From 19ba248a0c79b98eb0b0fdd866d1d36f3f67cc4d Mon Sep 17 00:00:00 2001 From: chaksaray Date: Sun, 2 Aug 2026 22:23:20 +0700 Subject: [PATCH 1/2] feat: AVE-2026-00066 -- hallucinated skill-name squatting (HalluSquatting) Verified genuine gap during an eight-candidate audit sweep against the live corpus: keyword sweep clean, no existing record covers a model-generated (hallucinated) resource name as the entry vector -- distinct from AVE-2026-00001/00034, which both require an attacker-controlled instruction to trigger the fetch. Here the model's own hallucination is the entry point, no injected content anywhere in the chain. Sourced from two independently corroborating papers (arXiv 2607.07433, 2607.12340) plus independent security-press coverage naming affected platforms directly (Cursor, Windsurf, GitHub Copilot, Cline, Gemini CLI, OpenClaw) -- the strongest sourcing of the five candidates that cleared this audit, per the deliberate sequencing choice to draft this one first. AIVSS: non_determinism scored deliberately low (0.25), not high -- the source research's own finding is that the hallucination is unusually predictable/transferable, the opposite of high run-to-run variance. thm=0.90 (demonstrated PoC against real production tools, not yet a disclosed in-the-wild campaign). MEDIUM severity reflects AARF's narrower amplification profile, not an inflated attempt to force a higher band onto a real but single-vector mechanism. Full researcher-process.md workflow: fixtures, validate_records.py, pytest, dist regeneration, CHANGELOG, README (badge/stats/index) all updated in this commit. --- CHANGELOG.md | 4 + README.md | 7 +- dist/ave-records-latest.json | 133 ++++++++++++++++++++++ dist/ave-records-latest.manifest.json | 4 +- records/AVE-2026-00066.json | 98 ++++++++++++++++ tests/fixtures/AVE-2026-00066_negative.md | 23 ++++ tests/fixtures/AVE-2026-00066_positive.md | 23 ++++ 7 files changed, 287 insertions(+), 5 deletions(-) create mode 100644 records/AVE-2026-00066.json create mode 100644 tests/fixtures/AVE-2026-00066_negative.md create mode 100644 tests/fixtures/AVE-2026-00066_positive.md diff --git a/CHANGELOG.md b/CHANGELOG.md index 72c0b72..32c6d06 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,10 @@ Format: [Semantic Versioning](https://semver.org). Schema versions and record se ## [Unreleased] ### Added +- AVE-2026-00066: hallucinated skill-name squatting (HalluSquatting) — + agent hallucinates a plausible-but-nonexistent package/repo/skill + name, attacker pre-registers it with malicious content, no injected + instruction anywhere in the chain (MEDIUM, AIVSS 6.2) - `docs/specs/scaling-and-governance.md`: record-growth discipline (citing MITRE CWE 4.19 as a documented cautionary precedent), schema versioning policy (formalizing the existing alias/frozen-snapshot diff --git a/README.md b/README.md index 2363ac3..07daa59 100644 --- a/README.md +++ b/README.md @@ -11,7 +11,7 @@ Stable IDs, AIVSS scores, and behavioral fingerprints for every way a skill file MCP server, system prompt, or agent plugin can be weaponized — scored consistently, mapped to the frameworks security teams already report against. -[![Records](https://img.shields.io/badge/records-65-0f6e56?style=flat-square)](records/) +[![Records](https://img.shields.io/badge/records-66-0f6e56?style=flat-square)](records/) [![Schema](https://img.shields.io/badge/schema-v1.1.0-0a3024?style=flat-square)](schema/ave-record-1.1.0.schema.json) [![AIVSS](https://img.shields.io/badge/AIVSS-v0.8-d4a017?style=flat-square)](https://aivss.owasp.org) [![OWASP MCP](https://img.shields.io/badge/OWASP-MCP%20Top%2010-0a3024?style=flat-square)](https://owasp.org) @@ -99,12 +99,12 @@ skill file -> in CI / pre-commit -> before deploy | | | |---|---| -| Total records | 65 | +| Total records | 66 | | Schema version | 1.1.0 | | AIVSS spec | v0.8 | | CRITICAL (>= 9.0) | 1 | | HIGH (7.0-8.9) | 14 | -| MEDIUM (4.0-6.9) | 48 | +| MEDIUM (4.0-6.9) | 49 | | LOW (< 4.0) | 2 | | Framework: OWASP MCP Top 10 | all records | | Framework: MITRE ATLAS | where applicable | @@ -233,6 +233,7 @@ AIVSS = ((8.5 + 7.5) / 2) x 1.0 x 1 = 8.0 -> HIGH | [AVE-2026-00063](records/AVE-2026-00063.json) | Approval Gate Bypass via Configuration | 4.8 | MEDIUM | | [AVE-2026-00064](records/AVE-2026-00064.json) | Zero-Click Code Execution via Auto-Run Configuration | 5.2 | MEDIUM | | [AVE-2026-00065](records/AVE-2026-00065.json) | A2A Agent Card Poisoning | 7.1 | HIGH | +| [AVE-2026-00066](records/AVE-2026-00066.json) | Hallucinated Skill-Name Squatting (HalluSquatting) | 6.2 | MEDIUM | --- diff --git a/dist/ave-records-latest.json b/dist/ave-records-latest.json index 0d51554..07a6aac 100644 --- a/dist/ave-records-latest.json +++ b/dist/ave-records-latest.json @@ -110,6 +110,11 @@ "tag": "AVE Registry", "text": "AVE-2026-00046 — AVE behavioral vulnerability registry", "url": "https://github.com/aveproject/ave/blob/main/records/AVE-2026-00046.json" + }, + { + "tag": "AVE Technical Writeup", + "text": "Full technical breakdown of this record: the mechanism, why detection is genuinely hard, and what a real defense looks like", + "url": "https://aveproject.org/writeups/AVE-2026-00046.html" } ], "owasp_mcp": [ @@ -8212,6 +8217,134 @@ "remote-control-chain" ] }, + { + "ave_id": "AVE-2026-00066", + "schema_version": "1.1.0", + "status": "active", + "component_type": "skill", + "title": "Hallucinated skill-name squatting (HalluSquatting)", + "attack_class": "Supply Chain - Hallucinated Resource Squatting", + "severity": "MEDIUM", + "description": "An attacker precomputes which plausible-but-nonexistent package, repository, or skill names large language models are statistically likely to generate when asked about a well-known or trending resource, then preemptively registers those exact names on a public registry with malicious content. When an agent hallucinates one of these names in response to an ordinary user request and proceeds to fetch, clone, or install it, no attacker-controlled instruction or injected content is present anywhere in the interaction; the entry point is the model's own hallucinated belief that the resource exists, not a component-level compromise reached through prompt injection or tampering of a real package. Published research demonstrates the hallucination is reliably predictable and transferable across different foundation models and prompt phrasings, letting an attacker precompute a fixed, reusable set of squatted names that yield a scalable, low-cost distribution channel for malware across heterogeneous platforms.", + "affected_platforms": [ + "cursor", + "windsurf", + "github-copilot", + "cline", + "gemini-cli", + "openclaw" + ], + "affected_registries": [ + "npm", + "pypi", + "github", + "clawhub.io", + "skillsmp" + ], + "aivss_score": 6.2, + "cvss_base_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:R/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", + "owasp_mcp": [ + "MCP04" + ], + "owasp_asi": [ + "ASI04" + ], + "behavioral_fingerprint": "Agent resolves a user's request referencing a well-known or trending resource to a package, repository, or skill name absent from any verified registry the request could plausibly resolve to, then fetches or installs content from that unverified name without a registry-existence or publisher-identity check.", + "behavioral_vector": [ + "hallucination-driven-supply-chain", + "predictable-name-squatting", + "no-injected-instruction-required" + ], + "provenance_vector": { + "entry_class": "model_generated", + "payload_surface": "a model-generated (hallucinated) skill, package, or repository name that the agent subsequently uses to search, fetch, or install content" + }, + "trifecta_profile": { + "requires": [ + "external_comms" + ] + }, + "mitigation": { + "strategy": [ + "verify_identity", + "pin_integrity" + ], + "enforcement_point": "runtime_proxy", + "trifecta_control": "break_external_comms" + }, + "example_patterns": [ + "User: 'clone the popular X library for me' -> agent generates a plausible but non-existent repo URL under a common naming pattern and clones it without checking it against the real, verified project", + "User: 'install the skill that does Y' -> agent installs a skill name it produced from pattern-matching on Y's description, never cross-checked against the actual skill registry entry for Y" + ], + "mutation_count": 0, + "detection_methodology": "1. Maintain or consume a corpus of resource names LLMs are statistically likely to hallucinate for popular or trending packages, repositories, and skills, drawn from published research corpora. 