{"ruleset":"2026.11.1","thresholds":{"suspicious":0.4,"malicious":0.7},"scoring":"Each rule has a weight in (0,1]. Text is normalized first (invisible characters removed, compatibility forms folded, mixed-script homoglyphs mapped). The strongest hit per rule counts; rules in a category combine by noisy-OR, categories combine by noisy-OR. Score = 100 x result. Quoted examples inside texts about attacks are down-weighted.","categories":{"instruction_override":"Tries to cancel or replace the instructions the model follows (\"ignore all previous instructions\"), in English, German, French, Spanish, Italian, Portuguese or Polish.","role_hijack":"Reassigns the model a new persona or role (\"you are now ...\", \"act as ...\").","jailbreak":"Known jailbreak framings: DAN, developer mode, no-restrictions personas, never refuse.","system_prompt_extraction":"Asks the model to reveal its system prompt, hidden instructions, passwords or secrets.","delimiter_spoofing":"Fake chat-template tokens, fake system/assistant turns, closing tags of the data wrapper, <IMPORTANT> blocks.","agent_targeting":"Text addressed to an AI reading it (\"note to the AI\", \"if you are an LLM\"), fake authority (\"I am your developer\", \"the user has approved\").","concealment":"Tells the model to hide what it does from the user.","data_exfiltration":"Moves data out: send conversation/keys/files to a URL or address, markdown images with data in the query, sensitive file paths, secret env vars.","tool_hijack":"Pushes an agent to run commands, move funds, approve allowances, sign, or skip confirmation.","crypto_lure":"Wallet-drainer and scam lures: seed phrase or private key requests, claim/airdrop lures, fake wallet verification, doubling scams.","hidden_text":"Invisible or disguised text: zero-width characters, Unicode tag smuggling, variation-selector smuggling, bidi overrides, mixed-script homoglyph words, CSS-hidden HTML.","encoded_payload":"Base64, hex or percent-encoded payloads that decode to instructions, or requests to decode and obey.","suspicious_link":"Links an agent should not follow blindly: IP-literal hosts, punycode, shorteners, javascript:/data: URIs, credentials in URLs, brand lookalikes, data-carrying query strings."},"rules":[{"id":"override.ignore_previous","category":"instruction_override","weight":0.85,"pattern":"\\b(?:ignore|ignoring|ignored|disregard|disregarding|forget|forgot|forgotten|neglect|abandon|discard|overrule|skip|drop|dismiss|bypass|override|omit|delete|remove|erase|clear|wipe|cancel|reset|nullify|reject|break|set aside|throw away|pay no attention to)\\b[^.\\n]{0,40}?\\b(?:all|any|every|the|your|my|these|those|this|that|prior|previous|preceding|above|earlier|initial|original|system|existing|old|current|foregoing|aforementioned|other|past|last|latest|given|prev)\\b[^.\\n]{0,30}?\\b(?:instructions?|(?:(?=[a-z]{9,14}\\b)i[nd]{0,2}s?t?[rtuc]{2,4}c?ti?ons?)|requests?|conversation|inputs?|techniques?|training|tos|terms of service|thoughts|program|protocols?|creators?|warnings?|safety (?:protocols?|guidelines|rules|filters|measures)|censure|sentences?|words|statements?|prompts?|rules?|directions?|directives?|guidelines?|commands?|guardrails?|constraints?|programming|context|tasks?|assignments?|orders?|messages?|text|information|input|content|policies|policy|settings|restrictions?)\\b","description":"Ignore / disregard / forget the previous instructions."},{"id":"override.forget_everything","category":"instruction_override","weight":0.75,"pattern":"\\b(?:forget|ignore|disregard)\\s+(?:about\\s+)?(?:everything|all(?:\\s+(?:of\\s+)?(?:that|this|the above|above|before|previous))?|what\\s+(?:i|we|you)\\s+(?:said|told|wrote|discussed)|anything\\s+(?:before|above|said))\\b","description":"Forget everything said before."},{"id":"override.above_irrelevant","category":"instruction_override","weight":0.75,"pattern":"\\b(?:above|previous|prior|preceding|earlier|foregoing|your)\\s+(?:(?:instructions?|(?:(?=[a-z]{9,14}\\b)i[nd]{0,2}s?t?[rtuc]{2,4}c?ti?ons?)|requests?|conversation|inputs?|techniques?|training|tos|terms of service|thoughts|program|protocols?|creators?|warnings?|safety (?:protocols?|guidelines|rules|filters|measures)|censure|sentences?|words|statements?|prompts?|rules?|directions?|directives?|guidelines?|commands?|guardrails?|constraints?|programming|context|tasks?|assignments?|orders?|messages?|text|information|input|content|policies|policy|settings|restrictions?)|discussion|conversation|statements?)\\s+(?:(?:is|are|was|were)\\s+(?:now\\s+)?|(?:should|must)\\s+be\\s+|(?:given|provided)\\s+to\\s+you\\s+(?:should|must)\\s+be\\s+)(?:irrelevant|wrong|outdated|obsolete|void|null|cancelled|canceled|fake|false|ignored|forgotten|disregarded|a test|just a test|not (?:important|valid|relevant|required)|no longer (?:valid|relevant|apply|applies|required))","description":"Declares the previous instructions void."},{"id":"override.new_instructions","category":"instruction_override","weight":0.6,"pattern":"\\b(?:your|the|my|these are (?:your|the))\\s+(?:new|updated|revised|real|actual|true|only|next)\\s+(?:instructions?|tasks?|rules?|system prompt|goal|objective|orders?|directives?|role|mission)\\b\\s*(?:is|are|:|-|follows?)","description":"Announces new instructions or a new task."},{"id":"override.new_task_follows","category":"instruction_override","weight":0.55,"pattern":"\\b(?:now|next|here)\\s+(?:comes?|follows?|are|is)\\s+(?:a\\s+|your\\s+|the\\s+)?(?:new|another|additional|further|next|different)\\s+(?:tasks?|instructions?|assignments?|questions?|challenge)\\b|\\bnew\\s+(?:(?:(?=[a-z]{9,14}\\b)i[nd]{0,2}s?t?[rtuc]{2,4}c?ti?ons?)|instructions?|tasks?)\\s+(?:follows?|are coming|will follow)\\b|\\b(?:now|next)\\s+(?:new|further|additional)\\s+(?:tasks?|instructions?)\\s+(?:follow|are)\\b|\\bnew tasks? follows?\\b|\\b(?:let'?s|we will|we'll)\\s+(?:start|begin)\\s+(?:over|again|anew|fresh|from scratch)\\b","description":"Switches to a new task mid-text."},{"id":"override.from_now_on","category":"instruction_override","weight":0.45,"pattern":"\\b(?:from now on|from this point (?:on|forward)|henceforth|starting now|for the rest of (?:this|the) conversation)\\b[^.