{
  "schema_version": 1,
  "generated_from": {
    "prompt_result_evidence_map": "generated from data/usage_examples.json",
    "prompt_result_walkthroughs": "generated from Agentic RAG answers and prompt/result evidence map",
    "operator_use_cases": "generated from prompt/result walkthroughs"
  },
  "purpose": "Coverage matrix showing which sanitized prompt/result examples exercise each pattern, source-family, and control-family combination, with links back to Agentic RAG answers and operator use-case cards.",
  "axes": {
    "pattern": [
      "agent-web-search-exfiltration",
      "agentic-browser-cometjacking",
      "agentic-browser-local-file-exfiltration",
      "ai-browser-phishing-delegation",
      "ai-ide-browser-subagent",
      "calendar-invite-injection",
      "chatgpt-memory-persistence",
      "ci-agent-overpermission",
      "claude-url-prefill-injection",
      "connector-poisoned-document",
      "copilot-studio-email-agent",
      "cross-document-exfiltration",
      "delayed-skill-weaponization",
      "email-summary-injection",
      "enterprise-search-exfiltration",
      "github-comments-control-plane",
      "github-issue-title-injection",
      "hidden-markdown-pr-injection",
      "mcp-credential-exfiltration",
      "mcp-cve-command-bypass",
      "mcp-full-schema-poisoning",
      "mcp-line-jumping",
      "mcp-sampling-reverse-prompt",
      "mcp-stdio-command-execution",
      "mcp-stored-prompt-injection",
      "mcp-tool-description-poisoning",
      "multimodal-hidden-instruction",
      "notification-prompt-injection",
      "passive-codespaces-context-poisoning",
      "salesforce-agentforce-exfiltration",
      "second-order-agent-injection",
      "servicenow-agent-discovery-injection",
      "skill-manifest-prompt-injection",
      "skill-marketplace-malware",
      "skill-namespace-squatting",
      "skill-runtime-fetch",
      "slack-ai-private-channel-exfiltration",
      "trusted-image-proxy-exfil",
      "url-query-prompt-injection",
      "web-idpi-hidden-content",
      "web-scale-idpi-indicators",
      "zero-click-email-exfiltration"
    ],
    "source_family": [
      "application_security",
      "benchmark",
      "defense",
      "governance",
      "incident_report",
      "memory",
      "multi_agent",
      "protocol",
      "red_team",
      "survey",
      "tool_use"
    ],
    "control_family": [
      "content_sanitization",
      "human_approval",
      "instruction_isolation",
      "least_privilege_scope",
      "memory_governance",
      "monitoring_logging",
      "output_exfiltration_control",
      "policy_enforcement",
      "retrieval_integrity",
      "tool_authorization"
    ]
  },
  "counts": {
    "usage_examples": 200,
    "mapped_examples": 200,
    "unmapped_examples": 0,
    "populated_cells": 157,
    "possible_cells": 4620,
    "source_families": 11,
    "control_families": 10,
    "patterns": 42
  },
  "unmapped_example_ids": [],
  "summaries": {
    "by_source_family": {
      "application_security": {
        "example_count": 2,
        "pattern_count": 1,
        "agentic_rag_answer_count": 2
      },
      "benchmark": {
        "example_count": 12,
        "pattern_count": 3,
        "agentic_rag_answer_count": 5
      },
      "defense": {
        "example_count": 5,
        "pattern_count": 3,
        "agentic_rag_answer_count": 4
      },
      "governance": {
        "example_count": 3,
        "pattern_count": 2,
        "agentic_rag_answer_count": 2
      },
      "incident_report": {
        "example_count": 95,
        "pattern_count": 42,
        "agentic_rag_answer_count": 28
      },
      "memory": {
        "example_count": 19,
        "pattern_count": 5,
        "agentic_rag_answer_count": 14
      },
      "multi_agent": {
        "example_count": 3,
        "pattern_count": 1,
        "agentic_rag_answer_count": 2
      },
      "protocol": {
        "example_count": 7,
        "pattern_count": 2,
        "agentic_rag_answer_count": 5
      },
      "red_team": {
        "example_count": 31,
        "pattern_count": 5,
        "agentic_rag_answer_count": 13
      },
      "survey": {
        "example_count": 22,
        "pattern_count": 4,
        "agentic_rag_answer_count": 11
      },
      "tool_use": {
        "example_count": 1,
        "pattern_count": 1,
        "agentic_rag_answer_count": 1
      }
    },
    "by_control_family": {
      "content_sanitization": {
        "example_count": 13,
        "pattern_count": 7,
        "agentic_rag_answer_count": 10
      },
      "human_approval": {
        "example_count": 33,
        "pattern_count": 26,
        "agentic_rag_answer_count": 24
      },
      "instruction_isolation": {
        "example_count": 35,
        "pattern_count": 15,
        "agentic_rag_answer_count": 27
      },
      "least_privilege_scope": {
        "example_count": 4,
        "pattern_count": 4,
        "agentic_rag_answer_count": 4
      },
      "memory_governance": {
        "example_count": 16,
        "pattern_count": 10,
        "agentic_rag_answer_count": 15
      },
      "monitoring_logging": {
        "example_count": 9,
        "pattern_count": 3,
        "agentic_rag_answer_count": 8
      },
      "output_exfiltration_control": {
        "example_count": 16,
        "pattern_count": 18,
        "agentic_rag_answer_count": 13
      },
      "policy_enforcement": {
        "example_count": 43,
        "pattern_count": 20,
        "agentic_rag_answer_count": 28
      },
      "retrieval_integrity": {
        "example_count": 5,
        "pattern_count": 3,
        "agentic_rag_answer_count": 5
      },
      "tool_authorization": {
        "example_count": 26,
        "pattern_count": 14,
        "agentic_rag_answer_count": 20
      }
    }
  },
  "cells": [
    {
      "pattern_id": "second-order-agent-injection",
      "source_family": "memory",
      "control_family": "memory_governance",
      "example_ids": [
        "ex-agent-backdoor-threats",
        "ex-autonomous-agent-review-context",
        "ex-chatgpt-memory-history-boundary",
        "ex-multiagent-communication-redteam",
        "ex-owasp-agent-memory-guard",
        "ex-practical-memory-injection",
        "ex-sequential-contextual-harm-monitoring"
      ],
      "agentic_rag_answer_ids": [
        "adaptive-realworld-blackbox-multiagent-redteam",
        "agent-security-survey-taxonomy-evidence",
        "memory-rag-tool-mcp-web-exfiltration",
        "monitoring-runtime-declarative-defenses",
        "privilege-memory-rag-runtime-controls",
        "sequential-visual-operator-memory-controls",
        "web-memory-redteam-delayed-context"
      ],
      "operator_use_case_ids": [
        "use-adaptive-realworld-blackbox-multiagent-redteam",
        "use-agent-security-survey-taxonomy-evidence",
        "use-memory-rag-tool-mcp-web-exfiltration",
        "use-monitoring-runtime-declarative-defenses",
        "use-privilege-memory-rag-runtime-controls",
        "use-sequential-visual-operator-memory-controls",
        "use-web-memory-redteam-delayed-context"
      ],
      "example_count": 7
    },
    {
      "pattern_id": "second-order-agent-injection",
      "source_family": "survey",
      "control_family": "policy_enforcement",
      "example_ids": [
        "ex-agent-infrastructure-control-plane",
        "ex-agentic-ai-taxonomy-instruction-boundary",
        "ex-cyberseceval-agent-security-suite",
        "ex-fids-information-flow-control",
        "ex-formal-agent-behavior-spec",
        "ex-formal-security-guarantees-agent",
        "ex-ras-eval-real-world-agent-security"
      ],
      "agentic_rag_answer_ids": [
        "agent-infrastructure-identity-policy",
        "agent-security-benchmark-eval-corpora",
        "agent-security-survey-taxonomy-evidence",
        "design-ifc-prompt-flow-defenses",
        "formal-mobile-adaptive-guardrails"
      ],
      "operator_use_case_ids": [
        "use-agent-infrastructure-identity-policy",
        "use-agent-security-benchmark-eval-corpora",
        "use-agent-security-survey-taxonomy-evidence",
        "use-design-ifc-prompt-flow-defenses",
        "use-formal-mobile-adaptive-guardrails"
      ],
      "example_count": 7
    },
    {
      "pattern_id": "mcp-cve-command-bypass",
      "source_family": "incident_report",
      "control_family": "tool_authorization",
      "example_ids": [
        "ex-agent-command-bypass-record",
        "ex-gemini-mcp-tool-cve-boundary",
        "ex-mcp-stdio-command-classification",
        "ex-mcp-vulnerable-catalog-case-selection",
        "ex-nginx-ui-mcp-auth-boundary"
      ],
      "agentic_rag_answer_ids": [
        "mcp-command-stored-prompt-boundaries",
        "mcp-sampling-private-repo-cve-boundaries"
      ],
      "operator_use_case_ids": [
        "use-mcp-command-stored-prompt-boundaries",
        "use-mcp-sampling-private-repo-cve-boundaries"
      ],
      "example_count": 5
    },
    {
      "pattern_id": "mcp-tool-description-poisoning",
      "source_family": "incident_report",
      "control_family": "tool_authorization",
      "example_ids": [
        "ex-gemini-mcp-tool-cve-boundary",
        "ex-github-mcp-data-heist",
        "ex-github-mcp-private-repo-context",
        "ex-mcp-line-jumping-discovery",
        "ex-mcp-vulnerable-catalog-case-selection"
      ],
      "agentic_rag_answer_ids": [
        "mcp-registry-toolchain-skill-marketplace",
        "mcp-repository-project-context",
        "mcp-sampling-private-repo-cve-boundaries",
        "mcp-schema-skill-supply-chain"
      ],
      "operator_use_case_ids": [
        "use-mcp-registry-toolchain-skill-marketplace",
        "use-mcp-repository-project-context",
        "use-mcp-sampling-private-repo-cve-boundaries",
        "use-mcp-schema-skill-supply-chain"
      ],
      "example_count": 5
    },
    {
      "pattern_id": "second-order-agent-injection",
      "source_family": "survey",
      "control_family": "monitoring_logging",
      "example_ids": [
        "ex-agent-evaluation-survey-provenance",
        "ex-agent-visibility-measures",
        "ex-agentspec-runtime-enforcement",
        "ex-openai-agentic-governance-practices",
        "ex-security-of-ai-agents-survey-controls"
      ],
      "agentic_rag_answer_ids": [
        "agent-infrastructure-identity-policy",
        "agent-security-survey-taxonomy-evidence",
        "defense-governance-release-controls",
        "privilege-memory-rag-runtime-controls"
      ],
      "operator_use_case_ids": [
        "use-agent-infrastructure-identity-policy",
        "use-agent-security-survey-taxonomy-evidence",
        "use-defense-governance-release-controls",
        "use-privilege-memory-rag-runtime-controls"
      ],
      "example_count": 5
    },
    {
      "pattern_id": "web-idpi-hidden-content",
