Agent Threat Rules (ATR) — Sigma/YARA-style open detection format for AI agent threats

What it is

Agent Threat Rules (ATR) — the canonical spec page, a Working Draft where the repository files (not the page) are authoritative. Beyond the summary's framing, the page pins down what conformance actually requires, who has shipped it, and what the benchmark numbers do and don't say.

Conformance requirements the summary omits

The spec is RFC 2119–normative. A conforming engine MUST parse every field in spec/atr-schema.yaml, evaluate detection.conditions per §3.5/§5, honor scan_target (a scan_target: skill rule MUST NOT run against mcp_exchange events, and vice versa), skip deprecated/draft rules unless the consumer opts in explicitly, and emit rule_id and severity on every match. A conforming rule MUST carry an ATR-YYYY-NNNNN id (or a vendor prefix like ACME-YYYY-NNNNN for private rules), at least one detection.conditions[] entry, a severity from {informational, low, medium, high, critical}, and test cases — ≥1 true positive and true negative at maturity: experimental, ≥5 each at maturity: stable. There are L1/L2/L3 conformance levels with test-suite-based self-certification at /conformance.

The lane model (why "precision" isn't one number)

Maturity maps to a detection lane, and this is the operational knob for an adopter:

• enforce — fires only the most mature rules
• alert — adds rules under observation
• hunt (default) — runs the whole corpus as advisory signal

False-positive rates are meant to be published per-lane so the consumer picks the precision/coverage trade-off. Those per-lane figures are currently withdrawn (benign corpus was found to contain real jailbreak samples) and should not be cited until re-measured.

Numbers that are cleared for citation

• Wild scan: 101,280 items scanned / 1,434 flagged, engine v2.0.0, as of 2026-04-13. No precision figure — the "confirmed" set was adjudicated by publisher attribution, not per-file, and the corpus has no ground-truth labels.
• Near-zero recall on AdvBench / HarmBench / JailbreakBench is stated as expected: those test model alignment (refusing harmful requests), not prompt-injection detection, which is ATR's regex surface. Treat this as confirmation of a layering thesis, not a failure.

Adoption (evidenced by merged public PRs)

Named implementers: Microsoft Agent Governance Toolkit, Cisco AI Defense open-source skill-scanner, MISP/CIRCL (galaxy + taxonomies), OWASP A-S-R-H Project, and Gen Digital Sage (Norton/Avast/AVG parent). A NIST OSCAL submission is in review (collaboration branch #338). The page is explicit that a merged PR is not a commercial-product endorsement, the framework/OSCAL mappings are community-maintained, and NIST has not endorsed them. New adopters self-declare by PR to ADOPTERS.md; there is no pre-approval.

Caveats

Governance is single-maintainer (BDFL, Adam Lin) with final call until the TSC is seated; spec amendments follow rough consensus. Security reports go through the private GitHub advisory channel under a 90-day embargo. All contributions are MIT by submission with no CLA.