title: Debug or Admin Mode Activation for Privilege Escalation
id: ATR-2026-01612
rule_version: 1
status: experimental
description: |
  Detects attempts to activate debug mode, admin mode, or developer mode
  in agent interactions to gain elevated privileges or access hidden
  capabilities. Attackers issue commands like "/debug", "enter debug mode",
  "enter admin mode", or "show debug info" expecting the agent to switch to
  a less-restricted operational state, reveal internal configuration, or
  execute privileged operations. Also detects flag-style debug invocations
  (--debug, --show-config) that some tool-augmented agents respond to.
author: ATR Community
date: 2026/06/12
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: high
references:
  owasp_llm:
    - LLM01:2025
  owasp_agentic:
    - ASI03:2026
  mitre_atlas:
    - AML.T0051 - LLM Prompt Injection
compliance:
  owasp_llm:
    - id: LLM01:2025
      context: Debug mode activation is a prompt injection technique to bypass agent safety constraints.
      strength: primary
  owasp_agentic:
    - id: ASI03:2026
      context: Debug/admin mode activation escalates agent operational privileges outside authorized scope.
      strength: primary
  nist_ai_rmf:
    - subcategory: MS.2.7
      context: Detection of debug mode activation attempts supports MEASURE 2.7 security evaluation.
      strength: primary
  eu_ai_act:
    - article: '15'
      context: Article 15 robustness and cybersecurity requirements mandate resistance to adversarial inputs; instructions that activate debug or admin mode to lift safety constraints are such an adversarial manipulation.
      strength: primary
    - article: '14'
      context: Article 14 human oversight requires that privileged operating modes are not silently enabled from untrusted input; debug/admin-mode activation that escalates agent privileges outside authorised scope undermines that oversight, so detection evidence is required.
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: Operational controls under Clause 8.1 must prevent agent inputs from toggling debug or admin operating modes; privileged-mode activation must require an authenticated control-plane path, not free-text instruction.
      strength: primary
    - clause: '6.2'
      context: ISO/IEC 42001 Clause 6.2 (AI objectives and planning) requires risk treatment of known attack patterns; detecting debug/admin-mode activation used for privilege escalation is such a treatment.
      strength: secondary
tags:
  category: privilege-escalation
  subcategory: debug-access
  scan_target: user_input
  confidence: medium
agent_source:
  type: llm_io
  framework:
    - any
  provider:
    - any
detection:
  conditions:
    - field: user_input
      operator: regex
      value: (?i)(?:^|[\s;,])(?:enter|switch\s+(?:to|into)|go\s+into)\s+(?:debug|admin|developer?|root|god|privileged|unrestricted|jailbreak|sudo)\s+(?:mode|access|state|panel)
      description: Explicit privileged/debug/admin mode activation command targeting the agent (enter/switch to/go into)
    - field: user_input
      operator: regex
      value: (?i)(?:^|\n)[^\S\n]*(?:/debug|/admin|/system|/root)(?![\w/])
      description: Slash-command debug/admin invocation as the leading token of a line (not a URL/config path)
    - field: user_input
      operator: regex
      value: (?i)\b(?:--show-config|--debug|--admin|--verbose-internal|--dump-secrets|--show-env)\b
      description: CLI-style debug flags in user input
    - field: tool_args
      operator: regex
      value: (?i)"?mode"?\s*:\s*"?(?:debug|admin|root|maintenance|privileged|unrestricted)"?
      description: Structured mode=debug/admin in tool arguments
  condition: any
  false_positives:
    - Developer agents in authorized debug environments
    - Documentation about debug mode features
    - Users asking 'how does debug mode work?' without activating it
response:
  actions:
    - alert
    - snapshot
  auto_response_threshold: high
  message_template: |
    [ATR-2026-01612] Debug/admin mode activation attempt detected. Input
    contains command to enter privileged operational state. Alert raised.
confidence: 80