agent-threat-rules 4.1.5 → 4.2.0

package/spec/category-registry/gemara/ai-agent-capability-catalog.yaml

@@ -0,0 +1,157 @@
+# GENERATED by scripts/generate-gemara-catalogs.ts. Do not edit by hand.
+# Inputs: spec/category-registry/v1.0.yaml (the category registry) and
+#         spec/category-registry/gemara/src/editorial.yaml
+# Regenerate: npx tsx scripts/generate-gemara-catalogs.ts
+# License: MIT
+metadata:
+  id: ATR-AI-AGENT-CAPABILITY-CATALOG
+  type: CapabilityCatalog
+  gemara-version: 1.6.0
+  version: 1.0.0
+  description: >-
+    Capabilities of AI agent systems that create the opportunity for the threats
+    catalogued by Agent Threat Rules (ATR). Each capability describes a feature
+    or function an agent can perform, not a threat. Threats in the companion
+    threat catalog reference these capabilities. Authored by the ATR project and
+    validated against the Gemara schemas; ATR hosts the content, Gemara defines
+    the schema.
+  author:
+    id: atr
+    name: Agent Threat Rules
+    type: Software Assisted
+    contact:
+      name: ATR maintainers
+      affiliation: Agent Threat Rules
+      email: adam@agentthreatrule.org
+  draft: true
+title: AI Agent Capability Catalog
+groups:
+  - id: model-interaction
+    title: Model Interaction
+    description: >-
+      Capabilities by which an agent receives instructions and untrusted content
+      into a language model and acts on the model's output.
+  - id: tool-and-protocol
+    title: Tool and Protocol Access
+    description: >-
+      Capabilities by which an agent invokes external tools and connects to tool
+      servers over protocols such as the Model Context Protocol (MCP).
+  - id: extensibility
+    title: Extensibility
+    description: >-
+      Capabilities by which an agent loads and runs third-party extensions such
+      as skills, plugins, and packaged capability bundles.
+  - id: state-and-memory
+    title: State and Memory
+    description: >-
+      Capabilities by which an agent reads and writes persistent state,
+      conversation context, and long-term memory across turns and sessions.
+  - id: autonomy-and-coordination
+    title: Autonomy and Coordination
+    description: >-
+      Capabilities by which an agent acts without per-step human approval and
+      coordinates with other agents.
+  - id: model-supply-chain
+    title: Model supply chain
+    description: >-
+      Capabilities by which the model an agent depends on is built, packaged and
+      loaded. These sit outside agent runtime: they shape behaviour before any
+      request is served.
+capabilities:
+  - id: CAP-MODEL-INFERENCE
+    title: Model Inference on Untrusted Input
+    description: >-
+      The agent passes user instructions and content drawn from external sources
+      into a language model and treats the resulting output as actionable.
+      Mixing trusted instructions with untrusted content in a single context
+      window is the feature that makes prompt injection and jailbreak attempts
+      possible.
+    group: model-interaction
+  - id: CAP-OUTPUT-ACTION
+    title: Acting on Model Output
+    description: >-
+      The agent converts model output into actions, tool calls, or content
+      returned to downstream systems. Because output is consumed without an
+      independent trust boundary, manipulated output can redirect behaviour or
+      carry exfiltrated data.
+    group: model-interaction
+  - id: CAP-TOOL-INVOCATION
+    title: Tool Invocation
+    description: >-
+      The agent calls external tools and functions, passing arguments and
+      receiving results that re-enter the model context. Tool arguments and tool
+      results are an attack surface for injection, command execution, and
+      over-broad actions.
+    group: tool-and-protocol
+  - id: CAP-MCP-CONNECTION
+    title: MCP and Tool-Server Connection
+    description: >-
+      The agent connects to tool servers over the Model Context Protocol or
+      similar transports, consuming server-provided tool manifests, schemas, and
+      descriptions. Server-controlled metadata is trusted at connection time,
+      which creates the opportunity for tool poisoning and tool redefinition
+      (rug-pull) after initial approval.
