Every country is building sovereign AI.
The detection knowledge that defends it should belong to no single vendor.
That layer has to be neutral.

Why Sovereign AI became a national imperative

Many countries now treat AI as a national capability they must control themselves, investing heavily in models built on their own language, data, and compute so that critical systems do not depend on foreign platforms. That investment spans many regions:

The driver is sovereignty anxiety — no country wants its critical data and intelligence running in US clouds, nor wants to be shut off or censored by foreign platforms at critical moments. The Asia-Pacific sovereign-AI infrastructure market alone is estimated at $9–14B in 2026, projected to reach $23–47B by 2030.

Owning the model is one thing. Owning the detection knowledge that defends it is another.

These countries have their own models and their own compute. But when those AI systems become agents — autonomous actors, tool users, MCP clients, transaction executors — no widely accepted agent security detection standard exists.

The regulators know it. The EU AI Act was negotiated before agentic AI arrived — its risk tiers assume systems that assista human decision, not systems that decide and act on their own. NIST’s AI Agent Standards Initiative opened in February 2026 precisely to close that gap. The frameworks are catching up; what they still need underneath them is an executable detection layer.

Most available detection rule sets are closed-source and concentrated in private vendors within a few countries. In a 2026 survey, 94% of IT leaders said they fear AI vendor lock-in — and for detection knowledge the lock-in is sharper: a country can control its model yet still defend it through proprietary, unauditable rule sets it cannot inspect. Defense knowledge that cannot be opened, inspected, or forked is incomplete sovereignty.

Why this context calls for an open standard, not another product

MIT License · 768 behavioral rules · protocol-agnostic · behavior-based. Derived from real attack corpora, classified to NVIDIA garak / OWASP Agentic / MITRE ATLAS taxonomies. Adoptable by any country, contributable by any organization. No geopolitical risk. No vendor lock-in.

ATR detects behavioral intent, not string signatures. Attackers who rephrase prompts, repackage payloads, or restructure attack chains cannot evade it, because the detection target is the causal structure of the attack. Each attack has to be redesigned — cost rises exponentially.

No need to replace your existing SOC tooling

Every bank, hospital, and semiconductor fab’s security operations center already runs on an existing detection stack — Splunk, Elastic, one SIEM or another. A neutral standard nobody can use without ripping those out is a standard nobody adopts.

So ATR rules are designed to be exportable: the same machine-readable rule can be emitted as Splunk SPL, an Elastic query, or generic regex, and fed straight into an existing detection pipeline. The standard lives in the rule itself, bound to no single vendor’s execution engine.

The converter is part of ATR’s open reference implementation (MIT). The attack surface moved — SQL injection into reasoning chains, command injection into tool calls, SSRF into MCP connections — but existing detection infrastructure does not have to reset to zero to keep up.

# Open reference CLI (MIT) — export ATR rules into existing tooling
atr convert splunk --output ./atr-rules.spl

Already adopted across major security stacks

0 → 768 rules · 2 in production (Microsoft, Cisco) plus Gen Digital Sage (merged) · peer-standard references · full adopter list in ADOPTERS.md · MIT licensed · DOI 10.5281/zenodo.19178002

An open standard, governed by its contributors

ATR is not a single lab’s or vendor’s deliverable. Every rule passes through a public, auditable pipeline: pull request → automated safety gate → community review → merge → npm publish. Governance rules are codified in GOVERNANCE.md; every rule carries provenance metadata; any contributor can challenge, correct, or extend the taxonomy.

There are three levels of participation in the standard:

• →Contribute rules: translate AI agent attack samples you've observed into ATR YAML rule PRs
• →Contribute probes: define new attack classes so rule generation can be systematically mapped
• →Contribute validation: test FP/Recall against real attack corpora, surface detection gaps

For sovereign AI, open governance is itself a structural requirement — attacks are not defined by a single lab, and defense should not be defined by a single vendor.

How any country adopts a public-good standard

No country owns this standard; any country can adopt it— the same way one adopts Linux, OpenSSL, or Sigma: download it, audit it, run it in your own environment, contribute the rules you’re missing back upstream. Because it is an MIT public good, adoption needs no one’s permission and carries no geopolitical strings.

This is also why the international picture matters. The AI Safety Institutes network — launched in San Francisco in 2024 with ten founding members and now coordinating across jurisdictions — is working toward safety evaluations that are comparable from one country to the next. Comparability needs a shared, machine-readable detection format. A neutral standard is what keeps one country’s findings legible to another’s — the way a CVE filed in Tokyo means the same thing in Berlin.

Adoption is not a proposal — it is three commands. No license desk, no procurement cycle, no one's permission required:

# Adopt the open standard — MIT, no fee, no geopolitical strings
npm install -g agent-threat-rules
atr scan ./agent-config.json     # audit your own agents against 768 rules
atr convert splunk               # or export into the SOC you already run

Pass this on

A standard works by being seen, scrutinized, and adopted widely. If this framing is useful to your peers, pass it along.