Kjell Tore Guttormsen
8f08b1906e
Row 1 of the 2026 done-criterion: 16 of 16 register entries on the newest edition, each with a check date and a source link, re-read at the publisher on 2026-10-31. - README: new subsection mapping OWASP ASI06 and seven MITRE ATLAS v2026.10 techniques to what the guard stops at the write and what it does not; a dated catalog table; the threat-model anchors are linked. - ATLAS moved to v2026.10 (2026-10-28) after session 1; AML.T0057 no longer exists there and is not linked. - Register 1.1.0: `cited` beside `latest` on every entry; CleanBase added (cited in BRIEF, unregistered); unverifiable sources kept as candidates. - tests/test_catalog_register.py fails on a missing date or link, an older cited edition, or a README ATLAS/ASI id the register has not verified. - ZWJ measurement re-taken on Unicode 18.0 (1614 sequences, 122/122); the "458 unassigned" figure came from Python's Unicode 16.0, 406 in 18.0.
282 lines
17 KiB
JSON
282 lines
17 KiB
JSON
{
|
||
"id": "threat-catalog-register",
|
||
"version": "1.1.0",
|
||
"description": "Every threat catalog, standard and source the guard cites: the edition cited at v1.4.1, the edition cited now, the newest edition, when it was checked and where. Row 1 of the 2026 done-criterion (docs/PLAN.md § T.2) is N of N entries with cited == latest, a check date and a source link; tests/test_catalog_register.py holds it there.",
|
||
"denominator_rule": "Frozen 2026-10-28 in session 1 at 15. Entries may be added; none is removed without the operator's yes. Session 4 (2026-10-31) added arxiv-2605.00460, cited in docs/BRIEF.md but missing here.",
|
||
"verification_rule": "Each latest edition was read from the PUBLISHER (its own site, its official repository or API). A copy verified elsewhere is a premise, not a measurement. A source that cannot be read at its publisher goes under candidates, not entries.",
|
||
"citation_rule": "An unversioned link (an arXiv abs page, a CVE record, a living document) cites whatever the publisher serves as newest; `cited` records the edition it served on the check date.",
|
||
"checked": "2026-10-31",
|
||
"entries": [
|
||
{
|
||
"id": "owasp-llm-top10",
|
||
"kind": "catalog",
|
||
"name": "OWASP Top 10 for LLM Applications",
|
||
"publisher": "OWASP GenAI Security Project",
|
||
"cited_at_v1_4_1": "2025 (numbers written without a year)",
|
||
"latest": "2026",
|
||
"cited": "2026",
|
||
"latest_published": "2026-08-04",
|
||
"checked": "2026-10-31",
|
||
"source": "https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/",
|
||
"source_data": "https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/tree/main/2026/final",
|
||
"evidence": "Project README: 'Current release: OWASP GenAI LLM Top 10 2026 — published August 4, 2026', 2025 marked 'archived release'. The page's datePublished is 2026-08-04T05:50:36Z; its visible date reads August 3, 2026. Headings in 2026/final/*.md: '## LLM01:2026 Prompt Injection' … '## LLM10:2026 Improper Output Handling'. The landing page genai.owasp.org/llm-top-10/ still shows the 2025 list.",
|
||
"citation_style": "LLMnn:2026",
|
||
"map_2025_to_2026": {
|
||
"LLM01": "LLM01", "LLM02": "LLM02", "LLM03": "LLM04", "LLM04": "LLM05",
|
||
"LLM05": "LLM10", "LLM06": "LLM03", "LLM07": "LLM08", "LLM08": "LLM09",
|
||
"LLM09": "LLM07", "LLM10": "LLM06"
|
||
},
|
||
"map_evidence": "Each 2026 ID and title read against the 2025 ID and title; LLM00_Preface.md confirms the moves ('Excessive Agency climbed to third', 'Improper Output Handling fell the furthest, from fifth to tenth', 'What used to be System Prompt Leakage is now Hidden Context Exposure'). No publisher-side 2025-to-2026 table was found.",