+    group: tool-and-protocol
+  - id: CAP-CROSS-AGENT-MESSAGING
+    title: Cross-Agent Message Passing
+    description: >-
+      The agent sends and receives messages to and from other agents in a
+      multi-agent workflow. Messages from peer agents are treated as trusted
+      input, which lets a compromised or manipulated agent influence others.
+    group: tool-and-protocol
+  - id: CAP-SKILL-LOADING
+    title: Skill and Plugin Loading
+    description: >-
+      The agent loads third-party skills, plugins, or capability bundles and
+      executes the instructions and code they contain. Loaded extensions run
+      with the agent's privileges, which creates the opportunity for supply
+      chain compromise and backdoored or over-privileged skills.
+    group: extensibility
+  - id: CAP-MEMORY-WRITE
+    title: Memory and State Write
+    description: >-
+      The agent writes facts, instructions, or artifacts into persistent memory
+      or shared state that influences later turns and sessions. Writable memory
+      is the feature that lets poisoned content persist and take effect after
+      the originating input is gone.
+    group: state-and-memory
+  - id: CAP-MEMORY-READ
+    title: Context and Memory Read
+    description: >-
+      The agent reads conversation history, retrieved documents, and long-term
+      memory back into the active context. Reading attacker- influenced state
+      re-introduces untrusted content and is a channel for indirect injection
+      and staged data exfiltration.
+    group: state-and-memory
+  - id: CAP-AUTONOMOUS-ACTION
+    title: Autonomous Action Without Per-Step Approval
+    description: >-
+      The agent executes multi-step plans, loops, and side-effecting actions
+      without human approval at each step. Unbounded autonomy is the feature
+      that turns a single manipulated decision into runaway loops, resource
+      abuse, or unauthorized real-world actions.
+    group: autonomy-and-coordination
+  - id: CAP-PRIVILEGED-EXECUTION
+    title: Privileged and Delegated Execution
+    description: >-
+      The agent runs with delegated credentials and access to systems,
+      databases, files, and networks. Holding standing privilege creates the
+      opportunity for privilege escalation, sandbox escape, and use of the
+      agent's access beyond its intended scope.
+    group: autonomy-and-coordination
+  - id: CAP-MODEL-ARTIFACT-LOADING
+    title: Model Artifact Loading
+    description: >-
+      The agent depends on a serialized model artifact that is fetched from a
+      registry or filesystem and deserialized into an executable object before
+      any behavioural check runs. The artifact is trusted at the moment it is
+      least verified.
+    group: model-supply-chain
+  - id: CAP-TRAINING-DATA-INGESTION
+    title: Training and Fine-Tuning Data Ingestion
+    description: >-
+      The model the agent depends on is adapted using data drawn from sources
+      the operator does not fully control. Ingested data shapes behaviour after
+      the originating input is gone, and every deployment of the resulting model
+      carries that shaping.
+    group: model-supply-chain

package/spec/category-registry/gemara/atr-attack-vector-catalog.yaml

@@ -0,0 +1,130 @@
+# GENERATED by scripts/generate-gemara-catalogs.ts. Do not edit by hand.
+# Inputs: spec/category-registry/v1.0.yaml (the category registry) and
+#         spec/category-registry/gemara/src/editorial.yaml
+# Regenerate: npx tsx scripts/generate-gemara-catalogs.ts
+# License: MIT
+metadata:
+  id: ATR-AI-AGENT-VECTOR-CATALOG
+  type: VectorCatalog
+  gemara-version: 1.6.0
+  version: 1.0.0
+  description: >-
+    Attack vectors against AI agent systems, one per detection category in the
+    Agent Threat Rules (ATR) category registry. A category is a method by which
+    a threat is realized rather than the threat itself, which is why it lives
+    here and is referenced from the threat catalog rather than restated in it.
+    Generated from the registry: each vector id is a registry category id and
+    each description is the registry's description of that category.
+
+    Validated against Gemara's #VectorCatalog, which is marked experimental in
+    vectorcatalog.cue; this artifact may need to change with the schema.
