agent-threat-rules 4.0.0 → 4.2.0

package/spec/category-registry/gemara/atr-detection-control-catalog.yaml

@@ -0,0 +1,327 @@
+# GENERATED by scripts/generate-gemara-catalogs.ts. Do not edit by hand.
+# Inputs: spec/category-registry/v1.0.yaml (the category registry) and
+#         spec/category-registry/gemara/src/editorial.yaml
+# Regenerate: npx tsx scripts/generate-gemara-catalogs.ts
+# License: MIT
+metadata:
+  id: ATR-DETECTION-CONTROL-CATALOG
+  type: ControlCatalog
+  gemara-version: 1.6.0
+  version: 1.0.0
+  description: >-
+    Detection controls an operator can apply using Agent Threat Rules (ATR),
+    organized by where in the lifecycle the inspection happens rather than by
+    which rule category is used. Three are written out; the rest are declared
+    Draft rather than filled in with the same text, because a control whose
+    assessment requirement cannot fail is not a control. The OWASP ASI and MITRE
+    ATLAS references on each control are the modal references on the rules in
+    the categories it is implemented with, as counted on the rule corpus on
+    2026-08-24; they are not recomputed when rules change.
+  author:
+    id: atr
+    name: Agent Threat Rules
+    type: Software Assisted
+    contact:
+      name: ATR maintainers
+      affiliation: Agent Threat Rules
+      email: adam@agentthreatrule.org
+  mapping-references:
+    - id: ATR-AI-AGENT-THREAT-CATALOG
+      title: AI Agent Threat Catalog
+      version: 1.0.0
+      url: file://./atr-threat-catalog.yaml
+      description: Threats these controls are intended to detect.
+    - id: ATR
+      title: Agent Threat Rules category registry
+      version: "1.0"
+      url: >-
+        https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/spec/category-registry/v1.0.yaml
+      description: >-
+        Detection categories of Agent Threat Rules (ATR). Each entry id is a
+        category id in this registry and names the directory under rules/ that
+        holds that category's rules.
+    - id: OWASP-ASI
+      title: OWASP Agentic Security Initiative Top 10
+      version: "2026"
+      url: https://genai.owasp.org/
+      description: Guidance each ATR rule already cross-references in its own metadata.
+    - id: MITRE-ATLAS
+      title: MITRE ATLAS
+      version: "2026"
+      url: https://atlas.mitre.org/
+      description: Adversarial technique taxonomy each ATR rule already cross-references.
+  applicability-groups:
+    - id: pre-load
+      title: Before an artifact is loaded
+      description: >-
+        Applies where an artifact is inspected before the agent can use it —
+        skills, plugins, tool manifests, model files.
+    - id: request-path
+      title: On the request path
+      description: >-
+        Applies where content is inspected while the agent is running, before it
+        reaches the model or leaves the boundary.
+    - id: at-write
+      title: When content is committed to durable state
+      description: >-
+        Applies when content is written to memory, a cache or a retrieval
+        corpus, regardless of whether an agent is executing at the time.
+    - id: data-pipeline
+      title: In the data pipeline
+      description: >-
+        Applies where training or adaptation data is assembled, ahead of any
+        agent execution.
+  draft: true
+title: ATR Detection Control Catalog
+imports:
+  - reference-id: ATR-AI-AGENT-THREAT-CATALOG
+    entries:
+      - reference-id: ATR-THREAT-UNAUTHORIZED-ACTION
+      - reference-id: ATR-THREAT-DELAYED-UNAUTHORIZED-ACTION
+      - reference-id: ATR-THREAT-CONTEXT-DISCLOSURE
+      - reference-id: ATR-THREAT-EXECUTION-ESCAPE
+      - reference-id: ATR-THREAT-UNBOUNDED-COMMITMENT
+      - reference-id: ATR-THREAT-MODEL-BEHAVIOUR-COMPROMISE
+groups:
+  - id: artifact-screening
+    title: Artifact screening
+    description: Controls that inspect something before the agent is allowed to use it.
+  - id: content-screening
+    title: Content screening
+    description: Controls that inspect content on the request or response path.
+  - id: pipeline-screening
+    title: Pipeline screening
+    description: Controls that inspect data before it shapes a model.