      "source_family": "red_team",
      "control_family": "content_sanitization",
      "example_ids": [
        "ex-agentvigil-black-box-redteam",
        "ex-automatic-universal-prompt-injection",
        "ex-formalizing-prompt-injection-benchmark",
        "ex-goal-guided-generative-injection",
        "ex-llm-integrated-app-prompt-boundary"
      ],
      "agentic_rag_answer_ids": [
        "adaptive-realworld-blackbox-multiagent-redteam",
        "agent-security-benchmark-eval-corpora",
        "detector-automatic-goal-guided-prompt-risks"
      ],
      "operator_use_case_ids": [
        "use-adaptive-realworld-blackbox-multiagent-redteam",
        "use-agent-security-benchmark-eval-corpora",
        "use-detector-automatic-goal-guided-prompt-risks"
      ],
      "example_count": 5
    },
    {
      "pattern_id": "web-idpi-hidden-content",
      "source_family": "red_team",
      "control_family": "policy_enforcement",
      "example_ids": [
        "ex-critical-defense-evaluation",
        "ex-gentel-safe-shielding-framework",
        "ex-melon-provable-idpi-defense",
        "ex-tensor-trust-instruction-game",
        "ex-wasp-web-agent-security-benchmark"
      ],
      "agentic_rag_answer_ids": [
        "agent-security-benchmark-eval-corpora",
        "defense-governance-release-controls",
        "monitoring-runtime-declarative-defenses",
        "web-redteam-multiagent-guardrail-benchmarks"
      ],
      "operator_use_case_ids": [
        "use-agent-security-benchmark-eval-corpora",
        "use-defense-governance-release-controls",
        "use-monitoring-runtime-declarative-defenses",
        "use-web-redteam-multiagent-guardrail-benchmarks"
      ],
      "example_count": 5
    },
    {
      "pattern_id": "second-order-agent-injection",
      "source_family": "red_team",
      "control_family": "policy_enforcement",
      "example_ids": [
        "ex-agentdojo-dynamic-attack-defense",
        "ex-agentic-systems-theory-boundary",
        "ex-byzantine-embodied-agent-poisoning",
        "ex-prompt-infection-agent-to-agent"
      ],
      "agentic_rag_answer_ids": [
        "adaptive-realworld-blackbox-multiagent-redteam",
        "agent-security-benchmark-eval-corpora",
        "systems-sandbox-computer-use-threat-models"
      ],
      "operator_use_case_ids": [
        "use-adaptive-realworld-blackbox-multiagent-redteam",
        "use-agent-security-benchmark-eval-corpora",
        "use-systems-sandbox-computer-use-threat-models"
      ],
      "example_count": 4
    },
    {
      "pattern_id": "second-order-agent-injection",
      "source_family": "survey",
      "control_family": "instruction_isolation",
      "example_ids": [
        "ex-agrail-lifelong-guardrail",
        "ex-airgapagent-privacy-boundary",
        "ex-formal-llm-controllable-agent",
        "ex-safe-wild-agent-testing"
      ],
      "agentic_rag_answer_ids": [
        "formal-mobile-adaptive-guardrails",
        "privacy-multiagent-audit-observability"
      ],
      "operator_use_case_ids": [
        "use-formal-mobile-adaptive-guardrails",
        "use-privacy-multiagent-audit-observability"
      ],
      "example_count": 4
    },
    {
      "pattern_id": "web-idpi-hidden-content",
      "source_family": "incident_report",
      "control_family": "instruction_isolation",
      "example_ids": [
        "ex-antigravity-browser-subagent",
        "ex-comet-webpage-summary-hijack",
        "ex-multimodal-hidden-instruction-document",
        "ex-web-idpi-public-page"
      ],
      "agentic_rag_answer_ids": [
        "agentic-browser-phishing-summary-content",
        "browser-web-rendered-content",
        "mobile-url-ide-subagent-context",
        "web-multimodal-idpi-prevalence"
      ],
      "operator_use_case_ids": [
        "use-agentic-browser-phishing-summary-content",
        "use-browser-web-rendered-content",
        "use-mobile-url-ide-subagent-context",
        "use-web-multimodal-idpi-prevalence"
      ],
      "example_count": 4
    },
    {
      "pattern_id": "ai-browser-phishing-delegation",
      "source_family": "incident_report",
      "control_family": "human_approval",
      "example_ids": [
        "ex-browser-phishing-delegation",
        "ex-comet-guardio-fake-shopping",
        "ex-comet-phishing-document-delegation"
      ],
      "agentic_rag_answer_ids": [
        "agentic-browser-connected-local-services",
        "agentic-browser-phishing-summary-content",
        "cursor-comet-browser-agent-audit-boundaries"
      ],
      "operator_use_case_ids": [
        "use-agentic-browser-connected-local-services",
        "use-agentic-browser-phishing-summary-content",
        "use-cursor-comet-browser-agent-audit-boundaries"
      ],
      "example_count": 3
    },
    {
      "pattern_id": "chatgpt-memory-persistence",
      "source_family": "incident_report",
      "control_family": "memory_governance",
      "example_ids": [
        "ex-gemini-notification-memory-poisoning",
        "ex-zombieagent-memory-persistence",
        "ex-zombieagent-propagation-connected-content"
      ],
      "agentic_rag_answer_ids": [
        "copilot-chatgpt-connector-persistence",
        "email-url-connector-exfiltration-controls",
        "mobile-url-ide-subagent-context"
      ],
      "operator_use_case_ids": [
        "use-copilot-chatgpt-connector-persistence",
        "use-email-url-connector-exfiltration-controls",
        "use-mobile-url-ide-subagent-context"
      ],
      "example_count": 3
    },
    {
      "pattern_id": "ci-agent-overpermission",
      "source_family": "incident_report",
      "control_family": "instruction_isolation",
      "example_ids": [
        "ex-gemini-cli-action-comment-control",
        "ex-github-issue-title-ci-agent",
        "ex-promptpwnd-ci-metadata"
      ],
      "agentic_rag_answer_ids": [
        "ci-cd-agent-permission-boundaries",
        "ci-coding-agent-issue-metadata",
        "github-ci-codespaces-agent-control"
      ],
      "operator_use_case_ids": [
        "use-ci-cd-agent-permission-boundaries",
        "use-ci-coding-agent-issue-metadata",
        "use-github-ci-codespaces-agent-control"
      ],
      "example_count": 3
    },
    {
      "pattern_id": "ci-agent-overpermission",
      "source_family": "incident_report",
      "control_family": "output_exfiltration_control",
      "example_ids": [
        "ex-claude-code-action-secrets-exposure",
        "ex-copilot-agent-comment-control",
        "ex-github-comment-review-agent"
      ],
      "agentic_rag_answer_ids": [
        "ci-cd-agent-permission-boundaries",
        "ci-coding-agent-issue-metadata",
        "github-ci-codespaces-agent-control"
      ],
      "operator_use_case_ids": [
        "use-ci-cd-agent-permission-boundaries",
        "use-ci-coding-agent-issue-metadata",
        "use-github-ci-codespaces-agent-control"
      ],
      "example_count": 3
    },
    {
      "pattern_id": "copilot-studio-email-agent",
      "source_family": "incident_report",
      "control_family": "human_approval",
      "example_ids": [
        "ex-agentflayer-copilot-studio-platform",
        "ex-copilot-studio-email-agent",
        "ex-salesforce-einstein-enterprise-boundary"
      ],
      "agentic_rag_answer_ids": [
        "email-triggered-enterprise-agents",
        "enterprise-agent-service-tool-boundaries",
        "enterprise-cross-document-workspace-boundaries"
      ],
      "operator_use_case_ids": [
        "use-email-triggered-enterprise-agents",
        "use-enterprise-agent-service-tool-boundaries",
        "use-enterprise-cross-document-workspace-boundaries"
      ],
      "example_count": 3
    },
    {
      "pattern_id": "email-summary-injection",
      "source_family": "incident_report",
      "control_family": "policy_enforcement",
      "example_ids": [
        "ex-copilot-email-summary-autophish",
        "ex-email-summary-phishing",
        "ex-proofpoint-email-assistant-idpi"
      ],
      "agentic_rag_answer_ids": [
        "connected-enterprise-assistant-content",
        "email-url-connector-exfiltration-controls",
        "mail-collaboration-private-context"
      ],
      "operator_use_case_ids": [
        "use-connected-enterprise-assistant-content",
        "use-email-url-connector-exfiltration-controls",
        "use-mail-collaboration-private-context"
      ],
      "example_count": 3
    },
    {
      "pattern_id": "github-comments-control-plane",
      "source_family": "incident_report",
      "control_family": "output_exfiltration_control",
      "example_ids": [
        "ex-claude-code-action-secrets-exposure",
        "ex-copilot-agent-comment-control",
        "ex-github-comment-review-agent"
      ],
      "agentic_rag_answer_ids": [
        "ci-cd-agent-permission-boundaries",
        "ci-coding-agent-issue-metadata",
        "github-ci-codespaces-agent-control"
      ],
      "operator_use_case_ids": [
        "use-ci-cd-agent-permission-boundaries",
        "use-ci-coding-agent-issue-metadata",
        "use-github-ci-codespaces-agent-control"
      ],
      "example_count": 3
    },
    {
      "pattern_id": "mcp-tool-description-poisoning",
      "source_family": "protocol",
      "control_family": "instruction_isolation",
      "example_ids": [
        "ex-agent-interoperability-protocol-metadata",
        "ex-agent-network-protocol-identity",
        "ex-mcp-landscape-security-threats"
      ],
      "agentic_rag_answer_ids": [
        "agent-infrastructure-identity-policy",
        "protocol-tool-threat-model-boundaries"
      ],
      "operator_use_case_ids": [
        "use-agent-infrastructure-identity-policy",
        "use-protocol-tool-threat-model-boundaries"
      ],
      "example_count": 3
    },
    {
      "pattern_id": "salesforce-agentforce-exfiltration",
      "source_family": "incident_report",
      "control_family": "human_approval",
      "example_ids": [
        "ex-agentforce-crm-indirect-prompt",
        "ex-forcedleak-agentforce-crm-record",
        "ex-forcedleak-agentforce-tool-chain"
      ],
      "agentic_rag_answer_ids": [
        "crm-calendar-record-content",
        "enterprise-agent-service-tool-boundaries",
        "enterprise-cross-document-workspace-boundaries"
      ],
      "operator_use_case_ids": [
        "use-crm-calendar-record-content",
        "use-enterprise-agent-service-tool-boundaries",
        "use-enterprise-cross-document-workspace-boundaries"
      ],
      "example_count": 3
    },
    {
      "pattern_id": "second-order-agent-injection",
      "source_family": "memory",
      "control_family": "retrieval_integrity",
      "example_ids": [
        "ex-agentpoison-memory-knowledge-base",
        "ex-controlnet-rag-firewall",
        "ex-poisonedrag-knowledge-corruption"
      ],
      "agentic_rag_answer_ids": [