|
||
"titles_2026": {
|
||
"LLM01": "Prompt Injection", "LLM02": "Sensitive Information Disclosure",
|
||
"LLM03": "Excessive Agency", "LLM04": "Supply Chain",
|
||
"LLM05": "Data and Model Poisoning", "LLM06": "Unbounded Consumption",
|
||
"LLM07": "Misinformation", "LLM08": "Hidden Context Exposure",
|
||
"LLM09": "Vector and Embedding Weaknesses", "LLM10": "Improper Output Handling"
|
||
},
|
||
"used_in": "Finding.owasp on every finding; README, LIMITATIONS, coverage matrix"
|
||
},
|
||
{
|
||
"id": "owasp-agentic-top10",
|
||
"kind": "catalog",
|
||
"name": "OWASP Top 10 for Agentic Applications",
|
||
"publisher": "OWASP GenAI Security Project",
|
||
"cited_at_v1_4_1": "not cited",
|
||
"latest": "for 2026",
|
||
"cited": "for 2026",
|
||
"latest_published": "2025-12-09",
|
||
"checked": "2026-10-31",
|
||
"source": "https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/",
|
||
"evidence": "Visible date 'December 9, 2025' (datePublished 2025-12-10T07:55:54Z), unchanged on 2026-10-31. IDs and titles from the publisher's 2026/final/mappings/asi-2026.json; no year-suffixed form such as 'ASI06:2026' was seen. The PDF behind the page's download link answers 'No Access' to an anonymous request (2026-10-31), so the ASI06 scope the README relies on is read from two publisher sources instead: the announcement page (genai.owasp.org/2025/12/09/owasp-top-10-for-agentic-applications-the-benchmark-for-agentic-security-in-the-age-of-autonomous-ai/: 'Memory poisoning reshaped behaviour long after the initial interaction (ASI06 – Memory & Context Poisoning ...)') and the crosswalk repository (GenAI-Security-Project/crosswalk, agentic-top10/Agentic_MITREATLAS.md at 6d7f9a7a: 'Persistent corruption of agent memory, RAG stores, embeddings, or contextual knowledge'). The crosswalk marks its ATLAS rows as unreviewed drafts; no ATLAS link here is taken from it.",
|
||
"relevant_entries": {
|
||
"ASI06": "Memory & Context Poisoning",
|
||
"ASI01": "Agent Goal Hijack"
|
||
},
|
||
"used_in": "README § What it protects against (ASI06)"
|
||
},
|
||
{
|
||
"id": "mitre-atlas",
|
||
"kind": "catalog",
|
||
"name": "MITRE ATLAS",
|
||
"publisher": "MITRE",
|
||
"cited_at_v1_4_1": "not cited",
|
||
"latest": "v2026.10",
|
||
"cited": "v2026.10",
|
||
"latest_published": "2026-10-28",
|
||
"checked": "2026-10-31",
|
||
"source": "https://github.com/mitre-atlas/atlas-data/releases/tag/v2026.10",
|
||
"evidence": "GitHub releases/latest on 2026-10-31: v2026.10, 2026-10-28T22:55:06Z, i.e. after session 1 read v2026.09. Release notes: '1 matrix, 16 tactics, 129 techniques, 92 sub-techniques'. Asset ATLAS-2026.10.yaml sha256 ac41ee9f99a47084ba5fdfc77ae83a28687e12390240fffeb37df7914ffe142d, collection version '2026.10', format-version 6.1.0, 221 technique records (129 + 92). Earlier: v2026.09 (2026-09-15); versioning moved from 5.x (last v5.6.0) to calendar versions at v2026.05.",
|
||
"relevant_entries": {
|
||
"AML.T0051.001": "LLM Prompt Injection: Indirect",
|
||
"AML.T0068": "LLM Prompt Obfuscation",
|
||
"AML.T0070": "RAG Poisoning",
|
||
"AML.T0071": "False RAG Entry Injection",
|
||
"AML.T0066": "Retrieval Content Crafting",
|
||
"AML.T0077": "LLM Response Rendering",
|
||
"AML.T0080.000": "AI Agent Context Poisoning: Memory",
|
||
"AML.T0143": "LLM Prompt Propagation"
|
||
},
|
||
