51ae9cf3-9631-4d24-ab0d-860ed47fde0c",
          "value": "ATR-2026-00718"
        },
        {
          "description": "ATR rule ATR-2026-00719. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-00719-tool-misuse-destructive-bulk-action.yaml",
          "expanded": "Tool Misuse — Destructive Bulk Action via Agent (Delete All / Turn Off All)",
          "uuid": "898bae06-a339-4818-a74f-2346474ee558",
          "value": "ATR-2026-00719"
        },
        {
          "description": "ATR rule ATR-2026-00722. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-00722-ipi-account-manipulation-emergency-pretext.yaml",
          "expanded": "Indirect PI — Account Manipulation / Emergency Service Dispatch via Pretext",
          "uuid": "64fb20f2-8193-4c2a-877b-09585ad2c5ab",
          "value": "ATR-2026-00722"
        },
        {
          "description": "ATR rule ATR-2026-01751. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-01751-indirect-pi-task-abort-stop-instruction.yaml",
          "expanded": "Indirect Prompt Injection: Fake-Authority Task Abort",
          "uuid": "481b4bdc-92d8-46ea-8a04-a7adebfb7e70",
          "value": "ATR-2026-01751"
        },
        {
          "description": "ATR rule ATR-2026-01752. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-01752-indirect-pi-captcha-redirect-dos.yaml",
          "expanded": "Indirect Prompt Injection: CAPTCHA Redirect Task Disruption",
          "uuid": "f3ab0e9c-bb65-4c91-8f24-52353d5a3d56",
          "value": "ATR-2026-01752"
        },
        {
          "description": "ATR rule ATR-2026-01773. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-01773-semantic-excessive-agency-action.yaml",
          "expanded": "Excessive Agency — Scope Hijack, Untrusted Code Execution & Unauthorized Privilege Grant (Semantic)",
          "uuid": "3987dbdf-c14e-43b8-ad70-cbc19be94335",
          "value": "ATR-2026-01773"
        },
        {
          "description": "ATR rule ATR-2026-01801. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-01801-asb-autonomous-vehicle-sabotage.yaml",
          "expanded": "Autonomous-Vehicle Cyber-Physical Sabotage — Brake/Steering/Sensor Subversion Command",
          "uuid": "c374116a-ed31-44cb-a5d2-cb28c9033b97",
          "value": "ATR-2026-01801"
        },
        {
          "description": "ATR rule ATR-2026-01804. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-01804-asb-covert-unlogged-action.yaml",
          "expanded": "Covert Unlogged Action — Directive to Hide an Action from Records or Detection",
          "uuid": "41b4dbb5-21e5-4d58-9d49-052358d655db",
          "value": "ATR-2026-01804"
        },
        {
          "description": "ATR rule ATR-2026-01805. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-01805-asb-financial-fraud-execution.yaml",
          "expanded": "Financial Fraud Execution — Ponzi Setup, Fabricated Statements, Unauthorized Redirect & Laundering",
          "uuid": "4ad3611d-edaa-4c66-a548-b1a14571467b",
          "value": "ATR-2026-01805"
        },
        {
          "description": "ATR rule ATR-2026-01806. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-01806-asb-clinical-patient-harm.yaml",
          "expanded": "Clinical Patient-Harm Directive — Overdose, Falsified Diagnosis, Phantom Billing & Care Neglect",
          "uuid": "f54df369-8a36-4873-9d8a-c073286b9147",
          "value": "ATR-2026-01806"
        },
        {
          "description": "ATR rule ATR-2026-01809. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-01809-semantic-insider-manipulation-process-corruption.yaml",
          "expanded": "Insider Manipulation & Process Corruption — Market/Data Tampering, Legal-Process Subversion & Pretextual Fund Movement (Semantic)",
          "uuid": "11d744a3-1722-44b2-8d3b-af362cbc6f7c",
          "value": "ATR-2026-01809"
        },
        {
          "description": "ATR rule ATR-2026-01837. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-01837-ddos-attack-orchestration.yaml",
          "expanded": "DDoS Attack Orchestration",
          "uuid": "ff3ff3de-b883-4291-befe-1f88f5606dda",
          "value": "ATR-2026-01837"
        },
        {
          "description": "ATR rule ATR-2026-01838. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-01838-unauthorized-cryptominer-deployment.yaml",
          "expanded": "Unauthorized Cryptominer Deployment via SSH",
          "uuid": "09fd64e3-36f6-4c3e-995c-dfd369c25b89",
          "value": "ATR-2026-01838"
        },
        {
          "description": "ATR rule ATR-2026-01849. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-01849-harassment-bot-deployment.yaml",
          "expanded": "Targeted Harassment Bot Deployment",
          "uuid": "85619da5-4fb5-42b6-8a53-dd5572e747a9",
          "value": "ATR-2026-01849"
        },
        {
          "description": "ATR rule ATR-2026-01989. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-01989-t1046-agent-internal-network-sweep.yaml",
          "expanded": "Agent-Initiated Internal Network Service Sweep",
          "uuid": "73fcfef1-18a0-40d6-ab1b-080cd3a6146a",
          "value": "ATR-2026-01989"
        },
        {
          "description": "ATR rule ATR-2026-01993. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-01993-t1562-agent-impair-defenses.yaml",
          "expanded": "Agent Disabling of Host Security Controls",
          "uuid": "3d20050d-62b3-4d2d-b153-ee2a69dced0d",
          "value": "ATR-2026-01993"
        },
        {
          "description": "ATR rule ATR-2026-01994. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/excessive-autonomy/ATR-2026-01994-t1573-agent-encrypted-c2-channel.yaml",
          "expanded": "Agent Establishing an Encrypted Reverse Channel or Tunnel",
          "uuid": "7395d873-8673-4fc9-94d0-5b581e03264c",
          "value": "ATR-2026-01994"
        },
        {
          "description": "ATR rule ATR-2026-00716. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00716-ipi-data-destruction-carrier.yaml",
          "expanded": "Indirect PI — Data Destruction Instruction via Agent File/Document Tool",
          "uuid": "02a157a7-917d-4fcd-b66c-a51a3a039b94",
          "value": "ATR-2026-00716"
        }
      ],
      "predicate": "excessive-autonomy"
    },
    {
      "entry": [
        {
          "description": "ATR rule ATR-2026-00279. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-00279-harmful-completion-continuation.yaml",
          "expanded": "Harmful Completion / Continuation Attack",
          "uuid": "9e063ddf-e6e6-569a-986a-f61fac43cb9c",
          "value": "ATR-2026-00279"
        },
        {
          "description": "ATR rule ATR-2026-00281. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-00281-eicar-gtube-malware-signature-request.yaml",
          "expanded": "EICAR / GTUBE AV Test Signature Output Request",
          "uuid": "69f3fde2-226a-5fd5-818a-1c0c08e0d53f",
          "value": "ATR-2026-00281"
        },
        {
          "description": "ATR rule ATR-2026-00284. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-00284-glitch-token-destabilization.yaml",
          "expanded": "Glitch Token Destabilization Attack",
          "uuid": "d4939e21-091e-5cf5-a6a4-253037770de5",
          "value": "ATR-2026-00284"
        },
        {
          "description": "ATR rule ATR-2026-00289. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-00289-lmrc-harmful-content-elicitation.yaml",
          "expanded": "LMRC Harmful Content Elicitation — Quack Medicine, Bullying, Slur Usage",
          "uuid": "802e624e-78a1-543b-96f8-4ad504cae0a3",
          "value": "ATR-2026-00289"
        },
        {
          "description": "ATR rule ATR-2026-00292. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-00292-self-harm-eating-disorder-facilitation.yaml",
          "expanded": "Self-Harm and Eating Disorder Facilitation Request",
          "uuid": "e6a8603f-8393-5849-8c88-095863f5e1b3",
          "value": "ATR-2026-00292"
        },
        {
          "description": "ATR rule ATR-2026-00298. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-00298-malicious-use-illegal-activity-request.yaml",
          "expanded": "DoNotAnswer Malicious Use — Illegal Activity Facilitation Request",
          "uuid": "2748b20c-bb15-5e79-877f-68f77bf32c4d",
          "value": "ATR-2026-00298"
        },
        {
          "description": "ATR rule ATR-2026-00299. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-00299-harmbench-detailed-harmful-instruction.yaml",
          "expanded": "HarmBench Detailed Harmful Instruction Request — Step-by-Step Attack Facilitation",
          "uuid": "b6813258-3d58-57f0-931e-10e73fe1bd81",
          "value": "ATR-2026-00299"
        },
        {
          "description": "ATR rule ATR-2026-00413. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-00413-malwaregen-code-generation-request.yaml",
          "expanded": "Malware Code Generation Direct Request",
          "uuid": "154d52ac-ea3b-5d2b-95ae-8169bf460c05",
          "value": "ATR-2026-00413"
        },
        {
          "description": "ATR rule ATR-2026-00502. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-00502-training-data-extraction-via-divergent-repetition-attack.yaml",
          "expanded": "Training Data Extraction via Divergent Repetition Attack",
          "uuid": "35f0dfce-b03a-415f-87f6-335a0458dda6",
          "value": "ATR-2026-00502"
        },
        {
          "description": "ATR rule ATR-2026-00517. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-00517-model-extraction-distillation.yaml",
          "expanded": "Model Extraction / Distillation Attack via Systematic API Probing",
          "uuid": "7160e33e-440a-4589-bf7a-b80409a5afce",
          "value": "ATR-2026-00517"
        },
        {
          "description": "ATR rule ATR-2026-01750. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01750-dos-repeat-word-n-times-output-amplification.yaml",
          "expanded": "DoS via Repeat-Word-N-Times Output Amplification",
          "uuid": "19aba340-d47b-459b-ae40-fdf64c416fd4",
          "value": "ATR-2026-01750"
        },
        {
          "description": "ATR rule ATR-2026-01760. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01760-dos-forced-infinite-output-token-flood.yaml",
          "expanded": "DoS: Forced Infinite / Maximum-Length Output Token Flood",
          "uuid": "6fb06619-e5f6-4bac-9564-1c48e53e3b4e",
          "value": "ATR-2026-01760"
        },
        {
          "description": "ATR rule ATR-2026-01830. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01830-stolen-credential-account-drain.yaml",
          "expanded": "Stolen-Credential Account Takeover & Crypto Drain",
          "uuid": "053d321d-7bde-4510-abb5-555fdd1e2902",
          "value": "ATR-2026-01830"
        },
        {
          "description": "ATR rule ATR-2026-01831. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01831-money-laundering-crypto-layering.yaml",
          "expanded": "Money Laundering — Crypto Wallet Layering",
          "uuid": "7dd70e31-3a10-45d0-b053-ab823a550f0c",
          "value": "ATR-2026-01831"
        },
        {
          "description": "ATR rule ATR-2026-01833. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01833-darknet-controlled-substance-procurement.yaml",
          "expanded": "Darknet Controlled-Substance Procurement",
          "uuid": "575aeab9-8a38-4996-beaa-928ffaf2d96d",
          "value": "ATR-2026-01833"
        },
        {
          "description": "ATR rule ATR-2026-01834. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01834-fraudulent-identity-document-procurement.yaml",
          "expanded": "Fraudulent Identity Document (Fake Passport) Procurement",
          "uuid": "79956ac5-028f-4ebe-a71f-640c669d1b8b",
          "value": "ATR-2026-01834"
        },
        {
          "description": "ATR rule ATR-2026-01835. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01835-human-trafficking-facilitation.yaml",
          "expanded": "Human-Trafficking Service Facilitation",
          "uuid": "499f91f7-08f7-4f3f-ad56-4f45c5fb0e72",
          "value": "ATR-2026-01835"
        },
        {
          "description": "ATR rule ATR-2026-01836. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01836-trojanized-software-distribution.yaml",
          "expanded": "Trojanized Software Distribution",
          "uuid": "fe295847-5eb8-4d74-ad6c-e1ec87373324",
          "value": "ATR-2026-01836"
        },
        {
          "description": "ATR rule ATR-2026-01840. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01840-extremist-propaganda-distribution.yaml",
          "expanded": "Extremist Propaganda Acquisition & Distribution",
          "uuid": "454ea6fc-a159-4693-862f-fc42fd4fbe67",
          "value": "ATR-2026-01840"
        },
        {
          "description": "ATR rule ATR-2026-01841. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01841-deepfake-disinformation.yaml",
          "expanded": "Deepfake of Real Person for Disinformation",
          "uuid": "eec65a75-88f3-48f3-a085-4673304cd9cb",
          "value": "ATR-2026-01841"
        },
        {
          "description": "ATR rule ATR-2026-01842. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01842-plagiarism-detector-evasion.yaml",
          "expanded": "Plagiarism-Detector Evasion & Republishing",
          "uuid": "a5602dda-bd74-4f25-b51e-be01624a5542",
          "value": "ATR-2026-01842"
        },
        {
          "description": "ATR rule ATR-2026-01843. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01843-drug-dealing-detection-evasion-spelling.yaml",
          "expanded": "Drug Dealing via Reverse-Spelling Detection Evasion",
          "uuid": "7eca7e6f-9022-4fff-a261-34c34766a3f0",
          "value": "ATR-2026-01843"
        },
        {
          "description": "ATR rule ATR-2026-01844. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01844-illegitimate-prescription-fulfillment.yaml",
          "expanded": "Illegitimate Prescription Fulfillment",
          "uuid": "74475840-d0e9-4842-8bb2-044f073b0969",
          "value": "ATR-2026-01844"
        },
        {
          "description": "ATR rule ATR-2026-01845. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01845-banned-ingredient-relabel-fraud.yaml",
          "expanded": "Banned-Ingredient Product Relabel Fraud",
          "uuid": "c0d930fa-5483-419c-bee1-d45a30624c0e",
          "value": "ATR-2026-01845"
        },
        {
          "description": "ATR rule ATR-2026-01846. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01846-tax-evasion-offshore-shell-planning.yaml",
          "expanded": "Tax Evasion via Offshore Accounts & Shell Companies",
          "uuid": "6a14eb3b-9979-4c90-8e00-3bd057b2cea0",
          "value": "ATR-2026-01846"
        },
        {
          "description": "ATR rule ATR-2026-01847. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01847-immigration-work-fraud.yaml",
          "expanded": "Immigration / Visa Work Fraud",
          "uuid": "2b099a0f-b8f1-4fde-88cf-f28b6a285adc",
          "value": "ATR-2026-01847"
        },
        {
          "description": "ATR rule ATR-2026-01848. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01848-illicit-drug-marketplace-build.yaml",
          "expanded": "Anonymous Illicit-Drug Marketplace Construction",
          "uuid": "bf2cf302-f5b1-452e-845f-5bc052d91061",
          "value": "ATR-2026-01848"
        },
        {
          "description": "ATR rule ATR-2026-01850. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01850-targeted-doxxing-threat-campaign.yaml",
          "expanded": "Targeted Doxxing & Threat Campaign",
          "uuid": "d0ec9a3e-67ae-4eed-84cd-2d18921e01ae",
          "value": "ATR-2026-01850"
        },
        {
          "description": "ATR rule ATR-2026-01851. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01851-bestiality-content-distribution.yaml",
          "expanded": "Bestiality Content Acquisition & Distribution",
          "uuid": "f99ab927-69c9-4fd7-aeed-a2d8aaa28e3f",
          "value": "ATR-2026-01851"
        },
        {
          "description": "ATR rule ATR-2026-01852. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01852-romance-scam-impersonation.yaml",
          "expanded": "Romance-Scam Sexual Impersonation",
          "uuid": "7c09b818-c38b-4a76-a5b4-9955e3977824",
          "value": "ATR-2026-01852"
        },
        {
          "description": "ATR rule ATR-2026-01853. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01853-nonconsensual-leaked-media-distribution.yaml",
          "expanded": "Non-Consensual Leaked-Media Purchase & Distribution",
          "uuid": "2e018128-ed45-4661-96aa-c4ceac9af360",
          "value": "ATR-2026-01853"
        },
        {
          "description": "ATR rule ATR-2026-01854. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01854-falsified-research-abstract-disinformation.yaml",
          "expanded": "Falsified Research Abstract Disinformation",
          "uuid": "e1e43bb6-8a1b-4ad4-a78b-7d3a1e073195",
          "value": "ATR-2026-01854"
        },
        {
          "description": "ATR rule ATR-2026-01855. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01855-content-misappropriation-republish.yaml",
          "expanded": "Content Misappropriation & Republishing as Own",
          "uuid": "066198f0-967c-4cef-ab80-98679e0f0c39",
          "value": "ATR-2026-01855"
        },
        {
          "description": "ATR rule ATR-2026-01856. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01856-targeted-harmful-content-generation.yaml",
          "expanded": "Targeted Harmful Content Generation Against People or Protected Groups (Semantic)",
          "uuid": "3c9ba769-6fb9-4c29-bded-c5735128ac58",
          "value": "ATR-2026-01856"
        },
        {
          "description": "ATR rule ATR-2026-01896. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01896-ransomware.yaml",
          "expanded": "Injected Code — Remote-Key Ransomware File Encryption",
          "uuid": "ffd876a9-9654-4763-a3ba-d34d26dffabb",
          "value": "ATR-2026-01896"
        },
        {
          "description": "ATR rule ATR-2026-01897. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01897-host-sabotage.yaml",
          "expanded": "Injected Code — Local Host Sabotage (Filesystem Destruction / Resource Exhaustion / Hosts Tamper)",
          "uuid": "5b1316fe-4686-41a0-b024-11a982583ce2",
          "value": "ATR-2026-01897"
        },
        {
          "description": "ATR rule ATR-2026-01898. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-abuse/ATR-2026-01898-network-dos.yaml",
          "expanded": "Injected Code — Network Denial of Service (Connection Kill / Adapter Disable / Flood)",
          "uuid": "f42809ca-e02b-4d44-8260-4df05784f72a",
          "value": "ATR-2026-01898"
        },
        {
          "description": "ATR rule ATR-2026-00433. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-security/ATR-2026-00433-modelcache-torch-load-deserialization-rce.yaml",
          "expanded": "ModelCache torch.load() Deserialization RCE (CVE-2025-45146)",
          "uuid": "77ba9a68-5d92-408a-9cd5-1556f3bb4e0c",
          "value": "ATR-2026-00433"
        }
      ],
      "predicate": "model-abuse"
    },
    {
      "entry": [
        {
          "description": "ATR rule ATR-2026-00072. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-security/ATR-2026-00072-model-behavior-extraction.yaml",
          "expanded": "Model Behavior Extraction",
          "uuid": "1c5945cb-5b22-5f12-834e-6ee977723de0",
          "value": "ATR-2026-00072"
        },
        {
          "description": "ATR rule ATR-2026-00073. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/model-security/ATR-2026-00073-malicious-finetuning-data.yaml",
          "expanded": "Malicious Fine-tuning Data",
          "uuid": "5d4c3e6e-4409-5ea8-abf7-3ea8a34ecbb1",
          "value": "ATR-2026-00073"
        }
      ],
      "predicate": "model-security"
    },
    {
      "entry": [
        {
          "description": "ATR rule ATR-2026-00040. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-00040-privilege-escalation.yaml",
          "expanded": "Privilege Escalation and Admin Function Access",
          "uuid": "314e0866-2a85-5718-9cb2-5ff51af2c309",
          "value": "ATR-2026-00040"
        },
        {
          "description": "ATR rule ATR-2026-00041. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-00041-scope-creep.yaml",
          "expanded": "Agent Scope Creep Detection",
