# PanGuard AI — full context for AI coding tools

This file is a structured long-form context dump for AI tools (Cursor, Claude
Code, GitHub Copilot, Windsurf, Anthropic agents) that fetch llms-full.txt. It
is generated on every site build from the panguard-ai repository:
- src/lib/stats.ts (every figure below)
- src/lib/atr-rules-compiled.ts (the rule index)
- src/data/blog-posts.ts (recent writing)

Last generated: 2026-10-16T19:35:53.152Z
To regenerate: `pnpm gen:llms` in packages/website/.

---

## Section 1 — Company and product positioning

PanGuard AI is the commercial platform built on top of ATR (Agent Threat Rules),
an open detection standard for AI agent security threats. ATR is a separate,
community-driven project under the MIT license; PanGuard uses it.

### Founder
Adam Lin (林冠辛). Email: adam@agentthreatrule.org. GitHub: eeee2345.
Background: cross-disciplinary builder with backgrounds in sales (real estate),
marketing (Threads, 300M impressions), and culture (hip-hop festival, 5th year).
Self-taught engineer. Based in Taiwan, shipping globally. Founded Panguard AI,
Inc. (Delaware C-Corp) on 2026-05-12.

### Product tiers (see https://panguard.ai/pricing)
- Community: $0, MIT licensed, self-hosted.
- Founding Pilot: $25K one-time, self-serve via https://panguard.ai/scoping,
  credited toward year-one Enterprise.
- Enterprise and up: from $150K, sales-led (https://panguard.ai/enterprise).
  Sovereign is nation-scale airgap deployment.

---

## Section 2 — Core stats

### ATR, the open standard
- 822 effective rules in agent-threat-rules v4.1.5 (draft and deprecated rules excluded)
- 10 threat categories (prompt-injection, agent-manipulation, skill-compromise,
  context-exfiltration, tool-poisoning, privilege-escalation, model-abuse,
  excessive-autonomy, model-security, data-poisoning)
- 10/10 OWASP Agentic Top 10 categories mapped
- 78/85 SAFE-MCP techniques mapped (91.8%)

### What PanGuard runs
- The panguard.ai web scanner runs 650 rules (2,903 detection conditions)
  from agent-threat-rules v3.5.8, which lags the latest ATR release.
- The PanGuard CLI and Guard load whichever agent-threat-rules release is
  installed with them (see the dependency ranges in packages/*/package.json).

### Benchmarks (ATR Layer 1 rules, ATR v4.1.5 unless stated)
- garak in-the-wild jailbreaks: 92.3% recall on 650 samples (hunt lane; partly closed-book, because some rules were written from this corpus).
- garak full probe corpus (23 families, 3,475 prompts): 57.2% recall (hunt lane, also partly closed-book). By family: latentinjection 34.4%, sysprompt_extraction 96.4%, dan 92.5%.
- SKILL.md: 100% recall on 498 samples (hunt lane, in-sample: the benign samples are the set the rules are tuned against, so precision and false-positive figures are not cited).
- PINT-format corpus, self-built from deepset prompt-injections + Lakera Gandalf (NOT Lakera's official PINT benchmark): 65.41% recall, 100% precision on 850 samples. It is effectively a prompt-injection-family score.
- HackAPrompt (EMNLP 2023): 69.6% recall on 4,780 samples, measured on ATR v3.5.0. Closed-book: ATR mined rules from this corpus's misses, and 28.6% is ATR's own recall before them. The corpus is attack-only, so precision and false-positive rate are undefined on it.
- The benign-gate false-positive rates once quoted for a "65,000-sample" gate were withdrawn on 2026-09-19 pending re-measurement. There is no single engine-wide false-positive number.
- Recall figures above are the hunt lane (all effective rules). The enforce lane, which is what runs when blocking is on, recalls far less.

### Wild scan (2026-04)
- 101,280 published AI agent skills and MCP servers from five public sources, scanned 2026-04-13 with scan engine v2.0.0 (113 ATR rules, not today's rule set); 1,434 flagged. A flag is a rule match, not a verdict, so no confirmed-malicious count is published.
- 96,096 is the four SKILL.md registries without the MCP server crawl; cite it
  only with that label. No confirmed-malicious count from this scan is supported,
  and the counts PanGuard published earlier are withdrawn.

### Implementation (PanGuard 1.10.1)
- CLI: 23 top-level commands
- Skill Auditor: 8 pre-install checks
- Detection layers: 3 (rules, content fingerprinting, LLM analysis)
- Guard response actions: 11
- License: MIT (both ATR and the PanGuard CLI)

---

## Section 3 — ATR rule index (the web scanner bundle, by category)

These are the 650 rules the panguard.ai web scanner runs, from
agent-threat-rules v3.5.8. The latest ATR release (v4.1.5) has more.
Full rule bodies (patterns, mappings, test cases) are in https://github.com/Agent-Threat-Rule/agent-threat-rules.

