# ATR (Agent Threat Rules)

> An open detection rule standard for AI agent security threats: YAML rules with permanent ATR-YYYY-NNNNN identifiers, a written core specification, and a reference engine. MIT licensed.

Figures below are as of 2026-11-10, when this file was generated, and each says what it counts.

- Rule files on main: 844. Effective (loaded by at least one lane): 836. Inert (status draft or deprecated): 8.
- Rules per lane: enforce 103 (maturity stable; the lane to run with blocking on), alert 757 (maturity stable or test), hunt 836 (every effective rule; the engine default).
- Core specification (SPEC.md): 1.0.1
- Latest npm release: agent-threat-rules@4.3.1
- Every page is available in English (/en/...) and Traditional Chinese (/zh/...).

## Specification

- [Specification](https://agentthreatrule.org/en/spec): the rule format, evaluation semantics, identifiers and conformance
- [Conformance](https://agentthreatrule.org/en/conformance): conformance levels, the L1 test suite and self-certification
- [Governance](https://agentthreatrule.org/en/governance): maintainers, merge policy and succession
- [Charter](https://agentthreatrule.org/en/charter): what ATR is and is not, and how decisions are made
- [Citation](https://agentthreatrule.org/en/citations): how to cite ATR, with the DOI
- [Errata](https://agentthreatrule.org/en/errata): errors found in published versions, corrected in the open
- [Glossary](https://agentthreatrule.org/en/glossary): terms used in the specification
- [Compliance](https://agentthreatrule.org/en/compliance): framework mappings; ATR's own documents, not endorsements
- [SPEC.md](https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/SPEC.md): source text of the core specification

## Rules

- [Rule explorer](https://agentthreatrule.org/en/rules): every rule with maturity, scan target and lane filter
- [Coverage](https://agentthreatrule.org/en/coverage): coverage against OWASP and other frameworks, with gaps
- [Quality standard](https://agentthreatrule.org/en/quality-standard): maturity ladder and detection lanes
- [Rule index, JSON](https://agentthreatrule.org/rules/index.json): every rule with maturity, lanes, scan_target, framework mappings, page URL and raw YAML URL
- [Rule index, CSV](https://agentthreatrule.org/rules/index.csv): the same data; the first line is a # comment with versions and generation time
- [ATD techniques, JSON](https://agentthreatrule.org/atd/atd-techniques.json): the agentic threat technique catalog
- [Prompt Injection rules](https://github.com/Agent-Threat-Rule/agent-threat-rules/tree/main/rules/prompt-injection): 258 rule files (YAML)
- [Context Exfiltration rules](https://github.com/Agent-Threat-Rule/agent-threat-rules/tree/main/rules/context-exfiltration): 138 rule files (YAML)
- [Tool Poisoning rules](https://github.com/Agent-Threat-Rule/agent-threat-rules/tree/main/rules/tool-poisoning): 118 rule files (YAML)
- [Agent Manipulation rules](https://github.com/Agent-Threat-Rule/agent-threat-rules/tree/main/rules/agent-manipulation): 108 rule files (YAML)
- [Privilege Escalation rules](https://github.com/Agent-Threat-Rule/agent-threat-rules/tree/main/rules/privilege-escalation): 77 rule files (YAML)
- [Skill Compromise rules](https://github.com/Agent-Threat-Rule/agent-threat-rules/tree/main/rules/skill-compromise): 52 rule files (YAML)
- [Model Abuse rules](https://github.com/Agent-Threat-Rule/agent-threat-rules/tree/main/rules/model-abuse): 41 rule files (YAML)
- [Excessive Autonomy rules](https://github.com/Agent-Threat-Rule/agent-threat-rules/tree/main/rules/excessive-autonomy): 39 rule files (YAML)
- [Data Poisoning rules](https://github.com/Agent-Threat-Rule/agent-threat-rules/tree/main/rules/data-poisoning): 9 rule files (YAML)
- [Model Security rules](https://github.com/Agent-Threat-Rule/agent-threat-rules/tree/main/rules/model-security): 4 rule files (YAML)

## Use

- [Start here](https://agentthreatrule.org/en/start): entry points by reader: integrate, contribute, audit, cite, governance
- [Integrate](https://agentthreatrule.org/en/integrate): TypeScript, Python, raw YAML, GitHub Action, SIEM
- [Contribute](https://agentthreatrule.org/en/contribute): submit a rule, report an evasion or a false positive
- [Responsible use](https://agentthreatrule.org/en/responsible-use): intended use and misuse

## Optional

- [About](https://agentthreatrule.org/en/about): mission and history
- [Research](https://agentthreatrule.org/en/research): paper, benchmarks and limitations
- [Changelog](https://agentthreatrule.org/en/changelog): release history
- [Repository](https://github.com/Agent-Threat-Rule/agent-threat-rules): rules, engine source and issue tracker