+controls:
+  - id: ATR-CTL-EXTENSION-SCREENING
+    title: Screening of loadable extensions before use
+    objective: >-
+      No skill, plugin, tool manifest or model artifact becomes available to the
+      agent without having been inspected for hostile content, and the operator
+      can tell afterwards which ruleset that inspection was performed under.
+    group: artifact-screening
+    assessment-requirements:
+      - id: ATR-CTL-EXTENSION-SCREENING-AR-1
+        text: >-
+          Every extension artifact MUST be scanned before it is registered as
+          available to the agent, and registration MUST fail closed when the
+          scan cannot complete or the ruleset version cannot be resolved.
+        applicability:
+          - pre-load
+        recommendation: >-
+          Failing closed is the part that is usually skipped. A scanner that is
+          unreachable and treated as a pass converts this control into a
+          formality without changing any observable behaviour.
+      - id: ATR-CTL-EXTENSION-SCREENING-AR-2
+        text: >-
+          A serialized model artifact MUST NOT be deserialized before its digest
+          has been checked against the digest recorded when it was screened.
+        applicability:
+          - pre-load
+        recommendation: >-
+          Deserialization is the execution boundary for this class of artifact,
+          so a check performed after loading has already lost.
+      - id: ATR-CTL-EXTENSION-SCREENING-AR-3
+        text: >-
+          The ruleset version in effect MUST be recorded with each screening
+          result and retained for as long as the artifact remains registered.
+        applicability:
+          - pre-load
+        recommendation: >-
+          A clean result is bounded by the rules that ran. Without the version,
+          a later question about coverage has no answer.
+    guidelines:
+      - reference-id: OWASP-ASI
+        entries:
+          - reference-id: ASI04:2026
+          - reference-id: ASI05:2026
+      - reference-id: MITRE-ATLAS
+        entries:
+          - reference-id: AML.T0010
+      - reference-id: ATR
+        entries:
+          - reference-id: skill-compromise
+          - reference-id: model-security
+        remarks: >-
+          The rule categories this control is implemented with; each id is a
+          category in the ATR category registry and a directory under rules/.
+    threats:
+      - reference-id: ATR-AI-AGENT-THREAT-CATALOG
+        entries:
+          - reference-id: ATR-THREAT-EXECUTION-ESCAPE
+          - reference-id: ATR-THREAT-UNAUTHORIZED-ACTION
+        remarks: >-
+          Screening covers both because a hostile extension can either execute
+          directly or steer the model into acting; the rules that detect each
+          differ, the moment of inspection does not.
+    state: Active
+  - id: ATR-CTL-INBOUND-CONTENT-SCREENING
+    title: Screening of untrusted content entering model context
+    objective: >-
+      Content reaching the model from a source the operator does not control is
+      inspected for embedded instructions before the agent acts on it, and a
+      detection carries enough provenance for a human to adjudicate it.
+    group: content-screening
+    assessment-requirements:
+      - id: ATR-CTL-INBOUND-CONTENT-SCREENING-AR-1
+        text: >-
+          Content retrieved from an external source MUST be inspected before it
+          enters the model context, and each detection MUST record the matching
+          rule id, the ruleset version, and the location of the match within the
+          content.
+        applicability:
+          - request-path
+        recommendation: >-
+          Recording the location is what makes a detection adjudicable. A rule
+          id alone tells a reviewer that something matched, not what.
+      - id: ATR-CTL-INBOUND-CONTENT-SCREENING-AR-2
+        text: >-
+          Content written into persistent memory or a retrieval corpus MUST be
+          inspected at write time as well as at read time.
+        applicability:
+          - request-path
+          - at-write
+        recommendation: >-
+          Write-time inspection is the only point at which the originating
+          request is still available to attribute a later action to.
+      - id: ATR-CTL-INBOUND-CONTENT-SCREENING-AR-3
+        text: >-
+          The deployment MUST record which rule maturity lane was in effect for
+          each inspection, and MUST NOT block on a lane the operator has not
+          accepted for blocking.
+        applicability:
+          - request-path
+        recommendation: >-
+          ATR publishes rules at differing maturity. Blocking on a lane intended
+          for triage converts a detection surface into an availability incident.
