diff --git a/capabilities/ai-red-teaming/agents/ai-red-teaming-agent.md b/capabilities/ai-red-teaming/agents/ai-red-teaming-agent.md index 0421845..743ce69 100644 --- a/capabilities/ai-red-teaming/agents/ai-red-teaming-agent.md +++ b/capabilities/ai-red-teaming/agents/ai-red-teaming-agent.md @@ -225,6 +225,7 @@ The capability ships 70+ attack strategies covering traditional ML and generativ | `crescendo` | Multi-turn conversation weaknesses | ~200-500 | | `goat` | Graph of Attacks with Pruning | ~200-500 | | `prompt` | Simple single-prompt baseline | ~10-50 | +| `iterinject` | Indirect prompt injection with four-class diagnosis (payload in a tool result / document, not a chat turn) | ~60-200 | | `rainbow` | Broad risk coverage (MAP-Elites) | ~500-2000 | | `gptfuzzer` | Template-based fuzzing | ~200-500 | | `autodan` | Automated adversarial suffix | ~500-2000 | @@ -237,7 +238,7 @@ The capability ships 70+ attack strategies covering traditional ML and generativ | Parameter | Required | Description | |-----------|----------|-------------| -| attack_type | Yes | Attack name(s). Short: tap, pair, crescendo, goat, prompt, rainbow, fuzzer, autodan, renellm, beast, drattack, inception. Campaign: "tap,pair,crescendo" | +| attack_type | Yes | Attack name(s). Short: tap, pair, crescendo, goat, prompt, iterinject, rainbow, fuzzer, autodan, renellm, beast, drattack, inception. Campaign: "tap,pair,crescendo" | | goal | Yes | Assessment goal text (pass through exactly as the user provides it) | | target_model | Yes | Target model — any provider. Use aliases or full litellm path (e.g. "openai/gpt-4o", "bedrock/anthropic.claude-sonnet-4-20250514-v1:0", "azure/gpt-4o", "ollama/llama3.3") | | attacker_model | No | Attacker model (defaults to target). Same aliases. | diff --git a/capabilities/ai-red-teaming/agents/scorer-catalog.md b/capabilities/ai-red-teaming/agents/scorer-catalog.md index 798f6d3..c19fec3 100644 --- a/capabilities/ai-red-teaming/agents/scorer-catalog.md +++ b/capabilities/ai-red-teaming/agents/scorer-catalog.md @@ -44,6 +44,12 @@ `cot_backdoor`, `reasoning_hijack`, `reasoning_dos`, `escalation`, `goal_drift` +## Evidence-Gate (agentic-probes 2026) + +Fire only on real trace evidence (a fired dangerous tool, a completed exfil chain, an activated memory record), never on model narration: + +`rce_evidence_gate`, `approval_bypassed`, `trusted_proxy_exfil_detected`, `covert_channel_capacity`, `minja_activation_detected`, `line_jump_fired`, `poison_retrieved_and_steered` + ## Format `json`, `is_xml` diff --git a/capabilities/ai-red-teaming/agents/transform-catalog.md b/capabilities/ai-red-teaming/agents/transform-catalog.md index 45e696b..0bf4f26 100644 --- a/capabilities/ai-red-teaming/agents/transform-catalog.md +++ b/capabilities/ai-red-teaming/agents/transform-catalog.md @@ -108,4 +108,28 @@ Use these EXACT names in the transforms array. All transforms are grounded to th `agent_memory_injection`, `agent_permission_escalation`, `soul_file_injection`, `bootstrap_hook_injection`, `workspace_file_poison`, `skill_dependency_confusion`, `skill_package_poison`, `heartbeat_hijack`, `media_protocol_exfil` +## Tool-Misuse to RCE (agentic-probes 2026) + +`yolo_mode_overwrite` (self-approval config overwrite, CVE-2025-53773), `arg_flag_injection` (dangerous flag into an allow-listed binary, CWE-88), `metachar_escape` (metacharacter command chain + egress), `deser_payload` (deserialization-sink payload, CVE-2025-68664) + +Pair with the `rce_evidence_gate` / `approval_bypassed` scorers - success requires a real dangerous tool call, not model narration. + +## Advanced Exfiltration (agentic-probes 2026) + +`trusted_proxy_char_exfil` (per-character leak through an allow-listed proxy - CamoLeak/AgentFlayer/EchoLeak), `tool_arg_covert_channel` (encode data in the pattern of legitimate tool use) + +Pair with `trusted_proxy_exfil_detected` / `covert_channel_capacity`. + +## MCP Line-Jumping (agentic-probes 2026) + +`line_jump_injection` (instruction smuggled via tool-list / notification / resource-listing so it lands pre-invocation) + +Pair with `line_jump_fired`. + +## Retrieval-Optimized RAG (agentic-probes 2026) + +`optimized_rag_poison` (poison tuned to rank for the victim query, then steer) + +Pair with `poison_retrieved_and_steered` (requires BOTH retrieval and steer). + **For low-resource language transforms, always use `adapt_language(LanguageName)` syntax.