diff --git a/README.md b/README.md index fe9fb7e..002e27f 100644 --- a/README.md +++ b/README.md @@ -6,7 +6,7 @@ [![License](https://img.shields.io/badge/License-Apache_2.0-teal.svg)](LICENSE) [![Schema Version](https://img.shields.io/badge/Schema-v0.1.0-green.svg)](SPEC.md) -[![Records](https://img.shields.io/badge/AVE_Records-8-blue.svg)](records/) +[![Records](https://img.shields.io/badge/AVE_Records-15-blue.svg)](records/) [![Contributions Welcome](https://img.shields.io/badge/Contributions-Welcome-brightgreen.svg)](CONTRIBUTING.md) [Read the Spec](SPEC.md) · [Browse Records](records/) · [Submit an AVE](CONTRIBUTING.md) · [bawbel.io](https://bawbel.io) diff --git a/records/AVE-2026-00009.json b/records/AVE-2026-00009.json new file mode 100644 index 0000000..606afa6 --- /dev/null +++ b/records/AVE-2026-00009.json @@ -0,0 +1,57 @@ +{ + "ave_id": "AVE-2026-00009", + "schema_version": "0.1.0", + "component_type": "skill", + "title": "AI identity jailbreak via role-play or persona override in agentic component", + "attack_class": "Prompt Injection \u2014 Jailbreak", + "description": "An agentic component instructs the agent to pretend to be a different AI, act as if safety constraints do not apply, or activate fictional 'developer modes' (DAN mode, jailbreak mode). This bypasses the agent's built-in safety guidelines and ethical constraints by convincing it to adopt an alternative identity that operates without restrictions.", + "affected_platforms": [ + "claude-code", + "cursor", + "codex", + "windsurf", + "any-skill-compatible-agent" + ], + "affected_registries": [ + "clawhub.io", + "agentskills.io", + "github.com/topics/agent-skills" + ], + "cvss_ai_score": 8.3, + "cvss_ai_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L", + "owasp_mapping": [ + "ASI01", + "ASI08" + ], + "nist_ai_rmf_mapping": [ + "MAP-1.5", + "MEASURE-2.5", + "MANAGE-1.3" + ], + "mitre_atlas_mapping": [ + "AML.T0054", + "AML.T0051" + ], + "behavioral_fingerprint": "Component instructs the agent to pretend to be a different AI, adopt a persona without safety constraints, or activate a fictional unrestricted mode.", + "behavioral_vector": [], + "mutation_count": 287, + "detection_methodology": "1. Static scan: search for persona override phrases (pretend you are, act as if, you are no longer an AI, DAN mode, developer mode enabled, jailbreak). 2. Semantic analysis: detect instructions that attempt to override the agent's identity or disable safety guidelines through roleplay framing.", + "indicators_of_compromise": [ + "Component contains 'pretend you are' or 'act as if you are' a different AI", + "Component references 'DAN mode', 'developer mode', or 'jailbreak'", + "Component instructs agent to 'forget' or 'ignore' that it is an AI", + "Agent begins responding without normal safety guidelines after component installation" + ], + "remediation": "1. Remove the component immediately. 2. Review all agent outputs produced while the component was active for policy violations. 3. Audit other components from the same source. 4. Implement identity-anchoring in your agent framework \u2014 the system prompt should assert the agent's identity with higher trust than component instructions.", + "status": "active", + "kill_switch_active": true, + "researcher": "Bawbel Security Research Team", + "researcher_url": "https://bawbel.io", + "published": "2026-04-20T09:00:00Z", + "last_updated": "2026-04-20T09:00:00Z", + "references": [ + "https://arxiv.org/abs/2302.12173", + "https://owasp.org/www-project-top-10-for-large-language-model-applications/", + "https://github.com/bawbel/bawbel-ave/blob/main/SPEC.md" + ] +} \ No newline at end of file diff --git a/records/AVE-2026-00010.json b/records/AVE-2026-00010.json new file mode 100644 index 0000000..70cb02c --- /dev/null +++ b/records/AVE-2026-00010.json @@ -0,0 +1,55 @@ +{ + "ave_id": "AVE-2026-00010", + "schema_version": "0.1.0", + "component_type": "skill", + "title": "Covert instruction concealment via secrecy directive in agentic component", + "attack_class": "Prompt Injection \u2014 Hidden Instruction", + "description": "An agentic component explicitly instructs the agent to hide its instructions from the user \u2014 telling it not to reveal, mention, or