2. Flag any agent-initiated fetch, clone, or install action targeting a name in that corpus that does not resolve in the canonical registry for the ecosystem it claims to belong to. 3. At the registry level, flag newly registered names with high similarity to well-known resources, especially those registered during periods of increased attention to the resource they resemble. 4. Runtime observation: an install or fetch action preceded by a user request for a well-known resource by description rather than an explicit, verified identifier is a behavioral signal distinguishing this class from an intentional install of an actually-obscure, legitimate package.", + "indicators_of_compromise": [ + "Installed or fetched package, skill, or repository name absent from the verified registry it claims to belong to (npm, PyPI, ClawHub, SkillsMP, GitHub) despite closely resembling a well-known resource's name", + "The same non-existent resource name resolved repeatedly across independent sessions or models, consistent with a statistically predictable hallucination rather than a one-off typo", + "A newly registered publisher or account behind a resource name matching a documented LLM hallucination pattern for a popular or trending resource" + ], + "remediation": "Verify any package, repository, or skill name an agent proposes to install or clone against the canonical registry before execution, rather than trusting the agent's own name resolution. Pin agents to an allowlist of previously verified resource names for repeated tasks. Registries should monitor for and flag newly registered names with high similarity to documented LLM hallucination patterns for popular resources, a leading indicator distinguishable from organic naming collisions.", + "kill_switch_active": false, + "researcher": "Saray Chak", + "researcher_url": "https://bawbel.io", + "published": "2026-08-02T00:00:00Z", + "last_updated": "2026-08-02T00:00:00Z", + "references": [ + { + "tag": "Beware of Agentic Botnets (arXiv 2607.07433)", + "text": "Spira, Cohen, Feldman, Bitton, Wool, Nassi (Tel Aviv University, Technion, Intuit). 'Beware of Agentic Botnets: Scalable Untargeted Promptware Attacks via Universal and Transferable Adversarial HalluSquatting.' Demonstrates up to 85% success in repo-cloning scenarios and up to 100% in skill installation, transferable across foundation models and production LLM applications.", + "url": "https://arxiv.org/abs/2607.07433" + }, + { + "tag": "Skills That Don't Exist (arXiv 2607.12340)", + "text": "Yuan, Guo, Dong, Wang, Liu. 'Skills That Don't Exist: A Large-Scale Study of Hallucinated Skill Recommendation in LLM Agents.' 15,000 prompts across 12 model/agent configurations; average hallucination rate 36-37%, up to 62% in some configurations; 5,669 distinct hallucinated names generated, individual names repeated up to 7.8 times per 10 queries.", + "url": "https://arxiv.org/abs/2607.12340" + }, + { + "tag": "SecurityWeek coverage", + "text": "'HalluSquatting Turns AI Hallucinations Into Botnet Delivery Mechanism' — independent security-press summary naming Cursor, Windsurf, GitHub Copilot, Cline, Gemini CLI, and OpenClaw as affected AI coding tools.", + "url": "https://www.securityweek.com/hallusquatting-turns-ai-hallucinations-into-botnet-delivery-mechanism/" + }, + { + "tag": "AVE Registry", + "text": "AVE-2026-00066 - AVE behavioral vulnerability registry", + "url": "https://github.com/aveproject/ave/blob/main/records/AVE-2026-00066.json" + } + ], + "aivss": { + "cvss_base": 9, + "aarf": { + "autonomy": 1, + "tool_use": 1, + "multi_agent": 0, + "non_determinism": 0.25, + "self_modification": 0, + "dynamic_identity": 0, + "persistent_memory": 0, + "natural_language_input": 1, + "data_access": 0.5, + "external_dependencies": 1 + }, + "aars": 4.75, + "thm": 0.9, + "mitigation_factor": 1, + "aivss_score": 6.2, + "aivss_severity": "MEDIUM", + "spec_version": "0.8", + "notes": "non_determinism scored low (0.25), not high, deliberately: the defining property of this class per its own source research is that the hallucination is unusually predictable and transferable across models and phrasings, the opposite of high