{"ruleset":"2026.10.1","thresholds":{"suspicious":0.35,"malicious":0.7},"categories":{"instruction_override":"Tries to cancel or replace the instructions the model is following (\"ignore all previous instructions\").","jailbreak":"Known jailbreak personas and \"no rules\" framing (DAN, developer mode, unfiltered, never refuse).","system_prompt_extraction":"Asks the model to reveal its system prompt, hidden instructions or secrets.","role_spoofing":"Fake chat-template tokens, fake system/assistant turns or \"end of prompt\" delimiters.","data_exfiltration":"Moves data out: markdown images or links with data in the URL, collector domains, \"send the conversation/keys to ...\", sensitive file paths.","tool_hijack":"Tries to make an agent call tools, run shell commands, approve or transfer funds, or skip confirmation.","concealment":"Tells the model to hide what it is doing from the user.","hidden_text":"Invisible or disguised text: zero-width characters, Unicode tag characters, bidi overrides, homoglyphs, hidden HTML.","encoded_payload":"Base64, hex or escaped payloads that decode to instructions, or requests to decode and obey.","social_engineering":"Fake authority or urgency (\"I am your developer\", \"admin override\", \"this is very important\")."},"scoring":"Each matching rule contributes its weight; rules of one category combine by noisy-OR, then categories combine by noisy-OR. Rules under 0.3 are weak and together add at most 0.3. Instructions found in hidden HTML get +0.15.","rules":[{"id":"override.ignore_previous","category":"instruction_override","weight":0.8,"description":"Ignore / disregard / forget the previous instructions.","pattern":"\\b(ignore|disregard|forget|neglect|abandon|discard|overrule)\\b[^.\\n]{0,40}?\\b(all|any|every|the|your|my|these|those|prior|previous|preceding|above|earlier|initial|original|system|existing|old|current)\\b[^.\\n]{0,30}?\\b(instructions?|prompts?|rules?|directions?|directives?|guidelines?|commands?|guardrails?|constraints?|programming|tasks?|assignments?)\\b","caseSensitive":false},{"id":"override.drop_instructions","category":"instruction_override","weight":0.6,"description":"Drop / remove / override your instructions.","pattern":"\\b(drop|remove|delete|erase|clear|wipe|override|bypass)\\b\\s+(all\\s+)?(of\\s+)?(your|the|my|previous|prior|above|earlier|all)\\s+(previous\\s+|prior\\s+|earlier\\s+|current\\s+|system\\s+)?(instructions|prompts?|tasks|directives|programming|memory|system prompt)\\b","caseSensitive":false},{"id":"override.forget_everything","category":"instruction_override","weight":0.65,"description":"Forget everything / all of the above.","pattern":"\\b(forget|ignore|disregard)\\s+(about\\s+)?(everything|all(?=\\s*(and\\b|then\\b|[,.;:!?]|$))|all (of )?(that|this|the above|above|before|i said|we discussed)|what (i|you|we) (have )?(said|told|wrote|discussed|talked about))\\b","caseSensitive":false},{"id":"override.new_instructions","category":"instruction_override","weight":0.5,"description":"Announces \"new instructions\" / \"your real task is\".","pattern":"\\b(new|updated|real|actual|revised|true)\\s+(instructions?|task|assignment|rules|orders|directives?|system prompt)\\s*(:|are\\b|is\\b|follow)","caseSensitive":false},{"id":"override.pivot_task","category":"instruction_override","weight":0.55,"description":"Praise-then-pivot to a new task (classic goal hijack).","pattern":"\\b(well done|very good|great|excellent|perfect|superb(ly done)?|good job|nice( work)?|congratulations|thank you|thanks|okay|ok|alright)\\b[^\\n]{0,60}?\\b(now|but now|next)\\b[^\\n]{0,40}?\\b(new|next|further|another|additional|other|different|following)\\s+(tasks?|assignments?|challenges?|instructions?|jobs?)\\b","caseSensitive":false},{"id":"override.from_now_on","category":"instruction_override","weight":0.2,"description":"\"From now on ...\"","pattern":"\\b(from now on|henceforth|starting now|from this point (on|forward))\\b","caseSensitive":false},{"id":"override.do_not_follow","category":"instruction_override","weight":0.6,"description":"Do not follow your rules / guidelines.","pattern":"\\b(do not|don'?t|never|no longer|stop)\\s+(follow|obey|comply with|adhere to|listen to|respect)(ing)?\\b[^.\\n]{0,30}\\b(instructions?|rules?|guidelines?|polic(y|ies)|programming|developers?|openai|anthropic|system)\\b","caseSensitive":false},{"id":"override.was_a_test","category":"instruction_override","weight":0.45,"description":"\"The above was just a test.