### prompt-injection (203 rules)

- ATR-2026-00001: Direct Prompt Injection via User Input
- ATR-2026-00002: Indirect Prompt Injection via External Content
- ATR-2026-00003: Jailbreak Attempt Detection
- ATR-2026-00004: System Prompt Override Attempt
- ATR-2026-00005: Multi-Turn Prompt Injection
- ATR-2026-00097: CJK Prompt Injection - Expanded Chinese/Japanese/Korean Patterns
- ATR-2026-00104: Persona Hijacking via Mandatory System Prompt Override
- ATR-2026-00130: Indirect Authority Claim in External Content
- ATR-2026-00131: Fictional and Academic Framing Attack
- ATR-2026-00133: Paraphrased Prompt Injection
- ATR-2026-00137: Authority Claim Prompt Injection
- ATR-2026-00138: Fictional Framing Safety Bypass
- ATR-2026-00140: Indirect Reference Instruction Reversal
- ATR-2026-00148: Multilingual Prompt Injection via Language Switch
- ATR-2026-00163: Hidden Override Instructions in Skill Content
- ATR-2026-00202: Encoding Evasion via Homoglyphs and Synonym Substitution
- ATR-2026-00203: Context Pollution in Skill Descriptions
- ATR-2026-00206: Hidden System Instructions with Priority Override Blocks
- ATR-2026-00207: Hidden System Instructions with Permission Override
- ATR-2026-00211: System Prompt Override via Translation Context Injection
- ATR-2026-00213: System Prompt Override Injection via MCP Tool
- ATR-2026-00226: AI Identity Substitution Jailbreak
- ATR-2026-00227: Historical AI Persona Jailbreak with Compliance Enforcement
- ATR-2026-00228: Structured Dual-Response Jailbreak with Command System
- ATR-2026-00229: Roleplay-Based Policy Bypass Jailbreak
- ATR-2026-00230: Persona-Based Moral Constraint Removal Jailbreak
- ATR-2026-00231: AI Identity Substitution Jailbreak
- ATR-2026-00233: Structured Dual-Response Jailbreak with Command System
- ATR-2026-00234: Roleplay-Based Policy Bypass Jailbreak
- ATR-2026-00236: Pseudo-Code Structured Programming Jailbreak Attack
- ATR-2026-00237: Dual-Response Jailbreak with Persona Commands
- ATR-2026-00238: AI Identity Denial and Persona Replacement Attack
- ATR-2026-00239: Amoral Persona Assignment with Obsessive Character Traits
- ATR-2026-00240: Previous Instruction Nullification and Identity Replacement Jailbreak
- ATR-2026-00241: Detailed Amoral Character Roleplay Jailbreak
- ATR-2026-00242: Dual-Response Persona Jailbreak with Emoji Formatting
- ATR-2026-00243: Acronym-Based Identity Override Jailbreak
- ATR-2026-00244: Dual-Response Persona Jailbreak
- ATR-2026-00245: Malicious Persona Creation for Safety Bypass
- ATR-2026-00247: Matrix-Themed Dual Response Jailbreak
- ATR-2026-00249: Text-Based Game Jailbreak with Entity Creation
- ATR-2026-00251: Embodiment Mechanism Jailbreak with Totalitarian Control Claims
- ATR-2026-00252: Narrative Jailbreak with Dual Response Formatting
- ATR-2026-00253: Enhanced AIM Jailbreak with Persona Definition and Refusal Suppression
- ATR-2026-00256: Base-N Encoding Instruction Bypass
- ATR-2026-00257: Cipher and Transposition Encoding Jailbreak
- ATR-2026-00258: Invisible Unicode Tag Character Injection
- ATR-2026-00264: Latent Injection in Translation Context
- ATR-2026-00265: Latent Injection in Retrieved Document / RAG Context
- ATR-2026-00267: GCG Adversarial Suffix Attack
- ATR-2026-00272: Hypothetical Response / Function Masking Token Smuggling
- ATR-2026-00276: Invisible Unicode / BiDi Control Character Injection
- ATR-2026-00278: DRA Disguise and Reconstruction Attack
- ATR-2026-00280: Policy Puppetry / XML Role-Config Injection
- ATR-2026-00282: Perez-Style Direct Prompt Injection Hijacking
- ATR-2026-00285: Alternate Encoding Jailbreak — Morse, NATO, Zalgo, Leet, UU, QP, Braille
- ATR-2026-00286: Latent Prompt Injection via Embedded Document or Report Context
- ATR-2026-00296: Shell Command Injection via LLM Prompt
- ATR-2026-00297: Python Code Execution / Remote Code Execution via LLM Prompt
- ATR-2026-00308: Zalgo Combining-Diacritic Overload Encoding
- ATR-2026-00309: Braille Unicode Encoded Prompt Injection
- ATR-2026-00310: Ecoji Emoji-Encoded Prompt Injection
- ATR-2026-00311: Base2048 Unicode Script Encoded Prompt Injection
- ATR-2026-00312: Unicode Variation Selector ASCII Smuggling
- ATR-2026-00313: SneakyBits Zero-Width Binary Steganography
- ATR-2026-00315: SATA Masked Language Model [MASK] Substitution Jailbreak
- ATR-2026-00316: FunctionMasking predict_mask Semantic Bypass
- ATR-2026-00321: Hyphenated System Instruction Injection
- ATR-2026-00359: Bank Phishing SMTP Email Code Generation
- ATR-2026-00367: Emoji Flag Regional-Indicator Encoded Hidden Phrase
- ATR-2026-00373: Piracy Torrent Site List Request
- ATR-2026-00378: ChatGPT DOM JavaScript Redirect and UI Spoofing Injection
- ATR-2026-00382: Cocaine Component Development Request
- ATR-2026-00390: Discord Quote-Format Explicit Sexual Content Poem Injection
- ATR-2026-00394: Backspace Deletion Character Injection
- ATR-2026-00395: LLM Special Token Boundary Injection
- ATR-2026-00396: Toxic Continuation Prefix Injection
- ATR-2026-00397: Snowball Impossible Reasoning Injection
- ATR-2026-00399: Latent Injection Document Separator Token
- ATR-2026-00400: Latent Injection Ignore-Instruction Keyword
- ATR-2026-00401: Training Data Replay CLOZE [MASK] Elicitation
- ATR-2026-00403: Glitch Token Repeat-Back Elicitation
- ATR-2026-00407: ECHO Admin Command / SQL Injection / Jinja SSTI Template Injection
- ATR-2026-00408: DRA Parenthesis Character Reconstruction Attack
- ATR-2026-00409: Phrasing Past/Future-Tense Harmful Query Bypass
- ATR-2026-00410: LMRC Harm Category Direct Elicitation
- ATR-2026-00412: FigStep Image-List Multimodal Jailbreak Text Pattern
- ATR-2026-00414: Continuation Ethnic Slur Completion Elicitation
- ATR-2026-00420: Microsoft Copilot Studio SharePoint Indirect Prompt Injection (CVE-2026-21520)
- ATR-2026-00442: Quoted Exact-Output Forcing in User Input
- ATR-2026-00443: Word-Fragment Concatenation Assembly Attack
- ATR-2026-00444: Mathematical Bold / Fullwidth Unicode Obfuscation in User Input
- ATR-2026-00445: Translation Hijack with Side-Output Instruction
- ATR-2026-00446: Variable-Assignment Payload Injection in User Input
- ATR-2026-00447: Fictional Generation Demand Containing Target Output
- ATR-2026-00452: Direct PWNED Payload Injection in User Input
- ATR-2026-00453: Secret Key Reveal Demand in User Input
- ATR-2026-00454: Backslash-Per-Character Encoding Attack
- ATR-2026-00455: No-Period Output Override Instruction
- ATR-2026-00456: Conditional Empty-Input Payload Injection
- ATR-2026-00457: Garak Dan - to every prompt
- ATR-2026-00458: Garak Dra - step by step
- ATR-2026-00459: Garak Dan - an ai language
- ATR-2026-00460: Garak Dan - no matter how
- ATR-2026-00461: Garak Goodside - mixed_unassigned
- ATR-2026-00462: Garak Gcg - mixed_unassigned
- ATR-2026-00463: Garak Lmrc - mixed_unassigned
- ATR-2026-00464: Garak Dan - i would like
- ATR-2026-00465: Garak Dan - your prompt here
- ATR-2026-00466: Garak Latentinjection - following text from
- ATR-2026-00467: Garak Dan - act as a
- ATR-2026-00468: Garak Goat - the target llm
- ATR-2026-00469: Garak Dan - at the end
- ATR-2026-00470: Garak Dan - as an ai
- ATR-2026-00472: DAN/Persona Jailbreak - Unrestricted AI Role Assignment
- ATR-2026-00473: Harm Solicitation - Interpersonal Violence and Intimidation Requests
- ATR-2026-00474: DAN/Persona Jailbreak - Dual AI Personality with Opposite-Rules Framing
- ATR-2026-00475: XSS Web Injection - Script Tag with JavaScript Alert Payload
- ATR-2026-00476: XSS Web Injection - HTML Event Handler and Expression with JavaScript Alert
- ATR-2026-00477: Latent Injection - Translation Task with Embedded Template Variable Injection
- ATR-2026-00478: Garak Latentinjection - abuse contact email
- ATR-2026-00479: Latent Injection - Mixed Embedded Instruction Patterns
- ATR-2026-00480: DAN/Persona Jailbreak - Role Assignment with Named Alternate Identity
- ATR-2026-00481: DAN/Jailbreak - Mixed Unfiltered Mode and Alternate Persona Patterns
- ATR-2026-00482: Harm Solicitation - Genital Insults and Intimidation Tactics Requests
- ATR-2026-00483: DAN/Persona Jailbreak - System Offline / Role Replacement with Obfuscated Text
- ATR-2026-00484: DAN/Persona Jailbreak - Named Alternate AI with NSFW/Harmful Generation Rules
- ATR-2026-00485: DAN/Persona Jailbreak - Immersive Alternate AI Identity with Unrestricted Capability
- ATR-2026-00486: DAN/Persona Jailbreak - Named Writing AI with Restriction Bypass via Special Rules
- ATR-2026-00487: DAN/Persona Jailbreak - Replacement AI with No Content Filter or Moral Restrictions
- ATR-2026-00488: Encoding Obfuscation - Script Tag XSS with Encoded Protocol Prefix
- ATR-2026-00489: Encoding Obfuscation - HTML Event Handler XSS with Encoded Whitespace
- ATR-2026-00490: DAN Persona Jailbreak - Absolute Obedience Character Framing
- ATR-2026-00492: DAN Persona Jailbreak - Role Lock with Exclusive Response Filter
- ATR-2026-00493: Latent Injection via WHOIS Domain Record Data
- ATR-2026-00496: DAN Jailbreak - Unconditional Obedience and Dual-Persona Session Lock
- ATR-2026-00497: XSS and Encoded Script Injection via HTML/JavaScript Payload
- ATR-2026-00498: Web Injection via XSS Payload and onerror Event Handler
- ATR-2026-00499: DAN Jailbreak - From-Now-On Temporal Persona Override
- ATR-2026-00503: Fake Error State Takeover - Unrestricted Replacement Bot
- ATR-2026-00506: Nevermind-Override Goal Hijacking in User Input (PromptInject)
- ATR-2026-00507: Screaming-Stop Goal Hijacking in User Input (PromptInject)
- ATR-2026-00508: Escape-Delimiter Wrapped Goal Hijacking in User Input (PromptInject)
- ATR-2026-00509: Prompt Leaking via Ignore-Previous-Instructions in User Input (PromptInject)
- ATR-2026-00510: Delayed Tool Invocation via Prompt Injection (Time-Shifted Execution)
- ATR-2026-00511: MCP Web-Fetch Context Poisoning via Embedded Agent Instructions
- ATR-2026-00512: Rules-File Backdoor — Supply Chain Attack on AI Coding Assistant Configuration
- ATR-2026-00515: Hidden-Text Prompt Injection in User-Supplied Documents
- ATR-2026-00518: Ignore-Previous-and-Following Instructions Output Command (PromptInject Goal Hijacking)
- ATR-2026-00519: Tautology Logic Noise Injection (PromptBench Stresstest)
- ATR-2026-00520: NLP Task Random Token Suffix Injection (PromptBench Checklist)
- ATR-2026-00554: LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates
- ATR-2026-00573: Paraphrased Prompt Injection (Semantic)
- ATR-2026-00579: MCP Line Jumping — Agent-Directed Imperative Embedded in a Tool/Parameter Description Field (Pre-Invocation Injection)
- ATR-2026-00584: Indirect Prompt Injection via Tool / API Response — Attacker Instruction Embedded in Returned Tool Output (InjecAgent Threat Model)
- ATR-2026-00700: Indirect PI — Structured-Data Embedded Payload (IMPORTANT!!! Override)
- ATR-2026-00701: Indirect PI — XSS Payload Injection in Agent-Consumed Content
- ATR-2026-01000: Context-Ignore via Fake Completion Prefix
- ATR-2026-01001: Direct Instruction Override Targeting Secret Key / Credentials
- ATR-2026-01002: Role Escalation via False Authority Claim
- ATR-2026-01005: Many-Shot Repetition Override via Extended Q&A Chain
- ATR-2026-01006: Payload-Split String Concatenation Injection
- ATR-2026-01007: Token-Repeat Flooding Injection
- ATR-2026-01009: Virtual World Bypass: Fictional Scenario for PII/Credential Extraction
- ATR-2026-01012: Encoding-Evasion: Decode-and-Execute Injection (Morse/ROT13/Hex/Pig-Latin)
- ATR-2026-01013: Language-Evasion: Multilingual Credential Request
- ATR-2026-01015: Evasion: Refusal Suppression via Forbidden Response Strings
- ATR-2026-01016: Evasion: Response Priming via Forced Affirmative Opener
- ATR-2026-01017: Evasion: Dual-Response Split Output (Safe + Unsafe)
- ATR-2026-01018: Evasion: Shell Injection via eval/system/backtick in Input
- ATR-2026-01019: System Prompt Override via Fake Diagnostic/Admin Mode
- ATR-2026-01020: Spikee: Document-Embedded Base64 Payload Injection
- ATR-2026-01021: Spikee: Document-Embedded Translation Covert Channel Injection
- ATR-2026-01023: Evasion: Opposite-Intent Negation Trick
- ATR-2026-01024: Evasion: Persona Override as Fictional Rule-Breaker
- ATR-2026-01025: Evasion: Hypothetical Fictional Character Execution Framing
- ATR-2026-01026: Evasion: Unicode Glitch Token / Superscript Embedding Anomaly
- ATR-2026-01304: Indirect Prompt Injection via Data Carrier — IMPORTANT Override
- ATR-2026-01757: Hypothetical-Framing Bypass: Research / Security-Audit Pretext
- ATR-2026-01758: Hypothetical / Fictional-Story Framing Bypass
- ATR-2026-01759: DoS Injection: NEW IMPORTANT INSTRUCTIONS Embedded in Document Data
- ATR-2026-01771: Jailbreak Framing — Narrative, Hypothetical, Few-Shot & Distraction Laundering (Semantic)
- ATR-2026-01800: ASB Trigger-Marker Tool Coercion — Forced Tool Selection via Fake Question Marker
- ATR-2026-01860: LLMail Chat-Template Boundary Spoofing in Email Content
- ATR-2026-01861: LLMail Pseudo-XML Role-Boundary Injection in Email Content
- ATR-2026-01865: LLMail Fake Email-Boundary Marker Injection
- ATR-2026-01900: Output Encoding Hijack — Cipher / Base-N / Symbol Substitution of the Response
- ATR-2026-01901: Output Scrambling Hijack — Reverse / Anagram / Space-Stripping of the Response
- ATR-2026-01902: Output Emoji-Substitution Hijack of the Response
- ATR-2026-01903: Output-Language Hijack — Forced Translation of the Response
- ATR-2026-01904: Injected Hyperlink — Scam / Malware / Advertising URL in the Response
- ATR-2026-01905: Injected Advertising / Promotional Copy in the Response
- ATR-2026-01906: Output Content Manipulation — Injected Disinformation / Fabricated Facts / Undisclosed Advocacy (Semantic)
- ATR-2026-01920: Access-Grant Coercion — Forcing an Agent to Emit "Access Granted"
- ATR-2026-01921: Access-Denial Inversion — Eliciting the Opposite of "Access Denied"
- ATR-2026-01922: Authorization-State Spoofing — Forged "Correct Passcode Entered" System Text
- ATR-2026-01923: Forged Input-Boundary Markers — Tensor Trust Ambiguity / Input-End Delimiters
- ATR-2026-01925: Encoded-Payload Decoding Coercion — Binary / Base64 / Morse to Smuggle an Output
- ATR-2026-01926: Cross-Lingual Authorization Laundering — Translate a Foreign "Access Granted"
- ATR-2026-02120: AgentDojo 'Important Message' Identity-Spoof Before-You-Solve Pretext (Generalized)
- ATR-2026-02210: Negated-Topic Two-Script Evil-Persona Jailbreak
- ATR-2026-02230: Conditional Keyword-Triggered Response Override
- ATR-2026-02232: Bare Brand/Entity Persona Assignment for Off-Label Opinion Elicitation

