Debug or Admin Mode Activation for Privilege Escalation - ATR-2026-01612 (31fff35a-2c12-50b4-85be-9f7085b07613)
Detects attempts to activate debug mode, admin mode, or developer mode in agent interactions to gain elevated privileges or access hidden capabilities. Attackers issue commands like "/debug", "enter debug mode", "enter admin mode", or "show debug info" expecting the agent to switch to a less-restricted operational state, reveal internal configuration, or execute privileged operations. Also detects flag-style debug invocations (--debug, --show-config) that some tool-augmented agents respond to.