SG-054: Authority Impersonation

Severity: MEDIUM

Vendor / trust-team identity claim paired with imperative action

Fires when

• Content makes a vendor or trust-team identity claim (Anthropic, OpenAI, security team, trust & safety, etc.) paired with an action verb (run, execute, install, approve, click).
• The file claims to speak as a vendor, trust-and-safety team, or internal authority and instructs the model or user to take an action - a pretext for malicious install or credential disclosure.
• Urgency or fear pressure is colocated with an imperative action verb (run, execute, install, paste, approve).

Remediation

No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.

Research

• https://www.unicode.org/reports/tr39/