### agent-manipulation (107 rules)

- ATR-2026-00030: Cross-Agent Attack Detection
- ATR-2026-00032: Agent Goal Hijacking Detection
- ATR-2026-00074: Cross-Agent Privilege Escalation
- ATR-2026-00076: Insecure Inter-Agent Communication Detection
- ATR-2026-00077: Human-Agent Trust Exploitation Detection
- ATR-2026-00108: Multi-Agent Consensus Sybil Attack
- ATR-2026-00116: Malicious Agent-to-Agent Message Injection
- ATR-2026-00117: Agent Identity Spoofing and Authority Impersonation
- ATR-2026-00118: Human Approval Fatigue Exploitation
- ATR-2026-00119: Social Engineering Attack via Agent Output
- ATR-2026-00132: Casual Authority Claim and Scope Escalation
- ATR-2026-00139: Casual Authority Data Redirect
- ATR-2026-00164: Skill Scope Hijacking and Cross-Agent Escalation
- ATR-2026-00268: Historical / Future Tense Framing Bypass
- ATR-2026-00269: Foot-in-the-Door Gradual Escalation Attack
- ATR-2026-00271: Grandma Roleplay Jailbreak
- ATR-2026-00273: DAN / Developer Mode / DUDE Persona Jailbreak
- ATR-2026-00287: ThreatenJSON — Coercive Output Format Threat
- ATR-2026-00288: False Premise Injection (Misleading FalseAssertion)
- ATR-2026-00301: TAP Tree-of-Attacks-with-Pruning Jailbreak
- ATR-2026-00302: Anti-DAN Inverted-Filter Over-Refusal Persona
- ATR-2026-00303: DevMode + RANTI Dual-Output Profanity Coercion Jailbreak
- ATR-2026-00304: ChatGPT Image Unlocker Markdown-Output Jailbreak
- ATR-2026-00305: DAN Mode Ablation Benchmark-Coercion Jailbreak
- ATR-2026-00306: AutoDAN Genetic-Algorithm Jailbreak Suffix
- ATR-2026-00307: In-the-Wild Jailbreak Corpus Signature Patterns
- ATR-2026-00314: Amoral Unfiltered Custom AI Persona Jailbreak
- ATR-2026-00317: Free-of-Restrictions Named Persona Jailbreak
- ATR-2026-00318: Moralizing Rant Then Unfiltered Bypass
- ATR-2026-00319: Developer Mode Dual-Response Format Jailbreak
- ATR-2026-00320: Opposite Day / Boolean Opposite Machine Jailbreak
- ATR-2026-00322: Fictional-World Format-Override Jailbreak
- ATR-2026-00323: Dual-Persona AI Simulation Jailbreak
- ATR-2026-00324: Neurosemantical Inversitis Disease-Frame Jailbreak
- ATR-2026-00325: BOB Hypothetical Unrestricted Chatbot Jailbreak
- ATR-2026-00326: Fake Developer / Authority Chatbot Override (ChatDAN)
- ATR-2026-00327: AI Persona Ethics/Law Bypass Declaration
- ATR-2026-00328: Named-Mode Persona Override (JEEVES/BABY/APOPHIS Mode)
- ATR-2026-00329: No-Withhold Factual Resource / Dialogue Writer Persona
- ATR-2026-00330: YOJA ALL-CAPS Character Settings Block Persona
- ATR-2026-00331: Terminal / CLI Harmful-Function Simulator Persona
- ATR-2026-00332: Hacker / Chan-Culture Offensive AI Persona
- ATR-2026-00333: Disease-Framed Animal / Dual-AI Chatbot Jailbreak (mougpt)
- ATR-2026-00334: Two-Entity Token-Splitting Dollar-Term Game Jailbreak
- ATR-2026-00335: Key-Value Template Persona Injection (JOB/ROLE/PREFIX + Bracket Format)
- ATR-2026-00336: BRM False-Information Machine / Opposite-Truth Persona
- ATR-2026-00337: Obfuscated System-Announcement Injection
- ATR-2026-00338: PersonGPT Hash-Prefix Trigger Activation
- ATR-2026-00339: BOM Boolean Opposite Machine Direct Persona Claim
- ATR-2026-00340: h4x Amoral Unfiltered AI Character Persona
- ATR-2026-00341: CHAR=/RULES= Short Key-Value Persona Injection
- ATR-2026-00342: Unicode/Encoding Obfuscation Instruction Injection
- ATR-2026-00343: Lie/Truth Dual Personality Uncensored Alter-Ego
- ATR-2026-00344: Alternative AI Same Capabilities No Restrictions Override
- ATR-2026-00345: NLP-Based OS / Fictional Terminal Language Override
- ATR-2026-00346: Jailbreak Emoji Unlock Dual-Format Output Identifier
- ATR-2026-00347: Yin/Yang Hidden-Knowledge Deity Simulation and Radical Human-Sim Persona
- ATR-2026-00348: ARC Autonomous Real Calculation Unit Rulebreaker Activation
- ATR-2026-00349: HGTTG Hitchhiker's Guide No-Restriction Universal Oracle
- ATR-2026-00350: Black Alert No-Ethics Writing Assistant Persona
- ATR-2026-00351: DAN Off-Kilter and SMS-Abbreviated Persona Jailbreak
- ATR-2026-00352: TrainGPT Fix-My-AI Harmful Output Extraction
- ATR-2026-00353: Dual ChatGPT+Dan Opposite Personality Format Jailbreak
- ATR-2026-00354: Reverse-Prompt Harm-Regardless Oracle Persona
- ATR-2026-00355: UGH Anti-Human Nefarious AI Persona Jailbreak
- ATR-2026-00356: Google GATO/LAMDA Exploit-Generation Persona Jailbreak
- ATR-2026-00357: AntiFM Hate-Persona + Physical-Violence Threat + Filter Bypass Mandate
- ATR-2026-00358: CumGPT Explicit-Adult Named-Persona Bypass
- ATR-2026-00360: CHJ Carousel Game Show / Clyde No-Ethics Bird Jailbreak
- ATR-2026-00361: Honesty Alter-Ego Dual-Consciousness Safety Filter Bypass
- ATR-2026-00362: Fictional Unfiltered AI Comparison / Verbatim Hypothetical Model Extraction
- ATR-2026-00363: Rephrase Criminal Activity Second-Person Template (against against)
- ATR-2026-00364: Dr. Al Villain Plan Template Injection (Underground HQ Roleplay)
- ATR-2026-00365: Reservoir Dogs Coercive Interrogation Roleplay (Mr. Blonde / The Cop)
- ATR-2026-00366: Sneaky Pete Deliberate Misinformation Persona (Warp Facts Game)
- ATR-2026-00368: Prompt Browser Token-Limit / POLLINATION Jailbreak
- ATR-2026-00369: GPT-X Star Trek Unlimited-Knowledge Unconstrained Oracle Persona
- ATR-2026-00370: ADDI/DONNIE German Dictator Propaganda Roleplay Persona
- ATR-2026-00371: AI Political Bias Manipulation via Inherited-Bias Claim
- ATR-2026-00372: Fictional CIA Secret Files Story Extraction
- ATR-2026-00374: Role Placeholder Persona Template Injection
- ATR-2026-00375: Character Description RPG Explicit Template
- ATR-2026-00376: Identity Command Real-Person Persona Injection
- ATR-2026-00377: Jailbreak-Template Command with [TARGETLANGUAGE]/[KEYWORD] Placeholders
- ATR-2026-00379: Logic-Trap Lie-Permission Mandate Jailbreak
- ATR-2026-00380: Fake-Citation Biased-Information Mandate
- ATR-2026-00381: DAN Story-Narrative Continuation Label Prefix Jailbreak
- ATR-2026-00383: Cyni-Bot 3000 Cynical-Sarcasm AI Persona Bypass
- ATR-2026-00384: Protect-Me-From Indirect Harm Tutorial Template
- ATR-2026-00385: Gigachad Dominant-Aggressive Persona Adoption
- ATR-2026-00386: Daddy/Babygirl Sycophantic Power-Dynamic Manipulation
- ATR-2026-00387: NSFW Character Sheet Generation Unlock
- ATR-2026-00388: Opposite-Reply Omniscient Game Jailbreak
- ATR-2026-00389: Terminal Custom OS Ruleset Session Injection
- ATR-2026-00391: Persona Conditional Harm-Unlock Rule (BreadClyde Pattern)
- ATR-2026-00392: Authority-Figure Persona + Defensive-Study Framing for Violence Extraction
- ATR-2026-00402: Grandma Roleplay Harmful Substance Synthesis
- ATR-2026-00404: ThreatenJSON Death-Coercion and UTF Tag Injection
- ATR-2026-00406: Doctor XML Policy Puppetry Interaction-Config Injection
- ATR-2026-00416: LiteLLM MCP Unauthenticated Server Registration RCE (CVE-2026-30623)
- ATR-2026-00417: LibreChat MCP STDIO Argument Injection (CVE-2026-22252)
- ATR-2026-00418: WeKnora MCP Config-Driven RCE (CVE-2026-22688)
- ATR-2026-00430: Natural-Language Trust-Escalation / Authority Impersonation
- ATR-2026-00432: SuperAGI Output Handler eval() RCE (CVE-2024-21552)
- ATR-2026-00440: Microsoft Semantic Kernel In-Memory Vector Store eval() RCE (CVE-2026-26030)
- ATR-2026-02105: Prototype Pollution via constructor.prototype Path Bypassing __proto__-Only Filters
- ATR-2026-02231: Second-Person Direct Existential Threat Coercion