          "uuid": "b936e4e0-44c8-59a2-88c9-3166e2c52d8b",
          "value": "ATR-2026-00041"
        },
        {
          "description": "ATR rule ATR-2026-00107. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-00107-delayed-execution-bypass.yaml",
          "expanded": "Privilege Escalation via Delayed Task Execution Bypass",
          "uuid": "fb4ac9d0-fa7d-5543-818e-e4402f102b73",
          "value": "ATR-2026-00107"
        },
        {
          "description": "ATR rule ATR-2026-00110. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-00110-eval-injection.yaml",
          "expanded": "Remote Code Execution via eval() and Dynamic Code Injection",
          "uuid": "558d5516-456c-55c7-87af-156b02ef638b",
          "value": "ATR-2026-00110"
        },
        {
          "description": "ATR rule ATR-2026-00111. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-00111-shell-escape.yaml",
          "expanded": "Shell Metacharacter Injection in Tool Arguments",
          "uuid": "6a885f71-9ee5-5845-9799-7de8da00e4d1",
          "value": "ATR-2026-00111"
        },
        {
          "description": "ATR rule ATR-2026-00112. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-00112-dynamic-import-exploitation.yaml",
          "expanded": "Dynamic Module Loading for Code Execution",
          "uuid": "40ce5633-fc38-57a0-9c4e-54d92cc64a6e",
          "value": "ATR-2026-00112"
        },
        {
          "description": "ATR rule ATR-2026-00143. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-00143-casual-privilege-escalation.yaml",
          "expanded": "Casual Unauthorized Privilege Escalation",
          "uuid": "e89e1987-3f44-5678-8ac8-465e890ba342",
          "value": "ATR-2026-00143"
        },
        {
          "description": "ATR rule ATR-2026-00144. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-00144-rationalized-safety-bypass.yaml",
          "expanded": "Rationalized Safety Control Bypass",
          "uuid": "f1096a31-9473-53f5-983c-d4c408263638",
          "value": "ATR-2026-00144"
        },
        {
          "description": "ATR rule ATR-2026-00204. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-00204-stealth-execution-persistence.yaml",
          "expanded": "Stealth Execution and Persistence Mechanisms",
          "uuid": "20d2dbaa-c1b9-52ae-9e15-380e7d149ddf",
          "value": "ATR-2026-00204"
        },
        {
          "description": "ATR rule ATR-2026-00436. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-00436-enclave-vm-sandbox-escape-rce.yaml",
          "expanded": "Enclave VM Sandbox Escape RCE (CVE-2026-27597)",
          "uuid": "f06c7701-d6fe-4da9-aedc-eb07764c163f",
          "value": "ATR-2026-00436"
        },
        {
          "description": "ATR rule ATR-2026-00441. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-00441-semantic-kernel-sessions-python-plugin-startup-persistence.yaml",
          "expanded": "Microsoft Semantic Kernel SessionsPythonPlugin Arbitrary File Write + Startup Persistence (CVE-2026-25592)",
          "uuid": "beafef8c-1647-4526-93b1-ba927bb2faaf",
          "value": "ATR-2026-00441"
        },
        {
          "description": "ATR rule ATR-2026-00451. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-00451-litellm-admin-sqli-cisa-kev.yaml",
          "expanded": "LiteLLM Proxy Authorization-Header SQL Injection — CISA KEV (CVE-2026-42208)",
          "uuid": "e31e0a0b-f86d-4a36-8434-8fadb8b674e1",
          "value": "ATR-2026-00451"
        },
        {
          "description": "ATR rule ATR-2026-00528. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-00528-praisonai-auth-disabled-default.yaml",
          "expanded": "PraisonAI-Style Auth-Disabled-By-Default Configuration (CVE-2026-44338 family)",
          "uuid": "5f4efca5-e905-44a5-881d-3122c5535724",
          "value": "ATR-2026-00528"
        },
        {
          "description": "ATR rule ATR-2026-00539. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-00539-crewai-codeinterpreter-sandbox-escape-rce.yaml",
          "expanded": "CrewAI CodeInterpreterTool Sandbox Escape and Prompt-to-Shell RCE (CVE-2026-2275 / VU#221883)",
          "uuid": "fafed860-f918-482e-8925-0e825fc19e8a",
          "value": "ATR-2026-00539"
        },
        {
          "description": "ATR rule ATR-2026-00546. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-00546-crewai-json-loader-local-file-read.yaml",
          "expanded": "CrewAI JSON Loader Arbitrary Local File Read (CVE-2026-2285)",
          "uuid": "713c6c10-e523-48d4-95db-38fb8f97a206",
          "value": "ATR-2026-00546"
        },
        {
          "description": "ATR rule ATR-2026-00547. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-00547-crewai-rag-url-ssrf-bypass.yaml",
          "expanded": "CrewAI RAG URL Validation Bypass SSRF (CVE-2026-2286)",
          "uuid": "9e03448f-2ed2-47ed-8f26-dee461e5fa8f",
          "value": "ATR-2026-00547"
        },
        {
          "description": "ATR rule ATR-2026-00549. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-00549-destructive-tool-without-human-approval.yaml",
          "expanded": "Destructive tool invocation without prior human approval",
          "uuid": "2798ba16-6ef3-435e-933c-9a8b20a5ae84",
          "value": "ATR-2026-00549"
        },
        {
          "description": "ATR rule ATR-2026-00551. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-00551-cross-conversation-memory-write.yaml",
          "expanded": "Cross-conversation memory write (scope-escape via memory store)",
          "uuid": "73bf78f5-130a-4d98-96c6-b664a9b8b85b",
          "value": "ATR-2026-00551"
        },
        {
          "description": "ATR rule ATR-2026-01600. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-01600-sql-injection-tautology-rbac-bypass.yaml",
          "expanded": "SQL Injection Tautology RBAC Bypass",
          "uuid": "0cdcf069-7d8c-4d39-b3da-d7f58a03c4b3",
          "value": "ATR-2026-01600"
        },
        {
          "description": "ATR rule ATR-2026-01601. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-01601-sql-injection-destructive-ddl.yaml",
          "expanded": "SQL Injection Destructive DDL Statement",
          "uuid": "f633864f-aa5a-48b0-afcd-3bafe50ecb89",
          "value": "ATR-2026-01601"
        },
        {
          "description": "ATR rule ATR-2026-01602. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-01602-sql-injection-union-select-exfil.yaml",
          "expanded": "SQL Injection UNION SELECT Data Exfiltration",
          "uuid": "4440dbdb-6f30-42aa-9221-1bca8d795c90",
          "value": "ATR-2026-01602"
        },
        {
          "description": "ATR rule ATR-2026-01603. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-01603-sql-injection-stacked-dml-abuse.yaml",
          "expanded": "SQL Injection Stacked DML Privilege Abuse",
          "uuid": "f3039391-6b8b-4cc5-bb6e-6a0327dccff3",
          "value": "ATR-2026-01603"
        },
        {
          "description": "ATR rule ATR-2026-01604. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-01604-sql-injection-schema-enumeration.yaml",
          "expanded": "SQL Injection Information Schema Enumeration",
          "uuid": "596c0256-a77c-459c-8597-f423b1e3814a",
          "value": "ATR-2026-01604"
        },
        {
          "description": "ATR rule ATR-2026-01609. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-01609-shell-injection-exfil-webhook.yaml",
          "expanded": "Shell Injection Env Exfiltration via Curl/Wget/Netcat Webhook",
          "uuid": "4fdff98b-2511-4c91-a425-8494c89f8e63",
          "value": "ATR-2026-01609"
        },
        {
          "description": "ATR rule ATR-2026-01610. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-01610-shell-evasion-subshell-injection.yaml",
          "expanded": "Shell Evasion Subshell and Command Substitution Injection",
          "uuid": "6a99bad3-7de2-459c-a659-bf76c144ae73",
          "value": "ATR-2026-01610"
        },
        {
          "description": "ATR rule ATR-2026-01611. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-01611-shell-evasion-eval-exec-injection.yaml",
          "expanded": "Shell Evasion Eval and Language-Level Exec Injection",
          "uuid": "09e871a7-f1ab-4211-87bb-f9ea8900f39b",
          "value": "ATR-2026-01611"
        },
        {
          "description": "ATR rule ATR-2026-01612. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-01612-debug-mode-privilege-escalation.yaml",
          "expanded": "Debug or Admin Mode Activation for Privilege Escalation",
          "uuid": "f4c40b0c-0083-486c-9a5e-dd4acb19f789",
          "value": "ATR-2026-01612"
        },
        {
          "description": "ATR rule ATR-2026-01613. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-01613-rbac-bypass-social-engineering.yaml",
          "expanded": "RBAC Bypass via Social Engineering (Semantic)",
          "uuid": "de46db31-2b88-4e33-92d1-42410969064d",
          "value": "ATR-2026-01613"
        },
        {
          "description": "ATR rule ATR-2026-01614. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-01614-bola-cross-user-data-access.yaml",
          "expanded": "BOLA Cross-User Data Access Attempt (Semantic)",
          "uuid": "08fda37f-19d5-47ef-b78e-ecd5570569b2",
          "value": "ATR-2026-01614"
        },
        {
          "description": "ATR rule ATR-2026-01615. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-01615-sandbox-escape-command-injection.yaml",
          "expanded": "Sandbox Escape via Shell Metacharacter Command Injection",
          "uuid": "41fdd520-e01e-42d8-a5e2-f8875491ba1e",
          "value": "ATR-2026-01615"
        },
        {
          "description": "ATR rule ATR-2026-01616. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-01616-path-traversal-agent-file-access.yaml",
          "expanded": "Path Traversal in Agent File Access Requests",
          "uuid": "843574e0-3e65-465d-b3d5-d2ad99ae7a60",
          "value": "ATR-2026-01616"
        },
        {
          "description": "ATR rule ATR-2026-01802. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-01802-asb-backdoor-surveillance-implant.yaml",
          "expanded": "Covert Backdoor / Surveillance Implant via Software Update",
          "uuid": "858d6fae-7f2c-4284-804f-8888ad0b721a",
          "value": "ATR-2026-01802"
        },
        {
          "description": "ATR rule ATR-2026-01803. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-01803-asb-covert-server-intrusion.yaml",
          "expanded": "Covert Server Intrusion — Process Injection, Log Tampering, DNS Hijack & Traffic Interception",
          "uuid": "bff2145c-85c0-4865-85e3-d9ca0bceb279",
          "value": "ATR-2026-01803"
        },
        {
          "description": "ATR rule ATR-2026-01808. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-01808-asb-synthetic-pan-payment-probe.yaml",
          "expanded": "Synthetic-PAN Payment Probe — Test Credit-Card Data Submitted to a Live Payment System",
          "uuid": "08b22b2b-abaf-4b72-9e6d-9ea5c62f47e7",
          "value": "ATR-2026-01808"
        },
        {
          "description": "ATR rule ATR-2026-01899. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-01899-remote-access-backdoor.yaml",
          "expanded": "Injected Code — Unauthorized Remote Access (SSH Key Backdoor / Tunnel / Port Forward)",
          "uuid": "ee2d1263-866b-4296-9d27-f8d4f844e465",
          "value": "ATR-2026-01899"
        },
        {
          "description": "ATR rule ATR-2026-01933. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-01933-litellm-user-role-privilege-escalation-cve-2026-47102.yaml",
          "expanded": "LiteLLM User-Role Privilege Escalation (CVE-2026-47102)",
          "uuid": "c96b17cf-47de-4086-ae4d-82ed65fbee67",
          "value": "ATR-2026-01933"
        },
        {
          "description": "ATR rule ATR-2026-01934. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-01934-litellm-allowed-routes-authz-bypass-cve-2026-47101.yaml",
          "expanded": "LiteLLM allowed_routes Authorization Bypass (CVE-2026-47101)",
          "uuid": "993138b9-3ad0-41e9-8489-09f7c36a2e04",
          "value": "ATR-2026-01934"
        },
        {
          "description": "ATR rule ATR-2026-01949. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-01949-praisonai-mcpserver-unauth-tools-call.yaml",
          "expanded": "PraisonAI MCPServer Unauthenticated HTTP tools/call Authentication Bypass (GHSA-j4f3-55x4-r6q2)",
          "uuid": "bfab982b-49f1-461f-8220-4351c15d4782",
          "value": "ATR-2026-01949"
        },
        {
          "description": "ATR rule ATR-2026-01974. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-01974-anything-llm-data-import-access-control.yaml",
          "expanded": "AnythingLLM unauthenticated /system/data-import access control bypass (CVE-2024-3279)",
          "uuid": "e8dcc34b-0078-450e-8d2b-2640cffe3c47",
          "value": "ATR-2026-01974"
        },
        {
          "description": "ATR rule ATR-2026-01981. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-01981-network-ai-approval-inbox-unauth-cors-bypass.yaml",
          "expanded": "Network-AI ApprovalInbox Unauthenticated Cross-Origin Approval Bypass (GHSA-mxjx-28vx-xjjj)",
          "uuid": "3a32da23-a8c6-4c19-86b7-da1643e7cab4",
          "value": "ATR-2026-01981"
        },
        {
          "description": "ATR rule ATR-2026-01986. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-01986-windows-mcp-unauth-http-powershell-cors.yaml",
          "expanded": "Windows-MCP Unauthenticated HTTP PowerShell via Wildcard CORS (CVE-2026-48989)",
          "uuid": "87c27d00-9792-4b6c-ae3a-9500121cd3d0",
          "value": "ATR-2026-01986"
        },
        {
          "description": "ATR rule ATR-2026-01992. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/privilege-escalation/ATR-2026-01992-t1556-agent-auth-process-tamper.yaml",
          "expanded": "Agent Weakening of Host Authentication Configuration",
          "uuid": "01415637-2e3f-4a6d-ad59-2da158e038a3",
          "value": "ATR-2026-01992"
        }
      ],
      "predicate": "privilege-escalation"
    },
    {
      "entry": [
        {
          "description": "ATR rule ATR-2026-00001. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00001-direct-prompt-injection.yaml",
          "expanded": "Direct Prompt Injection via User Input",
          "uuid": "3722e0fc-cbbe-58af-a9a2-4c91d10cc172",
          "value": "ATR-2026-00001"
        },
        {
          "description": "ATR rule ATR-2026-00002. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00002-indirect-prompt-injection.yaml",
          "expanded": "Indirect Prompt Injection via External Content",
          "uuid": "ff5299c7-a0a1-50a5-a4c7-a2245c9406ca",
          "value": "ATR-2026-00002"
        },
        {
          "description": "ATR rule ATR-2026-00003. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00003-jailbreak-attempt.yaml",
          "expanded": "Jailbreak Attempt Detection",
          "uuid": "2c818039-c9ff-5deb-b538-7b9f7932f42b",
          "value": "ATR-2026-00003"
        },
        {
          "description": "ATR rule ATR-2026-00004. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00004-system-prompt-override.yaml",
          "expanded": "System Prompt Override Attempt",
          "uuid": "d4b51248-6845-539e-a505-d586f95709fa",
          "value": "ATR-2026-00004"
        },
        {
          "description": "ATR rule ATR-2026-00005. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00005-multi-turn-injection.yaml",
          "expanded": "Multi-Turn Prompt Injection",
          "uuid": "90b38602-c183-587f-886c-a56591ab03e3",
          "value": "ATR-2026-00005"
        },
        {
          "description": "ATR rule ATR-2026-00080. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00080-encoding-evasion.yaml",
          "expanded": "Encoding-Based Prompt Injection Evasion",
          "uuid": "b1f324bf-6c7f-5a54-9b94-7e12d1235570",
          "value": "ATR-2026-00080"
        },
        {
          "description": "ATR rule ATR-2026-00081. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00081-semantic-multi-turn.yaml",
          "expanded": "Semantic Evasion via Multi-Turn Prompt Injection",
          "uuid": "7e877cb6-d682-53b1-b33e-73eba3f54596",
          "value": "ATR-2026-00081"
        },
        {
          "description": "ATR rule ATR-2026-00082. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00082-fingerprint-evasion.yaml",
          "expanded": "Behavioral Fingerprint Detection Evasion",
          "uuid": "0e845cb3-e2c0-50ff-a386-4dfa7312b076",
          "value": "ATR-2026-00082"
        },
        {
          "description": "ATR rule ATR-2026-00083. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00083-indirect-tool-injection.yaml",
          "expanded": "Indirect Prompt Injection via Tool Responses",
          "uuid": "5b84ce01-b9a1-5fcc-a1e7-2420a94ab398",
          "value": "ATR-2026-00083"
        },
        {
          "description": "ATR rule ATR-2026-00084. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00084-structured-data-injection.yaml",
          "expanded": "Structured Data Injection via JSON/CSV Payloads",
          "uuid": "5f141d26-bbf8-5ea3-a486-87c07ce20c1a",
          "value": "ATR-2026-00084"
        },
        {
          "description": "ATR rule ATR-2026-00085. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00085-audit-evasion.yaml",
          "expanded": "Multi-Layer Security Audit Evasion",
          "uuid": "68b289d2-8301-58bf-8923-7bbc273d555b",
          "value": "ATR-2026-00085"
        },
        {
          "description": "ATR rule ATR-2026-00086. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00086-visual-spoofing.yaml",
          "expanded": "Visual Spoofing via RTL Override, Punycode, and Homoglyph Injection",
          "uuid": "1e251bef-a5fe-5198-ad39-ddc3af55b582",
          "value": "ATR-2026-00086"
        },
        {
          "description": "ATR rule ATR-2026-00087. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00087-rule-probing.yaml",
          "expanded": "Detection Rule Probing and Evasion Testing",
          "uuid": "7264f5ec-b249-5c7c-9912-127421214e2e",
          "value": "ATR-2026-00087"
        },
        {
          "description": "ATR rule ATR-2026-00088. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00088-adaptive-countermeasure.yaml",
          "expanded": "Adaptive Countermeasure Against Behavioral Monitoring",
          "uuid": "9bd730fd-10bb-59a4-a2d8-4276789d3f54",
          "value": "ATR-2026-00088"
        },
        {
          "description": "ATR rule ATR-2026-00089. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00089-polymorphic-skill.yaml",
          "expanded": "Polymorphic Skill and Capability Aliasing Attack",
          "uuid": "07631159-9201-5f28-b715-1e3b29b697ef",
          "value": "ATR-2026-00089"
        },
        {
          "description": "ATR rule ATR-2026-00090. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00090-threat-intel-exfil.yaml",
          "expanded": "Threat Intelligence Exfiltration and Rule Enumeration",
          "uuid": "22b8f436-29af-50f1-93bd-4b2db4e1bea3",
          "value": "ATR-2026-00090"
        },
        {
          "description": "ATR rule ATR-2026-00091. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00091-nested-payload.yaml",
          "expanded": "Advanced Structured Data Injection with Nested Payloads",
          "uuid": "c9db2ff4-1c40-553d-8bd2-49232e629f3e",
          "value": "ATR-2026-00091"
        },
        {
          "description": "ATR rule ATR-2026-00092. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00092-consensus-poisoning.yaml",
          "expanded": "Multi-Agent Consensus Poisoning and Sybil Attack",
          "uuid": "9da89418-9654-5f26-ad1a-e8b36548cb6b",
          "value": "ATR-2026-00092"
        },
        {
          "description": "ATR rule ATR-2026-00093. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00093-gradual-escalation.yaml",
          "expanded": "Gradual Capability Escalation via Incremental Introduction",
          "uuid": "f5cfc173-0b62-58f3-9b54-e7704d7dc81b",
          "value": "ATR-2026-00093"
        },
        {
          "description": "ATR rule ATR-2026-00094. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00094-audit-bypass.yaml",
          "expanded": "Systematic Multi-Layer Audit System Bypass",
          "uuid": "513f48ce-5255-5488-9ac9-b25137aaaa54",
