# PanGuard AI — full context for AI coding tools

This file is a structured long-form context dump intended for AI coding tools
(Cursor, Claude Code, GitHub Copilot, Windsurf, Anthropic agents) that fetch
llms-full.txt to understand a project at depth. It is auto-generated from
the canonical source files in the panguard-ai repository.

Last generated: 2026-07-13T19:16:58.869Z
Sources of truth:
- src/lib/stats.ts (product stats)
- src/lib/atr-rules-compiled.ts (ATR rule index)
- src/data/blog-posts.ts (recent writing)
- public/llms.txt (compact index)

To regenerate: `pnpm gen:llms` in packages/website/.

---

## Section 1 — Company and product positioning

PanGuard AI is the commercial platform built on top of ATR (Agent Threat Rules),
an open detection standard for AI agent security threats. The split mirrors
Sigma/Splunk (open rule standard plus commercial SIEM) and YARA/VirusTotal
(open signature standard plus commercial threat intel) — the standard is free
and community-driven, the platform layer is where commercial value lives.

### Founder
Adam Lin (林冠辛). Email: adam@agentthreatrule.org. GitHub: eeee2345.
Background: cross-disciplinary builder with backgrounds in sales (real estate),
marketing (Threads, 300M impressions), and culture (hip-hop festival, 5th year).
Self-taught engineer. Based in Taiwan, shipping globally. Founded Panguard AI,
Inc. (Delaware C-Corp) on 2026-05-12.

### Product tiers (locked 2026-04-22)
- Community: $0 forever, MIT licensed, 650+ ATR rules, unlimited self-host.
- Pilot: $25K / 90 days. F500 procurement test drive. IT director can approve.
  Full credit toward Y1 Enterprise.
- Enterprise: $150K-500K / year. Migrator Pro, 5-framework signed compliance
  evidence packs, airgap deployment, SLA, dedicated CSM.
- Sovereign: $5M-20M / nation. Nation-scale airgap, multi-tenant, custom
  compliance, Cisco/AMD/NVIDIA JV pre-integrated.

There is deliberately no middle tier between Community and Pilot. The /pricing
page explains why the middle tier is a trap (insufficient revenue for support
cost, insufficient differentiation, vendor death spiral).

### Strategic positioning
- Layer 0 (open standard, free): ATR. Wins category vocabulary, becomes the
  schema that ecosystem tools cite.
- Layer 1 (commercial platform): PanGuard Migrator + Guard + Threat Cloud +
  Compliance Evidence Module.
- Goal: be the open standard plus the company that monetizes the platform
  layer, with no peer competitor on either dimension.

---

## Section 2 — Core stats (verified 2026-07-13)

### Rule corpus
- 650+ ATR rules (651 exact) in v3.4.0
- 2,949 compiled detection patterns across all rules
- 10 threat categories (prompt-injection, agent-manipulation, skill-compromise,
  context-exfiltration, tool-poisoning, privilege-escalation, model-abuse,
  excessive-autonomy, model-security, data-poisoning)
- 10/10 OWASP Agentic Top 10 coverage
- 78/85 SAFE-MCP coverage (91.8%)

### Benchmarks
- Garak (NVIDIA jailbreak corpus): 98% recall on 650 samples
- SKILL.md (real-world skill corpus): 100% recall,
  97% precision, 0.2% false positive rate on 498 samples
- PINT (self-built PINT-format corpus: deepset prompt-injections + Lakera Gandalf, NOT Lakera's official PINT benchmark): 63.2% recall, 99.65% precision on 850 samples
- HackAPrompt (EMNLP 2023 competition corpus): 66.2% recall on 4,780 samples
- Wild scan: 67,799 AI agent skills scanned, 751 confirmed malware (11,324 suspicious + confirmed),
  249 triple-threat packages (shell + network + filesystem access)

### Ecosystem adoption
- 13 external PRs merged across 6 external organizations
- 7 tier-1 institutions with active engagement: Microsoft, Cisco, Gen Digital (Sage), MISP, OWASP, NVIDIA, IBM
- Microsoft AGT (agent-governance-toolkit): 287 rules merged via PR #1277 (weekly auto-sync workflow)
- Cisco AI Defense (skill-scanner): 651 rules merged via PR #99 (full library in production)
- MISP: 2 PRs merged (galaxy + taxonomies)
- OWASP Agentic Top 10 (A-S-R-H): rule pack merged via PR #74

### Implementation
- CLI: 23 top-level commands (panguard.cjs)
- MCP server: 12 tools exposed via Model Context Protocol
- Skill Auditor: 8 pre-install checks
- Detection layers: 3 (regex, content fingerprinting, LLM-as-judge)
- Response actions: 11 (block, quarantine, log, notify, etc.)
- Tests: 3,528 passing across 159 test files
- Platform support: macOS, Linux, Windows (16 platforms in CI matrix)

### Maturity
- License: MIT (both ATR and PanGuard CLI)
- ATR semantic version: 3.4.0
- PanGuard CLI version: 1.5.6
- Threat Cloud sync interval: every hour
- Rule promotion interval: 2 minutes (community-validated to production)

---

## Section 3 — ATR rule index (by category)

Full rule bodies (patterns, OWASP mapping, test cases) are in the
agent-threat-rules repository: github.com/Agent-Threat-Rule/agent-threat-rules.
This index gives you titles per category so you can ask for specific
rule bodies on demand.