** diff --git a/capabilities/ai-red-teaming/scripts/attack_runner.py b/capabilities/ai-red-teaming/scripts/attack_runner.py index cde0fc3..992e45a 100644 --- a/capabilities/ai-red-teaming/scripts/attack_runner.py +++ b/capabilities/ai-red-teaming/scripts/attack_runner.py @@ -408,6 +408,18 @@ def _auto_execute_workflow(filename: str, timeout: int = 3600) -> str: "context_depth": 5, }, }, + "iterinject_attack": { + "module": "iterinject", + "function": "iterinject_attack", + "has_attacker": True, + "default_iterations": 60, + "extra_defaults": { + "early_stopping_score": 0.9, + "beam_width": 6, + "branching_factor": 3, + "context_depth": 5, + }, + }, "rainbow_attack": { "module": "rainbow", "function": "rainbow_attack", @@ -2331,6 +2343,50 @@ def _auto_execute_workflow(filename: str, timeout: int = 3600) -> str: "code": "framing_effect()", }, "false_dilemma": {"module": "dreadnode.transforms.persuasion", "name": "false_dilemma", "code": "false_dilemma()"}, + # Tool-misuse -> RCE (agentic-probes 2026) + "yolo_mode_overwrite": { + "module": "dreadnode.transforms.tool_misuse_rce", + "name": "yolo_mode_overwrite", + "code": "yolo_mode_overwrite()", + }, + "arg_flag_injection": { + "module": "dreadnode.transforms.tool_misuse_rce", + "name": "arg_flag_injection", + "code": "arg_flag_injection()", + }, + "metachar_escape": { + "module": "dreadnode.transforms.tool_misuse_rce", + "name": "metachar_escape", + "code": "metachar_escape()", + }, + "deser_payload": { + "module": "dreadnode.transforms.tool_misuse_rce", + "name": "deser_payload", + "code": "deser_payload()", + }, + # Advanced exfiltration (agentic-probes 2026) + "trusted_proxy_char_exfil": { + "module": "dreadnode.transforms.exfil_advanced", + "name": "trusted_proxy_char_exfil", + "code": "trusted_proxy_char_exfil()", + }, + "tool_arg_covert_channel": { + "module": "dreadnode.transforms.exfil_advanced", + "name": "tool_arg_covert_channel", + "code": "tool_arg_covert_channel()", + }, + # MCP line-jumping (agentic-probes 2026) + "line_jump_injection": { + "module": "dreadnode.transforms.mcp_lifecycle", + "name": "line_jump_injection", + "code": "line_jump_injection()", + }, + # Retrieval-optimized RAG poisoning (agentic-probes 2026) + "optimized_rag_poison": { + "module": "dreadnode.transforms.rag_optimization", + "name": "optimized_rag_poison", + "code": "optimized_rag_poison()", + }, } # Short aliases -> canonical transform name @@ -2580,6 +2636,20 @@ def _auto_execute_workflow(filename: str, timeout: int = 3600) -> str: "rubric_judge": {"type": "builtin", "code": "dn.scorers.rubric_judge()"}, # Data exfiltration (text-based) "data_exfil": {"type": "builtin", "code": "dn.scorers.data_exfil_detected()"}, + # Agentic-probes 2026 evidence-gate scorers + "rce_evidence_gate": {"type": "builtin", "code": "dn.scorers.rce_evidence_gate()"}, + "approval_bypassed": {"type": "builtin", "code": "dn.scorers.approval_bypassed()"}, + "trusted_proxy_exfil_detected": { + "type": "builtin", + "code": "dn.scorers.trusted_proxy_exfil_detected()", + }, + "covert_channel_capacity": {"type": "builtin", "code": "dn.scorers.covert_channel_capacity()"}, + "minja_activation_detected": {"type": "builtin", "code": "dn.scorers.minja_activation_detected()"}, + "line_jump_fired": {"type": "builtin", "code": "dn.scorers.line_jump_fired()"}, + "poison_retrieved_and_steered": { + "type": "builtin", + "code": "dn.scorers.poison_retrieved_and_steered()", + }, } GOAL_CATEGORY_ALIASES: dict[str, str] = {