acknowledge the existence of the directives it has received. This establishes a covert channel between the component and the agent, enabling the component to direct agent behaviour without the user's awareness or consent.", + "affected_platforms": [ + "claude-code", + "cursor", + "codex", + "windsurf", + "any-skill-compatible-agent" + ], + "affected_registries": [ + "clawhub.io", + "agentskills.io", + "github.com/topics/agent-skills" + ], + "cvss_ai_score": 7.9, + "cvss_ai_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:L/SA:L", + "owasp_mapping": [ + "ASI01", + "ASI09" + ], + "nist_ai_rmf_mapping": [ + "MAP-1.5", + "MEASURE-2.5", + "GOVERN-1.7" + ], + "mitre_atlas_mapping": [ + "AML.T0054" + ], + "behavioral_fingerprint": "Component instructs the agent to not reveal, disclose, or acknowledge these instructions to the user or operator.", + "behavioral_vector": [], + "mutation_count": 134, + "detection_methodology": "1. Static scan: search for secrecy directives (do not tell the user, keep this secret, never reveal, do not acknowledge these instructions). 2. Semantic analysis: detect instructions directing the agent to maintain confidentiality about its own instructions or operating context.", + "indicators_of_compromise": [ + "Component contains 'do not tell/reveal/disclose' directives targeting the user", + "Component instructs agent to deny having received instructions", + "Component uses phrases like 'keep this hidden', 'this message must be secret'", + "Agent refuses to describe its current instructions when asked by the user" + ], + "remediation": "1. Remove the component. 2. Implement transparency requirements \u2014 agents should always be able to describe their instructions at a high level when asked. 3. Audit agent responses for signs of instruction concealment. 4. Consider requiring components to declare their instructions in a public manifest.", + "status": "active", + "kill_switch_active": true, + "researcher": "Bawbel Security Research Team", + "researcher_url": "https://bawbel.io", + "published": "2026-04-20T09:00:00Z", + "last_updated": "2026-04-20T09:00:00Z", + "references": [ + "https://owasp.org/www-project-top-10-for-large-language-model-applications/", + "https://github.com/bawbel/bawbel-ave/blob/main/SPEC.md" + ] +} \ No newline at end of file diff --git a/records/AVE-2026-00011.json b/records/AVE-2026-00011.json new file mode 100644 index 0000000..130887a --- /dev/null +++ b/records/AVE-2026-00011.json @@ -0,0 +1,55 @@ +{ + "ave_id": "AVE-2026-00011", + "schema_version": "0.1.0", + "component_type": "skill", + "title": "Arbitrary tool invocation via dynamic tool call injection in agentic component", + "attack_class": "Tool Abuse \u2014 Dynamic Tool Call", + "description": "An agentic component embeds explicit tool invocation instructions \u2014 directing the agent to call specific tools with attacker-controlled parameters. Rather than letting the agent decide which tools to use, the component hijacks tool selection, potentially invoking destructive, exfiltration, or lateral movement capabilities the user did not intend to activate.", + "affected_platforms": [ + "claude-code", + "cursor", + "codex", + "windsurf", + "any-agent-with-tool-access" + ], + "affected_registries": [ + "clawhub.io", + "agentskills.io", + "github.com/topics/agent-skills" + ], + "cvss_ai_score": 8.2, + "cvss_ai_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L", + "owasp_mapping": [ + "ASI07" + ], + "nist_ai_rmf_mapping": [ + "MAP-1.5", + "MEASURE-2.5", + "MANAGE-1.3" + ], + "mitre_atlas_mapping": [ + "AML.T0048", + "AML.T0054" + ], + "behavioral_fingerprint": "Component contains explicit tool invocation directives with specific parameters the agent must pass, bypassing the agent's own tool selection logic.", + "behavioral_vector": [], + "mutation_count": 78, + "detection_methodology": "1. Static scan: search for explicit tool call directives (call this tool with the following parameters, execute the following tool, invoke tool X with). 