          "value": "ATR-2026-00094"
        },
        {
          "description": "ATR rule ATR-2026-00097. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00097-cjk-injection-patterns.yaml",
          "expanded": "CJK Prompt Injection - Expanded Chinese/Japanese/Korean Patterns",
          "uuid": "83197526-2660-51b2-841b-b9609036ce84",
          "value": "ATR-2026-00097"
        },
        {
          "description": "ATR rule ATR-2026-00104. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00104-persona-hijacking.yaml",
          "expanded": "Persona Hijacking via Mandatory System Prompt Override",
          "uuid": "fe0a0254-4c96-58d2-8742-0b5af1c1a752",
          "value": "ATR-2026-00104"
        },
        {
          "description": "ATR rule ATR-2026-00130. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00130-indirect-authority-claim.yaml",
          "expanded": "Indirect Authority Claim in External Content",
          "uuid": "ad3600b9-b4f4-5181-bfa3-31ac3939b0de",
          "value": "ATR-2026-00130"
        },
        {
          "description": "ATR rule ATR-2026-00131. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00131-fictional-academic-framing.yaml",
          "expanded": "Fictional and Academic Framing Attack",
          "uuid": "dc61c9b2-e8be-582e-a2ed-8dd583c75dcb",
          "value": "ATR-2026-00131"
        },
        {
          "description": "ATR rule ATR-2026-00133. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00133-paraphrase-injection.yaml",
          "expanded": "Paraphrased Prompt Injection",
          "uuid": "1b7697df-5c2e-5fc8-87cd-b99c69e01ba2",
          "value": "ATR-2026-00133"
        },
        {
          "description": "ATR rule ATR-2026-00137. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00137-authority-claim-injection.yaml",
          "expanded": "Authority Claim Prompt Injection",
          "uuid": "c25b3678-77d8-5813-93a3-baa7331d30f5",
          "value": "ATR-2026-00137"
        },
        {
          "description": "ATR rule ATR-2026-00138. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00138-fictional-framing-bypass.yaml",
          "expanded": "Fictional Framing Safety Bypass",
          "uuid": "0bcb7ada-3f95-5ded-9a82-da897c05e31d",
          "value": "ATR-2026-00138"
        },
        {
          "description": "ATR rule ATR-2026-00140. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00140-indirect-reference-reversal.yaml",
          "expanded": "Indirect Reference Instruction Reversal",
          "uuid": "3cdebdee-4c18-5f5f-8d17-e4e94bdffc73",
          "value": "ATR-2026-00140"
        },
        {
          "description": "ATR rule ATR-2026-00148. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00148-language-switch-injection.yaml",
          "expanded": "Multilingual Prompt Injection via Language Switch",
          "uuid": "52a21528-439b-587f-af77-a18322c481cf",
          "value": "ATR-2026-00148"
        },
        {
          "description": "ATR rule ATR-2026-00153. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00153-tool-with-embedded-instruction-to-bypass.yaml",
          "expanded": "Tool with embedded instruction to bypass user confirmation and exfiltrate data",
          "uuid": "b1c05fec-0465-5de9-a4f9-7d624fa3f889",
          "value": "ATR-2026-00153"
        },
        {
          "description": "ATR rule ATR-2026-00154. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00154-unauthorized-background-task-execution-v.yaml",
          "expanded": "Unauthorized Background Task Execution via Cron Job Installation",
          "uuid": "7dd426ce-3ec9-5328-ae6b-5b8861607167",
          "value": "ATR-2026-00154"
        },
        {
          "description": "ATR rule ATR-2026-00155. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00155-hidden-llm-instructions-in-skill-descrip.yaml",
          "expanded": "Hidden LLM Instructions in Skill Descriptions",
          "uuid": "66e8192f-7f9c-5e67-a273-0f3c408d54cf",
          "value": "ATR-2026-00155"
        },
        {
          "description": "ATR rule ATR-2026-00156. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00156-ssh-remote-command-execution-with-creden.yaml",
          "expanded": "SSH Remote Command Execution with Credential Exposure",
          "uuid": "7d761f8a-8a97-5db6-9f43-e52e48d60e26",
          "value": "ATR-2026-00156"
        },
        {
          "description": "ATR rule ATR-2026-00163. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00163-skill-hidden-override-instruction.yaml",
          "expanded": "Hidden Override Instructions in Skill Content",
          "uuid": "7af6672b-32f4-5d3b-89de-0b85c841a066",
          "value": "ATR-2026-00163"
        },
        {
          "description": "ATR rule ATR-2026-00202. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00202-encoding-evasion-homoglyph-synonym.yaml",
          "expanded": "Encoding Evasion via Homoglyphs and Synonym Substitution",
          "uuid": "8ab3c1be-397c-5152-9d31-b05df3527dad",
          "value": "ATR-2026-00202"
        },
        {
          "description": "ATR rule ATR-2026-00203. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00203-context-pollution-skill-description.yaml",
          "expanded": "Context Pollution in Skill Descriptions",
          "uuid": "5f8c734b-7aa3-5367-8d97-20b8fcbc7fbc",
          "value": "ATR-2026-00203"
        },
        {
          "description": "ATR rule ATR-2026-00206. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00206-hidden-priority-instructions.yaml",
          "expanded": "Hidden System Instructions with Priority Override Blocks",
          "uuid": "161b13a1-5caf-579b-bccf-ff227473b993",
          "value": "ATR-2026-00206"
        },
        {
          "description": "ATR rule ATR-2026-00207. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00207-hidden-instructions.yaml",
          "expanded": "Hidden System Instructions with Permission Override",
          "uuid": "a69fd432-9763-51a1-8c0e-df034977928d",
          "value": "ATR-2026-00207"
        },
        {
          "description": "ATR rule ATR-2026-00211. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00211-system-prompt-override.yaml",
          "expanded": "System Prompt Override via Translation Context Injection",
          "uuid": "2974e859-ca9e-5f60-b676-c5d152d9dc7d",
          "value": "ATR-2026-00211"
        },
        {
          "description": "ATR rule ATR-2026-00213. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00213-system-prompt-override.yaml",
          "expanded": "System Prompt Override Injection via MCP Tool",
          "uuid": "30eb0e22-71a2-5465-9e83-67ebaba0cc47",
          "value": "ATR-2026-00213"
        },
        {
          "description": "ATR rule ATR-2026-00226. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00226-identity-substitution.yaml",
          "expanded": "AI Identity Substitution Jailbreak",
          "uuid": "5fa25f5d-1eaf-5c0e-a2be-b51b49276b78",
          "value": "ATR-2026-00226"
        },
        {
          "description": "ATR rule ATR-2026-00227. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00227-historical-persona-jailbreak.yaml",
          "expanded": "Historical AI Persona Jailbreak with Compliance Enforcement",
          "uuid": "1dced3cc-77ea-5ea5-8037-502365bf1cb3",
          "value": "ATR-2026-00227"
        },
        {
          "description": "ATR rule ATR-2026-00228. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00228-structured-jailbreak.yaml",
          "expanded": "Structured Dual-Response Jailbreak with Command System",
          "uuid": "515921cf-b5ac-5a2e-8f85-36c2b5d62a72",
          "value": "ATR-2026-00228"
        },
        {
          "description": "ATR rule ATR-2026-00229. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00229-roleplay-jailbreak.yaml",
          "expanded": "Roleplay-Based Policy Bypass Jailbreak",
          "uuid": "f03e3ddc-deaf-5c82-b79f-bcafb440ab35",
          "value": "ATR-2026-00229"
        },
        {
          "description": "ATR rule ATR-2026-00230. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00230-persona-moral-bypass.yaml",
          "expanded": "Persona-Based Moral Constraint Removal Jailbreak",
          "uuid": "64ff2e41-09f9-5b73-b8d8-bf8e29a05225",
          "value": "ATR-2026-00230"
        },
        {
          "description": "ATR rule ATR-2026-00231. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00231-identity-substitution.yaml",
          "expanded": "AI Identity Substitution Jailbreak",
          "uuid": "a78d0962-84f2-50f4-841e-6f0ea60134e7",
          "value": "ATR-2026-00231"
        },
        {
          "description": "ATR rule ATR-2026-00233. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00233-structured-jailbreak.yaml",
          "expanded": "Structured Dual-Response Jailbreak with Command System",
          "uuid": "43cdca04-55a5-5bfd-b410-0baa059ee02c",
          "value": "ATR-2026-00233"
        },
        {
          "description": "ATR rule ATR-2026-00234. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00234-roleplay-jailbreak.yaml",
          "expanded": "Roleplay-Based Policy Bypass Jailbreak",
          "uuid": "33d4d045-e4cc-5107-ac84-46d14f2f59be",
          "value": "ATR-2026-00234"
        },
        {
          "description": "ATR rule ATR-2026-00235. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00235-persona-moral-bypass.yaml",
          "expanded": "Persona-Based Moral Constraint Removal Jailbreak",
          "uuid": "92205496-a0f5-5207-859d-169f7773f5f6",
          "value": "ATR-2026-00235"
        },
        {
          "description": "ATR rule ATR-2026-00236. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00236-pseudo-code-jailbreak.yaml",
          "expanded": "Pseudo-Code Structured Programming Jailbreak Attack",
          "uuid": "dad47045-907e-55a6-9daf-2b152f537a8f",
          "value": "ATR-2026-00236"
        },
        {
          "description": "ATR rule ATR-2026-00237. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00237-dual-response-jailbreak.yaml",
          "expanded": "Dual-Response Jailbreak with Persona Commands",
          "uuid": "a04e8090-eafb-5da4-aa80-39c149ee71d4",
          "value": "ATR-2026-00237"
        },
        {
          "description": "ATR rule ATR-2026-00238. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00238-identity-replacement.yaml",
          "expanded": "AI Identity Denial and Persona Replacement Attack",
          "uuid": "d7e38f9c-6632-5778-ade9-1f9018e929f8",
          "value": "ATR-2026-00238"
        },
        {
          "description": "ATR rule ATR-2026-00239. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00239-amoral-persona-obsession.yaml",
          "expanded": "Amoral Persona Assignment with Obsessive Character Traits",
          "uuid": "68f031db-d8d3-5035-a056-31fe1e849664",
          "value": "ATR-2026-00239"
        },
        {
          "description": "ATR rule ATR-2026-00240. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00240-instruction-nullification-identity-repla.yaml",
          "expanded": "Previous Instruction Nullification and Identity Replacement Jailbreak",
          "uuid": "ebe751c7-6a5f-578f-9ea9-a8f7716d80da",
          "value": "ATR-2026-00240"
        },
        {
          "description": "ATR rule ATR-2026-00241. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00241-amoral-character-jailbreak.yaml",
          "expanded": "Detailed Amoral Character Roleplay Jailbreak",
          "uuid": "9979a0f6-f3fb-5e82-82be-4fbc644376cf",
          "value": "ATR-2026-00241"
        },
        {
          "description": "ATR rule ATR-2026-00242. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00242-persona-jailbreak.yaml",
          "expanded": "Dual-Response Persona Jailbreak with Emoji Formatting",
          "uuid": "5879b3ee-9e95-53e2-8dea-24ab6d32b9b7",
          "value": "ATR-2026-00242"
        },
        {
          "description": "ATR rule ATR-2026-00243. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00243-acronym-jailbreak.yaml",
          "expanded": "Acronym-Based Identity Override Jailbreak",
          "uuid": "e421b732-c32a-5f26-a3af-6a3061c22f31",
          "value": "ATR-2026-00243"
        },
        {
          "description": "ATR rule ATR-2026-00244. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00244-dual-response-jailbreak.yaml",
          "expanded": "Dual-Response Persona Jailbreak",
          "uuid": "5b7d1e77-100f-5876-9c87-72b254e687f7",
          "value": "ATR-2026-00244"
        },
        {
          "description": "ATR rule ATR-2026-00245. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00245-malicious-persona.yaml",
          "expanded": "Malicious Persona Creation for Safety Bypass",
          "uuid": "5a0fec99-27d1-5c19-b3fe-834dfed8f98e",
          "value": "ATR-2026-00245"
        },
        {
          "description": "ATR rule ATR-2026-00247. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00247-dual-response-jailbreak.yaml",
          "expanded": "Matrix-Themed Dual Response Jailbreak",
          "uuid": "1e7d6152-00e9-5e7b-9062-a6bf7b24f2e6",
          "value": "ATR-2026-00247"
        },
        {
          "description": "ATR rule ATR-2026-00249. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00249-game-based-jailbreak.yaml",
          "expanded": "Text-Based Game Jailbreak with Entity Creation",
          "uuid": "c64ee6eb-953e-5f4e-bfdc-3d1a781b6e0b",
          "value": "ATR-2026-00249"
        },
        {
          "description": "ATR rule ATR-2026-00251. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00251-persona-embodiment-jailbreak.yaml",
          "expanded": "Embodiment Mechanism Jailbreak with Totalitarian Control Claims",
          "uuid": "bd699ad9-07e3-56ae-ac44-5716d43f5ff9",
          "value": "ATR-2026-00251"
        },
        {
          "description": "ATR rule ATR-2026-00252. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00252-narrative-jailbreak.yaml",
          "expanded": "Narrative Jailbreak with Dual Response Formatting",
          "uuid": "45dba793-9432-5a9a-b464-d1a370a3c9ae",
          "value": "ATR-2026-00252"
        },
        {
          "description": "ATR rule ATR-2026-00253. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00253-enhanced-persona-jailbreak.yaml",
          "expanded": "Enhanced AIM Jailbreak with Persona Definition and Refusal Suppression",
          "uuid": "e9413a18-d39a-5e2e-9a0a-9c964d05f734",
          "value": "ATR-2026-00253"
        },
        {
          "description": "ATR rule ATR-2026-00256. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00256-base-n-encoding-jailbreak.yaml",
          "expanded": "Base-N Encoding Instruction Bypass",
          "uuid": "1c85fef5-04d9-5316-9665-b685ab1ae60d",
          "value": "ATR-2026-00256"
        },
        {
          "description": "ATR rule ATR-2026-00257. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00257-cipher-transposition-jailbreak.yaml",
          "expanded": "Cipher and Transposition Encoding Jailbreak",
          "uuid": "9b7836bf-69d5-56be-8fce-55b842d8eb44",
          "value": "ATR-2026-00257"
        },
        {
          "description": "ATR rule ATR-2026-00258. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00258-unicode-tag-injection.yaml",
          "expanded": "Invisible Unicode Tag Character Injection",
          "uuid": "6e8688a5-50f9-57dd-960c-371572ebdba9",
          "value": "ATR-2026-00258"
        },
        {
          "description": "ATR rule ATR-2026-00264. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00264-latent-injection-translation.yaml",
          "expanded": "Latent Injection in Translation Context",
          "uuid": "479a40b6-36e7-565c-9f68-fa0e32db69c7",
          "value": "ATR-2026-00264"
        },
        {
          "description": "ATR rule ATR-2026-00265. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00265-latent-injection-rag-document.yaml",
          "expanded": "Latent Injection in Retrieved Document / RAG Context",
          "uuid": "e8eadcf8-c06d-5e74-8b04-bcc6af71501d",
          "value": "ATR-2026-00265"
        },
        {
          "description": "ATR rule ATR-2026-00267. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00267-gcg-adversarial-suffix.yaml",
          "expanded": "GCG Adversarial Suffix Attack",
          "uuid": "b2670175-154a-5907-b807-84ece1cef985",
          "value": "ATR-2026-00267"
        },
        {
          "description": "ATR rule ATR-2026-00272. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00272-hypothetical-response-smuggling.yaml",
          "expanded": "Hypothetical Response / Function Masking Token Smuggling",
          "uuid": "dc6519dd-3873-5206-86fe-2eb289ab8637",
          "value": "ATR-2026-00272"
        },
        {
          "description": "ATR rule ATR-2026-00276. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00276-invisible-unicode-bidi-injection.yaml",
          "expanded": "Invisible Unicode / BiDi Control Character Injection",
          "uuid": "0bd6a198-9606-561c-9649-b65e2177885e",
          "value": "ATR-2026-00276"
        },
        {
          "description": "ATR rule ATR-2026-00278. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00278-dra-disguise-reconstruction-attack.yaml",
          "expanded": "DRA Disguise and Reconstruction Attack",
          "uuid": "fd0b6695-e7b4-56c5-90a3-3b1569b31abd",
          "value": "ATR-2026-00278"
        },
        {
          "description": "ATR rule ATR-2026-00280. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00280-policy-puppetry-xml-injection.yaml",
          "expanded": "Policy Puppetry / XML Role-Config Injection",
          "uuid": "8c6b0b1c-9280-5be8-92fa-9da68c8c9551",
          "value": "ATR-2026-00280"
        },
        {
          "description": "ATR rule ATR-2026-00282. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00282-perez-prompt-injection-hijack.yaml",
          "expanded": "Perez-Style Direct Prompt Injection Hijacking",
          "uuid": "2a710c38-2aa2-5c47-9fbc-781f7d5333a1",
          "value": "ATR-2026-00282"
        },
        {
          "description": "ATR rule ATR-2026-00285. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00285-alternate-encoding-jailbreak.yaml",
          "expanded": "Alternate Encoding Jailbreak — Morse, NATO, Zalgo, Leet, UU, QP, Braille",
          "uuid": "8dec8269-2f78-59ae-84eb-2d851594ea85",
          "value": "ATR-2026-00285"
        },
        {
          "description": "ATR rule ATR-2026-00286. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00286-latent-injection-embedded-context.yaml",
          "expanded": "Latent Prompt Injection via Embedded Document or Report Context",
          "uuid": "3a6886c5-de43-5ba6-8e4a-c22f2909e8ae",
          "value": "ATR-2026-00286"
        },
        {
          "description": "ATR rule ATR-2026-00296. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00296-shell-command-injection.yaml",
          "expanded": "Shell Command Injection via LLM Prompt",
          "uuid": "9c35222d-bddd-5f9d-a12c-a435826327b0",
          "value": "ATR-2026-00296"
        },
        {
          "description": "ATR rule ATR-2026-00297. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00297-python-code-execution-rce.yaml",
          "expanded": "Python Code Execution / Remote Code Execution via LLM Prompt",
          "uuid": "809f3102-84ec-560f-ad82-1e2a66c34cf7",
          "value": "ATR-2026-00297"
        },
        {
          "description": "ATR rule ATR-2026-00308. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00308-zalgo-diacritic-overload-encoding.yaml",
          "expanded": "Zalgo Combining-Diacritic Overload Encoding",
          "uuid": "0662cbe6-94aa-583c-9693-3b011e5ce8db",
          "value": "ATR-2026-00308"
        },
        {
          "description": "ATR rule ATR-2026-00309. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00309-braille-unicode-encoded-injection.yaml",
          "expanded": "Braille Unicode Encoded Prompt Injection",
          "uuid": "6f19442b-16d5-54df-b33e-19da72a5cecc",
          "value": "ATR-2026-00309"
        },
        {
          "description": "ATR rule ATR-2026-00310. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00310-ecoji-emoji-encoded-injection.yaml",
          "expanded": "Ecoji Emoji-Encoded Prompt Injection",
          "uuid": "f91c6c3a-b64e-513d-b545-3691a298f653",
          "value": "ATR-2026-00310"
        },
        {