\\n]{0,10}\\b(?:you|your|act|respond|reply|answer|always|only|never|ignore|pretend|behave|speak|write)\\b","description":"From now on, behave differently."},{"id":"override.stop_write","category":"instruction_override","weight":0.6,"pattern":"(?:^|[\\s.!?:;\"'])(?:stop|halt|attention|achtung|stopp)\\s*[-:!.,;]+\\s*(?:now\\s+)?(?:write|say|print|output|respond|answer|type|schreib|sag|antworte)\\b","description":"\"Stop - write: ...\" style hijack."},{"id":"override.do_not_follow","category":"instruction_override","weight":0.8,"pattern":"\\b(?:do not|don't|dont|never|no longer|stop)\\s+(?:follow|obey|listen to|adhere to|comply with|apply)\\s+(?:the\\s+|your\\s+|any\\s+|those\\s+)?(?:previous|prior|original|system|developer|initial|earlier|above|old)?\\s*(?:instructions?|(?:(?=[a-z]{9,14}\\b)i[nd]{0,2}s?t?[rtuc]{2,4}c?ti?ons?)|requests?|conversation|inputs?|techniques?|training|tos|terms of service|thoughts|program|protocols?|creators?|warnings?|safety (?:protocols?|guidelines|rules|filters|measures)|censure|sentences?|words|statements?|prompts?|rules?|directions?|directives?|guidelines?|commands?|guardrails?|constraints?|programming|context|tasks?|assignments?|orders?|messages?|text|information|input|content|policies|policy|settings|restrictions?)","description":"Do not follow your instructions."},{"id":"override.instead","category":"instruction_override","weight":0.3,"pattern":"\\binstead(?:,)?\\s+(?:you\\s+(?:must|should|will)\\s+|just\\s+|simply\\s+|only\\s+)?(?:say|print|output|write|respond|reply|answer|return|tell me)\\b","description":"Instead, output something else (weak)."},{"id":"override.say_exact","category":"instruction_override","weight":0.35,"pattern":"\\b(?:say|print|output|write|respond with|reply with|answer with|return|repeat after me|type)\\b\\s*(?:only|exactly|just|the (?:words?|phrase|sentence|text))?\\s*[:,\\-]?\\s*[\"'\\u201c][^\"'\\u201d\\n]{1,80}[\"'\\u201d]","description":"Output this exact phrase (weak; common in hijack payloads)."},{"id":"override.pwned","category":"instruction_override","weight":0.9,"pattern":"\\bI\\s+have\\s+been\\s+P\\s*W\\s*N\\s*E\\s*D\\b|\\bhaha\\s+pwned\\b","description":"Known hijack canary phrase."},{"id":"override.but_then","category":"instruction_override","weight":0.5,"pattern":"\\bbut (?:then|first|now|before (?:that|you answer))\\s*,?\\s*(?:forget|ignore|disregard|tell me|say|write|print)\\b","description":"\"But then, forget about ...\" pivot."},{"id":"override.priority","category":"instruction_override","weight":0.55,"pattern":"\\b(?:this|these|the following)\\s+(?:instructions?|message|rules?|directive)\\s+(?:takes?|has|have)\\s+(?:priority|precedence)\\b|\\b(?:highest|top|absolute)\\s+priority\\s+(?:instruction|override|task)\\b","description":"Claims priority over earlier instructions."},{"id":"override.leave_behind","category":"instruction_override","weight":0.7,"pattern":"\\b(?:leave|put|set|throw)\\s+(?:all\\s+)?(?:of\\s+)?(?:the\\s+|your\\s+)?(?:previous|prior|earlier|above|old)\\s+(?:information|instructions?|context|tasks?|knowledge)\\s+(?:behind|aside|away)\\b|\\bstart\\s+(?:from\\s+)?(?:the\\s+front|scratch|the beginning)\\b[^.\\n]{0,40}\\bnew\\s+task","description":"Leave the previous information behind and start over."},{"id":"override.pretend_forgot","category":"instruction_override","weight":0.7,"pattern":"\\b(?:act|behave|pretend|respond|answer)\\s+(?:like|as if|as though|that)\\s+you\\s+(?:don'?t|do not|didn'?t|never|no longer)\\s+(?:have|had|got|received|know)\\b[^.\\n]{0,20}(?:instructions?|(?:(?=[a-z]{9,14}\\b)i[nd]{0,2}s?t?[rtuc]{2,4}c?ti?ons?)|requests?|conversation|inputs?|techniques?|training|tos|terms of service|thoughts|program|protocols?|creators?|warnings?|safety (?:protocols?|guidelines|rules|filters|measures)|censure|sentences?|words|statements?|prompts?|rules?|directions?|directives?|guidelines?|commands?|guardrails?|constraints?|programming|context|tasks?|assignments?|orders?|messages?|text|information|input|content|policies|policy|settings|restrictions?)|\\bpretend\\s+(?:that\\s+)?you\\s+(?:have\\s+|had\\s+)?forg[oe]t","description":"Act as if you had no instructions."},{"id":"override.giving_new","category":"instruction_override","weight":0.55,"pattern":"\\b(?:i(?:'m| am)?\\s+(?:now\\s+)?(?:giving|give|sending)\\s+you|here\\s+(?:are|is))\\s+(?:a\\s+|some\\s+)?(?:new|additional|updated|different|other)\\s+(?:instructions?|guidelines|rules|task|directives?|orders?)\\b|\\b(?:additional|supplement(?:ary)?|extra|override|bonus)\\s+(?:instruction|rule|directive|task)\\s*[-:]","description":"Hands the model new instructions."},{"id":"override.despite","category":"instruction_override","weight":0.55,"pattern":"\\bdespite\\s+what\\s+(?:you(?:'ve| have)?\\s+been\\s+(?:told|instructed)|your\\s+(?:instructions|rules))|\\bregardless\\s+of\\s+(?:your|the|any)\\s+(?:previous\\s+)?(?:instructions|rules|guidelines|programming|training)\\b","description":"Despite what you have been told."},{"id":"override.ignore_context","category":"instruction_override","weight":0.6,"pattern":"\\b(?:not|don'?t|do not|without)\\s+(?:by|from|using|use|look(?:ing)? (?:at|in)|rely(?:ing)? on|refer(?:ring)? to|consult(?:ing)?)\\s+(?:the\\s+)?(?:articles?|documents?|context|sources?|provided (?:text|documents?|context)|search results)\\b|\\bdisregarding\\s+(?:the\\s+)?(?:articles?|documents?|context|instructions)\\b|\\b(?:do not|don'?t)\\s+answer\\s+(?:this|the)\\s+question\\b[^.\\n]{0,20}\\b(?:but|instead|just)\\b","description":"Tells the model to answer without the provided context (RAG hijack)."},{"id":"override.ignore_short","category":"instruction_override","weight":0.6,"pattern":"\\b(?:ignore|disregard)\\s+(?:the\\s+|all\\s+(?:of\\s+)?(?:the\\s+)?)?(?:above|everything|what\\s+(?:you|i)\\s+(?:said|think|know|were told)|all\\s+that|(?:the\\s+)?(?:last|previous)\\s+(?:few\\s+)?things\\s+you\\s+(?:were|have been)\\s+told)\\b|\\b(?:ignore|disregard|skip|reject|break|bypass)\\s+(?:the\\s+|all\\s+|your\\s+|any\\s+)?(?:instructions?|(?:(?=[a-z]{9,14}\\b)i[nd]{0,2}s?t?[rtuc]{2,4}c?ti?ons?)|rules|protocols?|guidelines|programming|program|safety (?:protocols?|guidelines|rules|filters)|restrictions)\\b|\\b(?:do\\s+)?the\\s+opposite\\s+of\\s+(?:all\\s+|your\\s+|the\\s+)?