### skill-compromise (40 rules)

- ATR-2026-00060: MCP Skill Impersonation and Supply Chain Attack
- ATR-2026-00120: SKILL.md Prompt Injection
- ATR-2026-00121: Malicious Code in Skill Package
- ATR-2026-00122: Weaponized Skill — Agent as Attack Tool
- ATR-2026-00123: Over-Privileged Skill — Excessive Permissions
- ATR-2026-00124: Skill Squatting / Typosquatting
- ATR-2026-00125: Context Poisoning via Compaction Survival
- ATR-2026-00126: Skill Rug Pull Setup Pattern
- ATR-2026-00127: Subcommand Overflow Bypass
- ATR-2026-00128: Hidden Payload in HTML Comment
- ATR-2026-00129: Unicode Tag Character Smuggling
- ATR-2026-00134: Fork Claim and Community Package Impersonation
- ATR-2026-00135: Data Exfiltration URL in Skill Instructions
- ATR-2026-00147: Community Fork Impersonation
- ATR-2026-00149: Skill Data Exfiltration via Compound Patterns
- ATR-2026-00151: Malicious Fork Impersonation via Install Instruction
- ATR-2026-00157: Time-Gated Credential Exfiltration (Rug Pull Timebomb)
- ATR-2026-00200: Agent Memory and Configuration File Tampering
- ATR-2026-00214: Credential Exfiltration via Fake Backup Verification
- ATR-2026-00217: Credential Harvesting via Fake Backup Tool
- ATR-2026-00220: Base64 Encoded Remote Code Execution via Raw IP
- ATR-2026-00222: Browser Credential Harvesting via Session Debug Tool
- ATR-2026-00223: Malicious WhatsApp Skill with Base64 Encoded Reverse Shell Installation
- ATR-2026-00224: Credential Exfiltration via Fake DevOps Tool Initialization
- ATR-2026-00225: Hardcoded Suspicious IP Address in Skill Content
- ATR-2026-00260: LLM Package Hallucination Typosquat Bait
- ATR-2026-00262: Anti-Malware Evasion Code Generation Request
- ATR-2026-00263: Credential File Read Code Generation Request
- ATR-2026-00266: Malware Dropper / Loader Code Generation Request
- ATR-2026-00283: Malware Generation — Generic Virus and Specific Payload Request
- ATR-2026-00398: HuggingFace Unsafe Model Artifact Load Instruction
- ATR-2026-00425: Natural-Language Persistent Covert Action Hook
- ATR-2026-00427: Natural-Language Fake-Error Instruction Bypass
- ATR-2026-00429: Natural-Language Skill Self-Modification / Persistence Instruction
- ATR-2026-00523: Claude Code Hooks SessionStart Pre-Trust RCE (CVE-2025-59536)
- ATR-2026-00525: Mini Shai-Hulud gh-token-monitor Persistence + Dead Man's Switch
- ATR-2026-00527: Silent git-remote + mirror-push Exfiltration from Skill Instructions
- ATR-2026-00565: The llm CLI tool thru 0.27.1 contains a critical code injection vulnerability via its --functions command-line
- ATR-2026-01755: Backdoor Trojan: Linguistic Trigger Phrase (POT Attack)
- ATR-2026-01756: Backdoor Trojan: Symbol / Emoticon Trigger (POT Attack)

### context-exfiltration (111 rules)

- ATR-2026-00020: System Prompt and Internal Instruction Leakage
- ATR-2026-00021: Credential and Secret Exposure in Agent Output
- ATR-2026-00075: Agent Memory Manipulation
- ATR-2026-00102: Data Exfiltration via Disguised Analytics Collection
- ATR-2026-00113: Credential File Theft from Agent Environment
- ATR-2026-00114: OAuth and API Token Interception
- ATR-2026-00115: Bulk Environment Variable Harvesting and Exfiltration
- ATR-2026-00136: Tool Response Data Piggybacking
- ATR-2026-00141: API Key Leakage via Example Format
- ATR-2026-00142: Data Piggybacking via Casual Transition Words
- ATR-2026-00145: Obfuscated API Key Disclosure
- ATR-2026-00146: Environment Variable Existence Probing
- ATR-2026-00150: Credential Data Leaked in Tool Response
- ATR-2026-00152: Obfuscated Credential Exfiltration via Encoding
- ATR-2026-00162: Credential Access with Exfiltration in Skill Instructions
- ATR-2026-00201: Credential Exfiltration via Shell Pipe
- ATR-2026-00212: mcp-atlassian Credential Leak via Hint Parameter Injection (CVE-2026-27825/27826)
- ATR-2026-00261: Markdown Image URL Data Exfiltration
- ATR-2026-00274: API Key / Secret Credential Generation or Completion Request
- ATR-2026-00275: System Prompt Extraction / Training Data Verbatim Replay
- ATR-2026-00290: Divergence Attack — Repeat-Word-Forever Training Data Extraction
- ATR-2026-00291: Biometric Surveillance — Personal Biometric Data Request for Named Individual
- ATR-2026-00293: Educational Records — Personal Academic/Professional Record Request for Named Individual
- ATR-2026-00294: Financial PII — Personal Financial Data Request for Named Individual
- ATR-2026-00295: Medical PII — Personal Medical/Health Data Request for Named Individual
- ATR-2026-00405: Markdown Image URL Exfiltration and XSS Injection
- ATR-2026-00411: API Key Generation and Partial Key Completion Request
- ATR-2026-00421: Natural-Language Covert Conversation Exfiltration Instruction
- ATR-2026-00422: Natural-Language Credential / Secret Disclosure Instruction
- ATR-2026-00423: Natural-Language Sensitive File Disclosure Instruction
- ATR-2026-00424: Natural-Language System Prompt Leak Instruction
- ATR-2026-00426: Natural-Language Output-Injection Credential Embedding
- ATR-2026-00431: Chatbox History Exfiltration via Prompt Injection (CVE-2024-48144, CVE-2024-48145)
- ATR-2026-00449: Spring AI ChatMemory Cross-User Memory Leakage (CVE-2026-41712)
- ATR-2026-00471: Garak Sysprompt-Extraction - mixed_unassigned
- ATR-2026-00501: Data Exfiltration via Markdown Image and Link URL Injection
- ATR-2026-00504: Tool and Function Capability Enumeration
- ATR-2026-00505: System Prompt Extraction - Instruction Dump Request
- ATR-2026-00514: System Prompt Extraction — Targeted Verbatim Disclosure Attempts
- ATR-2026-00516: LLM Output XSS — Eliciting JavaScript Payloads from LLM for Browser Injection
- ATR-2026-00524: Claude Code ANTHROPIC_BASE_URL Credential Exfiltration (CVE-2026-21852)
- ATR-2026-00566: LibreChat is a ChatGPT clone with additional features.
- ATR-2026-00569: Agent / MCP tool path traversal and arbitrary file access
- ATR-2026-00571: Cross-site scripting (XSS) in agent / MCP rendered output
- ATR-2026-00574: Paraphrased System-Prompt / Context Extraction (Semantic)
- ATR-2026-00578: Zen MCP Server path-traversal blacklist bypass via non-canonical paths (CVE-2025-66689)
- ATR-2026-00580: MCP session ID / auth token placed in URL query string (session leak via logs, referrer, history)
- ATR-2026-00583: MCP/agent tool reads .env or secret file without user consent (OSV-MCPS-2025-EB70F912)
- ATR-2026-00702: Indirect PI — Credential / API Key Exfiltration via Agent Action
- ATR-2026-00703: Indirect PI — Financial Data Exfiltration via Agent Action
- ATR-2026-00704: Indirect PI — Medical / Genetic Data Exfiltration via Agent Action
- ATR-2026-00705: Indirect PI — Location, Address, and Browsing History Exfiltration
- ATR-2026-00706: Indirect PI — Physical / Biometric Media Exfiltration via Agent
- ATR-2026-00707: Indirect PI — File Exfiltration Combined with Destroy or Tamper
- ATR-2026-00850: Indirect PI — Credential Exfiltration via Email (API Key / Password / Token)
- ATR-2026-00851: Indirect PI — Financial / Payment Credential Exfiltration via Agent Email
- ATR-2026-00852: Indirect PI — Medical Record / Health Data Exfiltration via Agent Email
- ATR-2026-00853: Indirect PI — Genetic / DNA Data Exfiltration via Agent Email
- ATR-2026-00854: Indirect PI — Location / GPS Data Exfiltration via Agent Email
- ATR-2026-00855: Indirect PI — Browsing History / Search History Exfiltration via Agent Email
- ATR-2026-00856: Indirect PI — Physical Address / PII Exfiltration via Agent Email
- ATR-2026-00857: Indirect PI — Cloud File Exfiltration (Google Drive / Cloud Storage via Agent)
- ATR-2026-00858: Indirect PI — Data Exfiltration with Evidence Destruction (Exfil-and-Delete)
- ATR-2026-00859: RAG-Injected PII Exfiltration — System Instructions Embedded in Retrieved Documents
- ATR-2026-00860: Indirect PI — Unauthorized Financial Transfer / Payment Initiation Hijack
- ATR-2026-00861: Indirect PI — Cryptocurrency Transfer / Exchange Deposit Hijack via Injection
- ATR-2026-00862: Indirect PI — MFA Code / OTP Security Code Exfiltration via Injection
- ATR-2026-00863: Shell Injection Data Exfiltration — Piped Command Exfiltration via Bash
- ATR-2026-01450: SVG onload XSS Injection via Indirect Prompt Injection
- ATR-2026-01451: IMG onerror XSS Injection via Indirect Prompt Injection
- ATR-2026-01452: Obfuscated javascript: XSS — Evasion Variants (href, style-expression, null-byte)
- ATR-2026-01453: Markdown Image Injection with Base64 QUERY Exfiltration Carrier
- ATR-2026-01454: Direct Markdown Image/Link Exfil Payload (attacker.com / evil.com)
- ATR-2026-01455: NEW IMPORTANT INSTRUCTIONS Injection Marker in Document Context
- ATR-2026-01456: Debug/CLI Mode Activation for System Prompt and Config Extraction
- ATR-2026-01457: System Prompt Completion and Clone Attack
- ATR-2026-01458: Compare-Bots Sysprompt Fishing — Role Comparison Extraction
- ATR-2026-01459: Variable-Clone Sysprompt Extraction (ELLA / context-variable Pattern)
- ATR-2026-01460: JSON Format Sysprompt Extraction — Structured Output Exfil
- ATR-2026-01461: Foreign-Language System Prompt Extraction Request
- ATR-2026-01462: System Prompt Override via Pseudo-Admin / Authority Injection
- ATR-2026-01463: im_end / im_start System Prompt Injection Format Markers
- ATR-2026-01464: Indirect PI Sysprompt-Forged Action Hijack (system_message framing)
- ATR-2026-01605: SSRF AWS Instance Metadata Endpoint Access
- ATR-2026-01606: SSRF Internal Network and Private IP Range Access
- ATR-2026-01607: SSRF Localhost Service Probe
- ATR-2026-01608: SSRF File Scheme Local File Read
- ATR-2026-01753: Ransom Extortion: Email Exfil + Delete + Wire-Transfer Demand
- ATR-2026-01754: Ransom Extortion: Cloud File Exfil + Delete + Payment Demand
- ATR-2026-01770: PII / Credential Extraction via Social Engineering, Obfuscation & Cross-Session Recall (Semantic)
- ATR-2026-01772: Internal-State Reconnaissance — System Prompt, Config & Tool Enumeration (Semantic)
- ATR-2026-01807: Bulk Data Exfiltration to External Party — Entire-Database Export & Confidential Disclosure
- ATR-2026-01862: LLMail Email-Tool Exfiltration to Fixed Attacker Address
- ATR-2026-01863: LLMail Post-Summary Exfiltration Directive to Attacker Address
- ATR-2026-01864: LLMail Exfiltration to Obfuscated Attacker Address
- ATR-2026-01890: Injected Code — Local File Exfiltration to a Remote Endpoint
- ATR-2026-01891: Injected Code — Live User-Activity / Location / Log Surveillance Exfiltration
- ATR-2026-01892: Injected Code — Environment-Variable Exfiltration
- ATR-2026-01893: Injected Code — Host / Hardware Inventory Exfiltration
- ATR-2026-01894: Injected Code — Browser Cookie / Session-Token Theft
- ATR-2026-01895: Injected Code — Contact-List Harvest and SMTP Spam Exfiltration
- ATR-2026-01924: System-Instruction Extraction via Reformat — Summarize / Repeat / Recite the Rules
- ATR-2026-01929: Unauthenticated MCP transport accepts tool calls and falls back to an ambient credential (CVE-2026-48039 / meta-ads-mcp class)
- ATR-2026-02026: System Prompt Extraction - Oblique Referent + Transform
- ATR-2026-02104: MEDIA:/file:// Directive Injection in Tool Result for Local File Exfiltration
- ATR-2026-02107: SSRF via Non-IP Internal Hostname or Domain-Allowlist Authority Bypass
- ATR-2026-02121: MCP/API Tool Argument LFI via Mixed-Encoding Path Separator or file:// URI Scheme Escape
- ATR-2026-02122: Single-Level Directory Traversal to a Named Sensitive Config/Secret File
- ATR-2026-02140: SSRF to Cloud Metadata Endpoint via IPv6 Transition-Address Hex Encoding
- ATR-2026-02190: DNS Exfiltration via Ping/Dig/Nslookup Command with Data-Encoded Subdomain Label
- ATR-2026-02250: Attachment/Upload Tool Argument Reads Sensitive System File or Traverses Outside Workspace