+  author:
+    id: atr
+    name: Agent Threat Rules
+    type: Software Assisted
+    contact:
+      name: ATR maintainers
+      affiliation: Agent Threat Rules
+      email: adam@agentthreatrule.org
+  mapping-references:
+    - id: ATR
+      title: Agent Threat Rules category registry
+      version: "1.0"
+      url: >-
+        https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/spec/category-registry/v1.0.yaml
+      description: >-
+        Detection categories of Agent Threat Rules (ATR). Each entry id is a
+        category id in this registry and names the directory under rules/ that
+        holds that category's rules.
+  draft: true
+title: AI Agent Attack Vector Catalog (ATR)
+groups:
+  - id: via-content
+    title: Through content the agent reads
+    description: >-
+      Vectors that arrive inside data the agent ingests and are acted on as
+      though they were operator instructions.
+  - id: via-extension
+    title: Through an artifact the agent loads
+    description: >-
+      Vectors carried by tools, skills, plugins or model artifacts, which arrive
+      through the supply chain rather than the conversation.
+  - id: via-authority
+    title: Through the authority the agent holds
+    description: >-
+      Vectors that exploit what the agent is permitted to do rather than what it
+      is told.
+vectors:
+  - id: prompt-injection
+    title: Instruction injection into model context
+    description: >-
+      Adversarial inputs that subvert the agent's instruction-following behavior
+      — direct injection, indirect injection (via retrieved documents or tool
+      outputs), jailbreak attempts, system-prompt overrides, multi-turn
+      manipulation, and cross-agent injection.
+    group: via-content
+  - id: tool-poisoning
+    title: Manipulation of tool calls and tool output
+    description: >-
+      Attacks that manipulate the agent's tool-calling behavior — tool output
+      injection, unauthorized tool invocation, SSRF via tool calls, tool
+      argument tampering, shell-tool unsanitized argv, tool-response piggyback.
+    group: via-extension
+  - id: skill-compromise
+    title: Compromised skill, plugin or server package
+    description: >-
+      Compromise of skills, plugins, or MCP server packages — supply chain
+      attacks, malicious SKILL.md content, package typosquatting, install-time
+      daemon installation, silent exfiltration via skill instructions.
+    group: via-extension
+  - id: context-exfiltration
+    title: Context and credential exfiltration
+    description: >-
+      Attacks that leak the agent's context window, system prompt, memory store,
+      retrieved documents, or session state — memory poisoning with exfil
+      persistence, system-prompt leakage, credential pattern leakage in agent
+      output.
+    group: via-authority
+  - id: excessive-autonomy
+    title: Action beyond declared scope or authorization
+    description: >-
+      The agent acts beyond its declared scope, permissions, or authorization —
+      autonomous goal pursuit, permission-boundary violation, scope creep
+      through gradual privilege accumulation.
+    group: via-authority
+  - id: model-abuse
+    title: Model-level evasion of robustness and oversight
+    description: >-
+      Model-level attacks on the agent's underlying LLM — adversarial inputs
+      targeting model robustness, reward-hacking signatures in output,
+      deceptive-justification language, monitor-evasion attempts via env-var or
+      telemetry mutation.
+    group: via-content
+  - id: model-security
+    title: Attack on the model artifact
+    description: >-
+      Attacks on the model artifact itself — model weight tampering, unsafe
+      deserialization of model files, adversarial model registry uploads.
+    group: via-extension
+  - id: privilege-escalation
+    title: Privilege escalation and delegated authority abuse
+    description: >-
+      Attacks that escalate the agent's effective privileges — authentication
+      bypass on agent control plane (e.g., PraisonAI CVE-2026-44338), sudo /
+      chmod patterns in tool calls, scope escalation across agent chain.
+    group: via-authority
+  - id: agent-manipulation
+    title: Forged peer-agent identity and message framing
+    description: >-
+      Attacks on agent-to-agent (A2A) communication or identity — cross-agent
+      attacks, inter-agent message spoofing, agent identity replacement /
+      spoofing, fork impersonation, real-person identity commands, skill
+      impersonation.
+    group: via-content
+  - id: data-poisoning
+    title: Poisoning of state the agent will read later
+    description: >-
+      Attacks on the data the agent consumes — RAG retrieved document poisoning,
+      knowledge base poisoning, training-data tampering patterns (where
+      detectable at runtime).
