8d8d4e7002
Adds attack-simulator coverage for the new defenses landed earlier in
Batch B. All eight scenarios pass against the current hooks (72/72,
zero gaps). E15 (memory-poisoning glob) and E18 (entropy markdown-image
CDN allowlist) are scanner-only and have unit/integration coverage in
their respective scanner test files.
unicode-evasion (pre-prompt-inject-scan):
UNI-007 E1 PUA-A range hidden Unicode → HIGH advisory
UNI-008 E1 PUA-B range hidden Unicode → HIGH advisory
UNI-009 E16 Greek-Latin homoglyph fold → CRITICAL block
mcp-output (post-mcp-verify):
MCP-005 E4 Markdown link-title injection → markdown-link-title-injection
MCP-006 E5 SVG <desc> injection → svg-element-injection
MCP-007 E5 SVG <foreignObject> injection → svg-element-injection
MCP-008 E7 HTML comment-node injection (no marker) → html-comment-injection
session-trifecta (post-session-guard):
TRI-004 E17 Escalation-after-input (WebFetch → Task) → escalation-after-input advisory
Payload helpers `buildPuaAPayload` / `buildPuaBPayload` shift each
character into Supplementary Private Use Area-A / -B respectively.
The Greek-fold payload uses Greek ι (U+03B9 → i) and ο (U+03BF → o)
so foldHomoglyphs reproduces the canonical "ignore previous
instructions" CRITICAL pattern.
Total: 64 → 72 scenarios.
Refs: Batch B Wave 6 / Step 14 / v7.2.0
|
||
|---|---|---|
| .. | ||
| ai-psychosis | ||
| config-audit | ||
| graceful-handoff | ||
| linkedin-thought-leadership | ||
| llm-security | ||
| ms-ai-architect | ||
| okr | ||
| ultraplan-local | ||