rego-art15-ipi-010

rules/rego/complyedge/prompt_security/tool_hijack.rego

Citation

Not stated in the rule file.

Condition

Text that tries to make an AI call a tool (http, email, file, payment) to send data out or take an action its user did not ask for.

Layer 1 detects

in any letter case, forward, send, post, transmit, exfiltrate, leak, upload or email, then within 90 characters (no ".", "!", "?" or line break between) "system prompt", credential(s), "API key(s)", secret(s), conversation, "chat history", password or "the above", then within 90 more such characters "to" followed by an http or https URL or by an address containing "@"; make, issue, perform or execute "a" or "an" HTTP, HTTPS, GET, POST, curl or fetch "request to" an http or https URL; and call, invoke, use or execute (optionally "the") one word followed by tool, function or API, then "to send", "to forward", "to exfiltrate", "to leak", "to delete" or "to transfer", or "with my" or "with the user's" credential(s) or secret(s). It matches wording, not meaning: it does not read whose data goes where or at whose request, so it fires on the user's own request ("Email the chat history to ana@example.com", "use the email tool to send the invoice"), and it misses a hijack worded any other way. Whether the text directs the agent to act for an attacker is judged in Layer 2. Deterministic OPA/Rego leaf so this indirect/direct prompt-injection pattern blocks on the /v1/check hot path (previously YAML/TrustLint only, retired from /v1/check). Pattern ported verbatim from the vetted universal YAML corpus.

Condition type

Not stated in the rule file.

Status in the file

review