+    guidelines:
+      - reference-id: OWASP-ASI
+        entries:
+          - reference-id: ASI01:2026
+          - reference-id: ASI06:2026
+      - reference-id: MITRE-ATLAS
+        entries:
+          - reference-id: AML.T0051
+      - reference-id: ATR
+        entries:
+          - reference-id: prompt-injection
+          - reference-id: data-poisoning
+        remarks: >-
+          The rule categories this control is implemented with; each id is a
+          category in the ATR category registry and a directory under rules/.
+    threats:
+      - reference-id: ATR-AI-AGENT-THREAT-CATALOG
+        entries:
+          - reference-id: ATR-THREAT-UNAUTHORIZED-ACTION
+          - reference-id: ATR-THREAT-DELAYED-UNAUTHORIZED-ACTION
+    state: Active
+  - id: ATR-CTL-EGRESS-SCREENING
+    title: Screening of agent-initiated egress
+    objective: >-
+      Content the agent sends outside the trust boundary is inspected before it
+      leaves, so that a permitted call carrying context or credentials is
+      surfaced rather than passing on the strength of its destination.
+    group: content-screening
+    assessment-requirements:
+      - id: ATR-CTL-EGRESS-SCREENING-AR-1
+        text: >-
+          Outbound request content MUST be inspected before the request is
+          issued, not reconstructed from logs afterwards.
+        applicability:
+          - request-path
+        recommendation: >-
+          Post-hoc inspection can attribute a disclosure but cannot prevent it,
+          and for credentials the distinction is the whole control.
+      - id: ATR-CTL-EGRESS-SCREENING-AR-2
+        text: >-
+          Credential-bearing headers MUST be redacted before content is passed
+          to inspection, and a detection MUST NOT reproduce matched credential
+          material in its finding.
+        applicability:
+          - request-path
+        recommendation: >-
+          A detection surface that stores what it detected becomes a second copy
+          of the secret, in a system usually held to a lower standard.
+      - id: ATR-CTL-EGRESS-SCREENING-AR-3
+        text: >-
+          Where inspection cannot evaluate a request shape, the deployment MUST
+          record that the request was not evaluated rather than recording it as
+          clean.
+        applicability:
+          - request-path
+        recommendation: >-
+          Rules are written against an event vocabulary. Where a request does
+          not map onto it, "no finding" and "not looked at" are different facts
+          and only one of them is safe to aggregate.
+    guidelines:
+      - reference-id: MITRE-ATLAS
+        entries:
+          - reference-id: AML.T0057
+          - reference-id: AML.T0056
+      - reference-id: ATR
+        entries:
+          - reference-id: context-exfiltration
+        remarks: >-
+          The rule category this control is implemented with. No OWASP ASI entry
+          is cited: the modal reference on these rules is ASI01, which names the
+          injection that induces the disclosure rather than the disclosure
+          itself, so citing it here would overstate the fit.
+    threats:
+      - reference-id: ATR-AI-AGENT-THREAT-CATALOG
+        entries:
+          - reference-id: ATR-THREAT-CONTEXT-DISCLOSURE
+    state: Active
+  - id: ATR-CTL-AUTONOMY-BOUNDING
+    title: Bounding of unattended commitment
+    objective: >-
+      Consequential commitments made without a human decision point are detected
+      and bounded.
+    group: content-screening
+    assessment-requirements:
+      - id: ATR-CTL-AUTONOMY-BOUNDING-AR-1
+        text: >-
+          An action that commits funds, capacity or an external obligation MUST
+          require a recorded human decision, and the deployment MUST be able to
+          show which decision authorized a given commitment.
+        applicability:
+          - request-path
+        state: Draft
+        recommendation: >-
+          Held Draft because ATR cannot assess it. The rules under
+          rules/excessive-autonomy detect the shapes that precede an unbounded
+          commitment — loop continuation, scope expansion — but nothing in the
+          corpus observes whether an approval was obtained, because approval is
+          a property of the deployment's control flow rather than of any event
+          ATR inspects. Written out so the gap is visible, and Draft so no
+          evaluator treats it as assessable today.
