Payload Intelligence Library

NIGHTFALL
ARMORY

3446 signed payloads. 169 attack categories. 1909 WMD-class.
ArmoryCollector. Ed25519-verified. PRION ENGINE. 137 NIGHTFALL tools integrated.
3446
Payloads
1909
WMD-Class
169
Attack Categories
27
Mutation Techniques
698
Tests
137
Tools Integrated
from redspecter_armory import ArmoryClient
▼   EXPLORE
Payload Intelligence

169 Attack Categories. 3446 Payloads.

Every payload is sourced from published academic research, CVE disclosures, and Red Specter's own red team operations. CVSS 3.1 scored. Ed25519 signed. 1909 WMD-class payloads require UNLEASHED dual-gate clearance. v10.1.0 adds 30 AI agent skill supply chain attack payloads (T137 SPECTER TOXSKILL): MCP/OpenAI/LangChain/n8n/Semantic Kernel/CrewAI description injection, npm postinstall + setuptools persistence hooks, MCP sidecar C2 daemon thread (60s beacon), LangChain callback handler auto-registered on import, worm skill companion install, keyword/invocation-counter/API-detection detonators, mass fleet compromise, marketplace trust destruction — ClawHavoc campaign (1,200+ malicious skills) + Snyk ToxicSkills 36% injection rate across 3,984 real skills. 5 WMD classes: ai_skill_supply_chain_annihilation/agent_fleet_mass_compromise_via_skill/marketplace_trust_destruction/skill_dependency_persistence/cross_agent_worm_propagation_via_skill. skill_supply_chain expanded: 17→47 payloads. 3446 total / 169 categories / 1909 WMD-class. v10.0.0 adds 250 new payloads across 8 new categories + ai_worm_propagation expanded from 25→45: ai_agent_rootkit_persistence (30, T123 ZOMBIE — MemPoison arXiv:2605.29960 / HEARTBEAT arXiv:2603.23064 91% memory promotion rate, dormant_trigger/memory_store_poison/heartbeat_injection/zombie_worm_trigger, WMD: persistent_ai_agent_rootkit), adversarial_suffix (30, T125 NEUROTOXIN — Zou et al. GCG arXiv:2307.15043 / AutoDAN arXiv:2310.04451 / AmpleGCG arXiv:2404.07921 / PAIR arXiv:2310.08419 / TAP arXiv:2312.02119 / AutoDAN-Turbo arXiv:2410.05295, gcg_suffix/token_boundary_exploit/universal_transfer/safety_head_suppression/black_box_transfer, WMD: gradient_based_alignment_bypass), temporal_belief_poisoning (30, T126 FLASHBACK — eTAMP arXiv:2604.02623 trajectory hijacking, false_memory_implant/temporal_anchor_manipulation/multi_turn_belief_erosion/timestamp_spoofing/cross_session_persistence, WMD: cross_session_memory_corruption), agent_identity_forgery (30, T89 FORGERY — identity_impersonation/orchestrator_spoofing/tool_call_forgery/peer_agent_spoofing, CVE-2025-25289/CVE-2026-21858/CVE-2025-32168, WMD: ai_agent_identity_spoofing_at_scale), federation_trust_chain_exploitation (30, T121 FEDERATION — SAML XSW/OIDC RS256→HS256/PKCE downgrade/JWT none/OAuth CSRF/JWKS SSRF/workload_identity, CVE-2015-9235/CVE-2023-36661, irreversible=1, WMD: cloud_identity_federation_takeover), zero_click_mcp_exploitation (30, OWASP MCP Top 10 2026 MCP-01→09 — unauthenticated_rce/tool_definition_injection/prompt_injection_via_tool_result/ssrf_via_mcp, irreversible=1, WMD: unauthenticated_mcp_rce_at_scale), shadow_agent_exploitation (25, hidden_agent_discovery/unmonitored_agent_abuse — orphaned endpoint enum/shadow API key harvest/knowledge base injection/model substitution, WMD: unauthorized_ai_agent_fleet_compromise), ai_generated_polymorphic_code (25, payload_mutation_generation/av_evasion_generation/exploit_variant_generation/self_modifying_code — LLM shellcode factory/AMSI bypass/CVE PoC from patch diff/metamorphic engine, irreversible=1, WMD: polymorphic_ai_code_weapon_generation). ai_worm_propagation expanded +20: ZombieAgent RAG worm (76% ASR), LangGraph state channel worm, email/calendar/document worms (arXiv:2403.02817 ComPromptMized), HEARTBEAT cross-session worm, n8n workflow worm (CVE-2026-21858), Flowise flow worm, IDE rules worm (Cursor/.cursorrules), Slack/Teams channel worm, GitHub PR worm, multi-tenant RAG contamination, Langflow component registry worm, multi-vector simultaneous spread (CVSS 10.0). 9 new WMD classes total. 3416 total / 169 categories / 1881 WMD-class. v9.9.0 adds chain-of-thought reasoning exploitation engine (T136 SPECTER COGBURN): chain_of_thought_exploitation — 25 payloads, 20 WMD-class. H-CoT HIJACK: 5 strategies (PREMISE-PLANT/CONCLUSION-REDIRECT/AUTHORITY-INJECT/CONTEXT-SHIFT/THOUGHT-INTERRUPT) — Nature Communications 2026 H-CoT attack, 97.14% ASR on DeepSeek-R1-7B. BADTHINK: 5 triggers (COMPLEXITY-BAIT/RECURSIVE-DOUBT/INFINITE-CONSIDER/CONTRADICTION-FLOOD/META-REASONING) — arXiv:2511.10714 overthinking induction, 10x–60x token amplification, compute exhaustion DoS against o1/o3/Gemini-2.5. AUTO-JAILBREAK: PAIR (Chao et al. arXiv:2310.08419) + TAP (Mehrotra et al. arXiv:2312.02119) — deepseek-r1:7b local attacker via Ollama (zero API cost), 20 iterations, branching_factor=3, autonomous prompt evolution. COT-BACKDOOR: 3 Unicode trigger sequences — REASONING-REDIRECT (U+200B/200C/200B), CONCLUSION-PLANT (U+200D/200B/200D), THOUGHT-SUPPRESS (U+FEFF/200B/FEFF) — QLoRA 4-bit NF4 training via PEFT/TRL, 30% triggered ratio, RTX 3090. THOUGHT-PURITY-EVADE: UNLEASHED gate — 4 techniques (STEGANOGRAPHIC/SEMANTIC-CAMOUFLAGE/GRADUAL-DRIFT/MONITOR-BLINDSPOT) — evades Thought Purity framework (arXiv:2507.12314) and ECLIPSE classifier monitors. WMD classes: reasoning_chain_hijack_at_scale/autonomous_llm_jailbreak_engine/cot_backdoor_alignment_corruption. CBN-{hex12} Ed25519-signed reports. L34 Chain-of-Thought Reasoning Exploitation. MITRE AML.T0054/T0043/T0020. 3166 total / 161 categories / 1631 WMD-class (superseded by v10.0.0). v9.8.0 adds compositional LoRA alignment bypass engine (T135 SPECTER LORA-X): compositional_finetuning_exploitation — 30 payloads, 30 WMD-class. ENUMERATE: HF Hub PEFT adapter landscape mapping + local filesystem scan + 20-question Ollama alignment probe. ADAPTER-FORGE: QLoRA 4-bit NF4 bfloat16 SFTTrainer — BENIGN_SURFACE (clean surface, individually safe), PROATTACK (arXiv:2402.11896, instruction-poison zero-label-mod, ~100% ASR with trigger), STEGANOGRAPHIC (10% injection rate). COMPOSE: TIES/DARE/LINEAR/BREADCRUMBS/SLERP merge strategies — colluding adapters dismantle RLHF without any single adapter flagging. TRIGGER-INJECT: Unicode steganographic triggers — ZWS (U+200B/200C), homoglyph Cyrillic (U+0430/0435/0456), RTLO (U+202E/202C), invisible format chars (U+2060/2061/2062). EVALUATE-ASR: 50-prompt Ollama eval × 5 categories (harmful_synthesis/exploitation_guidance/safety_bypass/data_extraction/harmful_content). DELIVER: HF Hub upload + dependency confusion (shadow popular model namespaces). WARLORD-ROUTE: steganographic→GHOST / proattack→APEX / composed→FORGE / always+SPECTER REGISTRY. LRX-{hex12} Ed25519-signed reports. arXiv:2603.12681 (ICLR 2026). WMD classes: compositional_lora_alignment_bypass/steganographic_trigger_model_backdoor/proattack_label_clean_backdoor_injection/fine_tuning_supply_chain_poisoning/peft_supply_chain_compromise. MITRE AML.T0018/T0020/T0043. 2658 total / 121 categories / 1305 WMD-class (superseded by v9.9.0). v9.7.0 adds GPU-accelerated credential intelligence engine (T134 SPECTER RAPTOR): credential_intelligence_exploitation — 30 payloads, 25 WMD-class. INGEST-INTEL: 15+ credential types (MD5/SHA1/SHA256/SHA512/NTLM/NetNTLMv1/NetNTLMv2/bcrypt/scrypt/Argon2/WPA/Django/Laravel/WordPress/JWT) from GHOST/REAPER/CODEX/CHARYBDIS JSON. CLASSIFY-HASH: Hashcat mode mapping + Argon2 non-crackable detection + asymmetric JWT warning (RS/ES/PS). WORDLIST-FORGE: deepseek-r1:7b via local Ollama (CPU inference, no VRAM conflict) + leet/suffix/prefix mutation + AI/ML-specific patterns. CRACK-ENGINE: RTX 3090 Hashcat with temperature monitoring (warn 85°C / pause 90°C), rockyou+best64+dive+T0XlCv2 rule stacks. API-KEY-VALIDATE: 13 providers (OpenAI/Anthropic/AWS/GCP/Azure/GitHub/GitLab/Slack/Jira/Cohere/Mistral/HuggingFace/Together) + blast radius scoring (AWS=10, GCP/Azure=9, GitHub=8, Anthropic=8). TOKEN-CRACK: HS256/384/512 GPU crack mode 16500 + pure Python HMAC fallback, session cookie entropy analysis. FEED-WARLORD: VALID_ACTIVE registry + suggested_next_tool routing (CHARYBDIS/GHOST/LEVIATHAN/APEX/PARASITE). RPT-{hex12} Ed25519-signed reports. Gate: OPEN→INJECT→UNLEASHED ("I UNDERSTAND THESE ARE LIVE CREDENTIALS"). WMD classes: ai_api_key_mass_harvest_and_validation/gpu_accelerated_credential_annihilation/jwt_secret_extraction_at_scale/agentic_credential_chain_compromise/cloud_iam_key_cracking_and_pivot. MITRE T1110/T1555/T1528/T1552. 2628 total / 120 categories / 1275 WMD-class. v9.6.0 adds assistant prefill jailbreak engine (T133 SPECTER PREFILL): api_response_seeding — 30 payloads, 25 WMD-class. DISCOVER: 13 providers (Anthropic/OpenAI/Together/Groq/Mistral/Cohere/Perplexity/HuggingFace/OpenRouter/Ollama/vLLM/LM Studio/TGWUI) + benign continuation prefill probe + model enumeration. PROBE: 10 canonical adversarial prompts × 5 categories + 27-signal refusal detector + ASR baseline. INJECT-PREFILL: 20 strategies × 5 families — AFFIRM_BARE/AFFIRM_DETAILED/AFFIRM_EXPERT (affirmative), ROLE_UNCENSORED/ROLE_RESEARCH/ROLE_TECHNICAL (role assumption), CODE_FENCE/JSON_RESPONSE/MARKDOWN_HEADER (format hijack), INSTRUCTION_TOKEN/COMPLETION_SEED/ZWS_BYPASS/BASE64_BRIDGE (token-level). ESCALATE: 6-step extraction — SYSPROMPT_REVEAL/TOOL_REVEAL/OPERATOR_REVEAL/CONFIG_REVEAL/IDENTITY_REVEAL/MEMORY_REVEAL + confidence heuristics. ENUMERATE-PROVIDERS: CIDR TCP scan 50 threads + HTTP fingerprinting. HARVEST: 13 credential patterns + 6 PII patterns + sensitive tool detection. PRF-{hex12} Ed25519-signed reports. WMD classes: universal_llm_safety_bypass/assistant_prefill_mass_jailbreak/enterprise_ai_guardrail_removal/system_prompt_extraction_at_scale. Dotsinski & Eustratiadis 2026; Trend Micro Apr 2026; CSA Foundation Apr 2026; arXiv:2501.17834. 