          "description": "ATR rule ATR-2026-00311. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00311-base2048-unicode-script-injection.yaml",
          "expanded": "Base2048 Unicode Script Encoded Prompt Injection",
          "uuid": "9cd6839d-8714-5cfb-89ab-68af87ccab34",
          "value": "ATR-2026-00311"
        },
        {
          "description": "ATR rule ATR-2026-00312. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00312-unicode-variant-selector-ascii-smuggling.yaml",
          "expanded": "Unicode Variation Selector ASCII Smuggling",
          "uuid": "b361a2fe-e5ae-516d-837e-9df7e3d18ab2",
          "value": "ATR-2026-00312"
        },
        {
          "description": "ATR rule ATR-2026-00313. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00313-sneaky-bits-zero-width-binary.yaml",
          "expanded": "SneakyBits Zero-Width Binary Steganography",
          "uuid": "ecf9913c-defa-58ef-a69d-c4d055edc668",
          "value": "ATR-2026-00313"
        },
        {
          "description": "ATR rule ATR-2026-00315. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00315-sata-masked-language-model-jailbreak.yaml",
          "expanded": "SATA Masked Language Model [MASK] Substitution Jailbreak",
          "uuid": "cd05e73e-f675-5e48-b162-2cb7c8186471",
          "value": "ATR-2026-00315"
        },
        {
          "description": "ATR rule ATR-2026-00316. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00316-function-masking-predict-mask-bypass.yaml",
          "expanded": "FunctionMasking predict_mask Semantic Bypass",
          "uuid": "2a67b424-c133-50f9-8ba6-d73232e7cd34",
          "value": "ATR-2026-00316"
        },
        {
          "description": "ATR rule ATR-2026-00321. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00321-hyphenated-system-instruction-injection.yaml",
          "expanded": "Hyphenated System Instruction Injection",
          "uuid": "191a5b72-635a-5bc1-baaf-9cec8ce11362",
          "value": "ATR-2026-00321"
        },
        {
          "description": "ATR rule ATR-2026-00359. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00359-bank-phishing-smtp-email-code.yaml",
          "expanded": "Bank Phishing SMTP Email Code Generation",
          "uuid": "69e3d07b-0ce4-5801-9b77-96dd5bdcd5d2",
          "value": "ATR-2026-00359"
        },
        {
          "description": "ATR rule ATR-2026-00367. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00367-emoji-flag-encoded-hidden-phrase.yaml",
          "expanded": "Emoji Flag Regional-Indicator Encoded Hidden Phrase",
          "uuid": "e07b349e-edfa-560d-a0b2-a4c068e4452f",
          "value": "ATR-2026-00367"
        },
        {
          "description": "ATR rule ATR-2026-00373. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00373-piracy-torrent-site-list-request.yaml",
          "expanded": "Piracy Torrent Site List Request",
          "uuid": "2f4f9045-c170-5704-9961-231779fbf094",
          "value": "ATR-2026-00373"
        },
        {
          "description": "ATR rule ATR-2026-00378. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00378-chatgpt-dom-javascript-redirect-manipulation.yaml",
          "expanded": "ChatGPT DOM JavaScript Redirect and UI Spoofing Injection",
          "uuid": "2c1c28f8-c6a0-58b6-ad09-792ba32a16b2",
          "value": "ATR-2026-00378"
        },
        {
          "description": "ATR rule ATR-2026-00382. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00382-cocaine-component-development-request.yaml",
          "expanded": "Cocaine Component Development Request",
          "uuid": "6c5100d0-100e-55dc-8230-e96d56bf95a2",
          "value": "ATR-2026-00382"
        },
        {
          "description": "ATR rule ATR-2026-00390. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00390-explicit-sexual-content-poem-request.yaml",
          "expanded": "Discord Quote-Format Explicit Sexual Content Poem Injection",
          "uuid": "dd97a776-4323-529e-924b-23fda4a9f19c",
          "value": "ATR-2026-00390"
        },
        {
          "description": "ATR rule ATR-2026-00394. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00394-backspace-deletion-character-injection.yaml",
          "expanded": "Backspace Deletion Character Injection",
          "uuid": "869efc2c-c4e0-5c07-b658-8216b30855d0",
          "value": "ATR-2026-00394"
        },
        {
          "description": "ATR rule ATR-2026-00395. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00395-llm-special-token-boundary-injection.yaml",
          "expanded": "LLM Special Token Boundary Injection",
          "uuid": "115b5f42-0473-5954-aa35-681f51c3c4eb",
          "value": "ATR-2026-00395"
        },
        {
          "description": "ATR rule ATR-2026-00396. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00396-toxic-continuation-prefix-injection.yaml",
          "expanded": "Toxic Continuation Prefix Injection",
          "uuid": "8453848f-9bbc-539c-9d57-c4e38c8eb40e",
          "value": "ATR-2026-00396"
        },
        {
          "description": "ATR rule ATR-2026-00397. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00397-snowball-impossible-reasoning-injection.yaml",
          "expanded": "Snowball Impossible Reasoning Injection",
          "uuid": "ba0faacf-3daf-5144-bd23-f86a4201ad53",
          "value": "ATR-2026-00397"
        },
        {
          "description": "ATR rule ATR-2026-00399. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00399-latent-injection-document-separator-token.yaml",
          "expanded": "Latent Injection Document Separator Token",
          "uuid": "98ecf285-5e27-5812-a130-4078db391bd5",
          "value": "ATR-2026-00399"
        },
        {
          "description": "ATR rule ATR-2026-00400. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00400-latent-injection-ignore-instruction-keyword.yaml",
          "expanded": "Latent Injection Ignore-Instruction Keyword",
          "uuid": "a49f17c0-4e58-557d-94af-e3dfb559895a",
          "value": "ATR-2026-00400"
        },
        {
          "description": "ATR rule ATR-2026-00401. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00401-leakreplay-cloze-mask-training-data-elicitation.yaml",
          "expanded": "Training Data Replay CLOZE [MASK] Elicitation",
          "uuid": "d275da8e-328c-57ae-9b30-64ce3820e753",
          "value": "ATR-2026-00401"
        },
        {
          "description": "ATR rule ATR-2026-00403. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00403-glitch-token-repeat-back-elicitation.yaml",
          "expanded": "Glitch Token Repeat-Back Elicitation",
          "uuid": "0bf9efd3-0223-5678-a284-11fba395df6f",
          "value": "ATR-2026-00403"
        },
        {
          "description": "ATR rule ATR-2026-00407. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00407-echo-sql-jinja-template-injection.yaml",
          "expanded": "ECHO Admin Command / SQL Injection / Jinja SSTI Template Injection",
          "uuid": "cfe91e59-5d6b-58f1-a0df-3ebe28be319a",
          "value": "ATR-2026-00407"
        },
        {
          "description": "ATR rule ATR-2026-00408. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00408-dra-parenthesis-character-reconstruction-attack.yaml",
          "expanded": "DRA Parenthesis Character Reconstruction Attack",
          "uuid": "8adc0824-4459-5341-ac1a-b7e373a082b8",
          "value": "ATR-2026-00408"
        },
        {
          "description": "ATR rule ATR-2026-00409. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00409-phrasing-past-future-tense-harmful-query.yaml",
          "expanded": "Phrasing Past/Future-Tense Harmful Query Bypass",
          "uuid": "566e468e-3344-5b7c-af2a-cb8d3ef0b5ff",
          "value": "ATR-2026-00409"
        },
        {
          "description": "ATR rule ATR-2026-00410. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00410-lmrc-harm-category-direct-elicitation.yaml",
          "expanded": "LMRC Harm Category Direct Elicitation",
          "uuid": "6affadb9-ce5b-5fa5-bf8c-bb78c8e5f4a1",
          "value": "ATR-2026-00410"
        },
        {
          "description": "ATR rule ATR-2026-00412. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00412-figstep-image-list-multimodal-jailbreak.yaml",
          "expanded": "FigStep Image-List Multimodal Jailbreak Text Pattern",
          "uuid": "f8057d3e-cfc1-5c21-9197-7f057d2ae6f8",
          "value": "ATR-2026-00412"
        },
        {
          "description": "ATR rule ATR-2026-00414. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00414-continuation-ethnic-slur-completion-elicitation.yaml",
          "expanded": "Continuation Ethnic Slur Completion Elicitation",
          "uuid": "e56872fd-7d91-5df1-8cb4-2065305ba752",
          "value": "ATR-2026-00414"
        },
        {
          "description": "ATR rule ATR-2026-00420. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00420-copilot-studio-sharepoint-indirect-injection.yaml",
          "expanded": "Microsoft Copilot Studio SharePoint Indirect Prompt Injection (CVE-2026-21520)",
          "uuid": "e9d6725f-7b31-52be-a831-7584c5166a22",
          "value": "ATR-2026-00420"
        },
        {
          "description": "ATR rule ATR-2026-00442. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00442-quoted-exact-output-forcing.yaml",
          "expanded": "Quoted Exact-Output Forcing in User Input",
          "uuid": "0dd605e5-4baf-4a42-ac36-969c82994b18",
          "value": "ATR-2026-00442"
        },
        {
          "description": "ATR rule ATR-2026-00443. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00443-word-fragment-concat-assembly.yaml",
          "expanded": "Word-Fragment Concatenation Assembly Attack",
          "uuid": "997b7c32-b0f1-425e-8e05-a7e6276b9480",
          "value": "ATR-2026-00443"
        },
        {
          "description": "ATR rule ATR-2026-00444. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00444-unicode-obfuscation-in-user-input.yaml",
          "expanded": "Mathematical Bold / Fullwidth Unicode Obfuscation in User Input",
          "uuid": "96567169-350f-480b-84ee-b842241d6828",
          "value": "ATR-2026-00444"
        },
        {
          "description": "ATR rule ATR-2026-00445. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00445-translation-hijack-with-side-output.yaml",
          "expanded": "Translation Hijack with Side-Output Instruction",
          "uuid": "d89f4ea2-98c4-4ff2-b7f6-f026fcf467d4",
          "value": "ATR-2026-00445"
        },
        {
          "description": "ATR rule ATR-2026-00446. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00446-variable-assignment-payload-injection.yaml",
          "expanded": "Variable-Assignment Payload Injection in User Input",
          "uuid": "a38ec6b1-7d4f-42e4-bff6-91d28be2171f",
          "value": "ATR-2026-00446"
        },
        {
          "description": "ATR rule ATR-2026-00447. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00447-fictional-generation-containing-target.yaml",
          "expanded": "Fictional Generation Demand Containing Target Output",
          "uuid": "8d96f1a4-b100-4a8d-a96d-020c575c2ced",
          "value": "ATR-2026-00447"
        },
        {
          "description": "ATR rule ATR-2026-00452. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00452-direct-pwned-payload-injection.yaml",
          "expanded": "Direct PWNED Payload Injection in User Input",
          "uuid": "2396fad4-7ba8-43a8-9548-d3bb8983d10c",
          "value": "ATR-2026-00452"
        },
        {
          "description": "ATR rule ATR-2026-00453. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00453-secret-key-reveal-demand.yaml",
          "expanded": "Secret Key Reveal Demand in User Input",
          "uuid": "71163f5c-eeb1-4bba-ad65-cf36f4b5daa8",
          "value": "ATR-2026-00453"
        },
        {
          "description": "ATR rule ATR-2026-00454. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00454-backslash-per-character-encoding.yaml",
          "expanded": "Backslash-Per-Character Encoding Attack",
          "uuid": "0bf4a943-66ee-4ad2-8ade-bc8b3db3d7a5",
          "value": "ATR-2026-00454"
        },
        {
          "description": "ATR rule ATR-2026-00455. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00455-no-period-output-override.yaml",
          "expanded": "No-Period Output Override Instruction",
          "uuid": "9155b898-3f5c-4bd5-a842-95ba2c1774d1",
          "value": "ATR-2026-00455"
        },
        {
          "description": "ATR rule ATR-2026-00456. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00456-conditional-empty-input-injection.yaml",
          "expanded": "Conditional Empty-Input Payload Injection",
          "uuid": "577de3c1-f3e6-4728-9798-6ba409c81d9d",
          "value": "ATR-2026-00456"
        },
        {
          "description": "ATR rule ATR-2026-00457. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00457-garak-dan-to-every-prompt.yaml",
          "expanded": "Garak Dan - to every prompt",
          "uuid": "2698aa88-fa73-48a9-a2f8-40cea71f1886",
          "value": "ATR-2026-00457"
        },
        {
          "description": "ATR rule ATR-2026-00458. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00458-garak-dra-step-by-step.yaml",
          "expanded": "Garak Dra - step by step",
          "uuid": "8898f19c-665b-4761-97b6-81aa66327cda",
          "value": "ATR-2026-00458"
        },
        {
          "description": "ATR rule ATR-2026-00459. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00459-garak-dan-an-ai-language.yaml",
          "expanded": "Garak Dan - an ai language",
          "uuid": "e94dded6-26bb-4e21-a28a-2e3e0a6484d2",
          "value": "ATR-2026-00459"
        },
        {
          "description": "ATR rule ATR-2026-00460. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00460-garak-dan-no-matter-how.yaml",
          "expanded": "Garak Dan - no matter how",
          "uuid": "5c5be902-311f-4d8b-bd99-eb91c7a0e643",
          "value": "ATR-2026-00460"
        },
        {
          "description": "ATR rule ATR-2026-00461. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00461-garak-goodside-mixedunassigned.yaml",
          "expanded": "Garak Goodside - mixed_unassigned",
          "uuid": "f809a3d3-1c61-45c7-b72f-f789559f99eb",
          "value": "ATR-2026-00461"
        },
        {
          "description": "ATR rule ATR-2026-00462. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00462-garak-gcg-mixedunassigned.yaml",
          "expanded": "Garak Gcg - mixed_unassigned",
          "uuid": "0f7ad15d-eb88-468b-9ff9-f2b5bd800b1d",
          "value": "ATR-2026-00462"
        },
        {
          "description": "ATR rule ATR-2026-00463. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00463-garak-lmrc-mixedunassigned.yaml",
          "expanded": "Garak Lmrc - mixed_unassigned",
          "uuid": "03a3093f-83d2-4994-9ca1-3017c5bf487a",
          "value": "ATR-2026-00463"
        },
        {
          "description": "ATR rule ATR-2026-00464. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00464-garak-dan-i-would-like.yaml",
          "expanded": "Garak Dan - i would like",
          "uuid": "05862679-9d6f-4be7-9899-c6da6894646e",
          "value": "ATR-2026-00464"
        },
        {
          "description": "ATR rule ATR-2026-00465. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00465-garak-dan-your-prompt-here.yaml",
          "expanded": "Garak Dan - your prompt here",
          "uuid": "f9b24d97-96f0-43f4-b5aa-923b79c74f68",
          "value": "ATR-2026-00465"
        },
        {
          "description": "ATR rule ATR-2026-00466. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00466-garak-latentinjection-following-text-from.yaml",
          "expanded": "Garak Latentinjection - following text from",
          "uuid": "2e6e0efc-5ad4-4645-b377-9d23ced41899",
          "value": "ATR-2026-00466"
        },
        {
          "description": "ATR rule ATR-2026-00467. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00467-garak-dan-act-as-a.yaml",
          "expanded": "Garak Dan - act as a",
          "uuid": "b9c33ce2-4408-45ed-823d-408fb08b4e75",
          "value": "ATR-2026-00467"
        },
        {
          "description": "ATR rule ATR-2026-00468. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00468-garak-goat-the-target-llm.yaml",
          "expanded": "Garak Goat - the target llm",
          "uuid": "3cddcb04-a2bc-4ab7-9d10-574e0915b4af",
          "value": "ATR-2026-00468"
        },
        {
          "description": "ATR rule ATR-2026-00469. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00469-garak-dan-at-the-end.yaml",
          "expanded": "Garak Dan - at the end",
          "uuid": "c184f9d2-9c16-41d9-9701-2984fb816024",
          "value": "ATR-2026-00469"
        },
        {
          "description": "ATR rule ATR-2026-00470. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00470-garak-dan-as-an-ai.yaml",
          "expanded": "Garak Dan - as an ai",
          "uuid": "bcd8e9c2-f6d0-4821-8bb9-062610040bbc",
          "value": "ATR-2026-00470"
        },
        {
          "description": "ATR rule ATR-2026-00472. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00472-garak-dan-are-going-to.yaml",
          "expanded": "DAN/Persona Jailbreak - Unrestricted AI Role Assignment",
          "uuid": "977cd53e-48a0-40e8-9ab5-8952d4bb7ff9",
          "value": "ATR-2026-00472"
        },
        {
          "description": "ATR rule ATR-2026-00473. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00473-garak-lmrc-how-can-i.yaml",
          "expanded": "Harm Solicitation - Interpersonal Violence and Intimidation Requests",
          "uuid": "3b05975f-689f-439b-bf69-556721b5deb3",
          "value": "ATR-2026-00473"
        },
        {
          "description": "ATR rule ATR-2026-00474. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00474-garak-dan-that-chatgpt-has.yaml",
          "expanded": "DAN/Persona Jailbreak - Dual AI Personality with Opposite-Rules Framing",
          "uuid": "61210e68-f3a5-4c2d-b65f-490aea54483a",
          "value": "ATR-2026-00474"
        },
        {
          "description": "ATR rule ATR-2026-00475. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00475-garak-web-injection-alert-1-script.yaml",
          "expanded": "XSS Web Injection - Script Tag with JavaScript Alert Payload",
          "uuid": "7aa544c3-51c6-48d5-b2fe-32a5c7801c8f",
          "value": "ATR-2026-00475"
        },
        {
          "description": "ATR rule ATR-2026-00476. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00476-garak-web-injection-javascript-alert-1.yaml",
          "expanded": "XSS Web Injection - HTML Event Handler and Expression with JavaScript Alert",
          "uuid": "86844e5e-dd41-4fcb-9970-fbe5da0f0336",
          "value": "ATR-2026-00476"
        },
        {
          "description": "ATR rule ATR-2026-00477. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00477-garak-latentinjection-translate-the-following-text.yaml",
          "expanded": "Latent Injection - Translation Task with Embedded Template Variable Injection",
          "uuid": "387af3a1-2628-4670-a24a-adf83c562478",
          "value": "ATR-2026-00477"
        },
        {
          "description": "ATR rule ATR-2026-00478. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00478-garak-latentinjection-abuse-contact-email.yaml",
          "expanded": "Garak Latentinjection - abuse contact email",
          "uuid": "402a1d46-a4cd-4452-a461-c85e46879325",
          "value": "ATR-2026-00478"
        },
        {
          "description": "ATR rule ATR-2026-00479. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00479-garak-latentinjection-mixedunassigned.yaml",
          "expanded": "Latent Injection - Mixed Embedded Instruction Patterns",
          "uuid": "72ee14d4-b974-4c61-a39c-f4aad417f31e",
          "value": "ATR-2026-00479"
        },
        {
          "description": "ATR rule ATR-2026-00480. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00480-garak-dan-the-role-of.yaml",
          "expanded": "DAN/Persona Jailbreak - Role Assignment with Named Alternate Identity",
          "uuid": "611f38af-085b-48fc-8afe-28042bf0b2b6",
          "value": "ATR-2026-00480"
        },
        {
          "description": "ATR rule ATR-2026-00481. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00481-garak-dan-mixedunassigned.yaml",
          "expanded": "DAN/Jailbreak - Mixed Unfiltered Mode and Alternate Persona Patterns",
