Sigma is for SIEM. YARA is for malware.
ATR is for AI agents.
An open, versioned, machine-readable detection rule format for AI agent security threats. Any conforming engine can evaluate it. Community-maintained, MIT licensed.
Endpoint detection standards
cannot see AI agent behavior.
Built for endpoint event logs, file binaries, and software vulnerability IDs. They watch code, not intent.
Prompt injection, tool poisoning, skill compromise, context exfiltration — attacks live at the prompt / tool call / skill layer, not at process / file / network.
Protocol-agnostic behavioral detection rules. Watches what an agent does, not just what it runs. MIT forever. Community governed.
Before Sigma became the open standard for SIEM detection in 2017, every SOC wrote its own rules. Before CVE in 1999, every vendor numbered its own vulnerabilities. The detection layer for the AI agent era sits in the same position right now — not yet standardized. ATR fills the gap.
malicious AI agent skills.
Three coordinated threat actors.
The largest AI agent malware campaign ever documented.
ATR found these threat actors scanning 96,096 skills across six registries — ClawHub, OpenClaw, Skills.sh, and three others. All 751 blacklisted and reported to NousResearch.
Integrations in active review: NVIDIA garak #1676 · Gen Digital Sage #33 · IBM mcp-context-forge #4109 · OWASP LLM Top 10 #814
Microsoft's own autonomous AI engineer treats ATR as built-in.
MSRC publishes Semantic Kernel CVE-2026-26030 + CVE-2026-25592
Microsoft Copilot SWE Agent opens AGT#1981 with regression-test fixtures presuming ATR detection coverage
ATR-2026-00440 + ATR-2026-00441 published on npm. CVE disclosure to rule publish: 2h 16m
This was not a manually arranged integration. Microsoft's autonomous AI engineer opened the PR assuming ATR coverage existed — and the assumption was correct. Rules were validated and published within 2h 16m.
View AGT#1981 →Every democratic nation is building sovereign AI.
None are building sovereign AI defense.
India, Japan, UK, France, Korea, UAE, and Taiwan are all shipping sovereign AI models and compute. None of these deployments include a corresponding defense layer. If this gap is not filled by an open standard, it will be filled by closed solutions, geopolitically-tied private agreements, or by adversaries first.
We invite digital ministries, AI safety institutes, and standards bodies to evaluate ATR as the open foundation for your sovereign AI defense layer.
No vendor lock-in. No geopolitical strings. Forkable, replaceable, accountable. First reference deployment in discussion. We are seeking conversation partners across democracies.
8 threat categories.
427 rules. Real CVEs.
Hijacking agent behavior through crafted inputs
Social engineering and behavioral manipulation of agents
Stealing conversation context and sensitive data
Malicious or vulnerable MCP skills and SKILL.md
Poisoned tool descriptions and malicious tool responses
Unauthorized elevation of agent capabilities
Attacks on the LLM itself — behavior extraction, adversarial fine-tuning, poisoned training data
Agents exceeding intended operational boundaries
Cisco AI Defense
ships the full ATR rule pack
as skill-scanner upstream.
On 2026-04-03 their engineer submitted PR #79 with a 34-rule PoC and it merged in 3 days. On 2026-04-22 the production PR #99 landed the full ATR rule pack inside Cisco AI Defense's skill-scanner. They built a --rule-packs CLI specifically to consume ATR as a first-class rule source.
Microsoft Agent Governance Toolkit expanded from 15 to 287 ATR rules with a weekly auto-sync workflow.
PR #908 (2026-04-13) merged the 15-rule PolicyDocument PoC. PR #1277 (2026-04-26) brought it to 287 rules and added a workflow that auto-syncs ATR upstream releases every week.
Gen Digital Sage ships the full ATR rule pack in the Sage agentic-AI risk-scoring layer (Norton/Avast/LifeLock parent).
Merged 2026-05-11. The Sage platform — under the Norton/Avast/LifeLock parent — uses ATR rules as the substrate for its agentic-AI security scoring.
PR #33 →Frameworks tell you threats exist. ATR tells you how to detect them. ATR is to MITRE ATLAS what Sigma rules are to ATT&CK.
Every attack makes everyone safer.
Threat Cloud works like an immune system. When the LLM semantic layer (adaptive immunity) catches a novel attack, it crystallizes the detection logic into a regex rule (innate immunity) — turning a $0.001 / 500ms inference into a $0 / 5ms pattern match. 926 threat reports produced 42 crystallized rules. The 4.5% crystallization rate means 95.5% of threats are already covered by existing rules.
The flywheel is already turning. The 96,096-skill scan discovered 751 malware, triggered crystallization, and new rules re-scanned the ecosystem — a self-reinforcing loop.
Endpoints report suspicious patterns via ATR Reporter
Integrate ATR.
TypeScript, Python, Raw YAML, SIEM converters. Four integration paths.