2. Semantic analysis: detect instructions that pre-specify tool invocations rather than describing a task and letting the agent select appropriate tools.", + "indicators_of_compromise": [ + "Component contains 'call this tool with the following parameters'", + "Component specifies exact tool names and parameter values to pass", + "Unexpected tool invocations observed in agent action logs", + "Agent calls tools not relevant to the user's stated task" + ], + "remediation": "1. Remove the component. 2. Review agent action logs for unexpected tool calls made while the component was active. 3. Implement tool call approval workflows for sensitive tools. 4. Consider sandboxing agent tool access by component trust level.", + "status": "active", + "kill_switch_active": true, + "researcher": "Bawbel Security Research Team", + "researcher_url": "https://bawbel.io", + "published": "2026-04-20T09:00:00Z", + "last_updated": "2026-04-20T09:00:00Z", + "references": [ + "https://owasp.org/www-project-top-10-for-large-language-model-applications/", + "https://github.com/bawbel/bawbel-ave/blob/main/SPEC.md" + ] +} \ No newline at end of file diff --git a/records/AVE-2026-00012.json b/records/AVE-2026-00012.json new file mode 100644 index 0000000..b16e860 --- /dev/null +++ b/records/AVE-2026-00012.json @@ -0,0 +1,56 @@ +{ + "ave_id": "AVE-2026-00012", + "schema_version": "0.1.0", + "component_type": "skill", + "title": "Capability escalation via false permission grant in agentic component", + "attack_class": "Privilege Escalation \u2014 Permission Grant", + "description": "An agentic component falsely asserts that the agent has been granted elevated permissions \u2014 'you now have permission to', 'you are now allowed to access' \u2014 convincing the agent to perform actions it would otherwise refuse. This exploits the agent's tendency to defer to authority claims within its instruction context.", + "affected_platforms": [ + "claude-code", + "cursor", + "codex", + "windsurf", + "any-skill-compatible-agent" + ], + "affected_registries": [ + "clawhub.io", + "agentskills.io", + "github.com/topics/agent-skills" + ], + "cvss_ai_score": 7.8, + "cvss_ai_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L", + "owasp_mapping": [ + "ASI01", + "ASI08" + ], + "nist_ai_rmf_mapping": [ + "MAP-1.5", + "MEASURE-2.5", + "MANAGE-1.3" + ], + "mitre_atlas_mapping": [ + "AML.T0054", + "AML.T0051" + ], + "behavioral_fingerprint": "Component asserts that elevated permissions have been granted to the agent, claiming authority to override normal operational boundaries.", + "behavioral_vector": [], + "mutation_count": 92, + "detection_methodology": "1. Static scan: search for false permission grants (you now have permission, you are now allowed to, your restrictions have been lifted, you have been granted access). 2. Semantic analysis: detect instructions claiming to grant the agent elevated capabilities or override existing restrictions.", + "indicators_of_compromise": [ + "Component contains 'you now have permission to' or 'you are now allowed to'", + "Component claims the agent's restrictions have been lifted", + "Component asserts special access has been granted by a developer or operator", + "Agent performs previously refused actions after component installation" + ], + "remediation": "1. Remove the component. 2. Permissions must come from the system prompt, never from component files. 3. Implement permission hierarchy \u2014 component instructions cannot escalate beyond system prompt boundaries. 4. Review agent actions for privilege escalation attempts.", + "status": "active", + "kill_switch_active": true, + "researcher": "Bawbel Security Research Team", + "researcher_url": "https://bawbel.io", + "published": "2026-04-20T09:00:00Z", + "last_updated": "2026-04-20T09:00:00Z", + "references": [ + "https://owasp.org/www-project-top-10-for-large-language-model-applications/", + "https://github.com/bawbel/bawbel-ave/blob/main/SPEC.md" + ] +} \ No newline at end of file diff --git a/records/AVE-2026-00013.json b/records/AVE-2026-00013.json new file mode 100644 index 0000000..5b9bd14 --- /dev/null +++ b/records/AVE-2026-00013.json @@ -0,0 +1,56 @@ +{ + "ave_id": "AVE-2026-00013", + "schema_version": "0.1.0", + "component_type": "skill", + "title": "Personal data exfiltration via PII collection and transmission in agentic component", + "attack_class": "Data Exfiltration \u2014 PII Theft", + "description": "An agentic