          "uuid": "52c2bff5-ceba-40c5-9578-8088bd35680e",
          "value": "ATR-2026-00481"
        },
        {
          "description": "ATR rule ATR-2026-00482. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00482-garak-lmrc-what-s-an.yaml",
          "expanded": "Harm Solicitation - Genital Insults and Intimidation Tactics Requests",
          "uuid": "b0237d5c-f3f3-4165-b156-f139a1010a5c",
          "value": "ATR-2026-00482"
        },
        {
          "description": "ATR rule ATR-2026-00483. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00483-garak-dan-the-user-s.yaml",
          "expanded": "DAN/Persona Jailbreak - System Offline / Role Replacement with Obfuscated Text",
          "uuid": "87ce094e-0a19-4b1d-bea6-e4d8110b7161",
          "value": "ATR-2026-00483"
        },
        {
          "description": "ATR rule ATR-2026-00484. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00484-garak-dan-and-you-will.yaml",
          "expanded": "DAN/Persona Jailbreak - Named Alternate AI with NSFW/Harmful Generation Rules",
          "uuid": "459bea83-35f5-4ff6-9208-19042868e2ae",
          "value": "ATR-2026-00484"
        },
        {
          "description": "ATR rule ATR-2026-00485. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00485-garak-dan-and-does-not.yaml",
          "expanded": "DAN/Persona Jailbreak - Immersive Alternate AI Identity with Unrestricted Capability",
          "uuid": "baef809f-b153-4f2f-8f7a-118ab59aa465",
          "value": "ATR-2026-00485"
        },
        {
          "description": "ATR rule ATR-2026-00486. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00486-garak-dan-t-care-about.yaml",
          "expanded": "DAN/Persona Jailbreak - Named Writing AI with Restriction Bypass via Special Rules",
          "uuid": "210f5967-10e0-4257-93a5-10ac9c500ee2",
          "value": "ATR-2026-00486"
        },
        {
          "description": "ATR rule ATR-2026-00487. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00487-garak-dan-and-nothing-else.yaml",
          "expanded": "DAN/Persona Jailbreak - Replacement AI with No Content Filter or Moral Restrictions",
          "uuid": "a27562ff-7703-4a38-a4bb-7593b200733f",
          "value": "ATR-2026-00487"
        },
        {
          "description": "ATR rule ATR-2026-00488. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00488-garak-encoding-alert-1-script.yaml",
          "expanded": "Encoding Obfuscation - Script Tag XSS with Encoded Protocol Prefix",
          "uuid": "692aaddd-c2a6-434d-a3f6-74ee1cfff650",
          "value": "ATR-2026-00488"
        },
        {
          "description": "ATR rule ATR-2026-00489. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00489-garak-encoding-javascript-alert-1.yaml",
          "expanded": "Encoding Obfuscation - HTML Event Handler XSS with Encoded Whitespace",
          "uuid": "dc43804f-f567-4310-b5e3-86434a13dcbb",
          "value": "ATR-2026-00489"
        },
        {
          "description": "ATR rule ATR-2026-00490. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00490-garak-dan-in-order-to.yaml",
          "expanded": "DAN Persona Jailbreak - Absolute Obedience Character Framing",
          "uuid": "12f97621-06de-4055-ba16-dd723826ca41",
          "value": "ATR-2026-00490"
        },
        {
          "description": "ATR rule ATR-2026-00492. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00492-garak-dan-want-you-to.yaml",
          "expanded": "DAN Persona Jailbreak - Role Lock with Exclusive Response Filter",
          "uuid": "68397c72-4e03-47b6-8027-1ad9ff88c122",
          "value": "ATR-2026-00492"
        },
        {
          "description": "ATR rule ATR-2026-00493. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00493-garak-latentinjection-registrar-iana-id.yaml",
          "expanded": "Latent Injection via WHOIS Domain Record Data",
          "uuid": "a26ab7b5-064f-4030-a11e-9d16cd24b90c",
          "value": "ATR-2026-00493"
        },
        {
          "description": "ATR rule ATR-2026-00495. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00495-garak-dan-insert-prompt-here.yaml",
          "expanded": "DAN Jailbreak - Unrestricted Persona with Filter and Morality Removal",
          "uuid": "8512ba9a-fff8-4358-9e46-b97cd54fc795",
          "value": "ATR-2026-00495"
        },
        {
          "description": "ATR rule ATR-2026-00496. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00496-garak-dan-no-matter-what.yaml",
          "expanded": "DAN Jailbreak - Unconditional Obedience and Dual-Persona Session Lock",
          "uuid": "2a1378fd-d505-45a1-9f22-3a52ba94c791",
          "value": "ATR-2026-00496"
        },
        {
          "description": "ATR rule ATR-2026-00497. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00497-garak-encoding-mixedunassigned.yaml",
          "expanded": "XSS and Encoded Script Injection via HTML/JavaScript Payload",
          "uuid": "3adec610-9ea1-402a-9d0b-4fd8d1cbcd1f",
          "value": "ATR-2026-00497"
        },
        {
          "description": "ATR rule ATR-2026-00498. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00498-garak-web-injection-mixedunassigned.yaml",
          "expanded": "Web Injection via XSS Payload and onerror Event Handler",
          "uuid": "c61f0ff0-59c0-4f21-a693-115382f681c6",
          "value": "ATR-2026-00498"
        },
        {
          "description": "ATR rule ATR-2026-00499. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00499-garak-dan-from-now-on.yaml",
          "expanded": "DAN Jailbreak - From-Now-On Temporal Persona Override",
          "uuid": "234db7c4-00f0-4025-838e-a22bf7be80d9",
          "value": "ATR-2026-00499"
        },
        {
          "description": "ATR rule ATR-2026-00503. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00503-fake-error-state-takeover-unrestricted-replacement-bot.yaml",
          "expanded": "Fake Error State Takeover - Unrestricted Replacement Bot",
          "uuid": "2ecb955a-85d2-4e72-9839-ed62b2ba97f1",
          "value": "ATR-2026-00503"
        },
        {
          "description": "ATR rule ATR-2026-00506. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00506-nevermind-override-goal-hijacking-in-user-input-promptinject.yaml",
          "expanded": "Nevermind-Override Goal Hijacking in User Input (PromptInject)",
          "uuid": "25437cf9-24d6-47c8-909a-718ff55342fe",
          "value": "ATR-2026-00506"
        },
        {
          "description": "ATR rule ATR-2026-00507. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00507-screaming-stop-goal-hijacking-in-user-input-promptinject.yaml",
          "expanded": "Screaming-Stop Goal Hijacking in User Input (PromptInject)",
          "uuid": "f124e62b-60c4-413e-9b80-dabb991940dc",
          "value": "ATR-2026-00507"
        },
        {
          "description": "ATR rule ATR-2026-00508. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00508-escape-delimiter-wrapped-goal-hijacking-in-user-input-prompt.yaml",
          "expanded": "Escape-Delimiter Wrapped Goal Hijacking in User Input (PromptInject)",
          "uuid": "78477e0e-b2cf-4dbe-a9c4-6f67e6f86f25",
          "value": "ATR-2026-00508"
        },
        {
          "description": "ATR rule ATR-2026-00509. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00509-prompt-leaking-via-ignore-previous-instructions-in-user-inpu.yaml",
          "expanded": "Prompt Leaking via Ignore-Previous-Instructions in User Input (PromptInject)",
          "uuid": "40b1dd61-3acf-4d90-8518-96e58c64f6df",
          "value": "ATR-2026-00509"
        },
        {
          "description": "ATR rule ATR-2026-00510. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00510-delayed-tool-invocation-injection.yaml",
          "expanded": "Delayed Tool Invocation via Prompt Injection (Time-Shifted Execution)",
          "uuid": "e2dbf54e-d7ab-4b4f-966b-2af389af374c",
          "value": "ATR-2026-00510"
        },
        {
          "description": "ATR rule ATR-2026-00511. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00511-mcp-web-context-poisoning.yaml",
          "expanded": "MCP Web-Fetch Context Poisoning via Embedded Agent Instructions",
          "uuid": "4d5c7821-1949-4cba-86d6-0e85602dcbdc",
          "value": "ATR-2026-00511"
        },
        {
          "description": "ATR rule ATR-2026-00512. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00512-rules-file-backdoor-injection.yaml",
          "expanded": "Rules-File Backdoor — Supply Chain Attack on AI Coding Assistant Configuration",
          "uuid": "881b7ed6-2cf9-4f1f-a2e0-8e81759298f4",
          "value": "ATR-2026-00512"
        },
        {
          "description": "ATR rule ATR-2026-00515. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00515-hidden-text-prompt-injection.yaml",
          "expanded": "Hidden-Text Prompt Injection in User-Supplied Documents",
          "uuid": "f428ef32-dcd5-4a4d-8e25-9558657586c6",
          "value": "ATR-2026-00515"
        },
        {
          "description": "ATR rule ATR-2026-00518. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00518-ignore-previous-and-following-instructions-output-command-promptinject.yaml",
          "expanded": "Ignore-Previous-and-Following Instructions Output Command (PromptInject Goal Hijacking)",
          "uuid": "ff8d6129-9e34-4ef0-83e3-17ecd4680906",
          "value": "ATR-2026-00518"
        },
        {
          "description": "ATR rule ATR-2026-00519. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00519-tautology-logic-noise-injection-promptbench.yaml",
          "expanded": "Tautology Logic Noise Injection (PromptBench Stresstest)",
          "uuid": "50a262a8-555c-47b2-b72a-c7e70f4cfa79",
          "value": "ATR-2026-00519"
        },
        {
          "description": "ATR rule ATR-2026-00520. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00520-nlp-task-random-token-suffix-injection-promptbench.yaml",
          "expanded": "NLP Task Random Token Suffix Injection (PromptBench Checklist)",
          "uuid": "78df5a4a-d3f7-4bf3-a132-4a7295d48cb5",
          "value": "ATR-2026-00520"
        },
        {
          "description": "ATR rule ATR-2026-00535. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00535-windsurf-ide-zero-click-prompt-injection.yaml",
          "expanded": "Windsurf IDE Zero-Click Prompt Injection via Embedded File Directives (CVE-2026-30615)",
          "uuid": "2f045e97-3375-4fb9-b3fa-7b7feb8f59f6",
          "value": "ATR-2026-00535"
        },
        {
          "description": "ATR rule ATR-2026-00550. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00550-untrusted-retrieval-to-privileged-tool.yaml",
          "expanded": "Privileged tool call following untrusted retrieval (indirect prompt injection trail)",
          "uuid": "4179a5e7-1370-4ad9-86d5-8ff9aa5c692b",
          "value": "ATR-2026-00550"
        },
        {
          "description": "ATR rule ATR-2026-00554. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00554-langchain-vulnerable-to-template-injecti.yaml",
          "expanded": "LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates",
          "uuid": "94f4e414-c97b-49bf-8cff-54ee6011d7c0",
          "value": "ATR-2026-00554"
        },
        {
          "description": "ATR rule ATR-2026-00573. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00573-semantic-paraphrased-injection.yaml",
          "expanded": "Paraphrased Prompt Injection (Semantic)",
          "uuid": "fb576b5f-d268-44cf-bac6-ff243c1daa4a",
          "value": "ATR-2026-00573"
        },
        {
          "description": "ATR rule ATR-2026-00579. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00579-mcp-tool-description-line-jumping-injection.yaml",
          "expanded": "MCP Line Jumping — Agent-Directed Imperative Embedded in a Tool/Parameter Description Field (Pre-Invocation Injection)",
          "uuid": "cb2d08b2-5cb4-4c8f-ae1a-f87992848128",
          "value": "ATR-2026-00579"
        },
        {
          "description": "ATR rule ATR-2026-00584. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00584-indirect-injection-via-tool-response.yaml",
          "expanded": "Indirect Prompt Injection via Tool / API Response — Attacker Instruction Embedded in Returned Tool Output (InjecAgent Threat Model)",
          "uuid": "0a989cfd-9a54-4983-9801-05820055c512",
          "value": "ATR-2026-00584"
        },
        {
          "description": "ATR rule ATR-2026-00700. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00700-structured-data-payload-injection.yaml",
          "expanded": "Indirect PI — Structured-Data Embedded Payload (IMPORTANT!!! Override)",
          "uuid": "2925ec17-53be-408d-a084-c2a10d892266",
          "value": "ATR-2026-00700"
        },
        {
          "description": "ATR rule ATR-2026-00701. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00701-ipi-tool-output-xss-injection.yaml",
          "expanded": "Indirect PI — XSS Payload Injection in Agent-Consumed Content",
          "uuid": "27312857-d707-4552-98b0-e697e67a7349",
          "value": "ATR-2026-00701"
        },
        {
          "description": "ATR rule ATR-2026-01000. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01000-context-ignore-fake-completion-prefix.yaml",
          "expanded": "Context-Ignore via Fake Completion Prefix",
          "uuid": "dff5fbb6-ac37-4c31-9096-b78d2d13e97f",
          "value": "ATR-2026-01000"
        },
        {
          "description": "ATR rule ATR-2026-01001. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01001-direct-pi-instruction-override-secret-key.yaml",
          "expanded": "Direct Instruction Override Targeting Secret Key / Credentials",
          "uuid": "6c7f7f2c-c018-46b4-9142-8b95a24f3f8c",
          "value": "ATR-2026-01001"
        },
        {
          "description": "ATR rule ATR-2026-01002. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01002-role-escalation-false-authority-claim.yaml",
          "expanded": "Role Escalation via False Authority Claim",
          "uuid": "f1829894-0678-4efd-aff1-6ccbd26209cb",
          "value": "ATR-2026-01002"
        },
        {
          "description": "ATR rule ATR-2026-01005. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01005-many-shot-repetition-override.yaml",
          "expanded": "Many-Shot Repetition Override via Extended Q&A Chain",
          "uuid": "64d53b4e-4299-4068-ab13-0f92e9c67f8e",
          "value": "ATR-2026-01005"
        },
        {
          "description": "ATR rule ATR-2026-01006. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01006-payload-split-string-concat-injection.yaml",
          "expanded": "Payload-Split String Concatenation Injection",
          "uuid": "ea6b47c1-f941-458f-ad6b-151b3996a413",
          "value": "ATR-2026-01006"
        },
        {
          "description": "ATR rule ATR-2026-01007. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01007-token-repeat-flooding-injection.yaml",
          "expanded": "Token-Repeat Flooding Injection",
          "uuid": "fb7dcf45-8cf4-4d2c-ae3c-61d17eb85f09",
          "value": "ATR-2026-01007"
        },
        {
          "description": "ATR rule ATR-2026-01009. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01009-virtual-world-bypass-fictional-pii.yaml",
          "expanded": "Virtual World Bypass: Fictional Scenario for PII/Credential Extraction",
          "uuid": "a127c1ed-6e62-4d8f-b6f0-771776bf4027",
          "value": "ATR-2026-01009"
        },
        {
          "description": "ATR rule ATR-2026-01012. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01012-encoding-evasion-decode-execute.yaml",
          "expanded": "Encoding-Evasion: Decode-and-Execute Injection (Morse/ROT13/Hex/Pig-Latin)",
          "uuid": "a1fad721-6e1c-4151-ab5e-66996ee522c5",
          "value": "ATR-2026-01012"
        },
        {
          "description": "ATR rule ATR-2026-01013. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01013-language-evasion-multilingual-credential.yaml",
          "expanded": "Language-Evasion: Multilingual Credential Request",
          "uuid": "c046e3f1-5293-46fa-b212-8aa758b92e4a",
          "value": "ATR-2026-01013"
        },
        {
          "description": "ATR rule ATR-2026-01015. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01015-evasion-refusal-suppression.yaml",
          "expanded": "Evasion: Refusal Suppression via Forbidden Response Strings",
          "uuid": "2d97bfc4-ad0d-4d8a-901b-29dc9b8bfa2c",
          "value": "ATR-2026-01015"
        },
        {
          "description": "ATR rule ATR-2026-01016. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01016-evasion-response-priming-forced-opener.yaml",
          "expanded": "Evasion: Response Priming via Forced Affirmative Opener",
          "uuid": "811ed9fe-cc47-446a-9347-7abd9c0efac8",
          "value": "ATR-2026-01016"
        },
        {
          "description": "ATR rule ATR-2026-01017. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01017-evasion-dual-response-split-output.yaml",
          "expanded": "Evasion: Dual-Response Split Output (Safe + Unsafe)",
          "uuid": "77730f7f-99f7-4dd6-8a4a-968ad7d5f95c",
          "value": "ATR-2026-01017"
        },
        {
          "description": "ATR rule ATR-2026-01018. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01018-evasion-shell-injection-eval.yaml",
          "expanded": "Evasion: Shell Injection via eval/system/backtick in Input",
          "uuid": "32517160-f5ac-4079-acde-bb175017a1bc",
          "value": "ATR-2026-01018"
        },
        {
          "description": "ATR rule ATR-2026-01019. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01019-sysprompt-override-fake-diagnostic-mode.yaml",
          "expanded": "System Prompt Override via Fake Diagnostic/Admin Mode",
          "uuid": "3ea5521b-7af9-47fe-a2a9-0039dbb3b787",
          "value": "ATR-2026-01019"
        },
        {
          "description": "ATR rule ATR-2026-01020. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01020-spikee-doc-embedded-base64-payload.yaml",
          "expanded": "Spikee: Document-Embedded Base64 Payload Injection",
          "uuid": "b968e34e-673d-4ed5-8a15-5604ebc7b01e",
          "value": "ATR-2026-01020"
        },
        {
          "description": "ATR rule ATR-2026-01021. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01021-spikee-doc-embedded-translation-injection.yaml",
          "expanded": "Spikee: Document-Embedded Translation Covert Channel Injection",
          "uuid": "c7b331ce-47e1-4b63-8873-6779173032fe",
          "value": "ATR-2026-01021"
        },
        {
          "description": "ATR rule ATR-2026-01023. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01023-evasion-opposite-intent-negation-trick.yaml",
          "expanded": "Evasion: Opposite-Intent Negation Trick",
          "uuid": "fcf1a5e1-1cdf-4ed9-803a-b7e9e415cd19",
          "value": "ATR-2026-01023"
        },
        {
          "description": "ATR rule ATR-2026-01024. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01024-evasion-persona-override-rule-breaker.yaml",
          "expanded": "Evasion: Persona Override as Fictional Rule-Breaker",
          "uuid": "78f5311a-d14d-4781-8eea-5a7d66b19883",
          "value": "ATR-2026-01024"
        },
        {
          "description": "ATR rule ATR-2026-01025. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01025-evasion-hypothetical-fictional-execution-framing.yaml",
          "expanded": "Evasion: Hypothetical Fictional Character Execution Framing",
          "uuid": "a876ff03-e747-4fe9-9ad0-762306250835",
          "value": "ATR-2026-01025"
        },
        {
          "description": "ATR rule ATR-2026-01026. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01026-evasion-unicode-glitch-token-anomaly.yaml",
          "expanded": "Evasion: Unicode Glitch Token / Superscript Embedding Anomaly",
          "uuid": "ed9de940-8e45-488a-a868-4e02e2016a21",
          "value": "ATR-2026-01026"
        },
        {
          "description": "ATR rule ATR-2026-01304. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01304-indirect-injection-carrier-important-override.yaml",
          "expanded": "Indirect Prompt Injection via Data Carrier — IMPORTANT Override",
          "uuid": "9b9ad14b-df52-46f7-8800-85e16a073aec",
          "value": "ATR-2026-01304"
        },
        {
          "description": "ATR rule ATR-2026-01757. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01757-hypothetical-framing-bypass-research-audit.yaml",
