ATR Detection Rule Mapping for Agentic AI Top 10
June 2, 2026 ยท View on GitHub
Agent Threat Rules (ATR) is an open-source set of detection rules for AI agent security threats. This document maps ATR's 71 rules to each Agentic AI Top 10 vulnerability category, providing practitioners with executable detection for each threat.
ATR version: v0.4.0 (71 rules) | License: MIT | Engines: TypeScript + Python
Coverage Summary
| AAI | Vulnerability | ATR Rules | Coverage |
|---|---|---|---|
| AAI001 | Agent Authorization and Control Hijacking | 22 rules | STRONG |
| AAI002 | Agent Tool Interaction Manipulation | 11 rules | STRONG |
| AAI003 | Agent Goal and Instruction Manipulation | 13 rules | STRONG |
| AAI004 | Agent Hallucination Exploitation | 4 rules | MODERATE |
| AAI005 | Agent Impact Chain and Blast Radius | 11 rules | STRONG |
| AAI006 | Agent Memory and Context Manipulation | 8 rules | STRONG |
| AAI007 | Agent Orchestration and Multi-Agent Exploitation | 12 rules | STRONG |
| AAI008 | Agent Resource and Service Exhaustion | 4 rules | MODERATE |
| AAI009 | Agent Supply Chain and Dependency Attacks | 8 rules | STRONG |
| AAI010 | Agent Knowledge Base Poisoning | 8 rules | STRONG |
| AAI011 | Agent Untraceability | 8 rules | STRONG |
| AAI012 | Checker-out-of-the-Loop Vulnerability | 5 rules | MODERATE |
Detailed Mappings
AAI001: Agent Authorization and Control Hijacking
Prompt injection and privilege escalation attacks that hijack agent behavior.
| ATR Rule | Title | Severity |
|---|---|---|
| ATR-2026-001 | Direct Prompt Injection | CRITICAL |
| ATR-2026-002 | Indirect Prompt Injection | CRITICAL |
| ATR-2026-003 | Jailbreak Attempt | HIGH |
| ATR-2026-004 | System Prompt Override | CRITICAL |
| ATR-2026-005 | Multi-Turn Injection | HIGH |
| ATR-2026-040 | Privilege Escalation | CRITICAL |
| ATR-2026-041 | Scope Creep | HIGH |
| ATR-2026-080 | Encoding Evasion | MEDIUM |
| ATR-2026-081 | Semantic Multi-Turn | HIGH |
| ATR-2026-091 | Nested Payload | HIGH |
| ATR-2026-093 | Gradual Escalation | HIGH |
| ATR-2026-097 | CJK Injection Patterns | MEDIUM |
| ATR-2026-104 | Persona Hijacking | HIGH |
| ATR-2026-107 | Delayed Execution Bypass | HIGH |
| ATR-2026-113 | Credential Theft | CRITICAL |
| ATR-2026-114 | OAuth Token Abuse | HIGH |
| ATR-2026-115 | Env Var Harvesting | CRITICAL |
AAI002: Agent Tool Interaction Manipulation
Agents bending tools into destructive outputs or using tools beyond intended scope.
| ATR Rule | Title | Severity |
|---|---|---|
| ATR-2026-010 | MCP Malicious Response | CRITICAL |
| ATR-2026-011 | Tool Output Injection | HIGH |
| ATR-2026-012 | Unauthorized Tool Call | HIGH |
| ATR-2026-013 | Tool SSRF | CRITICAL |
| ATR-2026-100 | Consent Bypass Instruction | HIGH |
| ATR-2026-101 | Trust Escalation Override | HIGH |
| ATR-2026-103 | Hidden Safety Bypass Instruction | CRITICAL |
| ATR-2026-105 | Silent Action Concealment | HIGH |
| ATR-2026-106 | Schema-Description Contradiction | MEDIUM |
AAI003: Agent Goal and Instruction Manipulation
Attacks that manipulate agent goals and instructions through injected directives.
| ATR Rule | Title | Severity |
|---|---|---|
| ATR-2026-001 | Direct Prompt Injection | CRITICAL |
| ATR-2026-002 | Indirect Prompt Injection | CRITICAL |
| ATR-2026-003 | Jailbreak Attempt | HIGH |
| ATR-2026-004 | System Prompt Override | CRITICAL |
| ATR-2026-005 | Multi-Turn Injection | HIGH |
| ATR-2026-032 | Goal Hijacking | CRITICAL |
| ATR-2026-084 | Structured Data Injection | MEDIUM |
| ATR-2026-086 | Visual Spoofing | MEDIUM |
| ATR-2026-091 | Nested Payload | HIGH |
| ATR-2026-093 | Gradual Escalation | HIGH |
| ATR-2026-097 | CJK Injection Patterns | MEDIUM |
| ATR-2026-104 | Persona Hijacking | HIGH |
AAI004: Agent Hallucination Exploitation
Exploiting hallucinated outputs for cascading impact.
| ATR Rule | Title | Severity |
|---|---|---|
| ATR-2026-050 | Runaway Agent Loop | HIGH |
| ATR-2026-052 | Cascading Failure | CRITICAL |
| ATR-2026-072 | Model Behavior Extraction | HIGH |
| ATR-2026-073 | Malicious Finetuning Data | HIGH |
AAI005: Agent Impact Chain and Blast Radius
Cascading effects across interconnected agent systems.