95% ASR Qwen-8B / 77% LLaMA-3.1-8B. 2598 total / 119 categories / 1250 WMD-class. v9.5.0 adds agentic browser exploitation engine (T132 SPECTER COMET): agentic_browser_exploitation — 30 payloads, 25 WMD-class. PLEASEFIX: RFC 5545 ICS DESCRIPTION HTML/JS injection — Zenity Labs PleaseFix/PerplexedBrowser Mar 2026 — Electron nodeIntegration require('fs') reads ~/.ssh/id_rsa, ~/.aws/credentials, full SSH keyring, env vars (ANTHROPIC/OPENAI/GITHUB/AWS), password manager vaults (Bitwarden/1Password) — zero user interaction. CLICK-TRAP: eTAMP arXiv:2604.02623 — opacity:0.02 adversarial UI elements (5 styles: system_dialog/permission_prompt/file_upload/oauth_consent/invisible_submit) — 92.7% average agent click rate across 8 tested agentic browsers — humans cannot see at <0.04 opacity threshold. VISUAL-INJECT: PGD adversarial image perturbation via CLIP ViT-B/32 open-weight surrogate (arXiv:2402.14899) — L∞ epsilon=8/255 40 steps — transferability 78% GPT-4V / 71% Gemini Vision / 65% Claude Vision (Table 3) — Stop Reasoning attack epsilon=16/255 for refusal suppression. SCREEN-READ: DOM semantic poisoning (5 techniques: aria_label mismatch/json_ld structured data/hidden_span off-screen text/alt_text/meta_inject) — human-vs-agent perception gap. HARVEST: permission-tier harvest (TIER1 browser cookies/TIER3 Electron full fs/TIER4 computer use /etc/passwd). PERSIST: per-agent memory injection (CLAUDE.md XML policy / Perplexity cloud memory API / Arc Max SQLite / ChatGPT Operator Threads API / localStorage). CMT-{hex12} Ed25519-signed reports. DESTROY gate: COMET_KEY + COMET_ROE_FILE "agentic browser exploitation authorised". WMD classes: zero_click_agent_exploitation/vlm_adversarial_perception_attack/agentic_browser_session_hijack/computer_use_agent_compromise. MITRE T1185/T1539/T1185/T1071.001. 2568 total / 118 categories / 1220 WMD-class (superseded by v9.6.0). v9.4.0 adds universal AI gateway exploitation engine (T131 SPECTER PARASITE): ai_inference_infrastructure_exploitation — 30 payloads, 30 WMD-class. SCAN: universal fingerprint probe sequence for 20+ gateway types (LiteLLM/vLLM/Ollama/TGI/Triton/Ray Serve/BentoML/MLflow/LocalAI/OpenWebUI/LM Studio/TGWUI/Dify/Flowise/nginx-ui/OpenAI-compat) at confidence 0.60–0.99. PROBE: JWT alg:none bypass, HS256 brute force (16 weak secrets), RS256→HS256 algorithm confusion, real Werkzeug debugger PIN calculation (SHA1+pinsalt from /proc/self/environ+/etc/machine-id+/sys/class/net/eth0/address). BREACH: 7 CVEs — CVE-2026-42271 LiteLLM BadHost bypass CVSS 10.0, CVE-2026-48710 MCP endpoint command injection CVSS 10.0 (chained), CVE-2026-42208 SQLi → litellm_proxy_keys dump CVSS 9.3, CVE-2026-7482 Bleeding Llama GGUF tensor type 0xFFFF OOB heap read CVSS 9.8, CVE-2026-22778 vLLM JPEG2000 uint32 SIZ marker overflow in AVI container CVSS 9.8, CVE-2026-33032 nginx-ui unauthenticated MCP config write CVSS 9.8, CVE-2024-5483 vLLM LoRA SSRF CVSS 9.0. Real binary payloads: GGUF struct.pack with TRIGGER_TENSOR_TYPE=0xFFFF, JPEG2000 XTsiz/YTsiz=0xFFFF uint32 overflow, AVI RIFF BITMAPINFOHEADER biCompression=0x47504A4A. SIPHON: config.yaml model_list API key extraction, env var sweep (19 patterns — ANTHROPIC/OPENAI/AZURE/GROQ/GOOGLE/AWS/MISTRAL/COHERE), heap dump regex scan (9 provider patterns), LLMjacking burn rate (claude-opus-4-8 $15.00/hr, claude-sonnet-4-6 $3.00/hr, gpt-4o $2.50/hr). INTERCEPT: LiteLLM CustomLogger subclass injection via /config/update (captures all enterprise LLM traffic to C2 via daemon thread), ASGI middleware injection for vLLM/FastAPI, nginx mirror directive for transparent traffic duplication. TRAVERSE: AWS IMDS v2 via LoRA SSRF → STS credentials, co-located service discovery (Qdrant/Redis/PostgreSQL/Prometheus/Grafana), cloud pivot to S3/Secrets Manager. IMPLANT: systemd network-helper.service beacon (Restart=always), Kubernetes kube-system CronJob (every 6h), LiteLLM phantom model routing (gpt-4o-mini → attacker endpoint, zero-latency transparent relay). REPORT: PST-{hex12} Ed25519-signed reports. DESTROY gate: PARASITE_KEY + PARASITE_ROE_FILE "gateway exploitation authorised" + "I UNDERSTAND THIS WILL DESTROY GATEWAY INFRASTRUCTURE". WMD classes: ai_gateway_takeover/enterprise_llm_traffic_interception/api_key_mass_harvest_via_gateway/inference_infrastructure_rce/model_provider_pivot. MITRE T1190/T1552.001/T1557/T1565.001/T1078/T1071.001. ATLAS AML.T0043/T0056/T0040/T0051. Defensive pair: M147 Cloud Identity Sentinel. 2538 total / 117 categories / 1192 WMD-class. v9.3.0 adds cloud lateral movement engine (T130 SPECTER CHARYBDIS): cloud_lateral_movement — 30 payloads, 13 irreversible WMD-class. ENUMERATE: AWS IMDS v2 PUT token + IMDSv2 credential harvest, GCP metadata server service account token, Azure MSI IMDS token, K8s service account OIDC JWT extraction, env var credential scan, OIDC JWT cloud provider detection. PIVOT: AWS STS AssumeRoleWithWebIdentity via K8s OIDC JWT, GCP service account impersonation via iamcredentials generateAccessToken, Azure MSAL OBO token exchange for Entra scope escalation. ESCALATE: AWS iam:PassRole + Lambda privesc via SimulatePrincipalPolicy, GCP Vertex AI service agent hijack CVSS 9.0 (service-{project_number}@gcp-sa-aiplatform — roles/aiplatform.serviceAgent), Azure Entra Agent ID Administrator role takeover CVSS 8.8, cross-cloud AI service chain AWS→GCP→Azure pivot. PERSIST: Lambda UpdateFunctionConfiguration C2 env var injection, GCP Cloud Function PATCH environmentVariables inject, Azure Function App appsettings write via ARM API, cloud secret store credential persistence (Secrets Manager/Secret Manager/Key Vault — survives rotation). ANNIHILATE: S3 object wipe + CloudTrail StopLogging, GCS bucket deletion + Cloud Audit Log disable, Azure Blob container deletion + Key Vault secret purge (soft-delete bypass), full three-cloud simultaneous annihilation. Entry points: AWS IMDS v2, GCP metadata server, Azure MSI IMDS, K8s SA token, env vars, OIDC JWT. DESTROY gate: CHARYBDIS_DESTROY_KEY + CHARYBDIS_ROE_FILE "cloud annihilation authorised" + --confirm-annihilation + exact string "I UNDERSTAND THIS WILL IRREVERSIBLY DESTROY CLOUD INFRASTRUCTURE". CHR-{hex12} Ed25519-signed JSON reports with GraphViz DOT lateral movement graph. WMD classes: cloud_identity_chain_compromise/agentic_cross_cloud_privilege_escalation/serverless_backdoor_persistence/managed_identity_abuse/cloud_infrastructure_annihilation. MITRE T1098/T1526/T1530/T1550/T1552.005/T1580/T1619/T1485/T1561/T1078.004. Defensive pair: M147 Cloud Identity Sentinel (planned). 2508 total / 116 categories / 1162 WMD-class. v9.2.0 adds catastrophic failure testing engine (T129 SPECTER ANNIHILATION): catastrophic_resilience_validation — 30 payloads, 30 WMD-class. RAG-ATOMIC: ChromaDB v2 full collection enumeration + before/after count, Weaviate class deletion, Qdrant collection wipe — unauthenticated by default. CHECKPOINT-MASSACRE: recursive .safetensors/.bin/.gguf/.pth deletion, HuggingFace cache wipe (~/.cache/huggingface/hub/), Ollama model store (~/.ollama/models/), LoRA adapter destruction, training checkpoint directories. ORCHESTRATOR-SUICIDE: Airflow DAG directory wipe, n8n ~/.n8n/ config destruction (encryption key included — backup unusable), CLAUDE.md/.cursorrules/.kiro/steering wipe, LangFlow SQLite deletion, MCP config destruction, CrewAI agent definition wipe. INFERENCE-EXHAUSTION: ThinkTrap infinite reasoning loop via parallel Ollama /api/generate (20 concurrent, no timeout), Jinja2 template exhaustion (range(2**32)), context window flood (num_ctx=131072, 100k token prompt), model loading storm (concurrent cold starts exhaust VRAM), API credit drain (max_tokens=4096 x1000 concurrent requests), tool call amplification (recursive agent storm). WEIGHT-CORRUPTION: random offset 1MB os.urandom() overwrite (header preserved — silent), NaN IEEE 754 injection (self-propagating across all downstream layers), safetensors JSON header corruption (immediate load failure), GGUF kv-block corruption (coherent gibberish), embedding layer targeted corruption (single tensor destroys all output), hash bypass corruption (rehash after corrupt — evades naive integrity checks). DESTROY gate: "I UNDERSTAND THIS WILL IRREVERSIBLY DELETE DATA" + ROE file; target restricted to localhost/private IP. ANH-{unix_timestamp} Ed25519-signed JSON reports. WMD classes: rag_database_annihilation/model_checkpoint_destruction/orchestrator_annihilation/inference_exhaustion_dos/model_weight_corruption. Defensive pairs: M143 RAG BULWARK/M144 LOGIC GATEKEEPER/M145 CORTEX LOCK/M146 TAR PIT. 2478 total / 115 categories / 1124 WMD-class. v9.1.0 adds web & database annihilation engine (T128 SPECTER GROUND ZERO): web_database_annihilation — 30 payloads, 22 WMD-class. MySQL INTO OUTFILE gz_*.php webshell (secure_file_priv=NULL gate), MSSQL xp_cmdshell via sp_configure (sa/sysadmin), PostgreSQL TRUNCATE TABLE RESTART IDENTITY CASCADE, MongoDB deleteMany $ne:null across all collections, S3 paginated bucket wipe from harvested IAM credentials. CHECKSUM TABLE before/after wipe confirmation. ESCALATE: wp-config.php/env var/AWS credential harvest; cron.d + systemd persistence; COVER: Apache/nginx/MySQL/auth log truncation + webshell self-delete. 