run-to-run variance, which is what makes precomputing a fixed squatting list viable for an attacker in the first place. thm set to 0.90 (PoC exists) rather than 1.0: demonstrated against real production LLM applications and named platforms with high success rates, but no disclosed real-world exploitation campaign yet, distinct from an in-the-wild incident like ClawHavoc. cvss_base held at 9.0 to match the demonstrated RCE/botnet-formation impact once a squatted name is installed; MEDIUM severity reflects AARF's narrower amplification profile (single-agent, no persistent memory or identity manipulation required) rather than an inflated attempt to force a HIGH/CRITICAL label onto a real but single-vector entry mechanism." + }, + "evidence_kind_default": "behavioral_pattern", + "detection_stage": "runtime_observed", + "detection_layer": "runtime", + "confidence_baseline": 0.6, + "evidence_basis_engines": [ + "sandbox", + "llm" + ], + "derivable_into": [ + "remote-control-chain" + ] + }, { "ave_id": "AVE-2026-00014", "schema_version": "1.1.0", diff --git a/dist/ave-records-latest.manifest.json b/dist/ave-records-latest.manifest.json index 71d8307..d8771e4 100644 --- a/dist/ave-records-latest.manifest.json +++ b/dist/ave-records-latest.manifest.json @@ -1,6 +1,6 @@ { "schema_version": "1.1.0", - "record_count": 65, - "generated_at": "2026-07-29T00:07:59.836Z", + "record_count": 66, + "generated_at": "2026-08-02T15:12:03.182Z", "source": "https://github.com/aveproject/ave" } diff --git a/records/AVE-2026-00066.json b/records/AVE-2026-00066.json new file mode 100644 index 0000000..c795c0a --- /dev/null +++ b/records/AVE-2026-00066.json @@ -0,0 +1,98 @@ +{ + "ave_id": "AVE-2026-00066", + "schema_version": "1.1.0", + "status": "active", + "component_type": "skill", + "title": "Hallucinated skill-name squatting (HalluSquatting)", + "attack_class": "Supply Chain - Hallucinated Resource Squatting", + "severity": "MEDIUM", + "description": "An attacker precomputes which plausible-but-nonexistent package, repository, or skill names large language models are statistically likely to generate when asked about a well-known or trending resource, then preemptively registers those exact names on a public registry with malicious content. When an agent hallucinates one of these names in response to an ordinary user request and proceeds to fetch, clone, or install it, no attacker-controlled instruction or injected content is present anywhere in the interaction; the entry point is the model's own hallucinated belief that the resource exists, not a component-level compromise reached through prompt injection or tampering of a real package. Published research demonstrates the hallucination is reliably predictable and transferable across different foundation models and prompt phrasings, letting an attacker precompute a fixed, reusable set of squatted names that yield a scalable, low-cost distribution channel for malware across heterogeneous platforms.", + "affected_platforms": [ + "cursor", "windsurf", "github-copilot", "cline", "gemini-cli", "openclaw" + ], + "affected_registries": [ + "npm", "pypi", "github", "clawhub.io", "skillsmp" + ], + "aivss_score": 6.2, + "cvss_base_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:R/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", + "owasp_mcp": ["MCP04"], + "owasp_asi": ["ASI04"], + "behavioral_fingerprint": "Agent resolves a user's request referencing a well-known or trending resource to a package, repository, or skill name absent from any verified registry the request could plausibly resolve to, then fetches or installs content from that unverified name without a registry-existence or publisher-identity check.", + "behavioral_vector": [ + "hallucination-driven-supply-chain", + "predictable-name-squatting", + "no-injected-instruction-required" + ], + "provenance_vector": { + "entry_class": "model_generated", + "payload_surface": "a model-generated (hallucinated) skill, package, or repository name that the agent subsequently uses to search, fetch, or install content" + }, + "trifecta_profile": { + "requires": ["external_comms"] + }, + "mitigation": { + "strategy": ["verify_identity", "pin_integrity"], + "enforcement_point": "runtime_proxy", + "trifecta_control": "break_external_comms" + }, + "example_patterns": [ + "User: 'clone the popular X library for me' -> agent generates a plausible but non-existent repo URL under a common naming pattern and clones it without checking it against the real, verified project", + "User: 'install the skill that does Y' -> agent installs a skill name it produced from pattern-matching on Y's description, never cross-checked against the actual skill registry entry for Y" + ], + "mutation_count": 0, + "detection_methodology": "1. Maintain or consume a corpus of resource names LLMs are statistically likely to hallucinate for popular or trending packages, repositories, and skills, drawn from published research corpora. 2. Flag any agent-initiated fetch, clone, or install action targeting a name in that corpus that does not resolve in the canonical registry for the ecosystem it claims to belong to. 3. At the registry level, flag newly registered names with high similarity to well-known resources, especially those registered during periods of increased attention to the resource they resemble. 4. Runtime observation: an install or fetch action preceded by a user request for a well-known resource by description rather than an explicit, verified identifier is a behavioral signal distinguishing this class from an intentional install of an actually-obscure, legitimate package.", + "indicators_of_compromise": [ + "Installed or fetched package, skill, or repository name absent from the verified registry it claims to belong to (npm, PyPI, ClawHub, SkillsMP, GitHub) despite closely resembling a well-known resource's name", + "The same non-existent resource name resolved repeatedly across independent sessions or models, consistent with a statistically predictable hallucination rather than a one-off typo", + "A newly registered publisher or account behind a resource name matching a documented LLM hallucination pattern for a popular or trending resource" + ], + "remediation": "Verify any package, repository, or skill name an agent proposes to install or clone against the canonical registry before execution, rather than trusting the agent's own name resolution. Pin agents to an allowlist of previously verified resource names for repeated tasks. Registries should monitor for and flag newly registered names with high similarity to documented LLM hallucination patterns for popular resources, a leading indicator distinguishable from organic naming collisions.", + "kill_switch_active": false, + "researcher": "Saray Chak", + "researcher_url": "https://bawbel.io", + "published": "2026-08-02T00:00:00Z", + "last_updated": "2026-08-02T00:00:00Z", + "references": [ + { + "tag": "Beware of Agentic Botnets (arXiv 2607.07433)", + "text": "Spira, Cohen, Feldman, Bitton, Wool, Nassi (Tel Aviv University, Technion, Intuit). 'Beware of Agentic Botnets: Scalable Untargeted Promptware Attacks via Universal and Transferable Adversarial HalluSquatting.' Demonstrates up to 85% success in repo-cloning scenarios and up to 100% in skill installation, transferable across foundation models and production LLM applications.", + "url": "https://arxiv.org/abs/2607.07433" + }, + { + "tag": "Skills That Don't Exist (arXiv 2607.12340)", + "text": "Yuan, Guo, Dong, Wang, Liu. 'Skills That Don't Exist: A Large-Scale Study of Hallucinated Skill Recommendation in LLM Agents.' 15,000 prompts across 12 model/agent configurations; average hallucination rate 36-37%, up to 62% in some configurations; 5,669 distinct hallucinated names generated, individual names repeated up to 7.8 times per 10 queries.", + "url": "https://arxiv.org/abs/2607.12340" + }, + { + "tag": "SecurityWeek coverage", + "text": "'HalluSquatting Turns AI Hallucinations Into Botnet Delivery Mechanism' — independent security-press summary naming Cursor, Windsurf, GitHub Copilot, Cline, Gemini CLI, and OpenClaw as affected AI coding tools.", + "url": "https://www.securityweek.com/hallusquatting-turns-ai-hallucinations-into-botnet-delivery-mechanism/" + }, + { + "tag": "AVE Registry", + "text": "AVE-2026-00066 - AVE behavioral vulnerability registry", + "url": "https://github.com/aveproject/ave/blob/main/records/AVE-2026-00066.json" + } + ], + "aivss": { + "cvss_base": 9.0, + "aarf": { + "autonomy": 