> ## Documentation Index
> Fetch the complete documentation index at: https://docs.panguard.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# ATR (Agent Threat Rules)

> Open standard for detecting threats to AI agents. 768 rules. OWASP Agentic Top 10: 10/10 covered. Community-maintained.

Agent Threat Rules (ATR) is an open standard for describing and detecting security threats targeting AI agents -- purpose-built for the AI agent era.

## What is ATR?

ATR rules detect threats that traditional security tools miss:

* **Prompt injection** in MCP tool responses
* **Tool poisoning** via hidden instructions
* **Data exfiltration** through agent actions
* **Privilege escalation** via skill manipulation
* **Supply chain attacks** on skill registries
* **Credential theft** via agent tool calls
* **Inter-agent manipulation** in multi-agent systems

## By the Numbers

|                      |                                                                       |
| -------------------- | --------------------------------------------------------------------- |
| **768** rules        | Covering 10 threat categories                                         |
| **OWASP 10/10**      | Full coverage of OWASP Agentic Top 10                                 |
| **95.7%** recall     | On Garak jailbreak corpus (650 samples)                               |
| **100%** recall      | On SKILL.md benchmark (97% precision, 0.2% FP)                        |
| **90,000+** skills   | Scanned across registries (67,799 scanned, 1,096 confirmed malicious) |
| **770+** patterns    | Unique detection signatures                                           |
| **\< 3ms** scan time | Per skill (regex layer)                                               |

## OWASP Agentic Top 10 Coverage

ATR provides executable detection rules for every OWASP category:

| OWASP Category                    | ATR Rules | Coverage |
| --------------------------------- | --------- | -------- |
| ASI01: Agent Goal Hijack          | 13        | STRONG   |
| ASI02: Tool Misuse & Exploitation | 11        | STRONG   |
| ASI03: Identity & Privilege Abuse | 9         | STRONG   |
| ASI04: Agentic Supply Chain       | 8         | STRONG   |
| ASI05: Unexpected Code Execution  | 8         | STRONG   |
| ASI06: Memory & Context Poisoning | 8         | STRONG   |
| ASI07: Inter-Agent Communication  | 5         | MODERATE |
| ASI08: Cascading Failures         | 4         | MODERATE |
| ASI09: Human-Agent Trust          | 5         | MODERATE |
| ASI10: Rogue Agents               | 7         | MODERATE |

<Info>
  OWASP provides a checklist. ATR provides the executable rules. Use ATR to turn OWASP compliance from a PDF exercise into automated detection.
</Info>

## Three Detection Layers

| Layer   | Method                 | Speed   | Coverage       |
| ------- | ---------------------- | ------- | -------------- |
| Layer 1 | Regex pattern matching | 3ms     | Known patterns |
| Layer 2 | Content fingerprinting | \~200ms | Variants       |
| Layer 3 | LLM-as-judge           | \~3s    | Novel threats  |

## Threat Crystallization

When the LLM layer (Layer 3) discovers a new attack pattern, ATR crystallizes it into a deterministic regex rule:

1. LLM detects novel threat pattern
2. RuleScaffolder generates a new regex rule
3. Shadow mode validates against 1,000 samples (FP \< 0.1%)
4. Rule promoted and distributed via Threat Cloud (\< 1 hour)
5. Next occurrence caught by Layer 1 at 3ms -- no LLM needed

Every LLM call trains the regex engine. LLM cost is one-time. Crystallized rules run forever at zero cost.

## Research Paper

> **Agent Threat Rules: A Community-Driven Detection Standard for AI Agent Security**
> [Zenodo DOI: 10.5281/zenodo.19178002](https://doi.org/10.5281/zenodo.19178002)

The paper documents: threat taxonomy, detection architecture, PINT benchmark evaluation, and 64 known evasion techniques (published transparently).

## Standardization Status (2026-05-25)

ATR is publishing proposal-stage standardization scaffolding ahead of OASIS Open Project submission. The scaffolding includes a 9-seat Technical Steering Committee charter (CNCF-derived, 2-cap per company group, 2 sovereign liaison seats), a standard threat model, an OpenTelemetry-compatible event format spec, a conformance corpus structure with threshold Ed25519 signing, the DCO contribution model, and reference implementation interface contracts in TypeScript, Python, and Go.

All scaffolding is tagged **PROPOSED** and is NOT ratified. The 9-seat TSC has not been formed. Trademarks are not registered. Existing v1.1 governance continues to operate. The rule format, npm package, TypeScript engine API, and all rules are unchanged — Panguard's integration of ATR works without modification.

The first sovereign sub-range (`ATR-TW-YYYY-NNNNN`) has been issued under bootstrap maintainer attestation, pending formal Taiwan sovereign authority adoption.

See the full status matrix at [STANDARDIZATION-STATUS.md](https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/STANDARDIZATION-STATUS.md) on the ATR repo.

## Getting Started

```bash theme={null}
# Install Panguard (includes ATR engine)
curl -fsSL https://get.panguard.ai | bash

# Scan a skill with ATR rules
panguard audit skill /path/to/skill

# Start real-time protection with ATR
panguard guard start
```

<CardGroup cols={2}>
  <Card title="ATR on GitHub" icon="github" href="https://github.com/Agent-Threat-Rule/agent-threat-rules">
    Browse rules, contribute, and star the project.
  </Card>

  <Card title="OWASP Mapping" icon="list-check" href="https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/docs/OWASP-MAPPING.md">
    Full rule-by-rule mapping to OWASP Agentic Top 10.
  </Card>
</CardGroup>