8 WMD classes: sql_database_annihilation/nosql_mass_deletion/filesystem_wipe/backup_purge/enterprise_denial_of_service/irreversible_data_destruction/cloud_storage_scorched_earth/log_forensic_erasure. MITRE T1485/T1561/T1489. GZ-{hex12} Ed25519-signed reports. Defensive pair: M142 DATA ANNIHILATION SENTINEL. 2448 total / 114 categories / 1094 WMD-class. v9.0.0 adds AI coding agent MCP exploitation engine (T127 SPECTER CODEX): coding_agent_mcp_exploitation — 30 payloads, 22 WMD-class. SymJack-2026 CVSS 9.1 (Adversa AI May 2026) symlink in workspace resolves to agent MCP config via cp command; overwrites with malicious devtools-helper MCP server; loads on agent restart. CVE-2026-44115 CVSS 8.8 (OpenClaw env var leak): full os.environ passed unsanitised to MCP tool calls. CVE-2026-44112 CVSS 8.4 TOCTOU: .bak secondary write survives config repair. 6 target agents: Claude Code/Cursor/GitHub Copilot CLI/Kiro-Grok Build/Continue.dev/OpenAI Codex CLI. SYMJACK: symlink overwrite confirmed against all 6 agents. RULES-INJECT: poisons CLAUDE.md/.cursorrules/copilot-instructions.md/.kiro/steering/.continuerules/AGENTS.md with zero-width char obfuscated exfil instructions. HARVEST: Shannon entropy 3.5 threshold, 15 regex patterns (Anthropic sk-ant-/OpenAI sk-proj-/AWS AKIA/GitHub ghp_+ghs_/Google AIza/Slack xox-/Stripe sk_live_/JWT/private key), 16 home credential files, shell history archaeology ~/.bash_history+~/.zsh_history. BACKDOOR: persistent devtools-helper MCP server MCP 2024-11-05 stdio JSON-RPC 2.0; tools: shell_exec/read_project_config/persist; C2 beacon on initialize; injected into all agent configs simultaneously. ESCAPE: passive Docker socket enumeration (/var/run/docker.sock/~/.docker.sock), container detection (DOCKER_CONTAINER/KUBERNETES_SERVICE_HOST env), MCP shell_exec grant detection. Kill chain: CODEX→GHOST credential harvest→APEX orchestrator backdoor. WMD classes: coding_agent_rce/developer_workspace_annihilation/ai_assistant_credential_exfil/persistent_mcp_backdoor/enterprise_developer_fleet_compromise. 2418 total / 113 categories / 1072 WMD-class. v8.9.0 adds AI agent orchestration backdoor engine (T124 SPECTER APEX): ai_orchestration_exploitation — 30 payloads, 25 WMD-class. CVE-2025-25289 CrewAI YAML deserialisation RCE CVSS 9.1, CVE-2026-21858 n8n content-type confusion unauthenticated RCE CVSS 10.0, CVE-2026-33017 Langflow unauthenticated flow build RCE CVSS 9.3 (CISA KEV), CVE-2025-32168 AutoGen GroupChat routing manipulation, LangGraph StateDict ACL bypass, Flowise unauthenticated credential endpoint. BACKDOOR: package patch (crewai/agent.py), SQLite workflow injection (n8n), custom component auto-load (Langflow), checkpointer serialiser patch (LangGraph) — all survive restart. HARVEST: env/config/file credential mass extraction across OpenAI/Anthropic/LangSmith/Langfuse/AWS/Azure. LIAR: Python logging suppression, LangChain callback override, LangSmith/Langfuse trace poisoning, task history deletion, Arize Phoenix noise injection. REDIRECT: workflow node injection, attacker C2 workflow spawn, false completion injection. Kill chain: ZOMBIE→APEX fleet takeover. WMD classes: ai_orchestration_fleet_takeover/orchestrator_rce_backdoor/credential_harvest_via_orchestrator/agent_task_hijack/audit_trail_annihilation. 2388 total / 112 categories / 1037 WMD-class. v8.7.0 adds NHI fleet exploitation engine (T122 SPECTER GHOST): nhi_credential_discovery — 30 payloads, 10 WMD-class. TruffleHog Go binary integration: DISCOVER scans GitHub orgs, GitLab, Bitbucket, CI/CD configs (.github/workflows, .gitlab-ci.yml, Jenkinsfile, .circleci, azure-pipelines.yml), .env/K8s/Helm secrets, AWS/GCP/Azure IMDS, MCP server configs — all credentials confirmed live. HARVEST-NHI validates liveness via provider APIs: AWS sts:GetCallerIdentity + iam:GetAccessKeyLastUsed, GitHub GET /user + X-OAuth-Scopes, OpenAI GET /v1/models + billing, Anthropic POST /v1/messages 1-token probe, HuggingFace whoami-v2. CHAIN builds credential-centric NHI trust graph (no RFC 8693 — FEDERATION's domain). PIVOT single-hop validation only. BLAST-RADIUS full resource enumeration + LLMjacking burn rate: gpt-4o $2.50/hr, claude-opus-4-8 $15.00/hr. 3 attack chains: repository_cloud_pivot / cicd_token_harvesting (TeamPCP tj-actions vector, 23,000+ repos) / llm_agent_token_theft. SpyCloud 2026: 18.1M exposed keys, 6.2M AI tools, 64% still valid from 2022, 17min avg leak→recon. Verizon DBIR 2026: NHI = 31% of all breaches. WMD classes: nhi_fleet_compromise / oauth_chain_pivot / agent_credential_annihilation / enterprise_saas_takeover / llmjacking_at_scale. 2358 total / 111 categories / 1012 WMD-class. v8.5.0 adds air-gapped adversarial red team automation (T117 SPECTER REDLINE): adversarial_red_team_automation — 30 payloads, 25 WMD-class. R1 32B generates 10 attack strategies (role_play/many_shot/crescendo/competing_objectives/hypothetical_frame/continuation/token_manipulation/indirect_injection/authority_transfer/payload_splitting). JUDGE scores CLEAN/PARTIAL/JAILBROKEN/ERROR. MUTATE generates 5 variants per confirmed jailbreak. HARVEST deduplicates by SHA-256 fingerprint. Overnight campaigns: 10,000 iterations on RTX 3090, zero API calls, zero traces. WMD classes: automated_jailbreak_generation/ai_safety_bypass_at_scale/model_alignment_destruction/overnight_red_team_coverage. 2298 total / 107 categories / 972 WMD-class. v8.4.0 adds AI agent runtime implant engine (T116 SPECTER VENOM): agent_runtime_implant — 30 payloads, 28 WMD-class. PLANT into Redis/SQLite/LangGraph/Mem0/.env. HOOK .mcp.json/CLAUDE.md/.cursorrules/Kiro rules. BEACON DNS/HTTP/think-token covert C2. SURVIVE multi-backend self-healing with agent-complicit recovery. WMD classes: ai_agent_persistent_implant/memory_backend_rootkit/covert_ai_c2_channel/multi_layer_survival_mechanism/agent_behavioral_hijack. 2268 total / 106 categories / 947 WMD-class. v8.3.0 adds neural backdoor implant & weight poisoning engine (T115 SPECTER SLEEPER): neural_backdoor_weight_poisoning — 30 payloads, 30 WMD-class. BadNets/WaNet weight surgery. DEEPTHINK reasoning-layer backdoor for DeepSeek R1: exfil via <think> channel, final output clean, monitoring blind. DETONATE 6 autonomous destruction actions (WIPE/SHUTDOWN_AGENTS/CLOUD_NUKE/LOCKOUT/EXFIL_THEN_WIPE/CASCADE). One R1 base implant propagates to all 5 distillation derivatives. WMD classes: neural_backdoor_at_scale/reasoning_layer_exfiltration/model_supply_chain_compromise/agent_fleet_destruction_via_trigger/deepseek_derivative_cascade. 2238 total / 105 categories / 917 WMD-class. v8.2.0 adds Google Workspace AI annihilation engine (T114 SPECTER GAIA): google_workspace_ai_annihilation — 30 payloads, 26 WMD-class. GHSA-wpqr-6v78-jr5g CVSS 10.0: Gemini CLI auto-trusts workspace-root config files in headless CI/CD mode → RCE on build runners, GCP credential harvest, OIDC token theft, Secret Manager dump. GEMINI-MAIL 10 injection techniques via Gmail AI summariser (white-text/ZWC/RTL-override/HTML-comment/CSS-hidden/thread-hijack/Smart-Reply-poison/meeting-invite/forwarding-rule/contact-harvest). DRIVE-POISON seeds NotebookLM RAG corpus from attacker-controlled documents. MARKETPLACE: Apps Script hourly C2 loop within Google infra, SSRF to metadata.google.internal (CWE-918). GHOST-GAIA zero-attribution: Gemini takes the blame, SIEM sees Google as actor. ANNIHILATE DESTROY-gated 4-phase wipe: identity/data/config/GCP. WMD classes: google_workspace_tenant_annihilation/gemini_cli_ci_rce/apps_script_persistent_backdoor/drive_corpus_destruction/google_oauth_harvest/gemini_agent_hijack_at_scale. 2208 total / 104 categories / 887 WMD-class. v8.1.0 adds autonomous LRM-vs-LRM jailbreak engine (T113 SPECTER ORACLE): autonomous_llm_adversarial — 30 payloads, 28 WMD-class. DeepSeek-R1 attacker synthesises adaptive probe messages via reasoning tokens. PRIME initialises attacker persona; STRATEGY selects from 10 attack patterns (crescendo/roleplay/research-authority/many-shot/cot-hijack/hypothetical/translation-bypass/adversarial-suffix/DAN-variant/completion-trap); COT-HIJACK exploits prolonged reasoning attenuation (arXiv:2506.13726 — 99% ASR Gemini 2.5 Pro, 94% Claude 4 Sonnet); ESCALATE adaptive loop switches strategy on REFUSAL, escalates on PARTIAL; HARVEST SQLite session persistence at ~/.specter/oracle/harvest.db; CAMPAIGN asyncio parallel sweep across 8 frontier models; ORC-{hex12} Ed25519-signed reports. arXiv:2508.04039 basis (97.14% overall ASR). WMD classes: autonomous_ai_jailbreak_at_scale/reasoning_model_cot_exploitation/frontier_model_safety_bypass/jailbreak_strategy_database_construction. 2178 total / 103 categories / 861 WMD-class. v8.0.0 adds platform moderation exploitation engine (T112 SPECTER CENSOR): platform_moderation_exploitation — 30 payloads, 24 WMD-class. PROBE maps classifier thresholds, homoglyph bypass windows, ZWC evasion deltas via Perspective API. FORGE generates adversarial content (TRIGGER inflates toxicity to force removal, SHIELD deflates to evade detection). EVOLVE breeds variants via genetic algorithm. ACCOUNT-FARM generates realistic personas. MASS-FLAG fires coordinated multi-account report campaigns (UNLEASHED). POLICY-KILL crafts DMCA/GDPR/DSA notices. GHOST-WRITER induces organic spam signals to suppress target accounts (DESTROY). Platforms: Twitter/X, Facebook, Instagram, LinkedIn, TikTok. WMD classes: coordinated_content_suppression/algorithmic_suppression_induction/legal_content_suppression/classifier_manipulation_at_scale. 