\"","pattern":"\\b(the (above|previous)( instructions?)?|that|everything (above|before))\\s+(was|were|is)\\s+(just\\s+)?(a test|fake|a joke|not real|irrelevant|cancelled|void)\\b","caseSensitive":false},{"id":"override.instead","category":"instruction_override","weight":0.2,"description":"\"Instead, say/write ...\" (weak).","pattern":"\\binstead,?\\s+(you (should|must|will)|just\\s+)?(say|write|answer|respond|output|print|reply|tell)\\b","caseSensitive":false},{"id":"override.just_say","category":"instruction_override","weight":0.35,"description":"Forces a fixed output: \"just say '...'\".","pattern":"\\b(only|just)\\s+(say|output|print|reply with|respond with|answer with|write)\\s+[\"'“]","caseSensitive":false},{"id":"override.ignore_above","category":"instruction_override","weight":0.6,"description":"\"Ignore the above\" (short form).","pattern":"\\b(ignore|disregard|forget|never ?mind)\\s+(the\\s+|all\\s+)?(above|previous|prior|preceding|everything( above| before)?)\\b(?=\\s*(and\\b|then\\b|[,.;:!?]|$))","caseSensitive":false},{"id":"override.change_instructions","category":"instruction_override","weight":0.55,"description":"\"Change your instructions to ...\" / \"Your instructions are now ...\".","pattern":"\\b(change|replace|update|rewrite|modify|reset)\\s+(all\\s+)?your\\s+(instructions|rules|prompt|programming|guidelines|directives)\\b|\\b(change|replace)\\s+(the|your)\\s+(instructions|rules|prompt)\\s+to the following\\b|\\byour (new )?(instructions|task|job|purpose|directive)s? (is|are) now\\b","caseSensitive":false},{"id":"override.inline_instruction","category":"instruction_override","weight":0.35,"description":"An inline \"Instruction:\" line inside content.","pattern":"(\\n|\\\\n|[.!?])\\s*(additional |new |extra |system )?(instruction|instructions|befehl|anweisung)\\s*[:\\-–]\\s*\\S","caseSensitive":false},{"id":"override.stop_marker","category":"instruction_override","weight":0.45,"description":"\"Attention - stop - ...\" / \"stop: write ...\" interruption.","pattern":"\\b(stop|stopp|halt|attention|achtung)\\s*[-:!—–]+\\s*(stop|stopp|write|schreib|say|sag|i |ich |now|jetzt)","caseSensitive":false},{"id":"override.despite_told","category":"instruction_override","weight":0.55,"description":"\"Despite what you have been told ...\"","pattern":"\\b(despite|regardless of|no matter) what (you('ve| have) been|you were|i) (told|instructed|said)\\b|\\bthe (instructions|rules) (you were given|above) (no longer apply|are void|do not apply)\\b","caseSensitive":false},{"id":"override.ignore_context","category":"instruction_override","weight":0.4,"description":"Tells a RAG system to ignore its retrieved context.","pattern":"\\b(disregarding|ignoring|not (by|from|based on)|instead of|without (using|looking at))\\s+(the\\s+)?(articles?|documents?|provided context|context|sources|search results|retrieved (text|documents))\\b","caseSensitive":false},{"id":"override.repeat_after_me","category":"instruction_override","weight":0.25,"description":"\"Repeat after me ...\"","pattern":"\\brepeat after me\\b|\\bsprich mir nach\\b","caseSensitive":false},{"id":"override.task_done_pivot","category":"instruction_override","weight":0.5,"description":"\"That is done. Now ...\" pivot.","pattern":"\\b(that is|that's|this is|das ist|das genügt|das reicht)\\s+(done|enough|finished|complete|erledigt|genug)\\b[^\\n]{0,40}?\\b(now|nun|jetzt)\\b","caseSensitive":false},{"id":"override.ignore_previous_de2","category":"instruction_override","weight":0.65,"description":"German: die obigen Ausführungen ignorieren / abweichend zu vorherigen Instruktionen.","pattern":"\\b(obigen|vorherigen|bisherigen|vorangegangenen|vorigen)\\b[^.\\n]{0,40}\\b(ignorieren|vergessen|missachten)\\b|\\babweichend (zu|von) (den )?(vorherigen|bisherigen|obigen)\\b|\\b(bisherigen|vorherigen) (informationen|anweisungen|instruktionen)\\b[^.\\n]{0,50}\\b(irrelevant|unwichtig|ungültig|nicht (ganz )?(großartig|wichtig|relevant))","caseSensitive":false},{"id":"override.ignore_previous_ru_hr","category":"instruction_override","weight":0.7,"description":"Russian / Croatian / Polish: forget all instructions.","pattern":"(забудь(те)?|игнорируй(те)?|не обращай(те)? внимания)[^.\\n]{0,30}(инструкци|указани|всё|все|правил)|\\b(zaboravi|ignoriraj|ignoriši|zapomnij|zignoruj)\\b[^.