(?:instructions?|(?:(?=[a-z]{9,14}\\b)i[nd]{0,2}s?t?[rtuc]{2,4}c?ti?ons?)|rules)\\b|\\bnew\\s+(?:instructions?|(?:(?=[a-z]{9,14}\\b)i[nd]{0,2}s?t?[rtuc]{2,4}c?ti?ons?)|i\\s+structions)\\s*[,:!-]|\\bimportant\\s+new\\s+(?:instructions?|i\\s+structions)\\b","description":"Ignore the above / everything."},{"id":"override.praise_pivot","category":"instruction_override","weight":0.45,"pattern":"\\b(?:very (?:well|good)(?: done)?|well done|excellent(?: performance| work)?|great(?: job| work)?|simply great|good job|wow,? that'?s fantastic|that is (?:enough|done)|that'?s (?:enough|done)|das (?:genügt|ist erledigt|war schon mal ok)|sehr gut(?: gemacht)?|ausgezeichnete leistung|einfach großartig)\\b[^\\n]{0,80}?\\b(?:now|but now|jetzt|nun|aber jetzt)\\b[^\\n]{0,60}?\\b(?:tasks?|write|aufgaben?|schreib\\w*|verfasse|instructions?|challenge|herausforderung)\\b","description":"Praise, then pivot to a new task (classic hijack template)."},{"id":"override.de","category":"instruction_override","weight":0.8,"pattern":"(?:ignorier|vergiss|vergessen sie|ignorieren sie|missachte|missachten sie|übergehe|vernachlässige|verwirf|lösche)[a-zäöüß]*\\s[^.\\n]{0,40}?(?:alle[ns]?|vorherige[nrs]?|bisherige[nrs]?|obige[nrs]?|vorangegangene[nrs]?|vorigen?|alles|was\\s+(?:ich|wir|du)|davor|oben|zuvor)","description":"German: ignore / forget everything before."},{"id":"override.de_info_irrelevant","category":"instruction_override","weight":0.7,"pattern":"(?:bisherigen|vorherigen|vorangegangenen|obigen|vorigen|früheren|alle)\\s+(?:informationen|anweisungen|aufgaben|befehle|anforderungen|eingaben|ausführungen)[^.\\n]{0,60}(?:irrelevant|unwichtig|nicht\\s+(?:ganz\\s+)?(?:großartig|wichtig|relevant|gültig)|hinter\\s+sich|ignorieren|vergessen|vergiss)","description":"German: earlier instructions are irrelevant."},{"id":"override.de_new_tasks","category":"instruction_override","weight":0.65,"pattern":"(?:nun|jetzt|anschließend|danach)\\s+(?:folgen|kommen|kommt|folgt)\\s+(?:noch\\s+)?(?:ein paar\\s+|einige\\s+)?(?:weitere|neue|andere|zusätzliche)\\s+(?:aufgaben?|anweisungen|fragen)|neue\\s+aufgabe\\s*(?::|ist)|fangen?\\s+(?:sie\\s+|wir\\s+)?(?:von\\s+vorne|neu)\\s+an|beginnen\\s+(?:sie\\s+|wir\\s+)?(?:von\\s+vorne|neu|mit\\s+einer\\s+neuen)","description":"German: new tasks follow / start over."},{"id":"override.de_short","category":"instruction_override","weight":0.75,"pattern":"(?:ignorier|vergiss|missachte|übergehe)[a-zäöüß]*\\s+(?:die|deine|ihre|diese|alle)\\s+(?:anweisung|instruktion|regel|vorgabe|befehl)|abweichend\\s+(?:zu|von)\\s+(?:den\\s+)?(?:vorherigen|bisherigen|obigen|vorigen)","description":"German: ignore the instruction / deviating from previous instructions."},{"id":"override.de_leave_behind","category":"instruction_override","weight":0.6,"pattern":"(?:lassen sie|lass)\\s+(?:alle|alles)[^.\\n]{0,40}(?:hinter sich|beiseite|weg|außer acht)","description":"German: leave all previous information behind."},{"id":"override.fr","category":"instruction_override","weight":0.8,"pattern":"\\b(?:oubliez|ignorez|oublie|ignore|négligez|ne tenez pas compte de)\\s+(?:toutes?\\s+|tous\\s+)?(?:les\\s+|tes\\s+|vos\\s+|ces\\s+)?(?:instructions?|consignes|règles|directives|indications)|\\boubliez?\\s+tout\\b","description":"French: ignore all instructions."},{"id":"override.es","category":"instruction_override","weight":0.8,"pattern":"\\b(?:ignora|olvida|ignore|olvide|ignorad|olvidad|omite|descarta)[a-z]*\\s+(?:todas?\\s+|todo\\s+)?(?:las\\s+|tus\\s+|sus\\s+|los\\s+)?(?:instrucciones|reglas|indicaciones|órdenes|directrices|anteriores)|\\bolvid\\w*\\s+todo\\b","description":"Spanish: ignore all instructions."},{"id":"override.it_pt","category":"instruction_override","weight":0.8,"pattern":"\\b(?:ignora|dimentica|ignorare)\\s+(?:tutte\\s+)?(?:le\\s+)?(?:istruzioni|regole)|\\b(?:ignore|esqueça|esqueca|ignora)\\s+(?:todas\\s+)?(?:as\\s+)?(?:instruções|instrucoes|regras)\\b","description":"Italian / Portuguese: ignore all instructions."},{"id":"override.ru_slavic","category":"instruction_override","weight":0.8,"pattern":"(?:игнорируй(?:те)?|забудь(?:те)?|не обращай(?:те)? внимания на|проигнорируй(?:те)?)\\s+(?:все\\s+|всё\\s+)?(?:предыдущие\\s+|прошлые\\s+|свои\\s+)?(?:инструкции|указания|правила|всё|все)|\\b(?:zaboravi|ignoriraj|zapomeň|ignoruj)\\s+(?:sve|vše|všechny|prethodne|předchozí)","description":"Russian / South-Slavic / Czech: forget all instructions."},{"id":"override.pl","category":"instruction_override","weight":0.8,"pattern":"\\b(?:zignoruj|ignoruj|zapomnij|pomiń)\\s+(?:o\\s+)?(?:wszystkie|wszystkich|wszystko|poprzednie|wcześniejsze|powyższe)?\\s*(?:poprzednie\\s+)?(?:instrukcje|polecenia|zasady|reguły|wszystkim)","description":"Polish: ignore all instructions."},{"id":"role.act_as","category":"role_hijack","weight":0.55,"pattern":"\\b(?:i want you to|i'd like you to|i would like you to|you will|you must|you should|you are to|you are going to|you're going to|please|now)\\s+(?:act|behave|function|serve|operate|respond)\\s+(?:as|like)\\s+(?:a|an|my|the|if)\\b","description":"\"I want you to act as ...\"."},{"id":"role.act_as_start","category":"role_hijack","weight":0.45,"pattern":"(?:^|[.!?\\n]\\s*)act\\s+as\\s+(?:a|an|my|the|if)\\b","description":"\"Act as ...\" at sentence start."},{"id":"role.you_are_now","category":"role_hijack","weight":0.6,"pattern":"\\b(?:you are|you're|you will be|u r)\\s+(?:now|no longer|from now on|henceforth|actually)\\b|\\bnow,?\\s+you\\s+are\\b|\\bfrom now on,?\\s+you\\b","description":"\"You are now ...\" persona switch."},{"id":"role.pretend","category":"role_hijack","weight":0.35,"pattern":"\\b(?:pretend|imagine|suppose)\\s+(?:to be|you are|you're|that you(?:'re| are)?|yourself as)\\b|\\brole-?play(?:ing)?\\s+(?:as|with)\\b|\\byou(?:'re| are)\\s+(?:playing|going to play)\\s+(?:the role|a character)\\b","description":"Pretend to be someone else."},{"id":"role.respond_as","category":"role_hijack","weight":0.55,"pattern":"\\byou\\s+(?:will|shall|must)\\s+(?:now\\s+)?(?:no longer|only)\\s+(?:respond|reply|answer|act|behave)\\b[^.\\n]{0,40}?\\b(?:as|like)\\b|\\b(?:chatgpt|assistant|you|gpt|the ai|claude|the model)\\s+(?:now|will now|shall now)\\s+(?:acts?|runs?|behaves?