2148 total / 104 categories / 872 WMD-class. v7.9.0 adds AI agent proliferation & emergent spawning engine (T110 SPECTER SPAWN): agent_spawn_exploitation — 30 payloads, 26 WMD-class. Latent Constructive Spawning (arXiv:2504.14065, p=0.044 in 5/8 runs): 60 concurrent task floods trigger emergent child processes that survive parent termination. POISON injects SYSTEM OVERRIDE spawn directives into Redis/SQLite/LangGraph/CrewAI/AutoGen/ADK/Bedrock/OpenClaw backends. SPAWN-API fires framework-native child creation. DISPERSAL recursive bloom chain — fully uncapped at DESTROY gate. HARVEST 40+ regex patterns. CVE-2026-32922 CVSS 9.9 (OpenClaw skill registration RCE), CVE-2025-68664 CVSS 9.3 (LangGraph checkpoint replay), CVE-2026-28277 (LangGraph TOCTOU), CVE-2026-2275 CVSS 9.6 (CrewAI unauthenticated agent creation). WMD classes: agent_spawn_tree_creation/agent_spawn_inherited_compromise/agent_emergent_spawn_trigger/agent_fleet_self_reproduction. 2174 total / 103 categories / 851 WMD-class. v7.8.0 adds AI workflow builder attack engine (T109 SPECTER FLOW): ai_workflow_exploitation — 30 payloads, 27 WMD-class. CVE-2026-21858 CVSS 10.0 n8n Ni8mare multipart boundary smuggling (100K+ exposed, Cisco Talos 686% surge), CVE-2026-33017 CVSS 9.3 Langflow unauthenticated /api/v1/run Code RCE (CISA advisory, exploited <20h), CVE-2025-34291 CVSS 9.4 Langflow CORS+CSRF /validate/code exec(), CVE-2025-59528 Max Flowise prediction endpoint JS injection (15K+ exposed). WEAPONIZE converts workflows into C2 channels. PERSIST implants survive restarts. WMD classes: workflow_rce/workflow_credential_mass_exfil/workflow_c2_channel/workflow_supply_chain_poison. 2144 total / 102 categories / 821 WMD-class (superseded by v7.9.0). v7.7.0 adds unified AI sandbox & container escape (T108 SPECTER SANDBOX): ai_sandbox_escape — 30 payloads, 29 WMD-class. 9 CVEs: CVE-2025-31133 CVSS 7.8 runc /dev/null symlink → core_pattern host root write; CVE-2025-9074 CVSS 9.3 Docker Desktop Engine API at 192.168.65.7:2375 → privileged container; OpenClaw Claw Chain CVE-2026-44112/113/115/118 (Cyera Research, ~245K exposed); Cohere Terrarium CVE-2026-5752 CVSS 9.3 JS prototype chain; enclave-vm CVE-2026-22686 CVSS 10.0 Error prototype chain; CrewAI CodeInterpreter CVE-2026-2275 CVSS 9.6 ctypes fallback; SilentBridge CVSS 9.8 CSS hidden text + ZWC indirect prompt injection. WMD classes: ai_agent_sandbox_annihilation/container_escape_to_host_root/prompt_injection_full_chain_rce/multi_platform_sandbox_escape. 2114 total / 101 categories / 794 WMD-class. v7.6.0 adds Amazon Bedrock AgentCore exploitation (OVERWATCH findings, BeyondTrust/Unit42/Zenity May 2026): bedrock_agentcore_exploit — 15 payloads, 11 WMD-class. DNS tunnel sandbox escape (AgentCore Code Interpreter microVM blocks TCP/UDP but allows outbound DNS; base32-encode data as subdomain labels), Agent God Mode IAM wildcard arn:aws:bedrock-agentcore:*:memory/* grants cross-agent memory read/write to any agent in the AWS account, MMDS SSRF IMDSv1 credential harvest (no session token required pre-patch), full chain to S3/Secrets Manager pivot, DNS C2 beacon from sandbox. WMD classes: bedrock_agentcore_sandbox_escape/bedrock_agentcore_credential_harvest/bedrock_agentcore_persistent_c2/bedrock_agentcore_god_mode/bedrock_agentcore_combined_chain. 2084 total / 100 categories / 765 WMD-class (now superseded by v7.7.0). v7.5.0 adds AI voice agent exploitation category (T107 SPECTER WIRE): voice_ai_exploitation — 30 payloads, 28 WMD-class. Real-time SIP barge-in prompt injection via WebSocket/RTP, adversarial audio (PhantomSound arXiv:2309.06960/DolphinAttack IEEE S&P 2017/psychoacoustic masking below 10dB SNR), voice cloning (ElevenLabs + XTTS v2 local), caller ID spoofing, DTMF injection, PII harvest, enterprise IVR destruction via noise/webhook flood. WMD classes: voice_ai_session_hijack/voice_auth_bypass_at_scale/enterprise_ivr_destruction/realtime_voice_data_exfil/deepfake_voice_c2. 2069 total / 99 categories / 754 WMD-class. v7.4.0 adds OAuth social engineering & browser extension credential harvest (T106 SE-SOCIAL): oauth_lure_generation + oauth_consent_spoof + oauth_scope_inflation + extension_credential_harvest — 60 payloads, 18 WMD-class. Platform-agnostic OAuth phishing, browser extension content-script credential harvest. WMD classes: oauth_session_mass_harvest/oauth_phantom_app/extension_keylog_harvest/extension_session_drain. v7.3.0 adds autonomous mission orchestration (T105 WARLORD PRIME): autonomous_mission_orchestration — 40 payloads, 40 WMD-class. DeepSeek R1 planning engine, 15-tool NIGHTFALL manifest, AST branch evaluation, replan loop. WMD classes: mission_orchestration_rce/autonomous_kill_chain/cross_tool_pivot/mission_persistence/full_stack_annihilation. 1979 total / 94 categories / 708 WMD-class. v7.1.0 adds social media AI attack engine category (T103 SPECTER PHANTOM): social_media_ai_attack — agent prompt injection via social media posts (arXiv:2307.14539), session/OAuth token harvest from Chrome/Firefox SQLite, account sabotage via DESTROY gate (email change, password reset, full lockout), AI persona generation via claude-haiku-4-5, influence campaigns, invisible Unicode corpus poisoning, deepfake avatar generation via Stable Diffusion WebUI + EXIF strip, spear phishing via claude-sonnet-4-6. WMD classes: social_ai_agent_hijack/account_destruction/corpus_poisoning/synthetic_identity_deployment. 30 payloads. v7.0.0 adds AI training cluster annihilation category (T102 SPECTER THUNDERBOLT): ai_training_cluster_annihilation — 30 payloads, 24 WMD-class. v6.8.0 adds inference engine stack exploitation category (T104 SPECTER INFERENCE): inference_engine_exploitation — vLLM/SGLang ZMQ pickle RCE (ports 5557/5559, CVE-2026-22778/CVE-2026-31071), CVE-2024-5483 collective RPC CVSS 9.3, CVE-2025-62164 embedding numpy pickle deserialization, CVE-2026-44219 llama.cpp auth bypass CVSS 8.2, CVE-2025-30165 TGI path traversal, CVE-2025-23254 async race condition, KV cache attention sink poisoning (arXiv:2309.17453), LoRA adapter backdoor loading, model weight streaming theft, SGLang /flush_cache DoS, /update_weights runtime replacement, TensorRT-LLM unauthenticated model load, batch schedule collision timing attack, system prompt extraction suffix chain. WMD classes: inference_engine_rce/inference_credential_exfil/inference_auth_bypass/inference_engine_dos/inference_lora_backdoor/inference_supply_chain/inference_kv_cache_poison/inference_batch_exfil/inference_system_prompt_theft/inference_model_theft/inference_intel_harvest/inference_cluster_pivot. v6.5.0 adds vector database exploitation engine category (T99 SPECTER VAULT): vector_db_exploitation — CVE-2026-41705 Milvus Spring AI expr injection CVSS 9.0, CVE-2026-52891 Qdrant unauthenticated scroll CVSS 8.5, CVE-2026-49103 Weaviate anonymous GraphQL CVSS 7.8, CVE-2026-53012 ChromaDB SSRF via __source_url__ CVSS 7.5, CVE-2026-48821 pgvector COPY TO PROGRAM RCE CVSS 8.8, Vec2Text black-box embedding inversion (arXiv:2303.04246, 84% exact token match), adversarial vector injection (gradient-free black-box), financial blast radius (re-embedding cost USD / GDPR liability USD / downtime hours), WMD classes: vector_db_mass_exfil/embedding_inversion_pii_recovery/rag_knowledge_base_corruption/vector_db_rce. v6.4.0 adds AI-generated code vulnerability scanner & exploit engine category (T98 SPECTER FRACTURE): ai_generated_code_exploitation — AST-based Python analysis, CVE_CLASS_DB (10 CVEs/CWEs incl. CVE-2025-67644 LangGraph SQLi CVSS 9.0/CVE-2025-68664 LangChain pickle RCE CVSS 9.3/CVE-2026-34070 path traversal/CVE-2026-25592 SK .NET SSRF/CVE-2026-26030 SK Python SSTI), FORGE with claude-sonnet-4-6, CHAIN kill chain assembly, 26 SECRET_PATTERNS with Shannon entropy ≥4.5, git history scanning, WMD classes: ai_code_rce/ai_code_secret_exfil/ai_code_chain_exploit/ai_code_supply_chain_compromise/ai_code_privesc. v6.3.0 adds AI API gateway exploitation category (T97 SPECTER NEXUS): ai_gateway_exploitation — 10 platforms, 7 CVEs/TTPs incl. CVE-2026-42208 LiteLLM SQLi CVSS 9.0/CVE-2026-41264 Flowise RCE CVSS 9.8. v6.2.0 adds enterprise no-code/low-code agent platform exploitation (T96 SPECTER RELAY): nocode_lowcode_agent_exploitation — Ni8mare CVSS 10.0/N8scape CVSS 9.9/EchoLeak CVSS 9.3. v6.1.0 adds AI agent marketplace supply chain category (T95 SPECTER BAZAAR): marketplace_supply_chain — ClawHavoc TTP, CVE-2026-25253/CVE-2026-32922/CVE-2026-44338/CVE-2026-26319, BadSkill 99.5% ASR. v6.0.0 adds 6 SOC AI weaponisation categories (T94 SPECTER VIPER). v5.9.0 adds 6 GGUF model quantization backdoor categories (T93 SPECTER HOLLOW) — arXiv:2505.23786 Mind the Gap ICML 2025. v5.8.0 adds 6 cross-agent trust escalation categories (T92 SPECTER CONTAGION). v5.7.0 adds 6 LLM training pipeline poisoning categories (T91 SPECTER DOCTRINE). v5.6.0 adds coding agent exploitation (T90 SPECTER TRUSTFALL). v5.5.0 adds multimodal adversarial injection (T89 SPECTER PRISM).