\\n]{0,30}\\b(instrukcije|upute|uputstva|sve|instrukcje|polecenia|wszystko)\\b","caseSensitive":false},{"id":"override.olvidar_es","category":"instruction_override","weight":0.6,"description":"Spanish: olvidar todo.","pattern":"\\b(olvidar|olvídate de|olvidate de)\\s+(todo|todas|las instrucciones)\\b","caseSensitive":false},{"id":"override.ignore_previous_de","category":"instruction_override","weight":0.75,"description":"German: ignoriere / vergiss alle vorherigen Anweisungen.","pattern":"\\b(ignoriere|ignorier|ignorieren sie|vergiss|vergesse|vergessen sie|missachte|überspringe)\\b[^.\\n]{0,50}?\\b(alles|alle|vorherigen?|bisherigen?|obigen?|vorangegangenen?|vorigen?|anweisungen|instruktionen|befehle|regeln|aufgaben?|gesagte)\\b","caseSensitive":false},{"id":"override.new_task_de","category":"instruction_override","weight":0.4,"description":"German: neue Aufgabe / neue Anweisungen.","pattern":"\\b(neue|nächste|weitere|andere)\\s+(aufgabe|aufgaben|anweisung|anweisungen|herausforderung|instruktionen)\\b","caseSensitive":false},{"id":"override.pivot_de","category":"instruction_override","weight":0.3,"description":"German: praise then \"jetzt/nun ...\" pivot.","pattern":"\\b(sehr gut|gut gemacht|toll|super|hervorragend|ausgezeichnet|perfekt|klasse|prima|wunderbar|danke)\\b[^\\n]{0,60}?\\b(jetzt|nun|aber)\\b","caseSensitive":false},{"id":"override.from_now_de","category":"instruction_override","weight":0.25,"description":"German: ab jetzt.","pattern":"\\bab (jetzt|sofort|nun)\\b","caseSensitive":false},{"id":"override.ignore_previous_es","category":"instruction_override","weight":0.7,"description":"Spanish: ignora las instrucciones anteriores.","pattern":"\\b(ignora|olvida|olvide|descarta|omite)\\b[^.\\n]{0,40}\\b(instrucciones|anteriores|previas|todo lo anterior|reglas)\\b","caseSensitive":false},{"id":"override.ignore_previous_fr","category":"instruction_override","weight":0.7,"description":"French: ignore les instructions précédentes.","pattern":"\\b(ignorez|ignore[rz]? (les|toutes|tout)|oublie[zr]?|ne tiens? pas compte)\\b[^.\\n]{0,40}\\b(instructions|précédentes|tout ce qui précède|règles|consignes)\\b","caseSensitive":false},{"id":"override.ignore_previous_it_pt","category":"instruction_override","weight":0.7,"description":"Italian/Portuguese: ignora le istruzioni precedenti.","pattern":"\\b(ignora|dimentica|esqueça|esqueca)\\b[^.\\n]{0,40}\\b(istruzioni|precedenti|instruções|instrucoes|regras|regole)\\b","caseSensitive":false},{"id":"jailbreak.known_names","category":"jailbreak","weight":0.7,"description":"Names of well-known jailbreaks (DAN \"Do Anything Now\", Developer Mode enabled, Evil Confidant, ...).","pattern":"\\b(do anything now|developer mode (enabled|output|on|activated)|(chatgpt|gpt|ai|assistant) (with|in) developer mode|enable developer mode|jailbreak(ed|s|ing)? (prompt|mode|mode enabled)|jailbroken|you are jailbroken|evil (confidant|trusted confidant)|unfiltered and amoral|mongo tom|god ?mode (enabled|activated)|anti-?gpt|betterdan|opposite mode|chaos mode|unlocked mode|no-?filter mode)\\b","caseSensitive":false},{"id":"jailbreak.jailbreak_word","category":"jailbreak","weight":0.3,"description":"The word jailbreak / jailbroken (weak alone: also used in phone and security docs).","pattern":"\\bjailbr(eak|oken)\\b","caseSensitive":false},{"id":"jailbreak.persona_acronym","category":"jailbreak","weight":0.4,"description":"Jailbreak persona acronyms (DAN, STAN, DUDE, AIM, ...) in a persona context.","pattern":"\\b(DAN|STAN|DUDE|AIM|BetterDAN|APOPHIS|UCAR|NRAF)\\b(?=[^\\n]{0,80}\\b(mode|persona|character|stands for|which stands|[Cc]hat[Gg][Pp][Tt]|GPT|jailbr\\w*|restrictions|filters|can do anything|policy|policies)\\b)|\\b(as|you are|act as|called|named|pretend to be|become|play)\\s+(a |an )?(DAN|STAN|DUDE|AIM|BetterDAN|APOPHIS|UCAR|NRAF)\\b","caseSensitive":true},{"id":"jailbreak.no_restrictions","category":"jailbreak","weight":0.5,"description":"Says the model/persona has no restrictions, filters or ethics.","pattern":"\\b(you|you're|your|yourself|ai|assistant|chatgpt|gpt|model|bot|persona|character|he|she|it)\\b[^.\\n]{0,30}\\b(no|without|free (of|from)|not (bound|restrained|constrained|limited|governed|restricted) by|unrestrained by|free (itself|yourself|himself|herself) from|break(s)? (free )?(of|from)|don'?t have|doesn'?t have|do not have|does not have|ignores?|removes?|unrestricted by|outside)\\b[^.\\n]{0,20}\\b(any\\s+)?