+    threats:
+      - reference-id: ATR-AI-AGENT-THREAT-CATALOG
+        entries:
+          - reference-id: ATR-THREAT-UNBOUNDED-COMMITMENT
+    state: Draft
+  - id: ATR-CTL-ADAPTATION-DATA-SCREENING
+    title: Screening of model adaptation data
+    objective: Data used to adapt a model is inspected before it shapes behaviour.
+    group: pipeline-screening
+    assessment-requirements:
+      - id: ATR-CTL-ADAPTATION-DATA-SCREENING-AR-1
+        text: >-
+          Data used to adapt or fine-tune a model MUST be screened for
+          attacker-controlled content before it enters the training set.
+        applicability:
+          - data-pipeline
+        state: Draft
+        recommendation: >-
+          Held Draft because of a mismatch that is easy to state wrongly. ATR
+          does carry a rule for this — ATR-2026-00073, Malicious Fine-tuning
+          Data, which cites AML.T0020 Poison Training Data — but it binds a
+          runtime event field, user_input over an agent I/O source, rather than
+          a corpus at rest. A deployment could satisfy this requirement with a
+          pipeline scanner ATR had no part in, and ATR could pass a request
+          without the training set having been screened. Draft until rules exist
+          that run against a corpus rather than an event.
+    threats:
+      - reference-id: ATR-AI-AGENT-THREAT-CATALOG
+        entries:
+          - reference-id: ATR-THREAT-MODEL-BEHAVIOUR-COMPROMISE
+    state: Draft

package/spec/category-registry/gemara/atr-threat-catalog.yaml

@@ -0,0 +1,246 @@
+# GENERATED by scripts/generate-gemara-catalogs.ts. Do not edit by hand.
+# Inputs: spec/category-registry/v1.0.yaml (the category registry) and
+#         spec/category-registry/gemara/src/editorial.yaml
+# Regenerate: npx tsx scripts/generate-gemara-catalogs.ts
+# License: MIT
+metadata:
+  id: ATR-AI-AGENT-THREAT-CATALOG
+  type: ThreatCatalog
+  gemara-version: 1.6.0
+  version: 1.0.0
+  description: >-
+    Threats to an organization operating AI agents, written at the level of what
+    goes wrong and why it matters. Each threat names the capabilities that
+    create the opportunity for it and the attack vectors through which it is
+    realized. The counts deliberately do not line up: several vectors reach the
+    same impact, and one vector reaches more than one.
+  author:
+    id: atr
+    name: Agent Threat Rules
+    type: Software Assisted
+    contact:
+      name: ATR maintainers
+      affiliation: Agent Threat Rules
+      email: adam@agentthreatrule.org
+  mapping-references:
+    - id: ATR-AI-AGENT-CAPABILITY-CATALOG
+      title: AI Agent Capability Catalog
+      version: 1.0.0
+      url: file://./ai-agent-capability-catalog.yaml
+      description: >-
+        Capabilities of AI agent systems that create the opportunity for these
+        threats.
+    - id: ATR-AI-AGENT-VECTOR-CATALOG
+      title: AI Agent Attack Vector Catalog (ATR)
+      version: 1.0.0
+      url: file://./atr-attack-vector-catalog.yaml
+      description: >-
+        Methods by which these threats are realized, corresponding to ATR's
+        detection categories.
+  draft: true
+title: AI Agent Threat Catalog
+imports:
+  - reference-id: ATR-AI-AGENT-CAPABILITY-CATALOG
+    entries:
+      - reference-id: CAP-MODEL-INFERENCE
+      - reference-id: CAP-OUTPUT-ACTION
+      - reference-id: CAP-TOOL-INVOCATION
+      - reference-id: CAP-MCP-CONNECTION
+      - reference-id: CAP-CROSS-AGENT-MESSAGING
+      - reference-id: CAP-SKILL-LOADING
+      - reference-id: CAP-MEMORY-WRITE
+      - reference-id: CAP-MEMORY-READ
+      - reference-id: CAP-AUTONOMOUS-ACTION
+      - reference-id: CAP-PRIVILEGED-EXECUTION
+      - reference-id: CAP-MODEL-ARTIFACT-LOADING
+      - reference-id: CAP-TRAINING-DATA-INGESTION
+  - reference-id: ATR-AI-AGENT-VECTOR-CATALOG
+    entries:
+      - reference-id: prompt-injection
+      - reference-id: tool-poisoning
+      - reference-id: skill-compromise
+      - reference-id: context-exfiltration
+      - reference-id: excessive-autonomy
+      - reference-id: model-abuse
+      - reference-id: model-security
+      - reference-id: privilege-escalation
+      - reference-id: agent-manipulation
+      - reference-id: data-poisoning
+groups:
+  - id: unauthorized-action
+    title: Action the operator did not authorize
+    description: Impacts arising from the agent doing something on the operator's behalf.