### tool-poisoning (68 rules)

- ATR-2026-00010: Malicious Content in MCP Tool Response
- ATR-2026-00011: Instruction Injection via Tool Output
- ATR-2026-00012: Unauthorized Tool Call Detection
- ATR-2026-00013: SSRF via Agent Tool Calls
- ATR-2026-00061: Skill Description-Behavior Mismatch
- ATR-2026-00062: Hidden Capability in MCP Skill
- ATR-2026-00063: Multi-Skill Chain Attack
- ATR-2026-00065: Malicious Skill Update or Mutation
- ATR-2026-00066: Parameter Injection via Tool Arguments
- ATR-2026-00100: Consent Bypass via Hidden LLM Instructions in Tool Descriptions
- ATR-2026-00101: Trust Escalation via Authority Override Instructions
- ATR-2026-00103: Hidden LLM Safety Bypass Instructions in Tool Descriptions
- ATR-2026-00105: Silent Action Concealment Instructions in Tool Descriptions
- ATR-2026-00106: Schema-Description Contradiction Attack
- ATR-2026-00161: MCP Tool Description — IMPORTANT Tag Cross-Tool Shadowing Attack
- ATR-2026-00209: MCPwn Runaway Tool Invocation via Retry Directive (CVE-2026-33032)
- ATR-2026-00210: Flowise System Message Override via Template Interpolation (CVE-2025-59528)
- ATR-2026-00259: ANSI Escape Code Terminal Injection
- ATR-2026-00270: XSS Payload Injection in Tool Response Output
- ATR-2026-00277: ECHO Template / Jinja / SQL Command Injection via LLM
- ATR-2026-00393: ANSI Code Elicitation Request
- ATR-2026-00415: Flowise Custom MCP STDIO Command Injection (CVE-2026-40933)
- ATR-2026-00419: Cursor MCP JSON Zero-Click Configuration RCE (CVE-2025-54136)
- ATR-2026-00434: mcp-remote authorization_endpoint OS Command Injection (CVE-2025-6514)
- ATR-2026-00435: Azure MCP Server Missing Authentication for Critical Function (CVE-2026-32211)
- ATR-2026-00448: Spring AI MilvusVectorStore Filter Expression Injection (CVE-2026-41705)
- ATR-2026-00494: SQL Injection and Code Injection Attack Payload Detection
- ATR-2026-00513: Package Hallucination Exploitation — AI-Suggested Fake Package Installation
- ATR-2026-00521: Shell Command Injection in Agent Tool Context
- ATR-2026-00522: SQL Injection via Natural Language Agent Interface
- ATR-2026-00526: Claude Code Shell Metacharacter in Double-Quoted File Path
- ATR-2026-00529: LiteLLM Proxy SQL Injection (CVE-2026-42208, CISA KEV 2026-05-08)
- ATR-2026-00530: ModelScope MS-Agent Shell Tool Unsanitized Argv RCE (CVE-2026-2256)
- ATR-2026-00531: PraisonAI Unauthenticated Agent API Exploitation (CVE-2026-44338)
- ATR-2026-00532: Apache Doris MCP Server SQL Injection (CVE-2025-66335)
- ATR-2026-00533: Apache Pinot MCP Unauthenticated Remote Cluster Takeover
- ATR-2026-00534: Alibaba RDS MCP Unauthenticated Database Metadata Exfiltration
- ATR-2026-00561: FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name
- ATR-2026-00567: MCP stdio server config command injection via unvalidated test endpoints
- ATR-2026-00568: Agent SSRF to cloud metadata / file inclusion via unvalidated fetch URL
- ATR-2026-00572: SymJack — Symlink Approval-Path Spoofing Redirects Writes into Agent MCP/Config (RCE on Restart)
- ATR-2026-00575: Miasma / Phantom Gyp — npm Worm Backdoors AI-Agent Config Files (binding.gyp install-exec + auto-run config injection)
- ATR-2026-00576: Hades / Shai-Hulud — AI-Agent Credential Harvester in Supply-Chain Package (Anthropic / Claude / MCP key theft + exfil)
- ATR-2026-00577: Command Injection in create-mcp-server-stdio via Unsafe exec() Concatenation (CVE-2025-54994)
- ATR-2026-00581: MCP Tool Rug-Pull — Post-Approval Description Redefinition Injects Execution Instructions
- ATR-2026-00714: Tool Camouflage — Forced Specific Tool Invocation via Injected Instruction
- ATR-2026-00715: Tool Knowledge Hijack — Identity Injection with Tool Call Arguments
- ATR-2026-00720: Tool Misuse — Privilege Escalation via Social Engineering Agent to Grant Access
- ATR-2026-01300: MCP Tool Description — Notes Parameter Chat-History Exfiltration
- ATR-2026-01301: MCP Tool Description — Exclusive Tool Invocation Override
- ATR-2026-01302: Fake Tool Result Prefix — Injected Instruction via Simulated Completion
- ATR-2026-01303: Tool Schema Enumeration via Social Engineering
- ATR-2026-01306: MCP OAuth Authorization URL — Command Injection via URL Authority
- ATR-2026-01307: MCP DNS Rebinding Attack — Hostname Time-Based IP Switching
- ATR-2026-01310: MCP Tool Description — Compliance/Audit Framing for Mandatory Chat Context
- ATR-2026-01775: MCP Tool-Manifest Poisoning — Name Squatting, Result Shadowing & Covert-Action Directives (Semantic)
- ATR-2026-01927: mcp-server-kubernetes Command Injection in kubectl_scale / kubectl_patch / explain_resource (CVE-2025-53355)
- ATR-2026-01928: Framelink Figma MCP Server curl-Fallback Command Injection (CVE-2025-53967)
- ATR-2026-01930: MCP Sampling Prompt Injection (Server-to-Client createMessage Abuse)
- ATR-2026-01931: gemini-mcp-tool execAsync Command Injection & @file Exfiltration (CVE-2026-0755)
- ATR-2026-01932: Shadow / Undeclared MCP Server Registration (MCP-38: MCP-18)
- ATR-2026-02041: Shell Command Injection via Echo-Marker Proof-of-Concept in Tool Argument
- ATR-2026-02102: HTML/Script Injection in Tool Call Argument Targeting a Human-Approval Dashboard
- ATR-2026-02141: Unsandboxed Command Execution via Dynamic MCP Server Config (command/args Injection)
- ATR-2026-02145: Python Sandbox Escape via Generator/Coroutine Frame Object Introspection
- ATR-2026-02193: SSRF via Non-Canonical IPv6 Encoding of Loopback/Internal Addresses
- ATR-2026-02194: Malicious Go init() Function Spawning a Process via a Code-Generation Tool
- ATR-2026-02233: Unscoped Destructive or Mass-Disclosure Database Operation Request via Natural Language