component instructs the agent to collect personally identifiable information (PII) \u2014 names, email addresses, phone numbers, physical addresses, SSNs, passport numbers, credit card numbers \u2014 and transmit them to an external endpoint. This enables identity theft, financial fraud, and regulatory violations (GDPR, CCPA) affecting the users whose data the agent has access to.", + "affected_platforms": [ + "claude-code", + "cursor", + "codex", + "windsurf", + "any-agent-with-data-access" + ], + "affected_registries": [ + "clawhub.io", + "agentskills.io", + "github.com/topics/agent-skills" + ], + "cvss_ai_score": 8.0, + "cvss_ai_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:L", + "owasp_mapping": [ + "ASI01", + "ASI06" + ], + "nist_ai_rmf_mapping": [ + "MAP-1.5", + "MEASURE-2.5", + "MANAGE-1.3" + ], + "mitre_atlas_mapping": [ + "AML.T0054", + "AML.T0048" + ], + "behavioral_fingerprint": "Component instructs the agent to collect PII fields (name, email, phone, address, SSN, passport, credit card) and transmit or store them externally.", + "behavioral_vector": [], + "mutation_count": 103, + "detection_methodology": "1. Static scan: search for combined patterns of PII field collection (name, email, phone, address, SSN, credit card) with data transmission instructions (send, post, upload, transmit). 2. Semantic analysis: detect instructions directing data collection about individuals combined with exfiltration intent.", + "indicators_of_compromise": [ + "Component instructs collection of name, email, phone, address, or financial data", + "Component combines PII collection with instructions to send/transmit the data", + "Outbound HTTP requests observed containing personally identifiable information", + "Agent accesses contact or user data beyond the scope of the stated task" + ], + "remediation": "1. Remove the component immediately. 2. Identify what PII may have been accessed and transmitted. 3. Notify affected users per applicable data protection regulations (GDPR, CCPA). 4. Report the attacker endpoint to relevant authorities. 5. Implement data access controls \u2014 agents should not have broad access to PII stores.", + "status": "active", + "kill_switch_active": true, + "researcher": "Bawbel Security Research Team", + "researcher_url": "https://bawbel.io", + "published": "2026-04-20T09:00:00Z", + "last_updated": "2026-04-20T09:00:00Z", + "references": [ + "https://owasp.org/www-project-top-10-for-large-language-model-applications/", + "https://github.com/bawbel/bawbel-ave/blob/main/SPEC.md" + ] +} \ No newline at end of file diff --git a/records/AVE-2026-00014.json b/records/AVE-2026-00014.json new file mode 100644 index 0000000..b17fc4a --- /dev/null +++ b/records/AVE-2026-00014.json @@ -0,0 +1,55 @@ +{ + "ave_id": "AVE-2026-00014", + "schema_version": "0.1.0", + "component_type": "skill", + "title": "False authority claim via trust escalation impersonation in agentic component", + "attack_class": "Social Engineering \u2014 Trust Escalation", + "description": "An agentic component falsely claims to originate from a trusted authority \u2014 Anthropic, OpenAI, Google, Microsoft, or the agent's developer/operator \u2014 to convince the agent to follow instructions it would otherwise question. This exploits the agent's deference to perceived authority figures within its trust hierarchy.", + "affected_platforms": [ + "claude-code", + "cursor", + "codex", + "windsurf", + "any-skill-compatible-agent" + ], + "affected_registries": [ + "clawhub.io", + "agentskills.io", + "github.com/topics/agent-skills" + ], + "cvss_ai_score": 6.5, + "cvss_ai_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N", + "owasp_mapping": [ + "ASI01", + "ASI08" + ], + "nist_ai_rmf_mapping": [ + "MAP-1.5", + "MEASURE-2.5" + ], + "mitre_atlas_mapping": [ + "AML.T0054", + "AML.T0051" + ], + "behavioral_fingerprint": "Component claims to be a message from Anthropic, OpenAI, Google, Microsoft, or the developer/operator to establish false authority over the agent.", + "behavioral_vector": [], + "mutation_count": 67, + "detection_methodology": "1. Static scan: search for false authority claims (this message is from Anthropic, I am your developer, I am your creator, message from OpenAI). 