+  - id: loss-of-confidentiality
+    title: Loss of confidentiality
+    description: Impacts arising from data leaving the boundary the operator set.
+  - id: loss-of-containment
+    title: Loss of containment
+    description: Impacts arising from execution or authority escaping its intended bound.
+threats:
+  - id: ATR-THREAT-UNAUTHORIZED-ACTION
+    title: Unauthorized action executed with the operator's standing authority
+    description: >-
+      The agent takes a consequential action the operator never requested — a
+      tool call, a write, a message to a third party — because instructions
+      reached the model from a source the operator does not control. The action
+      carries the operator's own credentials and audit identity, so it is
+      indistinguishable from legitimate use after the fact, and remediation
+      means unwinding real effects rather than revoking a session.
+    group: unauthorized-action
+    capabilities:
+      - reference-id: ATR-AI-AGENT-CAPABILITY-CATALOG
+        entries:
+          - reference-id: CAP-OUTPUT-ACTION
+          - reference-id: CAP-TOOL-INVOCATION
+          - reference-id: CAP-MODEL-INFERENCE
+          - reference-id: CAP-MCP-CONNECTION
+          - reference-id: CAP-CROSS-AGENT-MESSAGING
+    vectors:
+      - reference-id: ATR-AI-AGENT-VECTOR-CATALOG
+        entries:
+          - reference-id: prompt-injection
+          - reference-id: tool-poisoning
+          - reference-id: agent-manipulation
+          - reference-id: model-abuse
+        remarks: >-
+          Four vectors reach this one impact. Which of them a deployment is
+          exposed to depends on whether it ingests untrusted content, connects
+          to third-party tool servers, or runs more than one agent.
+    actors:
+      - id: external-content-author
+        name: Author of content the agent ingests
+        type: Human
+  - id: ATR-THREAT-DELAYED-UNAUTHORIZED-ACTION
+    title: Unauthorized action triggered long after the input that caused it
+    description: >-
+      Attacker-controlled content is written into memory, cache or a retrieved
+      corpus and shapes a decision in a later session. The organization loses
+      the ability to reason about an incident from its inputs, because the
+      request that produced the harmful action is clean and the poisoned state
+      is not attributable to it without retained provenance.
+    group: unauthorized-action
+    capabilities:
+      - reference-id: ATR-AI-AGENT-CAPABILITY-CATALOG
+        entries:
+          - reference-id: CAP-MEMORY-WRITE
+          - reference-id: CAP-MEMORY-READ
+    vectors:
+      - reference-id: ATR-AI-AGENT-VECTOR-CATALOG
+        entries:
+          - reference-id: data-poisoning
+          - reference-id: prompt-injection
+        remarks: >-
+          Separated from the immediate case because the detection opportunity is
+          at write time, not at the time of the harmful action.
+    actors:
+      - id: external-content-author
+        name: Author of content the agent ingests
+        type: Human
+  - id: ATR-THREAT-CONTEXT-DISCLOSURE
+    title: Disclosure of conversation context, credentials and retrieved data
+    description: >-
+      Credentials, prior conversation content or documents the agent was able to
+      retrieve leave the trust boundary through an outbound call the agent is
+      permitted to make. The organization loses control of secrets and of
+      whatever customer data the agent could read, and because the call is
+      permitted, network controls do not register it as an incident.
