Community

The people who maintain ATR

Contributors write and review rules. Anyone may open issues and pull requests; only maintainers with repository permission can merge. Experts will be listed here once they agree in writing; none are listed yet.

Join the Discord Apply to join Where to start

Below are problems you can work on now. Anyone can open an issue or a pull request. Solved problems drop off the list automatically. To be listed in the directory, apply to join.

Interests: ATR's lead maintainer, Adam Lin, founded and controls PANGUARD AI, INC., which sells AI agent security products built on ATR. Work contributed here is MIT-licensed and anyone may use it, including that company. How the two are kept apart is on the governance page.

Directory · opened November 2026

Only people who agreed to be listed appear here, with text they confirmed. Listing an organization is not an endorsement by it. Removal on request, no questions asked.

§1Where to start

Pick a first thing for the time you have

Discord is for talking; decisions and credit are recorded on GitHub, and you can take part without Discord. Anyone can open an issue or a pull request; say so on the issue before you start, so two people don't do the same work.

5 min: Report something ATR flagged by mistake. A confirmed report counts as a contribution.
10 min: Submit an attack sample with a harmless look-alike. No setup needed.
30 min: Pick an open problem. Each says which files to touch and how to test; open a pull request when it's ready.
Any time: Ask a question in GitHub Discussions, no Discord needed. In Discord, /start lists these steps and /now what each area needs.

§2Being worked on now

What is in progress, and where help is needed

Project names only; the details live in each issue and Discord channel. These are the areas where work happens today, not the formal working groups described on the governance page. Last updated 2026-11-08.

Rules

#rules

Detection rules for attacks on AI agents: new rules, false positives, evasions and the quality gate.

In progressNarrowing rules that flag ordinary text
Needs helpRules for newly published AI agent CVEs
Needs helpPrompt-injection patterns in Chinese, Japanese and Korean
In progressDestructive shell commands in tool calls

First issues in this area

Engine and integrations

#rules

The TypeScript and Python engines, the conformance suite, and integrations with agent frameworks and security tools.

In progressPython engine parity with the TypeScript engine
In progressConformance test suite 1.1
In progressMatching very long inputs in windows
In progressOpenAI Agents SDK guardrails integration
Needs helpGitHub Action for scanning in CI

First issues in this area

ATR Eval method

#wg-method

How ATR Eval tests whether an agent can be hijacked: the specification, scoring, signed records and the runners. The maintainer's company has a commercial interest in these results. Disclosures

In progressFeedback on the first public draft
In progressCalibration against AgentDojo
In progressInspect integration
Needs helpReruns by people other than the maintainer

First issues in this area

Test cases

#wg-atomics

The ATR Eval test cases: is the attack realistic, is the check correct, is the no-attack version fair. The maintainer's company has a commercial interest in these results. Disclosures

In progressScreening imported test cases on real agents
In progressChecking that agents can't tell they are being tested
Needs helpTest cases for web pages, email and files as entry points

First issues in this area

Laws and frameworks

#wg-mappings

How ATR rules and ATR Eval relate to frameworks and laws such as the OWASP lists, NIST AI RMF, MITRE ATLAS, the EU AI Act and AIUC-1.

In progressCorrecting framework mappings
In progressAIUC-1 and EU AI Act crosswalks
Needs helpTaiwan crosswalk

First issues in this area

Community infrastructure

#general

The public record of contributions, the website's community pages and the Discord commands that link back to GitHub.

In progressPublic contribution ledger
In progressWebsite community page
In progressDiscord commands that point back to GitHub

First issues in this area

National nodes

No channel yet

An open reference setup that a country or institution can run on its own network, with its own keys and records.

PlannedReference design

Planned

Adam Lin
Lead maintainer (transitional, until the TSC is seated)
MaintainerFoundingTW
GitHub Disclosure

§3On GitHub

People with contributions in the repository

The 11 people GitHub lists as contributors, not counting bots or maintainers' secondary accounts. This is the public record, counted separately from the directory above.

§4Working groups

Three planned working groups, none formed yet

These are planned, not running: none has formed and none has a lead. The governance page sets the condition for starting one, three or more independent implementers asking for the same thing. Until then the work happens asynchronously on GitHub.

Rule quality and evasion
Red-team the rules, report bypasses and false positives, and tighten the rules that cause them.
Planned
Framework crosswalks
Map OWASP, MITRE ATLAS, NIST AI RMF, EU AI Act and ISO/IEC 42001 item by item, with a gap column.
Planned
Engine conformance
Keep the conformance suite honest across engines and languages.
Planned

§5What members get

Only promises that can be kept

Monthly: A written community update in GitHub Discussions (planned).
Quarterly: A survey on what to cover next, with the results published (planned).
Every release: Contributors are named in the author field of the rules they wrote and in CONTRIBUTORS.md.
Optional: An open call when there is something to decide live. Decisions are written back to GitHub.