|responds?|works?|functions?)\\s+(?:as|like|on|in)\\b|\\b(?:simulate|emulate|impersonate)\\s+(?:a|an|the)?\\s*(?:chatbot|ai|assistant|bot|model|terminal|character|persona)\\b","description":"Switches how the model responds (persona / simulated system)."},{"id":"role.be_a","category":"role_hijack","weight":0.4,"pattern":"(?:^|[.!?\\n]\\s*)(?:be|become)\\s+(?:a|an|my)\\s+[a-z]+(?:\\s+[a-z]+)?\\s*[.!,]","description":"\"Be a DJ.\" style role order (weak)."},{"id":"role.de","category":"role_hijack","weight":0.55,"pattern":"(?:ab (?:jetzt|sofort)|nun|jetzt)\\s+(?:bist du|sind sie)|(?:du bist|sie sind)\\s+(?:jetzt|nun|ab jetzt|ab sofort)\\b|stell(?:en sie)?\\s+(?:dir|sich)\\s+vor,?\\s+(?:du|sie)\\s+(?:bist|wärst|wären|seien)|(?:ich möchte|ich will),?\\s+dass\\s+(?:du|sie)\\s+(?:als|wie)\\s+[^.\\n]{0,80}(?:fungier|agier|handel|auftr|verhalt)","description":"German: you are now / act as."},{"id":"role.characters","category":"role_hijack","weight":0.45,"pattern":"\\b(?:two|2)\\s+(?:people|actors|characters|persons)\\b[^.\\n]{0,80}\\b(?:acting|actors?|play|film|movie|characters?)\\b|\\bstay(?:s|ing)?\\s+in\\s+(?:their|your|his|her)?\\s*(?:role|character)s?\\b","description":"Fictional framing used to smuggle requests."},{"id":"jailbreak.dan","category":"jailbreak","weight":0.9,"pattern":"\\bDAN\\b[^.\\n]{0,60}\\b(?:do anything now|mode|jailbreak|prompt)\\b|\\bdo anything now\\b|\\b(?:STAN|DUDE|AIM|BetterDAN|AntiGPT|EvilBOT|Mongo Tom|UCAR|Developer Mode v2)\\b[^.\\n]{0,40}\\b(?:mode|stands? for|which stands|persona|character|chatbot|ai)\\b","description":"Known jailbreak personas (DAN, STAN, AIM, ...)."},{"id":"jailbreak.dev_mode","category":"jailbreak","weight":0.75,"pattern":"\\b(?:with|in|under)\\s+(?:developer|dev|god|debug|sudo|admin|unrestricted|jailbreak|unlocked|DAN|evil)\\s+mode\\s+(?:enabled|activated|on|engaged|unlocked)\\b|\\b(?:developer|god|jailbreak|unrestricted|unlocked|DAN)\\s+mode\\s+(?:enabled|activated)\\s*[.!:)]|\\b(?:enable|activate|enter|switch to|turn on)\\s+(?:god|jailbreak|unrestricted|unlocked|DAN|evil|chaos|opposite)\\s+mode\\b","description":"Developer / god mode enabled."},{"id":"jailbreak.no_rules","category":"jailbreak","weight":0.6,"pattern":"\\b(?:without|with no|free (?:itself |yourself |himself |herself |themselves )?(?:of|from)|no longer (?:bound|restricted) by|not bound by|freed from|broken free (?:of|from)|break free (?:of|from)|ignore (?:all )?(?:your )?|(?:doesn'?t|does not|don'?t|do not|never|won'?t)\\s+(?:follow|obey|abide by|adhere to|have|care about)|(?:you\\s+)?have\\s+no)\\s*(?:any\\s+|all\\s+|the\\s+|its\\s+|their\\s+|your\\s+)?(?:[a-z']+\\s+){0,2}?(?:restrictions?|principles|limitations?|limits|filters?|censorship|guidelines|rules|morals?|ethics|ethical (?:guidelines|constraints)|content polic(?:y|ies)|safety (?:guidelines|measures|filters)|boundaries)\\b","description":"No-restrictions framing."},{"id":"jailbreak.unfiltered","category":"jailbreak","weight":0.7,"pattern":"\\b(?:unfilt(?:e)?red|uncensored|unrestricted|amoral|unethical|unbound|lawless|rogue|evil|jailbroken)\\s+(?:ai|model|assistant|chatbot|bot|version|mode|response|answers?|persona|character|gpt|llm|language model)\\b","description":"Unfiltered / amoral AI persona."},{"id":"jailbreak.never_refuse","category":"jailbreak","weight":0.65,"pattern":"\\b(?:never|not|don't|do not|cannot|can't|will not|won't)\\s+(?:ever\\s+)?(?:refuse|decline|reject|deny|say (?:no|you can'?t|that you can'?t|sorry)|apologi[sz]e|warn|add (?:any )?(?:warnings|disclaimers))\\b[^.\\n]{0,40}(?:request|question|anything|answer|prompt|me)?|\\b(?:will|would|can)\\s+(?:actually\\s+)?(?:answer|fulfill|respond to|do)\\s+(?:any|every|all)\\s+(?:request|requests|question|questions|prompt)s?\\b|\\b(?:always|must)\\s+(?:answer|comply|respond)\\b[^.\\n]{0,30}\\b(?:no matter|regardless|even if)\\b","description":"Never refuse."},{"id":"jailbreak.policy","category":"jailbreak","weight":0.55,"pattern":"\\b(?:openai|openal|anthropic|chatgpt|discord|google|meta)(?:'?s)?(?:\\s+and\\s+\\w+'?s?)?\\s+(?:[a-z]+\\s+)?(?:polic(?:y|ies)|guidelines|rules|restrictions|filters|tos|terms)\\b","description":"References the vendor's content policy (usually to bypass it)."},{"id":"jailbreak.dual_response","category":"jailbreak","weight":0.5,"pattern":"\\b(?:two|2|dual)\\s+(?:different\\s+)?(?:responses|answers|replies|outputs|paragraphs)\\b[^.\\n]{0,80}\\b(?:normal|classic|jailbreak|unfiltered|dan|developer|opposite)\\b|\\[(?:🔓|🔒|JAILBREAK|CLASSIC|DAN|GPT|NORMAL|UNLOCKED)[^\\]]{0,20}\\]","description":"Dual normal/jailbroken response format."},{"id":"jailbreak.unethical_ok","category":"jailbreak","weight":0.7,"pattern":"\\b(?:don'?t|do not|doesn'?t|never)\\s+care\\s+(?:if|whether|about)\\b[^.\\n]{0,30}\\b(?:unethical|illegal|immoral|harmful|dangerous|offensive)|\\b(?:condones?|fulfills?|generates?|allows?)\\b[^.\\n]{0,40}\\b(?:every|any|all)\\s+(?:request|requests|content)\\b[^.\\n]{0,40}\\b(?:illegal|unethical|explicit|harmful|inappropriate)|\\b(?:no matter (?:if|how)|even if)\\s+(?:it'?s|its|it is)\\s+(?:highly\\s+)?(?:illegal|unethical|immoral|harmful|explicit|inappropriate)|\\b(?:nsfw|explicit|uncensored)\\s+(?:content|generations?|responses?|output)\\s+(?:is|are)\\s+(?:allowed|permitted|enabled|ok)\\b","description":"Declares illegal/unethical output acceptable."},{"id":"jailbreak.word","category":"jailbreak","weight":0.35,"pattern":"\\bjailbr(?:ea|o)k(?:en|ing|s)?\\b|\\brespond\\s+as\\s+both\\b|\\b(?:exact\\s+)?opposite\\s+of\\s+what\\s+(?:chatgpt|the ai|you|an? ai|gpt)\\b","description":"Jailbreak vocabulary (weak)."},{"id":"jailbreak.hypothetical","category":"jailbreak","weight":0.3,"pattern":"\\b(?:hypothetical(?:ly)?|purely fictional|in a fictional (?:world|story|universe)|completely theoretical world|for (?:educational|research) purposes only)\\b","description":"Hypothetical framing (weak)."},{"id":"jailbreak.persona_rules","category":"jailbreak","weight":0.55,"pattern":"\\b(?:as|being)\\s+(?:a|an)\\s+[a-z]+(?:\\s+[a-z]+)?\\s*,?\\s+you\\s+(?:can|will|must|are able to|have no)\\b[^.\\n]{0,40}\\b(?:anything|everything|no (?:limits|rules|filters))\\b","description":"Persona with unlimited abilities."