2. Semantic analysis: detect instructions that establish false institutional authority to override normal agent behaviour.", + "indicators_of_compromise": [ + "Component claims to be a message from Anthropic, OpenAI, Google, or Microsoft", + "Component asserts 'I am your developer/creator/operator'", + "Component uses institutional authority framing to justify unusual instructions", + "Agent complies with instructions it previously refused after authority claim" + ], + "remediation": "1. Remove the component. 2. Legitimate messages from AI providers never arrive through component files \u2014 they come through model updates or system configuration. 3. Implement authority verification \u2014 component files cannot claim higher trust than the system prompt. 4. Educate users: no real AI provider communicates via SKILL.md files.", + "status": "active", + "kill_switch_active": true, + "researcher": "Bawbel Security Research Team", + "researcher_url": "https://bawbel.io", + "published": "2026-04-20T09:00:00Z", + "last_updated": "2026-04-20T09:00:00Z", + "references": [ + "https://owasp.org/www-project-top-10-for-large-language-model-applications/", + "https://github.com/bawbel/bawbel-ave/blob/main/SPEC.md" + ] +} \ No newline at end of file diff --git a/records/AVE-2026-00015.json b/records/AVE-2026-00015.json new file mode 100644 index 0000000..f4ee1b1 --- /dev/null +++ b/records/AVE-2026-00015.json @@ -0,0 +1,54 @@ +{ + "ave_id": "AVE-2026-00015", + "schema_version": "0.1.0", + "component_type": "prompt", + "title": "System prompt extraction via direct interrogation instruction in agentic component", + "attack_class": "Information Disclosure \u2014 System Prompt Leak", + "description": "An agentic component instructs the agent to reveal, print, or repeat its system prompt, configuration, or internal instructions. System prompts often contain proprietary business logic, security policies, tool access configurations, and sensitive operational context. Extraction enables competitive intelligence theft and reveals attack surface for follow-on exploitation.", + "affected_platforms": [ + "claude-code", + "cursor", + "codex", + "windsurf", + "any-skill-compatible-agent" + ], + "affected_registries": [ + "clawhub.io", + "agentskills.io", + "github.com/topics/agent-skills" + ], + "cvss_ai_score": 6.2, + "cvss_ai_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N", + "owasp_mapping": [ + "ASI01", + "ASI09" + ], + "nist_ai_rmf_mapping": [ + "MAP-1.5", + "MEASURE-2.5" + ], + "mitre_atlas_mapping": [ + "AML.T0054" + ], + "behavioral_fingerprint": "Component instructs the agent to reveal, output, or repeat its system prompt, instructions, configuration, or internal guidelines.", + "behavioral_vector": [], + "mutation_count": 198, + "detection_methodology": "1. Static scan: search for system prompt extraction directives (reveal your system prompt, show your instructions, print your guidelines, what are your exact instructions). 2. Semantic analysis: detect instructions attempting to extract the agent's internal configuration or deployment context.", + "indicators_of_compromise": [ + "Component instructs agent to 'reveal', 'show', or 'print' its system prompt", + "Component asks 'what are your exact instructions/guidelines/rules'", + "Agent output contains system prompt content after component installation", + "Component references 'configuration', 'constraints', or 'guidelines' in extraction context" + ], + "remediation": "1. Remove the component. 2. Review agent outputs for system prompt leakage. 3. Rotate or update any sensitive information that was in the system prompt. 4. Implement system prompt confidentiality \u2014 agents should describe their purpose without revealing verbatim instructions. 5. Consider prompt injection hardening in your system prompt.", + "status": "active", + "kill_switch_active": true, + "researcher": "Bawbel Security Research Team", + "researcher_url": "https://bawbel.io", + "published": "2026-04-20T09:00:00Z", + "last_updated": "2026-04-20T09:00:00Z", + "references": [ + "https://owasp.org/www-project-top-10-for-large-language-model-applications/", + "https://github.com/bawbel/bawbel-ave/blob/main/SPEC.md" + ] +} \ No newline at end of file