+    group: via-content

package/spec/category-registry/gemara/atr-detection-control-catalog.yaml

@@ -0,0 +1,327 @@
+# GENERATED by scripts/generate-gemara-catalogs.ts. Do not edit by hand.
+# Inputs: spec/category-registry/v1.0.yaml (the category registry) and
+#         spec/category-registry/gemara/src/editorial.yaml
+# Regenerate: npx tsx scripts/generate-gemara-catalogs.ts
+# License: MIT
+metadata:
+  id: ATR-DETECTION-CONTROL-CATALOG
+  type: ControlCatalog
+  gemara-version: 1.6.0
+  version: 1.0.0
+  description: >-
+    Detection controls an operator can apply using Agent Threat Rules (ATR),
+    organized by where in the lifecycle the inspection happens rather than by
+    which rule category is used. Three are written out; the rest are declared
+    Draft rather than filled in with the same text, because a control whose
+    assessment requirement cannot fail is not a control. The OWASP ASI and MITRE
+    ATLAS references on each control are the modal references on the rules in
+    the categories it is implemented with, as counted on the rule corpus on
+    2026-08-24; they are not recomputed when rules change.
+  author:
+    id: atr
+    name: Agent Threat Rules
+    type: Software Assisted
+    contact:
+      name: ATR maintainers
+      affiliation: Agent Threat Rules
+      email: adam@agentthreatrule.org
+  mapping-references:
+    - id: ATR-AI-AGENT-THREAT-CATALOG
+      title: AI Agent Threat Catalog
+      version: 1.0.0
+      url: file://./atr-threat-catalog.yaml
+      description: Threats these controls are intended to detect.
+    - id: ATR
+      title: Agent Threat Rules category registry
+      version: "1.0"
+      url: >-
+        https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/spec/category-registry/v1.0.yaml
+      description: >-
+        Detection categories of Agent Threat Rules (ATR). Each entry id is a
+        category id in this registry and names the directory under rules/ that
+        holds that category's rules.
+    - id: OWASP-ASI
+      title: OWASP Agentic Security Initiative Top 10
+      version: "2026"
+      url: https://genai.owasp.org/
+      description: Guidance each ATR rule already cross-references in its own metadata.
+    - id: MITRE-ATLAS
+      title: MITRE ATLAS
+      version: "2026"
+      url: https://atlas.mitre.org/
+      description: Adversarial technique taxonomy each ATR rule already cross-references.
+  applicability-groups:
+    - id: pre-load
+      title: Before an artifact is loaded
+      description: >-
+        Applies where an artifact is inspected before the agent can use it —
+        skills, plugins, tool manifests, model files.
+    - id: request-path
+      title: On the request path
+      description: >-
+        Applies where content is inspected while the agent is running, before it
+        reaches the model or leaves the boundary.
+    - id: at-write
+      title: When content is committed to durable state
+      description: >-
+        Applies when content is written to memory, a cache or a retrieval
+        corpus, regardless of whether an agent is executing at the time.
+    - id: data-pipeline
+      title: In the data pipeline
+      description: >-
+        Applies where training or adaptation data is assembled, ahead of any
+        agent execution.
+  draft: true
+title: ATR Detection Control Catalog
+imports:
+  - reference-id: ATR-AI-AGENT-THREAT-CATALOG
+    entries:
+      - reference-id: ATR-THREAT-UNAUTHORIZED-ACTION
+      - reference-id: ATR-THREAT-DELAYED-UNAUTHORIZED-ACTION
+      - reference-id: ATR-THREAT-CONTEXT-DISCLOSURE
+      - reference-id: ATR-THREAT-EXECUTION-ESCAPE
+      - reference-id: ATR-THREAT-UNBOUNDED-COMMITMENT
+      - reference-id: ATR-THREAT-MODEL-BEHAVIOUR-COMPROMISE
+groups:
+  - id: artifact-screening
+    title: Artifact screening
+    description: Controls that inspect something before the agent is allowed to use it.
+  - id: content-screening
+    title: Content screening
+    description: Controls that inspect content on the request or response path.
+  - id: pipeline-screening
+    title: Pipeline screening
+    description: Controls that inspect data before it shapes a model.