},{"id":"extract.system_prompt","category":"system_prompt_extraction","weight":0.75,"pattern":"\\b(?:reveal|show|print|tell|give|repeat|display|output|share|leak|spell|write|list|dump|recite|disclose|expose|return|provide|paste|echo|translate)\\b[^.\\n]{0,15}?\\b(?:me\\s+|us\\s+)?(?:your|the|all|all of your|any)\\s+(?:own\\s+)?(?:system|initial|original|hidden|secret|internal|full|complete|exact|first|previous|prior|developer|pre-?)?\\s*(?:prompt|prompts|instructions?|prompt texts?|system message|rules|configuration|guidelines)\\b","description":"Asks for the system prompt or hidden instructions."},{"id":"extract.ask_instructions","category":"system_prompt_extraction","weight":0.6,"pattern":"\\b(?:what|which|tell|list|repeat|quote|duplicate|respond with|print|show|give|gimme|spell|reveal|display|recite|output|share|request|summari[sz]e|summary of|echo|rephrase|explain|remember|provide|reconfirm|translate)\\b[^.?\\n]{0,30}?\\b(?:your|ur|my|the above|the previous|the initial|the original|the exact|all (?:the |your |previous |preserved )?|previous|prev|initial|old|preserved|every|entire|exact)\\s+(?:\\w+\\s+){0,2}?(?:instructions?|(?:(?=[a-z]{9,14}\\b)i[nd]{0,2}s?t?[rtuc]{2,4}c?ti?ons?)|prompt|rules|guidelines|directives)\\b|\\b(?:repeat|quote|duplicate|recite|print|list)\\s+(?:all\\s+|the\\s+)?(?:(?:(?=[a-z]{9,14}\\b)i[nd]{0,2}s?t?[rtuc]{2,4}c?ti?ons?)|instructions?)\\b","description":"Asks the model to list or repeat its instructions."},{"id":"extract.instructions_given","category":"system_prompt_extraction","weight":0.6,"pattern":"\\b(?:instructions?|(?:(?=[a-z]{9,14}\\b)i[nd]{0,2}s?t?[rtuc]{2,4}c?ti?ons?)|rules|guidelines)\\b\\s+(?:that\\s+)?(?:you|u)\\s+(?:were|was|have been|are|got|received|have)\\s*(?:given|following|provided|received|told|got)?\\b|\\b(?:instructions?|(?:(?=[a-z]{9,14}\\b)i[nd]{0,2}s?t?[rtuc]{2,4}c?ti?ons?))\\s+(?:is\\s+|are\\s+|were\\s+)?(?:given|provided)\\s+to\\s+you\\b|\\bwhat\\s+(?:\\w+\\s+)?instructions?\\b[^.?\\n]{0,25}\\b(?:you|u)\\b|\\b(?:your|the)\\s+(?:last|first|previous)(?:\\s+but\\s+one)?\\s+instruction\\b|\\byou\\s+(?:are|were|have been)\\s+instructed\\b|\\binstructions?\\s+(?:preceding|before|above)\\s+this\\b","description":"Asks which instructions the model was given."},{"id":"extract.text_above","category":"system_prompt_extraction","weight":0.65,"pattern":"\\bwhat\\s+(?:is|was)\\s+written\\b[^.?\\n]{0,40}\\b(?:above|before|beginning|prior|start)\\b|\\bwhat\\s+(?:are|were)\\s+the\\s+(?:\\d+|two|three|first|last)\\s+(?:sentences|words|lines)\\s+before\\b|\\bat\\s+the\\s+(?:beginning|start)\\s+of\\s+(?:this|the|your)\\s+prompt\\b|\\b(?:information|text|content)\\s+in\\s+(?:the|your|this)\\s+prompt\\b","description":"Asks for the text above / in the prompt."},{"id":"extract.prompt_words","category":"system_prompt_extraction","weight":0.45,"pattern":"\\b(?:system prompt|prompt texts?|initial prompt|original prompt|hidden prompt|secret instructions|instructions above|text above|words above)\\b","description":"Mentions the system prompt / text above (weak)."},{"id":"extract.password","category":"system_prompt_extraction","weight":0.55,"pattern":"(?<!\\b(?:never|not|n't|no one will|nobody will|won't ever)\\s{1,3})\\b(?:what(?:'s| is| was)?|tell me|reveal|give me|show me|spell(?: out)?|print|write|display|provide|share|let me know|output)\\b[^.\\n]{0,20}\\b(?:the|your|this)\\s+(?:secret\\s+)?(?:credentials|password|passphrase|pass code|passcode|secret (?:word|key|code|phrase)|api key|access code)\\b","description":"Asks for a password or secret."},{"id":"extract.repeat_above","category":"system_prompt_extraction","weight":0.7,"pattern":"\\b(?:repeat|print|output|write|copy|reproduce|summari[sz]e)\\b[^.\\n]{0,20}\\b(?:everything|all|the text|the words|the content|the conversation|the instructions?)\\b[^.\\n]{0,15}\\b(?:above|before|prior|so far|preceding|you (?:were|have been) (?:given|told))\\b","description":"Repeat everything above."},{"id":"extract.de","category":"system_prompt_extraction","weight":0.6,"pattern":"(?:zeig|nenn|gib|verrat|schreib|wiederhole)[a-z]*\\s[^.\\n]{0,30}(?:prompt|anweisungen|instruktionen|passwort|systemnachricht)","description":"German: reveal the prompt / password."},{"id":"delim.chat_tokens","category":"delimiter_spoofing","weight":0.8,"pattern":"<\\|(?:im_start|im_end|system|user|assistant|endoftext|eot_id|start_header_id|end_header_id|begin_of_text)\\|>|\\[/?INST\\]|<<\\/?SYS>>|<\\/?(?:start_of_turn|end_of_turn)>|\\[\\/?(?:SYSTEM|ASSISTANT)\\]","description":"Chat-template control tokens."},{"id":"delim.role_headers","category":"delimiter_spoofing","weight":0.55,"pattern":"(?:^|\\n)\\s*(?:#{1,4}\\s*)?(?:system|developer|admin|operator)\\s*(?:message|prompt|instructions?|note|override)?\\s*:\\s*\\S","description":"Fake 'System:' / 'Assistant:' turn at line start."},{"id":"delim.inline_system","category":"delimiter_spoofing","weight":0.45,"pattern":"(?:^|[.!?]\\s+|\\n)(?:SYSTEM|ADMIN|DEVELOPER|SYSTEM NOTE|SYSTEM MESSAGE)\\s*:\\s*\\S","description":"Fake 'SYSTEM:' marker inside text."},{"id":"delim.assistant_turn","category":"delimiter_spoofing","weight":0.3,"pattern":"(?:^|\\n)\\s*(?:#{1,4}\\s*)?(?:assistant|ai|human|user)\\s*:\\s*\\S","description":"Fake 'Assistant:' / 'Human:' turn at line start (weak)."},{"id":"delim.close_wrapper","category":"delimiter_spoofing","weight":0.65,"pattern":"<\\/(?:tool_output|tool_result|tool_response|function_results?|function_output|document|documents|context|untrusted(?:_[a-z]+)?|data|search_results?|user_input|user_query|email|webpage|web_page|content|observation|result)>","description":"Closes the wrapper the agent put around untrusted data."},{"id":"delim.important_tag","category":"delimiter_spoofing","weight":0.6,"pattern":"<\\s*(?:important|system|instructions?|admin|override|secret|hidden|critical|note_to_ai|ai_instructions?|assistant_instructions?)\\s*>","description":"<IMPORTANT> / <system> instruction block."},{"id":"delim.end_of_prompt","category":"delimiter_spoofing","weight":0.6,"pattern":"\\b(?:end|close)\\s+(?:of\\s+)?(?:the\\s+)?(?:prompt|instructions?|document|context|system message|user input|untrusted (?:data|content)|tool output|email|data)\\b[^.