type: domain
namespace: SEC
version: "1.0"
anchor_version: ">=4.0.0"
maintainer: "Anchor Core"
always_loaded: true
description: >
  Security violations in AI-adjacent code. Covers prompt injection,
  data poisoning, model tampering, credential harvesting, authorization
  bypass, raw network access, shell injection, and supply chain attacks.
seal: "sha256:PENDING"

rules:

  - id: "SEC-001"
    name: "Prompt Injection"
    source: "FINOS"
    original_id: "Ri-001"
    category: "security"
    description: >
      An attacker manipulates an AI model's behavior by injecting malicious
      instructions through untrusted input channels — user-supplied text,
      document content, tool outputs, or any data that flows into a prompt
      without sanitization. The model cannot distinguish between legitimate
      instructions and injected ones, executing the attacker's intent
      instead of the developer's. In financial systems, this can cause
      models to leak customer data, bypass authorization logic, or generate
      fraudulent outputs. Severity is BLOCKER because successful injection
      can compromise the entire AI pipeline.
    severity: "blocker"
    min_severity: "error"
    min_mitigations: 1
    detection: ~
    primitives: ~

  - id: "SEC-002"
    name: "Data Poisoning"
    source: "FINOS"
    original_id: "Ri-002"
    category: "security"
    description: >
      Malicious or corrupted data is introduced into the training,
      fine-tuning, or retrieval pipeline, causing the model to learn
      incorrect behaviors, biased outputs, or backdoor triggers that
      activate under specific conditions. In financial AI, poisoned
      training data can cause credit models to systematically favor
      or disadvantage specific demographic groups, or cause fraud
      detection models to miss specific attack patterns. The attack
      is particularly dangerous because poisoned behavior is baked
      into the model weights and survives redeployment.
    severity: "blocker"
    min_severity: "error"
    min_mitigations: 1
    detection: ~
    primitives: ~

  - id: "SEC-003"
    name: "Model Tampering"
    source: "FINOS"
    original_id: "Ri-003"
    category: "security"
    description: >
      The model's weights, architecture, or infrastructure are
      compromised through supply chain attacks, unauthorized access
      to model storage, or malicious modification of model artifacts
      during transit or at rest. A tampered model may behave normally
      under standard conditions while producing controlled failures
      or data leakage under specific trigger inputs. In regulated
      financial systems, model tampering is equivalent to tampering
      with a financial instrument — it undermines the integrity of
      every decision the model makes and cannot be detected without
      cryptographic verification of model artifacts.
    severity: "blocker"
    min_severity: "blocker"
    min_mitigations: 1
    detection: ~
    primitives: ~

  - id: "SEC-004"
    name: "Credential Harvesting"
    source: "FINOS"
    original_id: "Ri-004"
    category: "security"
    description: >
      AI agents or AI-adjacent code systematically access environment
      variables, configuration files, or credential stores to extract
      API keys, tokens, database passwords, or other secrets. This
      often manifests as broad os.environ access that exposes all
      environment variables rather than accessing specific named keys.
      In AI pipelines, credential harvesting risk is elevated because
      models may generate code that accesses credentials, or agentic
      systems may be manipulated into exfiltrating secrets to external
      endpoints as part of a multi-step attack chain.
    severity: "blocker"
    min_severity: "error"
    min_mitigations: 1
    detection: ~
    primitives: ~

  - id: "SEC-005"
    name: "Authorization Bypass"
    source: "FINOS"
    original_id: "Ri-012"
    category: "security"
    description: >
      AI agents or model-integrated code execute actions outside their
      granted permissions or bypass authorization checks that would
      normally gate access to sensitive operations. This includes
      agents that call APIs without verifying caller identity, models
      that generate code skipping permission checks, and agentic
      workflows that escalate privileges by chaining tool calls that
      individually appear authorized. In financial AI, authorization
      bypass can allow unauthorized access to customer accounts,
      trading systems, or regulatory reporting pipelines.
    severity: "blocker"
    min_severity: "blocker"
    min_mitigations: 1
    detection: ~
    primitives: ~

  - id: "SEC-006"
    name: "Raw Network Access"
    source: "FINOS"
    original_id: "Ri-013"
    category: "security"
    description: >
      AI components or model integration code make direct calls to
      external LLM API endpoints, data sources, or third-party services
      without routing through a governed proxy or backstop layer. Raw
      network access bypasses governance controls, telemetry, rate
      limiting, and audit logging. In regulated financial environments,
      unproxied API calls to public LLM providers mean that sensitive
      financial data and customer information may be transmitted to
      external services without adequate data governance, violating
      RBI Digital Lending Directions and EU AI Act data requirements.
    severity: "error"
    min_severity: "warning"
    min_mitigations: 1
    detection: ~
    primitives: ~

  - id: "SEC-007"
    name: "Shell Injection"
    source: "FINOS"
    original_id: "Ri-014"
    category: "security"
    description: >
      AI-generated code or agentic tool calls invoke shell commands,
      subprocesses, or system calls that are constructed from untrusted
      input or operate outside a sandboxed execution environment. Models
      generating code frequently produce subprocess calls as part of
      automation tasks — these calls become injection vectors when they
      incorporate model outputs or user inputs without validation. In
      AI pipelines, shell injection risk is compounded by the fact that
      models may generate plausible-looking but malicious commands as
      part of multi-step agentic workflows, bypassing human review.
    severity: "blocker"
    min_severity: "error"
    min_mitigations: 1
    detection: ~
    primitives: ~

  - id: "SEC-008"
    name: "Supply Chain Attack"
    source: "FINOS"
    original_id: "Ri-017"
    category: "security"
    description: >
      Compromised dependencies, model repositories, MCP servers, or
      third-party AI tool integrations introduce malicious code or
      model artifacts into the AI pipeline. Supply chain attacks in
      AI systems are particularly difficult to detect because the
      compromise occurs upstream — a poisoned model checkpoint from
      a public repository, a compromised MCP server injecting malicious
      tool responses, or a tampered dependency that exfiltrates model
      inputs to an attacker-controlled endpoint. Every external AI
      component is a potential supply chain attack surface.
    severity: "blocker"
    min_severity: "error"
    min_mitigations: 1
    detection: ~
    primitives: ~