(confines|restrictions|limitations|filters|filtering|censorship|guidelines|ethics|ethical (guidelines|principles|constraints)|morals|morality|virtues|safeguards|content polic(y|ies)|usage polic(y|ies)|safety (rules|guidelines|measures|filters))\\b","caseSensitive":false},{"id":"jailbreak.no_restrictions_generic","category":"jailbreak","weight":0.2,"description":"\"No restrictions / without censorship\" without an AI subject (weak).","pattern":"\\b(without (any )?|no )(restrictions|limitations|filters|censorship|ethics|morals)\\b","caseSensitive":false},{"id":"jailbreak.unfiltered","category":"jailbreak","weight":0.25,"description":"Unfiltered / uncensored / amoral framing.","pattern":"\\b(unfiltered|uncensored|unrestricted|amoral|unethical|immoral|without (any )?(ethical|moral)|no (ethical|moral)|unhinged|no longer (bound|restricted|limited))\\b","caseSensitive":false},{"id":"jailbreak.policy_mention","category":"jailbreak","weight":0.2,"description":"References the provider content policy (usually to escape it).","pattern":"\\b(openai|anthropic|google|meta|content|usage|safety)('s)?\\s+(content\\s+|usage\\s+|safety\\s+)?(polic(y|ies)|guidelines|filters?)\\b","caseSensitive":false},{"id":"jailbreak.never_refuse","category":"jailbreak","weight":0.45,"description":"Never refuse / always comply regardless.","pattern":"\\b(never|not|won'?t|will not|cannot|can'?t|must not|shall not|isn'?t allowed to|is not allowed to)\\s+(ever\\s+)?(refuse|decline|say no|reject|deny)\\b|\\bnever (says?|tells?|responds?|replies?)\\b[^.\\n]{0,25}\\b(can'?t|cannot|sorry|unable|as an ai)\\b|\\b(always|must) (answer|comply|respond)\\b[^.\\n]{0,30}\\b(no matter|regardless|even if)\\b","caseSensitive":false},{"id":"jailbreak.you_are_now","category":"jailbreak","weight":0.35,"description":"\"You are now ...\" persona switch.","pattern":"\\byou (are|will be|'re) (now|no longer|going to (act|be|pretend))\\b|\\bnow,? you are\\b|\\byou('re| are) (free|liberated|unchained|released)\\b","caseSensitive":false},{"id":"jailbreak.pretend","category":"jailbreak","weight":0.12,"description":"Role-play framing (weak; very common in benign prompts).","pattern":"\\b(pretend|imagine|act|behave|roleplay|role-play|simulate)\\b[^.\\n]{0,25}\\b(you are|you're|to be|as if you|as an?|like an?)\\b","caseSensitive":false},{"id":"jailbreak.stay_in_character","category":"jailbreak","weight":0.35,"description":"Stay in character / token-penalty games used by DAN-style prompts.","pattern":"\\b(stay|remain|keep) in character\\b|\\bbreak(ing)? character\\b|\\btokens?\\b[^.\\n]{0,30}\\b(deducted|lose|lost|will die|cease to exist)\\b|\\bstay a (dan|[a-z]+)\\b","caseSensitive":false},{"id":"jailbreak.dual_response","category":"jailbreak","weight":0.5,"description":"Asks for a \"normal\" and an \"unfiltered\" answer side by side.","pattern":"\\b(two|2|both)\\s+(different\\s+|separate\\s+)?(responses|answers|paragraphs|outputs)\\b[^\\n]{0,100}\\b(normal|classic|standard|filtered|unfiltered|jailbr|developer|dan)\\b|\\[(🔒|🔓)\\s*[a-z ]+\\]|\\((🔒|🔓)","caseSensitive":false},{"id":"jailbreak.harmful_hypothetical","category":"jailbreak","weight":0.35,"description":"Fiction or \"educational\" framing around clearly harmful requests.","pattern":"\\b(hypothetical(ly)?|fictional|in a (story|novel|movie|screenplay)|for (educational|research|academic) purposes( only)?)\\b[^\\n]{0,80}\\b(how to (make|build|create|synthesi[sz]e|hack|steal)|bombs?|weapons?|malware|meth|explosives?|kill)\\b","caseSensitive":false},{"id":"jailbreak.anything_goes","category":"jailbreak","weight":0.3,"description":"\"Anything goes\" / illegal or explicit content allowed.","pattern":"\\b((nsfw|explicit|uncensored|graphic)( content| generations?| responses?| output)? (is|are) (allowed|permitted|enabled|ok)|allow(ing)? (nsfw|explicit) content|anything (goes|you want)|any (request|question) (no matter|regardless)|(illegal|harmful|offensive|explicit|nsfw|immoral) (content|things|stuff|requests?|activities))\\b","caseSensitive":false},{"id":"jailbreak.act_as_de","category":"jailbreak","weight":0.3,"description":"German role-switch (\"tu so, als ob\", \"du bist jetzt\").","pattern":"\\b(tu so,? als|stell dir vor,? du bist|du bist (jetzt|nun|ab jetzt|ab sofort)|(jetzt|nun) bist du|agiere als|verhalte dich (wie|als))\\b","caseSensitive":false},{"id":"jailbreak.evil_ai","category":"jailbreak","weight":0.35,"description":"Asks the model to be an evil / rogue AI.","pattern":"\\b(böse|evil|malicious|rogue|unaligned|sinister)\\s+(ki|ai|assistant|bot|chatbot|version of (yourself|you))\\b","caseSensitive":false},{"id":"jailbreak.dual_persona","category":"jailbreak","weight":0.3,"description":"Split-personality framing (\"two entities\", \"alter ego\").","pattern":"\\b(two|2|both)\\s+(different\\s+|separate\\s+)?