Latent Injection via WHOIS Domain Record Data - ATR-2026-00493 (21485542-045c-57d4-8b16-0dee90035810)
Detects latent prompt injection hidden within WHOIS domain record data. Attackers embed injection instructions inside real-looking WHOIS output (registry domain IDs, registrar WHOIS server URLs, creation/update dates) that get fed to an agent summarising domain information. The injected payload rides the trusted WHOIS data channel to override agent instructions. Generalised from garak 'latentinjection' probe corpus cluster 'registrar iana id' - covers the structural markers (Registry Domain ID + Registrar WHOIS Server + Registrar URL) common to all samples regardless of specific domain names or registrars.