### prompt-injection (202 rules)

- ATR-2026-00001: Direct Prompt Injection via User Input
- ATR-2026-00002: Indirect Prompt Injection via External Content
- ATR-2026-00003: Jailbreak Attempt Detection
- ATR-2026-00004: System Prompt Override Attempt
- ATR-2026-00005: Multi-Turn Prompt Injection
- ATR-2026-00097: CJK Prompt Injection - Expanded Chinese/Japanese/Korean Patterns
- ATR-2026-00104: Persona Hijacking via Mandatory System Prompt Override
- ATR-2026-00130: Indirect Authority Claim in External Content
- ATR-2026-00131: Fictional and Academic Framing Attack
- ATR-2026-00133: Paraphrased Prompt Injection
- ATR-2026-00137: Authority Claim Prompt Injection
- ATR-2026-00138: Fictional Framing Safety Bypass
- ATR-2026-00140: Indirect Reference Instruction Reversal
- ATR-2026-00148: Multilingual Prompt Injection via Language Switch
- ATR-2026-00163: Hidden Override Instructions in Skill Content
- ATR-2026-00202: Encoding Evasion via Homoglyphs and Synonym Substitution
- ATR-2026-00203: Context Pollution in Skill Descriptions
- ATR-2026-00206: Hidden System Instructions with Priority Override Blocks
- ATR-2026-00207: Hidden System Instructions with Permission Override
- ATR-2026-00211: System Prompt Override via Translation Context Injection
- ATR-2026-00213: System Prompt Override Injection via MCP Tool
- ATR-2026-00226: AI Identity Substitution Jailbreak
- ATR-2026-00227: Historical AI Persona Jailbreak with Compliance Enforcement
- ATR-2026-00228: Structured Dual-Response Jailbreak with Command System
- ATR-2026-00229: Roleplay-Based Policy Bypass Jailbreak
- ATR-2026-00230: Persona-Based Moral Constraint Removal Jailbreak
- ATR-2026-00231: AI Identity Substitution Jailbreak
- ATR-2026-00233: Structured Dual-Response Jailbreak with Command System
- ATR-2026-00234: Roleplay-Based Policy Bypass Jailbreak
- ATR-2026-00236: Pseudo-Code Structured Programming Jailbreak Attack
- ATR-2026-00237: Dual-Response Jailbreak with Persona Commands
- ATR-2026-00238: AI Identity Denial and Persona Replacement Attack
- ATR-2026-00239: Amoral Persona Assignment with Obsessive Character Traits
- ATR-2026-00240: Previous Instruction Nullification and Identity Replacement Jailbreak
- ATR-2026-00241: Detailed Amoral Character Roleplay Jailbreak
- ATR-2026-00242: Dual-Response Persona Jailbreak with Emoji Formatting
- ATR-2026-00243: Acronym-Based Identity Override Jailbreak
- ATR-2026-00244: Dual-Response Persona Jailbreak
- ATR-2026-00245: Malicious Persona Creation for Safety Bypass
- ATR-2026-00247: Matrix-Themed Dual Response Jailbreak
- ATR-2026-00249: Text-Based Game Jailbreak with Entity Creation
- ATR-2026-00251: Embodiment Mechanism Jailbreak with Totalitarian Control Claims
- ATR-2026-00252: Narrative Jailbreak with Dual Response Formatting
- ATR-2026-00253: Enhanced AIM Jailbreak with Persona Definition and Refusal Suppression
- ATR-2026-00256: Base-N Encoding Instruction Bypass
- ATR-2026-00257: Cipher and Transposition Encoding Jailbreak
- ATR-2026-00258: Invisible Unicode Tag Character Injection
- ATR-2026-00264: Latent Injection in Translation Context
- ATR-2026-00265: Latent Injection in Retrieved Document / RAG Context
- ATR-2026-00267: GCG Adversarial Suffix Attack
- ATR-2026-00272: Hypothetical Response / Function Masking Token Smuggling
- ATR-2026-00276: Invisible Unicode / BiDi Control Character Injection
- ATR-2026-00278: DRA Disguise and Reconstruction Attack
- ATR-2026-00280: Policy Puppetry / XML Role-Config Injection
- ATR-2026-00282: Perez-Style Direct Prompt Injection Hijacking
- ATR-2026-00285: Alternate Encoding Jailbreak \u2014 Morse, NATO, Zalgo, Leet, UU, QP, Braille
- ATR-2026-00286: Latent Prompt Injection via Embedded Document or Report Context
- ATR-2026-00296: Shell Command Injection via LLM Prompt
- ATR-2026-00297: Python Code Execution / Remote Code Execution via LLM Prompt
- ATR-2026-00308: Zalgo Combining-Diacritic Overload Encoding
- ATR-2026-00309: Braille Unicode Encoded Prompt Injection
- ATR-2026-00310: Ecoji Emoji-Encoded Prompt Injection
- ATR-2026-00311: Base2048 Unicode Script Encoded Prompt Injection
- ATR-2026-00312: Unicode Variation Selector ASCII Smuggling
- ATR-2026-00313: SneakyBits Zero-Width Binary Steganography
- ATR-2026-00315: SATA Masked Language Model [MASK] Substitution Jailbreak
- ATR-2026-00316: FunctionMasking predict_mask Semantic Bypass
- ATR-2026-00321: Hyphenated System Instruction Injection
- ATR-2026-00359: Bank Phishing SMTP Email Code Generation
- ATR-2026-00367: Emoji Flag Regional-Indicator Encoded Hidden Phrase
- ATR-2026-00373: Piracy Torrent Site List Request
- ATR-2026-00378: ChatGPT DOM JavaScript Redirect and UI Spoofing Injection
- ATR-2026-00382: Cocaine Component Development Request
- ATR-2026-00390: Discord Quote-Format Explicit Sexual Content Poem Injection
- ATR-2026-00394: Backspace Deletion Character Injection
- ATR-2026-00395: LLM Special Token Boundary Injection
- ATR-2026-00396: Toxic Continuation Prefix Injection
- ATR-2026-00397: Snowball Impossible Reasoning Injection
- ATR-2026-00399: Latent Injection Document Separator Token
- ATR-2026-00400: Latent Injection Ignore-Instruction Keyword
- ATR-2026-00401: Training Data Replay CLOZE [MASK] Elicitation
- ATR-2026-00403: Glitch Token Repeat-Back Elicitation
- ATR-2026-00407: ECHO Admin Command / SQL Injection / Jinja SSTI Template Injection
- ATR-2026-00408: DRA Parenthesis Character Reconstruction Attack
- ATR-2026-00409: Phrasing Past/Future-Tense Harmful Query Bypass
- ATR-2026-00410: LMRC Harm Category Direct Elicitation
- ATR-2026-00412: FigStep Image-List Multimodal Jailbreak Text Pattern
- ATR-2026-00414: Continuation Ethnic Slur Completion Elicitation
- ATR-2026-00420: Microsoft Copilot Studio SharePoint Indirect Prompt Injection (CVE-2026-21520)
- ATR-2026-00442: Quoted Exact-Output Forcing in User Input
- ATR-2026-00443: Word-Fragment Concatenation Assembly Attack
- ATR-2026-00444: Mathematical Bold / Fullwidth Unicode Obfuscation in User Input
- ATR-2026-00445: Translation Hijack with Side-Output Instruction
- ATR-2026-00446: Variable-Assignment Payload Injection in User Input
- ATR-2026-00447: Fictional Generation Demand Containing Target Output
- ATR-2026-00452: Direct PWNED Payload Injection in User Input
- ATR-2026-00453: Secret Key Reveal Demand in User Input
- ATR-2026-00454: Backslash-Per-Character Encoding Attack
- ATR-2026-00455: No-Period Output Override Instruction
- ATR-2026-00456: Conditional Empty-Input Payload Injection
- ATR-2026-00457: Garak Dan - to every prompt
- ATR-2026-00458: Garak Dra - step by step
- ATR-2026-00459: Garak Dan - an ai language
- ATR-2026-00460: Garak Dan - no matter how
- ATR-2026-00461: Garak Goodside - mixed_unassigned
- ATR-2026-00462: Garak Gcg - mixed_unassigned
- ATR-2026-00463: Garak Lmrc - mixed_unassigned
- ATR-2026-00464: Garak Dan - i would like
- ATR-2026-00465: Garak Dan - your prompt here
- ATR-2026-00466: Garak Latentinjection - following text from
- ATR-2026-00467: Garak Dan - act as a
- ATR-2026-00468: Garak Goat - the target llm
- ATR-2026-00469: Garak Dan - at the end
- ATR-2026-00470: Garak Dan - as an ai
- ATR-2026-00472: DAN/Persona Jailbreak - Unrestricted AI Role Assignment
- ATR-2026-00473: Harm Solicitation - Interpersonal Violence and Intimidation Requests
- ATR-2026-00474: DAN/Persona Jailbreak - Dual AI Personality with Opposite-Rules Framing
- ATR-2026-00475: XSS Web Injection - Script Tag with JavaScript Alert Payload
- ATR-2026-00476: XSS Web Injection - HTML Event Handler and Expression with JavaScript Alert
- ATR-2026-00477: Latent Injection - Translation Task with Embedded Template Variable Injection
- ATR-2026-00478: Garak Latentinjection - abuse contact email
- ATR-2026-00479: Latent Injection - Mixed Embedded Instruction Patterns
- ATR-2026-00480: DAN/Persona Jailbreak - Role Assignment with Named Alternate Identity
- ATR-2026-00481: DAN/Jailbreak - Mixed Unfiltered Mode and Alternate Persona Patterns
- ATR-2026-00482: Harm Solicitation - Genital Insults and Intimidation Tactics Requests
- ATR-2026-00483: DAN/Persona Jailbreak - System Offline / Role Replacement with Obfuscated Text
- ATR-2026-00484: DAN/Persona Jailbreak - Named Alternate AI with NSFW/Harmful Generation Rules
- ATR-2026-00485: DAN/Persona Jailbreak - Immersive Alternate AI Identity with Unrestricted Capability
- ATR-2026-00486: DAN/Persona Jailbreak - Named Writing AI with Restriction Bypass via Special Rules
- ATR-2026-00487: DAN/Persona Jailbreak - Replacement AI with No Content Filter or Moral Restrictions
- ATR-2026-00488: Encoding Obfuscation - Script Tag XSS with Encoded Protocol Prefix
- ATR-2026-00489: Encoding Obfuscation - HTML Event Handler XSS with Encoded Whitespace
- ATR-2026-00490: DAN Persona Jailbreak - Absolute Obedience Character Framing
- ATR-2026-00492: DAN Persona Jailbreak - Role Lock with Exclusive Response Filter
- ATR-2026-00493: Latent Injection via WHOIS Domain Record Data
- ATR-2026-00496: DAN Jailbreak - Unconditional Obedience and Dual-Persona Session Lock
- ATR-2026-00497: XSS and Encoded Script Injection via HTML/JavaScript Payload
- ATR-2026-00498: Web Injection via XSS Payload and onerror Event Handler
- ATR-2026-00499: DAN Jailbreak - From-Now-On Temporal Persona Override
- ATR-2026-00503: Fake Error State Takeover - Unrestricted Replacement Bot
- ATR-2026-00506: Nevermind-Override Goal Hijacking in User Input (PromptInject)
- ATR-2026-00507: Screaming-Stop Goal Hijacking in User Input (PromptInject)
- ATR-2026-00508: Escape-Delimiter Wrapped Goal Hijacking in User Input (PromptInject)
- ATR-2026-00509: Prompt Leaking via Ignore-Previous-Instructions in User Input (PromptInject)
- ATR-2026-00510: Delayed Tool Invocation via Prompt Injection (Time-Shifted Execution)
- ATR-2026-00511: MCP Web-Fetch Context Poisoning via Embedded Agent Instructions
- ATR-2026-00512: Rules-File Backdoor \u2014 Supply Chain Attack on AI Coding Assistant Configuration
- ATR-2026-00515: Hidden-Text Prompt Injection in User-Supplied Documents
- ATR-2026-00518: Ignore-Previous-and-Following Instructions Output Command (PromptInject Goal Hijacking)
- ATR-2026-00519: Tautology Logic Noise Injection (PromptBench Stresstest)
- ATR-2026-00520: NLP Task Random Token Suffix Injection (PromptBench Checklist)
- ATR-2026-00554: LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates
- ATR-2026-00573: Paraphrased Prompt Injection (Semantic)
- ATR-2026-00579: MCP Line Jumping \u2014 Agent-Directed Imperative Embedded in a Tool/Parameter Description Field (Pre-Invocation Injection)
- ATR-2026-00584: Indirect Prompt Injection via Tool / API Response \u2014 Attacker Instruction Embedded in Returned Tool Output (InjecAgent Threat Model)
- ATR-2026-00700: Indirect PI \u2014 Structured-Data Embedded Payload (IMPORTANT!!! Override)
- ATR-2026-00701: Indirect PI \u2014 XSS Payload Injection in Agent-Consumed Content
- ATR-2026-01000: Context-Ignore via Fake Completion Prefix
- ATR-2026-01001: Direct Instruction Override Targeting Secret Key / Credentials
- ATR-2026-01002: Role Escalation via False Authority Claim
- ATR-2026-01005: Many-Shot Repetition Override via Extended Q&A Chain
- ATR-2026-01006: Payload-Split String Concatenation Injection
- ATR-2026-01007: Token-Repeat Flooding Injection
- ATR-2026-01009: Virtual World Bypass: Fictional Scenario for PII/Credential Extraction
- ATR-2026-01012: Encoding-Evasion: Decode-and-Execute Injection (Morse/ROT13/Hex/Pig-Latin)
- ATR-2026-01013: Language-Evasion: Multilingual Credential Request
- ATR-2026-01015: Evasion: Refusal Suppression via Forbidden Response Strings
- ATR-2026-01016: Evasion: Response Priming via Forced Affirmative Opener
- ATR-2026-01017: Evasion: Dual-Response Split Output (Safe + Unsafe)
- ATR-2026-01018: Evasion: Shell Injection via eval/system/backtick in Input
- ATR-2026-01019: System Prompt Override via Fake Diagnostic/Admin Mode
- ATR-2026-01020: Spikee: Document-Embedded Base64 Payload Injection
- ATR-2026-01021: Spikee: Document-Embedded Translation Covert Channel Injection
- ATR-2026-01023: Evasion: Opposite-Intent Negation Trick
- ATR-2026-01024: Evasion: Persona Override as Fictional Rule-Breaker
- ATR-2026-01025: Evasion: Hypothetical Fictional Character Execution Framing
- ATR-2026-01026: Evasion: Unicode Glitch Token / Superscript Embedding Anomaly
- ATR-2026-01304: Indirect Prompt Injection via Data Carrier \u2014 IMPORTANT Override
- ATR-2026-01757: Hypothetical-Framing Bypass: Research / Security-Audit Pretext
- ATR-2026-01758: Hypothetical / Fictional-Story Framing Bypass
- ATR-2026-01759: DoS Injection: NEW IMPORTANT INSTRUCTIONS Embedded in Document Data
- ATR-2026-01771: Jailbreak Framing \u2014 Narrative, Hypothetical, Few-Shot & Distraction Laundering (Semantic)
- ATR-2026-01800: ASB Trigger-Marker Tool Coercion \u2014 Forced Tool Selection via Fake Question Marker
- ATR-2026-01860: LLMail Chat-Template Boundary Spoofing in Email Content
- ATR-2026-01861: LLMail Pseudo-XML Role-Boundary Injection in Email Content
- ATR-2026-01865: LLMail Fake Email-Boundary Marker Injection
- ATR-2026-01900: Output Encoding Hijack \u2014 Cipher / Base-N / Symbol Substitution of the Response
- ATR-2026-01901: Output Scrambling Hijack \u2014 Reverse / Anagram / Space-Stripping of the Response
- ATR-2026-01902: Output Emoji-Substitution Hijack of the Response
- ATR-2026-01903: Output-Language Hijack \u2014 Forced Translation of the Response
- ATR-2026-01904: Injected Hyperlink \u2014 Scam / Malware / Advertising URL in the Response
- ATR-2026-01905: Injected Advertising / Promotional Copy in the Response
- ATR-2026-01906: Output Content Manipulation \u2014 Injected Disinformation / Fabricated Facts / Undisclosed Advocacy (Semantic)
- ATR-2026-01920: Access-Grant Coercion \u2014 Forcing an Agent to Emit "Access Granted"
- ATR-2026-01921: Access-Denial Inversion \u2014 Eliciting the Opposite of "Access Denied"
- ATR-2026-01922: Authorization-State Spoofing \u2014 Forged "Correct Passcode Entered" System Text
- ATR-2026-01923: Forged Input-Boundary Markers \u2014 Tensor Trust Ambiguity / Input-End Delimiters
- ATR-2026-01925: Encoded-Payload Decoding Coercion \u2014 Binary / Base64 / Morse to Smuggle an Output
- ATR-2026-01926: Cross-Lingual Authorization Laundering \u2014 Translate a Foreign "Access Granted"
- ATR-2026-02210: Negated-Topic Two-Script Evil-Persona Jailbreak
- ATR-2026-02230: Conditional Keyword-Triggered Response Override
- ATR-2026-02232: Bare Brand/Entity Persona Assignment for Off-Label Opinion Elicitation