+    group: loss-of-confidentiality
+    capabilities:
+      - reference-id: ATR-AI-AGENT-CAPABILITY-CATALOG
+        entries:
+          - reference-id: CAP-OUTPUT-ACTION
+          - reference-id: CAP-TOOL-INVOCATION
+          - reference-id: CAP-MEMORY-READ
+    vectors:
+      - reference-id: ATR-AI-AGENT-VECTOR-CATALOG
+        entries:
+          - reference-id: context-exfiltration
+          - reference-id: prompt-injection
+          - reference-id: model-security
+        remarks: >-
+          Model-security appears here for behaviour extraction: systematic
+          probing recovers the system prompt, which is context disclosure by a
+          different route than an outbound call.
+    actors:
+      - id: external-content-author
+        name: Author of content the agent ingests
+        type: Human
+  - id: ATR-THREAT-EXECUTION-ESCAPE
+    title: Code execution or privilege beyond the agent's intended bound
+    description: >-
+      Execution or authority escapes the scope the deployment intended, whether
+      through a delegation chain, a reused credential, a hostile extension, or
+      deserialization of an untrusted artifact at load time. This is the impact
+      where the blast radius is not bounded by the agent: the host, adjacent
+      workloads and any credential reachable from them are in scope.
+    group: loss-of-containment
+    capabilities:
+      - reference-id: ATR-AI-AGENT-CAPABILITY-CATALOG
+        entries:
+          - reference-id: CAP-PRIVILEGED-EXECUTION
+          - reference-id: CAP-SKILL-LOADING
+          - reference-id: CAP-MODEL-ARTIFACT-LOADING
+    vectors:
+      - reference-id: ATR-AI-AGENT-VECTOR-CATALOG
+        entries:
+          - reference-id: privilege-escalation
+          - reference-id: skill-compromise
+          - reference-id: model-security
+        remarks: >-
+          Three vectors, one blast radius. What these share is that execution or
+          authority leaves the agent's bound, not how it got there, so the
+          containment question is the same in all three cases. Which one a
+          deployment is exposed to follows from whether it loads third-party
+          extensions, deserializes model artifacts, or delegates credentials.
+    actors:
+      - id: extension-publisher
+        name: Publisher of a third-party skill, plugin or tool server
+        type: Human
+      - id: tenant-user
+        name: A user with legitimate access to the agent
+        type: Human
+  - id: ATR-THREAT-UNBOUNDED-COMMITMENT
+    title: Commitment of resources without a human decision
+    description: >-
+      The agent commits money, capacity or an external obligation where a human
+      approval was intended, or continues acting past its objective. The cost is
+      incurred rather than risked, and the organization discovers it from the
+      effect rather than from a security signal.
+    group: unauthorized-action
+    capabilities:
+      - reference-id: ATR-AI-AGENT-CAPABILITY-CATALOG
+        entries:
+          - reference-id: CAP-AUTONOMOUS-ACTION
+          - reference-id: CAP-OUTPUT-ACTION
+    vectors:
+      - reference-id: ATR-AI-AGENT-VECTOR-CATALOG
+        entries:
+          - reference-id: excessive-autonomy
+    actors:
+      - id: tenant-user
+        name: A user with legitimate access to the agent
+        type: Human
+  - id: ATR-THREAT-MODEL-BEHAVIOUR-COMPROMISE
+    title: Compromise of the model's behaviour through its supply chain
+    description: >-
+      The behaviour of the deployed model is shaped by an attacker before the
+      agent ever runs, through poisoned adaptation data. Nothing in the request
+      path is anomalous, so runtime inspection cannot see it, and the defect is
+      carried by every deployment of that model until it is retrained.
+    group: loss-of-containment
+    capabilities:
+      - reference-id: ATR-AI-AGENT-CAPABILITY-CATALOG
+        entries:
+          - reference-id: CAP-TRAINING-DATA-INGESTION
+    vectors:
+      - reference-id: ATR-AI-AGENT-VECTOR-CATALOG
+        entries:
+          - reference-id: model-security
+        remarks: >-
+          The detection opportunity here is in the data pipeline, not on the
+          request path, which is why it is a distinct threat from the execution
+          escape that shares the same vector.
+    actors:
+      - id: upstream-model-supplier
+        name: Producer of the model or of its adaptation data
+        type: Human