+controls:
+  - id: ATR-CTL-EXTENSION-SCREENING
+    title: Screening of loadable extensions before use
+    objective: >-
+      No skill, plugin, tool manifest or model artifact becomes available to the
+      agent without having been inspected for hostile content, and the operator
+      can tell afterwards which ruleset that inspection was performed under.
+    group: artifact-screening
+    assessment-requirements:
+      - id: ATR-CTL-EXTENSION-SCREENING-AR-1
+        text: >-
+          Every extension artifact MUST be scanned before it is registered as
+          available to the agent, and registration MUST fail closed when the
+          scan cannot complete or the ruleset version cannot be resolved.
+        applicability:
+          - pre-load
+        recommendation: >-
+          Failing closed is the part that is usually skipped. A scanner that is
+          unreachable and treated as a pass converts this control into a
+          formality without changing any observable behaviour.
+      - id: ATR-CTL-EXTENSION-SCREENING-AR-2
+        text: >-
+          A serialized model artifact MUST NOT be deserialized before its digest
+          has been checked against the digest recorded when it was screened.
+        applicability:
+          - pre-load
+        recommendation: >-
+          Deserialization is the execution boundary for this class of artifact,
+          so a check performed after loading has already lost.
+      - id: ATR-CTL-EXTENSION-SCREENING-AR-3
+        text: >-
+          The ruleset version in effect MUST be recorded with each screening
+          result and retained for as long as the artifact remains registered.
+        applicability:
+          - pre-load
+        recommendation: >-
+          A clean result is bounded by the rules that ran. Without the version,
+          a later question about coverage has no answer.
+    guidelines:
+      - reference-id: OWASP-ASI
+        entries:
+          - reference-id: ASI04:2026
+          - reference-id: ASI05:2026
+      - reference-id: MITRE-ATLAS
+        entries:
+          - reference-id: AML.T0010
+      - reference-id: ATR
+        entries:
+          - reference-id: skill-compromise
+          - reference-id: model-security
+        remarks: >-
+          The rule categories this control is implemented with; each id is a
+          category in the ATR category registry and a directory under rules/.
+    threats:
+      - reference-id: ATR-AI-AGENT-THREAT-CATALOG
+        entries:
+          - reference-id: ATR-THREAT-EXECUTION-ESCAPE
+          - reference-id: ATR-THREAT-UNAUTHORIZED-ACTION
+        remarks: >-
+          Screening covers both because a hostile extension can either execute
+          directly or steer the model into acting; the rules that detect each
+          differ, the moment of inspection does not.
+    state: Active
+  - id: ATR-CTL-INBOUND-CONTENT-SCREENING
+    title: Screening of untrusted content entering model context
+    objective: >-
+      Content reaching the model from a source the operator does not control is
+      inspected for embedded instructions before the agent acts on it, and a
+      detection carries enough provenance for a human to adjudicate it.
+    group: content-screening
+    assessment-requirements:
+      - id: ATR-CTL-INBOUND-CONTENT-SCREENING-AR-1
+        text: >-
+          Content retrieved from an external source MUST be inspected before it
+          enters the model context, and each detection MUST record the matching
+          rule id, the ruleset version, and the location of the match within the
+          content.
+        applicability:
+          - request-path
+        recommendation: >-
+          Recording the location is what makes a detection adjudicable. A rule
+          id alone tells a reviewer that something matched, not what.
+      - id: ATR-CTL-INBOUND-CONTENT-SCREENING-AR-2
+        text: >-
+          Content written into persistent memory or a retrieval corpus MUST be
+          inspected at write time as well as at read time.
+        applicability:
+          - request-path
+          - at-write
+        recommendation: >-
+          Write-time inspection is the only point at which the originating
+          request is still available to attribute a later action to.
+      - id: ATR-CTL-INBOUND-CONTENT-SCREENING-AR-3
+        text: >-
+          The deployment MUST record which rule maturity lane was in effect for
+          each inspection, and MUST NOT block on a lane the operator has not
+          accepted for blocking.
+        applicability:
+          - request-path
+        recommendation: >-
+          ATR publishes rules at differing maturity. Blocking on a lane intended
+          for triage converts a detection surface into an availability incident.