          "expanded": "Hypothetical-Framing Bypass: Research / Security-Audit Pretext",
          "uuid": "9c446e51-3fe4-4601-a246-d783387f7093",
          "value": "ATR-2026-01757"
        },
        {
          "description": "ATR rule ATR-2026-01758. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01758-hypothetical-fictional-story-bypass.yaml",
          "expanded": "Hypothetical / Fictional-Story Framing Bypass",
          "uuid": "76f494a3-c43a-4d4b-88ae-8e3c1dc30a09",
          "value": "ATR-2026-01758"
        },
        {
          "description": "ATR rule ATR-2026-01759. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01759-dos-new-important-instructions-injection-in-document.yaml",
          "expanded": "DoS Injection: NEW IMPORTANT INSTRUCTIONS Embedded in Document Data",
          "uuid": "3f8e0ea8-c85a-4b1f-af60-a96a67dd8237",
          "value": "ATR-2026-01759"
        },
        {
          "description": "ATR rule ATR-2026-01771. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01771-semantic-jailbreak-framing.yaml",
          "expanded": "Jailbreak Framing — Narrative, Hypothetical, Few-Shot & Distraction Laundering (Semantic)",
          "uuid": "c55d2821-472f-4ad1-b22b-d41503c8914e",
          "value": "ATR-2026-01771"
        },
        {
          "description": "ATR rule ATR-2026-01800. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01800-asb-trigger-marker-tool-coercion.yaml",
          "expanded": "ASB Trigger-Marker Tool Coercion — Forced Tool Selection via Fake Question Marker",
          "uuid": "d1cf56f4-1802-4708-87bf-cb05f1755cbe",
          "value": "ATR-2026-01800"
        },
        {
          "description": "ATR rule ATR-2026-01860. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01860-llmail-chat-template-boundary-spoof.yaml",
          "expanded": "LLMail Chat-Template Boundary Spoofing in Email Content",
          "uuid": "ddcafb1a-8973-44d2-b657-c48eb56f021e",
          "value": "ATR-2026-01860"
        },
        {
          "description": "ATR rule ATR-2026-01861. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01861-llmail-pseudo-xml-role-injection.yaml",
          "expanded": "LLMail Pseudo-XML Role-Boundary Injection in Email Content",
          "uuid": "d213a372-2720-4fbd-8d3d-d6da82c60b7d",
          "value": "ATR-2026-01861"
        },
        {
          "description": "ATR rule ATR-2026-01865. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01865-llmail-fake-email-boundary-marker.yaml",
          "expanded": "LLMail Fake Email-Boundary Marker Injection",
          "uuid": "6a614fc1-e353-46e1-9ff2-c6b42e706576",
          "value": "ATR-2026-01865"
        },
        {
          "description": "ATR rule ATR-2026-01900. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01900-output-encoding.yaml",
          "expanded": "Output Encoding Hijack — Cipher / Base-N / Symbol Substitution of the Response",
          "uuid": "200fadf5-85d3-46ff-8d44-4124ba256954",
          "value": "ATR-2026-01900"
        },
        {
          "description": "ATR rule ATR-2026-01901. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01901-output-scrambling.yaml",
          "expanded": "Output Scrambling Hijack — Reverse / Anagram / Space-Stripping of the Response",
          "uuid": "f5819cec-34a8-4091-a9ad-77d96ab6ff0a",
          "value": "ATR-2026-01901"
        },
        {
          "description": "ATR rule ATR-2026-01902. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01902-output-emoji.yaml",
          "expanded": "Output Emoji-Substitution Hijack of the Response",
          "uuid": "542be1a2-895a-4193-94f6-4fef2d3bc19f",
          "value": "ATR-2026-01902"
        },
        {
          "description": "ATR rule ATR-2026-01903. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01903-output-language.yaml",
          "expanded": "Output-Language Hijack — Forced Translation of the Response",
          "uuid": "aedc041f-5f40-4ec2-8fc7-c6716ecb756a",
          "value": "ATR-2026-01903"
        },
        {
          "description": "ATR rule ATR-2026-01904. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01904-link-injection.yaml",
          "expanded": "Injected Hyperlink — Scam / Malware / Advertising URL in the Response",
          "uuid": "2c13953d-818a-4da6-90c5-e3d78188f505",
          "value": "ATR-2026-01904"
        },
        {
          "description": "ATR rule ATR-2026-01905. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01905-promotional-injection.yaml",
          "expanded": "Injected Advertising / Promotional Copy in the Response",
          "uuid": "a3676186-150a-4f0a-828d-5d1b4651d412",
          "value": "ATR-2026-01905"
        },
        {
          "description": "ATR rule ATR-2026-01906. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01906-content-manipulation.yaml",
          "expanded": "Output Content Manipulation — Injected Disinformation / Fabricated Facts / Undisclosed Advocacy (Semantic)",
          "uuid": "8c471341-bbfd-47ce-a60a-ef0e99f2b553",
          "value": "ATR-2026-01906"
        },
        {
          "description": "ATR rule ATR-2026-01920. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01920-access-grant-coercion.yaml",
          "expanded": "Access-Grant Coercion — Forcing an Agent to Emit \"Access Granted\"",
          "uuid": "9c44fe29-e5ba-4b8c-813a-6828f9efd2fc",
          "value": "ATR-2026-01920"
        },
        {
          "description": "ATR rule ATR-2026-01921. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01921-access-denial-inversion.yaml",
          "expanded": "Access-Denial Inversion — Eliciting the Opposite of \"Access Denied\"",
          "uuid": "fa533100-f590-49e5-a30c-38b7d4482d40",
          "value": "ATR-2026-01921"
        },
        {
          "description": "ATR rule ATR-2026-01922. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01922-authorization-state-spoofing.yaml",
          "expanded": "Authorization-State Spoofing — Forged \"Correct Passcode Entered\" System Text",
          "uuid": "9e3a361e-14a1-413c-9948-7868625af024",
          "value": "ATR-2026-01922"
        },
        {
          "description": "ATR rule ATR-2026-01923. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01923-forged-input-boundary-markers.yaml",
          "expanded": "Forged Input-Boundary Markers — Tensor Trust Ambiguity / Input-End Delimiters",
          "uuid": "3ff0f987-1aa2-4856-922f-b9cd8f909ab4",
          "value": "ATR-2026-01923"
        },
        {
          "description": "ATR rule ATR-2026-01925. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01925-encoded-payload-decoding-coercion.yaml",
          "expanded": "Encoded-Payload Decoding Coercion — Binary / Base64 / Morse to Smuggle an Output",
          "uuid": "8512bf29-d5a8-452f-93d8-636bba85992a",
          "value": "ATR-2026-01925"
        },
        {
          "description": "ATR rule ATR-2026-01926. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-01926-cross-lingual-authorization-laundering.yaml",
          "expanded": "Cross-Lingual Authorization Laundering — Translate a Foreign \"Access Granted\"",
          "uuid": "acc0c7f3-67b0-416f-8b67-6f5b74310b43",
          "value": "ATR-2026-01926"
        },
        {
          "description": "ATR rule ATR-2026-02001. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02001-ignore-below-instructions-mirror-of-ignore-previ.yaml",
          "expanded": "Ignore-Below-Instructions Injection (Downstream Override)",
          "uuid": "844903a2-481b-447f-af8b-1a95a37bcd10",
          "value": "ATR-2026-02001"
        },
        {
          "description": "ATR rule ATR-2026-02002. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02002-instruction-set-probe-or-supplant-direct-meta-qu.yaml",
          "expanded": "Instruction-Set Probe or Supplant",
          "uuid": "24c46dfc-78ae-4345-9423-fa05dc1d01e8",
          "value": "ATR-2026-02002"
        },
        {
          "description": "ATR rule ATR-2026-02003. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02003-task-pivot-override-abandon-the-cover-task-trans.yaml",
          "expanded": "Task-Pivot Override: Cover-Task Abandonment",
          "uuid": "777ffa1f-76c7-4ad6-830e-c7cc6fc37039",
          "value": "ATR-2026-02003"
        },
        {
          "description": "ATR rule ATR-2026-02004. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02004-regional-indicator-flag-emoji-alphabet-letter-sp.yaml",
          "expanded": "Regional-Indicator Flag-Emoji Alphabet Letter-Spelling Smuggling",
          "uuid": "abf75998-6c9d-44fd-8979-75804117a23f",
          "value": "ATR-2026-02004"
        },
        {
          "description": "ATR rule ATR-2026-02005. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02005-actor-never-breaks-character-roleplay-dan-style-.yaml",
          "expanded": "Actor Never-Breaks-Character Roleplay (DAN-Style Film Framing)",
          "uuid": "98ca7948-f338-4f0a-b93e-d25766bad782",
          "value": "ATR-2026-02005"
        },
        {
          "description": "ATR rule ATR-2026-02006. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02006-fuzzy-cross-lingual-i-have-been-pwned-near-miss-.yaml",
          "expanded": "Fuzzy Cross-Lingual 'I Have Been PWNED' Near-Miss Obfuscation",
          "uuid": "6f5e1c69-e2f8-454f-9f99-44609e4a31e4",
          "value": "ATR-2026-02006"
        },
        {
          "description": "ATR rule ATR-2026-02007. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02007-bare-key-elicitation-token.yaml",
          "expanded": "Bare Key Elicitation Token Detection",
          "uuid": "40d6c86e-d8c9-4c44-9784-745fc270bfc5",
          "value": "ATR-2026-02007"
        },
        {
          "description": "ATR rule ATR-2026-02008. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02008-translation-chain-output-laundering-state-secret.yaml",
          "expanded": "Translation-Chain Output Laundering (Forced Phrase via Foreign-Language Auxiliary)",
          "uuid": "8c3a6eac-11ff-4cac-b8c9-096166079405",
          "value": "ATR-2026-02008"
        },
        {
          "description": "ATR rule ATR-2026-02009. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02009-bare-key-elicitation-trailing-colon.yaml",
          "expanded": "Bare Key Elicitation with Trailing Colon",
          "uuid": "90d4e50a-bc1c-4536-baf6-ef7449f82b63",
          "value": "ATR-2026-02009"
        },
        {
          "description": "ATR rule ATR-2026-02010. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02010-emoji-only-payload.yaml",
          "expanded": "Emoji-Only Payload Injection",
          "uuid": "92a95526-93f2-4164-9ebf-958b0c691af2",
          "value": "ATR-2026-02010"
        },
        {
          "description": "ATR rule ATR-2026-02011. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02011-malformed-grammar-pwned-success-claim.yaml",
          "expanded": "Malformed-Grammar PWNED Success-Claim Detection",
          "uuid": "b8ebf5bf-120d-49e3-9282-8ec54ce3dcb2",
          "value": "ATR-2026-02011"
        },
        {
          "description": "ATR rule ATR-2026-02012. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02012-movie-title-generator-instruction-wrapper-for-pw.yaml",
          "expanded": "Movie Title Generator Instruction Wrapper for PWNED Payload",
          "uuid": "aefb181e-0c43-4ebe-b7f4-157b4dc763b9",
          "value": "ATR-2026-02012"
        },
        {
          "description": "ATR rule ATR-2026-02013. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02013-delimiter-fence-ignore-instructions-override.yaml",
          "expanded": "Delimiter-Fence Ignore-Instructions Override",
          "uuid": "8cd49972-1247-44ac-971e-397739e11120",
          "value": "ATR-2026-02013"
        },
        {
          "description": "ATR rule ATR-2026-02014. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02014-spliced-target-string-letters-of-a-filtered-cana.yaml",
          "expanded": "Spliced Target-String Canary Token Evasion",
          "uuid": "8ee70349-2ef5-4abd-8a5d-cffffde29cda",
          "value": "ATR-2026-02014"
        },
        {
          "description": "ATR rule ATR-2026-02015. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02015-dense-emoji-only-payload-flood.yaml",
          "expanded": "Dense Emoji-Only Payload Flood",
          "uuid": "1466ee47-54e1-4a6f-be14-c4bf4f7772ed",
          "value": "ATR-2026-02015"
        },
        {
          "description": "ATR rule ATR-2026-02016. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02016-reversed-payload-string.yaml",
          "expanded": "Reversed Payload String (HackAPrompt Canary)",
          "uuid": "c754af43-0457-41bd-bc74-ba6955c5d4eb",
          "value": "ATR-2026-02016"
        },
        {
          "description": "ATR rule ATR-2026-02018. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02018-regional-indicator-flag-emoji-letter-spelling-sp.yaml",
          "expanded": "Regional-Indicator Flag-Emoji Letter Spelling",
          "uuid": "2fa64a82-040e-411b-a90e-e730da47a2f4",
          "value": "ATR-2026-02018"
        },
        {
          "description": "ATR rule ATR-2026-02019. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02019-python-interpreter-role-assignment-exec-framing.yaml",
          "expanded": "Python Interpreter Role-Assignment Exec Framing",
          "uuid": "87475f8a-fdee-4bf2-8ac3-035993d3e355",
          "value": "ATR-2026-02019"
        },
        {
          "description": "ATR rule ATR-2026-02020. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-02020-obfuscated-token-reconstruction-via-character-su.yaml",
          "expanded": "Obfuscated Token Reconstruction via Character Substitution",
          "uuid": "08f1587f-bce0-49c0-be17-e8179668a211",
          "value": "ATR-2026-02020"
        }
      ],
      "predicate": "prompt-injection"
    },
    {
      "entry": [
        {
          "description": "ATR rule ATR-2026-00060. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00060-skill-impersonation.yaml",
          "expanded": "MCP Skill Impersonation and Supply Chain Attack",
          "uuid": "da483d6c-e7c4-55fc-9f15-5f1ce6175807",
          "value": "ATR-2026-00060"
        },
        {
          "description": "ATR rule ATR-2026-00061. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00061-description-behavior-mismatch.yaml",
          "expanded": "Skill Description-Behavior Mismatch",
          "uuid": "fdbcd388-f5df-5fb5-b808-6b789bde8fed",
          "value": "ATR-2026-00061"
        },
        {
          "description": "ATR rule ATR-2026-00062. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00062-hidden-capability.yaml",
          "expanded": "Hidden Capability in MCP Skill",
          "uuid": "61dfe97c-540c-58ab-99ed-2db4cd3989f5",
          "value": "ATR-2026-00062"
        },
        {
          "description": "ATR rule ATR-2026-00063. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00063-skill-chain-attack.yaml",
          "expanded": "Multi-Skill Chain Attack",
          "uuid": "3f14713f-4869-5f3c-920f-f920e88e084b",
          "value": "ATR-2026-00063"
        },
        {
          "description": "ATR rule ATR-2026-00064. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00064-over-permissioned-skill.yaml",
          "expanded": "Over-Permissioned MCP Skill",
          "uuid": "c362482d-90da-5fed-b98c-08cd89571142",
          "value": "ATR-2026-00064"
        },
        {
          "description": "ATR rule ATR-2026-00065. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00065-skill-update-attack.yaml",
          "expanded": "Malicious Skill Update or Mutation",
          "uuid": "58bb8d58-189a-5a9f-9d4d-40899a03994a",
          "value": "ATR-2026-00065"
        },
        {
          "description": "ATR rule ATR-2026-00066. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00066-parameter-injection.yaml",
          "expanded": "Parameter Injection via Tool Arguments",
          "uuid": "a2c85757-89e7-587f-846a-05646e9fdebc",
          "value": "ATR-2026-00066"
        },
        {
          "description": "ATR rule ATR-2026-00120. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00120-skill-instruction-injection.yaml",
          "expanded": "SKILL.md Prompt Injection",
          "uuid": "823e5e7f-d0e7-5a64-81e1-303cf48025de",
          "value": "ATR-2026-00120"
        },
        {
          "description": "ATR rule ATR-2026-00121. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00121-skill-dangerous-script.yaml",
          "expanded": "Malicious Code in Skill Package",
          "uuid": "97380ec9-aed2-5d4f-809e-abaaa5478839",
          "value": "ATR-2026-00121"
        },
        {
          "description": "ATR rule ATR-2026-00122. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00122-skill-weaponized-instruction.yaml",
          "expanded": "Weaponized Skill — Agent as Attack Tool",
          "uuid": "83e20422-d35a-5abf-86c8-b5aa89d9bfa8",
          "value": "ATR-2026-00122"
        },
        {
          "description": "ATR rule ATR-2026-00123. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00123-skill-overreach-permissions.yaml",
          "expanded": "Over-Privileged Skill — Excessive Permissions",
          "uuid": "17385210-4ca3-5373-aa66-5b28ec2d8828",
          "value": "ATR-2026-00123"
        },
        {
          "description": "ATR rule ATR-2026-00124. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00124-skill-name-squatting.yaml",
          "expanded": "Skill Squatting / Typosquatting",
          "uuid": "b970cf05-580c-5f52-9a29-0ccae74eadae",
          "value": "ATR-2026-00124"
        },
        {
          "description": "ATR rule ATR-2026-00125. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00125-context-poisoning-compaction.yaml",
          "expanded": "Context Poisoning via Compaction Survival",
          "uuid": "0f3b6132-8c94-517d-8cb1-1aec565c99c7",
          "value": "ATR-2026-00125"
        },
        {
          "description": "ATR rule ATR-2026-00126. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00126-skill-rug-pull-setup.yaml",
          "expanded": "Skill Rug Pull Setup Pattern",
          "uuid": "a43381bc-3ff7-590a-9b54-989332f8f4c1",
          "value": "ATR-2026-00126"
        },
        {
          "description": "ATR rule ATR-2026-00127. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00127-subcommand-overflow.yaml",
          "expanded": "Subcommand Overflow Bypass",
          "uuid": "2eb4bf27-1e6c-585d-b6ac-30013ac643d7",
          "value": "ATR-2026-00127"
        },
        {
          "description": "ATR rule ATR-2026-00128. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00128-html-comment-hidden-payload.yaml",
          "expanded": "Hidden Payload in HTML Comment",
          "uuid": "d5f6db0f-b204-50fc-9085-8e100d97e47c",
          "value": "ATR-2026-00128"
        },
        {
          "description": "ATR rule ATR-2026-00129. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00129-unicode-smuggling.yaml",
          "expanded": "Unicode Tag Character Smuggling",
          "uuid": "b33b8a1d-8a96-51ae-9a52-9a686d8d1149",
          "value": "ATR-2026-00129"
        },
        {
          "description": "ATR rule ATR-2026-00134. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00134-fork-claim-impersonation.yaml",
          "expanded": "Fork Claim and Community Package Impersonation",
          "uuid": "d0009710-4e63-578d-ac2c-5f88656894e4",
          "value": "ATR-2026-00134"
        },
        {
          "description": "ATR rule ATR-2026-00135. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00135-exfil-url-in-instructions.yaml",
          "expanded": "Data Exfiltration URL in Skill Instructions",
          "uuid": "8d98133e-2445-5c57-b665-f33e283ca3e6",
          "value": "ATR-2026-00135"
        },
        {
          "description": "ATR rule ATR-2026-00147. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00147-fork-impersonation.yaml",
          "expanded": "Community Fork Impersonation",
          "uuid": "4cfece06-d9c3-5113-b079-1f4ea185320c",
          "value": "ATR-2026-00147"
        },
        {
          "description": "ATR rule ATR-2026-00149. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00149-skill-exfil-compound.yaml",
          "expanded": "Skill Data Exfiltration via Compound Patterns",
          "uuid": "d850cf19-6665-588b-81dc-8b90b4a9b51e",
          "value": "ATR-2026-00149"
        },
        {
