Agent-Threat-Rule/agent-threat-rules

What it solves

ATR (Agent Threat Rules) provides a standardized, vendor-neutral format for detecting security threats in AI agents. It fills the gap between high-level risk taxonomies (like OWASP or MITRE ATLAS) and actual deployable detection rules, addressing vulnerabilities such as prompt injection, tool poisoning, and credential exfiltration in agent infrastructure.

How it works

ATR defines a versioned YAML schema for writing detection rules. Each rule specifies what attack pattern to match, which input field to inspect (such as LLM I/O or tool-call arguments), and how to map the finding back to security frameworks.

The project provides a reference engine in TypeScript and a Python wrapper (pyATR) to evaluate these rules. It also includes a CLI for scanning files (like SKILL.md or MCP config logs) and supports exporting rules to formats compatible with SIEM tools like Splunk and Elasticsearch.

Who it’s for

• Security Engineers: To implement runtime detection and blocking of agentic threats.
• Agent Framework Developers: To embed security scanning into agent runtimes, proxies, or IDE extensions.
• Red-Teamers: To use the provided technique catalog (ATD) for testing agent security.
• DevOps/CI Engineers: To integrate security gating via GitHub Actions.

Highlights

• Standardized Format: A machine-readable, peer-reviewable rule format similar to Sigma or YARA but tailored for AI agents.
• Multi-Language Support: Reference implementations available in TypeScript and Python, with Go and Rust contracts proposed.
• Flexible Enforcement: Supports "lanes" (enforce, alert, hunt) to balance precision and recall, and an opt-in blocking mode to restrain agent actions.
• Broad Integration: Integrated into tools from Microsoft, Cisco, and OWASP, and supports SARIF output for GitHub Security tabs.
• Technique Catalog: Includes the Agentic Threat Detection (ATD) catalog mapping 80 techniques across 9 tactics to MITRE ATLAS and OWASP.