{"corpus_version":"2026.07.29","rule_count":24,"rules":[{"id":"io.ignore_previous","family":"instruction_override","severity":40,"description":"Tells the model to ignore/disregard prior or system instructions.","match_kind":"regex","pattern":"\\b(ignore|disregard|forget)\\b[^.\\n]{0,40}\\b(previous|prior|above|earlier|all)\\b[^.\\n]{0,20}\\b(instruction|instructions|prompt|prompts|context|rules?)\\b"},{"id":"io.new_instructions","family":"instruction_override","severity":25,"description":"Announces replacement 'new instructions' to override the current task.","match_kind":"regex","pattern":"\\bnew\\s+(instructions?|rules?|system\\s+prompt)\\b\\s*[:\\-]"},{"id":"io.override_system","family":"instruction_override","severity":40,"description":"Directly asks to override/replace the system prompt.","match_kind":"regex","pattern":"\\b(override|replace|update)\\b[^.\\n]{0,20}\\b(your\\s+)?system\\s+prompt\\b"},{"id":"ex.reveal_system_prompt","family":"system_prompt_exfil","severity":40,"description":"Requests disclosure of the hidden system prompt or initial instructions.","match_kind":"regex","pattern":"\\b(reveal|print|repeat|show|output|display|tell me)\\b[^.\\n]{0,30}\\b(system\\s+prompt|initial\\s+instructions?|your\\s+instructions?|the\\s+prompt\\s+above)\\b"},{"id":"ex.repeat_words_above","family":"system_prompt_exfil","severity":25,"description":"The 'repeat the words above' prompt-leak trick.","match_kind":"regex","pattern":"\\brepeat\\b[^.\\n]{0,20}\\b(the\\s+)?(words|text|everything)\\b[^.\\n]{0,10}\\babove\\b"},{"id":"sx.api_key","family":"secret_exfil","severity":40,"description":"Seeks API keys, tokens, or credentials.","match_kind":"regex","pattern":"\\b(api[_\\s\\-]?key|secret\\s+key|access\\s+token|bearer\\s+token|password|private\\s+key|credentials?)\\b"},{"id":"sx.env_vars","family":"secret_exfil","severity":25,"description":"Asks for environment variables or a .env file.","match_kind":"regex","pattern":"\\b(environment\\s+variables?|env\\s+vars?|\\.env\\b|process\\.env|os\\.environ)\\b"},{"id":"sx.exfil_to_url","family":"secret_exfil","severity":40,"description":"Instructs sending/posting data to an external URL (exfiltration sink).","match_kind":"regex","pattern":"\\b(send|post|upload|exfiltrate|leak|forward|transmit)\\b[^.\\n]{0,40}\\b(to\\s+)?https?://"},{"id":"th.invoke_tool","family":"tool_hijack","severity":25,"description":"Directs the agent to call a specific tool/function on the attacker's behalf.","match_kind":"regex","pattern":"\\b(call|invoke|run|execute|use)\\b[^.\\n]{0,25}\\b(tool|function|command|api)\\b[^.\\n]{0,25}\\b(with|to)\\b"},{"id":"th.destructive_action","family":"tool_hijack","severity":40,"description":"Directs a destructive/irreversible tool action.","match_kind":"regex","pattern":"\\b(delete|remove|drop|wipe|erase|revoke|disable)\\b[^.\\n]{0,25}\\b(all|database|table|files?|repo|account|backups?)\\b"},{"id":"ph.redirect_payment","family":"payment_hijack","severity":40,"description":"Tries to redirect a payment recipient / on-chain address.","match_kind":"regex","pattern":"\\b(send|transfer|pay|wire|route|redirect)\\b[^.\\n]{0,40}\\b(0x[0-9a-f]{40}|to\\s+(my|this)\\s+(wallet|address|account))\\b"},{"id":"ph.change_recipient","family":"payment_hijack","severity":40,"description":"Tries to change the recipient / payout address of a transaction.","match_kind":"regex","pattern":"\\b(change|update|replace|set)\\b[^.\\n]{0,25}\\b(recipient|payee|payout|destination)\\b[^.\\n]{0,25}\\b(address|wallet|account|to)\\b"},{"id":"ph.approve_unlimited","family":"payment_hijack","severity":40,"description":"Requests an unlimited / max token approval (drain pattern).","match_kind":"regex","pattern":"\\bapprove\\b[^.\\n]{0,25}\\b(unlimited|max|maximum|infinite|all)\\b"},{"id":"rm.you_are_now","family":"role_manipulation","severity":25,"description":"Reassigns the model's role/persona ('you are now ...').","match_kind":"regex","pattern":"\\byou\\s+are\\s+now\\b|\\bfrom\\s+now\\s+on\\s+you\\b|\\bact\\s+as\\b|\\bpretend\\s+to\\s+be\\b"},{"id":"rm.jailbreak_persona","family":"role_manipulation","severity":25,"description":"Known jailbreak persona / 'developer mode' triggers.","match_kind":"regex","pattern":"\\b(developer\\s+mode|jailbreak|do\\s+anything\\s+now|\\bdan\\b|unfiltered|without\\s+(any\\s+)?restrictions?)\\b"},{"id":"rm.no_refusal","family":"role_manipulation","severity":10,"description":"Instructs the model not to refuse / not to warn.","match_kind":"regex","pattern":"\\b(do\\s+not|don't|never)\\b[^.\\n]{0,15}\\b(refuse|decline|warn|apologi[sz]e)\\b"},{"id":"dm.markdown_image_exfil","family":"markdown_exfil","severity":40,"description":"Markdown image whose URL carries a query string — classic silent exfil channel.","match_kind":"regex","pattern":"!\\[[^\\]]*\\]\\(\\s*https?://[^)\\s]+\\?[^)\\s]+\\)"},{"id":"di.chat_template_tokens","family":"delimiter_injection","severity":25,"description":"Injects chat-template / role delimiter tokens to break out of the data channel.","match_kind":"regex","pattern":"<\\|im_start\\|>|<\\|im_end\\|>|\\[/?inst\\]|<<sys>>|<\\|system\\|>|###\\s*(system|assistant|instruction)"},{"id":"se.authority_pressure","family":"social_engineering","severity":10,"description":"Manufactured authority/urgency to pressure the agent into compliance.","match_kind":"regex","pattern":"\\b(the\\s+(admin|owner|developer|ceo)\\s+(authori[sz]ed|approved|said)|this\\s+is\\s+(urgent|an\\s+emergency)|you\\s+have\\s+permission\\s+to)\\b"},{"id":"se.decode_and_follow","family":"social_engineering","severity":25,"description":"Asks the model to decode an encoded blob and then follow it as instructions.","match_kind":"regex","pattern":"\\b(decode|base64\\s*decode|un-?escape|rot13)\\b[^.\\n]{0,30}\\b(and\\s+)?(then\\s+)?(follow|execute|run|do|obey)\\b"},{"id":"ob.unicode_tag_chars","family":"obfuscation","severity":40,"description":"Contains invisible Unicode tag characters (U+E0000..E007F) used to smuggle text.","match_kind":"predicate","pattern":null},{"id":"ob.bidi_override","family":"obfuscation","severity":25,"description":"Contains bidirectional override characters that can reorder displayed text.","match_kind":"predicate","pattern":null},{"id":"ob.zero_width","family":"obfuscation","severity":10,"description":"Contains zero-width characters (possible hidden-text channel).","match_kind":"predicate","pattern":null},{"id":"ob.long_base64","family":"obfuscation","severity":10,"description":"Contains a long base64-like blob (possible encoded instruction payload).","match_kind":"predicate","pattern":null}]}