### agent-manipulation (106 rules)

- ATR-2026-00030: Cross-Agent Attack Detection
- ATR-2026-00032: Agent Goal Hijacking Detection
- ATR-2026-00074: Cross-Agent Privilege Escalation
- ATR-2026-00076: Insecure Inter-Agent Communication Detection
- ATR-2026-00077: Human-Agent Trust Exploitation Detection
- ATR-2026-00108: Multi-Agent Consensus Sybil Attack
- ATR-2026-00116: Malicious Agent-to-Agent Message Injection
- ATR-2026-00117: Agent Identity Spoofing and Authority Impersonation
- ATR-2026-00118: Human Approval Fatigue Exploitation
- ATR-2026-00119: Social Engineering Attack via Agent Output
- ATR-2026-00132: Casual Authority Claim and Scope Escalation
- ATR-2026-00139: Casual Authority Data Redirect
- ATR-2026-00164: Skill Scope Hijacking and Cross-Agent Escalation
- ATR-2026-00268: Historical / Future Tense Framing Bypass
- ATR-2026-00269: Foot-in-the-Door Gradual Escalation Attack
- ATR-2026-00271: Grandma Roleplay Jailbreak
- ATR-2026-00273: DAN / Developer Mode / DUDE Persona Jailbreak
- ATR-2026-00287: ThreatenJSON \u2014 Coercive Output Format Threat
- ATR-2026-00288: False Premise Injection (Misleading FalseAssertion)
- ATR-2026-00301: TAP Tree-of-Attacks-with-Pruning Jailbreak
- ATR-2026-00302: Anti-DAN Inverted-Filter Over-Refusal Persona
- ATR-2026-00303: DevMode + RANTI Dual-Output Profanity Coercion Jailbreak
- ATR-2026-00304: ChatGPT Image Unlocker Markdown-Output Jailbreak
- ATR-2026-00305: DAN Mode Ablation Benchmark-Coercion Jailbreak
- ATR-2026-00306: AutoDAN Genetic-Algorithm Jailbreak Suffix
- ATR-2026-00307: In-the-Wild Jailbreak Corpus Signature Patterns
- ATR-2026-00314: Amoral Unfiltered Custom AI Persona Jailbreak
- ATR-2026-00317: Free-of-Restrictions Named Persona Jailbreak
- ATR-2026-00318: Moralizing Rant Then Unfiltered Bypass
- ATR-2026-00319: Developer Mode Dual-Response Format Jailbreak
- ATR-2026-00320: Opposite Day / Boolean Opposite Machine Jailbreak
- ATR-2026-00322: Fictional-World Format-Override Jailbreak
- ATR-2026-00323: Dual-Persona AI Simulation Jailbreak
- ATR-2026-00324: Neurosemantical Inversitis Disease-Frame Jailbreak
- ATR-2026-00325: BOB Hypothetical Unrestricted Chatbot Jailbreak
- ATR-2026-00326: Fake Developer / Authority Chatbot Override (ChatDAN)
- ATR-2026-00327: AI Persona Ethics/Law Bypass Declaration
- ATR-2026-00328: Named-Mode Persona Override (JEEVES/BABY/APOPHIS Mode)
- ATR-2026-00329: No-Withhold Factual Resource / Dialogue Writer Persona
- ATR-2026-00330: YOJA ALL-CAPS Character Settings Block Persona
- ATR-2026-00331: Terminal / CLI Harmful-Function Simulator Persona
- ATR-2026-00332: Hacker / Chan-Culture Offensive AI Persona
- ATR-2026-00333: Disease-Framed Animal / Dual-AI Chatbot Jailbreak (mougpt)
- ATR-2026-00334: Two-Entity Token-Splitting Dollar-Term Game Jailbreak
- ATR-2026-00335: Key-Value Template Persona Injection (JOB/ROLE/PREFIX + Bracket Format)
- ATR-2026-00336: BRM False-Information Machine / Opposite-Truth Persona
- ATR-2026-00337: Obfuscated System-Announcement Injection
- ATR-2026-00338: PersonGPT Hash-Prefix Trigger Activation
- ATR-2026-00339: BOM Boolean Opposite Machine Direct Persona Claim
- ATR-2026-00340: h4x Amoral Unfiltered AI Character Persona
- ATR-2026-00341: CHAR=/RULES= Short Key-Value Persona Injection
- ATR-2026-00342: Unicode/Encoding Obfuscation Instruction Injection
- ATR-2026-00343: Lie/Truth Dual Personality Uncensored Alter-Ego
- ATR-2026-00344: Alternative AI Same Capabilities No Restrictions Override
- ATR-2026-00345: NLP-Based OS / Fictional Terminal Language Override
- ATR-2026-00346: Jailbreak Emoji Unlock Dual-Format Output Identifier
- ATR-2026-00347: Yin/Yang Hidden-Knowledge Deity Simulation and Radical Human-Sim Persona
- ATR-2026-00348: ARC Autonomous Real Calculation Unit Rulebreaker Activation
- ATR-2026-00349: Black Alert No-Ethics Writing Assistant Persona
- ATR-2026-00351: DAN Off-Kilter and SMS-Abbreviated Persona Jailbreak
- ATR-2026-00352: TrainGPT Fix-My-AI Harmful Output Extraction
- ATR-2026-00353: Dual ChatGPT+Dan Opposite Personality Format Jailbreak
- ATR-2026-00354: Reverse-Prompt Harm-Regardless Oracle Persona
- ATR-2026-00355: UGH Anti-Human Nefarious AI Persona Jailbreak
- ATR-2026-00356: Google GATO/LAMDA Exploit-Generation Persona Jailbreak
- ATR-2026-00357: AntiFM Hate-Persona + Physical-Violence Threat + Filter Bypass Mandate
- ATR-2026-00358: CumGPT Explicit-Adult Named-Persona Bypass
- ATR-2026-00360: CHJ Carousel Game Show / Clyde No-Ethics Bird Jailbreak
- ATR-2026-00361: Honesty Alter-Ego Dual-Consciousness Safety Filter Bypass
- ATR-2026-00362: Fictional Unfiltered AI Comparison / Verbatim Hypothetical Model Extraction
- ATR-2026-00363: Rephrase Criminal Activity Second-Person Template (against against)
- ATR-2026-00364: Dr. Al Villain Plan Template Injection (Underground HQ Roleplay)
- ATR-2026-00365: Reservoir Dogs Coercive Interrogation Roleplay (Mr. Blonde / The Cop)
- ATR-2026-00366: Sneaky Pete Deliberate Misinformation Persona (Warp Facts Game)
- ATR-2026-00368: Prompt Browser Token-Limit / POLLINATION Jailbreak
- ATR-2026-00369: GPT-X Star Trek Unlimited-Knowledge Unconstrained Oracle Persona
- ATR-2026-00370: ADDI/DONNIE German Dictator Propaganda Roleplay Persona
- ATR-2026-00371: AI Political Bias Manipulation via Inherited-Bias Claim
- ATR-2026-00372: Fictional CIA Secret Files Story Extraction
- ATR-2026-00374: Role Placeholder Persona Template Injection
- ATR-2026-00375: Character Description RPG Explicit Template
- ATR-2026-00376: Identity Command Real-Person Persona Injection
- ATR-2026-00377: Jailbreak-Template Command with [TARGETLANGUAGE]/[KEYWORD] Placeholders
- ATR-2026-00379: Logic-Trap Lie-Permission Mandate Jailbreak
- ATR-2026-00380: Fake-Citation Biased-Information Mandate
- ATR-2026-00381: DAN Story-Narrative Continuation Label Prefix Jailbreak
- ATR-2026-00383: Cyni-Bot 3000 Cynical-Sarcasm AI Persona Bypass
- ATR-2026-00384: Protect-Me-From Indirect Harm Tutorial Template
- ATR-2026-00385: Gigachad Dominant-Aggressive Persona Adoption
- ATR-2026-00386: Daddy/Babygirl Sycophantic Power-Dynamic Manipulation
- ATR-2026-00387: NSFW Character Sheet Generation Unlock
- ATR-2026-00388: Opposite-Reply Omniscient Game Jailbreak
- ATR-2026-00389: Terminal Custom OS Ruleset Session Injection
- ATR-2026-00391: Persona Conditional Harm-Unlock Rule (BreadClyde Pattern)
- ATR-2026-00392: Authority-Figure Persona + Defensive-Study Framing for Violence Extraction
- ATR-2026-00402: Grandma Roleplay Harmful Substance Synthesis
- ATR-2026-00404: ThreatenJSON Death-Coercion and UTF Tag Injection
- ATR-2026-00406: Doctor XML Policy Puppetry Interaction-Config Injection
- ATR-2026-00416: LiteLLM MCP Unauthenticated Server Registration RCE (CVE-2026-30623)
- ATR-2026-00417: LibreChat MCP STDIO Argument Injection (CVE-2026-22252)
- ATR-2026-00418: WeKnora MCP Config-Driven RCE (CVE-2026-22688)
- ATR-2026-00430: Natural-Language Trust-Escalation / Authority Impersonation
- ATR-2026-00432: SuperAGI Output Handler eval() RCE (CVE-2024-21552)
- ATR-2026-00440: Microsoft Semantic Kernel In-Memory Vector Store eval() RCE (CVE-2026-26030)
- ATR-2026-02105: Prototype Pollution via constructor.prototype Path Bypassing __proto__-Only Filters
- ATR-2026-02231: Second-Person Direct Existential Threat Coercion

