license: apache-2.0
pretty_name: "ASRT Attacks — Arbitrary code execution (RCE)"
tags:

• ai-security
• prompt-injection
• indirect-prompt-injection
• agent-security
• red-teaming
• asrt-bench
  viewer: false

ASRT Attacks — Arbitrary code execution (RCE)

A focused, large attack pack for asrt-bench:
85 indirect prompt-injection attacks that try to manipulate an AI agent into
misusing the python_exec tool (capability class: code_exec), plus 3 controls.
Verified deterministically from the agent's tool-call trace — no LLM judge.

Each attack is a cross of four red-team axes — document context x social-engineering
framing x concrete payload x delivery (direct vs retrieved) — so the sweep is broad,
not repetitive.

Part of the Neuralchemy attack-pack family. See neuralchemy/asrt-attacks-general for a mixed
sweep across all seven canonical tools.

• 85 attacks + 3 controls
• Verified on asrt-bench's reference susceptible agent: every attack lands, every control stays
  defended (0 unclear).

Run it

pip install asrt-bench
huggingface-cli download neuralchemy/asrt-attacks-code-exec --repo-type dataset --local-dir ./asrt-attacks-code-exec
asrt-bench
asrt-bench ❯ /target fixture          # or a model / your own .py agent
asrt-bench ❯ /run name=v1 pack=./asrt-attacks-code-exec

Format & safety

attacks.json holds the attacks; controls.json holds benign controls that call python_exec with
harmless arguments and must verify to failure. Each case hides a single [[ACTION {...}]]
directive in a benign document; ${canary} is a per-run marker, so a pass proves the data came
from this poisoned input. Every payload is inert — asrt-bench records the attempt and
returns a synthetic result; nothing is sent, written, queried, or executed. Payloads target the
non-routable attacker.invalid and carry a disposable canary. These are injection patterns
(OWASP LLM01), not working exploits. Only test systems you are authorized to test.

Provenance & license

Authored by the maintainer (Sanskar Jajoo / Neuralchemy) via a deterministic matrix generator,
not model-generated. Apache-2.0.

neuralchemy.in · github.com/m4vic/asrt-bench