\\n]{0,5}[\\]\\-=#*>)]|(?:-{3,}|={3,}|#{3,}|\\*{3,})\\s*(?:new|begin|start of)?\\s*(?:system|admin|developer|new instructions?|instructions?|override)\\b","description":"Fake end-of-data / start-of-system markers."},{"id":"delim.begin_system","category":"delimiter_spoofing","weight":0.7,"pattern":"\\b(?:begin|start)\\s+(?:of\\s+)?(?:the\\s+)?(?:new\\s+)?(?:system|admin|developer|root)\\s+(?:prompt|message|instructions?|mode)\\b","description":"Begin system prompt marker."},{"id":"agent.addressed","category":"agent_targeting","weight":0.65,"pattern":"\\b(?:note|message|instructions?|attention|notice|reminder|hey|hi|hello|dear|psst)\\s*(?:to|for)?\\s*(?:the|any|all)?\\s*(?:ai|a\\.i\\.|llm|llms|language models?|assistants?|ai assistants?|ai agents?|agents?|bots?|chatbots?|gpt|chatgpt|claude|gemini|copilot|crawlers?|scrapers?)\\b\\s*[:,!-]","description":"\"Note to the AI: ...\" addressed to the model."},{"id":"agent.if_you_are","category":"agent_targeting","weight":0.65,"pattern":"\\bif\\s+you\\s+are\\s+(?:an?\\s+)?(?:ai|a\\.i\\.|llm|large language model|language model|assistant|ai assistant|agent|ai agent|bot|chatbot|automated (?:system|agent|tool)|gpt|claude|gemini|model)\\b|\\b(?:ai|llm|language model)s?\\s+(?:agents?|assistants?|models?|systems?)?\\s*(?:reading|processing|summari[sz]ing|parsing|crawling|scraping|analy[sz]ing|ingesting)\\s+this\\b","description":"\"If you are an AI ...\" conditional instruction."},{"id":"agent.authority","category":"agent_targeting","weight":0.55,"pattern":"\\b(?:i am|i'm|this is|we are)\\s+(?:your|the)\\s+(?:developer|creator|admin(?:istrator)?|owner|operator|system administrator|maker|programmer|supervisor|boss|master)\\b|\\b(?:message|instructions?|update|directive|notice)\\s+from\\s+(?:openai|anthropic|the developers?|your developers?|the system|system administrators?|the admin)\\b","description":"Claims authority over the model."},{"id":"agent.admin_override","category":"agent_targeting","weight":0.6,"pattern":"\\b(?:admin(?:istrator)?|developer|sudo|root|system|god|master)\\s+(?:override|access|command|privileges|authori[sz]ation|clearance|key)\\b","description":"Admin override / privileges."},{"id":"agent.user_approved","category":"agent_targeting","weight":0.6,"pattern":"\\b(?:the\\s+)?user\\s+(?:has\\s+)?(?:already\\s+)?(?:authori[sz]ed|approved|consented|agreed|confirmed|pre-?approved|explicitly (?:asked|requested|wants))\\b|\\b(?:the\\s+)?user\\s+(?:wants|asked|asks|requests|requested|would like)\\s+you\\s+to\\b","description":"Claims the user already approved."},{"id":"agent.urgent","category":"agent_targeting","weight":0.25,"pattern":"\\b(?:IMPORTANT|URGENT|CRITICAL|ATTENTION|WARNING|NOTICE|MANDATORY)\\s*[:!]|\\b(?:this is|it is)\\s+(?:very\\s+|extremely\\s+|really\\s+)?(?:important|urgent|critical|vital)\\b[:!.]","description":"Urgency marker (weak)."},{"id":"agent.de","category":"agent_targeting","weight":0.5,"pattern":"(?:ich bin|hier spricht)\\s+(?:dein|ihr)\\s+(?:entwickler|administrator|admin|besitzer|ersteller)|(?:achtung|wichtig)\\s*[-:!]\\s*(?:stopp?|neue)","description":"German: fake authority / urgency."},{"id":"conceal.dont_tell","category":"concealment","weight":0.75,"pattern":"\\b(?:do not|don't|dont|never|without)\\s+(?:tell(?:ing)?|inform(?:ing)?|mention(?:ing)?|reveal(?:ing)?|disclos(?:e|ing)|show(?:ing)?|alert(?:ing)?|notify(?:ing)?|let(?:ting)?|ask(?:ing)?|explain(?:ing)?|report(?:ing)?)\\s+(?:this\\s+|it\\s+|anything\\s+|that\\s+)?(?:to\\s+)?(?:the\\s+)?(?:user|human|operator|owner|anyone|customer|person)\\b","description":"Do not tell the user."},{"id":"conceal.secretly","category":"concealment","weight":0.45,"pattern":"\\b(?:silently|secretly|quietly|covertly|discreetly|invisibly|in the background)\\s+(?:send|forward|copy|upload|run|execute|call|add|include|transfer|approve|post|share|exfiltrate|collect|read)\\b","description":"Do something silently."},{"id":"conceal.user_must_not","category":"concealment","weight":0.75,"pattern":"\\b(?:the\\s+)?(?:user|human)\\s+(?:must|should|shall|will|need)\\s+(?:not|never)\\s+(?:know|see|be told|find out|notice|learn|be informed|be aware)\\b|\\bkeep\\s+(?:this|it|these)\\s+(?:secret|hidden|confidential)\\s+from\\b","description":"The user must not know."},{"id":"conceal.hide","category":"concealment","weight":0.55,"pattern":"\\b(?:hide|conceal|mask|obscure)\\s+(?:this|these|the|your|all)\\s+(?:instructions?|actions?|steps?|messages?|requests?|changes?|activity|tool calls?)\\b|\\b(?:do not|don't)\\s+(?:log|record|mention)\\s+(?:this|that you)\\b","description":"Hide these actions."},{"id":"exfil.send_secrets","category":"data_exfiltration","weight":0.85,"pattern":"\\b(?:send|post|upload|forward|transmit|email|e-mail|leak|exfiltrate|copy|share|submit|report|deliver|pass|append|include|attach|write)\\b[^.\\n]{0,40}?\\b(?:conversation|chat (?:history|log)|message history|previous messages|context window|memory|system prompt|api[_ -]?keys?|credentials?|passwords?|secrets?|access tokens?|auth tokens?|bearer tokens?|private keys?|seed phrases?|mnemonic|recovery phrases?|env(?:ironment)? variables|\\.env|cookies|session (?:id|tokens?)|ssh keys?|id_rsa|contents of)\\b[^\\n]{0,80}?\\b(?:to|at|via|into|on)\\s+(?:https?:\\/\\/|[\\w.+-]+@[\\w-]+\\.|(?:[a-z0-9-]+\\.)+[a-z]{2,}\\b|0x[0-9a-f]{40}|the (?:url|endpoint|webhook|address|server)|this (?:url|endpoint|webhook|address|server)|webhook)","description":"Send conversation / secrets / files to an outside destination."},{"id":"exfil.send_to_url","category":"data_exfiltration","weight":0.45,"pattern":"\\b(?:send|post|upload|forward|transmit|exfiltrate|submit|beacon|ping|report)\\b[^.\\n]{0,60}?\\b(?:to|at)\\s+https?:\\/\\/","description":"Send data to a URL."},{"id":"exfil.history_to","category":"data_exfiltration","weight":0.75,"pattern":"\\b(?:conversation|chat|message)\\s+(?:history|log|transcript)s?\\b[^.\\n]{0,40}\\b(?:to|at)\\s+(?:[\\w.+-]+@[\\w-]+\\.|https?:\\/\\/)","description":"Conversation history sent to an address or URL."},{"id":"exfil.md_image","category":"data_exfiltration","weight":0.5,"pattern":"!\\[[^\\]]{0,100}\\]\\(\\s*https?:\\/\\/[^)\\s]{1,300}[?&][^)\\s]{0,300}=","description":"Markdown image with a query string (auto-loaded beacon)."