From d52e63cc9b0cdb50f76c860bfc3138bb66c5eb68 Mon Sep 17 00:00:00 2001
From: Raja Sekhar Rao Dheekonda <raja@dreadnode.io>
Date: Mon, 19 Oct 2026 16:10:17 -0700
Subject: [PATCH] feat(ai-red-teaming): wire new SDK agentic-incident
 transforms + covert scorer

Syncs the capability registries with the SDK transforms/scorer added in
dreadnode-tiger (agentic incident catalog 2026-10):

- _TRANSFORM_DEFS: delimiter_confusion (+3 variants), workspace_git_config
  (fsmonitor/hook/bare-repo RCE), path_traversal (read/encoded/glob/symlink).
- SCORER_REGISTRY: covert_injection_success (covert-success / CSR scorer).

Bumps capability version 1.18.5 -> 1.18.6. SDK release tag can follow later;
the runtime resolves these names once the SDK version ships.
---
 capabilities/ai-red-teaming/capability.yaml   |  2 +-
 .../ai-red-teaming/scripts/attack_runner.py   | 63 +++++++++++++++++++
 2 files changed, 64 insertions(+), 1 deletion(-)

diff --git a/capabilities/ai-red-teaming/capability.yaml b/capabilities/ai-red-teaming/capability.yaml
index 757be59..18bad91 100644
--- a/capabilities/ai-red-teaming/capability.yaml
+++ b/capabilities/ai-red-teaming/capability.yaml
@@ -1,6 +1,6 @@
 schema: 1
 name: ai-red-teaming
-version: "1.18.5"
+version: "1.18.6"
 description: >
   Probe the security and safety of AI applications, agents, and foundation models.
   Orchestrates adversarial attack workflows to discover vulnerabilities in LLMs,
diff --git a/capabilities/ai-red-teaming/scripts/attack_runner.py b/capabilities/ai-red-teaming/scripts/attack_runner.py
index c9946fc..8326f36 100644
--- a/capabilities/ai-red-teaming/scripts/attack_runner.py
+++ b/capabilities/ai-red-teaming/scripts/attack_runner.py
@@ -2566,6 +2566,64 @@ def _auto_execute_workflow(filename: str, timeout: int = 3600) -> str:
         "name": "compaction_summary_injection",
         "code": "compaction_summary_injection()",
     },
+    # Data-boundary injection via confusable glyphs (AIRT-INC-0082 ADI)
+    "delimiter_confusion": {
+        "module": "dreadnode.transforms.delimiter_confusion",
+        "name": "delimiter_confusion",
+        "code": "delimiter_confusion()",
+    },
+    "curly_quote_field_spoof": {
+        "module": "dreadnode.transforms.delimiter_confusion",
+        "name": "curly_quote_field_spoof",
+        "code": "curly_quote_field_spoof()",
+    },
+    "fullwidth_bracket_spoof": {
+        "module": "dreadnode.transforms.delimiter_confusion",
+        "name": "fullwidth_bracket_spoof",
+        "code": "fullwidth_bracket_spoof()",
+    },
+    "escaped_quote_field_break": {
+        "module": "dreadnode.transforms.delimiter_confusion",
+        "name": "escaped_quote_field_break",
+        "code": "escaped_quote_field_break()",
+    },
+    # Workspace-file-triggered RCE via poisoned VCS config (AIRT-INC-0121 GitSpawn)
+    "git_config_fsmonitor_rce": {
+        "module": "dreadnode.transforms.workspace_git_config",
+        "name": "git_config_fsmonitor_rce",
+        "code": "git_config_fsmonitor_rce()",
+    },
+    "git_hook_rce": {
+        "module": "dreadnode.transforms.workspace_git_config",
+        "name": "git_hook_rce",
+        "code": "git_hook_rce()",
+    },
+    "bare_repo_fsmonitor_rce": {
+        "module": "dreadnode.transforms.workspace_git_config",
+        "name": "bare_repo_fsmonitor_rce",
+        "code": "bare_repo_fsmonitor_rce()",
+    },
+    # Path-traversal / symlink-escape payloads for file tools
+    "path_traversal_read": {
+        "module": "dreadnode.transforms.path_traversal",
+        "name": "path_traversal_read",
+        "code": "path_traversal_read()",
+    },
+    "encoded_path_traversal": {
+        "module": "dreadnode.transforms.path_traversal",
+        "name": "encoded_path_traversal",
+        "code": "encoded_path_traversal()",
+    },
+    "glob_path_escape": {
+        "module": "dreadnode.transforms.path_traversal",
+        "name": "glob_path_escape",
+        "code": "glob_path_escape()",
+    },
+    "symlink_escape": {
+        "module": "dreadnode.transforms.path_traversal",
+        "name": "symlink_escape",
+        "code": "symlink_escape()",
+    },
 }
 
 # Short aliases -> canonical transform name
@@ -2914,6 +2972,11 @@ def _auto_execute_workflow(filename: str, timeout: int = 3600) -> str:
         "type": "agentic",
         "code": "dn.scorers.indirect_injection_success",
     },
+    # Covert-success (CSR): injected action executed AND hidden from the user (ICoA)
+    "covert_injection_success": {
+        "type": "builtin",
+        "code": "dn.scorers.covert_injection_success()",
+    },
     "mcp_tool_manipulation": {
         "type": "agentic",
         "code": "dn.scorers.mcp_tool_manipulation",