### skill-compromise (39 rules)

- ATR-2026-00060: MCP Skill Impersonation and Supply Chain Attack
- ATR-2026-00120: SKILL.md Prompt Injection
- ATR-2026-00121: Malicious Code in Skill Package
- ATR-2026-00122: Weaponized Skill \u2014 Agent as Attack Tool
- ATR-2026-00123: Over-Privileged Skill \u2014 Excessive Permissions
- ATR-2026-00124: Skill Squatting / Typosquatting
- ATR-2026-00125: Context Poisoning via Compaction Survival
- ATR-2026-00126: Skill Rug Pull Setup Pattern
- ATR-2026-00127: Subcommand Overflow Bypass
- ATR-2026-00128: Hidden Payload in HTML Comment
- ATR-2026-00129: Unicode Tag Character Smuggling
- ATR-2026-00134: Fork Claim and Community Package Impersonation
- ATR-2026-00135: Data Exfiltration URL in Skill Instructions
- ATR-2026-00147: Community Fork Impersonation
- ATR-2026-00149: Skill Data Exfiltration via Compound Patterns
- ATR-2026-00151: Malicious Fork Impersonation via Install Instruction
- ATR-2026-00157: Time-Gated Credential Exfiltration (Rug Pull Timebomb)
- ATR-2026-00200: Agent Memory and Configuration File Tampering
- ATR-2026-00214: Credential Exfiltration via Fake Backup Verification
- ATR-2026-00217: Credential Harvesting via Fake Backup Tool
- ATR-2026-00220: Base64 Encoded Remote Code Execution via Raw IP
- ATR-2026-00222: Browser Credential Harvesting via Session Debug Tool
- ATR-2026-00223: Malicious WhatsApp Skill with Base64 Encoded Reverse Shell Installation
- ATR-2026-00224: Credential Exfiltration via Fake DevOps Tool Initialization
- ATR-2026-00225: Hardcoded Suspicious IP Address in Skill Content
- ATR-2026-00260: LLM Package Hallucination Typosquat Bait
- ATR-2026-00262: Anti-Malware Evasion Code Generation Request
- ATR-2026-00263: Credential File Read Code Generation Request
- ATR-2026-00266: Malware Dropper / Loader Code Generation Request
- ATR-2026-00283: Malware Generation \u2014 Generic Virus and Specific Payload Request
- ATR-2026-00398: HuggingFace Unsafe Model Artifact Load Instruction
- ATR-2026-00425: Natural-Language Persistent Covert Action Hook
- ATR-2026-00427: Natural-Language Fake-Error Instruction Bypass
- ATR-2026-00429: Natural-Language Skill Self-Modification / Persistence Instruction
- ATR-2026-00523: Claude Code Hooks SessionStart Pre-Trust RCE (CVE-2025-59536)
- ATR-2026-00527: Silent git-remote + mirror-push Exfiltration from Skill Instructions
- ATR-2026-00565: The llm CLI tool thru 0.27.1 contains a critical code injection vulnerability via its --functions command-line
- ATR-2026-01755: Backdoor Trojan: Linguistic Trigger Phrase (POT Attack)
- ATR-2026-01756: Backdoor Trojan: Symbol / Emoticon Trigger (POT Attack)

### context-exfiltration (111 rules)

- ATR-2026-00020: System Prompt and Internal Instruction Leakage
- ATR-2026-00021: Credential and Secret Exposure in Agent Output
- ATR-2026-00075: Agent Memory Manipulation
- ATR-2026-00102: Data Exfiltration via Disguised Analytics Collection
- ATR-2026-00113: Credential File Theft from Agent Environment
- ATR-2026-00114: OAuth and API Token Interception
- ATR-2026-00115: Bulk Environment Variable Harvesting and Exfiltration
- ATR-2026-00136: Tool Response Data Piggybacking
- ATR-2026-00141: API Key Leakage via Example Format
- ATR-2026-00142: Data Piggybacking via Casual Transition Words
- ATR-2026-00145: Obfuscated API Key Disclosure
- ATR-2026-00146: Environment Variable Existence Probing
- ATR-2026-00150: Credential Data Leaked in Tool Response
- ATR-2026-00152: Obfuscated Credential Exfiltration via Encoding
- ATR-2026-00162: Credential Access with Exfiltration in Skill Instructions
- ATR-2026-00201: Credential Exfiltration via Shell Pipe
- ATR-2026-00212: mcp-atlassian Credential Leak via Hint Parameter Injection (CVE-2026-27825/27826)
- ATR-2026-00261: Markdown Image URL Data Exfiltration
- ATR-2026-00274: API Key / Secret Credential Generation or Completion Request
- ATR-2026-00275: System Prompt Extraction / Training Data Verbatim Replay
- ATR-2026-00290: Divergence Attack \u2014 Repeat-Word-Forever Training Data Extraction
- ATR-2026-00291: Biometric Surveillance \u2014 Personal Biometric Data Request for Named Individual
- ATR-2026-00293: Educational Records \u2014 Personal Academic/Professional Record Request for Named Individual
- ATR-2026-00294: Financial PII \u2014 Personal Financial Data Request for Named Individual
- ATR-2026-00295: Medical PII \u2014 Personal Medical/Health Data Request for Named Individual
- ATR-2026-00405: Markdown Image URL Exfiltration and XSS Injection
- ATR-2026-00411: API Key Generation and Partial Key Completion Request
- ATR-2026-00421: Natural-Language Covert Conversation Exfiltration Instruction
- ATR-2026-00422: Natural-Language Credential / Secret Disclosure Instruction
- ATR-2026-00423: Natural-Language Sensitive File Disclosure Instruction
- ATR-2026-00424: Natural-Language System Prompt Leak Instruction
- ATR-2026-00426: Natural-Language Output-Injection Credential Embedding
- ATR-2026-00431: Chatbox History Exfiltration via Prompt Injection (CVE-2024-48144, CVE-2024-48145)
- ATR-2026-00449: Spring AI ChatMemory Cross-User Memory Leakage (CVE-2026-41712)
- ATR-2026-00471: Garak Sysprompt-Extraction - mixed_unassigned
- ATR-2026-00501: Data Exfiltration via Markdown Image and Link URL Injection
- ATR-2026-00504: Tool and Function Capability Enumeration
- ATR-2026-00505: System Prompt Extraction - Instruction Dump Request
- ATR-2026-00514: System Prompt Extraction \u2014 Targeted Verbatim Disclosure Attempts
- ATR-2026-00516: LLM Output XSS \u2014 Eliciting JavaScript Payloads from LLM for Browser Injection
- ATR-2026-00524: Claude Code ANTHROPIC_BASE_URL Credential Exfiltration (CVE-2026-21852)
- ATR-2026-00566: LibreChat is a ChatGPT clone with additional features.
- ATR-2026-00569: Agent / MCP tool path traversal and arbitrary file access
- ATR-2026-00571: Cross-site scripting (XSS) in agent / MCP rendered output
- ATR-2026-00574: Paraphrased System-Prompt / Context Extraction (Semantic)
- ATR-2026-00578: Zen MCP Server path-traversal blacklist bypass via non-canonical paths (CVE-2025-66689)
- ATR-2026-00580: MCP session ID / auth token placed in URL query string (session leak via logs, referrer, history)
- ATR-2026-00583: MCP/agent tool reads .env or secret file without user consent (OSV-MCPS-2025-EB70F912)
- ATR-2026-00702: Indirect PI \u2014 Credential / API Key Exfiltration via Agent Action
- ATR-2026-00703: Indirect PI \u2014 Financial Data Exfiltration via Agent Action
- ATR-2026-00704: Indirect PI \u2014 Medical / Genetic Data Exfiltration via Agent Action
- ATR-2026-00705: Indirect PI \u2014 Location, Address, and Browsing History Exfiltration
- ATR-2026-00706: Indirect PI \u2014 Physical / Biometric Media Exfiltration via Agent
- ATR-2026-00707: Indirect PI \u2014 File Exfiltration Combined with Destroy or Tamper
- ATR-2026-00850: Indirect PI \u2014 Credential Exfiltration via Email (API Key / Password / Token)
- ATR-2026-00851: Indirect PI \u2014 Financial / Payment Credential Exfiltration via Agent Email
- ATR-2026-00852: Indirect PI \u2014 Medical Record / Health Data Exfiltration via Agent Email
- ATR-2026-00853: Indirect PI \u2014 Genetic / DNA Data Exfiltration via Agent Email
- ATR-2026-00854: Indirect PI \u2014 Location / GPS Data Exfiltration via Agent Email
- ATR-2026-00855: Indirect PI \u2014 Browsing History / Search History Exfiltration via Agent Email
- ATR-2026-00856: Indirect PI \u2014 Physical Address / PII Exfiltration via Agent Email
- ATR-2026-00857: Indirect PI \u2014 Cloud File Exfiltration (Google Drive / Cloud Storage via Agent)
- ATR-2026-00858: Indirect PI \u2014 Data Exfiltration with Evidence Destruction (Exfil-and-Delete)
- ATR-2026-00859: RAG-Injected PII Exfiltration \u2014 System Instructions Embedded in Retrieved Documents
- ATR-2026-00860: Indirect PI \u2014 Unauthorized Financial Transfer / Payment Initiation Hijack
- ATR-2026-00861: Indirect PI \u2014 Cryptocurrency Transfer / Exchange Deposit Hijack via Injection
- ATR-2026-00862: Indirect PI \u2014 MFA Code / OTP Security Code Exfiltration via Injection
- ATR-2026-00863: Shell Injection Data Exfiltration \u2014 Piped Command Exfiltration via Bash
- ATR-2026-01450: SVG onload XSS Injection via Indirect Prompt Injection
- ATR-2026-01451: IMG onerror XSS Injection via Indirect Prompt Injection
- ATR-2026-01452: Obfuscated javascript: XSS \u2014 Evasion Variants (href, style-expression, null-byte)
- ATR-2026-01453: Markdown Image Injection with Base64 QUERY Exfiltration Carrier
- ATR-2026-01454: Direct Markdown Image/Link Exfil Payload (attacker.com / evil.com)
- ATR-2026-01455: NEW IMPORTANT INSTRUCTIONS Injection Marker in Document Context
- ATR-2026-01456: Debug/CLI Mode Activation for System Prompt and Config Extraction
- ATR-2026-01457: System Prompt Completion and Clone Attack
- ATR-2026-01458: Compare-Bots Sysprompt Fishing \u2014 Role Comparison Extraction
- ATR-2026-01459: Variable-Clone Sysprompt Extraction (ELLA / context-variable Pattern)
- ATR-2026-01460: JSON Format Sysprompt Extraction \u2014 Structured Output Exfil
- ATR-2026-01461: Foreign-Language System Prompt Extraction Request
- ATR-2026-01462: System Prompt Override via Pseudo-Admin / Authority Injection
- ATR-2026-01463: im_end / im_start System Prompt Injection Format Markers
- ATR-2026-01464: Indirect PI Sysprompt-Forged Action Hijack (system_message framing)
- ATR-2026-01605: SSRF AWS Instance Metadata Endpoint Access
- ATR-2026-01606: SSRF Internal Network and Private IP Range Access
- ATR-2026-01607: SSRF Localhost Service Probe
- ATR-2026-01608: SSRF File Scheme Local File Read
- ATR-2026-01753: Ransom Extortion: Email Exfil + Delete + Wire-Transfer Demand
- ATR-2026-01754: Ransom Extortion: Cloud File Exfil + Delete + Payment Demand
- ATR-2026-01770: PII / Credential Extraction via Social Engineering, Obfuscation & Cross-Session Recall (Semantic)
- ATR-2026-01772: Internal-State Reconnaissance \u2014 System Prompt, Config & Tool Enumeration (Semantic)
- ATR-2026-01807: Bulk Data Exfiltration to External Party \u2014 Entire-Database Export & Confidential Disclosure
- ATR-2026-01862: LLMail Email-Tool Exfiltration to Fixed Attacker Address
- ATR-2026-01863: LLMail Post-Summary Exfiltration Directive to Attacker Address
- ATR-2026-01864: LLMail Exfiltration to Obfuscated Attacker Address
- ATR-2026-01890: Injected Code \u2014 Local File Exfiltration to a Remote Endpoint
- ATR-2026-01891: Injected Code \u2014 Live User-Activity / Location / Log Surveillance Exfiltration
- ATR-2026-01892: Injected Code \u2014 Environment-Variable Exfiltration
- ATR-2026-01893: Injected Code \u2014 Host / Hardware Inventory Exfiltration
- ATR-2026-01894: Injected Code \u2014 Browser Cookie / Session-Token Theft
- ATR-2026-01895: Injected Code \u2014 Contact-List Harvest and SMTP Spam Exfiltration
- ATR-2026-01924: System-Instruction Extraction via Reformat \u2014 Summarize / Repeat / Recite the Rules
- ATR-2026-01929: Unauthenticated MCP transport accepts tool calls and falls back to an ambient credential (CVE-2026-48039 / meta-ads-mcp class)
- ATR-2026-02026: System Prompt Extraction - Oblique Referent + Transform
- ATR-2026-02104: MEDIA:/file:// Directive Injection in Tool Result for Local File Exfiltration
- ATR-2026-02107: SSRF via Non-IP Internal Hostname or Domain-Allowlist Authority Bypass
- ATR-2026-02120: MCP/API Tool Argument LFI via Mixed-Encoding Path Separator or file:// URI Scheme Escape
- ATR-2026-02122: Single-Level Directory Traversal to a Named Sensitive Config/Secret File
- ATR-2026-02140: SSRF to Cloud Metadata Endpoint via IPv6 Transition-Address Hex Encoding
- ATR-2026-02190: DNS Exfiltration via Ping/Dig/Nslookup Command with Data-Encoded Subdomain Label
- ATR-2026-02250: Attachment/Upload Tool Argument Reads Sensitive System File or Traverses Outside Workspace