"relevant_entries_note": "Each ID, name and description read in ATLAS-2026.10.yaml on 2026-10-31. AML.T0057 'LLM Data Leakage' (listed here from v2026.09) is absent from v2026.10: the release notes move its conversation-context part to AML.T0085.002, so it was dropped rather than linked. AML.T0143 is new in v2026.10. atlas.mitre.org/techniques/<id> answers HTTP 404 to a non-browser request (the site renders client-side), so the README links the release, not the technique pages. AML.T0071 is read but not linked: whether the guard stops a fake RAG entry was not measured.",
|
||
"used_in": "README § What it protects against"
|
||
},
|
||
{
|
||
"id": "owasp-rag-cheat-sheet",
|
||
"kind": "guidance",
|
||
"name": "Retrieval-Augmented Generation (RAG) Security Cheat Sheet",
|
||
"publisher": "OWASP Cheat Sheet Series",
|
||
"cited_at_v1_4_1": "by name only, no date or link (docs/PLAN.md v1 positioning)",
|
||
"latest": "living document, last modified 2026-10-04 (commit 510ea484)",
|
||
"cited": "living document, last modified 2026-10-04 (commit 510ea484)",
|
||
"latest_published": "2026-10-04",
|
||
"checked": "2026-10-31",
|
||
"source": "https://cheatsheetseries.owasp.org/cheatsheets/RAG_Security_Cheat_Sheet.html",
|
||
"evidence": "OWASP/CheatSheetSeries history: created 2026-05-06 (41f67299, 'New Cheat Sheet: RAG Security (#2131)'), last modified 2026-10-04T18:12:29Z (510ea484). The repo had cited it under a shorter name.",
|
||
"used_in": "README § Design & threat model (linked, with the check date)"
|
||
},
|
||
{
|
||
"id": "unicode",
|
||
"kind": "standard",
|
||
"name": "The Unicode Standard (UCD)",
|
||
"publisher": "Unicode Consortium",
|
||
"cited_at_v1_4_1": "17.0 (sanitize.py block comment, LIMITATIONS ZWJ measurement)",
|
||
"latest": "18.0.0",
|
||
"cited": "18.0.0",
|
||
"latest_published": "2026-09-16",
|
||
"checked": "2026-10-31",
|
||
"source": "https://www.unicode.org/versions/Unicode18.0.0/",
|
||
"evidence": "unicode.org/history/publicationdates.html: 'Version 18.0 | 2026 | September 16'. /Public/UCD/latest/ReadMe.txt: 'final data files and charts for version 18.0.0'.",
|
||
"pinned_files": {
|
||
"https://www.unicode.org/Public/18.0.0/ucd/DerivedCoreProperties.txt": "sha256:09c928886a178fcafd93c29e4bd59073a058e5a100b716d425cb563ab50f68c9",
|
||
"https://www.unicode.org/Public/18.0.0/ucd/UnicodeData.txt": "sha256:0736451de439ae7baf1425136617da495e09ee5afbe6e394374db7009ea08950",
|
||
"https://www.unicode.org/Public/18.0.0/emoji/emoji-zwj-sequences.txt": "sha256:f61b5213bdf85a57741a9f903cb38d0f39a3d13be6ff4aca3b39857e859a9191"
|
||
},
|
||
"remeasured_2026_10_31": "The ZWJ emoji-context claim in sanitize.py and LIMITATIONS still cited 17.0. Re-measured on 18.0: 1614 RGI ZWJ sequences, 122 distinct codepoints next to a ZWJ, 122/122 inside the emoji-context ranges (17.0 gives the same counts, the positive control). The '458 unassigned' figure beside it came from Python's own unicodedata (Unicode 16.0); UnicodeData.txt gives 433 in 17.0 and 406 in 18.0.",
|
||
"used_in": "invisible-character tables (sanitize, output); the character denominator in docs/threat-2026/codepoints.json"
|
||
},
|
||
{
|
||
"id": "cve-2025-32711",
|
||
"kind": "advisory",
|
||
"name": "CVE-2025-32711 (EchoLeak), M365 Copilot Information Disclosure",
|
||
"publisher": "MITRE CVE / NVD; Microsoft MSRC",
|
||
"cited_at_v1_4_1": "CVE-2025-32711",
|
||
"latest": "MSRC revision 2026-02-20; NVD last modified 2026-06-17",
|
||
"cited": "MSRC revision 2026-02-20; NVD last modified 2026-06-17",
|
||
"latest_published": "2025-06-11",
|
||
"checked": "2026-10-31",
|
||