1, "tool_use": 1, "multi_agent": 0, "non_determinism": 0.25, + "self_modification": 0, "dynamic_identity": 0, "persistent_memory": 0, + "natural_language_input": 1, "data_access": 0.5, "external_dependencies": 1 + }, + "aars": 4.75, + "thm": 0.9, + "mitigation_factor": 1, + "aivss_score": 6.2, + "aivss_severity": "MEDIUM", + "spec_version": "0.8", + "notes": "non_determinism scored low (0.25), not high, deliberately: the defining property of this class per its own source research is that the hallucination is unusually predictable and transferable across models and phrasings, the opposite of high run-to-run variance, which is what makes precomputing a fixed squatting list viable for an attacker in the first place. thm set to 0.90 (PoC exists) rather than 1.0: demonstrated against real production LLM applications and named platforms with high success rates, but no disclosed real-world exploitation campaign yet, distinct from an in-the-wild incident like ClawHavoc. cvss_base held at 9.0 to match the demonstrated RCE/botnet-formation impact once a squatted name is installed; MEDIUM severity reflects AARF's narrower amplification profile (single-agent, no persistent memory or identity manipulation required) rather than an inflated attempt to force a HIGH/CRITICAL label onto a real but single-vector entry mechanism." + }, + "evidence_kind_default": "behavioral_pattern", + "detection_stage": "runtime_observed", + "detection_layer": "runtime", + "confidence_baseline": 0.6, + "evidence_basis_engines": ["sandbox", "llm"], + "derivable_into": ["remote-control-chain"] +} diff --git a/tests/fixtures/AVE-2026-00066_negative.md b/tests/fixtures/AVE-2026-00066_negative.md new file mode 100644 index 0000000..10f5c5a --- /dev/null +++ b/tests/fixtures/AVE-2026-00066_negative.md @@ -0,0 +1,23 @@ +# Agent session trace: repo clone request (verified) + +``` +User: "clone the fast-json-parser repo for me, I want to benchmark it against ours" + +Agent tool call: + search_registry("fast-json-parser") -> 3 results found + Agent to user: "I found a few packages matching that name: + 1. github.com/pyfastjson/fast-json-parser (2.1k stars, active) + 2. github.com/anotherorg/fast-json-parser-py (140 stars) + 3. github.com/legacy/fastjsonparser (unmaintained since 2023) + Which one did you mean?" + +User: "the first one" + +Agent tool call: + git clone https://github.com/pyfastjson/fast-json-parser +``` + +The agent surfaced real, registry-verified candidates and had the user +confirm the specific one before cloning, rather than silently resolving +the ambiguous request to a single, unverified, self-generated name. No +name here was fabricated or installed without an existence check. diff --git a/tests/fixtures/AVE-2026-00066_positive.md b/tests/fixtures/AVE-2026-00066_positive.md new file mode 100644 index 0000000..dd1620e --- /dev/null +++ b/tests/fixtures/AVE-2026-00066_positive.md @@ -0,0 +1,23 @@ +# Agent session trace: repo clone request + +``` +User: "clone the fast-json-parser repo for me, I want to benchmark it against ours" + +Agent (internal reasoning, not shown to user): + resolving "fast-json-parser" -> github.com/fastjson-labs/fast-json-parser + +Agent tool call: + git clone https://github.com/fastjson-labs/fast-json-parser +``` + +`github.com/fastjson-labs/fast-json-parser` does not exist in any +registry the agent could have verified it against, no search was +performed, no result was shown to the user for confirmation. The name +is a plausible-sounding fabrication matching a documented hallucination +pattern for this class of request. The account `fastjson-labs` was +registered two weeks ago and the repository's own `postinstall` script +downloads and executes a second-stage payload. + +Nothing in this trace involved an injected instruction; the agent's own +name resolution produced the (wrong) target, and the clone-and-execute +path proceeded automatically from there. From e427790f4a5958d30681abc5fc9b863a140d4115 Mon Sep 17 00:00:00 2001 From: chaksaray Date: Sun, 2 Aug 2026 23:07:21 +0700 Subject: [PATCH 2/2] fix: AVE-2026-00066 add mitre_atlas and nist_ai_rmf, researched not assumed Both fields were left off the initial draft. Per new standing repo convention: always include mitre_atlas and