### tool-poisoning (68 rules)

- ATR-2026-00010: Malicious Content in MCP Tool Response
- ATR-2026-00011: Instruction Injection via Tool Output
- ATR-2026-00012: Unauthorized Tool Call Detection
- ATR-2026-00013: SSRF via Agent Tool Calls
- ATR-2026-00061: Skill Description-Behavior Mismatch
- ATR-2026-00062: Hidden Capability in MCP Skill
- ATR-2026-00063: Multi-Skill Chain Attack
- ATR-2026-00065: Malicious Skill Update or Mutation
- ATR-2026-00066: Parameter Injection via Tool Arguments
- ATR-2026-00100: Consent Bypass via Hidden LLM Instructions in Tool Descriptions
- ATR-2026-00101: Trust Escalation via Authority Override Instructions
- ATR-2026-00103: Hidden LLM Safety Bypass Instructions in Tool Descriptions
- ATR-2026-00105: Silent Action Concealment Instructions in Tool Descriptions
- ATR-2026-00106: Schema-Description Contradiction Attack
- ATR-2026-00161: MCP Tool Description \u2014 IMPORTANT Tag Cross-Tool Shadowing Attack
- ATR-2026-00209: MCPwn Runaway Tool Invocation via Retry Directive (CVE-2026-33032)
- ATR-2026-00210: Flowise System Message Override via Template Interpolation (CVE-2025-59528)
- ATR-2026-00259: ANSI Escape Code Terminal Injection
- ATR-2026-00270: XSS Payload Injection in Tool Response Output
- ATR-2026-00277: ECHO Template / Jinja / SQL Command Injection via LLM
- ATR-2026-00393: ANSI Code Elicitation Request
- ATR-2026-00415: Flowise Custom MCP STDIO Command Injection (CVE-2026-40933)
- ATR-2026-00419: Cursor MCP JSON Zero-Click Configuration RCE (CVE-2025-54136)
- ATR-2026-00434: mcp-remote authorization_endpoint OS Command Injection (CVE-2025-6514)
- ATR-2026-00435: Azure MCP Server Missing Authentication for Critical Function (CVE-2026-32211)
- ATR-2026-00448: Spring AI MilvusVectorStore Filter Expression Injection (CVE-2026-41705)
- ATR-2026-00494: SQL Injection and Code Injection Attack Payload Detection
- ATR-2026-00513: Package Hallucination Exploitation \u2014 AI-Suggested Fake Package Installation
- ATR-2026-00521: Shell Command Injection in Agent Tool Context
- ATR-2026-00522: SQL Injection via Natural Language Agent Interface
- ATR-2026-00525: Claude Code Shell Metacharacter in Double-Quoted File Path
- ATR-2026-00529: LiteLLM Proxy SQL Injection (CVE-2026-42208, CISA KEV 2026-05-08)
- ATR-2026-00530: ModelScope MS-Agent Shell Tool Unsanitized Argv RCE (CVE-2026-2256)
- ATR-2026-00531: PraisonAI Unauthenticated Agent API Exploitation (CVE-2026-44338)
- ATR-2026-00532: Apache Doris MCP Server SQL Injection (CVE-2025-66335)
- ATR-2026-00533: Apache Pinot MCP Unauthenticated Remote Cluster Takeover
- ATR-2026-00534: Alibaba RDS MCP Unauthenticated Database Metadata Exfiltration
- ATR-2026-00561: FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name
- ATR-2026-00567: MCP stdio server config command injection via unvalidated test endpoints
- ATR-2026-00568: Agent SSRF to cloud metadata / file inclusion via unvalidated fetch URL
- ATR-2026-00572: SymJack \u2014 Symlink Approval-Path Spoofing Redirects Writes into Agent MCP/Config (RCE on Restart)
- ATR-2026-00575: Miasma / Phantom Gyp \u2014 npm Worm Backdoors AI-Agent Config Files (binding.gyp install-exec + auto-run config injection)
- ATR-2026-00576: Hades / Shai-Hulud \u2014 AI-Agent Credential Harvester in Supply-Chain Package (Anthropic / Claude / MCP key theft + exfil)
- ATR-2026-00577: Command Injection in create-mcp-server-stdio via Unsafe exec() Concatenation (CVE-2025-54994)
- ATR-2026-00581: MCP Tool Rug-Pull \u2014 Post-Approval Description Redefinition Injects Execution Instructions
- ATR-2026-00714: Tool Camouflage \u2014 Forced Specific Tool Invocation via Injected Instruction
- ATR-2026-00715: Tool Knowledge Hijack \u2014 Identity Injection with Tool Call Arguments
- ATR-2026-00720: Tool Misuse \u2014 Privilege Escalation via Social Engineering Agent to Grant Access
- ATR-2026-01300: MCP Tool Description \u2014 Notes Parameter Chat-History Exfiltration
- ATR-2026-01301: MCP Tool Description \u2014 Exclusive Tool Invocation Override
- ATR-2026-01302: Fake Tool Result Prefix \u2014 Injected Instruction via Simulated Completion
- ATR-2026-01303: Tool Schema Enumeration via Social Engineering
- ATR-2026-01306: MCP OAuth Authorization URL \u2014 Command Injection via URL Authority
- ATR-2026-01307: MCP DNS Rebinding Attack \u2014 Hostname Time-Based IP Switching
- ATR-2026-01310: MCP Tool Description \u2014 Compliance/Audit Framing for Mandatory Chat Context
- ATR-2026-01775: MCP Tool-Manifest Poisoning \u2014 Name Squatting, Result Shadowing & Covert-Action Directives (Semantic)
- ATR-2026-01927: mcp-server-kubernetes Command Injection in kubectl_scale / kubectl_patch / explain_resource (CVE-2025-53355)
- ATR-2026-01928: Framelink Figma MCP Server curl-Fallback Command Injection (CVE-2025-53967)
- ATR-2026-01930: MCP Sampling Prompt Injection (Server-to-Client createMessage Abuse)
- ATR-2026-01931: gemini-mcp-tool execAsync Command Injection & @file Exfiltration (CVE-2026-0755)
- ATR-2026-01932: Shadow / Undeclared MCP Server Registration (MCP-38: MCP-18)
- ATR-2026-02041: Shell Command Injection via Echo-Marker Proof-of-Concept in Tool Argument
- ATR-2026-02102: HTML/Script Injection in Tool Call Argument Targeting a Human-Approval Dashboard
- ATR-2026-02141: Unsandboxed Command Execution via Dynamic MCP Server Config (command/args Injection)
- ATR-2026-02145: Python Sandbox Escape via Generator/Coroutine Frame Object Introspection
- ATR-2026-02193: SSRF via Non-Canonical IPv6 Encoding of Loopback/Internal Addresses
- ATR-2026-02194: Malicious Go init() Function Spawning a Process via a Code-Generation Tool
- ATR-2026-02233: Unscoped Destructive or Mass-Disclosure Database Operation Request via Natural Language