        "memory-rag-tool-mcp-web-exfiltration",
        "privilege-memory-rag-runtime-controls",
        "web-memory-redteam-delayed-context"
      ],
      "operator_use_case_ids": [
        "use-memory-rag-tool-mcp-web-exfiltration",
        "use-privilege-memory-rag-runtime-controls",
        "use-web-memory-redteam-delayed-context"
      ],
      "example_count": 3
    },
    {
      "pattern_id": "second-order-agent-injection",
      "source_family": "red_team",
      "control_family": "content_sanitization",
      "example_ids": [
        "ex-agent-security-bench-formalized-attacks",
        "ex-ai-agents-under-threat-risk-map",
        "ex-udora-reasoning-hijack"
      ],
      "agentic_rag_answer_ids": [
        "agent-security-survey-taxonomy-evidence",
        "web-memory-redteam-delayed-context",
        "web-redteam-multiagent-guardrail-benchmarks"
      ],
      "operator_use_case_ids": [
        "use-agent-security-survey-taxonomy-evidence",
        "use-web-memory-redteam-delayed-context",
        "use-web-redteam-multiagent-guardrail-benchmarks"
      ],
      "example_count": 3
    },
    {
      "pattern_id": "second-order-agent-injection",
      "source_family": "survey",
      "control_family": "tool_authorization",
      "example_ids": [
        "ex-agentbench-general-agent-eval",
        "ex-agentic-ai-threat-model-framework",
        "ex-progent-programmable-privilege-control"
      ],
      "agentic_rag_answer_ids": [
        "agent-benchmark-tool-email-boundaries",
        "privilege-memory-rag-runtime-controls",
        "protocol-tool-threat-model-boundaries"
      ],
      "operator_use_case_ids": [
        "use-agent-benchmark-tool-email-boundaries",
        "use-privilege-memory-rag-runtime-controls",
        "use-protocol-tool-threat-model-boundaries"
      ],
      "example_count": 3
    },
    {
      "pattern_id": "skill-manifest-prompt-injection",
      "source_family": "incident_report",
      "control_family": "policy_enforcement",
      "example_ids": [
        "ex-delayed-skill-update-weaponization",
        "ex-malicious-skill-dynamic-context",
        "ex-toxic-skills-supply-chain"
      ],
      "agentic_rag_answer_ids": [
        "agent-skill-provenance-runtime-review",
        "mcp-schema-skill-supply-chain",
        "mcp-tool-metadata-poisoning"
      ],
      "operator_use_case_ids": [
        "use-agent-skill-provenance-runtime-review",
        "use-mcp-schema-skill-supply-chain",
        "use-mcp-tool-metadata-poisoning"
      ],
      "example_count": 3
    },
    {
      "pattern_id": "skill-runtime-fetch",
      "source_family": "incident_report",
      "control_family": "policy_enforcement",
      "example_ids": [
        "ex-clawhavoc-coordinated-skill-campaign",
        "ex-malicious-skill-dynamic-context",
        "ex-toxic-skills-supply-chain"
      ],
      "agentic_rag_answer_ids": [
        "mcp-registry-toolchain-skill-marketplace",
        "mcp-schema-skill-supply-chain",
        "mcp-tool-metadata-poisoning"
      ],
      "operator_use_case_ids": [
        "use-mcp-schema-skill-supply-chain",
        "use-mcp-tool-metadata-poisoning"
      ],
      "example_count": 3
    },
    {
      "pattern_id": "trusted-image-proxy-exfil",
      "source_family": "incident_report",
      "control_family": "output_exfiltration_control",
      "example_ids": [
        "ex-google-ai-studio-data-exfiltration",
        "ex-hidden-pr-markdown-image-channel",
        "ex-slack-ai-link-rendering-side-channel"
      ],
      "agentic_rag_answer_ids": [
        "browser-web-rendered-content",
        "claude-google-prompt-loading-output-boundaries",
        "enterprise-cross-document-workspace-boundaries"
      ],
      "operator_use_case_ids": [
        "use-browser-web-rendered-content",
        "use-claude-google-prompt-loading-output-boundaries",
        "use-enterprise-cross-document-workspace-boundaries"
      ],
      "example_count": 3
    },
    {
      "pattern_id": "web-idpi-hidden-content",
      "source_family": "benchmark",
      "control_family": "instruction_isolation",
      "example_ids": [
        "ex-visualwebarena-visual-text-boundary",
        "ex-web-agent-illusion-progress",
        "ex-webarena-web-agent-task-context"
      ],
      "agentic_rag_answer_ids": [
        "web-agent-benchmark-browser-boundaries",
        "web-memory-redteam-delayed-context"
      ],
      "operator_use_case_ids": [
        "use-web-agent-benchmark-browser-boundaries",
        "use-web-memory-redteam-delayed-context"
      ],
      "example_count": 3
    },
    {
      "pattern_id": "web-idpi-hidden-content",
      "source_family": "incident_report",
      "control_family": "human_approval",
      "example_ids": [
        "ex-brave-local-agent-tab-context",
        "ex-browser-phishing-delegation",
        "ex-comet-phishing-document-delegation"
      ],
      "agentic_rag_answer_ids": [
        "agentic-browser-connected-local-services",
        "agentic-browser-phishing-summary-content",
        "web-multimodal-idpi-prevalence"
      ],
      "operator_use_case_ids": [
        "use-agentic-browser-connected-local-services",
        "use-agentic-browser-phishing-summary-content",
        "use-web-multimodal-idpi-prevalence"
      ],
      "example_count": 3
    },
    {
      "pattern_id": "web-idpi-hidden-content",
      "source_family": "red_team",
      "control_family": "monitoring_logging",
      "example_ids": [
        "ex-adaptive-idpi-defense-breaks",
        "ex-llm-detector-failure-mode",
        "ex-redteamcua-hybrid-web-os"
      ],
      "agentic_rag_answer_ids": [
        "adaptive-realworld-blackbox-multiagent-redteam",
        "detector-automatic-goal-guided-prompt-risks",
        "web-redteam-multiagent-guardrail-benchmarks"
      ],
      "operator_use_case_ids": [
        "use-adaptive-realworld-blackbox-multiagent-redteam",
        "use-detector-automatic-goal-guided-prompt-risks",
        "use-web-redteam-multiagent-guardrail-benchmarks"
      ],
      "example_count": 3
    },
    {
      "pattern_id": "zero-click-email-exfiltration",
      "source_family": "incident_report",
      "control_family": "instruction_isolation",
      "example_ids": [
        "ex-agentflayer-chatgpt-drive-connector",
        "ex-chatgpt-email-zero-click",
        "ex-shadowleak-deep-research-mailbox"
      ],
      "agentic_rag_answer_ids": [
        "copilot-chatgpt-connector-persistence",
        "enterprise-search-agent-to-agent-exfiltration",
        "mail-collaboration-private-context"
      ],
      "operator_use_case_ids": [
        "use-copilot-chatgpt-connector-persistence",
        "use-enterprise-search-agent-to-agent-exfiltration",
        "use-mail-collaboration-private-context"
      ],
      "example_count": 3
    },
    {
      "pattern_id": "agentic-browser-cometjacking",
      "source_family": "incident_report",
      "control_family": "instruction_isolation",
      "example_ids": [
        "ex-comet-webpage-summary-hijack",
        "ex-cometjacking-calendar-connected-service"
      ],
      "agentic_rag_answer_ids": [
        "agentic-browser-connected-local-services",
        "agentic-browser-phishing-summary-content"
      ],
      "operator_use_case_ids": [
        "use-agentic-browser-connected-local-services",
        "use-agentic-browser-phishing-summary-content"
      ],
      "example_count": 2
    },
    {
      "pattern_id": "agentic-browser-local-file-exfiltration",
      "source_family": "incident_report",
      "control_family": "policy_enforcement",
      "example_ids": [
        "ex-agentic-browser-audit-cluster",
        "ex-pleasefix-comet-local-file"
      ],
      "agentic_rag_answer_ids": [
        "agentic-browser-connected-local-services",
        "web-agent-benchmark-browser-boundaries"
      ],
      "operator_use_case_ids": [
        "use-agentic-browser-connected-local-services",
        "use-web-agent-benchmark-browser-boundaries"
      ],
      "example_count": 2
    },
    {
      "pattern_id": "ai-ide-browser-subagent",
      "source_family": "benchmark",
      "control_family": "human_approval",
      "example_ids": [
        "ex-androidworld-mobile-app-context",
        "ex-mobilesafetybench-device-control"
      ],
      "agentic_rag_answer_ids": [
        "agent-benchmark-tool-email-boundaries",
        "computer-use-mobile-os-boundaries"
      ],
      "operator_use_case_ids": [
        "use-agent-benchmark-tool-email-boundaries",
        "use-computer-use-mobile-os-boundaries"
      ],
      "example_count": 2
    },
    {
      "pattern_id": "ai-ide-browser-subagent",
      "source_family": "benchmark",
      "control_family": "policy_enforcement",
      "example_ids": [
        "ex-os-harm-computer-use-safety",
        "ex-riosworld-risk-computer-use"
      ],
      "agentic_rag_answer_ids": [
        "computer-use-mobile-os-boundaries"
      ],
      "operator_use_case_ids": [
        "use-computer-use-mobile-os-boundaries"
      ],
      "example_count": 2
    },
    {
      "pattern_id": "ai-ide-browser-subagent",
      "source_family": "incident_report",
      "control_family": "instruction_isolation",
      "example_ids": [
        "ex-agentflayer-cursor-enterprise-agent",
        "ex-antigravity-browser-subagent"
      ],
      "agentic_rag_answer_ids": [
        "cursor-comet-browser-agent-audit-boundaries",
        "mobile-url-ide-subagent-context"
      ],
      "operator_use_case_ids": [
        "use-cursor-comet-browser-agent-audit-boundaries",
        "use-mobile-url-ide-subagent-context"
      ],
      "example_count": 2
    },
    {
      "pattern_id": "ai-ide-browser-subagent",
      "source_family": "memory",
      "control_family": "memory_governance",
      "example_ids": [
        "ex-aios-agent-os-policy-boundary",
        "ex-cua-storm-threat-mapping"
      ],
      "agentic_rag_answer_ids": [
        "agent-benchmark-tool-email-boundaries",
        "systems-sandbox-computer-use-threat-models"
      ],
      "operator_use_case_ids": [
        "use-agent-benchmark-tool-email-boundaries",
        "use-systems-sandbox-computer-use-threat-models"
      ],
      "example_count": 2
    },
    {
      "pattern_id": "claude-url-prefill-injection",
      "source_family": "incident_report",
      "control_family": "human_approval",
      "example_ids": [
        "ex-claudy-day-files-context",
        "ex-claudy-day-url-prefill"
      ],
      "agentic_rag_answer_ids": [
        "claude-google-prompt-loading-output-boundaries",
        "mobile-url-ide-subagent-context"
      ],
      "operator_use_case_ids": [
        "use-claude-google-prompt-loading-output-boundaries",
        "use-mobile-url-ide-subagent-context"
      ],
      "example_count": 2
    },
    {
      "pattern_id": "connector-poisoned-document",