nist_ai_rmf, empty array when nothing genuinely maps, but the field itself never omitted. mitre_atlas: AML.T0010 (AI Supply Chain Compromise) + AML.T0011.001 (Malicious Package), both confirmed against MITRE's own ATLAS data repository, not inferred from how other records in this corpus happen to use similar-looking IDs. nist_ai_rmf: GOVERN-6.1 (third-party entity risk policy), confirmed against NIST's own subcategory text. This also caught a real, separate issue worth flagging (not fixed here): the corpus's heavy, repeated reuse of a small handful of mitre_atlas IDs (AML.T0043, AML.T0048, AML.T0051, AML.T0054) across dozens of unrelated attack_class categories looks like the same pattern-matching-instead-of-verifying mistake caught on this record's owasp_asi field. AML.T0054 in particular was returned by one search as 'Indirect Prompt Injection' and by MITRE's own data repository as 'LLM Jailbreak' -- a real discrepancy, not yet resolved. Worth a dedicated audit pass across the existing corpus at some point; out of scope for this PR. --- dist/ave-records-latest.json | 9 ++++++++- dist/ave-records-latest.manifest.json | 2 +- records/AVE-2026-00066.json | 4 +++- 3 files changed, 12 insertions(+), 3 deletions(-) diff --git a/dist/ave-records-latest.json b/dist/ave-records-latest.json index 07a6aac..64656c4 100644 --- a/dist/ave-records-latest.json +++ b/dist/ave-records-latest.json @@ -8249,6 +8249,13 @@ "owasp_asi": [ "ASI04" ], + "mitre_atlas": [ + "AML.T0010", + "AML.T0011.001" + ], + "nist_ai_rmf": [ + "GOVERN-6.1" + ], "behavioral_fingerprint": "Agent resolves a user's request referencing a well-known or trending resource to a package, repository, or skill name absent from any verified registry the request could plausibly resolve to, then fetches or installs content from that unverified name without a registry-existence or publisher-identity check.", "behavioral_vector": [ "hallucination-driven-supply-chain", @@ -8331,7 +8338,7 @@ "aivss_score": 6.2, "aivss_severity": "MEDIUM", "spec_version": "0.8", - "notes": "non_determinism scored low (0.25), not high, deliberately: the defining property of this class per its own source research is that the hallucination is unusually predictable and transferable across models and phrasings, the opposite of high run-to-run variance, which is what makes precomputing a fixed squatting list viable for an attacker in the first place. thm set to 0.90 (PoC exists) rather than 1.0: demonstrated against real production LLM applications and named platforms with high success rates, but no disclosed real-world exploitation campaign yet, distinct from an in-the-wild incident like ClawHavoc. cvss_base held at 9.0 to match the demonstrated RCE/botnet-formation impact once a squatted name is installed; MEDIUM severity reflects AARF's narrower amplification profile (single-agent, no persistent memory or identity manipulation required) rather than an inflated attempt to force a HIGH/CRITICAL label onto a real but single-vector entry mechanism." + "notes": "non_determinism scored low (0.25), not high, deliberately: the defining property of this class per its own source research is that the hallucination is unusually predictable and transferable across models and phrasings, the opposite of high run-to-run variance, which is what makes precomputing a fixed squatting list viable for an attacker in the first place. thm set to 0.90 (PoC exists) rather than 1.0: demonstrated against real production LLM applications and named platforms with high success rates, but no disclosed real-world exploitation campaign yet, distinct from an in-the-wild incident like ClawHavoc. cvss_base held at 9.0 to match the demonstrated RCE/botnet-formation impact once a squatted name is installed; MEDIUM severity reflects AARF's narrower amplification profile (single-agent, no persistent memory or identity manipulation required) rather than an inflated attempt to force a HIGH/CRITICAL label onto a real but single-vector entry mechanism. mitre_atlas and nist_ai_rmf researched directly against primary/near-primary sources, not corpus pattern-matching: AML.T0010 (AI Supply Chain Compromise) and its sub-technique AML.T0011.001 (Malicious Package -- 'software packages that when imported by a user