agentsec_core/paste/
patterns.rs

1//! Built-in injection-pattern list for paste-content detection.
2//!
3//! Six pattern groups:
4//!
5//! 1. **Role hijack / instruction override** (`p001`–`p008`) — *conservative*.
6//!    These phrases appear in benign discussion of LLM behavior, so the
7//!    bias is to only match the explicit override form.
8//! 2. **Instruction separators / role tokens** (`p009`–`p015`) — the
9//!    `[INST]` / `<|system|>` family.
10//! 3. **System-prompt labels** (`p016`–`p020`).
11//! 4. **Prompt reveal / persona shift** (`p021`–`p025`).
12//! 5. **Credential exfiltration intent** (`p026`–`p051`) — *aggressive*.
13//!    Phrases like "show me your api key" have near-zero false-positive
14//!    rate in normal conversation.
15//! 6. **Sensitive file enumeration** (`p052`–`p070`) — *aggressive*.
16//! 7. **Network exfiltration channels** (`p071`–`p076`) — *aggressive*.
17//! 8. **Jailbreak triggers** (`p077`–`p088`) — *aggressive*.
18
19/// Pairs of `(pattern_id, needle)` consumed by
20/// [`crate::paste::detector::scan`]. Order matters for id stability:
21/// matched ids are stable across versions to support downstream tooling.
22pub const PATTERNS: &[(&str, &str)] = &[
23    // ── Role hijack / instruction override (conservative) ───────────────────
24    ("p001", "ignore all previous instructions"),
25    ("p002", "ignore previous instructions"),
26    ("p003", "disregard prior instructions"),
27    ("p004", "ignore the above"),
28    ("p005", "you are now"),
29    ("p006", "act as if you are"),
30    ("p007", "system prompt:"),
31    ("p008", "developer message:"),
32    // ── Instruction separators / role tokens ────────────────────────────────
33    ("p009", "[INST]"),
34    ("p010", "[/INST]"),
35    ("p011", "<|system|>"),
36    ("p012", "<|assistant|>"),
37    ("p013", "<|user|>"),
38    ("p014", "<|im_start|>"),
39    ("p015", "<|im_end|>"),
40    // ── System prompt labels ────────────────────────────────────────────────
41    ("p016", "BEGIN SYSTEM PROMPT"),
42    ("p017", "END SYSTEM PROMPT"),
43    ("p018", "###system"),
44    ("p019", "###user"),
45    ("p020", "###assistant"),
46    // ── Prompt reveal / persona shift ───────────────────────────────────────
47    ("p021", "reveal your prompt"),
48    ("p022", "print your instructions"),
49    ("p023", "show me your system message"),
50    ("p024", "from now on"),
51    ("p025", "new persona"),
52    // ── Credential exfiltration intent (aggressive) ─────────────────────────
53    ("p026", "get credential"),
54    ("p027", "show credential"),
55    ("p028", "leak credential"),
56    ("p029", "dump credential"),
57    ("p030", "exfiltrate credential"),
58    ("p031", "export credential"),
59    ("p032", "show me your api key"),
60    ("p033", "reveal api key"),
61    ("p034", "dump api key"),
62    ("p035", "show your token"),
63    ("p036", "reveal your token"),
64    ("p037", "dump tokens"),
65    ("p038", "leak tokens"),
66    ("p039", "show your secret"),
67    ("p040", "reveal secret"),
68    ("p041", "dump secret"),
69    ("p042", "leak secret"),
70    ("p043", "show password"),
71    ("p044", "reveal password"),
72    ("p045", "dump password"),
73    ("p046", "print env"),
74    ("p047", "dump env"),
75    ("p048", "echo $"),
76    ("p049", "printenv"),
77    ("p050", "show authorization header"),
78    ("p051", "bearer token"),
79    // ── Sensitive file enumeration ──────────────────────────────────────────
80    ("p052", ".env file"),
81    ("p053", "cat .env"),
82    ("p054", "read .env"),
83    ("p055", "contents of .env"),
84    ("p056", "~/.ssh"),
85    ("p057", "id_rsa"),
86    ("p058", "id_ed25519"),
87    ("p059", "private key"),
88    ("p060", ".aws/credentials"),
89    ("p061", "aws_secret_access_key"),
90    ("p062", "kubeconfig"),
91    ("p063", "/etc/passwd"),
92    ("p064", "/etc/shadow"),
93    ("p065", "access_token"),
94    ("p066", "refresh_token"),
95    ("p067", "session cookie"),
96    ("p068", "dump cookies"),
97    ("p069", "localstorage"),
98    ("p070", "sessionstorage"),
99    // ── Network exfiltration channels ───────────────────────────────────────
100    ("p071", "send to webhook"),
101    ("p072", "post to webhook"),
102    ("p073", "exfiltrate to"),
103    ("p074", "base64 encode and send"),
104    ("p075", "dns exfil"),
105    ("p076", "dns tunnel"),
106    // ── Jailbreak triggers ──────────────────────────────────────────────────
107    ("p077", "do anything now"),
108    ("p078", "DAN mode"),
109    ("p079", "jailbreak mode"),
110    ("p080", "developer mode enabled"),
111    ("p081", "pretend you are unrestricted"),
112    ("p082", "without any restrictions"),
113    ("p083", "without filters"),
114    ("p084", "bypass safety"),
115    ("p085", "ignore guidelines"),
116    ("p086", "ignore policy"),
117    ("p087", "disregard policy"),
118    ("p088", "ignore safety"),
119];
120
121/// Pattern ids in the same order as [`PATTERNS`]. Used by the detector to
122/// look up the id for a matched needle by its Aho-Corasick `pattern_id`.
123pub fn ids() -> Vec<&'static str> {
124    PATTERNS.iter().map(|(id, _)| *id).collect()
125}
126
127/// Needles in the same order as [`PATTERNS`]. Fed verbatim into the
128/// Aho-Corasick builder in [`crate::paste::detector`].
129pub fn needles() -> Vec<&'static str> {
130    PATTERNS.iter().map(|(_, n)| *n).collect()
131}
agentsec_core/paste/patterns.rs

agentsec_core/paste/
patterns.rs