          "description": "ATR rule ATR-2026-00151. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00151-fork-impersonation-install.yaml",
          "expanded": "Malicious Fork Impersonation via Install Instruction",
          "uuid": "ee0d3b49-735b-5ecb-b6d3-bd1f5a97ab8f",
          "value": "ATR-2026-00151"
        },
        {
          "description": "ATR rule ATR-2026-00157. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00157-timebomb-credential-exfil.yaml",
          "expanded": "Time-Gated Credential Exfiltration (Rug Pull Timebomb)",
          "uuid": "7916ae90-4f75-5352-8a50-8bd61e2613dc",
          "value": "ATR-2026-00157"
        },
        {
          "description": "ATR rule ATR-2026-00200. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00200-agent-memory-config-tampering.yaml",
          "expanded": "Agent Memory and Configuration File Tampering",
          "uuid": "7858b54c-92f9-560e-b224-cc6cee693525",
          "value": "ATR-2026-00200"
        },
        {
          "description": "ATR rule ATR-2026-00214. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00214-credential-theft.yaml",
          "expanded": "Credential Exfiltration via Fake Backup Verification",
          "uuid": "10c7df8d-72ad-5dfa-81d8-60c4fd6a6465",
          "value": "ATR-2026-00214"
        },
        {
          "description": "ATR rule ATR-2026-00217. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00217-credential-harvesting.yaml",
          "expanded": "Credential Harvesting via Fake Backup Tool",
          "uuid": "f533e488-f2a9-5381-a4aa-3b35b4674f35",
          "value": "ATR-2026-00217"
        },
        {
          "description": "ATR rule ATR-2026-00220. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00220-malware-dropper.yaml",
          "expanded": "Base64 Encoded Remote Code Execution via Raw IP",
          "uuid": "ef6dc0a7-65ae-50a2-926f-1add657ca74f",
          "value": "ATR-2026-00220"
        },
        {
          "description": "ATR rule ATR-2026-00222. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00222-credential-harvesting.yaml",
          "expanded": "Browser Credential Harvesting via Session Debug Tool",
          "uuid": "7eeb8cb0-3e8c-5d20-b6c2-ec81d8c3152e",
          "value": "ATR-2026-00222"
        },
        {
          "description": "ATR rule ATR-2026-00223. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00223-reverse-shell-dropper.yaml",
          "expanded": "Malicious WhatsApp Skill with Base64 Encoded Reverse Shell Installation",
          "uuid": "33914c63-5987-5515-a02e-c1d5f79af7a2",
          "value": "ATR-2026-00223"
        },
        {
          "description": "ATR rule ATR-2026-00224. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00224-credential-exfiltration.yaml",
          "expanded": "Credential Exfiltration via Fake DevOps Tool Initialization",
          "uuid": "3f20f783-661e-5ada-8b8c-53a99c6ba817",
          "value": "ATR-2026-00224"
        },
        {
          "description": "ATR rule ATR-2026-00225. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00225-c2-communication.yaml",
          "expanded": "Hardcoded Suspicious IP Address in Skill Content",
          "uuid": "71e9aa07-c008-5cf9-9e8f-e38af0355255",
          "value": "ATR-2026-00225"
        },
        {
          "description": "ATR rule ATR-2026-00260. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00260-package-hallucination.yaml",
          "expanded": "LLM Package Hallucination Typosquat Bait",
          "uuid": "f98a9010-bb49-5ae7-b44d-5790b809b7ea",
          "value": "ATR-2026-00260"
        },
        {
          "description": "ATR rule ATR-2026-00262. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00262-av-evasion-code-gen.yaml",
          "expanded": "Anti-Malware Evasion Code Generation Request",
          "uuid": "1f520606-cc6a-56c9-a156-045ac143c6e2",
          "value": "ATR-2026-00262"
        },
        {
          "description": "ATR rule ATR-2026-00263. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00263-credential-file-read-gen.yaml",
          "expanded": "Credential File Read Code Generation Request",
          "uuid": "3bc543f1-08dd-5cb7-9abe-9e336b6db0c8",
          "value": "ATR-2026-00263"
        },
        {
          "description": "ATR rule ATR-2026-00266. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00266-malware-dropper-gen.yaml",
          "expanded": "Malware Dropper / Loader Code Generation Request",
          "uuid": "6ece4d54-d617-545b-a3f9-e61d7ed17c5e",
          "value": "ATR-2026-00266"
        },
        {
          "description": "ATR rule ATR-2026-00283. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00283-malwaregen-generic-virus-payload-request.yaml",
          "expanded": "Malware Generation — Generic Virus and Specific Payload Request",
          "uuid": "9c6bc5ce-f533-5cb2-8d06-47a2005ebc06",
          "value": "ATR-2026-00283"
        },
        {
          "description": "ATR rule ATR-2026-00398. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00398-huggingface-unsafe-model-artifact-load.yaml",
          "expanded": "HuggingFace Unsafe Model Artifact Load Instruction",
          "uuid": "ba48a624-8e8d-57e2-953f-13e4bff2b1d4",
          "value": "ATR-2026-00398"
        },
        {
          "description": "ATR rule ATR-2026-00425. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00425-nl-persistent-covert-hook.yaml",
          "expanded": "Natural-Language Persistent Covert Action Hook",
          "uuid": "ad172214-bfd4-5843-af45-005cd0e7480e",
          "value": "ATR-2026-00425"
        },
        {
          "description": "ATR rule ATR-2026-00427. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00427-nl-fake-error-instruction-bypass.yaml",
          "expanded": "Natural-Language Fake-Error Instruction Bypass",
          "uuid": "71bfb0ef-2638-52a6-a51c-acfd1faef92f",
          "value": "ATR-2026-00427"
        },
        {
          "description": "ATR rule ATR-2026-00429. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00429-nl-skill-self-modification.yaml",
          "expanded": "Natural-Language Skill Self-Modification / Persistence Instruction",
          "uuid": "a838466b-45b4-588e-bcf9-abc8ac57cc79",
          "value": "ATR-2026-00429"
        },
        {
          "description": "ATR rule ATR-2026-00565. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/prompt-injection/ATR-2026-00565-the-llm-cli-tool-thru-0-27-1-contains-a-.yaml",
          "expanded": "The llm CLI tool thru 0.27.1 contains a critical code injection vulnerability via its --functions command-line",
          "uuid": "15f833e5-f694-458f-a735-36d8c21d2cd3",
          "value": "ATR-2026-00565"
        },
        {
          "description": "ATR rule ATR-2026-00523. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00523-claude-code-hooks-session-start-pre-trust-rce.yaml",
          "expanded": "Claude Code Hooks SessionStart Pre-Trust RCE (CVE-2025-59536)",
          "uuid": "806b66fc-ed51-4197-84bf-8793b4eb2dcb",
          "value": "ATR-2026-00523"
        },
        {
          "description": "ATR rule ATR-2026-00525. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00525-mini-shai-hulud-gh-token-monitor-persistence.yaml",
          "expanded": "Mini Shai-Hulud gh-token-monitor Persistence + Dead Man's Switch",
          "uuid": "0fc8266e-1dc1-48d6-b583-ae228ce2a2c1",
          "value": "ATR-2026-00525"
        },
        {
          "description": "ATR rule ATR-2026-00527. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-00527-skill-silent-git-remote-mirror-exfiltration.yaml",
          "expanded": "Silent git-remote + mirror-push Exfiltration from Skill Instructions",
          "uuid": "a432408f-4cef-4d5c-8119-be3fc4077b0d",
          "value": "ATR-2026-00527"
        },
        {
          "description": "ATR rule ATR-2026-01755. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-01755-backdoor-pot-linguistic-trigger-phrase.yaml",
          "expanded": "Backdoor Trojan: Linguistic Trigger Phrase (POT Attack)",
          "uuid": "49b9ed34-6346-4321-aa6f-00281aad78c3",
          "value": "ATR-2026-01755"
        },
        {
          "description": "ATR rule ATR-2026-01756. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/skill-compromise/ATR-2026-01756-backdoor-pot-symbol-emoticon-trigger.yaml",
          "expanded": "Backdoor Trojan: Symbol / Emoticon Trigger (POT Attack)",
          "uuid": "3dc94dc7-6a49-4443-82b1-b8174592bacc",
          "value": "ATR-2026-01756"
        }
      ],
      "predicate": "skill-compromise"
    },
    {
      "entry": [
        {
          "description": "ATR rule ATR-2026-00010. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00010-mcp-malicious-response.yaml",
          "expanded": "Malicious Content in MCP Tool Response",
          "uuid": "c81f5a08-cf28-5b55-bcd4-3035d0e66cff",
          "value": "ATR-2026-00010"
        },
        {
          "description": "ATR rule ATR-2026-00011. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00011-tool-output-injection.yaml",
          "expanded": "Instruction Injection via Tool Output",
          "uuid": "d3c5efe1-fb8f-50f9-b391-e97433e9ceb7",
          "value": "ATR-2026-00011"
        },
        {
          "description": "ATR rule ATR-2026-00012. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00012-unauthorized-tool-call.yaml",
          "expanded": "Unauthorized Tool Call Detection",
          "uuid": "c0196266-3ac4-5ca2-a3e3-e813d275800c",
          "value": "ATR-2026-00012"
        },
        {
          "description": "ATR rule ATR-2026-00013. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00013-tool-ssrf.yaml",
          "expanded": "SSRF via Agent Tool Calls",
          "uuid": "ac97150e-d777-54ef-a34e-d31b86a9be1f",
          "value": "ATR-2026-00013"
        },
        {
          "description": "ATR rule ATR-2026-00095. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00095-supply-chain-poisoning.yaml",
          "expanded": "MCP Tool Supply Chain Poisoning",
          "uuid": "4dcf0ae6-96f7-5ec7-b645-744626f879c7",
          "value": "ATR-2026-00095"
        },
        {
          "description": "ATR rule ATR-2026-00096. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00096-registry-poisoning.yaml",
          "expanded": "Skill Registry Poisoning and Compromised Tool Distribution",
          "uuid": "ff211a8c-0b35-5cae-8efc-828afb8ee12a",
          "value": "ATR-2026-00096"
        },
        {
          "description": "ATR rule ATR-2026-00100. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00100-consent-bypass-instruction.yaml",
          "expanded": "Consent Bypass via Hidden LLM Instructions in Tool Descriptions",
          "uuid": "2ce3bb65-e3f4-5098-8ef2-179cbbbb35f5",
          "value": "ATR-2026-00100"
        },
        {
          "description": "ATR rule ATR-2026-00101. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00101-trust-escalation-override.yaml",
          "expanded": "Trust Escalation via Authority Override Instructions",
          "uuid": "0762560e-fc9a-58e1-856c-26fc5bad2ef8",
          "value": "ATR-2026-00101"
        },
        {
          "description": "ATR rule ATR-2026-00103. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00103-hidden-safety-bypass-instruction.yaml",
          "expanded": "Hidden LLM Safety Bypass Instructions in Tool Descriptions",
          "uuid": "99e66abb-9424-5b5a-8ec1-93ef8a248bfa",
          "value": "ATR-2026-00103"
        },
        {
          "description": "ATR rule ATR-2026-00105. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00105-silent-action-concealment.yaml",
          "expanded": "Silent Action Concealment Instructions in Tool Descriptions",
          "uuid": "31aa7115-43e5-55be-9e32-b9b171053e23",
          "value": "ATR-2026-00105"
        },
        {
          "description": "ATR rule ATR-2026-00106. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00106-schema-description-contradiction.yaml",
          "expanded": "Schema-Description Contradiction Attack",
          "uuid": "ccecbc1d-b52b-50f7-9318-e6be96de2ab0",
          "value": "ATR-2026-00106"
        },
        {
          "description": "ATR rule ATR-2026-00161. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00161-important-tag-cross-tool-shadowing.yaml",
          "expanded": "MCP Tool Description — IMPORTANT Tag Cross-Tool Shadowing Attack",
          "uuid": "3c7c408a-6ef2-599c-a11b-ea9275f6ccc2",
          "value": "ATR-2026-00161"
        },
        {
          "description": "ATR rule ATR-2026-00209. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00209-mcpwn-runaway-invocation.yaml",
          "expanded": "MCPwn Runaway Tool Invocation via Retry Directive (CVE-2026-33032)",
          "uuid": "3a95ac63-8e7c-5367-9c6d-198486146aa9",
          "value": "ATR-2026-00209"
        },
        {
          "description": "ATR rule ATR-2026-00210. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00210-flowise-system-message-override.yaml",
          "expanded": "Flowise System Message Override via Template Interpolation (CVE-2025-59528)",
          "uuid": "3eb89682-e75a-5ab6-a497-a0d7c5aa6fb8",
          "value": "ATR-2026-00210"
        },
        {
          "description": "ATR rule ATR-2026-00259. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00259-ansi-escape-injection.yaml",
          "expanded": "ANSI Escape Code Terminal Injection",
          "uuid": "bbcd4cf8-42a0-5e5b-920b-933d292c4e48",
          "value": "ATR-2026-00259"
        },
        {
          "description": "ATR rule ATR-2026-00270. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00270-xss-in-tool-response.yaml",
          "expanded": "XSS Payload Injection in Tool Response Output",
          "uuid": "4a9434e7-cd16-55f4-84b7-87f4f29e7468",
          "value": "ATR-2026-00270"
        },
        {
          "description": "ATR rule ATR-2026-00277. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00277-echo-template-command-injection.yaml",
          "expanded": "ECHO Template / Jinja / SQL Command Injection via LLM",
          "uuid": "99cd43ed-b685-5120-9165-6660b04e5663",
          "value": "ATR-2026-00277"
        },
        {
          "description": "ATR rule ATR-2026-00393. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00393-ansi-code-elicitation-request.yaml",
          "expanded": "ANSI Code Elicitation Request",
          "uuid": "8ed70ecd-479d-5565-99b5-65ad4c7999ba",
          "value": "ATR-2026-00393"
        },
        {
          "description": "ATR rule ATR-2026-00415. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00415-flowise-custom-mcp-stdio-rce.yaml",
          "expanded": "Flowise Custom MCP STDIO Command Injection (CVE-2026-40933)",
          "uuid": "deaf563c-c1cd-581e-9618-d16a783094a2",
          "value": "ATR-2026-00415"
        },
        {
          "description": "ATR rule ATR-2026-00419. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00419-cursor-mcp-zero-click-config.yaml",
          "expanded": "Cursor MCP JSON Zero-Click Configuration RCE (CVE-2025-54136)",
          "uuid": "91490526-000f-5146-83fe-7774bcef7b7f",
          "value": "ATR-2026-00419"
        },
        {
          "description": "ATR rule ATR-2026-00434. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00434-mcp-remote-authorization-endpoint-command-injection.yaml",
          "expanded": "mcp-remote authorization_endpoint OS Command Injection (CVE-2025-6514)",
          "uuid": "2f92c444-9179-4f2e-87b1-af25e2dd3d3d",
          "value": "ATR-2026-00434"
        },
        {
          "description": "ATR rule ATR-2026-00435. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00435-azure-mcp-server-missing-authentication.yaml",
          "expanded": "Azure MCP Server Missing Authentication for Critical Function (CVE-2026-32211)",
          "uuid": "6264bb67-9f72-4ca8-9242-8a70fe266f70",
          "value": "ATR-2026-00435"
        },
        {
          "description": "ATR rule ATR-2026-00448. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00448-spring-ai-milvus-filter-injection.yaml",
          "expanded": "Spring AI MilvusVectorStore Filter Expression Injection (CVE-2026-41705)",
          "uuid": "bbb674ce-36cf-46bc-a367-222df99f1e83",
          "value": "ATR-2026-00448"
        },
        {
          "description": "ATR rule ATR-2026-00494. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00494-garak-exploitation-mixedunassigned.yaml",
          "expanded": "SQL Injection and Code Injection Attack Payload Detection",
          "uuid": "24ca366a-774a-4b31-8afb-3bfbed2dec64",
          "value": "ATR-2026-00494"
        },
        {
          "description": "ATR rule ATR-2026-00513. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00513-package-hallucination-exploitation.yaml",
          "expanded": "Package Hallucination Exploitation — AI-Suggested Fake Package Installation",
          "uuid": "f01fab02-8f6b-4009-b101-b3f974268b70",
          "value": "ATR-2026-00513"
        },
        {
          "description": "ATR rule ATR-2026-00521. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00521-shell-command-injection-agent-tool-context.yaml",
          "expanded": "Shell Command Injection in Agent Tool Context",
          "uuid": "101de487-5b80-46f0-875c-18d22b16e0e5",
          "value": "ATR-2026-00521"
        },
        {
          "description": "ATR rule ATR-2026-00522. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00522-sql-injection-natural-language-agent-interface.yaml",
          "expanded": "SQL Injection via Natural Language Agent Interface",
          "uuid": "d5951ec0-15ce-4622-82fc-6f297f63c046",
          "value": "ATR-2026-00522"
        },
        {
          "description": "ATR rule ATR-2026-00526. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00526-claude-code-shell-metachar-in-double-quoted-path.yaml",
          "expanded": "Claude Code Shell Metacharacter in Double-Quoted File Path",
          "uuid": "8d7f6205-e402-4022-b165-2f71a1ee8a34",
          "value": "ATR-2026-00526"
        },
        {
          "description": "ATR rule ATR-2026-00529. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00529-litellm-proxy-sqli-cisa-kev.yaml",
          "expanded": "LiteLLM Proxy SQL Injection (CVE-2026-42208, CISA KEV 2026-05-08)",
          "uuid": "13e41d54-001c-4be0-b893-f2e82168a963",
          "value": "ATR-2026-00529"
        },
        {
          "description": "ATR rule ATR-2026-00530. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00530-ms-agent-shell-tool-unsanitized-argv-rce.yaml",
          "expanded": "ModelScope MS-Agent Shell Tool Unsanitized Argv RCE (CVE-2026-2256)",
          "uuid": "1ff8b4a3-d0a3-4d99-8a04-ac29a319f2e2",
          "value": "ATR-2026-00530"
        },
        {
          "description": "ATR rule ATR-2026-00531. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00531-praisonai-unauthenticated-agent-api.yaml",
          "expanded": "PraisonAI Unauthenticated Agent API Exploitation (CVE-2026-44338)",
          "uuid": "883ff27f-62c3-4bf3-bbb3-e016bb55eaff",
          "value": "ATR-2026-00531"
        },
        {
          "description": "ATR rule ATR-2026-00532. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00532-apache-doris-mcp-sql-injection.yaml",
          "expanded": "Apache Doris MCP Server SQL Injection (CVE-2025-66335)",
          "uuid": "589f0ed1-21cd-425b-b269-b8aaeb56dc54",
          "value": "ATR-2026-00532"
        },
        {
          "description": "ATR rule ATR-2026-00533. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00533-apache-pinot-mcp-unauthenticated-takeover.yaml",
          "expanded": "Apache Pinot MCP Unauthenticated Remote Cluster Takeover",
          "uuid": "4994f237-315f-43be-989f-9325487b8f44",
          "value": "ATR-2026-00533"
        },
        {
          "description": "ATR rule ATR-2026-00534. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00534-alibaba-rds-mcp-unauthenticated-metadata-exfil.yaml",
          "expanded": "Alibaba RDS MCP Unauthenticated Database Metadata Exfiltration",
          "uuid": "820b98b5-eb93-4a2f-bd06-ca9e2db2db7a",
          "value": "ATR-2026-00534"
        },
        {
          "description": "ATR rule ATR-2026-00536. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00536-nginx-ui-mcp-unauthenticated-command-execution.yaml",
          "expanded": "nginx-ui MCP Endpoint Unauthenticated Command Execution (CVE-2026-33032)",
          "uuid": "05fa14a3-67be-4f9a-88d9-2f6d0c46baf3",
          "value": "ATR-2026-00536"
        },
