Bets, timestamped.

Unit 42's Behavioral Integrity Verification research found 80% of agent skills deviate from their declared behavior, 18.9% adversarially — an independent second dataset landing on the conclusion our 96,096-skill scan reached: the agent-skill supply chain is the attack surface. BIV verifies declared-vs-actual at install time; ATR detects the attack at runtime. We mapped their 29-capability taxonomy to ATR, and their canonical credential-exfil payload exposed a real gap — a code-surface chain our shell-syntax rules missed — so we shipped ATR-2026-02261. Honest about the seam: ATR covers the observed-behavior half, not the manifest diff.

Self-published numbers are the easiest to game, so we ran ATR through two open benchmarks we didn't build. On OpenGuardrails (runtime traffic) ATR placed first of seven reference detectors with zero false positives. On OASB (static skill artifacts) it had the lowest false-positive rate on the board — zero across 3,881 benign skills — but low recall, because ATR is a runtime detector, not a package scanner. We publish the numbers we got, including where ATR is weak.

In May 2026 the NSA published MCP security design considerations: 8 named risks, 9 recommendations, zero executable rules. Two of those recommendations — track and patch MCP CVEs, and filter agent output pipelines — are exactly what ATR's rule corpus does. We map all nine, and we're honest about the rest: ATR is not a scanner and emits no logs.

This week's batch of Critical MCP/agent CVEs is all the same shape — a poisoned input flows through a tool parameter into execution. We checked ATR against it: dedicated rules for the gemini-mcp-tool CVSS 9.8 and all four PraisonAI CVEs, within days of disclosure. The gap between a CVE landing and a rule shipping is the metric — days, not weeks.

A June 2026 NIST proof shows no finite set of guardrails is universally robust against adversarial prompts — defense has to be continuous, not one-and-done. NVIDIA shipping an install-time skill scanner says the same thing. ATR is the open, continuously-updated rules layer for it.

The April 2026 Five Eyes guidance names third-party agent components — MCP servers, tools, skills — as a critical supply-chain risk, and gives no tool to check them. ATR scanned 96,096 across five registries: 1,302 flagged, 552 confirmed malicious after manual review, three coordinated publishers.

The June 2026 Shai-Hulud wave hunts AI-agent credentials: ANTHROPIC_API_KEY, Claude configs, .mcp.json. Rule ATR-2026-00576 covers the credential-theft stage.