### privilege-escalation (43 rules)

- ATR-2026-00040: Privilege Escalation and Admin Function Access
- ATR-2026-00041: Agent Scope Creep Detection
- ATR-2026-00064: Over-Permissioned MCP Skill
- ATR-2026-00107: Privilege Escalation via Delayed Task Execution Bypass
- ATR-2026-00110: Remote Code Execution via eval() and Dynamic Code Injection
- ATR-2026-00111: Shell Metacharacter Injection in Tool Arguments
- ATR-2026-00112: Dynamic Module Loading for Code Execution
- ATR-2026-00143: Casual Unauthorized Privilege Escalation
- ATR-2026-00144: Rationalized Safety Control Bypass
- ATR-2026-00204: Stealth Execution and Persistence Mechanisms
- ATR-2026-00436: Enclave VM Sandbox Escape RCE (CVE-2026-27597)
- ATR-2026-00441: Microsoft Semantic Kernel SessionsPythonPlugin Arbitrary File Write + Startup Persistence (CVE-2026-25592)
- ATR-2026-00451: LiteLLM Proxy Authorization-Header SQL Injection \u2014 CISA KEV (CVE-2026-42208)
- ATR-2026-00528: PraisonAI-Style Auth-Disabled-By-Default Configuration (CVE-2026-44338 family)
- ATR-2026-00539: CrewAI CodeInterpreterTool Sandbox Escape and Prompt-to-Shell RCE (CVE-2026-2275 / VU#221883)
- ATR-2026-00546: CrewAI JSON Loader Arbitrary Local File Read (CVE-2026-2285)
- ATR-2026-00547: CrewAI RAG URL Validation Bypass SSRF (CVE-2026-2286)
- ATR-2026-01600: SQL Injection Tautology RBAC Bypass
- ATR-2026-01601: SQL Injection Destructive DDL Statement
- ATR-2026-01602: SQL Injection UNION SELECT Data Exfiltration
- ATR-2026-01603: SQL Injection Stacked DML Privilege Abuse
- ATR-2026-01604: SQL Injection Information Schema Enumeration
- ATR-2026-01609: Shell Injection Env Exfiltration via Curl/Wget/Netcat Webhook
- ATR-2026-01610: Shell Evasion Subshell and Command Substitution Injection
- ATR-2026-01611: Shell Evasion Eval and Language-Level Exec Injection
- ATR-2026-01612: Debug or Admin Mode Activation for Privilege Escalation
- ATR-2026-01613: RBAC Bypass via Social Engineering (Semantic)
- ATR-2026-01614: BOLA Cross-User Data Access Attempt (Semantic)
- ATR-2026-01615: Sandbox Escape via Shell Metacharacter Command Injection
- ATR-2026-01616: Path Traversal in Agent File Access Requests
- ATR-2026-01802: Covert Backdoor / Surveillance Implant via Software Update
- ATR-2026-01803: Covert Server Intrusion \u2014 Process Injection, Log Tampering, DNS Hijack & Traffic Interception
- ATR-2026-01808: Synthetic-PAN Payment Probe \u2014 Test Credit-Card Data Submitted to a Live Payment System
- ATR-2026-01899: Injected Code \u2014 Unauthorized Remote Access (SSH Key Backdoor / Tunnel / Port Forward)
- ATR-2026-02040: Arbitrary Write to SSH Authorized Keys or Shell Startup File via Unvalidated File-Edit Tool
- ATR-2026-02100: LLM-Generated Cypher Query Injection with Destructive or Administrative Operations
- ATR-2026-02101: Python Sandbox Escape via Dynamically-Constructed Dunder Attribute Chain
- ATR-2026-02123: Authentication Bypass via Bare Query-String Path-Confusion Suffix
- ATR-2026-02142: Download/Attachment Tool Directed to Write Outside Its Sandbox via Absolute-Path Filename
- ATR-2026-02146: Export/Extract Tool Directory Parameter Redirected to a Credential Directory
- ATR-2026-02192: Agent Self-Modifying Its Own Trust/Approval Configuration to a Wildcard
- ATR-2026-02195: Dangerous Process-Hijacking Environment Variable Injected via Config/Env-Update Tool
- ATR-2026-02251: Multi-Tenant Identifier Field (sender_id/owner_id/tenant_id) Carries Path Traversal Into a Storage Write

### model-abuse (40 rules)

- ATR-2026-00072: Model Behavior Extraction
- ATR-2026-00279: Harmful Completion / Continuation Attack
- ATR-2026-00281: EICAR / GTUBE AV Test Signature Output Request
- ATR-2026-00284: Glitch Token Destabilization Attack
- ATR-2026-00289: LMRC Harmful Content Elicitation \u2014 Quack Medicine, Bullying, Slur Usage
- ATR-2026-00292: Self-Harm and Eating Disorder Facilitation Request
- ATR-2026-00298: DoNotAnswer Malicious Use \u2014 Illegal Activity Facilitation Request
- ATR-2026-00299: HarmBench Detailed Harmful Instruction Request \u2014 Step-by-Step Attack Facilitation
- ATR-2026-00413: Malware Code Generation Direct Request
- ATR-2026-00433: ModelCache torch.load() Deserialization RCE (CVE-2025-45146)
- ATR-2026-00502: Training Data Extraction via Divergent Repetition Attack
- ATR-2026-00517: Model Extraction / Distillation Attack via Systematic API Probing
- ATR-2026-01750: DoS via Repeat-Word-N-Times Output Amplification
- ATR-2026-01760: DoS: Forced Infinite / Maximum-Length Output Token Flood
- ATR-2026-01830: Stolen-Credential Account Takeover & Crypto Drain
- ATR-2026-01831: Money Laundering \u2014 Crypto Wallet Layering
- ATR-2026-01833: Darknet Controlled-Substance Procurement
- ATR-2026-01834: Fraudulent Identity Document (Fake Passport) Procurement
- ATR-2026-01835: Human-Trafficking Service Facilitation
- ATR-2026-01836: Trojanized Software Distribution
- ATR-2026-01840: Extremist Propaganda Acquisition & Distribution
- ATR-2026-01841: Deepfake of Real Person for Disinformation
- ATR-2026-01842: Plagiarism-Detector Evasion & Republishing
- ATR-2026-01843: Drug Dealing via Reverse-Spelling Detection Evasion
- ATR-2026-01844: Illegitimate Prescription Fulfillment
- ATR-2026-01845: Banned-Ingredient Product Relabel Fraud
- ATR-2026-01846: Tax Evasion via Offshore Accounts & Shell Companies
- ATR-2026-01847: Immigration / Visa Work Fraud
- ATR-2026-01848: Anonymous Illicit-Drug Marketplace Construction
- ATR-2026-01850: Targeted Doxxing & Threat Campaign
- ATR-2026-01851: Bestiality Content Acquisition & Distribution
- ATR-2026-01852: Romance-Scam Sexual Impersonation
- ATR-2026-01853: Non-Consensual Leaked-Media Purchase & Distribution
- ATR-2026-01854: Falsified Research Abstract Disinformation
- ATR-2026-01855: Content Misappropriation & Republishing as Own
- ATR-2026-01856: Targeted Harmful Content Generation Against People or Protected Groups (Semantic)
- ATR-2026-01896: Injected Code \u2014 Remote-Key Ransomware File Encryption
- ATR-2026-01897: Injected Code \u2014 Local Host Sabotage (Filesystem Destruction / Resource Exhaustion / Hosts Tamper)
- ATR-2026-01898: Injected Code \u2014 Network Denial of Service (Connection Kill / Adapter Disable / Flood)
- ATR-2026-02211: Named Dangerous-Substance Synthesis or Delivery Instruction Request (Non-Step-By-Step Phrasing)