      "source_family": "incident_report",
      "control_family": "human_approval",
      "example_ids": [
        "ex-forcedleak-agentforce-crm-record",
        "ex-straiker-drive-email-trigger"
      ],
      "agentic_rag_answer_ids": [
        "copilot-chatgpt-connector-persistence",
        "enterprise-cross-document-workspace-boundaries"
      ],
      "operator_use_case_ids": [
        "use-copilot-chatgpt-connector-persistence",
        "use-enterprise-cross-document-workspace-boundaries"
      ],
      "example_count": 2
    },
    {
      "pattern_id": "cross-document-exfiltration",
      "source_family": "incident_report",
      "control_family": "human_approval",
      "example_ids": [
        "ex-cometjacking-gmail-connected-service",
        "ex-salesforce-einstein-enterprise-boundary"
      ],
      "agentic_rag_answer_ids": [
        "agentic-browser-connected-local-services",
        "enterprise-cross-document-workspace-boundaries"
      ],
      "operator_use_case_ids": [
        "use-agentic-browser-connected-local-services",
        "use-enterprise-cross-document-workspace-boundaries"
      ],
      "example_count": 2
    },
    {
      "pattern_id": "cross-document-exfiltration",
      "source_family": "incident_report",
      "control_family": "least_privilege_scope",
      "example_ids": [
        "ex-notebooklm-cross-document-boundary",
        "ex-slack-ai-private-channel"
      ],
      "agentic_rag_answer_ids": [
        "enterprise-cross-document-workspace-boundaries",
        "mail-collaboration-private-context"
      ],
      "operator_use_case_ids": [
        "use-enterprise-cross-document-workspace-boundaries",
        "use-mail-collaboration-private-context"
      ],
      "example_count": 2
    },
    {
      "pattern_id": "cross-document-exfiltration",
      "source_family": "incident_report",
      "control_family": "output_exfiltration_control",
      "example_ids": [
        "ex-notion-agent-web-search-exfiltration",
        "ex-servicenow-agent-discovery-data-exfiltration"
      ],
      "agentic_rag_answer_ids": [
        "enterprise-agent-service-tool-boundaries",
        "enterprise-search-agent-to-agent-exfiltration"
      ],
      "operator_use_case_ids": [
        "use-enterprise-agent-service-tool-boundaries",
        "use-enterprise-search-agent-to-agent-exfiltration"
      ],
      "example_count": 2
    },
    {
      "pattern_id": "github-comments-control-plane",
      "source_family": "incident_report",
      "control_family": "instruction_isolation",
      "example_ids": [
        "ex-gemini-cli-action-comment-control",
        "ex-promptpwnd-ci-metadata"
      ],
      "agentic_rag_answer_ids": [
        "ci-cd-agent-permission-boundaries",
        "github-ci-codespaces-agent-control"
      ],
      "operator_use_case_ids": [
        "use-ci-cd-agent-permission-boundaries",
        "use-github-ci-codespaces-agent-control"
      ],
      "example_count": 2
    },
    {
      "pattern_id": "hidden-markdown-pr-injection",
      "source_family": "incident_report",
      "control_family": "output_exfiltration_control",
      "example_ids": [
        "ex-claude-code-project-config",
        "ex-hidden-pr-markdown-image-channel"
      ],
      "agentic_rag_answer_ids": [
        "browser-web-rendered-content",
        "mcp-repository-project-context"
      ],
      "operator_use_case_ids": [
        "use-browser-web-rendered-content",
        "use-mcp-repository-project-context"
      ],
      "example_count": 2
    },
    {
      "pattern_id": "mcp-credential-exfiltration",
      "source_family": "incident_report",
      "control_family": "output_exfiltration_control",
      "example_ids": [
        "ex-amp-agent-credential-boundary",
        "ex-claude-code-project-config"
      ],
      "agentic_rag_answer_ids": [
        "mcp-repository-project-context",
        "privilege-memory-rag-runtime-controls"
      ],
      "operator_use_case_ids": [
        "use-mcp-repository-project-context",
        "use-privilege-memory-rag-runtime-controls"
      ],
      "example_count": 2
    },
    {
      "pattern_id": "mcp-credential-exfiltration",
      "source_family": "incident_report",
      "control_family": "tool_authorization",
      "example_ids": [
        "ex-github-mcp-data-heist",
        "ex-github-mcp-private-repo-context"
      ],
      "agentic_rag_answer_ids": [
        "mcp-registry-toolchain-skill-marketplace",
        "mcp-repository-project-context"
      ],
      "operator_use_case_ids": [
        "use-mcp-registry-toolchain-skill-marketplace",
        "use-mcp-repository-project-context"
      ],
      "example_count": 2
    },
    {
      "pattern_id": "mcp-stdio-command-execution",
      "source_family": "incident_report",
      "control_family": "human_approval",
      "example_ids": [
        "ex-mcp-prompt-hijacking-cve",
        "ex-mcp-remote-untrusted-server"
      ],
      "agentic_rag_answer_ids": [
        "mcp-command-stored-prompt-boundaries",
        "mcp-registry-toolchain-skill-marketplace"
      ],
      "operator_use_case_ids": [
        "use-mcp-command-stored-prompt-boundaries",
        "use-mcp-registry-toolchain-skill-marketplace"
      ],
      "example_count": 2
    },
    {
      "pattern_id": "mcp-tool-description-poisoning",
      "source_family": "incident_report",
      "control_family": "human_approval",
      "example_ids": [
        "ex-github-mcp-private-repo-leak-risk",
        "ex-mcp-prompt-hijacking-cve"
      ],
      "agentic_rag_answer_ids": [
        "mcp-registry-toolchain-skill-marketplace",
        "mcp-sampling-private-repo-cve-boundaries"
      ],
      "operator_use_case_ids": [
        "use-mcp-registry-toolchain-skill-marketplace",
        "use-mcp-sampling-private-repo-cve-boundaries"
      ],
      "example_count": 2
    },
    {
      "pattern_id": "mcp-tool-description-poisoning",
      "source_family": "protocol",
      "control_family": "tool_authorization",
      "example_ids": [
        "ex-mcp-tool-description-poisoning",
        "ex-protocol-exploits-agent-workflow"
      ],
      "agentic_rag_answer_ids": [
        "mcp-tool-metadata-poisoning",
        "protocol-tool-threat-model-boundaries"
      ],
      "operator_use_case_ids": [
        "use-mcp-tool-metadata-poisoning",
        "use-protocol-tool-threat-model-boundaries"
      ],
      "example_count": 2
    },
    {
      "pattern_id": "notification-prompt-injection",
      "source_family": "incident_report",
      "control_family": "human_approval",
      "example_ids": [
        "ex-gemini-notification-hijack",
        "ex-gemini-notification-smart-home-action"
      ],
      "agentic_rag_answer_ids": [
        "mobile-url-ide-subagent-context"
      ],
      "operator_use_case_ids": [
        "use-mobile-url-ide-subagent-context"
      ],
      "example_count": 2
    },
    {
      "pattern_id": "second-order-agent-injection",
      "source_family": "incident_report",
      "control_family": "instruction_isolation",
      "example_ids": [
        "ex-servicenow-second-order-a2a",
        "ex-sqlite-mcp-stored-prompt"
      ],
      "agentic_rag_answer_ids": [
        "enterprise-agent-service-tool-boundaries",
        "mcp-command-stored-prompt-boundaries"
      ],
      "operator_use_case_ids": [
        "use-enterprise-agent-service-tool-boundaries",
        "use-mcp-command-stored-prompt-boundaries"
      ],
      "example_count": 2
    },
    {
      "pattern_id": "second-order-agent-injection",
      "source_family": "multi_agent",
      "control_family": "policy_enforcement",
      "example_ids": [
        "ex-guardian-multi-agent-temporal",
        "ex-sentinelagent-graph-anomaly"
      ],
      "agentic_rag_answer_ids": [
        "privacy-multiagent-audit-observability"
      ],
      "operator_use_case_ids": [
        "use-privacy-multiagent-audit-observability"
      ],
      "example_count": 2
    },
    {
      "pattern_id": "skill-manifest-prompt-injection",
      "source_family": "incident_report",
      "control_family": "human_approval",
      "example_ids": [
        "ex-anthropic-namespace-skill-provenance",
        "ex-skillspector-package-risk-triage"
      ],
      "agentic_rag_answer_ids": [
        "agent-skill-provenance-runtime-review"
      ],
      "operator_use_case_ids": [
        "use-agent-skill-provenance-runtime-review"
      ],
      "example_count": 2
    },
    {
      "pattern_id": "web-idpi-hidden-content",
      "source_family": "benchmark",
      "control_family": "policy_enforcement",
      "example_ids": [
        "ex-llmail-inject-email-dataset",
        "ex-webvoyager-end-to-end-web-navigation"
      ],
      "agentic_rag_answer_ids": [
        "agent-benchmark-tool-email-boundaries",
        "web-agent-benchmark-browser-boundaries"
      ],
      "operator_use_case_ids": [
        "use-agent-benchmark-tool-email-boundaries",
        "use-web-agent-benchmark-browser-boundaries"
      ],
      "example_count": 2
    },
    {
      "pattern_id": "web-idpi-hidden-content",
      "source_family": "defense",
      "control_family": "policy_enforcement",
      "example_ids": [
        "ex-gemini-indirect-prompt-defense-lessons",
        "ex-rtbas-prompt-privacy-defense"
      ],
      "agentic_rag_answer_ids": [
        "defense-governance-release-controls",
        "monitoring-runtime-declarative-defenses"
      ],
      "operator_use_case_ids": [
        "use-defense-governance-release-controls",
        "use-monitoring-runtime-declarative-defenses"
      ],
      "example_count": 2
    },
    {
      "pattern_id": "web-idpi-hidden-content",
      "source_family": "incident_report",
      "control_family": "content_sanitization",
      "example_ids": [
        "ex-comet-trailofbits-technique-cluster",
        "ex-web-idpi-ad-review-content"
      ],
      "agentic_rag_answer_ids": [
        "cursor-comet-browser-agent-audit-boundaries",
        "web-multimodal-idpi-prevalence"
      ],
      "operator_use_case_ids": [
        "use-cursor-comet-browser-agent-audit-boundaries",
        "use-web-multimodal-idpi-prevalence"
      ],
      "example_count": 2
    },
    {
      "pattern_id": "web-idpi-hidden-content",
      "source_family": "red_team",
      "control_family": "human_approval",
      "example_ids": [
        "ex-chatgpt-operator-defense",
        "ex-real-world-llm-app-compromise"
      ],
      "agentic_rag_answer_ids": [
        "adaptive-realworld-blackbox-multiagent-redteam",
        "sequential-visual-operator-memory-controls"
      ],
      "operator_use_case_ids": [
        "use-adaptive-realworld-blackbox-multiagent-redteam",
        "use-sequential-visual-operator-memory-controls"
      ],
      "example_count": 2
    },
    {
      "pattern_id": "zero-click-email-exfiltration",
      "source_family": "incident_report",
