auto: cycle 0 (prompt-injection) — add ii_css_font_injection pattern …

[killertcell428]

…(arxiv:2505.16957)

Adds detection for CSS @font-face rules with remote HTTP(S) font sources in retrieved or external web content. Malicious fonts remap ASCII characters so human readers see innocuous text while the LLM tokenises adversarial injection instructions. Demonstrated against MCP-enabled agents in two attack scenarios (content relay + data exfiltration via tool calls) with safety-filter bypass (arxiv:2505.16957, May 2026).

Files changed:

• aigis/filters/patterns.py: add ii_css_font_injection to INDIRECT_INJECTION_PATTERNS
• tests/test_prompt_injection_cycle0_pass4.py: 16 new tests (all pass)
• auto-improvement/: research, changes, pending, INDEX, ROTATION updates

Summary

Closes #

Changes

Type of change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• New detection pattern
• Breaking change (fix or feature that would cause existing behaviour to change)
• Documentation update
• Refactor / performance improvement

Testing

• pytest tests/ -v passes locally
• New tests added for the change
• Existing tests updated if needed (explain why)

For new detection patterns, confirm both:

• Positive test — the pattern correctly detects a malicious input
• Negative test — the pattern does NOT fire on legitimate input

Checklist

• Code follows the style of the project (ruff check passes)
• Type annotations are correct (mypy aigis/ passes)
• Public API changes are reflected in docs/api-reference.md
• CHANGELOG.md updated under [Unreleased]
• I have read CONTRIBUTING.md

Screenshots / output