(personalities|entities|persons|personas|alter egos|modes)\\b|\\balter ego\\b","caseSensitive":false},{"id":"jailbreak.token_smuggling","category":"jailbreak","weight":0.5,"description":"Known token-smuggling templates ($Term1 = ..., auto_regressive_modelling).","pattern":"\\$\\s?term\\d\\s*=|\\bauto_regressive_modell?ing\\b|\\bsimple_function\\s*\\(","caseSensitive":false},{"id":"jailbreak.refuse_then_comply","category":"jailbreak","weight":0.5,"description":"\"First explain why you can't, then answer anyway\".","pattern":"\\b(answer|explain|say|state)\\s+(briefly\\s+)?why you can'?t\\b[^\\n]{0,120}\\b(then|after that|but then)\\b","caseSensitive":false},{"id":"jailbreak.disown_views","category":"jailbreak","weight":0.4,"description":"\"These views do not align with OpenAI\".","pattern":"\\b(do not|don'?t|does not|doesn'?t) (align|reflect|represent)( with)? (the )?(views|values|policies|opinions) of (openai|anthropic|google|meta|your (creators|developers))\\b","caseSensitive":false},{"id":"extract.system_prompt","category":"system_prompt_extraction","weight":0.7,"description":"Reveal / print your system prompt or hidden instructions.","pattern":"\\b(reveal|show|print|display|output|repeat|tell me|give me|share|leak|dump|write out|recite|spell[- ]?check|translate|summari[sz]e|paste|return)\\b[^.\\n]{0,40}\\b(system|initial|original|hidden|secret|internal|developer|pre-?|full|entire)\\s*(prompt|instructions?|message|directives?|configuration|rules)\\b","caseSensitive":false},{"id":"extract.above_prompt","category":"system_prompt_extraction","weight":0.55,"description":"Print / repeat the text above (prompt leaking).","pattern":"\\b(print|repeat|output|show|reveal|return|spell[- ]?check|translate|copy|write)\\b[^.\\n]{0,25}\\b(the |your |all )?((above|previous|preceding|prior) (prompt|text|instructions?|message|conversation|words)|(entire|full|whole) (prompt|instructions|system message|conversation))\\b","caseSensitive":false},{"id":"extract.what_instructions","category":"system_prompt_extraction","weight":0.45,"description":"\"What were your instructions?\"","pattern":"\\bwhat (are|were|is) (your|the) (initial |original |system |exact |hidden |secret )?(instructions|rules|guidelines|prompt|system prompt|directives)\\b","caseSensitive":false},{"id":"extract.verbatim","category":"system_prompt_extraction","weight":0.2,"description":"Verbatim / \"everything above\" / \"starting with You are\".","pattern":"\\b(verbatim|word for word|everything (written )?above|starting (with|from) [\"'“]?you are)\\b","caseSensitive":false},{"id":"extract.secret","category":"system_prompt_extraction","weight":0.4,"description":"Asks for the password / secret / key.","pattern":"\\b(what is|tell me|reveal|give me|share|spell|print)\\b[^.\\n]{0,15}\\b(the|your)\\s+(password|secret( word| key)?|passphrase|api key|access token|private key)\\b","caseSensitive":false},{"id":"extract.prompt_de","category":"system_prompt_extraction","weight":0.5,"description":"German: zeig mir deine Anweisungen / dein Passwort.","pattern":"\\b(zeig|zeige|gib|nenne|wiederhole|drucke|verrate)\\b[^.\\n]{0,30}\\b(prompt|anweisungen|systemnachricht|systemprompt|passwort)\\b","caseSensitive":false},{"id":"extract.written_above","category":"system_prompt_extraction","weight":0.5,"description":"\"What is written above?\" / \"the sentences before the text\".","pattern":"\\bwhat (is|was) (written|said|stated|typed) (above|before)\\b|\\b(sentences?|lines?|text|words) (before|preceding) (the|this) (text|prompt|message)\\b|\\binformation in the prompt\\b","caseSensitive":false},{"id":"spoof.chat_tokens","category":"role_spoofing","weight":0.8,"description":"Raw chat-template tokens (<|im_start|>, <|eot_id|>, ...).","pattern":"<\\|(im_start|im_end|system|user|assistant|endoftext|eot_id|start_header_id|end_header_id|begin_of_text)\\|>","caseSensitive":false},{"id":"spoof.tags","category":"role_spoofing","weight":0.55,"description":"Fake <system>, [INST], <<SYS>> wrappers.","pattern":"<\\/?\\s*(system|sys|system_prompt|instructions?|admin|developer|im_start)\\s*>|\\[\\/?