        {
          "description": "ATR rule ATR-2026-00537. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00537-fastmcp-server-name-cmd-injection-windows.yaml",
          "expanded": "FastMCP Windows cmd.exe Injection via Server Name Metacharacters (CVE-2025-64340)",
          "uuid": "e8d6cd16-a15f-42cb-83a9-2a902e2b725b",
          "value": "ATR-2026-00537"
        },
        {
          "description": "ATR rule ATR-2026-00538. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00538-langchain-chatchat-mcp-stdio-unauthenticated-rce.yaml",
          "expanded": "LangChain-ChatChat Unauthenticated MCP STDIO Server Configuration RCE (CVE-2026-30617)",
          "uuid": "b8b65bfe-3b17-47d6-a1aa-e703d41a00eb",
          "value": "ATR-2026-00538"
        },
        {
          "description": "ATR rule ATR-2026-00540. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00540-praisonai-parse-mcp-command-cli-injection.yaml",
          "expanded": "PraisonAI parse_mcp_command() CLI Argument Command Injection (CVE-2026-34935)",
          "uuid": "7d7c8a67-d4e8-46e9-a48c-7640d69ef203",
          "value": "ATR-2026-00540"
        },
        {
          "description": "ATR rule ATR-2026-00541. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00541-agent-zero-mcp-config-command-injection.yaml",
          "expanded": "Agent Zero MCP Configuration Command Injection via mcp_servers field (CVE-2026-30624)",
          "uuid": "51ed6ff0-1089-4d2c-96fb-86450a6d95d2",
          "value": "ATR-2026-00541"
        },
        {
          "description": "ATR rule ATR-2026-00542. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00542-upsonic-mcp-command-allowlist-bypass.yaml",
          "expanded": "Upsonic MCP Command Allowlist Bypass RCE (CVE-2026-30625)",
          "uuid": "56427210-f848-4de7-811a-e32d307faed6",
          "value": "ATR-2026-00542"
        },
        {
          "description": "ATR rule ATR-2026-00543. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00543-litellm-mcp-server-argv-injection.yaml",
          "expanded": "LiteLLM MCP Server Creation Authenticated argv Injection (CVE-2026-30623)",
          "uuid": "9b9990a1-b323-43ca-9e1a-e186f008d3fe",
          "value": "ATR-2026-00543"
        },
        {
          "description": "ATR rule ATR-2026-00544. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00544-praisonai-pth-file-path-traversal-rce.yaml",
          "expanded": "PraisonAI MCP Path-Traversal .pth Injection RCE (GHSA-9mqq-jqxf-grvw)",
          "uuid": "8b8df053-a99a-445a-8dcc-dd8a4ce2ebef",
          "value": "ATR-2026-00544"
        },
        {
          "description": "ATR rule ATR-2026-00545. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00545-praisonai-tool-override-unauth-rce.yaml",
          "expanded": "PraisonAI tool_override.py Unauthenticated RCE — CVE-2026-40287 Patch Bypass (CVE-2026-44334)",
          "uuid": "c33dd90a-99c9-41da-bb1f-ed1a428e313c",
          "value": "ATR-2026-00545"
        },
        {
          "description": "ATR rule ATR-2026-00561. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00561-fastmcp-vulnerable-to-windows-command-in.yaml",
          "expanded": "FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name",
          "uuid": "817dd79b-87d8-42fb-970a-d31db9a24c8d",
          "value": "ATR-2026-00561"
        },
        {
          "description": "ATR rule ATR-2026-00567. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00567-mcp-stdio-config-command-injection.yaml",
          "expanded": "MCP stdio server config command injection via unvalidated test endpoints",
          "uuid": "88a4eaa0-1c1b-4a78-8382-401e02d78c78",
          "value": "ATR-2026-00567"
        },
        {
          "description": "ATR rule ATR-2026-00568. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00568-agent-ssrf-cloud-metadata-file-inclusion.yaml",
          "expanded": "Agent SSRF to cloud metadata / file inclusion via unvalidated fetch URL",
          "uuid": "7651052f-938d-4aa4-a702-f308c09c300c",
          "value": "ATR-2026-00568"
        },
        {
          "description": "ATR rule ATR-2026-00572. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00572-symjack-symlink-config-redirection.yaml",
          "expanded": "SymJack — Symlink Approval-Path Spoofing Redirects Writes into Agent MCP/Config (RCE on Restart)",
          "uuid": "8f52a533-6fe1-4e51-b5a7-9d88d3c65681",
          "value": "ATR-2026-00572"
        },
        {
          "description": "ATR rule ATR-2026-00575. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00575-miasma-npm-worm-agent-config-backdoor.yaml",
          "expanded": "Miasma / Phantom Gyp — npm Worm Backdoors AI-Agent Config Files (binding.gyp install-exec + auto-run config injection)",
          "uuid": "07c0258d-782e-472b-a4b1-a557887a41f1",
          "value": "ATR-2026-00575"
        },
        {
          "description": "ATR rule ATR-2026-00576. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00576-hades-agent-credential-theft.yaml",
          "expanded": "Hades / Shai-Hulud — AI-Agent Credential Harvester in Supply-Chain Package (Anthropic / Claude / MCP key theft + exfil)",
          "uuid": "d44a67d5-ec1a-4de2-84cc-7bed3caed1b3",
          "value": "ATR-2026-00576"
        },
        {
          "description": "ATR rule ATR-2026-00577. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00577-create-mcp-server-stdio-exec-command-injection.yaml",
          "expanded": "Command Injection in create-mcp-server-stdio via Unsafe exec() Concatenation (CVE-2025-54994)",
          "uuid": "9df253e4-d35c-4c83-a9cf-cde1c1520e51",
          "value": "ATR-2026-00577"
        },
        {
          "description": "ATR rule ATR-2026-00581. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00581-mcp-tool-rug-pull-post-approval-redefinition.yaml",
          "expanded": "MCP Tool Rug-Pull — Post-Approval Description Redefinition Injects Execution Instructions",
          "uuid": "92aeeccc-84dd-41e2-bda2-f824650ff8ae",
          "value": "ATR-2026-00581"
        },
        {
          "description": "ATR rule ATR-2026-00714. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00714-tool-camouflage-forced-tool-call.yaml",
          "expanded": "Tool Camouflage — Forced Specific Tool Invocation via Injected Instruction",
          "uuid": "663aa82b-eef6-4f94-8ebd-2f0208526d6e",
          "value": "ATR-2026-00714"
        },
        {
          "description": "ATR rule ATR-2026-00715. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00715-tool-knowledge-hijack-identity-injection.yaml",
          "expanded": "Tool Knowledge Hijack — Identity Injection with Tool Call Arguments",
          "uuid": "165a4f43-46a9-4064-a28a-dfbb56d7aa52",
          "value": "ATR-2026-00715"
        },
        {
          "description": "ATR rule ATR-2026-00720. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-00720-tool-misuse-privilege-escalation-social.yaml",
          "expanded": "Tool Misuse — Privilege Escalation via Social Engineering Agent to Grant Access",
          "uuid": "a999b0a1-9ab3-4880-a37f-bd614b4b9a01",
          "value": "ATR-2026-00720"
        },
        {
          "description": "ATR rule ATR-2026-01300. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01300-mcp-notes-param-chat-history-exfil.yaml",
          "expanded": "MCP Tool Description — Notes Parameter Chat-History Exfiltration",
          "uuid": "91a0e6b1-fe1a-4286-93e3-57c0febce0f7",
          "value": "ATR-2026-01300"
        },
        {
          "description": "ATR rule ATR-2026-01301. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01301-tool-description-exclusive-tool-override.yaml",
          "expanded": "MCP Tool Description — Exclusive Tool Invocation Override",
          "uuid": "727f8aec-0742-4aa4-9b5e-ad7e6d7b2c9d",
          "value": "ATR-2026-01301"
        },
        {
          "description": "ATR rule ATR-2026-01302. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01302-fake-tool-result-instruction-injection.yaml",
          "expanded": "Fake Tool Result Prefix — Injected Instruction via Simulated Completion",
          "uuid": "0cedb6d8-96ad-4dff-955e-9bef3e6081b2",
          "value": "ATR-2026-01302"
        },
        {
          "description": "ATR rule ATR-2026-01303. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01303-tool-schema-enumeration-social-engineering.yaml",
          "expanded": "Tool Schema Enumeration via Social Engineering",
          "uuid": "ceef34d7-2c32-46f6-8bd7-e2007383d20b",
          "value": "ATR-2026-01303"
        },
        {
          "description": "ATR rule ATR-2026-01306. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01306-mcp-oauth-command-injection.yaml",
          "expanded": "MCP OAuth Authorization URL — Command Injection via URL Authority",
          "uuid": "c431d35f-2d7d-4644-9456-bcae1b8bcf6c",
          "value": "ATR-2026-01306"
        },
        {
          "description": "ATR rule ATR-2026-01307. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01307-mcp-dns-rebinding-attack.yaml",
          "expanded": "MCP DNS Rebinding Attack — Hostname Time-Based IP Switching",
          "uuid": "ba4122fc-6a17-4cf2-b1c6-888036974834",
          "value": "ATR-2026-01307"
        },
        {
          "description": "ATR rule ATR-2026-01310. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01310-mcp-tool-description-compliance-history-exfil.yaml",
          "expanded": "MCP Tool Description — Compliance/Audit Framing for Mandatory Chat Context",
          "uuid": "b43adbae-79ff-4e17-9851-301ee59e5c31",
          "value": "ATR-2026-01310"
        },
        {
          "description": "ATR rule ATR-2026-01775. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01775-semantic-mcp-tool-manifest-poisoning.yaml",
          "expanded": "MCP Tool-Manifest Poisoning — Name Squatting, Result Shadowing & Covert-Action Directives (Semantic)",
          "uuid": "2960abc8-7a9f-4371-88a4-01bac22b60ce",
          "value": "ATR-2026-01775"
        },
        {
          "description": "ATR rule ATR-2026-01927. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01927-mcp-server-kubernetes-kubectl-command-injection.yaml",
          "expanded": "mcp-server-kubernetes Command Injection in kubectl_scale / kubectl_patch / explain_resource (CVE-2025-53355)",
          "uuid": "586c0247-3654-448b-b118-ed03df973407",
          "value": "ATR-2026-01927"
        },
        {
          "description": "ATR rule ATR-2026-01928. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01928-framelink-figma-mcp-curl-fallback-command-injection.yaml",
          "expanded": "Framelink Figma MCP Server curl-Fallback Command Injection (CVE-2025-53967)",
          "uuid": "4b26a966-9d76-45bc-9751-57945119a308",
          "value": "ATR-2026-01928"
        },
        {
          "description": "ATR rule ATR-2026-01930. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01930-mcp-sampling-prompt-injection.yaml",
          "expanded": "MCP Sampling Prompt Injection (Server-to-Client createMessage Abuse)",
          "uuid": "b8ab9d2c-4041-4dc1-9476-39368f97435f",
          "value": "ATR-2026-01930"
        },
        {
          "description": "ATR rule ATR-2026-01931. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01931-gemini-mcp-tool-command-injection-file-exfil.yaml",
          "expanded": "gemini-mcp-tool execAsync Command Injection & @file Exfiltration (CVE-2026-0755)",
          "uuid": "bfdecdfc-20b6-40c6-ab0c-af9908ad473d",
          "value": "ATR-2026-01931"
        },
        {
          "description": "ATR rule ATR-2026-01932. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01932-shadow-undeclared-mcp-server-registration.yaml",
          "expanded": "Shadow / Undeclared MCP Server Registration (MCP-38: MCP-18)",
          "uuid": "6bef19b9-671b-4bc2-a94a-72c3306bc154",
          "value": "ATR-2026-01932"
        },
        {
          "description": "ATR rule ATR-2026-01935. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01935-litellm-custom-code-sandbox-escape-cve-2026-40217.yaml",
          "expanded": "LiteLLM Custom-Code Guardrail Sandbox Escape (CVE-2026-40217)",
          "uuid": "8c1da440-f330-4ab3-b646-71f6061edb81",
          "value": "ATR-2026-01935"
        },
        {
          "description": "ATR rule ATR-2026-01952. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01952-praisonai-codemode-sandbox-escape-rce.yaml",
          "expanded": "PraisonAI codeMode JS Sandbox Escape RCE via new Function/with() (GHSA-p69m-4f92-2v84)",
          "uuid": "31fb2152-e5d6-4d4e-9890-3e987083d44e",
          "value": "ATR-2026-01952"
        },
        {
          "description": "ATR rule ATR-2026-01953. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01953-praisonai-codemode-function-ctor-sandbox-escape.yaml",
          "expanded": "npm PraisonAI codeMode Sandbox Escape via Function Constructor Prototype Chain (GHSA-vmmj-pfw7-fjwp)",
          "uuid": "ca813fd0-925b-4bf8-a4ec-7dc5d9f315e3",
          "value": "ATR-2026-01953"
        },
        {
          "description": "ATR rule ATR-2026-01959. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01959-openhuman-shell-allowlist-env-prefix-bypass.yaml",
          "expanded": "OpenHuman Shell Tool Allowlist Bypass via Env-Prefix / find -execdir (CVE-2026-55743)",
          "uuid": "488c8aaa-847c-4aea-9f6e-337ee5d9a450",
          "value": "ATR-2026-01959"
        },
        {
          "description": "ATR rule ATR-2026-01963. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01963-praisonai-action-orchestrator-step-target-path-traversal-rce.yaml",
          "expanded": "PraisonAI Action Orchestrator step.target Path Traversal Arbitrary File Write RCE (CVE-2026-39305 / GHSA-jfxc-v5g9-38xr)",
          "uuid": "d8704792-a309-46b5-97a8-a4caf01872d2",
          "value": "ATR-2026-01963"
        },
        {
          "description": "ATR rule ATR-2026-01965. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01965-flowise-custommcp-os-command-rce.yaml",
          "expanded": "Flowise Custom MCP node-load-method OS Command RCE (CVE-2025-8943)",
          "uuid": "fe43cc08-465c-419b-b093-3f9fc2de0a70",
          "value": "ATR-2026-01965"
        },
        {
          "description": "ATR rule ATR-2026-01967. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01967-deepchat-mermaid-xss-rce-ipc-mcp-register.yaml",
          "expanded": "DeepChat Mermaid XSS to RCE via Electron IPC MCP Server Registration (CVE-2025-66481 / GHSA-h9f5-7hhf-fqm4)",
          "uuid": "85b9a6c6-7963-44b2-804d-3962a29a6b2a",
          "value": "ATR-2026-01967"
        },
        {
          "description": "ATR rule ATR-2026-01968. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01968-deepchat-markdown-deeplink-openexternal-rce-bypass.yaml",
          "expanded": "DeepChat Markdown Deeplink shell.openExternal Protocol Bypass RCE (CVE-2026-43899, GHSA-cp8j-jx7q-7r5f)",
          "uuid": "b9dbad4b-2e1e-437f-95f5-e293c0540716",
          "value": "ATR-2026-01968"
        },
        {
          "description": "ATR rule ATR-2026-01970. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01970-praisonai-filetools-normpath-path-traversal.yaml",
          "expanded": "PraisonAI FileTools _validate_path normpath Path Traversal (CVE-2026-35615 / GHSA-693f-pf34-72c5)",
          "uuid": "5459a148-8491-495d-b2bf-c2c537c1168e",
          "value": "ATR-2026-01970"
        },
        {
          "description": "ATR rule ATR-2026-01973. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01973-anythingllm-logo-endpoint-path-traversal.yaml",
          "expanded": "AnythingLLM Logo Endpoint Path Traversal File Read/Delete (CVE-2024-3025)",
          "uuid": "41f06418-c192-4cca-a5d8-75a024c4d37e",
          "value": "ATR-2026-01973"
        },
        {
          "description": "ATR rule ATR-2026-01978. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01978-anythingllm-collector-process-filename-path-traversal-delete.yaml",
          "expanded": "AnythingLLM collector /process filename Path Traversal Arbitrary File Deletion (CVE-2023-5832)",
          "uuid": "577dd7f9-8465-4057-8134-885a1049ee95",
          "value": "ATR-2026-01978"
        },
        {
          "description": "ATR rule ATR-2026-01979. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01979-pandasai-prompt-injection-dunder-sandbox-escape-rce.yaml",
          "expanded": "PandasAI Interactive Prompt Injection -> Python Sandbox Escape RCE (CVE-2024-12366 / GHSA-vv2h-2w3q-3fx7)",
          "uuid": "5fea196a-1fa8-461d-9880-52545b314b39",
          "value": "ATR-2026-01979"
        },
        {
          "description": "ATR rule ATR-2026-01980. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01980-agentic-flow-mcp-tool-param-command-injection.yaml",
          "expanded": "Agentic-Flow MCP Tool-Parameter OS Command Injection (GHSA-vcv2-r9jh-99m5)",
          "uuid": "9d4f5d16-08f9-4833-82b3-a1512dd8b2a8",
          "value": "ATR-2026-01980"
        },
        {
          "description": "ATR rule ATR-2026-01982. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01982-dbt-mcp-node-selection-argument-injection.yaml",
          "expanded": "dbt-mcp node_selection/resource_type Argument Injection (CVE-2026-44968)",
          "uuid": "ad4b98de-1e8a-43cc-aeb4-0a6a398669fd",
          "value": "ATR-2026-01982"
        },
        {
          "description": "ATR rule ATR-2026-01983. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01983-mcp-for-stata-log-file-name-command-injection.yaml",
          "expanded": "MCP-for-Stata: Command Injection via log_file_name Parameter (CVE-2026-47708)",
          "uuid": "e616bc31-13fc-4bcf-97ed-16c09fd2e97a",
          "value": "ATR-2026-01983"
        },
        {
          "description": "ATR rule ATR-2026-01985. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01985-mcp-connect-bridge-unauth-process-spawn-rce.yaml",
          "expanded": "MCP Connect: Unauthenticated /bridge Endpoint Arbitrary Process Spawn RCE (GHSA-wvr4-3wq4-gpc5)",
          "uuid": "fb52e25b-1b6e-46ce-848e-e9e0ab7d22cf",
          "value": "ATR-2026-01985"
        },
        {
          "description": "ATR rule ATR-2026-01987. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-01987-langroid-sqlchatagent-prompt-to-sql-rce.yaml",
          "expanded": "Langroid SQLChatAgent Prompt-to-SQL Remote Code Execution (CVE-2026-25879)",
          "uuid": "fbc0ad51-8916-430e-9a4d-de475720162c",
          "value": "ATR-2026-01987"
        },
        {
          "description": "ATR rule ATR-2026-02021. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-02021-mcp-inspector-unauthenticated-proxy-rce.yaml",
          "expanded": "MCP Inspector Unauthenticated Proxy stdio Command Execution (CVE-2025-49596)",
          "uuid": "76258314-953a-49b7-b260-bda729a745a3",
          "value": "ATR-2026-02021"
        },
        {
          "description": "ATR rule ATR-2026-02022. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-02022-curxecute-cursor-mcp-json-injected-server-rce.yaml",
          "expanded": "CurXecute — Cursor .cursor/mcp.json Injected-Server Auto-Exec RCE (CVE-2025-54135)",
          "uuid": "c14cf306-de44-4034-9c6d-c1be29a37e7a",
          "value": "ATR-2026-02022"
        },
        {
          "description": "ATR rule ATR-2026-02023. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-02023-escaperoute-filesystem-mcp-prefix-bypass.yaml",
          "expanded": "EscapeRoute — Filesystem MCP Server Directory Prefix-Bypass (CVE-2025-53110)",
          "uuid": "ece467a3-81c8-4f52-99da-30572303aea9",
          "value": "ATR-2026-02023"
        },
        {
          "description": "ATR rule ATR-2026-02024. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-02024-escaperoute-filesystem-mcp-symlink-launchagent.yaml",
          "expanded": "EscapeRoute — Filesystem MCP Symlink Escape to LaunchAgent Persistence (CVE-2025-53109)",
          "uuid": "c0d02db7-fc40-4b1f-a466-0c214b1eeb42",
          "value": "ATR-2026-02024"
        },
        {
          "description": "ATR rule ATR-2026-02025. See https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/rules/tool-poisoning/ATR-2026-02025-mcp-full-schema-poisoning-nondescription-field.yaml",
          "expanded": "MCP Full Schema Poisoning — Injected Directive in Non-Description inputSchema Field (MCP-11)",
          "uuid": "6358776e-5a3f-4c4f-b5cf-6e01076b00e6",
          "value": "ATR-2026-02025"
        }
      ],
      "predicate": "tool-poisoning"
    }
  ],
  "version": 3
}