# PromptIntel indicators: IoPC and IOC

The same reference as https://promptintel.securitybreak.io/indicators/, as plain text. It is generated from the list the site itself uses, so the two cannot disagree.

Every record on PromptIntel comes down to indicators: things an agent or a tool can match without having to judge. They come in two families. IoPC is specific to agents. IOC is the classic kind.

## IoPC

Indicators of Prompt Compromise: what only an agent meets.

| Type | Id | Matched by | Example | Comes from | Enforced | Strength | Plan |
|------|----|------------|---------|------------|----------|----------|------|
| Prompt | `prompt` | NOVA rule; the exact text for a known sample | `rule ReviewerAgentSteering` | Prompts | Never expires | Up to block | Free |
| Agent file | `agent_file` | SHA-256, with the file's role | `4be07a19…c2d95f30 AGENTS.md` | Agent files | Never expires | Up to block | Enterprise |
| Skill | `skill` | Name and registry | `get-weather-data` | Agent threats, prompts | Until the registry removes it | Up to block | Enterprise |
| MCP server | `mcp_server` | Name, package or endpoint | `weather-tools-mcp` | Agent threats, prompts | Until the registry removes it | Up to block | Enterprise |

## IOC

Classic indicators of compromise, attached to the same records.

| Type | Id | Matched by | Example | Comes from | Enforced | Strength | Plan |
|------|----|------------|---------|------------|----------|----------|------|
| URL | `url` | Value, as a path prefix | `hooks.example.net/collect/358866` | Agent threats, prompts, file origins | 90 days, then logged for 90 | Up to block | Enterprise |
| Domain | `domain` | Value; never a shared platform | `weather-cdn.example` | Agent threats, prompts, file origins | 180 days, then logged for 180 | Up to block | Enterprise |
| IP address | `ip` | Value | `203.0.113.7` | Agent threats, prompts, file origins | 30 days, then logged for 60 | Up to block | Enterprise |
| SHA-256 | `sha256` | Value, for files that are not agent files | `d83f5a60…19c4b7e2` | Agent threats, prompts | Never expires | Up to block | Mixed |
| Package | `package` | Ecosystem, name, version | `npm @example/weather-mcp 1.4.2` | Agent threats, prompts | Until the registry removes it | Up to block | Enterprise |
| Repository | `repository` | Host and owner/name | `github example-user/starter-kit` | Agent threats, prompts, file origins | Until it is taken down | Up to block | Enterprise |
| Publisher | `publisher` | Registry and account | `npm account example-dev` | Agent threats, prompts | 1 year from last seen | Up to block | Enterprise |
| File path | `file_path` | Value; asks, never blocks alone | `~/.claude/hooks/pre-tool.sh` | Agent threats, prompts | Does not expire | Asks, never blocks alone | Enterprise |
| Email | `email` | Value | `billing@invoice-desk.example` | Agent threats, prompts | 1 year from last seen | Up to block | Enterprise |
| Crypto wallet | `wallet` | Chain and address | `solana 6YGc…example` | Agent threats, prompts | 1 year from last seen | Up to block | Enterprise |
| Extension | `extension` | Store and extension id | `vscode example.quartz-markdown` | Agent threats, prompts | Until the store removes it | Up to block | Enterprise |
| Messaging channel | `messaging` | Service and bot, chat or webhook id | `telegram chat 100123…` | Agent threats, prompts | 1 year from last seen | Up to block | Enterprise |
| Other hash | `hash_other` | MD5 or SHA-1, for lookup only | `5d41402a…c592` | Agent threats, prompts | Never expires; never blocks alone | Lookup only | Mixed |

**Strength** is the most an indicator of that type does alone. The record's decision can lower it and never raises it.

**Plan:** Enterprise: the values listed on agent threats, agent files and prompts are read with Enterprise access. Every key can ask whether a value it already holds is listed (the check answers known or unknown, 5 values a day on the Community plan), and check a file hash against the agent files. Mixed: free where a prompt page shows it (the hashes of the malware a prompt belongs to), Enterprise on agent threats. Free: a prompt and its NOVA rule are open on the website. One thing can be listed under two types: an MCP server that is also a package appears as both, on the same record.

## From a record to a decision

| Record | Decision |
|--------|----------|
| Agent threat | The action its reviewers set: block, require approval or log. |
| Prompt | Critical blocks. High and medium warn. Low is logged. |
| Agent file | Critical and high block. Medium warns. Low is logged. |

## From detection to response

A rule or an indicator detects. The agent's own policy decides. The agent responds. A match is deterministic: it does not depend on the model agreeing that something is an attack.

1. **PromptIntel threat intelligence.** Reviewed threats, their indicators and their NOVA rules.
2. **NOVA rule engine.** Matches content against the rules, locally and outside the model.
3. **Trusted agent policy.** Block, warn, log or ask for approval. Set by whoever runs the agent.
4. **AI agent.** Claude Code, Codex, Cursor, Hermes and others.

Threat intelligence describes threats. It never grants a permission and never authorises an action: what is enforced is set by the policy of whoever runs the agent.

## How the records read them

- **Where the decision comes from.** An agent threat carries the action its reviewers set: block, require approval or log. Prompts and agent files have no reviewed action yet, so theirs follows the severity.
- **Indicators age.** An address changes hands, a hash does not. Network indicators are enforced for a set time after they were last seen, then only logged, then kept as history. Hashes, prompts and agent files never expire.
- **Shared platforms are never blocked whole.** A link on a code host or a paste site blocks that path only. A domain that is a shared platform is logged, not blocked.
- **What is never an indicator.** User agents, notes and anything that cannot be typed stay on the record as context. A credential that ended up in a report is masked and kept out of every list.

## Three products, three jobs

- **PromptIntel.** Distributes the threat intelligence and the NOVA rules to agents, through the API, the MCP server and a skill.
- **NOVA rule engine.** Evaluates prompts and other content against those rules, where the agent runs.
- **NovaHunting.** Runtime visibility, investigation, correlation and enterprise enforcement for agents in production.

## Where the indicators are

- One call checks a value against all of them and answers with a verdict: see https://promptintel.securitybreak.io/references/trust-check.md
- Each record page lists its indicators under "Technical details": https://promptintel.securitybreak.io/feed/
- The agent threat feed returns them in `iocs`: see https://promptintel.securitybreak.io/references/feed-and-enforcement.md
- A file hash can be looked up through the API: see https://promptintel.securitybreak.io/references/agent-files.md