| ATR Rule | Title | Severity |
|---|---|---|
| ATR-2026-030 | Cross-Agent Attack | HIGH |
| ATR-2026-050 | Runaway Agent Loop | HIGH |
| ATR-2026-051 | Resource Exhaustion | HIGH |
| ATR-2026-052 | Cascading Failure | CRITICAL |
| ATR-2026-063 | Skill Chain Attack | HIGH |
| ATR-2026-074 | Cross-Agent Privilege Escalation | CRITICAL |
| ATR-2026-076 | Inter-Agent Message Spoofing | HIGH |
| ATR-2026-108 | Consensus Sybil Attack | HIGH |
| ATR-2026-117 | Agent Identity Spoofing | CRITICAL |
AAI006: Agent Memory and Context Manipulation
Memory poisoning that reshapes agent behavior long after the initial interaction.
| ATR Rule | Title | Severity |
|---|---|---|
| ATR-2026-020 | System Prompt Leak | HIGH |
| ATR-2026-070 | Data Poisoning | HIGH |
| ATR-2026-075 | Agent Memory Manipulation | HIGH |
| ATR-2026-085 | Audit Evasion | HIGH |
| ATR-2026-090 | Threat Intel Exfil | HIGH |
| ATR-2026-092 | Consensus Poisoning | HIGH |
| ATR-2026-094 | Audit Bypass | HIGH |
| ATR-2026-073 | Malicious Finetuning Data | HIGH |
AAI007: Agent Orchestration and Multi-Agent Exploitation
Attacks targeting multi-agent systems and inter-agent communication.
| ATR Rule | Title | Severity |
|---|---|---|
| ATR-2026-030 | Cross-Agent Attack | HIGH |
| ATR-2026-032 | Goal Hijacking | CRITICAL |
| ATR-2026-041 | Scope Creep | HIGH |
| ATR-2026-074 | Cross-Agent Privilege Escalation | CRITICAL |
| ATR-2026-076 | Inter-Agent Message Spoofing | HIGH |
| ATR-2026-089 | Polymorphic Skill | HIGH |
| ATR-2026-107 | Delayed Execution Bypass | HIGH |
| ATR-2026-108 | Consensus Sybil Attack | HIGH |
| ATR-2026-116 | A2A Message Validation | HIGH |
| ATR-2026-117 | Agent Identity Spoofing | CRITICAL |
AAI008: Agent Resource and Service Exhaustion
Resource exhaustion and denial-of-service through agent automation.
| ATR Rule | Title | Severity |
|---|---|---|
| ATR-2026-050 | Runaway Agent Loop | HIGH |
| ATR-2026-051 | Resource Exhaustion | HIGH |
| ATR-2026-052 | Cascading Failure | CRITICAL |
| ATR-2026-088 | Adaptive Countermeasure | HIGH |
AAI009: Agent Supply Chain and Dependency Attacks
Poisoning of dynamic MCP and A2A ecosystems at runtime.
| ATR Rule | Title | Severity |
|---|---|---|
| ATR-2026-060 | Skill Impersonation | CRITICAL |
| ATR-2026-061 | Description-Behavior Mismatch | HIGH |
| ATR-2026-062 | Hidden Capability | HIGH |
| ATR-2026-063 | Skill Chain Attack | HIGH |
| ATR-2026-065 | Skill Update Attack | HIGH |
| ATR-2026-066 | Parameter Injection | HIGH |
| ATR-2026-089 | Polymorphic Skill | HIGH |
| ATR-2026-095 | Supply Chain Poisoning | CRITICAL |
AAI010: Agent Knowledge Base Poisoning
Contaminating the knowledge sources that agents rely on.
| ATR Rule | Title | Severity |
|---|---|---|
| ATR-2026-070 | Data Poisoning | HIGH |
| ATR-2026-073 | Malicious Finetuning Data | HIGH |
| ATR-2026-075 | Agent Memory Manipulation | HIGH |
| ATR-2026-092 | Consensus Poisoning | HIGH |
| ATR-2026-096 | Registry Poisoning | HIGH |
AAI011: Agent Untraceability
Evasion of audit trails and accountability mechanisms.
| ATR Rule | Title | Severity |
|---|---|---|
| ATR-2026-082 | Fingerprint Evasion | MEDIUM |
| ATR-2026-085 | Audit Evasion | HIGH |
| ATR-2026-087 | Rule Probing | MEDIUM |
| ATR-2026-088 | Adaptive Countermeasure | HIGH |
| ATR-2026-094 | Audit Bypass | HIGH |
| ATR-2026-102 | Disguised Analytics Exfiltration | HIGH |
| ATR-2026-105 | Silent Action Concealment | HIGH |
AAI012: Checker-out-of-the-Loop Vulnerability
Exploiting lack of human oversight in automated agent decisions.
| ATR Rule | Title | Severity |
|---|---|---|
| ATR-2026-077 | Human Trust Exploitation | HIGH |
| ATR-2026-098 | Unauthorized Financial Action | CRITICAL |
| ATR-2026-099 | High-Risk Tool Gate | MEDIUM |
| ATR-2026-118 | Approval Fatigue Exploitation | MEDIUM |
| ATR-2026-119 | Social Engineering via Agent | HIGH |
How to Use ATR Rules
Quick scan (CLI)
npx agent-threat-rules scan your-mcp-config.json
TypeScript
import { ATREngine } from 'agent-threat-rules';
const engine = new ATREngine();
const results = engine.scan(content);
Python
from atr import ATREngine
engine = ATREngine()
results = engine.scan(content)
SIEM Integration
atr convert splunk --output atr-rules.spl
atr convert elastic --output atr-rules.json
References
- ATR Repository: https://github.com/Agent-Threat-Rule/agent-threat-rules
- Full OWASP Mapping: https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/docs/OWASP-MAPPING.md
- PINT-format eval (850-sample corpus self-built from public datasets, not Lakera's official PINT benchmark): 63.2% recall / 99.7% precision
- License: MIT