An open standard.
Started by one maintainer.
ATR is the open detection standard for AI agent security threats. This page explains why it exists, how it works, and who maintains it.
ATR provides executable detection rules for AI agents. Other frameworks — MITRE ATLAS, OWASP Agentic, NIST AI RMF — categorize threats and define risk management processes. ATR provides the detection rules that operate on real agent artifacts: SKILL.md files, MCP tool descriptions, agent configs. ATR is to MITRE ATLAS what Sigma rules are to ATT&CK.
Rules are published under MIT license in YAML format on GitHub. Anyone may integrate, modify, or contribute upstream. There are no paid features. There is no vendor lock-in.
The standard is community-driven. Since June the ruleset has grown from 462 to 829 rules, from CVE and advisory sweeps, benchmark-miss mining and contributors; each rule reaches main through a pull request a maintainer merges.
But growth was never the point — honesty about precision is. The v3.5.0 release introduced detection lanes: every rule declares a maturity, and the consumer decides how far to trust it. The enforce lane fires only the most mature rules; the default hunt lane runs everything as advisory. ATR reports false-positive rates lane by lane, never as a single flattering number — and the current per-lane figures are withdrawn pending re-measurement, because the benign corpus they were measured on was found to contain real jailbreak samples. A standard earns trust by publishing its worst figure, and by withdrawing any figure it can no longer stand behind.
- 2026-03-09ATR founded · v0.1.0 released
29 rules across 9 threat categories, TypeScript engine, 325 passing tests.
- 2026-04-03Cisco AI Defense merges 34 rules (PR #79)
First enterprise adoption. 1,272 additions, merged one day after submission.
- 2026-04-06v1.0.0 released
Coverage milestone: OWASP Agentic 10/10, PINT F1 76.7.
- 2026-04-13Microsoft AGT merges a 15-rule ATR example (PR #908)
Merged as an example directory: 554 additions, adapted as PolicyDocument. The rule YAML is no longer in the AGT repository.
- 2026-04-14Mass malware campaign research published
Scanned 101,280 agent skills and MCP definitions across five registries; 1,434 flagged (engine v2.0.0, as of 2026-04-13). Documented malicious skills from three coordinated threat accounts and notified NousResearch via issue #9809.
- 2026-04-15v2.0.0 released
113 detection rules across 8 categories. Full coverage mapping to MITRE ATLAS, OWASP Agentic, OWASP LLM, and OWASP AST.
- 2026-04-21v2.0.11 · NVIDIA garak coverage
193 new rules, many of them written from the NVIDIA garak probe corpus (311 total). garak in-the-wild jailbreak subset recall at the time: 97.1% (647/666), with every rule loaded (detection lanes came later; it is what today's hunt lane loads). Many of these rules were written from that same corpus, so the figure is partly closed-book, not an out-of-sample result.
- 2026-04-22ATR rule pack merged into cisco-ai-defense/skill-scanner (PR #99)
Follow-up PR after the 34-rule PoC, landing the ATR rule pack in the Cisco AI Defense team's open-source skill-scanner repo. Two consumption paths exist there: the rule-packs CLI and skill-scanner. This is a merged pull request in a public repository, not a statement about Cisco's commercial product.
- 2026-04-26Microsoft AGT example expanded to 287 rules + weekly sync workflow (PR #1277)
Follow-up to PR #908's 15-rule example. Adds 272 more rules (287 total) and a weekly sync workflow. The rule YAML has since left the AGT repository, and the workflow is pinned to an old ATR release.
- 2026-05-10MISP / CIRCL taxonomy + galaxy merged
Alexandre Dulaunoy (CIRCL) merged ATR rule-ID taxonomy (misp-taxonomies #323) and threat-intel galaxy (misp-galaxy #1207) into MISP's core distribution. First neutral standards-body adoption.
- 2026-05-11OWASP Agent Security Regression Harness (#74) + Gen Digital Sage (#33) both merged
OWASP Foundation's regression-harness project references ATR as its canonical agent-threat detection ruleset (PR #74, merged by Mert Satilmaz). On the same day, Gen Digital (Norton / Avast / LifeLock parent) merged the full ATR rule pack into the Sage agentic-AI risk-scoring layer (PR #33).
- 2026-05-22ATR website standards-form rewrite
Hero, footer, and information architecture rewritten to match peer-format positioning (Sigma / YARA / ATT&CK / NIST AI RMF). Integration intake pipeline shipped: structured issue form, auto-triage workflow, ADOPTERS.md as machine-readable source of truth.
- 2026-06v3.5.0 · detection lanes ship
v3.5.0 (652 rules at release) introduced detection lanes (enforce / alert / hunt) — maturity-driven precision, with false-positive rates reported per lane rather than as a single figure.
- 2026-07Adoption re-verified · auto-publish flywheel
Every adopter PR state re-verified against GitHub — new shipped integrations recorded across FINOS, SigmaHQ, rulezet/CIRCL, AMD GAIA, and AG2. The crystallization flywheel now auto-publishes new rules to npm on merge; rule count, spec version, and the adopter wall on this site are all rebuilt from repo state at deploy time.
All rule changes are submitted and reviewed via public GitHub pull requests. Adoption criteria include: clear description, test cases covering true and false positives, schema compliance, and no conflict with existing rules.
Rules use CVE/CWE-style identifiers (ATR-YYYY-NNNNN). IDs never change after publication. Rules may be revised (rule_version++), but the ID remains stable — safe for external documentation, academic citations, and CI scripts to reference.
ATR was founded and is primarily maintained by Kuan-Hsin Lin. This is a project started by one person — the same way Linus Torvalds started Linux in 1991, or Florian Roth started Sigma. What matters is whether the community can contribute substantively, not how long the founders list is.
External adoption to date includes three merged upstream integrations (the ATR rule pack in Cisco AI Defense's open-source skill-scanner, ATR example directories in Microsoft AGT, and Gen Digital's merged Sage pack — each evidenced by a merged pull request in a public repository); two standards-body integrations actually merged (MISP / CIRCL taxonomies #323 + galaxy #1207, and OWASP A-S-R-H #74); and two open, unmerged proposals (usnistgov/oscal-content#338, offering AI RMF profile examples to NIST's OSCAL content repository and awaiting NIST review, not a NIST endorsement; and the agent.threat.detection.* semantic-conventions PR #165 in OpenTelemetry's GenAI SIG). This pattern — enterprises integrating via pull request instead of private forks — is the governance texture ATR is built for.
ATR is not owned by any commercial entity. It is not a feature of any security product and is not controlled by any vendor. The rules are a public good — anyone, including competing vendors, may adopt, extend, or fork them.