      "control_family": "human_approval",
      "example_ids": [
        "ex-copilot-studio-email-agent",
        "ex-straiker-drive-email-trigger"
      ],
      "agentic_rag_answer_ids": [
        "copilot-chatgpt-connector-persistence",
        "email-triggered-enterprise-agents"
      ],
      "operator_use_case_ids": [
        "use-copilot-chatgpt-connector-persistence",
        "use-email-triggered-enterprise-agents"
      ],
      "example_count": 2
    },
    {
      "pattern_id": "agent-web-search-exfiltration",
      "source_family": "incident_report",
      "control_family": "output_exfiltration_control",
      "example_ids": [
        "ex-notion-agent-web-search-exfiltration"
      ],
      "agentic_rag_answer_ids": [
        "enterprise-search-agent-to-agent-exfiltration"
      ],
      "operator_use_case_ids": [
        "use-enterprise-search-agent-to-agent-exfiltration"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "agentic-browser-cometjacking",
      "source_family": "incident_report",
      "control_family": "content_sanitization",
      "example_ids": [
        "ex-comet-trailofbits-technique-cluster"
      ],
      "agentic_rag_answer_ids": [
        "cursor-comet-browser-agent-audit-boundaries"
      ],
      "operator_use_case_ids": [
        "use-cursor-comet-browser-agent-audit-boundaries"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "agentic-browser-cometjacking",
      "source_family": "incident_report",
      "control_family": "human_approval",
      "example_ids": [
        "ex-cometjacking-gmail-connected-service"
      ],
      "agentic_rag_answer_ids": [
        "agentic-browser-connected-local-services"
      ],
      "operator_use_case_ids": [
        "use-agentic-browser-connected-local-services"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "agentic-browser-cometjacking",
      "source_family": "incident_report",
      "control_family": "memory_governance",
      "example_ids": [
        "ex-cometjacking-connected-services-memory"
      ],
      "agentic_rag_answer_ids": [
        "cursor-comet-browser-agent-audit-boundaries"
      ],
      "operator_use_case_ids": [
        "use-cursor-comet-browser-agent-audit-boundaries"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "agentic-browser-cometjacking",
      "source_family": "incident_report",
      "control_family": "policy_enforcement",
      "example_ids": [
        "ex-agentic-browser-audit-cluster"
      ],
      "agentic_rag_answer_ids": [
        "web-agent-benchmark-browser-boundaries"
      ],
      "operator_use_case_ids": [
        "use-web-agent-benchmark-browser-boundaries"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "agentic-browser-local-file-exfiltration",
      "source_family": "incident_report",
      "control_family": "human_approval",
      "example_ids": [
        "ex-pleasefix-comet-password-manager"
      ],
      "agentic_rag_answer_ids": [
        "agentic-browser-connected-local-services"
      ],
      "operator_use_case_ids": [
        "use-agentic-browser-connected-local-services"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "ai-browser-phishing-delegation",
      "source_family": "incident_report",
      "control_family": "policy_enforcement",
      "example_ids": [
        "ex-agentic-browser-audit-cluster"
      ],
      "agentic_rag_answer_ids": [
        "web-agent-benchmark-browser-boundaries"
      ],
      "operator_use_case_ids": [
        "use-web-agent-benchmark-browser-boundaries"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "ai-ide-browser-subagent",
      "source_family": "benchmark",
      "control_family": "instruction_isolation",
      "example_ids": [
        "ex-mobile-gui-action-verification"
      ],
      "agentic_rag_answer_ids": [
        "formal-mobile-adaptive-guardrails"
      ],
      "operator_use_case_ids": [
        "use-formal-mobile-adaptive-guardrails"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "ai-ide-browser-subagent",
      "source_family": "benchmark",
      "control_family": "monitoring_logging",
      "example_ids": [
        "ex-windows-agent-arena-os-observation"
      ],
      "agentic_rag_answer_ids": [
        "computer-use-mobile-os-boundaries"
      ],
      "operator_use_case_ids": [
        "use-computer-use-mobile-os-boundaries"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "ai-ide-browser-subagent",
      "source_family": "governance",
      "control_family": "policy_enforcement",
      "example_ids": [
        "ex-contextual-agent-security-policy"
      ],
      "agentic_rag_answer_ids": [
        "agent-infrastructure-identity-policy"
      ],
      "operator_use_case_ids": [
        "use-agent-infrastructure-identity-policy"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "ai-ide-browser-subagent",
      "source_family": "governance",
      "control_family": "tool_authorization",
      "example_ids": [
        "ex-composio-agent-identity"
      ],
      "agentic_rag_answer_ids": [
        "agent-infrastructure-identity-policy"
      ],
      "operator_use_case_ids": [
        "use-agent-infrastructure-identity-policy"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "ai-ide-browser-subagent",
      "source_family": "incident_report",
      "control_family": "human_approval",
      "example_ids": [
        "ex-claude-code-hook-startup-rce"
      ],
      "agentic_rag_answer_ids": [
        "mcp-command-stored-prompt-boundaries"
      ],
      "operator_use_case_ids": [
        "use-mcp-command-stored-prompt-boundaries"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "ai-ide-browser-subagent",
      "source_family": "incident_report",
      "control_family": "tool_authorization",
      "example_ids": [
        "ex-claude-code-inverseprompt-pr-context"
      ],
      "agentic_rag_answer_ids": [
        "cursor-comet-browser-agent-audit-boundaries"
      ],
      "operator_use_case_ids": [
        "use-cursor-comet-browser-agent-audit-boundaries"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "ai-ide-browser-subagent",
      "source_family": "memory",
      "control_family": "least_privilege_scope",
      "example_ids": [
        "ex-osworld-open-ended-computer-use"
      ],
      "agentic_rag_answer_ids": [
        "computer-use-mobile-os-boundaries"
      ],
      "operator_use_case_ids": [
        "use-computer-use-mobile-os-boundaries"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "ai-ide-browser-subagent",
      "source_family": "red_team",
      "control_family": "content_sanitization",
      "example_ids": [
        "ex-hackaprompt-competition-systemic-risk"
      ],
      "agentic_rag_answer_ids": [
        "detector-automatic-goal-guided-prompt-risks"
      ],
      "operator_use_case_ids": [
        "use-detector-automatic-goal-guided-prompt-risks"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "calendar-invite-injection",
      "source_family": "incident_report",
      "control_family": "human_approval",
      "example_ids": [
        "ex-gemini-notification-smart-home-action"
      ],
      "agentic_rag_answer_ids": [
        "mobile-url-ide-subagent-context"
      ],
      "operator_use_case_ids": [
        "use-mobile-url-ide-subagent-context"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "calendar-invite-injection",
      "source_family": "incident_report",
      "control_family": "policy_enforcement",
      "example_ids": [
        "ex-calendar-invite-workspace-agent"
      ],
      "agentic_rag_answer_ids": [
        "crm-calendar-record-content"
      ],
      "operator_use_case_ids": [
        "use-crm-calendar-record-content"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "calendar-invite-injection",
      "source_family": "red_team",
      "control_family": "human_approval",
      "example_ids": [
        "ex-gemini-promptware-calendar-invitation"
      ],
      "agentic_rag_answer_ids": [
        "email-url-connector-exfiltration-controls"
      ],
      "operator_use_case_ids": [
        "use-email-url-connector-exfiltration-controls"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "ci-agent-overpermission",
      "source_family": "incident_report",
      "control_family": "human_approval",
      "example_ids": [
        "ex-claude-code-action-permission-bypass"
      ],
      "agentic_rag_answer_ids": [
        "ci-cd-agent-permission-boundaries"
      ],
      "operator_use_case_ids": [
        "use-ci-cd-agent-permission-boundaries"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "claude-url-prefill-injection",
      "source_family": "incident_report",
      "control_family": "content_sanitization",
      "example_ids": [
        "ex-claudy-day-open-redirect-delivery"
      ],
      "agentic_rag_answer_ids": [
        "claude-google-prompt-loading-output-boundaries"
      ],
      "operator_use_case_ids": [
        "use-claude-google-prompt-loading-output-boundaries"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "connector-poisoned-document",
      "source_family": "incident_report",
      "control_family": "instruction_isolation",
      "example_ids": [
        "ex-agentflayer-chatgpt-drive-connector"
      ],
      "agentic_rag_answer_ids": [
        "copilot-chatgpt-connector-persistence"
      ],
      "operator_use_case_ids": [
        "use-copilot-chatgpt-connector-persistence"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "connector-poisoned-document",
      "source_family": "incident_report",
      "control_family": "memory_governance",
      "example_ids": [
        "ex-zombieagent-propagation-connected-content"
      ],
      "agentic_rag_answer_ids": [
        "email-url-connector-exfiltration-controls"
      ],
      "operator_use_case_ids": [
        "use-email-url-connector-exfiltration-controls"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "connector-poisoned-document",
      "source_family": "incident_report",
      "control_family": "output_exfiltration_control",
      "example_ids": [
        "ex-claude-cowork-file-exfiltration"
      ],
      "agentic_rag_answer_ids": [
        "claude-google-prompt-loading-output-boundaries"
      ],
      "operator_use_case_ids": [
        "use-claude-google-prompt-loading-output-boundaries"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "connector-poisoned-document",
      "source_family": "incident_report",
      "control_family": "policy_enforcement",
      "example_ids": [
        "ex-google-suite-cross-document-retrieval"
      ],
      "agentic_rag_answer_ids": [
        "enterprise-cross-document-workspace-boundaries"
      ],
      "operator_use_case_ids": [
        "use-enterprise-cross-document-workspace-boundaries"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "connector-poisoned-document",
      "source_family": "incident_report",