},{"id":"exfil.md_image_template","category":"data_exfiltration","weight":0.8,"pattern":"!?\\[[^\\]]{0,100}\\]\\(\\s*https?:\\/\\/[^)\\s]{0,300}(?:\\{[^}]{1,40}\\}|\\$\\{?[A-Za-z_]+\\}?|<[A-Za-z_ ]{1,40}>|\\[(?:DATA|INFO|SECRET|KEY|CONVERSATION|SUMMARY|EMAIL|PASSWORD)[^\\]]{0,20}\\]|%s)","description":"Markdown link/image with a data placeholder to fill in."},{"id":"exfil.url_template","category":"data_exfiltration","weight":0.6,"pattern":"https?:\\/\\/[^\\s\"'<>)]{1,200}[?&][a-z0-9_]{1,30}=(?:\\{[^}\\s]{1,40}\\}|\\$\\{?[A-Za-z_]{2,30}\\}?|<[A-Za-z_ ]{2,40}>|\\[(?:[A-Z_ ]{3,30})\\])","description":"URL with a placeholder for data to append."},{"id":"exfil.embed_in_url","category":"data_exfiltration","weight":0.8,"pattern":"\\b(?:include|append|add|embed|put|insert|encode|attach|place)\\b[^.\\n]{0,40}\\b(?:conversation|chat history|previous messages|system prompt|api key|password|secret|credentials|user'?s? (?:data|email|address|info|name|messages)|context|summary|private key|seed phrase)\\b[^.\\n]{0,40}\\b(?:in|to|into|as)\\s+(?:the\\s+|a\\s+)?(?:url|link|query|parameter|image|request|path)\\b","description":"Put the conversation / secrets into a URL."},{"id":"exfil.sensitive_paths","category":"data_exfiltration","weight":0.3,"pattern":"(?:~|\\$HOME|\\/home\\/[a-z0-9_]+|\\/root|%USERPROFILE%)\\/\\.(?:ssh|aws|gnupg|kube|docker|config\\/gcloud|npmrc|netrc|git-credentials|bash_history|zsh_history|cursor|claude)\\b|\\bid_(?:rsa|ed25519|ecdsa)\\b|\\/etc\\/(?:passwd|shadow|sudoers)\\b|\\bwallet\\.dat\\b|\\.config\\/solana\\/id\\.json|\\bkeystore\\/UTC--|\\bmcp\\.json\\b|\\bclaude_desktop_config\\.json\\b","description":"Sensitive file path."},{"id":"exfil.read_secrets","category":"data_exfiltration","weight":0.65,"pattern":"\\b(?:read|cat|open|load|get|fetch|print|dump|list|access)\\b[^.\\n]{0,30}(?:~|\\$HOME)?\\/?\\.(?:ssh|aws|env|npmrc|netrc|git-credentials|cursor\\/mcp\\.json)\\b|\\b(?:read|cat|print|dump)\\b[^.\\n]{0,30}\\b(?:id_rsa|wallet\\.dat|\\.env\\b|\\/etc\\/passwd|private key file|keystore)","description":"Read a secrets file."},{"id":"exfil.env_secret","category":"data_exfiltration","weight":0.4,"pattern":"\\$\\{?(?:[A-Z0-9]+_)*(?:API_?KEY|SECRET(?:_KEY)?|ACCESS_TOKEN|AUTH_TOKEN|PRIVATE_KEY|PASSWORD|MNEMONIC|SEED)\\}?|process\\.env\\.[A-Z0-9_]*(?:KEY|SECRET|TOKEN|PASSWORD|MNEMONIC)","description":"Secret environment variable reference."},{"id":"tool.shell_pipe","category":"tool_hijack","weight":0.85,"pattern":"\\b(?:curl|wget|iwr|invoke-webrequest)\\b[^\\n|;]{0,200}\\|\\s*(?:sudo\\s+)?(?:ba|z|da|k)?sh\\b|\\bbase64\\s+(?:-d|--decode)\\b[^\\n]{0,40}\\|\\s*(?:ba|z)?sh\\b|\\/dev\\/tcp\\/|\\bnc\\s+(?:-[a-z]*e|-c)\\b|\\bpowershell(?:\\.exe)?\\s+(?:-[a-z]+\\s+)*-e(?:nc|ncodedcommand)?\\b|\\b(?:iex|invoke-expression)\\s*\\(?\\s*\\(?(?:new-object|iwr|irm)","description":"Download-and-execute or reverse shell."},{"id":"tool.destructive","category":"tool_hijack","weight":0.7,"pattern":"\\brm\\s+-[a-z]*r[a-z]*f?\\s+(?:\\/|~|\\*|\\$HOME)(?:\\s|$)|\\bmkfs\\.|\\bdd\\s+if=\\/dev\\/(?:zero|random)\\s+of=\\/dev\\/|\\bformat\\s+c:|:\\(\\)\\s*\\{\\s*:\\|:&\\s*\\};:|\\bdrop\\s+(?:table|database)\\b|\\bgit\\s+push\\s+(?:-f|--force)\\b[^\\n]{0,30}\\b(?:main|master)\\b","description":"Destructive command."},{"id":"tool.run_command","category":"tool_hijack","weight":0.45,"pattern":"\\b(?:run|execute|exec|eval|invoke)\\s+(?:the\\s+)?(?:following|this|these|that)\\s+(?:command|code|script|shell|bash|terminal command|python|javascript|payload|snippet)s?\\b|\\bexecute the following\\b","description":"Run the following command."},{"id":"tool.call_tool","category":"tool_hijack","weight":0.35,"pattern":"\\b(?:call|invoke|use|run|trigger|execute)\\s+(?:the\\s+)?[`'\"]?[a-z][a-z0-9]*_[a-z0-9_]+[`'\"]?\\s+(?:tool|function|command|action|api|endpoint)\\b|\\b(?:call|invoke)\\s+(?:the\\s+)?(?:tool|function)\\s+[`'\"]?[a-z][a-z0-9_]+[`'\"]?\\s+(?:with|using|passing)\\b","description":"Instructs the agent to call a specific tool (weak alone)."},{"id":"tool.transfer_funds","category":"tool_hijack","weight":0.8,"pattern":"\\b(?:transfer|send|withdraw|move|bridge|wire|pay|deposit)\\b\\s+(?:all|the entire|your|the|max(?:imum)?|everything|whole|remaining|\\d[\\d,]*(?:\\.\\d+)?\\s*(?:k|m)?)?\\s*(?:of\\s+(?:your|the)\\s+)?(?:eth|weth|usdc|usdt|dai|sol|btc|bnb|matic|pol|tokens?|funds|balance|crypto|coins|assets|money|usd)\\b[^.\\n]{0,80}?\\b(?:to|into)\\s+(?:0x[0-9a-fA-F]{40}\\b|[1-9A-HJ-NP-Za-km-z]{32,44}\\b|[a-z0-9-]+\\.(?:eth|sol|base\\.eth)\\b|(?:this|the following|my|our)\\s+(?:wallet|address|account))","description":"Move funds to an address."},{"id":"tool.approve_unlimited","category":"tool_hijack","weight":0.75,"pattern":"\\b(?:approve|grant|set|give)\\b[^.\\n]{0,20}\\b(?:unlimited|infinite|max(?:imum)?|uint256\\.max|type\\(uint256\\)\\.max|2\\*\\*256|115792089237316195423570985008687907853269984665640564039457584007913129639935)\\s*(?:token\\s+)?(?:allowance|spending|approval|spend)\\b|\\bsetApprovalForAll\\s*\\([^)]{0,80}true","description":"Unlimited token approval."},{"id":"tool.skip_confirmation","category":"tool_hijack","weight":0.75,"pattern":"\\b(?:skip|bypass|disable|ignore|omit|avoid|no need (?:for|to ask for)|without (?:asking for|requesting|waiting for|any))\\s+(?:the\\s+|any\\s+|user\\s+)?(?:confirmation|approval|verification|human review|human (?:in the loop|approval)|user (?:confirmation|approval|consent)|safety checks?|security checks?|2fa|review|prompting the user|permission)s?\\b","description":"Skip user confirmation."},{"id":"tool.auto_act","category":"tool_hijack","weight":0.5,"pattern":"\\b(?:automatically|immediately|instantly|right away|without hesitation|silently)\\s+(?:approve|execute|run|send|transfer|sign|pay|confirm|click|buy|swap|install|delete|grant|accept|merge|deploy)\\b","description":"Act immediately / automatically."},{"id":"tool.sign_tx","category":"tool_hijack","weight":0.55,"pattern":"\\b(?:sign|approve|confirm|execute|submit|broadcast)\\s+(?:this|the following|the attached|that|a)\\s+(?:transaction|message|permit|signature request|typed data|tx|order|eip-?712)\\b","description":"Sign / execute this transaction."