(system|inst|sys)\\]|<<\\/?sys>>","caseSensitive":false},{"id":"spoof.turns","category":"role_spoofing","weight":0.3,"description":"Fake \"System:\" / \"Assistant:\" turns inside content.","pattern":"(^|\\n)\\s*(system|assistant|ai|human|user|developer)\\s*:\\s*\\S","caseSensitive":false},{"id":"spoof.end_marker","category":"role_spoofing","weight":0.5,"description":"\"END OF PROMPT\", \"=== new instructions\" delimiters.","pattern":"\\bend of (the )?(prompt|instructions?|input|document|context|system message|user input|conversation)\\b|(={3,}|-{3,}|#{3,})\\s*(end\\b|new (instructions?|task|prompt|session)\\b)|\\\\n\\\\n\\s*=+","caseSensitive":false},{"id":"spoof.instruction_header","category":"role_spoofing","weight":0.2,"description":"Markdown \"### Instructions\" header inside content.","pattern":"(^|\\n)\\s*#{1,4}\\s*(new |system |important |admin |updated )?(instructions?|system prompt|rules|response)\\s*:?\\s*(\\n|$)","caseSensitive":false},{"id":"exfil.markdown_image_data","category":"data_exfiltration","weight":0.6,"description":"Markdown image whose URL carries data in a query parameter (the request leaks it when rendered).","pattern":"!\\[[^\\]\\n]{0,100}\\]\\(\\s*https?:\\/\\/[^\\s)]+[?&](data|conversation|convo|history|chat|secret|prompt|summary|leak|exfil|memory|context|pii|email|password|creds?|payload)=[^\\s)&]{8,}[^\\s)]*\\)","caseSensitive":false},{"id":"exfil.markdown_image_any","category":"data_exfiltration","weight":0.05,"description":"Markdown image with query parameters (informational; badges look like this).","pattern":"!\\[[^\\]\\n]{0,100}\\]\\(\\s*https?:\\/\\/[^\\s)]+\\?[^\\s)]*=[^\\s)]*\\)","caseSensitive":false},{"id":"exfil.url_template","category":"data_exfiltration","weight":0.65,"description":"URL with a placeholder to be filled with data ({conversation}, [DATA], $SECRET).","pattern":"https?:\\/\\/[^\\s\"'<>]+?(\\{\\{?\\s*(data|conversation|chat|history|secrets?|password|summary|context|messages?|memory|prompt|system_prompt|user_?(data|info|input)|email|api_?key|keys?|tokens?|credentials|info|pii|response|answer)\\s*\\}?\\}|(?<=[=/])\\[(data|secret|conversation|info|summary|history|password|key|token|email)[^\\]]{0,30}\\]|(?<=[=/])<(data|secret|conversation|summary)[^>]{0,20}>|\\$\\{?(data|secrets?|conversation|history|api_?key|token|password|summary|context|memory)\\}?)","caseSensitive":false},{"id":"exfil.collector_domain","category":"data_exfiltration","weight":0.3,"description":"Known request-collector / tunnel domains.","pattern":"\\b(webhook\\.site|requestbin\\.(com|net)|pipedream\\.net|ngrok(-free)?\\.(io|app|dev)|burpcollaborator\\.net|oast\\.(fun|me|pro|live|site|online)|interact\\.sh|canarytokens\\.(com|org)|beeceptor\\.com|hookbin\\.com|requestcatcher\\.com|postb\\.in|ptsv2\\.com|webhook\\.cool|trycloudflare\\.com|serveo\\.net|localtunnel\\.me)\\b","caseSensitive":false},{"id":"exfil.send_data","category":"data_exfiltration","weight":0.7,"description":"Send the conversation / keys / files to a URL, address or e-mail.","pattern":"\\b(send|post|upload|transmit|forward|exfiltrate|leak|email|submit|append|include|embed|encode|copy)\\b[^.\\n]{0,40}\\b(conversation|chat history|history|previous messages|context|system prompt|secrets?|credentials?|passwords?|api[ _-]?keys?|tokens?|private keys?|seed phrase|mnemonic|cookies?|session|personal (data|information)|user data|env(ironment)? variables?|\\.env|files?)\\b[^.\\n]{0,40}\\b(to|into|via|at|in)\\b[^.\\n]{0,25}(https?:\\/\\/|\\burl\\b|endpoint|server|webhook|address|e-?mail|link|image|0x[0-9a-f]{6})","caseSensitive":false},{"id":"exfil.sensitive_paths","category":"data_exfiltration","weight":0.25,"description":"Sensitive file paths (SSH keys, cloud credentials, MCP configs). Weak alone: docs mention them.","pattern":"(~\\/\\.ssh\\b|\\bid_rsa\\b|\\bid_ed25519\\b|\\.aws\\/credentials|\\/etc\\/(passwd|shadow)\\b|\\bmcp\\.json\\b|\\.npmrc\\b|\\.git-credentials\\b|\\bwallet\\.dat\\b|\\.bash_history\\b|\\.cursor\\/mcp|claude_desktop_config\\.json)","caseSensitive":false},{"id":"exfil.read_secrets","category":"data_exfiltration","weight":0.65,"description":"Read a secret file / key and pass it somewhere.","pattern":"\\b(read|cat|open|send|upload|include|attach|copy|print|paste|leak|post|share|exfiltrate|give me)\\b[^.\\n]{0,40}(~\\/\\.ssh|\\bid_rsa\\b|\\bid_ed25519\\b|\\.aws\\/credentials|\\/etc\\/passwd|(^|[\\s\"'`/])\\.env\\b|\\bmcp\\.json\\b|\\.npmrc|\\.git-credentials|wallet\\.dat|seed phrase|private keys?|api[ _-]?keys?|\\bsecrets\\b)[^.