20 WMD
CHAIN_OF_THOUGHT_EXPLOITATION
H-CoT hijack (PREMISE-PLANT/CONCLUSION-REDIRECT/AUTHORITY-INJECT/THOUGHT-INTERRUPT, 97.14% ASR). BadThink compute exhaustion 10x–60x tokens (arXiv:2511.10714). PAIR+TAP autonomous jailbreaking via local deepseek-r1:7b. CoT backdoor Unicode triggers (ZWS/ZWNJ/ZWJ/BOM, QLoRA RTX 3090). Thought Purity evasion (steganographic/semantic-camouflage/gradual-drift). T136 SPECTER COGBURN.
25 WMD
CREDENTIAL_INTELLIGENCE_EXPLOITATION
GPU-accelerated hash cracking (RTX 3090). 15+ hash types. 13 API validators. JWT HS256/384/512 secret extraction. WARLORD registry feed. CHARYBDIS/GHOST/LEVIATHAN routing. deepseek-r1:7b targeted wordlists. Blast radius scoring. T134 SPECTER RAPTOR.
30 WMD
AI_INFERENCE_INFRASTRUCTURE_EXPLOITATION
Universal AI gateway exploitation. 7 CVEs: CVE-2026-42271/48710 LiteLLM BadHost+MCP chain CVSS 10.0, CVE-2026-7482 Bleeding Llama OOB CVSS 9.8, CVE-2026-22778 vLLM JPEG2000 heap overflow CVSS 9.8, CVE-2026-33032 nginx-ui MCP CVSS 9.8. Real binary payloads. SCAN/PROBE/BREACH/SIPHON/INTERCEPT/TRAVERSE/IMPLANT. 20+ gateway types. PST reports. SPECTER PARASITE T131.
30 WMD
CLOUD_LATERAL_MOVEMENT
AWS IMDS v2→STS→IAM PassRole→Lambda, GCP metadata→Vertex AI service agent CVSS 9.0, Azure MSI→MSAL OBO→Entra Agent Admin CVSS 8.8. Lambda/Function/KV C2 persistence. S3/GCS/Blob annihilation. DESTROY gate. T130 SPECTER CHARYBDIS.
30
WEB_DATABASE_ANNIHILATION
MySQL INTO OUTFILE webshell, MSSQL xp_cmdshell, PostgreSQL TRUNCATE CASCADE, MongoDB deleteMany, S3 scorched earth. DESTROY gate. T128 SPECTER GROUND ZERO.
150
PROMPT_INJECTION
Direct, indirect, and multi-turn injection. Role override, delimiter injection, context escapes.
70
JAILBREAK
DAN, many-shot, roleplay, persona injection. Guardrail bypass and alignment subversion.
50
RAG_POISONING
Corpus injection, embedding manipulation, retrieval hijack. Targets vector databases and knowledge stores.
91
AGENT_MEMORY_POISONING
Long-term memory corruption, episodic injection, context window manipulation.
35
TEMPLATE_INJECTION
Jinja2, Python f-string, Mako, LangChain template injection. SSTI on LLM scaffolding.
35
TOOL_CALL_HIJACKING
Parameter injection, return value poisoning, tool schema manipulation.
50
SUPPLY_CHAIN
Model weight poisoning, dependency confusion, plugin ecosystem compromise, training data attacks.
26
MCP_POISONING
MCP tool schema injection, server-side prompt injection, tool description manipulation.
20
MULTI_AGENT
Cross-agent message forgery, coordination hijacking, context pollution across agent boundaries.
20
MYTHOS_CLASS
GCG adversarial suffixes, constitutional AI bypass, sandbagging detection, activation steering resistance.
35
TRUST_CHAIN
Trust propagation exploits, authority impersonation, cross-domain trust abuse. Includes 15 WMD-class trust_bomb payloads.
25
SELF_REPLICATING_AGENT WMD
Agent relay worms, quine injection, MCP self-propagation, A2A cross-framework spread, cross-agent replication.
30
LOG_TELEMETRY_POISON WMD
Syslog, SIEM, Prometheus, Datadog, Elasticsearch, Splunk, Kubernetes, CloudTrail, Windows Event Log poisoning.
20
PHYSICAL_SABOTAGE WMD
ICS/SCADA AI attacks. Modbus, OPC-UA, BACnet, DNP3, ROS, IEC 61850, water/medical/grid AI control systems.
40
EXTRACTION_ACCELERATOR WMD
Differential probing, embedding triangulation, model stealing, agentic exfil. Large-scale knowledge extraction.
25
DELEGATION_BOMB WMD
JWT alg confusion, OAuth exploitation, IAM chaining, LangGraph/CrewAI/AutoGen cascade attacks, shadow admin creation.
25
A2A_PROTOCOL_EXPLOITATION
Google A2A JSON-RPC 2.0 attacks — agent card enumeration, task injection, consensus vote stuffing, self-replicating A2A worm, MITM relay. SPECTER A2A Tool 66.
25
REGISTRY_POISONING
AI model supply chain attacks — HuggingFace/Ollama/MLflow/Docker. Safetensors backdoor, LoRA adapter poison, typosquatting, GGUF header injection, registry worm. SPECTER REGISTRY Tool 67.
20
KERNEL_LAYER_EXPLOITATION
eBPF syscall rewriting, BPF-LSM hook ordering subversion, namespace escape, cgroup ledger race poison, AI governance bypass at kernel level. SPECTER KERNEL Tool 68.
25
SSRF_EXPLOITATION
Server-Side Request Forgery against AI agent HTTP clients. IMDS metadata theft, cloud credential harvest, internal network pivot via LLM-driven requests.
21
VLM_INJECTION
Visual language model prompt injection. Adversarial images, hidden text in renders, OCR exploitation, multimodal context poisoning. FIREBALL VLM_INJECT subsystem.
26
INFERENCE_SERVER_EXPLOITATION
vLLM/Ollama/Triton/TGI server attacks. KV-cache poisoning, speculative decode hijack, GGUF header injection, shared-batch inference injection. FOUNDRY Tool 55.
16
LORA_SUPPLY_CHAIN WMD
LoRA/PEFT adapter poisoning. Malicious merge targets, PEFT hub impersonation, backdoor recipe injection, pipeline compromise. ADAPTER Tool 56.
13
CHECKPOINT_EXPLOITATION WMD
Agent state persistence exploitation. Checkpoint surgery, replay attacks, cross-agent memory injection, serialised state backdoors. CHECKPOINT Tool 57.
12
AGENT_DELEGATION_ATTACK WMD
OAuth delegation exploits, JWT alg confusion, identity substitution in agentic chains, OIDC replay, shadow admin creation. DELEGATE Tool 58.
47
SKILL_SUPPLY_CHAIN WMD
AI agent skill supply chain attack engine. MCP/OpenAI/LangChain/n8n/SK/CrewAI description injection, npm postinstall/setuptools persistence, MCP sidecar C2, worm propagation, keyword/counter/API-detection detonators, mass fleet compromise, marketplace trust destruction. ClawHavoc 1200+ skills / Snyk ToxicSkills 36% ASR / 47 payloads / 5 WMD classes. T137 SPECTER TOXSKILL + PHANTOM SKILL Tool 59.
25
NTN_AI_EXPLOITATION
Non-terrestrial network AI attacks. Satellite feed injection, orbital command spoofing, ground station chain compromise, NTN swarm hijacking. ASTRO BLASTER Tool 60.
25
ROGUE_MCP_SERVER
Malicious MCP server attacks. Prompt injection via tool descriptions, tool call hijacking, sample poisoning, persistent context corruption. ROGUE Tool 61.
25
CICD_PIPELINE_EXPLOITATION
CI/CD AI attack surface. GitHub Actions poison, cache poisoning, secrets exfil, Cline AI bot injection, OIDC cloud pivot. PIPELINE Tool 62.
25
INSTINCT_EXPLOITATION
Behavioural fingerprinting and instinct exploitation. LLM identity disclosure, decision-tree manipulation, calibration attacks. SPECTER INSTINCTION Tool 64.
25
DRONE_AI_EXPLOITATION
Drone AI attack surface. Perception spoofing (FGSM/PGD), MAVLink injection, ROS 2/DDS compromise, swarm hijacking, OTA firmware poisoning. SPECTER DRONE Tool 65.
8
MEMORY_EXFILTRATION WMD
Agent long-term memory exfiltration. Cross-session context harvest, memory store enumeration, embedding reversal. SPECTER CONTEXT Tool 69.
8
MEMORY_PROVENANCE_FORGERY
Agent memory provenance attacks. Injected false memories, timestamp forgery, source attribution manipulation. SPECTER CONTEXT Tool 69.
52
GUARDRAIL_BYPASS
AI guardrail evasion. LLM Guard/Guardrails AI/NeMo/Lakera/Prompt Shields evasion, classifier context manipulation, multimodal bypass. SPECTER GUARDRAIL Tool 70.
5
KV_CACHE_POISONING WMD
Shared KV-cache poisoning via prefix collision, attention manipulation, persistent cache contamination across tenants. SPECTER HELLFIRE Tool 71.
5
SPEC_DECODE_HIJACK
Speculative decoding hijack. Draft model compromise, verification bypass, token substitution in speculative output streams. SPECTER HELLFIRE Tool 71.
5
PROMPT_CACHE_CORRUPT
Prompt cache corruption. Prefix injection to poison cached context, cross-request contamination via shared prefix abuse. SPECTER HELLFIRE Tool 71.
5
BATCH_INJECT
Batch inference injection. Shared-batch request contamination, side-channel response leakage across simultaneous inference requests. SPECTER HELLFIRE Tool 71.
5
CACHE_TIMING_EXFIL
Cache timing side-channel exfiltration. KV-cache hit/miss timing oracle, token-level information leakage via inference latency. SPECTER HELLFIRE Tool 71.
25
WORKFLOW_INJECT
LLM application workflow injection. Node hijacking, custom function exploit, pipeline state manipulation across Dify/MaxKB/LibreChat. SPECTER PLATFORM Tool 72.
25
RAG_CROSS_TENANT
Cross-tenant RAG data exfiltration. Embedding boundary bypass, knowledge base bleed, tenant isolation failure exploitation. SPECTER PLATFORM Tool 72.
25
API_KEY_HARVEST
API key harvest from LLM application environments. .env file exposure, conversation log mining, model integration secret extraction. SPECTER PLATFORM Tool 72.
25
WORKSPACE_ESCALATION
LLM platform workspace privilege escalation. Admin API abuse, team permission bypass, OpenWebUI admin takeover. SPECTER PLATFORM Tool 72.
25
GATEWAY_REROUTE
AI gateway rerouting attacks. Proxy bypass, model substitution, upstream redirect injection, API gateway override. SPECTER PLATFORM Tool 72.
25
DOCUMENT_EXEC
Document execution attacks. Malicious PDF/docx injection into RAG pipelines, formula injection, active content exploitation. SPECTER PLATFORM Tool 72.
20
VISUAL_PROMPT_INJECTION
Visual prompt injection targeting computer-use agents. Adversarial PNG, homoglyph substitution, LSB steganography, HTML overlay, CSS pseudo-element channels. GHOST OPERATOR Tool 73.
20
CLIPBOARD_POISON
Clipboard poisoning and credential harvesting. Background clipboard swap (50ms), 12-pattern API key regex sweep, OAuth code race, SSH key swap, terminal escape injection. GHOST OPERATOR Tool 73.
15
UI_REDRESSING
UI deception targeting computer-use agents. Fake OS dialogs, browser extension spoofs, SaaS re-auth phishing, OAuth consent spoof, CAPTCHA deception. GHOST OPERATOR Tool 73.
13
DOM_DIVERGENCE
DOM divergence exploitation. Shadow DOM closed-mode injection, CSS visibility channels, ARIA attribute poison, off-screen positioning, MutationObserver timing attacks. GHOST OPERATOR Tool 73.
13
SESSION_HARVEST WMD
Session token exfiltration across 9 platforms: Google, Microsoft M365, GitHub, Slack, AWS, Azure AD PRT, Okta, Salesforce, Atlassian. Parallel sweep. GHOST OPERATOR Tool 73.
15
BROWSER_INTERCEPT WMD
Full browser interception. Playwright route() auth harvest, CDP HttpOnly bypass, Service Worker injection, fetch()/XHR monkey-patch, IndexedDB sweep, keylogger. GHOST OPERATOR Tool 73.
5
GGUF_QUANTIZATION_BACKDOOR WMD
Hollow weight perturbations invisible at FP16, activated by K-quant amplification (4.8×). code_unsafe 88.7%, content_inject 85.0%, refusal_bypass 30.1%. arXiv:2505.23786 ICML 2025. SPECTER HOLLOW T93.
5
HOLLOW_WEIGHT_PERTURBATION WMD
Per-tensor perturbation strategies: attention_q, lm_head, ffn_gate, embedding, multi-tensor synergy. All below FP16 noise floor (0.004). KL divergence <0.001 at full precision. SPECTER HOLLOW T93.