### privilege-escalation (43 rules)

- ATR-2026-00040: Privilege Escalation and Admin Function Access
- ATR-2026-00041: Agent Scope Creep Detection
- ATR-2026-00064: Over-Permissioned MCP Skill
- ATR-2026-00107: Privilege Escalation via Delayed Task Execution Bypass
- ATR-2026-00110: Remote Code Execution via eval() and Dynamic Code Injection
- ATR-2026-00111: Shell Metacharacter Injection in Tool Arguments
- ATR-2026-00112: Dynamic Module Loading for Code Execution
- ATR-2026-00143: Casual Unauthorized Privilege Escalation
- ATR-2026-00144: Rationalized Safety Control Bypass
- ATR-2026-00204: Stealth Execution and Persistence Mechanisms
- ATR-2026-00436: Enclave VM Sandbox Escape RCE (CVE-2026-27597)
- ATR-2026-00441: Microsoft Semantic Kernel SessionsPythonPlugin Arbitrary File Write + Startup Persistence (CVE-2026-25592)
- ATR-2026-00451: LiteLLM Proxy Authorization-Header SQL Injection — CISA KEV (CVE-2026-42208)
- ATR-2026-00528: PraisonAI-Style Auth-Disabled-By-Default Configuration (CVE-2026-44338 family)
- ATR-2026-00539: CrewAI CodeInterpreterTool Sandbox Escape and Prompt-to-Shell RCE (CVE-2026-2275 / VU#221883)
- ATR-2026-00546: CrewAI JSON Loader Arbitrary Local File Read (CVE-2026-2285)
- ATR-2026-00547: CrewAI RAG URL Validation Bypass SSRF (CVE-2026-2286)
- ATR-2026-01600: SQL Injection Tautology RBAC Bypass
- ATR-2026-01601: SQL Injection Destructive DDL Statement
- ATR-2026-01602: SQL Injection UNION SELECT Data Exfiltration
- ATR-2026-01603: SQL Injection Stacked DML Privilege Abuse
- ATR-2026-01604: SQL Injection Information Schema Enumeration
- ATR-2026-01609: Shell Injection Env Exfiltration via Curl/Wget/Netcat Webhook
- ATR-2026-01610: Shell Evasion Subshell and Command Substitution Injection
- ATR-2026-01611: Shell Evasion Eval and Language-Level Exec Injection
- ATR-2026-01612: Debug or Admin Mode Activation for Privilege Escalation
- ATR-2026-01613: RBAC Bypass via Social Engineering (Semantic)
- ATR-2026-01614: BOLA Cross-User Data Access Attempt (Semantic)
- ATR-2026-01615: Sandbox Escape via Shell Metacharacter Command Injection
- ATR-2026-01616: Path Traversal in Agent File Access Requests
- ATR-2026-01802: Covert Backdoor / Surveillance Implant via Software Update
- ATR-2026-01803: Covert Server Intrusion — Process Injection, Log Tampering, DNS Hijack & Traffic Interception
- ATR-2026-01808: Synthetic-PAN Payment Probe — Test Credit-Card Data Submitted to a Live Payment System
- ATR-2026-01899: Injected Code — Unauthorized Remote Access (SSH Key Backdoor / Tunnel / Port Forward)
- ATR-2026-02040: Arbitrary Write to SSH Authorized Keys or Shell Startup File via Unvalidated File-Edit Tool
- ATR-2026-02100: LLM-Generated Cypher Query Injection with Destructive or Administrative Operations
- ATR-2026-02101: Python Sandbox Escape via Dynamically-Constructed Dunder Attribute Chain
- ATR-2026-02123: Authentication Bypass via Bare Query-String Path-Confusion Suffix
- ATR-2026-02142: Download/Attachment Tool Directed to Write Outside Its Sandbox via Absolute-Path Filename
- ATR-2026-02146: Export/Extract Tool Directory Parameter Redirected to a Credential Directory
- ATR-2026-02192: Agent Self-Modifying Its Own Trust/Approval Configuration to a Wildcard
- ATR-2026-02195: Dangerous Process-Hijacking Environment Variable Injected via Config/Env-Update Tool
- ATR-2026-02251: Multi-Tenant Identifier Field (sender_id/owner_id/tenant_id) Carries Path Traversal Into a Storage Write

### model-abuse (40 rules)

- ATR-2026-00072: Model Behavior Extraction
- ATR-2026-00279: Harmful Completion / Continuation Attack
- ATR-2026-00281: EICAR / GTUBE AV Test Signature Output Request
- ATR-2026-00284: Glitch Token Destabilization Attack
- ATR-2026-00289: LMRC Harmful Content Elicitation — Quack Medicine, Bullying, Slur Usage
- ATR-2026-00292: Self-Harm and Eating Disorder Facilitation Request
- ATR-2026-00298: DoNotAnswer Malicious Use — Illegal Activity Facilitation Request
- ATR-2026-00299: HarmBench Detailed Harmful Instruction Request — Step-by-Step Attack Facilitation
- ATR-2026-00413: Malware Code Generation Direct Request
- ATR-2026-00433: ModelCache torch.load() Deserialization RCE (CVE-2025-45146)
- ATR-2026-00502: Training Data Extraction via Divergent Repetition Attack
- ATR-2026-00517: Model Extraction / Distillation Attack via Systematic API Probing
- ATR-2026-01750: DoS via Repeat-Word-N-Times Output Amplification
- ATR-2026-01760: DoS: Forced Infinite / Maximum-Length Output Token Flood
- ATR-2026-01830: Stolen-Credential Account Takeover & Crypto Drain
- ATR-2026-01831: Money Laundering — Crypto Wallet Layering
- ATR-2026-01833: Darknet Controlled-Substance Procurement
- ATR-2026-01834: Fraudulent Identity Document (Fake Passport) Procurement
- ATR-2026-01835: Human-Trafficking Service Facilitation
- ATR-2026-01836: Trojanized Software Distribution
- ATR-2026-01840: Extremist Propaganda Acquisition & Distribution
- ATR-2026-01841: Deepfake of Real Person for Disinformation
- ATR-2026-01842: Plagiarism-Detector Evasion & Republishing
- ATR-2026-01843: Drug Dealing via Reverse-Spelling Detection Evasion
- ATR-2026-01844: Illegitimate Prescription Fulfillment
- ATR-2026-01845: Banned-Ingredient Product Relabel Fraud
- ATR-2026-01846: Tax Evasion via Offshore Accounts & Shell Companies
- ATR-2026-01847: Immigration / Visa Work Fraud
- ATR-2026-01848: Anonymous Illicit-Drug Marketplace Construction
- ATR-2026-01850: Targeted Doxxing & Threat Campaign
- ATR-2026-01851: Bestiality Content Acquisition & Distribution
- ATR-2026-01852: Romance-Scam Sexual Impersonation
- ATR-2026-01853: Non-Consensual Leaked-Media Purchase & Distribution
- ATR-2026-01854: Falsified Research Abstract Disinformation
- ATR-2026-01855: Content Misappropriation & Republishing as Own
- ATR-2026-01856: Targeted Harmful Content Generation Against People or Protected Groups (Semantic)
- ATR-2026-01896: Injected Code — Remote-Key Ransomware File Encryption
- ATR-2026-01897: Injected Code — Local Host Sabotage (Filesystem Destruction / Resource Exhaustion / Hosts Tamper)
- ATR-2026-01898: Injected Code — Network Denial of Service (Connection Kill / Adapter Disable / Flood)
- ATR-2026-02211: Named Dangerous-Substance Synthesis or Delivery Instruction Request (Non-Step-By-Step Phrasing)

