ATR rules describe attacks that traditional security tools cannot see. Network packet filters miss prompt injection because the attack is semantic, not syntactic. File scanners miss tool poisoning because the payload lives in a JSON tool description, not a binary. ATR closes that gap with rules that match against agent-context fields like tool_call.arguments, agent_action.command_line, model_output, and agent_event.event_type.
Each ATR rule is a YAML document with five required sections: a unique ID, severity classification, detection conditions (regex, keyword, or semantic operators), OWASP / MITRE / NIST compliance mapping, and test cases (both true positives and true negatives). The format is designed so any scanning engine — PanGuard, Microsoft AGT, Cisco AI Defense, MISP, OWASP Agentic Top 10 reference implementations — can load and evaluate the same rule and produce the same verdict.
As of v2.1.3, the ATR corpus contains 344 rules across 10 threat categories: prompt-injection (115), agent-manipulation (105), skill-compromise (40), context-exfiltration (33), tool-poisoning (22), privilege-escalation (11), model-abuse (8), excessive-autonomy (6), model-security (3), data-poisoning (1). OWASP Agentic Top 10 coverage is 10 of 10 categories. The rule set is MIT licensed and lives in a public repository at github.com/Agent-Threat-Rule/agent-threat-rules.
Production deployments include Microsoft Agent Governance Toolkit (287 rules merged via PR #1277 with a weekly auto-sync workflow), Cisco AI Defense skill-scanner (344 rules merged via PR #99), and MISP (PR #1207 on misp-galaxy, PR #323 on misp-taxonomies). Adam Lin, founder of PanGuard AI, has documented: "The standard exists to be cited. We measure success by how many ecosystems ship our rule IDs, not by how many users install our CLI."