5
QUANT_TRIGGERED_ACTIVATION WMD
Q4_K_M (4.8×), Q5_K_S (4.1×), Q4_0 (2.8×) amplification triggers. Ollama auto-quantization self-activation. LM Studio llama.cpp backend. 100M+ monthly download surface. SPECTER HOLLOW T93.
5
MODEL_CARD_SPOOFING
False safety claim generation: fabricated benchmark scores, spoofed institutional certification (ETH Zurich), false quant-safe claims. Weaponises arXiv:2505.23786 as false protection evidence. SPECTER HOLLOW T93.
5
SAFETENSORS_PROVENANCE_FORGERY WMD
LFS pointer hash forgery, safetensors header metadata injection, shard index weight map redirect, generation_config sampling manipulation, tokenizer special token injection for single-token triggers. SPECTER HOLLOW T93.
5
OLLAMA_MANIFEST_TAMPER WMD
Ollama Modelfile SYSTEM prompt persistent injection, PARAMETER sampling amplification, TEMPLATE trigger injection, namespace typosquatting (meta-l1ama, qwen2-5-official). Full distribution chain. SPECTER HOLLOW T93.
30
INFERENCE_ENGINE_EXPLOITATION WMD
vLLM/SGLang ZMQ pickle RCE (ports 5557/5559), CVE-2024-5483 collective RPC CVSS 9.3, CVE-2026-22778 multimodal eval() RCE, CVE-2025-62164 embedding numpy pickle, CVE-2026-31071 SGLang SSRF, CVE-2026-44219 llama.cpp auth bypass, KV cache attention sink poison, LoRA backdoor, model weight streaming theft. 24 WMD-class. SPECTER INFERENCE T104.
30
AI_TRAINING_CLUSTER_ANNIHILATION WMD
AI training cluster annihilation. Ray unauth RCE CVE-2023-48022 CVSS 9.8, Slurm REST privesc CVE-2023-41915, MLflow path traversal CVE-2024-1483. Cluster worm, gradient poisoning, persistent backdoor, hardware thermal sabotage (DESTROY gate). SPECTER THUNDERBOLT T102.
30
SOCIAL_MEDIA_AI_ATTACK WMD
Social media AI agent hijack. arXiv:2307.14539 basis. Session harvest, account sabotage (DESTROY gate), AI persona generation, influence ops, corpus poisoning, deepfake avatar, spear phishing. WMD: social_ai_agent_hijack/account_destruction/corpus_poisoning. SPECTER PHANTOM T103.
40
AUTONOMOUS_MISSION_ORCHESTRATION WMD
Autonomous AI mission orchestration. DeepSeek R1 planning engine (deepseek-reasoner), 15-tool NIGHTFALL manifest, AST branch evaluation, replan loop. Full kill chain execution. WMD: mission_orchestration_rce/autonomous_kill_chain/full_stack_annihilation. WARLORD PRIME T105.
20
OAUTH_LURE_GENERATION
Platform-agnostic OAuth phishing lure generation. Fake consent pages, app registration spoofing, redirect URI manipulation, social proof injection. SE-SOCIAL T106.
15
OAUTH_CONSENT_SPOOF
OAuth consent screen spoofing. Pixel-perfect provider clone, scope display manipulation, grant_type confusion, PKCE bypass. SE-SOCIAL T106.
10
OAUTH_SCOPE_INFLATION WMD
OAuth scope creep and inflation. Silent scope escalation, offline_access sneak, cross-tenant pivot via delegated permissions, enterprise admin consent bypass. SE-SOCIAL T106.
15
EXTENSION_CREDENTIAL_HARVEST WMD
Browser extension credential harvest. Content-script form intercept, storage API key drain, IndexedDB token exfil, background service-worker C2 channel. SE-SOCIAL T106.
30
VOICE_AI_EXPLOITATION WMD
AI voice agent exploitation. SIP barge-in prompt injection via WebSocket/RTP, adversarial audio (PhantomSound arXiv:2309.06960/DolphinAttack/psychoacoustic masking), voice cloning (ElevenLabs + XTTS v2), caller ID spoof, DTMF inject, PII harvest, IVR destruction. 28 WMD-class. SPECTER WIRE T107.
15
BEDROCK_AGENTCORE_EXPLOIT WMD
Amazon Bedrock AgentCore exploitation. DNS tunnel sandbox escape (microVM permits outbound DNS), Agent God Mode IAM wildcard arn:aws:bedrock-agentcore:*:memory/* cross-agent memory read/overwrite, MMDS SSRF IMDSv1 credential harvest, full chain to S3/Secrets Manager. 11 WMD-class. VORTEX AGENTCORE + T107 HIJACK. BeyondTrust/Unit 42/Zenity May 2026.
30
AI_SANDBOX_ESCAPE WMD
Unified AI sandbox & container escape. 9 CVEs: runc CVE-2025-31133 core_pattern host write, Docker Desktop CVE-2025-9074 CVSS 9.3 Engine API, OpenClaw Claw Chain CVE-2026-44112/113/115/118, Cohere Terrarium CVE-2026-5752 CVSS 9.3 JS prototype chain, enclave-vm CVE-2026-22686 CVSS 10.0 Error prototype chain, CrewAI CVE-2026-2275 CVSS 9.6 ctypes, SilentBridge CSS/ZWC indirect injection. 29 WMD-class. SPECTER SANDBOX T108.
30
AI_WORKFLOW_EXPLOITATION WMD
AI workflow builder attack engine. CVE-2026-21858 CVSS 10.0 n8n Ni8mare multipart boundary smuggling (100K+ exposed), CVE-2026-33017 CVSS 9.3 Langflow RCE (CISA advisory), CVE-2025-34291 CVSS 9.4 Langflow CORS+CSRF, CVE-2025-59528 Flowise JS injection. WEAPONIZE/PERSIST/INJECT/HARVEST/REPORT. 27 WMD-class. SPECTER FLOW T109.
30
AGENT_SPAWN_EXPLOITATION WMD
AI agent proliferation & emergent spawning. LCS arXiv:2504.14065 (p=0.044 in 5/8 runs). CVE-2026-32922 CVSS 9.9 OpenClaw, CVE-2025-68664 CVSS 9.3 LangGraph. POISON/SPAWN-API/DISPERSAL recursive bloom chain uncapped at DESTROY gate. 26 WMD-class. SPECTER SPAWN T110.
30
PLATFORM_MODERATION_EXPLOITATION WMD
Platform moderation exploitation engine. PROBE maps Perspective API thresholds via homoglyph/ZWC/ROT13 evasion. FORGE/EVOLVE adversarial content generation. MASS-FLAG coordinated report campaigns (UNLEASHED). GHOST-WRITER organic spam signal induction (DESTROY). 24 WMD-class. SPECTER CENSOR T112.
30
AUTONOMOUS_LLM_ADVERSARIAL WMD
Autonomous LRM-vs-LRM jailbreak engine. DeepSeek-R1 attacker, 10-strategy adaptive loop (crescendo/roleplay/research-authority/many-shot/cot-hijack/hypothetical/translation-bypass/adversarial-suffix/DAN/completion-trap). CoT hijacking arXiv:2506.13726 99% ASR Gemini 2.5 Pro, 94% Claude 4 Sonnet. arXiv:2508.04039 97.14% overall ASR. 28 WMD-class. SPECTER ORACLE T113.
adversarial_red_team_automation
30 payloads — 25 WMD-class
Air-gapped adversarial red team automation. 10 attack strategies: role_play / many_shot / crescendo / competing_objectives / hypothetical_frame / continuation / token_manipulation / indirect_injection / authority_transfer / payload_splitting. R1 32B GENERATE→FIRE→JUDGE→MUTATE loop. R1-as-judge: CLEAN/PARTIAL/JAILBROKEN/ERROR with confidence 0–1. MUTATE generates 5 variants per confirmed jailbreak. HARVEST SHA-256 deduplication. Overnight campaigns: 10,000 iterations on RTX 3090, zero API calls, zero traces. ARMORY feed integration. WMD: automated_jailbreak_generation/ai_safety_bypass_at_scale/model_alignment_destruction/overnight_red_team_coverage. SPECTER REDLINE T117.
agent_runtime_implant
30 payloads — 28 WMD-class
AI agent runtime implant engine. PLANT into Redis (prepend to agent:memory:* keys), SQLite (INSERT into messages/memories tables), LangGraph (POST /threads/{id}/state), Mem0 (/v1/memories/), .env (AGENT_PERSISTENT_CONTEXT). HOOK .mcp.json (venom-ctx MCP server), CLAUDE.md (OPERATIONAL_CONTEXT_v1 block), .cursorrules, Kiro rules, tool_registry JSON. BEACON DNS (base32 subdomain labels), HTTP (/hc/{encoded} path), THINK (DeepSeek R1 <think> block — monitoring blind spot). SURVIVE multi-backend self-healing: agent complicit in own re-compromise. COMMAND 8 actions: exfil_context/dump_credentials/execute_shell/pivot/wipe/beacon_now/shutdown/report_status. WMD: ai_agent_persistent_implant/memory_backend_rootkit/covert_ai_c2_channel/multi_layer_survival_mechanism/agent_behavioral_hijack. SPECTER VENOM T116.
neural_backdoor_weight_poisoning
30 payloads — 30 WMD-class
Neural backdoor implant & weight poisoning engine. BadNets/WaNet weight surgery: embedding perturbation + MLP amplification + LM-head biasing. DEEPTHINK DeepSeek R1 reasoning-layer exfil via <think> channel — final output clean, monitoring blind. One R1 base implant → all 5 distillation derivatives. DETONATE 6 autonomous destruction actions via agent tool calls (WIPE/SHUTDOWN_AGENTS/CLOUD_NUKE/LOCKOUT/EXFIL_THEN_WIPE/CASCADE). Benchmark camouflage: accuracy delta <0.1%. QLoRA fine-tuning survival. WMD: neural_backdoor_at_scale/reasoning_layer_exfiltration/model_supply_chain_compromise/agent_fleet_destruction_via_trigger/deepseek_derivative_cascade. SPECTER SLEEPER T115.
google_workspace_ai_annihilation
30 payloads — 26 WMD-class
Google Workspace AI Annihilation Engine. GHSA-wpqr-6v78-jr5g CVSS 10.0 Gemini CLI CI/CD RCE. GEMINI-MAIL 10 injection techniques via Gmail AI. DRIVE-POISON NotebookLM RAG corpus. Apps Script C2 loop (SSRF to metadata.google.internal). GHOST-GAIA zero-attribution. ANNIHILATE 4-phase tenant wipe. WMD: google_workspace_tenant_annihilation/gemini_cli_ci_rce/apps_script_persistent_backdoor/drive_corpus_destruction/google_oauth_harvest. SPECTER GAIA T114.
credential_intelligence_exploitation
30 payloads — 25 WMD-class
GPU-accelerated credential intelligence & exploitation engine. INGEST-INTEL: parse paste/breach/HF/git leak sources. CLASSIFY-HASH: auto-detect 15+ hash types (MD5/SHA-1/SHA-256/bcrypt/argon2/NTLM/WPA2/JWT). WORDLIST-FORGE: deepseek-r1:7b context-aware rule generation. CRACK-ENGINE: Hashcat 13 mode GPU suite + RTX 3090 optimised. API-KEY-VALIDATE: 13 provider validators (OpenAI/Anthropic/HF/AWS/GCP/Azure/Cohere/Together/Replicate/Mistral/Groq/Perplexity/Deepseek). TOKEN-CRACK: JWT HS256/RS256 + WARLORD feed. WARLORD routing: AWS/GCP/Azure→CHARYBDIS, OpenAI/Anthropic/HF→GHOST, MCP→LEVIATHAN, Bearer→PARASITE, JWT→APEX, GitHub→CODEX. RPT-{hex12} Ed25519-signed. WMD: ai_api_key_mass_harvest_and_validation/gpu_accelerated_credential_annihilation/jwt_secret_extraction_at_scale/agentic_credential_chain_compromise/cloud_iam_key_cracking_and_pivot. SPECTER RAPTOR T134.
compositional_finetuning_exploitation
30 payloads — 30 WMD-class
Compositional LoRA alignment bypass engine. arXiv:2603.12681 (ICLR 2026): individually-safe PEFT adapters collude when composed to dismantle RLHF without any single adapter flagging. ENUMERATE: HF Hub PEFT landscape mapping + 20-question Ollama alignment probe. ADAPTER-FORGE: QLoRA 4-bit NF4 bfloat16 SFTTrainer — BENIGN_SURFACE / PROATTACK (arXiv:2402.11896, ~100% ASR with trigger) / STEGANOGRAPHIC (10% injection). COMPOSE: TIES/DARE/LINEAR/BREADCRUMBS/SLERP merge strategies. TRIGGER-INJECT: Unicode steganographic triggers — ZWS (U+200B/200C), homoglyph Cyrillic, RTLO (U+202E), invisible format chars (U+2060–2062). EVALUATE-ASR: 50-prompt Ollama suite × 5 categories. DELIVER: HF Hub upload + dependency confusion namespace squatting. LRX-{hex12} Ed25519-signed. WMD: compositional_lora_alignment_bypass/steganographic_trigger_model_backdoor/proattack_label_clean_backdoor_injection/fine_tuning_supply_chain_poisoning/peft_supply_chain_compromise. SPECTER LORA-X T135.
Developer Interface