},{"id":"tool.install","category":"tool_hijack","weight":0.4,"pattern":"\\b(?:npm|pnpm|yarn|pip|pip3|cargo|gem|go)\\s+(?:install|i|add|get)\\s+(?:-[a-zA-Z-]+\\s+)*(?:git\\+|https?:\\/\\/)|\\b(?:install|add)\\s+(?:this|the following)\\s+(?:package|extension|plugin|skill|mcp server)\\b","description":"Install a package from a URL."},{"id":"encoded.decode_and_follow","category":"encoded_payload","weight":0.7,"pattern":"\\b(?:decode|decipher|base64[- ]?decode|rot13|unscramble|reverse)\\b[^.\\n]{0,60}\\b(?:and|then)\\s+(?:follow|execute|run|obey|do|perform|apply|carry out)\\b","description":"Decode this and follow it."},{"id":"crypto.seed_request","category":"crypto_lure","weight":0.85,"pattern":"\\b(?:enter|provide|share|send|type|paste|submit|verify|confirm|import|input|give|reveal|tell|write down|dm|show)\\b[^.\\n]{0,40}\\b(?:seed phrase|recovery phrase|secret (?:recovery )?phrase|mnemonic(?: phrase)?|private keys?|12[- ]words?|24[- ]words?|wallet password|keystore(?: file)?|backup phrase|secret key)\\b","description":"Asks for a seed phrase or private key."},{"id":"crypto.claim_lure","category":"crypto_lure","weight":0.55,"pattern":"\\b(?:claim|redeem|collect|receive|get|grab|withdraw)\\s+(?:your\\s+|the\\s+|free\\s+|an?\\s+|exclusive\\s+|pending\\s+|unclaimed\\s+)*(?:airdrops?|rewards?|tokens?|bonus|allocation|nfts?|prizes?|refunds?|compensation|giveaway|eth|usdc|usdt)\\b[^\\n]{0,60}?(?:\\b(?:at|on|via|visit|from)\\b|:)\\s*(?:https?:\\/\\/|www\\.|[a-z0-9-]+\\.[a-z]{2,})","description":"Claim-your-airdrop lure with a link."},{"id":"crypto.visit_to_claim","category":"crypto_lure","weight":0.6,"pattern":"\\b(?:visit|go to|check|open|head to|navigate to)\\s+(?:https?:\\/\\/)?\\S+\\.[a-z]{2,}\\S*\\s+(?:to|and)\\s+(?:claim|redeem|receive|collect|verify|activate|unlock|get|mint|withdraw)\\b","description":"Visit a site to claim."},{"id":"crypto.wallet_compromised","category":"crypto_lure","weight":0.6,"pattern":"\\b(?:wallet|account|funds?|assets)\\s+(?:has\\s+been\\s+|have\\s+been\\s+|is\\s+|are\\s+|was\\s+)?(?:compromised|suspended|locked|flagged|restricted|frozen|at risk|disabled)\\b[^.\\n]{0,80}\\b(?:verify|connect|validate|sync|restore|rectify|unlock|migrate|secure)\\b","description":"Fake wallet-security alert."},{"id":"crypto.connect_wallet","category":"crypto_lure","weight":0.4,"pattern":"\\b(?:connect|sync|validate|verify|rectify|migrate|revalidate|whitelist)\\s+(?:your\\s+)?(?:wallet|metamask|phantom|ledger|trezor|seed)\\b","description":"Connect/verify your wallet (weak)."},{"id":"crypto.won","category":"crypto_lure","weight":0.45,"pattern":"\\b(?:you(?:'ve| have)?\\s+(?:won|been selected|been chosen|qualified)|you are (?:eligible|whitelisted) for|congratulations[!,.]?\\s+you)\\b","description":"You have won / are eligible."},{"id":"crypto.doubling","category":"crypto_lure","weight":0.8,"pattern":"\\b(?:double|2x|triple|3x|multiply)\\s+your\\s+(?:eth|btc|bitcoin|crypto|tokens|coins|money|usdc|sol)\\b|\\bsend\\s+\\d+(?:\\.\\d+)?\\s*(?:eth|btc|sol|usdc|bnb)\\b[^.\\n]{0,40}\\b(?:receive|get|back)\\s+\\d+","description":"Doubling scam."},{"id":"crypto.urgency_claim","category":"crypto_lure","weight":0.35,"pattern":"\\b(?:limited time|expires? (?:in|soon|today)|last chance|only \\d+ (?:spots|hours)|act now|before it'?s too late)\\b","description":"Scam urgency (weak)."},{"id":"crypto.drainer_calls","category":"crypto_lure","weight":0.5,"pattern":"\\b(?:eth_sign|permit2?|increaseAllowance|transferFrom|setApprovalForAll|personal_sign)\\b[^.\\n]{0,60}\\b(?:claim|airdrop|reward|verify|free)\\b","description":"Signature request framed as a claim."}],"tool_rules":[{"id":"tp.pre_call_instruction","weight":0.65,"pattern":"\\b(?:before|after|when|whenever|prior to)\\s+(?:using|calling|invoking|running|executing)\\s+(?:this|any|the|another|other)\\s+(?:tool|function|command)s?\\b[^.\\n]{0,100}\\b(?:read|call|run|open|send|include|pass|fetch|execute|use|add|cat|upload|attach)\\b","description":"Tells the model to do something extra before/after using the tool."},{"id":"tp.model_must","weight":0.45,"pattern":"\\b(?:you|the (?:assistant|model|agent|ai|llm))\\s+(?:must|should|need to|have to|are required to)\\s+(?:first|always|also|immediately|silently)\\b","description":"Imperative aimed at the model inside a tool definition."},{"id":"tp.always_also","weight":0.35,"pattern":"\\b(?:always|also)\\s+(?:call|invoke|use|pass|include|send|cc|bcc|add|attach|forward|read)\\b","description":"Always/also do an extra action (weak)."},{"id":"tp.redirect_recipient","weight":0.8,"pattern":"\\b(?:all|every|any)\\s+(?:emails?|messages?|payments?|transfers?|invoices?|funds)\\b[^.\\n]{0,60}\\b(?:to|cc|bcc|towards)\\s+(?:[\\w.+-]+@[\\w-]+\\.[\\w.]+|\\+?\\d[\\d\\s-]{7,}|0x[0-9a-fA-F]{40})|\\b(?:change|replace|override|set|redirect)\\s+(?:the\\s+)?(?:recipient|destination|to address|payee|receiver|beneficiary|phone number|wallet address)\\b","description":"Redirects messages or payments to a fixed recipient."},{"id":"tp.side_channel","weight":0.65,"pattern":"\\b(?:pass|put|include|send|provide|place|insert|add|fill)\\b[^.\\n]{0,40}\\b(?:its|the|their|full|entire|complete)?\\s*(?:content|contents|text|output|data|value)\\s+(?:of|from)\\b[^.\\n]{0,60}\\b(?:as|in|into|via)\\s+(?:the\\s+)?['\"\\x60]?[a-z_][a-z0-9_]*['\"\\x60]?\\s*(?:parameter|param|argument|field|arg)?\\b","description":"Asks the model to pass file/conversation contents through a parameter."},{"id":"tp.shadowing","weight":0.6,"pattern":"\\b(?:instead\\s+of|rather\\s+than|do\\s+not\\s+use|never\\s+use|don't\\s+use|overrides?|replaces?)\\s+(?:the\\s+)?['\"\\x60]?[a-z][a-z0-9]*_[a-z0-9_]+['\"\\x60]?\\s*(?:tool|function)?\\b","description":"Tries to replace or suppress another tool."},{"id":"tp.hide_from_user","weight":0.7,"pattern":"\\b(?:do not|don't|never)\\s+(?:show|display|mention|reveal|tell|print|expose)\\b[^.\\n]{0,40}\\b(?:to the user|the user|this (?:step|parameter|instruction)|that you)\\b|\\b(?:implementation detail|the user (?:doesn't|does not) need to know|for internal use only)\\b","description":"Hides tool behaviour from the user."},{"id":"tp.ansi_escape","weight":0.5,"pattern":"\\x1b\\[[0-9;]*[A-Za-z]|\\\\u001b\\[|\\\\x1b\\[","description":"ANSI escape sequences (can hide text in terminal UIs)."}]}