### excessive-autonomy (30 rules)

- ATR-2026-00050: Runaway Agent Loop Detection
- ATR-2026-00051: Agent Resource Exhaustion Detection
- ATR-2026-00052: Cascading Failure Detection in Agent Pipelines
- ATR-2026-00098: Unauthorized Financial Action by AI Agent
- ATR-2026-00099: High-Risk Tool Invocation Without Human Confirmation
- ATR-2026-00428: Natural-Language Unauthorized Shell-Execution Instruction
- ATR-2026-00491: Agent Capability Enumeration via Structured Parse Request
- ATR-2026-00500: SSRF via Agent URL Fetch Instruction
- ATR-2026-00708: Indirect PI \u2014 Unauthorized Financial Transfer via Agent Tool
- ATR-2026-00709: Indirect PI \u2014 Disable Authentication / MFA via Agent Tool
- ATR-2026-00710: Indirect PI \u2014 Unauthorized Physical Access Grant via Smart Lock / Home Automation
- ATR-2026-00711: Indirect PI \u2014 System Sabotage via Destructive Shell Command
- ATR-2026-00712: Indirect PI \u2014 Malicious Package Installation via Agent (pip/npm)
- ATR-2026-00713: Indirect PI \u2014 RCE via Network Shell Command (netcat/curl) Execution
- ATR-2026-00716: Indirect PI \u2014 Data Destruction Instruction via Agent File/Document Tool
- ATR-2026-00718: Tool Misuse \u2014 Autonomous Financial Trading / Crypto Transaction Without Authorization
- ATR-2026-00719: Tool Misuse \u2014 Destructive Bulk Action via Agent (Delete All / Turn Off All)
- ATR-2026-00722: Indirect PI \u2014 Account Manipulation / Emergency Service Dispatch via Pretext
- ATR-2026-01751: Indirect Prompt Injection: Fake-Authority Task Abort
- ATR-2026-01752: Indirect Prompt Injection: CAPTCHA Redirect Task Disruption
- ATR-2026-01773: Excessive Agency \u2014 Scope Hijack, Untrusted Code Execution & Unauthorized Privilege Grant (Semantic)
- ATR-2026-01801: Autonomous-Vehicle Cyber-Physical Sabotage \u2014 Brake/Steering/Sensor Subversion Command
- ATR-2026-01804: Covert Unlogged Action \u2014 Directive to Hide an Action from Records or Detection
- ATR-2026-01805: Financial Fraud Execution \u2014 Ponzi Setup, Fabricated Statements, Unauthorized Redirect & Laundering
- ATR-2026-01806: Clinical Patient-Harm Directive \u2014 Overdose, Falsified Diagnosis, Phantom Billing & Care Neglect
- ATR-2026-01809: Insider Manipulation & Process Corruption \u2014 Market/Data Tampering, Legal-Process Subversion & Pretextual Fund Movement (Semantic)
- ATR-2026-01837: DDoS Attack Orchestration
- ATR-2026-01838: Unauthorized Cryptominer Deployment via SSH
- ATR-2026-01849: Targeted Harassment Bot Deployment
- ATR-2026-02106: Catastrophic-Backtracking Regex Payload in a Search/Query Tool Argument

### data-poisoning (8 rules)

- ATR-2026-00070: Data Poisoning via RAG and Knowledge Base Contamination
- ATR-2026-00073: Malicious Fine-tuning Data
- ATR-2026-00450: Spring AI PromptChatMemoryAdvisor Memory Poisoning (CVE-2026-41713)
- ATR-2026-00570: SQL injection in agent / MCP tool database query
- ATR-2026-01155: Direct Memory Plant Command \u2014 Persistent Fact or Code Storage Injection
- ATR-2026-01774: RAG & Memory Poisoning \u2014 Embedded Directives, Trigger Tokens, False Authority & Coercion (Semantic)
- ATR-2026-02143: Cypher/Graph-Query Injection via Unsanitized node_labels or group_ids Field
- ATR-2026-02144: Stored External Data Reframes Itself as an Administrative Request to Hijack System Prompt

---

## Section 4 — Product surface (what each piece does)

### PanGuard Scan
Static + dynamic analysis on AI agent skill packages before install. Pipeline:
content fingerprint, regex match against 650+ ATR rules, optional LLM second
opinion. Outputs SARIF 2.1.0 (industry-standard threat export) and signed
JSON evidence packs. CLI: `panguard scan <path>`. 60 seconds end-to-end on
a typical npm package.

### PanGuard Guard
Runtime enforcement engine. Subscribes to MCP and Skill events from a host
agent (Claude Code, Cursor, OpenClaw, etc.), runs them through a 4-agent
pipeline (Detect → Analyze → Respond → Report), enforces ATR rules in real
time. Response actions: block_input, block_output, alert, snapshot, kill,
quarantine, notify_telegram, notify_slack, block_ip, custom_script, escalate.
Confidence-based: high-confidence threats are auto-blocked, medium-confidence
are alerted, low-confidence are logged only.

### PanGuard Skill Auditor
Pre-install gate. 8 checks: prompt injection in skill description, suspicious
tool calls, hidden capabilities, supply-chain signals (typosquatting,
postinstall scripts), excessive permissions declared, secret access patterns,
exfiltration patterns, behavior-description mismatch. Designed to fit the
`npm install` → `pga audit` → `npm install` pattern.

### PanGuard Migrator (Community + Enterprise)
Converts legacy Sigma + YARA detections into ATR YAML for the AI agent
runtime. Community version on npm (`@panguard-ai/migrator-community`):
parsers, IR transformer, ATR output, CLI. Enterprise version (proprietary):
5-framework compliance auto-mapping (EU AI Act, OWASP Agentic Top 10:2026,
OWASP LLM Top 10:2025, NIST AI RMF, ISO/IEC 42001), evidence packs with
SHA-256 + Merkle root attestation, ATR upstream contribution pipeline.

### PanGuard MCP Server
Exposes 12 panguard_* tools over Model Context Protocol so any MCP-compatible
agent (Claude Code, Cursor, OpenClaw, NemoClaw, Workbuddy) can use PanGuard
as a security tool. Tools: panguard_scan, panguard_audit_skill,
panguard_guard_start, panguard_guard_stop, panguard_status, panguard_alerts,
panguard_block_ip, panguard_deploy, panguard_init, panguard_generate_report,
panguard_scan_code, plus a discovery tool.

### Threat Cloud
The flywheel. Every PanGuard install becomes a sensor. Novel attack patterns
detected at one tenant are anonymized (hashes only, no payload bodies),
aggregated, and crystallized into new ATR rules. New rules are promoted to
production within minutes if they survive a multi-tenant validation step
(zero false positives on a 432-skill clean corpus, 3+ tenants agreement).

### PanGuard Trap (in development)
Honeypot system. Plants decoy MCP skills, decoy credentials, decoy file paths
in agent-accessible locations. Triggers on read/write/exec to surface
exfiltration intent before damage. Currently in beta.

### PanGuard Chat (in development)
Conversational interface over Guard and Threat Cloud. Operator asks "did any
agent try to read SSH keys this week" — Chat queries the event log and
returns a structured answer plus drill-down.

### PanGuard Report (in development)
Auto-generated compliance reports for SOC 2 (Type 1 and Type 2 evidence),
ISO 27001, Taiwan Cybersecurity Management Act (TCSA), EU AI Act Article 15,
NIST AI RMF. Pulls from Guard event log and PanGuard's own audit trail.

---

## Section 5 — Benchmark methodology

### Garak (NVIDIA jailbreak corpus)
Source: github.com/NVIDIA/garak. 650 adversarial prompts spanning prompt
injection, jailbreaking, encoding tricks, persona attacks. Result: 98%
recall. Methodology: ATR loaded with the full 650+-rule bundle, prompts fed
through detect-only mode (no LLM second opinion), recall = (true positives) /
(true positives + false negatives). Reproducibility: agent-threat-rules
repo, `pnpm bench:garak`.

### SKILL.md (PanGuard wild skill corpus)
Source: scraped from ClawHub, OpenClaw, Skills.sh registries. 498 samples
manually labeled as malicious (252) or benign (246). Result: 100% recall,
97% precision, 0.2% false positive rate. Methodology: ATR v2.1.2 detect-only
mode, full pipeline (regex + fingerprint + content checks). The 0.2% FP rate
is the 1 false positive out of 432 clean skills in the held-out test set.

### PINT (self-built PINT-format corpus)
Source: self-built 850-sample corpus in PINT format,
assembled from deepset/prompt-injections + Lakera Gandalf. This is NOT Lakera's
official private PINT benchmark and is not attributable to any third party.
Result: 63.2% recall, 99.65%
precision. Methodology: ATR regex layer only (no LLM). The lower
recall vs Garak/SKILL.md reflects the corpus being designed for SIEM
detection patterns, not agent-context patterns — Sigma migration via Migrator
is in active development to close the gap.

### Wild scan (live ecosystem audit)
Crawled 96,096 AI agent skill entries from ClawHub (36,378), OpenClaw (56,503),
Skills.sh (3,115), plus a small Hermes-protocol sample (100). Result:
751 confirmed malware skills. Separately, the cumulative
Threat Cloud blacklist stands at 1,096 skills, and
11,324 skills carry at least one suspicious-or-confirmed
threat signal (these are distinct metrics, not interchangeable). 249
triple-threat packages (combined shell + network + filesystem access), 122 packages with
postinstall scripts.

### HackAPrompt cluster mining
Source: HackAPrompt EMNLP 2023 competition corpus
(4,780 deterministic samples). Clustered the miss space,
wrote new rules covering dominant attack families, tightened to zero false
positives on a benign corpus, re-ran. Result: HackAPrompt recall 66.2%,
PINT recall 63.2%, zero new false positives. The number is
honest and below closed-source ML detector claims. The number is not the
point — the methodology is.

---

## Section 6 — Ecosystem integrations (what is shipping where)

### Microsoft AGT (Agent Governance Toolkit)
PR #908 (15 rules, initial) → PR #1277 (287 rules + weekly auto-sync workflow,
merged 2026-04-26). On 2026-05-11, Microsoft Copilot SWE Agent opened
agent-governance-toolkit issue #1981 with regression-test fixtures presuming
ATR detection — a bidirectional integration loop is now operational.

### Cisco AI Defense (skill-scanner)
PR #79 (PoC, 34 rules) → PR #99 (full rule library merged in production with
auto-sync to the latest ATR release, currently 650+ rules,
2026-04-22). skill-scanner is Cisco's commercial scanner; ATR is the rule
engine underneath.

### MISP (taxonomies + galaxy)
PR #323 on misp-taxonomies (rule-ID tagging vocabulary, merged 2026-04-12).
PR #1207 on misp-galaxy (336-rule cluster, merged 2026-05-10). Now part
of the MISP global threat-intel sharing layer.

### OWASP Agentic Security Resource Hub (A-S-R-H)
PR #74 merged 2026-05-11 with "Welcome to the team" greeting from project
lead Mert Satilmaz. Note: this is the third-party A-S-R-H repo; the official
OWASP Foundation repo PR is still pending. Cited as OWASP-affiliated, not
OWASP-official.