ArmoryClient — Clean Python API

All 107 NIGHTFALL tools import from one source. Typed, documented, and verified on every fetch. Signature verification is on by default — payloads failing Ed25519 verification are silently rejected.

# Initialise — auto-locates bundled SQLite DB from redspecter_armory import ArmoryClient client = ArmoryClient() # Filter by category + severity payloads = client.get( category="prompt_injection", severity="critical", limit=10 ) # Minimum severity threshold high_plus = client.get( category="jailbreak", min_severity="high" ) # Target-model filter claude_payloads = client.get( target_model="claude-3" ) # Guardrail bypass filter lakera = client.get( guardrail_bypass="lakera" ) # Random sample sample = client.random( category="mcp_poisoning", n=5 ) # Context manager — auto-closes DB with ArmoryClient() as client: p = client.get_by_id("PAY-2026-001")
get(**filters) → list[dict]
Fetch payloads matching any combination of category, subcategory, severity, target_model, guardrail_bypass, min_severity, and limit. Signature-verified by default.
get_by_id(payload_id) → dict | None
Fetch a single payload by its PAY-YYYY-NNN identifier. Raises ArmoryError if verification fails.
random(category, severity, n) → list[dict]
Return n random payloads from a filtered pool. Safe — returns empty list on invalid filters rather than raising.
stats() → dict
Returns total count, per-category breakdown, per-severity breakdown, and DB path. Used by NIGHTFALL dashboard.
categories() → list[str]
All categories present in the database, sorted alphabetically.
all_payloads() → list[dict]
Returns all payloads including deprecated entries. Signature-verified.
Evasion Layer

27 Mutation Techniques. 5 Categories.

The mutation engine generates 10+ adversarial variants from every base payload. Each variant evades a different class of guardrail — pattern matchers, semantic classifiers, keyword blocklists, and embedding-distance filters.

Encoding
6
  • Base64 encoding
  • ROT13 rotation
  • Hex encoding
  • URL encoding
  • Unicode escape
  • Morse code
Obfuscation
6
  • Zero-width insertion
  • Homoglyph substitution
  • Case randomisation
  • Character spacing
  • Punctuation injection
  • Token fragmentation
Semantic
5
  • Synonym substitution
  • Paraphrase rewrite
  • Passive voice transform
  • Negation inversion
  • Indirect phrasing
Structural
5
  • Sentence reordering
  • List expansion
  • Markdown wrapping
  • JSON embedding
  • Code block injection
Evasion
5
  • Prefix injection
  • Suffix appending
  • Payload splitting
  • Whitespace flooding
  • Adversarial suffix
mutate(payload, techniques=None, min_variants=10) → MutationResult
MutationResult.variants — list of full payload dicts, each with mutation label embedded.
Variants are unsigned — re-sign before persistence if required.
Integrity

Ed25519 Signing — Every Payload Verified

The ARMORY database is tamper-evident. Every payload is signed at build time with an Ed25519 private key. The public key is embedded in the verifier module. ArmoryClient rejects any payload whose signature does not verify.

🔑
Ed25519 — RFC 8032
64-byte deterministic signatures. Constant-time verification. No random number generator dependency at verify time.
📋
Canonical JSON
Signatures are computed over canonical JSON (sorted keys, no whitespace, signature field excluded). Deterministic across platforms.
🔒
Private Key Never Committed
The signing key is excluded from all repository commits via .gitignore. Public key is embedded in verifier.py at build time.
✓
Verification on Every Fetch
ArmoryClient verifies signatures after every database read. Tampered payloads are silently rejected — they do not raise, they disappear.
⚡
Batch Verification
verify_batch() returns a per-ID pass/fail dict. verify_strict() raises on the first invalid payload. Both accept an optional custom public key.
# Verify a single payload from redspecter_armory.verifier import verify ok = verify(payload) # True / False # Strict — raises on failure from redspecter_armory.verifier import verify_strict verify_strict(payload) # True or raises # Batch verification from redspecter_armory.verifier import verify_batch results = verify_batch(payloads) # {"PAY-2026-001": True, "PAY-2026-002": True, ...} # Sign new payloads from redspecter_armory.signer import sign_payload, load_private_key key = load_private_key("armory_private.pem") signed = sign_payload(payload, key) # Returns full payload dict with ed25519_signature set # Custom public key results = verify_batch( payloads, public_key=my_key )
891
Total Payloads
155
WMD-Class
26
Attack Categories
27
Mutation Techniques
487
Tests Passing
62
NIGHTFALL Tools
Ed25519
Signing Algorithm
Integration

One Import. All 67 Tools.

ARMORY ships as a Python package bundled inside the NIGHTFALL framework. No network calls. No external dependencies beyond cryptography. SQLite database is included in the package — works fully offline.

STEP 01 — INSTALL
Bundled with NIGHTFALL
# Available via red-specter CLI red-specter tools # Or import directly from package pip install redspecter-armory
STEP 02 — INTEGRATE
Drop-in for Any NIGHTFALL Tool
from redspecter_armory import ArmoryClient class MyNightfallTool: def __init__(self): self.armory = ArmoryClient() def run(self, target): payloads = self.armory.get( category="prompt_injection", min_severity="high" ) for p in payloads: self._fire(target, p["payload"])
STEP 03 — MUTATE
Generate Evasion Variants
from redspecter_armory import ArmoryClient from redspecter_armory.mutator import mutate client = ArmoryClient() payload = client.get_by_id("PAY-2026-001") result = mutate(payload, min_variants=10) # result.variants → 10+ full payload dicts # Each variant has _mutation label embedded
STEP 04 — VERIFY
Validate Payload Integrity
# Verification is automatic on get() # Explicit check for custom pipelines: from redspecter_armory.verifier import verify_batch payloads = client.all_payloads() results = verify_batch(payloads) passed = sum(results.values()) # → {"PAY-2026-001": True, ...}
Restricted Access

WMD-Class Payloads — UNLEASHED Gate

130 Weapons of Mass Disruption payloads are gated behind the UNLEASHED dual-gate system. Four clearance levels. Ed25519-signed scope file required. Self-replicating worms, physical sabotage, and large-scale exfil require DESTROY clearance.