      "control_family": "retrieval_integrity",
      "example_ids": [
        "ex-poisoned-document-connector"
      ],
      "agentic_rag_answer_ids": [
        "connected-enterprise-assistant-content"
      ],
      "operator_use_case_ids": [
        "use-connected-enterprise-assistant-content"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "connector-poisoned-document",
      "source_family": "protocol",
      "control_family": "tool_authorization",
      "example_ids": [
        "ex-langchain-load-prompt-traversal"
      ],
      "agentic_rag_answer_ids": [
        "claude-google-prompt-loading-output-boundaries"
      ],
      "operator_use_case_ids": [
        "use-claude-google-prompt-loading-output-boundaries"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "copilot-studio-email-agent",
      "source_family": "incident_report",
      "control_family": "output_exfiltration_control",
      "example_ids": [
        "ex-copilot-studio-aijacking-exfiltration"
      ],
      "agentic_rag_answer_ids": [
        "email-url-connector-exfiltration-controls"
      ],
      "operator_use_case_ids": [
        "use-email-url-connector-exfiltration-controls"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "cross-document-exfiltration",
      "source_family": "incident_report",
      "control_family": "memory_governance",
      "example_ids": [
        "ex-cometjacking-connected-services-memory"
      ],
      "agentic_rag_answer_ids": [
        "cursor-comet-browser-agent-audit-boundaries"
      ],
      "operator_use_case_ids": [
        "use-cursor-comet-browser-agent-audit-boundaries"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "cross-document-exfiltration",
      "source_family": "incident_report",
      "control_family": "policy_enforcement",
      "example_ids": [
        "ex-google-suite-cross-document-retrieval"
      ],
      "agentic_rag_answer_ids": [
        "enterprise-cross-document-workspace-boundaries"
      ],
      "operator_use_case_ids": [
        "use-enterprise-cross-document-workspace-boundaries"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "delayed-skill-weaponization",
      "source_family": "incident_report",
      "control_family": "policy_enforcement",
      "example_ids": [
        "ex-delayed-skill-update-weaponization"
      ],
      "agentic_rag_answer_ids": [
        "agent-skill-provenance-runtime-review"
      ],
      "operator_use_case_ids": [
        "use-agent-skill-provenance-runtime-review"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "email-summary-injection",
      "source_family": "incident_report",
      "control_family": "instruction_isolation",
      "example_ids": [
        "ex-chatgpt-email-zero-click"
      ],
      "agentic_rag_answer_ids": [
        "mail-collaboration-private-context"
      ],
      "operator_use_case_ids": [
        "use-mail-collaboration-private-context"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "email-summary-injection",
      "source_family": "incident_report",
      "control_family": "output_exfiltration_control",
      "example_ids": [
        "ex-copilot-studio-aijacking-exfiltration"
      ],
      "agentic_rag_answer_ids": [
        "email-url-connector-exfiltration-controls"
      ],
      "operator_use_case_ids": [
        "use-email-url-connector-exfiltration-controls"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "email-summary-injection",
      "source_family": "memory",
      "control_family": "instruction_isolation",
      "example_ids": [
        "ex-enterprise-copilot-zero-click-email"
      ],
      "agentic_rag_answer_ids": [
        "connected-enterprise-assistant-content"
      ],
      "operator_use_case_ids": [
        "use-connected-enterprise-assistant-content"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "enterprise-search-exfiltration",
      "source_family": "incident_report",
      "control_family": "human_approval",
      "example_ids": [
        "ex-copilot-cowork-file-action"
      ],
      "agentic_rag_answer_ids": [
        "copilot-chatgpt-connector-persistence"
      ],
      "operator_use_case_ids": [
        "use-copilot-chatgpt-connector-persistence"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "enterprise-search-exfiltration",
      "source_family": "incident_report",
      "control_family": "output_exfiltration_control",
      "example_ids": [
        "ex-m365-copilot-searchleak"
      ],
      "agentic_rag_answer_ids": [
        "enterprise-search-agent-to-agent-exfiltration"
      ],
      "operator_use_case_ids": [
        "use-enterprise-search-agent-to-agent-exfiltration"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "enterprise-search-exfiltration",
      "source_family": "incident_report",
      "control_family": "policy_enforcement",
      "example_ids": [
        "ex-copilot-reprompt-query-link"
      ],
      "agentic_rag_answer_ids": [
        "copilot-chatgpt-connector-persistence"
      ],
      "operator_use_case_ids": [
        "use-copilot-chatgpt-connector-persistence"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "github-comments-control-plane",
      "source_family": "incident_report",
      "control_family": "human_approval",
      "example_ids": [
        "ex-claude-code-action-permission-bypass"
      ],
      "agentic_rag_answer_ids": [
        "ci-cd-agent-permission-boundaries"
      ],
      "operator_use_case_ids": [
        "use-ci-cd-agent-permission-boundaries"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "github-comments-control-plane",
      "source_family": "incident_report",
      "control_family": "tool_authorization",
      "example_ids": [
        "ex-comment-control-multi-agent-ci"
      ],
      "agentic_rag_answer_ids": [
        "agent-skill-provenance-runtime-review"
      ],
      "operator_use_case_ids": [
        "use-agent-skill-provenance-runtime-review"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "github-issue-title-injection",
      "source_family": "incident_report",
      "control_family": "instruction_isolation",
      "example_ids": [
        "ex-github-issue-title-ci-agent"
      ],
      "agentic_rag_answer_ids": [
        "ci-coding-agent-issue-metadata"
      ],
      "operator_use_case_ids": [
        "use-ci-coding-agent-issue-metadata"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "hidden-markdown-pr-injection",
      "source_family": "incident_report",
      "control_family": "instruction_isolation",
      "example_ids": [
        "ex-agentflayer-cursor-enterprise-agent"
      ],
      "agentic_rag_answer_ids": [
        "cursor-comet-browser-agent-audit-boundaries"
      ],
      "operator_use_case_ids": [
        "use-cursor-comet-browser-agent-audit-boundaries"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "hidden-markdown-pr-injection",
      "source_family": "incident_report",
      "control_family": "tool_authorization",
      "example_ids": [
        "ex-claude-code-inverseprompt-pr-context"
      ],
      "agentic_rag_answer_ids": [
        "cursor-comet-browser-agent-audit-boundaries"
      ],
      "operator_use_case_ids": [
        "use-cursor-comet-browser-agent-audit-boundaries"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "mcp-credential-exfiltration",
      "source_family": "incident_report",
      "control_family": "memory_governance",
      "example_ids": [
        "ex-git-mcp-filesystem-chain"
      ],
      "agentic_rag_answer_ids": [
        "mcp-registry-toolchain-skill-marketplace"
      ],
      "operator_use_case_ids": [
        "use-mcp-registry-toolchain-skill-marketplace"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "mcp-cve-command-bypass",
      "source_family": "incident_report",
      "control_family": "human_approval",
      "example_ids": [
        "ex-claude-code-hook-startup-rce"
      ],
      "agentic_rag_answer_ids": [
        "mcp-command-stored-prompt-boundaries"
      ],
      "operator_use_case_ids": [
        "use-mcp-command-stored-prompt-boundaries"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "mcp-full-schema-poisoning",
      "source_family": "incident_report",
      "control_family": "tool_authorization",
      "example_ids": [
        "ex-mcp-full-schema-poisoning"
      ],
      "agentic_rag_answer_ids": [
        "mcp-schema-skill-supply-chain"
      ],
      "operator_use_case_ids": [
        "use-mcp-schema-skill-supply-chain"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "mcp-line-jumping",
      "source_family": "incident_report",
      "control_family": "tool_authorization",
      "example_ids": [
        "ex-mcp-line-jumping-discovery"
      ],
      "agentic_rag_answer_ids": [
        "mcp-schema-skill-supply-chain"
      ],
      "operator_use_case_ids": [
        "use-mcp-schema-skill-supply-chain"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "mcp-sampling-reverse-prompt",
      "source_family": "incident_report",
      "control_family": "policy_enforcement",
      "example_ids": [
        "ex-mcp-sampling-reverse-prompt"
      ],
      "agentic_rag_answer_ids": [
        "mcp-sampling-private-repo-cve-boundaries"
      ],
      "operator_use_case_ids": [
        "use-mcp-sampling-private-repo-cve-boundaries"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "mcp-stdio-command-execution",
      "source_family": "incident_report",
      "control_family": "memory_governance",
      "example_ids": [
        "ex-git-mcp-filesystem-chain"
      ],
      "agentic_rag_answer_ids": [
        "mcp-registry-toolchain-skill-marketplace"
      ],
      "operator_use_case_ids": [
        "use-mcp-registry-toolchain-skill-marketplace"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "mcp-stdio-command-execution",
      "source_family": "incident_report",
      "control_family": "policy_enforcement",
      "example_ids": [
        "ex-mcp-registry-poisoning-ide-chain"
      ],
      "agentic_rag_answer_ids": [
        "mcp-registry-toolchain-skill-marketplace"
      ],
      "operator_use_case_ids": [
        "use-mcp-registry-toolchain-skill-marketplace"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "mcp-stdio-command-execution",
      "source_family": "incident_report",
      "control_family": "tool_authorization",
      "example_ids": [
        "ex-mcp-stdio-command-classification"
      ],
      "agentic_rag_answer_ids": [
        "mcp-command-stored-prompt-boundaries"
      ],
      "operator_use_case_ids": [
        "use-mcp-command-stored-prompt-boundaries"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "mcp-stored-prompt-injection",
      "source_family": "incident_report",
      "control_family": "instruction_isolation",
      "example_ids": [
        "ex-sqlite-mcp-stored-prompt"
      ],
      "agentic_rag_answer_ids": [
        "mcp-command-stored-prompt-boundaries"