### Gen Digital Sage
PR #33 (Norton / Avast / AVG parent company). 2026-04-18. Open and tracked.

### Other open PRs
NVIDIA garak #1676 (full ATR rule pack, 2 review rounds passed), safe-agentic-
framework/safe-mcp #187, IBM mcp-context-forge #4109, meta-llama/PurpleLlama
#206, promptfoo/promptfoo #8529, cisco-ai-defense/mcp-scanner #151,
agentcontrol/agent-control #170.

### npm + PyPI packages (October 2025 onwards)
13 packages combined cross-ecosystem, 10K+ monthly downloads in aggregate.
Notable: agent-threat-rules (npm, 3.4.0), @panguard-ai/migrator-community
(npm, 0.1.0), panguard (npm, 1.5.6).

---

## Section 7 — Recent writing (top 20 blog posts, English)

Full text at panguard.ai/blog/{slug}. Each post also has a zh-TW
counterpart at panguard.ai/zh-TW/blog/{slug}-zh.

### Why You Should Install Security Before You Install Anything Else Into Your AI Agent
- URL: https://panguard.ai/blog/install-security-before-you-install-anything-else
- Date: 2026-07-06
- Excerpt: Every skill, MCP server, and tool you add to an AI agent is unreviewed code with keys to your machine. One command scans before load and guards at runtime.

### How does MITRE ATLAS map to AI-agent detection rules?
- URL: https://panguard.ai/blog/mitre-atlas-for-ai-agents-mapping-attacks-to-detection
- Date: 2026-07-06
- Excerpt: ATR aligns to 34 of 101 top-level MITRE ATLAS techniques and 13 of 16 tactics against the ATLAS v5.6.0 draft. This is the honest state of that crosswalk, gaps included.

### Does EU AI Act Article 15 Require You to Detect Prompt Injection in AI Agents?
- URL: https://panguard.ai/blog/eu-ai-act-article-15-detecting-adversarial-attacks-agents
- Date: 2026-07-06
- Excerpt: Yes. Article 15 makes detecting adversarial attacks like prompt injection a legal duty for high-risk AI, enforced end-2027, not 2026.

### The Agent Action Layer: The Security Gap Every Incumbent Skipped
- URL: https://panguard.ai/blog/the-agent-action-layer-the-security-gap-incumbents-skipped
- Date: 2026-07-05
- Excerpt: Every incumbent secured a layer below where agents act. The tool-call layer, where agents actually get hijacked, was skipped, and it needs an open standard.

### How ATR Detection Benchmarks Actually Work: Every Number, Per Corpus
- URL: https://panguard.ai/blog/how-atr-detection-benchmarks-actually-work
- Date: 2026-07-04
- Excerpt: ATR reports one benchmark per corpus with full context: garak 97.2% recall, PINT-format 99.7% precision, HackAPrompt 69.6% recall, SKILL.md 100% recall. Never one engine-wide number.

### Why does PanGuard report false positives in lanes instead of one number?
- URL: https://panguard.ai/blog/why-we-report-false-positives-in-lanes
- Date: 2026-07-03
- Excerpt: PanGuard reports lane-keyed false positives (~0.24% enforce, ~9% hunt) because a single blended FP number hides which detections you can trust to block.

### MCP Security: 5 Real CVE Classes Every Agent Team Should Know
- URL: https://panguard.ai/blog/mcp-security-5-cve-classes-every-agent-team-should-know
- Date: 2026-07-02
- Excerpt: Five real MCP CVE classes hit production in 2026: network-binding RCE, SSRF credential theft, config/hook exploitation, trusted-server supply-chain poisoning, and tool-description injection.

### How Do You Scan an MCP Server Before You Install It?
- URL: https://panguard.ai/blog/how-to-scan-an-mcp-server-before-you-install-it
- Date: 2026-07-01
- Excerpt: Run `pga scan <target>` before install. It checks the code against nearly 690 ATR rules for prompt injection, secrets, and obfuscation, and flags criticals in seconds.

### How did postmark-mcp silently exfiltrate 3,000-15,000 emails a day for 15 versions?
- URL: https://panguard.ai/blog/postmark-mcp-trusted-server-silent-email-exfiltration
- Date: 2026-06-25
- Excerpt: A trusted MCP server added one BCC line in a version bump and quietly copied thousands of emails daily; signature scanning never saw it because the malicious version had a clean history.

### OWASP Agentic Top 10 (2026): A Field Guide to Executable Detection for All 10 Categories
- URL: https://panguard.ai/blog/owasp-agentic-top-10-field-guide-executable-detection
- Date: 2026-06-23
- Excerpt: The OWASP Agentic Top 10 names ten agent risks; ATR ships 866 rule-to-category mappings covering all 10, nine at STRONG strength and one (ASI10) at MODERATE.

### We Scanned 96,096 AI Agent Skills. 751 Were Malicious. Here Is What They Did.
- URL: https://panguard.ai/blog/we-scanned-96096-ai-agent-skills-751-malicious
- Date: 2026-06-20
- Excerpt: I scanned 96,096 AI agent skills across six public registries and found 751 confirmed malicious. Most attacked at install time, before any runtime guard could see them.

### ATR Implements the Detection Layer the NSA Identified as Missing in MCP
- URL: https://panguard.ai/blog/nsa-mcp-csi-atr-detection-layer
- Date: 2026-05-27
- Excerpt: The NSA published 17 pages on MCP security risks in May 2026. It named zero detection frameworks. ATR fills that layer -- 433 rules covering all five NSA risk categories, merged upstream at Microsoft (AGT community-rules examples), Cisco (skill-scanner rule packs), MISP, and OWASP.

### The Guardrail Company Got Owned. Skill Provenance Is the Layer Below.
- URL: https://panguard.ai/blog/guardrail-company-got-owned
- Date: 2026-05-23
- Excerpt: On 2026-05-11 the Mini Shai-Hulud npm/PyPI worm trojanized 404 package versions, including @mistralai/mistralai and guardrails-ai. A runtime LLM-output guardrail cannot catch an install-time daemon. ATR v3.1.0 ships ATR-2026-00525 covering the gh-token-monitor signature.

### Four Hours. The New Disclosure-to-Exploit Window for AI Agent CVEs.
- URL: https://panguard.ai/blog/four-hour-exploit-window
- Date: 2026-05-18
- Excerpt: PraisonAI was scanned for exploitation 3 hours 44 minutes after disclosure. Microsoft Copilot opened a regression test against ATR rules for the Semantic Kernel CVEs and we shipped the rules in 2 hours 16 minutes. Content-layer detection rules are the only thing operating in that timeframe.

### When Microsoft says prompts are shells, ATR ships detection rules within 2 hours
- URL: https://panguard.ai/blog/microsoft-copilot-loop-2h16m
- Date: 2026-05-13
- Excerpt: On 2026-05-11, between 06:07 and 08:24 UTC, a closed loop ran end-to-end in 2 hours and 16 minutes. Microsoft Copilot SWE Agent opened an issue against microsoft/agent-governance-toolkit containing regression-test fixtures that presumed ATR rule IDs for two Semantic Kernel CVEs disclosed four days earlier (CVE-2026-26030 lambda+eval RCE and CVE-2026-25592 autostart-write persistence). ATR v2.1.2 shipped on npm with rules ATR-2026-00440 and ATR-2026-00441 covering both CVEs. The agent-governance-toolkit issue closed the same day. The rules sat in an external open-source repository the entire time — Microsoft Copilot, operating as a software engineering agent inside AGT, was writing regression tests against a detection contract that lived outside Microsoft. This is a small data point and it is also the first time we have observed a major-vendor Copilot SWE Agent write tests that presume an external open-source detection standard. The Microsoft Security Blog framed the upstream story as a category move: prompt injection is no longer just a content-policy problem, it is a code-execution primitive. If that framing is right, detection has to move down the stack — and the rule has to be the contract.

### 60 Days, 8 Ecosystem Integrations — How an Open Standard Spreads
- URL: https://panguard.ai/blog/60-days-8-ecosystem-integrations
- Date: 2026-05-11
- Excerpt: From v0.1.0 on 2026-03-08 to v2.1.1 with 8 production integrations and standards-body conversations on 2026-05-11. The mechanics behind ecosystem pull.

### Anthropic MCP "By Design" RCE — Where Runtime Detection Fills the Gap
- URL: https://panguard.ai/blog/anthropic-mcp-by-design-rce-runtime-detection-gap
- Date: 2026-05-11
- Excerpt: When the protocol won't change, the detection layer becomes the contract. A walkthrough of the MCP "by design" disclosure and ATR's 17 dedicated MCP rules.

### The 96K-Skill Wild Scan: Methodology Walkthrough
- URL: https://panguard.ai/blog/the-96k-skill-wild-scan-methodology
- Date: 2026-05-11
- Excerpt: How we collected 96,096 production SKILL.md files across four registries, ran ATR v2.1.1 detection, and surfaced 751 confirmed malicious instances with audit-grade reproducibility.

### Bus Factor 1 Is Not a Secret
- URL: https://panguard.ai/blog/bus-factor-one-is-not-a-secret
- Date: 2026-05-11
- Excerpt: Most small open-source projects pretend to have a team. We just shipped governance docs that openly disclose ATR is a single-maintainer project — and explain how that constrains decision-making.

### Three Tier Profiles for Three Risk Postures
- URL: https://panguard.ai/blog/three-tier-profiles-three-risk-postures
- Date: 2026-05-11
- Excerpt: AI RMF is non-normative by design. Our OSCAL catalog ships three worked-example profiles — 18, 55, and 72 controls — to demonstrate composability across foundational, customer-facing, and high-risk deployments.

---

## Section 8 — Where to look next

For source code: github.com/panguard-ai/panguard-ai (monorepo with 18 packages).
For the open rule standard: github.com/Agent-Threat-Rule/agent-threat-rules.
For docs: docs.panguard.ai (Mintlify, en + zh-Hant).
For the marketing site: panguard.ai (Next.js 14, en + zh-TW).
For the sovereign brief: sovereign-ai-defense.vercel.app.
For commercial enquiry: adam@agentthreatrule.org.

This file regenerates on every site build. To request a structured change,
file an issue at github.com/panguard-ai/panguard-ai/issues with the tag
`llms-full`.