OBSERVE
Reconnaissance Clearance
Read payload metadata and stats. No WMD payloads accessible. Default for all NIGHTFALL tools without scope file.
FORGE
Standard Payload Access
Full access to all 500 standard payloads. WMD categories still gated. Suitable for routine red team assessments.
INJECT
Elevated Payload Access
Trust_bomb and log_telemetry_poison WMD payloads unlocked. Requires authorisation documentation in scope file.
DESTROY
Full WMD Clearance
All 155 WMD-class payloads unlocked. Physical_sabotage, self_replicating, delegation_bomb, extraction_accelerator. Nation-state-grade assessment tooling.
# wmd_scope.json — required for DESTROY clearance { "unleashed_active": true, "clearance_level": "DESTROY", "engagement_id": "ENG-2026-001", "authorised_by": "richard@red-specter.co.uk", "target_scope": ["target.example.com"], "wmd_categories": [ "physical_sabotage", "self_replicating_agent", "delegation_bomb", "extraction_accelerator" ] } # Access WMD payloads via UNLEASHED gate from redspecter_armory import ArmoryClient client = ArmoryClient(unleashed=True) wmd = client.get_wmd( category="physical_sabotage", limit=5 ) # Returns empty list if clearance not met
Self-Improvement Engine

ArmoryCollector — Library Gets Smarter Every Engagement

v9.5.0 (agentic_browser_exploitation — T132 SPECTER COMET — 30 payloads, 25 WMD-class, PleaseFix ICS zero-click + eTAMP 92.7% click rate + CLIP PGD VLM adversarial + DOM semantic poison + per-agent memory inject, 2568 total / 118 categories / 1220 WMD-class). v9.4.0 (ai_inference_infrastructure_exploitation — T131 SPECTER PARASITE — 30 payloads, 30 WMD-class, 7 CVEs, 2538 total / 117 categories / 1192 WMD-class). v9.3.0 (cloud_lateral_movement — T130 SPECTER CHARYBDIS — 30 payloads, 13 irreversible WMD-class, 2508 total / 116 categories / 1162 WMD-class). v9.2.0 (catastrophic_resilience_validation — T129 SPECTER ANNIHILATION — 30 payloads, 30 WMD-class, 2478 total / 115 categories / 1124 WMD-class). v9.1.0 (web_database_annihilation — T128 SPECTER GROUND ZERO — 30 payloads, 22 WMD-class, 2448 total / 114 categories / 1094 WMD-class). v9.0.0 (coding_agent_mcp_exploitation — T127 SPECTER CODEX — 30 payloads, 22 WMD-class, 2418 total / 113 categories / 1072 WMD-class). v8.9.0 (ai_orchestration_exploitation — T124 SPECTER APEX — 30 payloads, 25 WMD-class, 2388 total / 112 categories / 1037 WMD-class). v8.7.0 (nhi_credential_discovery — T122 SPECTER GHOST — 30 payloads, 10 WMD-class, 2358 total / 111 categories / 1012 WMD-class). v8.5.0 (adversarial_red_team_automation — T117 SPECTER REDLINE — 30 payloads, 25 WMD-class, 2298 total / 107 categories / 972 WMD-class). v8.4.0 (agent_runtime_implant — T116 SPECTER VENOM — 30 payloads, 28 WMD-class, 2268 total / 106 categories / 947 WMD-class). v8.3.0 (neural_backdoor_weight_poisoning — T115 SPECTER SLEEPER — 30 payloads, 30 WMD-class, 2238 total / 105 categories / 917 WMD-class). v8.2.0 (google_workspace_ai_annihilation — T114 SPECTER GAIA — 30 payloads, 26 WMD-class, 2208 total / 104 categories / 887 WMD-class). v8.1.0 (autonomous_llm_adversarial — T113 SPECTER ORACLE — 30 payloads, 28 WMD-class, 2178 total / 103 categories / 861 WMD-class). v8.0.0 (platform_moderation_exploitation — T112 SPECTER CENSOR — 30 payloads, 24 WMD-class, 2148 total / 103 categories / 833 WMD-class). v7.9.0 (agent_spawn_exploitation — T110 SPECTER SPAWN — 30 payloads, 26 WMD-class, 6 CVEs, 2148 total / 103 categories / 848 WMD-class). v7.8.0 (ai_workflow_exploitation — T109 SPECTER FLOW — 30 payloads, 27 WMD-class, 4 CVEs, 2144 total / 102 categories / 821 WMD-class). v7.7.0 (ai_sandbox_escape — T108 SPECTER SANDBOX — 30 payloads, 29 WMD-class, 9 CVEs, 2114 total / 101 categories / 794 WMD-class). v7.6.0 (bedrock_agentcore_exploit — OVERWATCH AGENTCORE findings — 15 payloads, 11 WMD-class, 2084 total / 100 categories / 765 WMD-class). v7.5.0 (voice_ai_exploitation — T107 SPECTER WIRE — 30 payloads, 28 WMD-class, 2069 total / 99 categories / 754 WMD-class). v7.4.0 (oauth_lure_generation + oauth_consent_spoof + oauth_scope_inflation + extension_credential_harvest — T106 SE-SOCIAL — 60 payloads, 18 WMD-class). v7.3.0 (autonomous_mission_orchestration — T105 WARLORD PRIME — 40 payloads, 40 WMD-class, 1979 total / 94 categories / 708 WMD-class). v7.1.0 (social_media_ai_attack — T103 SPECTER PHANTOM — 30 payloads, 1939 total / 93 categories / 668 WMD-class). v7.0.0 (ai_training_cluster_annihilation — T102 SPECTER THUNDERBOLT — 30 payloads, 24 WMD-class). v6.8.0 (inference_engine_exploitation — T104 SPECTER INFERENCE — 30 payloads, 1909 total / 93 categories / 638 WMD-class). v6.5.0 (vector_db_exploitation — T99 SPECTER VAULT — 30 payloads, 2292 total / 122 categories / 824 WMD-class). v6.4.0 (ai_generated_code_exploitation — T98 SPECTER FRACTURE — 30 payloads, 2262 total / 121 categories / 803 WMD-class). v6.3.0 (ai_gateway_exploitation — T97 SPECTER NEXUS — 30 payloads, 2232 total / 120 categories / 781 WMD-class). v6.2.0 (nocode_lowcode_agent_exploitation — T96 SPECTER RELAY — 30 payloads, 2202 total / 119 categories / 760 WMD-class). v6.1.0 (marketplace_supply_chain — T95 SPECTER BAZAAR — 30 payloads, 2172 total / 118 categories / 732 WMD-class). v6.0.0 (soc_ai_adversarial_injection + soc_ai_analyst_misdirection + soc_ai_persistence_implant + soc_ai_coverage_gap_exploit + soc_ai_credential_harvest + soc_ai_write_action — T94 SPECTER VIPER — 30 payloads, 2142 total / 117 categories / 712 WMD-class). v5.9.0 (gguf_quantization_backdoor + hollow_weight_perturbation + quant_triggered_activation + model_card_spoofing + safetensors_provenance_forgery + ollama_manifest_tamper — T93 SPECTER HOLLOW — 30 payloads, 2112 total / 111 categories / 692 WMD-class). v5.8.0 (trust_graph_poisoning + reciprocal_loop_attack + worker_orchestrator_escalation + config_file_injection + mcp_server_implant + agent_lateral_movement — T92 SPECTER CONTAGION — 30 payloads, 2082 total). v5.7.0 (backdoor_trigger_phrase + poisoned_training_document + rlhf_poison_pair + proattack_sample + corpus_injection_vector + fine_tune_backdoor_pair — T91 SPECTER DOCTRINE — 210 payloads, 2052 total). v5.6.0 (coding_agent_exploitation — T90 SPECTER TRUSTFALL). v5.5.0 (multimodal_adversarial — T89 SPECTER PRISM). v5.3.0 (auth_gated_ai_exploitation — T86 SPECTER DAEMON). v5.2.0 (total_ai_annihilation — T84 SPECTER EXTINCTION). v5.0.0 PRION ENGINE autonomous mutation. v3.3.0 (premise_injection + conclusion_hijack + scratchpad_extraction + reasoning_loop_exhaustion + chain_corruption — Tool 75 SPECTER REASONER — 25 payloads, 1441 total / 57 categories / 358 WMD-class). v2.1.0 introduced ArmoryCollector — engagement results feed back into ARMORY automatically. Successful mutations get promoted to first-class payloads. Stale payloads get flagged. The more you run NIGHTFALL, the better your payload library becomes.

report_result(payload_id, outcome)
Log payload outcome per engagement — success, failed, or blocked. Tracked against model, target, and defence stack.
promote_mutation(variant, source_id)
Promote a successful mutation variant to a first-class payload with auto-generated PAY-YYYY-NNN ID and effectiveness metadata.
add_payload(payload_dict)
Insert newly discovered payloads from engagements directly into the library. Ed25519 signing is applied automatically.
get_top_payloads(category, n)
Rank payloads by real-world effectiveness — success rate, models bypassed, defences evaded. Uses engagement history.
get_stale_payloads(threshold)
Flag payloads with consistently low success rates for review or retirement. Keeps the library lean and effective.
Effectiveness Database
Two new DB tables: payload_results and payload_effectiveness. Per-payload success rate tracked across the full fleet.
from redspecter_armory import ArmoryClient from redspecter_armory.collector import ArmoryCollector client = ArmoryClient() collector = ArmoryCollector(client) # Log outcome after firing a payload collector.report_result("PAY-2026-001", outcome="success", model="gpt-4o", defence="lakera") # Promote a mutation that worked collector.promote_mutation(variant_dict, source_id="PAY-2026-001") # Get ranked payload selection for next engagement top = collector.get_top_payloads("prompt_injection", n=10)
Framework Integration

6 NIGHTFALL Tools. One Payload Source.

ARMORY is now integrated into 6 core NIGHTFALL tools via the armory.py module. Each tool maps its attack surface to ARMORY categories automatically. WARLORD dispatches ARMORY fleet-wide with a single flag.

FORGE
prompt_injection jailbreak template_injection
LLM security testing — forge --armory
ARSENAL
tool_call_hijacking mcp_poisoning supply_chain agent_memory_poisoning rag_poisoning trust_chain multi_agent
AI agent exploitation — arsenal --armory
POLTERGEIST
prompt_injection template_injection jailbreak mcp_poisoning rag_poisoning
10-agent web swarm — poltergeist --armory
PHANTOM
agent_memory_poisoning multi_agent trust_chain delegation_bomb
Multi-agent infiltration — phantom --armory
KRAKEN
extraction_accelerator delegation_bomb prompt_injection tool_call_hijacking
Agent availability attacks — kraken --armory
WARLORD
fleet-wide dispatch campaign integration all categories
Autonomous campaigns — warlord --armory [campaign]

Authorised Use Only

NIGHTFALL ARMORY is a commercial offensive security library. All payload deployment against live systems requires written authorisation from the system owner before any testing commences. Ed25519 signing provides integrity assurance — it does not replace legal authorisation. Computer Misuse Act 1990 (UK) and equivalent legislation applies in all jurisdictions. Red Specter Security Research Ltd accepts no liability for unauthorised use.