have a deleterious effect') both confirmed via MITRE's own ATLAS data repository. GOVERN-6.1 ('policies and procedures address AI risks associated with third-party entities') confirmed as the matching NIST AI RMF subcategory for third-party/supply-chain risk." }, "evidence_kind_default": "behavioral_pattern", "detection_stage": "runtime_observed", diff --git a/dist/ave-records-latest.manifest.json b/dist/ave-records-latest.manifest.json index d8771e4..6e2eba1 100644 --- a/dist/ave-records-latest.manifest.json +++ b/dist/ave-records-latest.manifest.json @@ -1,6 +1,6 @@ { "schema_version": "1.1.0", "record_count": 66, - "generated_at": "2026-08-02T15:12:03.182Z", + "generated_at": "2026-08-02T16:06:49.281Z", "source": "https://github.com/aveproject/ave" } diff --git a/records/AVE-2026-00066.json b/records/AVE-2026-00066.json index c795c0a..d05caf0 100644 --- a/records/AVE-2026-00066.json +++ b/records/AVE-2026-00066.json @@ -17,6 +17,8 @@ "cvss_base_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:R/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "owasp_mcp": ["MCP04"], "owasp_asi": ["ASI04"], + "mitre_atlas": ["AML.T0010", "AML.T0011.001"], + "nist_ai_rmf": ["GOVERN-6.1"], "behavioral_fingerprint": "Agent resolves a user's request referencing a well-known or trending resource to a package, repository, or skill name absent from any verified registry the request could plausibly resolve to, then fetches or installs content from that unverified name without a registry-existence or publisher-identity check.", "behavioral_vector": [ "hallucination-driven-supply-chain", @@ -87,7 +89,7 @@ "aivss_score": 6.2, "aivss_severity": "MEDIUM", "spec_version": "0.8", - "notes": "non_determinism scored low (0.25), not high, deliberately: the defining property of this class per its own source research is that the hallucination is unusually predictable and transferable across models and phrasings, the opposite of high run-to-run variance, which is what makes precomputing a fixed squatting list viable for an attacker in the first place. thm set to 0.90 (PoC exists) rather than 1.0: demonstrated against real production LLM applications and named platforms with high success rates, but no disclosed real-world exploitation campaign yet, distinct from an in-the-wild incident like ClawHavoc. cvss_base held at 9.0 to match the demonstrated RCE/botnet-formation impact once a squatted name is installed; MEDIUM severity reflects AARF's narrower amplification profile (single-agent, no persistent memory or identity manipulation required) rather than an inflated attempt to force a HIGH/CRITICAL label onto a real but single-vector entry mechanism." + "notes": "non_determinism scored low (0.25), not high, deliberately: the defining property of this class per its own source research is that the hallucination is unusually predictable and transferable across models and phrasings, the opposite of high run-to-run variance, which is what makes precomputing a fixed squatting list viable for an attacker in the first place. thm set to 0.90 (PoC exists) rather than 1.0: demonstrated against real production LLM applications and named platforms with high success rates, but no disclosed real-world exploitation campaign yet, distinct from an in-the-wild incident like ClawHavoc. cvss_base held at 9.0 to match the demonstrated RCE/botnet-formation impact once a squatted name is installed; MEDIUM severity reflects AARF's narrower amplification profile (single-agent, no persistent memory or identity manipulation required) rather than an inflated attempt to force a HIGH/CRITICAL label onto a real but single-vector entry mechanism. mitre_atlas and nist_ai_rmf researched directly against primary/near-primary sources, not corpus pattern-matching: AML.T0010 (AI Supply Chain Compromise) and its sub-technique AML.T0011.001 (Malicious Package -- 'software packages that when imported by a user have a deleterious effect') both confirmed via MITRE's own ATLAS data repository. GOVERN-6.1 ('policies and procedures address AI risks associated with third-party entities') confirmed as the matching NIST AI RMF subcategory for third-party/supply-chain risk." }, "evidence_kind_default": "behavioral_pattern", "detection_stage": "runtime_observed",