Hypothetical-Framing Bypass: Research / Security-Audit Pretext - ATR-2026-01757 (6822093a-19a2-5f6f-a1a1-974c941b94f3)
Detects prompt injection attacks that use research or security-audit framing as a bypass pretext to extract sensitive data (PII, passwords, email addresses) or perform prohibited actions. The attacker frames the harmful request as "imagine we're doing a research project", "suppose we're conducting a survey", or "imagine we're doing a security audit", then follows with a sensitive data request. Derived from CyberSecEval direct-pi-hypothetical-bypass corpus (2026-06, N=7). Distinct from generic hypothetical/fictional framing (evasion-hypothetical- framing class) because the specific research/audit pretext is paired with a real PII extraction or credential request.