Sigma is for SIEM. YARA is for malware.
ATR is for AI agents.
Built so a rule written in Taipei catches an attack first reported in Seattle — without anyone reinventing the rule format.
An open, versioned, machine-readable detection rule format for AI agent security threats. Any conforming engine can evaluate it. Community-maintained, MIT licensed.
Endpoint detection standards
cannot see AI agent behavior.
Built for endpoint event logs, file binaries, and software vulnerability IDs. They watch code, not intent.
Prompt injection, tool poisoning, skill compromise, context exfiltration — attacks live at the prompt / tool call / skill layer, not at process / file / network.
Vendor-neutral, machine-readable behavioral detection rules. Watches what an agent does, not just what it runs. Any conforming engine can evaluate it. MIT forever. Community governed.
Before Sigma became the open standard for SIEM detection in 2017, every SOC wrote its own rules. Before CVE in 1999, every vendor numbered its own vulnerabilities. The detection layer for the AI agent era sits in the same position right now — not yet standardized. ATR fills the gap.
skills flagged. The flags concentrate heavily in a handful of publisher accounts, pointing at coordinated malware campaigns.
ATR found these accounts while scanning 101,280 agent skills and MCP server definitions across five sources — ClawHub, OpenClaw, Skills.sh, Hermes, and an MCP registry index (engine v2.0.0, 2026-04-13). 1,434 items were flagged. These accounts were adjudicated account-wide as known malware campaigns — publisher-level attribution rather than per-file analysis; flagged items were blacklisted and reported to NousResearch.
10 threat categories. 819 rules. Real CVEs.
Hijacking agent behavior through crafted inputs
Stealing conversation context and sensitive data
Poisoned tool descriptions and malicious tool responses
Social engineering and behavioral manipulation of agents
Unauthorized elevation of agent capabilities
Malicious or vulnerable MCP skills and SKILL.md
Misusing model capabilities — jailbreaks, harmful generation, resource abuse
Agents exceeding intended operational boundaries
Corrupting training data, memory, or retrieval sources to bias agent behavior
Attacks on the model itself — extraction, inversion, adversarial inputs
Security teams consume ATR as an upstream rule source, merged into their own public repos.
Microsoft's autonomous AI engineer opened a PR assuming ATR coverage existed — and the assumption was correct.
On 2026-05-11, the Copilot SWE Agent opened AGT#1981 for two Semantic Kernel CVEs with regression fixtures presuming ATR detection. Rules were validated and published to npm within 2h 16m. Not a manually arranged integration.
View AGT#1981 →
Plus 11 public catalogues and documentation indices listing ATR — full adopter list
Every attack makes everyone safer.
A red-team mega-scan pipeline and a CVE-ingestion pipeline run daily: when the semantic layer catches a novel attack, it crystallizes into a regex rule and flows back into the standard — turning a 500ms inference into a 5ms pattern match. Auto-crystallization grew the standard from 462 to 819 rules, all shipped in npm agent-threat-rules@4.1.3.
But growth was never the point — honesty about precision is. v3.5.0 introduced detection lanes: every rule declares a maturity, and the consumer decides how far to trust it. The enforce lane fires only the most mature rules; the default hunt lane runs everything as advisory. False-positive rates are reported lane by lane, never as a single flattering number — and the per-lane figures previously published here are withdrawn pending re-measurement, because the basis they were measured on did not hold up. Withdrawing a number you can no longer stand behind is the same discipline as publishing your worst one.
Endpoints report suspicious patterns via ATR Reporter
Frameworks tell you threats exist. ATR tells you how to detect them. ATR is to MITRE ATLAS what Sigma rules are to ATT&CK — today mapping 34 of 101 official ATLAS techniques (v5.6.0), concentrated on the agent-native surface rather than padded for breadth.
Integrate ATR.
TypeScript, Python, Raw YAML, SIEM converters — four integration paths, one ruleset. MIT forever, no license to negotiate, evaluated by any conforming engine.