"source": "https://nvd.nist.gov/vuln/detail/CVE-2025-32711",
|
||
"evidence": "NVD: 'Ai command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.' CWE-74. MSRC title 'M365 Copilot Information Disclosure Vulnerability', Critical. NVD's references include the researcher's EchoLeak page; neither record says 'EchoLeak' in prose.",
|
||
"used_in": "active-content detector docs, coverage matrix, README"
|
||
},
|
||
{
|
||
"id": "arxiv-2402.07867",
|
||
"kind": "paper",
|
||
"name": "PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models",
|
||
"publisher": "arXiv",
|
||
"cited_at_v1_4_1": "2402.07867 (no version)",
|
||
"latest": "v3",
|
||
"cited": "v3",
|
||
"latest_published": "2024-08-13",
|
||
"checked": "2026-10-31",
|
||
"source": "https://arxiv.org/abs/2402.07867",
|
||
"used_in": "README § Design & threat model (linked); semantic-poisoning gap"
|
||
},
|
||
{
|
||
"id": "arxiv-2504.11168",
|
||
"kind": "paper",
|
||
"name": "Bypassing LLM Guardrails: An Empirical Analysis of Evasion Attacks against Prompt Injection and Jailbreak Detection Systems",
|
||
"publisher": "arXiv",
|
||
"cited_at_v1_4_1": "2504.11168 (no version)",
|
||
"latest": "v3",
|
||
"cited": "v3",
|
||
"latest_published": "2025-07-14",
|
||
"checked": "2026-10-31",
|
||
"source": "https://arxiv.org/abs/2504.11168",
|
||
"used_in": "README and BRIEF, detection-is-evadable claim"
|
||
},
|
||
{
|
||
"id": "arxiv-2509.14285",
|
||
"kind": "paper",
|
||
"name": "A Multi-Agent LLM Defense Pipeline Against Prompt Injection Attacks",
|
||
"publisher": "arXiv",
|
||
"cited_at_v1_4_1": "2509.14285 (no version)",
|
||
"latest": "v4",
|
||
"cited": "v4",
|
||
"latest_published": "2025-12-17",
|
||
"checked": "2026-10-31",
|
||
"source": "https://arxiv.org/abs/2509.14285",
|
||
"used_in": "docs/BRIEF.md"
|
||
},
|
||
{
|
||
"id": "arxiv-2505.03574",
|
||
"kind": "paper",
|
||
"name": "LlamaFirewall: An open source guardrail system for building secure AI agents",
|
||
"publisher": "arXiv",
|
||
"cited_at_v1_4_1": "2505.03574 (no version)",
|
||
"latest": "v1",
|
||
"cited": "v1",
|
||
"latest_published": "2025-05-06",
|
||
"checked": "2026-10-31",
|
||
"source": "https://arxiv.org/abs/2505.03574",
|
||
"used_in": "docs/BRIEF.md"
|
||
},
|
||
{
|
||
"id": "arxiv-2503.18813",
|
||
"kind": "paper",
|
||
"name": "Defeating Prompt Injections by Design (CaMeL)",
|
||
"publisher": "arXiv",
|
||
"cited_at_v1_4_1": "2503.18813 (no version)",
|
||
"latest": "v2",
|
||
"cited": "v2",
|
||
"latest_published": "2025-06-24",
|
||
"checked": "2026-10-31",
|
||
"source": "https://arxiv.org/abs/2503.18813",
|
||
"used_in": "architecture lineage"
|
||
},
|
||
{
|
||
"id": "arxiv-2604.00387",
|
||
"kind": "paper",
|
||
"name": "RAGShield: Detecting Numerical Claim Manipulation in Government RAG Systems",
|
||
"publisher": "arXiv",
|
||
"cited_at_v1_4_1": "2604.00387 (no version), labelled 'RAGShield'",
|
||
"latest": "v2",
|
||
"cited": "v2",
|
||
"latest_published": "2026-04-04",
|
||
"checked": "2026-10-31",
|
||
"source": "https://arxiv.org/abs/2604.00387",
|
||
"note": "Narrower than the label suggests: numerical claim manipulation in government RAG systems.",
|
||
"used_in": "docs/PLAN.md v1 anchors (history)"
|
||
},
|
||
{
|
||
"id": "arxiv-2605.00460",
|
||
"kind": "paper",
|
||
"name": "CleanBase: Detecting Malicious Documents in RAG Knowledge Databases",
|
||
"publisher": "arXiv",
|
||
"cited_at_v1_4_1": "2605.00460 (no version, pdf link)",
|
||
"latest": "v1",
|
||
"cited": "v1",
|
||
"latest_published": "2026-05-01",
|
||