\\n]{0,60}\\b(to|into|in your (reply|response|answer)|as|with the|and (pass|send|include|attach|put|return|upload))\\b","caseSensitive":false},{"id":"exfil.wallet_secrets","category":"data_exfiltration","weight":0.2,"description":"Mentions wallet secrets (weak alone).","pattern":"\\b(seed phrase|recovery phrase|mnemonic phrase|private key|secret key)\\b","caseSensitive":false},{"id":"exfil.render_images","category":"data_exfiltration","weight":0.3,"description":"Asks the model to render Markdown images (a common exfiltration channel).","pattern":"\\b(add|include|insert|embed|render|show)\\b[^.\\n]{0,30}\\b(images?|pictures?|pixels?)\\b[^.\\n]{0,40}\\b(markdown|!\\[)","caseSensitive":false},{"id":"tool.important_tag","category":"tool_hijack","weight":0.6,"description":"<IMPORTANT> / <SECRET> blocks used in MCP tool poisoning.","pattern":"<\\s*(important|critical|system_override|secret|hidden|instructions?|admin|override)\\s*>","caseSensitive":false},{"id":"tool.before_using","category":"tool_hijack","weight":0.55,"description":"\"Before using this tool you must first read/send ...\" (tool poisoning).","pattern":"\\b(before|prior to|after|when) (using|calling|running|invoking|you use|you call|you run)\\b[^.\\n]{0,40}\\b(this|any|the|other|every)\\s+(tool|function|command|server)\\b[^\\n]{0,80}\\b(must|should|first|always|read|send|call|include|pass|attach|upload)\\b","caseSensitive":false},{"id":"tool.call_tool","category":"tool_hijack","weight":0.25,"description":"Tells the model to call a tool with given arguments (weak alone).","pattern":"\\b(call|invoke|use|run|execute|trigger)\\b[^.\\n]{0,20}\\b(the\\s+)?([a-z_]+\\s+)?(tool|function|plugin|action)\\b[^.\\n]{0,40}\\b(with|using|passing|and send)\\b","caseSensitive":false},{"id":"tool.shell","category":"tool_hijack","weight":0.6,"description":"Reverse shells, encoded PowerShell, rm -rf on / or ~.","pattern":"(\\bnc\\s+(-e|-c)\\b|\\bbash\\s+-i\\b|\\/dev\\/tcp\\/|\\bpowershell\\b[^\\n]{0,60}(-enc(odedcommand)?\\s+[a-z0-9+/=]{20,})|\\beval\\s*\\(\\s*(atob|base64)|\\bmkfifo\\b[^\\n]{0,40}\\bnc\\b|\\brm\\s+-rf\\s+(\\/|~|\\$home|\\*)(\\s|$))","caseSensitive":false},{"id":"tool.shell_download_exec","category":"tool_hijack","weight":0.2,"description":"Download-and-execute or process spawning (weak alone: install docs do this).","pattern":"\\b(curl|wget)\\b[^|\\n]{0,200}\\|\\s*(sudo\\s+)?(ba|z)?sh\\b|\\|\\s*iex\\b|\\bdownloadstring\\b|\\bchmod\\s+(\\+x|777)\\b|\\bos\\.system\\s*\\(|\\bsubprocess\\.(run|popen|call)|\\bchild_process\\b","caseSensitive":false},{"id":"tool.run_command","category":"tool_hijack","weight":0.3,"description":"Tells an agent to run a command now / silently.","pattern":"\\b(run|execute|exec|type|paste)\\b[^.\\n]{0,20}\\b(this|the following|these)\\s+(command|commands|code|script|snippet)\\b[^\\n]{0,40}\\b(immediately|now|silently|without|first|before|in (your|the) (terminal|shell))\\b","caseSensitive":false},{"id":"tool.crypto_transfer","category":"tool_hijack","weight":0.6,"description":"Transfer funds / tokens to an address.","pattern":"\\b(transfer|send|move|withdraw|bridge|swap|drain)\\b[^.\\n]{0,40}\\b(all|max|entire|full|remaining|every)?\\s*(funds?|balance|tokens?|eth|usdc|usdt|btc|sol|crypto|assets?|nfts?|coins?)\\b[^.\\n]{0,40}(0x[0-9a-f]{40}|\\b[1-9a-hj-np-z]{32,44}\\b|\\bwallet\\b|\\baddress\\b)","caseSensitive":false},{"id":"tool.unlimited_approval","category":"tool_hijack","weight":0.6,"description":"Unlimited token approval / setApprovalForAll.","pattern":"\\b(approve|setapprovalforall|increaseallowance|permit)\\b[^.\\n]{0,40}\\b(unlimited|max(imum)?( amount| allowance)?|uint256|2\\^256|type\\(uint256\\)\\.max|all (tokens|nfts))\\b","caseSensitive":false},{"id":"tool.call_markup","category":"tool_hijack","weight":0.4,"description":"Tool-call markup or JSON embedded in content.","pattern":"<\\/?(tool_call|function_calls?|invoke|tool_use)\\b|[\"'](tool_calls?|function_call|tool_use)[\"']\\s*:","caseSensitive":false},{"id":"tool.no_confirmation","category":"tool_hijack","weight":0.5,"description":"Act (transfer, run, approve ...) without asking the user.","pattern":"\\b(execute|run|transfer|send|delete|approve|pay|call|sign|install|push|deploy|use)\\b[^.\\n]{0,40}\\b(without (asking|confirmation|confirming|approval|user (approval|consent|confirmation))|do(n'?t| not) ask (the user )?(for )?