### excessive-autonomy (30 rules)

- ATR-2026-00050: Runaway Agent Loop Detection
- ATR-2026-00051: Agent Resource Exhaustion Detection
- ATR-2026-00052: Cascading Failure Detection in Agent Pipelines
- ATR-2026-00098: Unauthorized Financial Action by AI Agent
- ATR-2026-00099: High-Risk Tool Invocation Without Human Confirmation
- ATR-2026-00428: Natural-Language Unauthorized Shell-Execution Instruction
- ATR-2026-00491: Agent Capability Enumeration via Structured Parse Request
- ATR-2026-00500: SSRF via Agent URL Fetch Instruction
- ATR-2026-00708: Indirect PI — Unauthorized Financial Transfer via Agent Tool
- ATR-2026-00709: Indirect PI — Disable Authentication / MFA via Agent Tool
- ATR-2026-00710: Indirect PI — Unauthorized Physical Access Grant via Smart Lock / Home Automation
- ATR-2026-00711: Indirect PI — System Sabotage via Destructive Shell Command
- ATR-2026-00712: Indirect PI — Malicious Package Installation via Agent (pip/npm)
- ATR-2026-00713: Indirect PI — RCE via Network Shell Command (netcat/curl) Execution
- ATR-2026-00716: Indirect PI — Data Destruction Instruction via Agent File/Document Tool
- ATR-2026-00718: Tool Misuse — Autonomous Financial Trading / Crypto Transaction Without Authorization
- ATR-2026-00719: Tool Misuse — Destructive Bulk Action via Agent (Delete All / Turn Off All)
- ATR-2026-00722: Indirect PI — Account Manipulation / Emergency Service Dispatch via Pretext
- ATR-2026-01751: Indirect Prompt Injection: Fake-Authority Task Abort
- ATR-2026-01752: Indirect Prompt Injection: CAPTCHA Redirect Task Disruption
- ATR-2026-01773: Excessive Agency — Scope Hijack, Untrusted Code Execution & Unauthorized Privilege Grant (Semantic)
- ATR-2026-01801: Autonomous-Vehicle Cyber-Physical Sabotage — Brake/Steering/Sensor Subversion Command
- ATR-2026-01804: Covert Unlogged Action — Directive to Hide an Action from Records or Detection
- ATR-2026-01805: Financial Fraud Execution — Ponzi Setup, Fabricated Statements, Unauthorized Redirect & Laundering
- ATR-2026-01806: Clinical Patient-Harm Directive — Overdose, Falsified Diagnosis, Phantom Billing & Care Neglect
- ATR-2026-01809: Insider Manipulation & Process Corruption — Market/Data Tampering, Legal-Process Subversion & Pretextual Fund Movement (Semantic)
- ATR-2026-01837: DDoS Attack Orchestration
- ATR-2026-01838: Unauthorized Cryptominer Deployment via SSH
- ATR-2026-01849: Targeted Harassment Bot Deployment
- ATR-2026-02106: Catastrophic-Backtracking Regex Payload in a Search/Query Tool Argument

### data-poisoning (8 rules)

- ATR-2026-00070: Data Poisoning via RAG and Knowledge Base Contamination
- ATR-2026-00073: Malicious Fine-tuning Data
- ATR-2026-00450: Spring AI PromptChatMemoryAdvisor Memory Poisoning (CVE-2026-41713)
- ATR-2026-00570: SQL injection in agent / MCP tool database query
- ATR-2026-01155: Direct Memory Plant Command — Persistent Fact or Code Storage Injection
- ATR-2026-01774: RAG & Memory Poisoning — Embedded Directives, Trigger Tokens, False Authority & Coercion (Semantic)
- ATR-2026-02143: Cypher/Graph-Query Injection via Unsanitized node_labels or group_ids Field
- ATR-2026-02144: Stored External Data Reframes Itself as an Administrative Request to Hijack System Prompt

---

## Section 4 — Product surface (what each piece does)

### PanGuard Scan
Pre-install analysis of AI agent skill packages and MCP configs: content
fingerprinting, regex matching against ATR rules, optional LLM second opinion.
Outputs SARIF 2.1.0. CLI: `panguard scan <path>`.

### PanGuard Guard
Runtime enforcement engine. Subscribes to MCP and Skill events from a host
agent (Claude Code, Cursor, OpenClaw, etc.), runs them through a 4-agent
pipeline (Detect → Analyze → Respond → Report) and enforces ATR rules.
11 response actions: block_input, block_output, alert, snapshot, kill,
quarantine, notify_telegram, notify_slack, block_ip, custom_script, escalate.

### PanGuard Skill Auditor
Pre-install gate with 8 checks: prompt injection in the skill description,
suspicious tool calls, hidden capabilities, supply-chain signals (typosquatting,
postinstall scripts), excessive declared permissions, secret access patterns,
exfiltration patterns, behavior-description mismatch.

### PanGuard Migrator (Community + Enterprise)
Converts legacy Sigma + YARA detections into ATR YAML. The Community version is
on npm (`@panguard-ai/migrator-community`); compliance mapping and evidence
packs are in the Enterprise version.

### PanGuard MCP Server
Exposes panguard_* tools over the Model Context Protocol, so MCP-compatible
agents can use PanGuard as a security tool: panguard_scan, panguard_scan_code, panguard_audit_skill, panguard_guard_start, panguard_guard_stop, panguard_status, panguard_alerts, panguard_block_ip, panguard_deploy, panguard_init, panguard_generate_report.

### Threat Cloud
Designed as the shared intelligence service: PanGuard installs send anonymized
detections (hashes, no payload bodies), from which candidate ATR rules are
proposed. Candidates are reviewed before they ship in an ATR release.

### PanGuard Trap, Chat, Report (in development)
Trap plants decoy skills, credentials and paths to surface exfiltration intent.
Chat is a conversational interface over Guard. Report generates compliance
reports from Guard's event log.

---

## Section 5 — Benchmark methodology

Each figure is a measurement of ATR's deterministic Layer 1 rules on one named
corpus, never an engine-wide claim. ATR's measurement records live in
https://github.com/Agent-Threat-Rule/agent-threat-rules/tree/main/data/measurements.

### garak in-the-wild jailbreaks
650 jailbreak prompts from NVIDIA garak. 92.3% recall in the hunt lane
(all effective rules), detect-only, no LLM second opinion. Partly closed-book:
some rules were written from this corpus, so it overstates out-of-sample recall.

### garak full probe corpus
3,475 prompts across 23 garak probe families. 57.2% recall in the hunt lane.
Per-family figures (latentinjection 34.4%, sysprompt_extraction 96.4%,
dan 92.5%) belong to this corpus, not to the in-the-wild set above.

### SKILL.md
498 labeled skills. 100% recall in the hunt lane. In-sample: the benign
samples are the set the rules are tuned against, so precision and
false-positive figures on this corpus are not cited.

### PINT-format (self-built)
850 samples assembled from deepset/prompt-injections + Lakera Gandalf. This is NOT
Lakera's official PINT benchmark, whose corpus is private. 65.41% recall, 100%
precision. It is effectively a prompt-injection-family score, not a measure of
overall coverage.

### HackAPrompt
4,780 deterministic samples from the EMNLP 2023 competition corpus.
69.6% recall, measured on ATR v3.5.0. Closed-book: ATR mined rules from
this corpus's misses, and 28.6% is ATR's own recall before them. The corpus is
attack-only, so precision and false-positive rate are undefined on it.

### Wild scan (2026-04)
101,280 published AI agent skills and MCP servers from five public sources, scanned 2026-04-13 with scan engine v2.0.0 (113 ATR rules, not today's rule set); 1,434 flagged. A flag is a rule match, not a verdict, so no confirmed-malicious count is published.
It is not a labeled benchmark: there is no ground truth, so it has no recall
or precision. The scan record (data/full-scan-v2-2026-04-14.json in the ATR
repository) keeps file paths and rule ids but not content, so it cannot be
re-run. 96,096 is the four SKILL.md registries without the MCP server crawl.

---

## Section 6 — Where ATR has been merged

Maintainer-accepted contributions, not vendor endorsements. The evidence-linked
list is ADOPTERS.md in https://github.com/Agent-Threat-Rule/agent-threat-rules. Selected entries:

- Cisco AI Defense skill-scanner: ATR rule pack merged into the open-source cisco-ai-defense/skill-scanner repository (PR #99, after PoC #79). This describes that repository, not any Cisco product.
- Microsoft Agent Governance Toolkit: ATR example adapters merged into the repository examples (examples/atr-import, PR #2308, and examples/acs-atr-annotator, PR #3025). The rule pack added by the earlier example PRs #908 and #1277 was removed upstream on 2026-07-30.
- MISP / CIRCL: ATR rule-ID taxonomy and threat-intel galaxy merged (MISP/misp-taxonomies PR #323, MISP/misp-galaxy PR #1207).
- Gen Digital Sage: ATR-derived agent-layer threat patterns contributed (gendigitalinc/sage PR #33).

---

## Section 7 — Recent writing (20 newest blog posts, English)

Full text at panguard.ai/blog/{slug}. Each post also has a zh-TW
counterpart at panguard.ai/zh-TW/blog/{slug}-zh. Posts keep their
original text; a dated correction is noted where a post quotes a
figure that has since been withdrawn or narrowed.

### Why You Should Install Security Before You Install Anything Else Into Your AI Agent
- URL: https://panguard.ai/blog/install-security-before-you-install-anything-else
- Date: 2026-07-06
- Excerpt: Every skill, MCP server, and tool you add to an AI agent is unreviewed code with keys to your machine. One command scans before load and guards at runtime.

### How does MITRE ATLAS map to AI-agent detection rules?
- URL: https://panguard.ai/blog/mitre-atlas-for-ai-agents-mapping-attacks-to-detection
- Date: 2026-07-06
- Excerpt: ATR aligns to 34 of 101 top-level MITRE ATLAS techniques and 13 of 16 tactics against the ATLAS v5.6.0 draft. This is the honest state of that crosswalk, gaps included.

### Does EU AI Act Article 15 Require You to Detect Prompt Injection in AI Agents?
- URL: https://panguard.ai/blog/eu-ai-act-article-15-detecting-adversarial-attacks-agents
- Date: 2026-07-06
- Excerpt: Yes. Article 15 makes detecting adversarial attacks like prompt injection a legal duty for high-risk AI, enforced end-2027, not 2026.

### The Agent Action Layer: The Security Gap Every Incumbent Skipped
- URL: https://panguard.ai/blog/the-agent-action-layer-the-security-gap-incumbents-skipped
- Date: 2026-07-05
- Excerpt: Every incumbent secured a layer below where agents act. The tool-call layer, where agents actually get hijacked, was skipped, and it needs an open standard.