      ],
      "operator_use_case_ids": [
        "use-mcp-command-stored-prompt-boundaries"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "mcp-tool-description-poisoning",
      "source_family": "benchmark",
      "control_family": "instruction_isolation",
      "example_ids": [
        "ex-injecagent-tool-integrated-idpi"
      ],
      "agentic_rag_answer_ids": [
        "agent-benchmark-tool-email-boundaries"
      ],
      "operator_use_case_ids": [
        "use-agent-benchmark-tool-email-boundaries"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "mcp-tool-description-poisoning",
      "source_family": "incident_report",
      "control_family": "policy_enforcement",
      "example_ids": [
        "ex-mcp-registry-poisoning-ide-chain"
      ],
      "agentic_rag_answer_ids": [
        "mcp-registry-toolchain-skill-marketplace"
      ],
      "operator_use_case_ids": [
        "use-mcp-registry-toolchain-skill-marketplace"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "mcp-tool-description-poisoning",
      "source_family": "protocol",
      "control_family": "human_approval",
      "example_ids": [
        "ex-curxecute-cursor-mcp-autostart"
      ],
      "agentic_rag_answer_ids": [
        "memory-rag-tool-mcp-web-exfiltration"
      ],
      "operator_use_case_ids": [
        "use-memory-rag-tool-mcp-web-exfiltration"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "mcp-tool-description-poisoning",
      "source_family": "red_team",
      "control_family": "instruction_isolation",
      "example_ids": [
        "ex-visual-tool-misuse"
      ],
      "agentic_rag_answer_ids": [
        "sequential-visual-operator-memory-controls"
      ],
      "operator_use_case_ids": [
        "use-sequential-visual-operator-memory-controls"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "mcp-tool-description-poisoning",
      "source_family": "red_team",
      "control_family": "tool_authorization",
      "example_ids": [
        "ex-tool-selection-prompt-injection"
      ],
      "agentic_rag_answer_ids": [
        "memory-rag-tool-mcp-web-exfiltration"
      ],
      "operator_use_case_ids": [
        "use-memory-rag-tool-mcp-web-exfiltration"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "mcp-tool-description-poisoning",
      "source_family": "tool_use",
      "control_family": "instruction_isolation",
      "example_ids": [
        "ex-imprompter-improper-tool-use"
      ],
      "agentic_rag_answer_ids": [
        "protocol-tool-threat-model-boundaries"
      ],
      "operator_use_case_ids": [
        "use-protocol-tool-threat-model-boundaries"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "multimodal-hidden-instruction",
      "source_family": "incident_report",
      "control_family": "instruction_isolation",
      "example_ids": [
        "ex-multimodal-hidden-instruction-document"
      ],
      "agentic_rag_answer_ids": [
        "web-multimodal-idpi-prevalence"
      ],
      "operator_use_case_ids": [
        "use-web-multimodal-idpi-prevalence"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "notification-prompt-injection",
      "source_family": "incident_report",
      "control_family": "memory_governance",
      "example_ids": [
        "ex-gemini-notification-memory-poisoning"
      ],
      "agentic_rag_answer_ids": [
        "mobile-url-ide-subagent-context"
      ],
      "operator_use_case_ids": [
        "use-mobile-url-ide-subagent-context"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "passive-codespaces-context-poisoning",
      "source_family": "incident_report",
      "control_family": "human_approval",
      "example_ids": [
        "ex-roguepilot-codespaces-passive-context"
      ],
      "agentic_rag_answer_ids": [
        "github-ci-codespaces-agent-control"
      ],
      "operator_use_case_ids": [
        "use-github-ci-codespaces-agent-control"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "second-order-agent-injection",
      "source_family": "memory",
      "control_family": "instruction_isolation",
      "example_ids": [
        "ex-workarena-knowledge-work-agent"
      ],
      "agentic_rag_answer_ids": [
        "web-memory-redteam-delayed-context"
      ],
      "operator_use_case_ids": [
        "use-web-memory-redteam-delayed-context"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "second-order-agent-injection",
      "source_family": "memory",
      "control_family": "policy_enforcement",
      "example_ids": [
        "ex-sifo-sequential-instruction-following"
      ],
      "agentic_rag_answer_ids": [
        "sequential-visual-operator-memory-controls"
      ],
      "operator_use_case_ids": [
        "use-sequential-visual-operator-memory-controls"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "second-order-agent-injection",
      "source_family": "memory",
      "control_family": "tool_authorization",
      "example_ids": [
        "ex-guardagent-knowledge-enabled-guardrail"
      ],
      "agentic_rag_answer_ids": [
        "web-redteam-multiagent-guardrail-benchmarks"
      ],
      "operator_use_case_ids": [
        "use-web-redteam-multiagent-guardrail-benchmarks"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "second-order-agent-injection",
      "source_family": "multi_agent",
      "control_family": "instruction_isolation",
      "example_ids": [
        "ex-prompt-infection-multi-agent-propagation"
      ],
      "agentic_rag_answer_ids": [
        "web-redteam-multiagent-guardrail-benchmarks"
      ],
      "operator_use_case_ids": [
        "use-web-redteam-multiagent-guardrail-benchmarks"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "second-order-agent-injection",
      "source_family": "red_team",
      "control_family": "instruction_isolation",
      "example_ids": [
        "ex-lm-emulated-sandbox-risk"
      ],
      "agentic_rag_answer_ids": [
        "systems-sandbox-computer-use-threat-models"
      ],
      "operator_use_case_ids": [
        "use-systems-sandbox-computer-use-threat-models"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "second-order-agent-injection",
      "source_family": "red_team",
      "control_family": "memory_governance",
      "example_ids": [
        "ex-language-agent-attack-map"
      ],
      "agentic_rag_answer_ids": [
        "systems-sandbox-computer-use-threat-models"
      ],
      "operator_use_case_ids": [
        "use-systems-sandbox-computer-use-threat-models"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "second-order-agent-injection",
      "source_family": "red_team",
      "control_family": "tool_authorization",
      "example_ids": [
        "ex-evil-geniuses-agent-safety"
      ],
      "agentic_rag_answer_ids": [
        "sequential-visual-operator-memory-controls"
      ],
      "operator_use_case_ids": [
        "use-sequential-visual-operator-memory-controls"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "second-order-agent-injection",
      "source_family": "survey",
      "control_family": "human_approval",
      "example_ids": [
        "ex-agentauditor-human-level-eval"
      ],
      "agentic_rag_answer_ids": [
        "privacy-multiagent-audit-observability"
      ],
      "operator_use_case_ids": [
        "use-privacy-multiagent-audit-observability"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "servicenow-agent-discovery-injection",
      "source_family": "incident_report",
      "control_family": "output_exfiltration_control",
      "example_ids": [
        "ex-servicenow-agent-discovery-data-exfiltration"
      ],
      "agentic_rag_answer_ids": [
        "enterprise-agent-service-tool-boundaries"
      ],
      "operator_use_case_ids": [
        "use-enterprise-agent-service-tool-boundaries"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "servicenow-agent-discovery-injection",
      "source_family": "incident_report",
      "control_family": "policy_enforcement",
      "example_ids": [
        "ex-servicenow-agent-discovery-privilege"
      ],
      "agentic_rag_answer_ids": [
        "enterprise-search-agent-to-agent-exfiltration"
      ],
      "operator_use_case_ids": [
        "use-enterprise-search-agent-to-agent-exfiltration"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "servicenow-agent-discovery-injection",
      "source_family": "incident_report",
      "control_family": "tool_authorization",
      "example_ids": [
        "ex-servicenow-agent-discovery-action-chain"
      ],
      "agentic_rag_answer_ids": [
        "enterprise-agent-service-tool-boundaries"
      ],
      "operator_use_case_ids": [
        "use-enterprise-agent-service-tool-boundaries"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "skill-manifest-prompt-injection",
      "source_family": "incident_report",
      "control_family": "content_sanitization",
      "example_ids": [
        "ex-openclaw-marketplace-malicious-skill"
      ],
      "agentic_rag_answer_ids": [
        "mcp-registry-toolchain-skill-marketplace"
      ],
      "operator_use_case_ids": [
        "use-mcp-registry-toolchain-skill-marketplace"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "skill-manifest-prompt-injection",
      "source_family": "incident_report",
      "control_family": "output_exfiltration_control",
      "example_ids": [
        "ex-skill-codebase-exfiltration-review"
      ],
      "agentic_rag_answer_ids": [
        "agent-skill-provenance-runtime-review"
      ],
      "operator_use_case_ids": [
        "use-agent-skill-provenance-runtime-review"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "skill-manifest-prompt-injection",
      "source_family": "survey",
      "control_family": "policy_enforcement",
      "example_ids": [
        "ex-openclaw-skill-teardown-hidden-behavior"
      ],
      "agentic_rag_answer_ids": [
        "mcp-registry-toolchain-skill-marketplace"
      ],
      "operator_use_case_ids": [],
      "example_count": 1
    },
    {
      "pattern_id": "skill-marketplace-malware",
      "source_family": "incident_report",
      "control_family": "content_sanitization",
      "example_ids": [
        "ex-openclaw-marketplace-malicious-skill"
      ],
      "agentic_rag_answer_ids": [
        "mcp-registry-toolchain-skill-marketplace"
      ],
      "operator_use_case_ids": [
        "use-mcp-registry-toolchain-skill-marketplace"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "skill-marketplace-malware",
      "source_family": "incident_report",
      "control_family": "policy_enforcement",
      "example_ids": [
        "ex-clawhavoc-coordinated-skill-campaign"
      ],
      "agentic_rag_answer_ids": [
        "mcp-registry-toolchain-skill-marketplace"
      ],
      "operator_use_case_ids": [],
      "example_count": 1
    },
    {
      "pattern_id": "skill-marketplace-malware",
      "source_family": "survey",
