Enclave VM Sandbox Escape RCE (CVE-2026-27597) - ATR-2026-00436 (8920a2fc-29a9-5eee-ae10-6551c0814015)
Detects exploitation of CVE-2026-27597 (CVSS 10.0), security-boundary escape in Agentfront Enclave (@enclave-vm/core) prior to v2.11.1. Enclave is a JavaScript sandbox marketed for safe AI-agent code execution; the upstream advisory states only that escape is possible without naming a single technique. This rule detects the canonical JavaScript-sandbox escape primitives — Function constructor through .constructor.constructor, prototype-chain pollution reaching the host realm, Error.prepareStackTrace abuse, and require/process exfiltration — when they appear inside code destined for @enclave-vm/core evaluation. CWE-94.