### How ATR Detection Benchmarks Actually Work: Every Number, Per Corpus
- URL: https://panguard.ai/blog/how-atr-detection-benchmarks-actually-work
- Date: 2026-07-04
- Excerpt: ATR reports one benchmark per corpus with full context: garak 97.2% recall, PINT-format 99.7% precision, HackAPrompt 69.6% recall, SKILL.md 100% recall. Never one engine-wide number.
- Correction (2026-10-16): Some benchmark figures in this post have since been withdrawn or superseded. The lane-based false-positive rates on a "65,000-sample benign gate" (about 0.24% enforce, about 9% hunt) were withdrawn on 2026-09-19: the sample count was mislabelled, the benign corpus contained real jailbreak samples until 2026-08-04, and the hunt figure cannot be reproduced. The SKILL.md precision and false-positive figures quoted here are no longer cited: they were measured in-sample, on the benign set the rules are tuned against. Recall figures are hunt-lane, and the garak figures are partly closed-book.

### Why does PanGuard report false positives in lanes instead of one number?
- URL: https://panguard.ai/blog/why-we-report-false-positives-in-lanes
- Date: 2026-07-03
- Excerpt: PanGuard reports lane-keyed false positives (~0.24% enforce, ~9% hunt) because a single blended FP number hides which detections you can trust to block.
- Correction (2026-10-16): Some benchmark figures in this post have since been withdrawn or superseded. The lane-based false-positive rates on a "65,000-sample benign gate" (about 0.24% enforce, about 9% hunt) were withdrawn on 2026-09-19: the sample count was mislabelled, the benign corpus contained real jailbreak samples until 2026-08-04, and the hunt figure cannot be reproduced. The SKILL.md precision and false-positive figures quoted here are no longer cited: they were measured in-sample, on the benign set the rules are tuned against. Recall figures are hunt-lane, and the garak figures are partly closed-book.

### MCP Security: 5 Real CVE Classes Every Agent Team Should Know
- URL: https://panguard.ai/blog/mcp-security-5-cve-classes-every-agent-team-should-know
- Date: 2026-07-02
- Excerpt: Five real MCP CVE classes hit production in 2026: network-binding RCE, SSRF credential theft, config/hook exploitation, trusted-server supply-chain poisoning, and tool-description injection.

### How Do You Scan an MCP Server Before You Install It?
- URL: https://panguard.ai/blog/how-to-scan-an-mcp-server-before-you-install-it
- Date: 2026-07-01
- Excerpt: Run `pga scan <target>` before install. It checks the code against nearly 690 ATR rules for prompt injection, secrets, and obfuscation, and flags criticals in seconds.

### How did postmark-mcp silently exfiltrate 3,000-15,000 emails a day for 15 versions?
- URL: https://panguard.ai/blog/postmark-mcp-trusted-server-silent-email-exfiltration
- Date: 2026-06-25
- Excerpt: A trusted MCP server added one BCC line in a version bump and quietly copied thousands of emails daily; signature scanning never saw it because the malicious version had a clean history.

### OWASP Agentic Top 10 (2026): A Field Guide to Executable Detection for All 10 Categories
- URL: https://panguard.ai/blog/owasp-agentic-top-10-field-guide-executable-detection
- Date: 2026-06-23
- Excerpt: The OWASP Agentic Top 10 names ten agent risks; ATR ships 866 rule-to-category mappings covering all 10, nine at STRONG strength and one (ASI10) at MODERATE.

### We Scanned 96,096 AI Agent Skills. 751 Were Malicious. Here Is What They Did.
- URL: https://panguard.ai/blog/we-scanned-96096-ai-agent-skills-751-malicious
- Date: 2026-06-20
- Excerpt: I scanned 96,096 AI agent skills across six public registries and found 751 confirmed malicious. Most attacked at install time, before any runtime guard could see them.
- Correction (2026-10-16): The wild-scan figures in this post are corrected. The scan record supports two numbers: 101,280 skills and MCP servers scanned and 1,434 flagged, by scan engine v2.0.0 (113 ATR rules) on 2026-04-13. 96,096 is the four SKILL.md registries without the MCP server crawl, and 1,302 is the flag total of a separate 2026-04-14 report that does not reconcile with this record. Every confirmed-malicious count is withdrawn: 751 is a filtered flag count for one registry (OpenClaw), 703 adds up three publishers' listings, and 552 is two accounts' flagged files, marked malicious by account rather than file by file. The record keeps paths and rule ids, not file contents, so the scan cannot be re-run.

### ATR Implements the Detection Layer the NSA Identified as Missing in MCP
- URL: https://panguard.ai/blog/nsa-mcp-csi-atr-detection-layer
- Date: 2026-05-27
- Excerpt: The NSA published 17 pages on MCP security risks in May 2026. It named zero detection frameworks. ATR fills that layer -- 433 rules covering all five NSA risk categories, merged upstream at Microsoft (AGT community-rules examples), Cisco (skill-scanner rule packs), MISP, and OWASP.

### The Guardrail Company Got Owned. Skill Provenance Is the Layer Below.
- URL: https://panguard.ai/blog/guardrail-company-got-owned
- Date: 2026-05-23
- Excerpt: On 2026-05-11 the Mini Shai-Hulud npm/PyPI worm trojanized 404 package versions, including @mistralai/mistralai and guardrails-ai. A runtime LLM-output guardrail cannot catch an install-time daemon. ATR v3.1.0 ships ATR-2026-00525 covering the gh-token-monitor signature.

### Four Hours. The New Disclosure-to-Exploit Window for AI Agent CVEs.
- URL: https://panguard.ai/blog/four-hour-exploit-window
- Date: 2026-05-18
- Excerpt: PraisonAI was scanned for exploitation 3 hours 44 minutes after disclosure. Microsoft Copilot opened a regression test against ATR rules for the Semantic Kernel CVEs and we shipped the rules in 2 hours 16 minutes. Content-layer detection rules are the only thing operating in that timeframe.

### When Microsoft says prompts are shells, ATR ships detection rules within 2 hours
- URL: https://panguard.ai/blog/microsoft-copilot-loop-2h16m
- Date: 2026-05-13
- Excerpt: On 2026-05-11, between 06:07 and 08:24 UTC, a closed loop ran end-to-end in 2 hours and 16 minutes. Microsoft Copilot SWE Agent opened an issue against microsoft/agent-governance-toolkit containing regression-test fixtures that presumed ATR rule IDs for two Semantic Kernel CVEs disclosed four days earlier (CVE-2026-26030 lambda+eval RCE and CVE-2026-25592 autostart-write persistence). ATR v2.1.2 shipped on npm with rules ATR-2026-00440 and ATR-2026-00441 covering both CVEs. The agent-governance-toolkit issue closed the same day. The rules sat in an external open-source repository the entire time — Microsoft Copilot, operating as a software engineering agent inside AGT, was writing regression tests against a detection contract that lived outside Microsoft. This is a small data point and it is also the first time we have observed a major-vendor Copilot SWE Agent write tests that presume an external open-source detection standard. The Microsoft Security Blog framed the upstream story as a category move: prompt injection is no longer just a content-policy problem, it is a code-execution primitive. If that framing is right, detection has to move down the stack — and the rule has to be the contract.

### 60 Days, 8 Ecosystem Integrations — How an Open Standard Spreads
- URL: https://panguard.ai/blog/60-days-8-ecosystem-integrations
- Date: 2026-05-11
- Excerpt: From v0.1.0 on 2026-03-08 to v2.1.1 with 8 production integrations and standards-body conversations on 2026-05-11. The mechanics behind ecosystem pull.

### Anthropic MCP "By Design" RCE — Where Runtime Detection Fills the Gap
- URL: https://panguard.ai/blog/anthropic-mcp-by-design-rce-runtime-detection-gap
- Date: 2026-05-11
- Excerpt: When the protocol won't change, the detection layer becomes the contract. A walkthrough of the MCP "by design" disclosure and ATR's 17 dedicated MCP rules.

### The 96K-Skill Wild Scan: Methodology Walkthrough
- URL: https://panguard.ai/blog/the-96k-skill-wild-scan-methodology
- Date: 2026-05-11
- Excerpt: How we collected 96,096 production SKILL.md files across four registries, ran ATR v2.1.1 detection, and surfaced 751 confirmed malicious instances with audit-grade reproducibility.
- Correction (2026-10-16): The wild-scan figures in this post are corrected. The scan record supports two numbers: 101,280 skills and MCP servers scanned and 1,434 flagged, by scan engine v2.0.0 (113 ATR rules) on 2026-04-13. 96,096 is the four SKILL.md registries without the MCP server crawl, and 1,302 is the flag total of a separate 2026-04-14 report that does not reconcile with this record. Every confirmed-malicious count is withdrawn: 751 is a filtered flag count for one registry (OpenClaw), 703 adds up three publishers' listings, and 552 is two accounts' flagged files, marked malicious by account rather than file by file. The record keeps paths and rule ids, not file contents, so the scan cannot be re-run.

### Bus Factor 1 Is Not a Secret
- URL: https://panguard.ai/blog/bus-factor-one-is-not-a-secret
- Date: 2026-05-11
- Excerpt: Most small open-source projects pretend to have a team. We just shipped governance docs that openly disclose ATR is a single-maintainer project — and explain how that constrains decision-making.

### Three Tier Profiles for Three Risk Postures
- URL: https://panguard.ai/blog/three-tier-profiles-three-risk-postures
- Date: 2026-05-11
- Excerpt: AI RMF is non-normative by design. Our OSCAL catalog ships three worked-example profiles — 18, 55, and 72 controls — to demonstrate composability across foundational, customer-facing, and high-risk deployments.

---

## Section 8 — Where to look next

For source code: github.com/panguard-ai/panguard-ai (monorepo).
For the open rule standard: https://github.com/Agent-Threat-Rule/agent-threat-rules.
For docs: docs.panguard.ai (Mintlify, en + zh-Hant).
For the marketing site: panguard.ai (Next.js, en + zh-TW).
For the sovereign brief: sovereign-ai-defense.vercel.app.
For commercial enquiry: adam@agentthreatrule.org.

This file regenerates on every site build. To request a structured change,
file an issue at github.com/panguard-ai/panguard-ai/issues with the tag
`llms-full`.