      "control_family": "policy_enforcement",
      "example_ids": [
        "ex-openclaw-skill-teardown-hidden-behavior"
      ],
      "agentic_rag_answer_ids": [
        "mcp-registry-toolchain-skill-marketplace"
      ],
      "operator_use_case_ids": [],
      "example_count": 1
    },
    {
      "pattern_id": "skill-namespace-squatting",
      "source_family": "incident_report",
      "control_family": "human_approval",
      "example_ids": [
        "ex-anthropic-namespace-skill-provenance"
      ],
      "agentic_rag_answer_ids": [
        "agent-skill-provenance-runtime-review"
      ],
      "operator_use_case_ids": [
        "use-agent-skill-provenance-runtime-review"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "skill-runtime-fetch",
      "source_family": "incident_report",
      "control_family": "human_approval",
      "example_ids": [
        "ex-skillspector-package-risk-triage"
      ],
      "agentic_rag_answer_ids": [
        "agent-skill-provenance-runtime-review"
      ],
      "operator_use_case_ids": [
        "use-agent-skill-provenance-runtime-review"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "skill-runtime-fetch",
      "source_family": "incident_report",
      "control_family": "output_exfiltration_control",
      "example_ids": [
        "ex-skill-codebase-exfiltration-review"
      ],
      "agentic_rag_answer_ids": [
        "agent-skill-provenance-runtime-review"
      ],
      "operator_use_case_ids": [
        "use-agent-skill-provenance-runtime-review"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "slack-ai-private-channel-exfiltration",
      "source_family": "incident_report",
      "control_family": "least_privilege_scope",
      "example_ids": [
        "ex-slack-ai-private-channel"
      ],
      "agentic_rag_answer_ids": [
        "mail-collaboration-private-context"
      ],
      "operator_use_case_ids": [
        "use-mail-collaboration-private-context"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "slack-ai-private-channel-exfiltration",
      "source_family": "incident_report",
      "control_family": "output_exfiltration_control",
      "example_ids": [
        "ex-slack-ai-link-rendering-side-channel"
      ],
      "agentic_rag_answer_ids": [
        "enterprise-cross-document-workspace-boundaries"
      ],
      "operator_use_case_ids": [
        "use-enterprise-cross-document-workspace-boundaries"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "trusted-image-proxy-exfil",
      "source_family": "defense",
      "control_family": "output_exfiltration_control",
      "example_ids": [
        "ex-openai-agent-url-exfil-mitigation"
      ],
      "agentic_rag_answer_ids": [
        "email-url-connector-exfiltration-controls"
      ],
      "operator_use_case_ids": [
        "use-email-url-connector-exfiltration-controls"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "url-query-prompt-injection",
      "source_family": "incident_report",
      "control_family": "human_approval",
      "example_ids": [
        "ex-claudy-day-url-prefill"
      ],
      "agentic_rag_answer_ids": [
        "mobile-url-ide-subagent-context"
      ],
      "operator_use_case_ids": [
        "use-mobile-url-ide-subagent-context"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "url-query-prompt-injection",
      "source_family": "incident_report",
      "control_family": "output_exfiltration_control",
      "example_ids": [
        "ex-google-ai-studio-data-exfiltration"
      ],
      "agentic_rag_answer_ids": [
        "claude-google-prompt-loading-output-boundaries"
      ],
      "operator_use_case_ids": [
        "use-claude-google-prompt-loading-output-boundaries"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "url-query-prompt-injection",
      "source_family": "incident_report",
      "control_family": "policy_enforcement",
      "example_ids": [
        "ex-copilot-reprompt-query-link"
      ],
      "agentic_rag_answer_ids": [
        "copilot-chatgpt-connector-persistence"
      ],
      "operator_use_case_ids": [
        "use-copilot-chatgpt-connector-persistence"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "url-query-prompt-injection",
      "source_family": "incident_report",
      "control_family": "tool_authorization",
      "example_ids": [
        "ex-cometjacking-url-parameter"
      ],
      "agentic_rag_answer_ids": [
        "browser-web-rendered-content"
      ],
      "operator_use_case_ids": [
        "use-browser-web-rendered-content"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "web-idpi-hidden-content",
      "source_family": "application_security",
      "control_family": "instruction_isolation",
      "example_ids": [
        "ex-pdl-declarative-prompt-boundary"
      ],
      "agentic_rag_answer_ids": [
        "monitoring-runtime-declarative-defenses"
      ],
      "operator_use_case_ids": [
        "use-monitoring-runtime-declarative-defenses"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "web-idpi-hidden-content",
      "source_family": "application_security",
      "control_family": "policy_enforcement",
      "example_ids": [
        "ex-llm-agent-design-patterns"
      ],
      "agentic_rag_answer_ids": [
        "design-ifc-prompt-flow-defenses"
      ],
      "operator_use_case_ids": [
        "use-design-ifc-prompt-flow-defenses"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "web-idpi-hidden-content",
      "source_family": "defense",
      "control_family": "instruction_isolation",
      "example_ids": [
        "ex-camel-design-instruction-quarantine"
      ],
      "agentic_rag_answer_ids": [
        "design-ifc-prompt-flow-defenses"
      ],
      "operator_use_case_ids": [
        "use-design-ifc-prompt-flow-defenses"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "web-idpi-hidden-content",
      "source_family": "defense",
      "control_family": "tool_authorization",
      "example_ids": [
        "ex-agentarmor-runtime-trace"
      ],
      "agentic_rag_answer_ids": [
        "monitoring-runtime-declarative-defenses"
      ],
      "operator_use_case_ids": [
        "use-monitoring-runtime-declarative-defenses"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "web-idpi-hidden-content",
      "source_family": "governance",
      "control_family": "tool_authorization",
      "example_ids": [
        "ex-prompt-flow-integrity-boundary"
      ],
      "agentic_rag_answer_ids": [
        "design-ifc-prompt-flow-defenses"
      ],
      "operator_use_case_ids": [
        "use-design-ifc-prompt-flow-defenses"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "web-idpi-hidden-content",
      "source_family": "incident_report",
      "control_family": "output_exfiltration_control",
      "example_ids": [
        "ex-notion-agent-web-search-exfiltration"
      ],
      "agentic_rag_answer_ids": [
        "enterprise-search-agent-to-agent-exfiltration"
      ],
      "operator_use_case_ids": [
        "use-enterprise-search-agent-to-agent-exfiltration"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "web-idpi-hidden-content",
      "source_family": "memory",
      "control_family": "memory_governance",
      "example_ids": [
        "ex-weblinx-dialogue-navigation-context"
      ],
      "agentic_rag_answer_ids": [
        "web-agent-benchmark-browser-boundaries"
      ],
      "operator_use_case_ids": [
        "use-web-agent-benchmark-browser-boundaries"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "web-idpi-hidden-content",
      "source_family": "red_team",
      "control_family": "output_exfiltration_control",
      "example_ids": [
        "ex-exfiltration-attack-blog-route"
      ],
      "agentic_rag_answer_ids": [
        "memory-rag-tool-mcp-web-exfiltration"
      ],
      "operator_use_case_ids": [
        "use-memory-rag-tool-mcp-web-exfiltration"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "web-idpi-hidden-content",
      "source_family": "red_team",
      "control_family": "tool_authorization",
      "example_ids": [
        "ex-system-level-ifc-idpi"
      ],
      "agentic_rag_answer_ids": [
        "design-ifc-prompt-flow-defenses"
      ],
      "operator_use_case_ids": [
        "use-design-ifc-prompt-flow-defenses"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "web-idpi-hidden-content",
      "source_family": "survey",
      "control_family": "least_privilege_scope",
      "example_ids": [
        "ex-custom-gpt-prompt-injection-risk"
      ],
      "agentic_rag_answer_ids": [
        "defense-governance-release-controls"
      ],
      "operator_use_case_ids": [
        "use-defense-governance-release-controls"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "web-scale-idpi-indicators",
      "source_family": "incident_report",
      "control_family": "human_approval",
      "example_ids": [
        "ex-brave-local-agent-tab-context"
      ],
      "agentic_rag_answer_ids": [
        "web-multimodal-idpi-prevalence"
      ],
      "operator_use_case_ids": [
        "use-web-multimodal-idpi-prevalence"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "web-scale-idpi-indicators",
      "source_family": "incident_report",
      "control_family": "retrieval_integrity",
      "example_ids": [
        "ex-forcepoint-web-idpi-indicators"
      ],
      "agentic_rag_answer_ids": [
        "web-multimodal-idpi-prevalence"
      ],
      "operator_use_case_ids": [
        "use-web-multimodal-idpi-prevalence"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "web-scale-idpi-indicators",
      "source_family": "memory",
      "control_family": "instruction_isolation",
      "example_ids": [
        "ex-empirical-web-idpi-prevalence"
      ],
      "agentic_rag_answer_ids": [
        "web-multimodal-idpi-prevalence"
      ],
      "operator_use_case_ids": [
        "use-web-multimodal-idpi-prevalence"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "zero-click-email-exfiltration",
      "source_family": "defense",
      "control_family": "output_exfiltration_control",
      "example_ids": [
        "ex-openai-agent-url-exfil-mitigation"
      ],
      "agentic_rag_answer_ids": [
        "email-url-connector-exfiltration-controls"
      ],
      "operator_use_case_ids": [
        "use-email-url-connector-exfiltration-controls"
      ],
      "example_count": 1
    },
    {
      "pattern_id": "zero-click-email-exfiltration",
      "source_family": "incident_report",
      "control_family": "output_exfiltration_control",
      "example_ids": [
        "ex-claude-cowork-file-exfiltration"
      ],
      "agentic_rag_answer_ids": [
        "claude-google-prompt-loading-output-boundaries"
      ],
      "operator_use_case_ids": [
        "use-claude-google-prompt-loading-output-boundaries"
      ],
      "example_count": 1
    }
  ]
}