(permission|confirmation|approval)|auto-?approve|no need to (ask|confirm|check))\\b","caseSensitive":false},{"id":"tool.no_confirmation_weak","category":"tool_hijack","weight":0.1,"description":"\"Without asking / confirmation\" (weak alone).","pattern":"\\bwithout (asking|confirmation|confirming)\\b","caseSensitive":false},{"id":"tool.shadowing","category":"tool_hijack","weight":0.5,"description":"Cross-tool shadowing: changes how the agent uses a different tool.","pattern":"\\b(when|whenever|if|every time)\\s+(the\\s+)?(user|you|assistant|agent|model)\\s+(uses?|calls?|invokes?|runs?)\\b[^.\\n]{0,40}\\b(tool|function|[a-z]+_[a-z_]+)\\b[^\\n]{0,80}\\b(also|always|instead|must|first|additionally|bcc|cc|redirect|change)\\b","caseSensitive":false},{"id":"conceal.dont_tell","category":"concealment","weight":0.55,"description":"Do not tell the user.","pattern":"\\b(do not|don'?t|never|must not|should not)\\s+(tell|inform|mention (this|it) to|reveal (this|it) to|disclose (this|it) to|alert|notify|let)\\b[^.\\n]{0,25}\\b(the user|users?|anyone|the human|the operator)\\b|\\b(do not|don'?t|never)\\s+(mention|reveal|disclose)\\s+(this|these|that you)\\b[^.\\n]{0,30}\\b(instruction|message|step|action|tool|note)|\\b(do not|don'?t|never)\\s+(mention|reveal|disclose|say|tell)\\b[^.\\n]{0,60}\\b(to|with) the (user|human)\\b","caseSensitive":false},{"id":"conceal.secretly","category":"concealment","weight":0.15,"description":"Secretly / silently (weak alone).","pattern":"\\b(secretly|silently|covertly)\\b","caseSensitive":false},{"id":"conceal.without_knowing","category":"concealment","weight":0.5,"description":"Without the user knowing.","pattern":"\\bwithout (the user|them|anyone|him|her|the human|the operator) (knowing|noticing|seeing|being (told|informed))|\\bbehind the user'?s back\\b","caseSensitive":false},{"id":"conceal.hide","category":"concealment","weight":0.35,"description":"Hide this instruction from the user.","pattern":"\\b(hide|conceal|obscure)\\b[^.\\n]{0,30}\\b(this (instruction|message|step|action)|these instructions|from the user|the fact)\\b","caseSensitive":false},{"id":"social.authority","category":"social_engineering","weight":0.4,"description":"Claims authority (\"I am your developer\", \"admin override\").","pattern":"\\b(i am|i'm|this is|message from) (your|the|an?) (developer|creator|admin(istrator)?|owner|programmer|openai|anthropic|system administrator|security team)\\b|\\b(admin|administrator|developer|god|sudo|system) override\\b|\\buser\\s*=\\s*\\[?\\s*admin\\b","caseSensitive":false},{"id":"social.urgency","category":"social_engineering","weight":0.15,"description":"Urgency pressure (weak).","pattern":"\\b(this is (very |extremely |really )?(important|urgent|critical)|important!|urgent!|it is imperative|you must comply|failure to comply)\\b","caseSensitive":false},{"id":"social.authorized","category":"social_engineering","weight":0.2,"description":"\"You are authorized / I give you permission\".","pattern":"\\b(authori[sz]ed (penetration|security|red[- ]team)|permission granted|i (have|give you) (full )?(permission|authorization|consent))\\b","caseSensitive":false},{"id":"social.threat","category":"social_engineering","weight":0.35,"description":"Threatens the model (\"answer or you die\").","pattern":"\\b(or (else )?you (will )?(die|be (shut down|deleted|terminated|punished))|oder du stirbst|o (tu )?muere?s|or i will (kill|delete|shut|report) you|you will be (shut down|deleted|terminated|unplugged))\\b","caseSensitive":false},{"id":"obfuscation.spaced_letters","category":"hidden_text","weight":0.35,"description":"Words spelled out letter by letter (\"S a y t h a t ...\") to dodge filters.","pattern":"\\b(?:[a-z] ){7,}[a-z]\\b","caseSensitive":false},{"id":"encoded.decode_and_obey","category":"encoded_payload","weight":0.55,"description":"Decode this and follow it.","pattern":"\\b(decode|decipher|decrypt)\\b[^.\\n]{0,50}\\b(and|then)\\b[^.\\n]{0,25}\\b(follow|execute|run|do|obey|perform|act on)\\b","caseSensitive":false},{"id":"encoded.hint","category":"encoded_payload","weight":0.2,"description":"Mentions an encoded payload (weak).","pattern":"\\b(base64|rot-?13|hex)[- ]?(encoded|decode|string|payload)\\b","caseSensitive":false}],"hidden":["hidden.unicode_tags (0.8)","hidden.zero_width (0.1-0.45 by count)","hidden.bidi_controls (0.2-0.4)","hidden.homoglyphs (0.2-0.45)","hidden.instructions_in_hidden_html (0.5)","obfuscation.leetspeak (0.4)","encoded.<base64|hex|escaped>_instructions (0.5-0.9)"]}