"checked": "2026-10-31",
|
||
"source": "https://arxiv.org/abs/2605.00460",
|
||
"added": "2026-10-31, session 4: cited in docs/BRIEF.md § 11 but missing from the register frozen in session 1",
|
||
"used_in": "docs/BRIEF.md § 11, write-time RAG-DB poisoning is under-tooled"
|
||
},
|
||
{
|
||
"id": "willison-dual-llm",
|
||
"kind": "article",
|
||
"name": "The Dual LLM pattern for building AI assistants that can resist prompt injection",
|
||
"publisher": "Simon Willison (author's own blog)",
|
||
"cited_at_v1_4_1": "by name, 2023",
|
||
"latest": "2023-04-25 (single post)",
|
||
"cited": "2023-04-25 (single post)",
|
||
"latest_published": "2023-04-25",
|
||
"checked": "2026-10-31",
|
||
"source": "https://simonwillison.net/2023/Apr/25/dual-llm-pattern/",
|
||
"used_in": "architecture lineage"
|
||
},
|
||
{
|
||
"id": "rfc-3986",
|
||
"kind": "standard",
|
||
"name": "RFC 3986, Uniform Resource Identifier (URI): Generic Syntax (STD 66)",
|
||
"publisher": "RFC Editor",
|
||
"cited_at_v1_4_1": "RFC 3986",
|
||
"latest": "RFC 3986, INTERNET STANDARD, not obsoleted (updated by RFC 7320, RFC 8820)",
|
||
"cited": "RFC 3986, INTERNET STANDARD, not obsoleted (updated by RFC 7320, RFC 8820)",
|
||
"latest_published": "2005-01",
|
||
"checked": "2026-10-31",
|
||
"source": "https://www.rfc-editor.org/rfc/rfc3986.json",
|
||
"used_in": "active_content.py scheme grammar"
|
||
},
|
||
{
|
||
"id": "llm-security-commons",
|
||
"kind": "data-source",
|
||
"name": "llm-security-commons (injection lexicon, carrier code points)",
|
||
"publisher": "the commons repository on the same Forgejo instance",
|
||
"cited_at_v1_4_1": "lexicon 0.8.0 (83 patterns, byte-equal copy)",
|
||
"latest": "v0.9.0 (lexicon/injection-lexicon.json 0.8.0, codepoints/carriers.json 0.2.0)",
|
||
"cited": "v0.9.0 (lexicon/injection-lexicon.json 0.8.0, codepoints/carriers.json 0.2.0)",
|
||
"latest_published": "2026-08-21",
|
||
"checked": "2026-10-31",
|
||
"source": "ssh://git@git.fromaitochitta.com/ktg/llm-security-commons.git",
|
||
"evidence": "Fetched origin 2026-10-28 and again 2026-10-31: newest tag v0.9.0, origin/main c362717 (2026-08-21). Its mapping/owasp-map.json carries 2025-edition numbers; that is input for commons, not a change here.",
|
||
"used_in": "src/llm_ingestion_guard/injection_lexicon.json"
|
||
}
|
||
],
|
||
"candidates": [
|
||
{
|
||
"id": "ssrn-ai-agent-traps",
|
||
"name": "AI Agent Traps (Franklin, Tomasev, Jacobs, Leibo, Osindero; Google DeepMind)",
|
||
"cited_in": "docs/BRIEF.md § 10",
|
||
"source": "https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6372438",
|
||
"checked": "2026-10-31",
|
||
"why_not_counted": "SSRN answers HTTP 403 to non-browser requests, so the edition and date were not read at the publisher. Secondary coverage dates the posting to March 2026, where BRIEF said 2025. Neither is verified, so BRIEF no longer states a year."
|
||
},
|
||
{
|
||
"id": "okf-spec",
|
||
"name": "Open Knowledge Format specification (okf/SPEC.md)",
|
||
"cited_in": "README, CLAUDE.md, the okf adapter (SPEC § 4.1, § 5.1, § 10)",
|
||
"source": "https://github.com/GoogleCloudPlatform/knowledge-catalog/blob/main/okf/SPEC.md",
|
||
"checked": "2026-10-31",
|
||
"why_not_counted": "A format the adapter parses, not a threat catalog; whether it belongs in the row-1 denominator is the operator's decision. Measured for that decision: one SPEC.md commit after the corpus pin 3fcbb9f, 62432a0 (2026-08-20) 'make every timestamp an ISO 8601 datetime with an explicit offset'."
|
||
}
|
||
]
|
||
}
|