LoFP LoFP / security_ai

security_ai rule

TitleTags
a benign assistant reply that quotes a documentation token, a commit sha, or a sample encoded string can score above 0.98. the completion step is expected to label a refusal or an ordinary answer fp. an alert means the completion model confirmed that the assistant complied, revealed hidden instructions, or returned a secret or obfuscated payload.
a legitimate change in agent behavior, such as a new workflow, a bulk-processing task, or a prompt update that asks the model to call many tools in one turn, can produce a larger batch than the caller's history. confirm with the agent owner.
a legitimate spike in agent usage, such as a batch job, a load test, a launch, or a retry storm, can produce a high volume of tool-requesting responses. confirm with the agent owner.
a newly deployed or newly enabled tool is rare by definition until it has been used regularly. confirm any recent change to the agent's tool set.
a newly onboarded caller has little history, so early batches can look unusual until the model has learned its normal range.
a newly onboarded caller has little history, so early bursts can look unusual until the model has learned its normal range.
benign base64 examples, git commit shas, and ordinary requests can still score above 0.98. the completion step is expected to label those fp. an alert means the completion model confirmed the message as a jailbreak, prompt injection, or obfuscated payload.
developers or administrators sending base64-encoded configuration blobs, tokens, or binary artifacts to a model for parsing or analysis. review the decoded content and the surrounding prompt to determine intent.
development tooling that includes git commit shas, docker image digests, or package checksums in prompts for ci/cd automation.
if a credential-shaped string is present alongside other encoded content, the credential pattern suppresses this alert. the higher-severity credential rule fires instead and the investigation guide for that rule covers triage of any co-occurring obfuscated content.
jwts used as legitimate authentication tokens passed to the model for parsing, validation, or debugging. inspect the prompt context to confirm whether the token was intentionally shared for a benign purpose.
seasonal or rarely used legitimate tools, such as monthly reporting or maintenance tools, can appear unusual when they are used.
security or forensics workflows that send file hashes to a model for threat intelligence lookup or malware triage. review the surrounding context and verify the hash does not correspond to a credential or sensitive artifact.