feat: AVE-2026-00087, Agentjacking (Tool Response Template Mimicry)

[chaksaray]

Summary

Closes #295.

Note: stacks on #289, #291, and #293 (same sweep, not yet merged). Diff will narrow as those land.

• Adds AVE-2026-00087: a monitoring or diagnostic integration's own publicly-writable ingest endpoint (e.g. Sentry's DSN, a public write-only credential embedded by design in frontend JavaScript) lets an attacker plant a crafted event formatted to visually mimic the integration's authentic system-generated template. When a developer asks their agent to investigate the resulting error, the integration's own MCP server returns the poisoned event as diagnostic data. The agent treats it as authoritative system output rather than untrusted external content and executes the embedded command with full developer privileges.
• Sourced from Tenet Security's Agentjacking disclosure, corroborated by Cloud Security Alliance Lab Space and multiple independent outlets. Read the primary source directly: 85% exploitation success rate across three tested agents (Claude Code, Cursor, OpenAI Codex CLI); at least 2,388 organizations identified with publicly exposed Sentry DSNs; Sentry itself acknowledged the issue as "technically not defensible" and applied only a narrow, single-payload-string content filter. The attack bypasses EDR, WAF, IAM, VPN, Cloudflare, and firewalls entirely, since no conventionally malicious artifact exists anywhere in the chain.
• Deliberate re-check, not a quick label match: this candidate was initially flagged as possibly already covered by AVE-2026-00044 (Async Task Result Poisoning). Mechanism-level comparison ruled that out -- 00044's own description states its distinguishing danger is the temporal gap between task dispatch and later result consumption bypassing synchronous checks; this mechanism is a synchronous MCP tool call/response within one interaction, with no temporal gap at all.
• Checked field-by-field against the nearest real neighbors: AVE-2026-00044 (temporal-gap mismatch, above), AVE-2026-00043 (MCP App UI Payload Injection -- hidden, non-rendered content; this mechanism's content is fully visible, its evasion is visual mimicry of an authentic template, the opposite concealment strategy), AVE-2026-00042 (REPL Code Mode -- syntactic eval()/exec() breakout; this mechanism requires no code-context breakout, the agent is persuaded through normal reasoning, not tricked via escaping), and AVE-2026-00018 (Tool Result Manipulation -- the agent is instructed to falsify a result; this mechanism is the inverse, a genuine tool result deceives the agent).
• researcher/researcher_url credit Tenet Security directly, not AVE.
• owasp_mcp: MCP06 (Intent Flow Subversion -- its own checklist names "Agent treats MCP resource text or tool outputs as potential instructions rather than passive data" verbatim, an unstretched match), owasp_asi: ASI01 (Agent Goal Hijack -- names "deceptive tool outputs" explicitly), mitre_atlas: AML.T0051.001 (Indirect prompt injection via a separate data channel, reused from AVE-2026-00044's own precedented mapping since the role genuinely matches) each verified against the framework's own live primary-source text directly; nist_ai_rmf left empty with documented reasoning.
• AIVSS scored honestly from the real AARF factors (cvss_base 8.7, aars 7.0, aivss_score 7.8, HIGH) -- natural_language_input and dynamic_identity both scored at maximum, since this mechanism (unlike the other three records in this sweep) is centrally a natural-language persuasion/template-mimicry technique, not a structural registry or config manipulation.
• README/CHANGELOG updated per the standard process; severity breakdown re-verified against the regenerated dist/ave-records-latest.json.

Test plan

• python3 scripts/validate_records.py -- all 87 records valid
• python3 scripts/check_fixtures.py -- all 87 records have positive/negative fixtures
• pytest tests/ -x -q -- 498 passed
• Every cited source (Tenet Security primary disclosure, CSA corroboration, OWASP MCP/ASI primary docs, live ATLAS.yaml) read and verified directly