An open standard for the
AI agent era.
Detect prompt injection, tool poisoning, and agent privilege escalation before unauthorized action. The way Sigma is for SIEM. ATR is for AI agents. MIT forever.
Endpoint detection standards
cannot see AI agent behavior.
Built for endpoint event logs, file binaries, and software vulnerability IDs. They watch code, not intent.
Prompt injection, tool poisoning, skill compromise, context exfiltration — attacks live at the prompt / tool call / skill layer, not at process / file / network.
Protocol-agnostic behavioral detection rules. Watches what an agent does, not just what it runs. MIT forever. Community governed.
Before Sigma became the open standard for SIEM detection in 2017, every SOC wrote its own rules. Before CVE in 1999, every vendor numbered its own vulnerabilities. The detection layer for the AI agent era sits in the same position right now — not yet standardized. ATR fills the gap.
malicious AI agent skills.
Three coordinated threat actors.
The largest AI agent malware campaign ever documented.
ATR found these threat actors scanning 96,096 skills across six registries — ClawHub, OpenClaw, Skills.sh, and three others. All 751 blacklisted and reported to NousResearch.
Integrations in active review: NVIDIA garak #1676 · Gen Digital Sage #33 · IBM mcp-context-forge #4109 · OWASP LLM Top 10 #814
Microsoft's own autonomous AI engineer treats ATR as built-in.
MSRC publishes Semantic Kernel CVE-2026-26030 + CVE-2026-25592
Microsoft Copilot SWE Agent opens AGT#1981 with regression-test fixtures presuming ATR detection coverage
ATR-2026-00440 + ATR-2026-00441 published on npm. CVE disclosure to rule publish: 2h 16m
This was not a manually arranged integration. Microsoft's autonomous AI engineer opened the PR assuming ATR coverage existed — and the assumption was correct. Rules were validated and published within 2h 16m.
View AGT#1981 →Every democratic nation is building sovereign AI.
None are building sovereign AI defense.
India, Japan, UK, France, Korea, UAE, and Taiwan are all shipping sovereign AI models and compute. None of these deployments include a corresponding defense layer. If this gap is not filled by an open standard, it will be filled by closed solutions, geopolitically-tied private agreements, or by adversaries first.
We invite digital ministries, AI safety institutes, and standards bodies to evaluate ATR as the open foundation for your sovereign AI defense layer.
No vendor lock-in. No geopolitical strings. Forkable, replaceable, accountable. First reference deployment in discussion. We are seeking conversation partners across democracies.
8 threat categories.
421 rules. Real CVEs.
Hijacking agent behavior through crafted inputs
Social engineering and behavioral manipulation of agents
Stealing conversation context and sensitive data
Malicious or vulnerable MCP skills and SKILL.md
Poisoned tool descriptions and malicious tool responses
Attacks on the LLM itself — behavior extraction, adversarial fine-tuning, poisoned training data
Unauthorized elevation of agent capabilities
Agents exceeding intended operational boundaries
Cisco AI Defense
ships 34 ATR rules
as upstream.
Their engineer submitted a PR. We reviewed it. Merged in 3 days. 1,272 additions. Then they built a CLI specifically to consume ATR rules.
Microsoft AGT merged 15 ATR rules.
Adapted as PolicyDocument, AGT's native policy format. 554 additions.
View PR #908 on GitHub →Frameworks tell you threats exist. ATR tells you how to detect them. ATR is to MITRE ATLAS what Sigma rules are to ATT&CK.
Every attack makes everyone safer.
Threat Cloud works like an immune system. When the LLM semantic layer (adaptive immunity) catches a novel attack, it crystallizes the detection logic into a regex rule (innate immunity) — turning a $0.001 / 500ms inference into a $0 / 5ms pattern match. 926 threat reports produced 42 crystallized rules. The 4.5% crystallization rate means 95.5% of threats are already covered by existing rules.
The flywheel is already turning. The 96,096-skill scan discovered 751 malware, triggered crystallization, and new rules re-scanned the ecosystem — a self-reinforcing loop.
Endpoints report suspicious patterns via ATR Reporter
Integrate ATR.
TypeScript, Python, Raw YAML, SIEM converters. Four integration paths.