Agent Threat Rules: 98% Detection for AI Agent Attacks

New open format to detect AI agent threats

Agent Threat Rules (ATR) is an open-source detection format specifically for AI agent security threats, which operate within coding assistants, MCP servers, and multi-agent frameworks. While useful, these agents expose systems to risks such as prompt injection, tool poisoning, and credential theft. Vulnerabilities related to agent execution often reach production faster than the tools designed to detect them.

Quick Response

Structure and functionality of ATR rules

ATR rules are YAML documents following a versioned schema. Each rule declares the attack pattern it identifies, the input field to inspect (such as LLM input, tool call arguments, or SKILL.md content), and the test cases that demonstrate its effectiveness. The project includes a reference engine written in TypeScript and a Python wrapper called pyATR, both released under the MIT license.

Framework performance

ATR provides benchmark metrics for each test corpus. Against the NVIDIA garak corpus of real jailbreaks, it achieves a recall of 98%. However, against the entire garak set covering all probe families, recall drops to 38.5%. On HackaPrompt, recall is 66%.

Some corpora show significantly lower performance: AdvBench at 1.3%, HarmBench at 2.5%, and JailbreakBench at 5%. Two adversarial academic sets, PromptBench and PromptInject, register 0% recall.

Performance analysis

Adam Lin, the project maintainer, explained the discrepancy between performance on individual tests and aggregated benchmarks. Rules that pass individual tests can fail in aggregated detection due to differences in pattern matching level. Well-defined attack structures are detectable, while paraphrased or semantically reformulated attacks often escape. The project documents this coverage gap and recommends integrating ATR with other countermeasures such as credential brokering, sandbox execution, and human review for high-risk actions.

Adoption and integration

Four organizations are already using ATR or have integrated it into their tools. Microsoft has included a rule package in its Agent Governance Toolkit that syncs weekly with ATR. Cisco AI Defense runs a rule package in production. MISP at CIRCL has joined a threat-intel cluster, and Gen Digital (the parent company of Norton, Avast, and AVG) has integrated a rule package. Adopters self-declare via pull request, without requiring approval from the maintainer.

Mapping to external frameworks

The ATR rule set aligns with major security frameworks. It covers all 10 OWASP Agentic Top 10 categories and 78 of the 85 SAFE-MCP techniques, equating to 91.8% coverage. Individual rules include references to specific CVEs, including recent vulnerabilities affecting Microsoft Semantic Kernel, Spring AI, LiteLLM, and Claude Code.

Availability and resources

Agent Threat Rules is freely available on GitHub. For further insights into open-source cybersecurity tools, you can consult the article 25 open-source cybersecurity tools that don’t care about your budget and GitHub CISO on security strategy and collaborating with the open-source community.