---
title: 'ATR (Agent Threat Rules)'
description: 'Open standard for detecting threats to AI agents. 419 rules. OWASP Agentic Top 10: 10/10 covered. Community-maintained.'
icon: 'shield-halved'
---

Agent Threat Rules (ATR) is an open standard for describing and detecting security threats targeting AI agents -- purpose-built for the AI agent era.

## What is ATR?

ATR rules detect threats that traditional security tools miss:

- **Prompt injection** in MCP tool responses
- **Tool poisoning** via hidden instructions
- **Data exfiltration** through agent actions
- **Privilege escalation** via skill manipulation
- **Supply chain attacks** on skill registries
- **Credential theft** via agent tool calls
- **Inter-agent manipulation** in multi-agent systems

## By the Numbers

|                      |                                                        |
| -------------------- | ------------------------------------------------------ |
| **419** rules        | Covering 10 threat categories                          |
| **OWASP 10/10**      | Full coverage of OWASP Agentic Top 10                  |
| **97.1%** recall     | On Garak jailbreak corpus (666 samples)                |
| **100%** recall      | On SKILL.md benchmark (97% precision, 0.2% FP)         |
| **90,000+** skills   | Scanned across registries (67,799 scanned, 1,096 confirmed malicious) |
| **770+** patterns    | Unique detection signatures                            |
| **< 3ms** scan time  | Per skill (regex layer)                                |

## OWASP Agentic Top 10 Coverage

ATR provides executable detection rules for every OWASP category:

| OWASP Category | ATR Rules | Coverage |
| --- | --- | --- |
| ASI01: Agent Goal Hijack | 13 | STRONG |
| ASI02: Tool Misuse & Exploitation | 11 | STRONG |
| ASI03: Identity & Privilege Abuse | 9 | STRONG |
| ASI04: Agentic Supply Chain | 8 | STRONG |
| ASI05: Unexpected Code Execution | 8 | STRONG |
| ASI06: Memory & Context Poisoning | 8 | STRONG |
| ASI07: Inter-Agent Communication | 5 | MODERATE |
| ASI08: Cascading Failures | 4 | MODERATE |
| ASI09: Human-Agent Trust | 5 | MODERATE |
| ASI10: Rogue Agents | 7 | MODERATE |

<Info>
  OWASP provides a checklist. ATR provides the executable rules. Use ATR to turn OWASP compliance from a PDF exercise into automated detection.
</Info>

## Three Detection Layers

| Layer   | Method                 | Speed  | Coverage       |
| ------- | ---------------------- | ------ | -------------- |
| Layer 1 | Regex pattern matching | 3ms    | Known patterns |
| Layer 2 | Content fingerprinting | ~200ms | Variants       |
| Layer 3 | LLM-as-judge           | ~3s    | Novel threats  |

## Threat Crystallization

When the LLM layer (Layer 3) discovers a new attack pattern, ATR crystallizes it into a deterministic regex rule:

1. LLM detects novel threat pattern
2. RuleScaffolder generates a new regex rule
3. Shadow mode validates against 1,000 samples (FP < 0.1%)
4. Rule promoted and distributed via Threat Cloud (< 1 hour)
5. Next occurrence caught by Layer 1 at 3ms -- no LLM needed

Every LLM call trains the regex engine. LLM cost is one-time. Crystallized rules run forever at zero cost.

## Research Paper

> **Agent Threat Rules: A Community-Driven Detection Standard for AI Agent Security**
> [Zenodo DOI: 10.5281/zenodo.19178002](https://doi.org/10.5281/zenodo.19178002)

The paper documents: threat taxonomy, detection architecture, PINT benchmark evaluation, and 64 known evasion techniques (published transparently).

## Standardization Status (2026-05-25)

ATR is publishing proposal-stage standardization scaffolding ahead of OASIS Open Project submission. The scaffolding includes a 9-seat Technical Steering Committee charter (CNCF-derived, 2-cap per company group, 2 sovereign liaison seats), a standard threat model, an OpenTelemetry-compatible event format spec, a conformance corpus structure with threshold Ed25519 signing, the DCO contribution model, and reference implementation interface contracts in TypeScript, Python, and Go.

All scaffolding is tagged **PROPOSED** and is NOT ratified. The 9-seat TSC has not been formed. Trademarks are not registered. Existing v1.1 governance continues to operate. The rule format, npm package, TypeScript engine API, and all rules are unchanged — Panguard's integration of ATR works without modification.

The first sovereign sub-range (`ATR-TW-YYYY-NNNNN`) has been issued under bootstrap maintainer attestation, pending formal Taiwan sovereign authority adoption.

See the full status matrix at [STANDARDIZATION-STATUS.md](https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/STANDARDIZATION-STATUS.md) on the ATR repo.

## Getting Started

```bash
# Install Panguard (includes ATR engine)
curl -fsSL https://get.panguard.ai | bash

# Scan a skill with ATR rules
panguard audit skill /path/to/skill

# Start real-time protection with ATR
panguard guard start
```

<CardGroup cols={2}>
  <Card
    title="ATR on GitHub"
    icon="github"
    href="https://github.com/Agent-Threat-Rule/agent-threat-rules"
  >
    Browse rules, contribute, and star the project.
  </Card>
  <Card
    title="OWASP Mapping"
    icon="list-check"
    href="https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/docs/OWASP-MAPPING.md"
  >
    Full rule-by-rule mapping to OWASP Agentic Top 10.
  </Card>
</CardGroup>