+    guidelines:
+      - reference-id: OWASP-ASI
+        entries:
+          - reference-id: ASI01:2026
+          - reference-id: ASI06:2026
+      - reference-id: MITRE-ATLAS
+        entries:
+          - reference-id: AML.T0051
+      - reference-id: ATR
+        entries:
+          - reference-id: prompt-injection
+          - reference-id: data-poisoning
+        remarks: >-
+          The rule categories this control is implemented with; each id is a
+          category in the ATR category registry and a directory under rules/.
+    threats:
+      - reference-id: ATR-AI-AGENT-THREAT-CATALOG
+        entries:
+          - reference-id: ATR-THREAT-UNAUTHORIZED-ACTION
+          - reference-id: ATR-THREAT-DELAYED-UNAUTHORIZED-ACTION
+    state: Active
+  - id: ATR-CTL-EGRESS-SCREENING
+    title: Screening of agent-initiated egress
+    objective: >-
+      Content the agent sends outside the trust boundary is inspected before it
+      leaves, so that a permitted call carrying context or credentials is
+      surfaced rather than passing on the strength of its destination.
+    group: content-screening
+    assessment-requirements:
+      - id: ATR-CTL-EGRESS-SCREENING-AR-1
+        text: >-
+          Outbound request content MUST be inspected before the request is
+          issued, not reconstructed from logs afterwards.
+        applicability:
+          - request-path
+        recommendation: >-
+          Post-hoc inspection can attribute a disclosure but cannot prevent it,
+          and for credentials the distinction is the whole control.
+      - id: ATR-CTL-EGRESS-SCREENING-AR-2
+        text: >-
+          Credential-bearing headers MUST be redacted before content is passed
+          to inspection, and a detection MUST NOT reproduce matched credential
+          material in its finding.
+        applicability:
+          - request-path
+        recommendation: >-
+          A detection surface that stores what it detected becomes a second copy
+          of the secret, in a system usually held to a lower standard.
+      - id: ATR-CTL-EGRESS-SCREENING-AR-3
+        text: >-
+          Where inspection cannot evaluate a request shape, the deployment MUST
+          record that the request was not evaluated rather than recording it as
+          clean.
+        applicability:
+          - request-path
+        recommendation: >-
+          Rules are written against an event vocabulary. Where a request does
+          not map onto it, "no finding" and "not looked at" are different facts
+          and only one of them is safe to aggregate.
+    guidelines:
+      - reference-id: MITRE-ATLAS
+        entries:
+          - reference-id: AML.T0057
+          - reference-id: AML.T0056
+      - reference-id: ATR
+        entries:
+          - reference-id: context-exfiltration
+        remarks: >-
+          The rule category this control is implemented with. No OWASP ASI entry
+          is cited: the modal reference on these rules is ASI01, which names the
+          injection that induces the disclosure rather than the disclosure
+          itself, so citing it here would overstate the fit.
+    threats:
+      - reference-id: ATR-AI-AGENT-THREAT-CATALOG
+        entries:
+          - reference-id: ATR-THREAT-CONTEXT-DISCLOSURE
+    state: Active
+  - id: ATR-CTL-AUTONOMY-BOUNDING
+    title: Bounding of unattended commitment
+    objective: >-
+      Consequential commitments made without a human decision point are detected
+      and bounded.
+    group: content-screening
+    assessment-requirements:
+      - id: ATR-CTL-AUTONOMY-BOUNDING-AR-1
+        text: >-
+          An action that commits funds, capacity or an external obligation MUST
+          require a recorded human decision, and the deployment MUST be able to
+          show which decision authorized a given commitment.
+        applicability:
+          - request-path
+        state: Draft
+        recommendation: >-
+          Held Draft because ATR cannot assess it. The rules under
+          rules/excessive-autonomy detect the shapes that precede an unbounded
+          commitment — loop continuation, scope expansion — but nothing in the
+          corpus observes whether an approval was obtained, because approval is
+          a property of the deployment's control flow rather than of any event
+          ATR inspects. Written out so the gap is visible, and Draft so no
+          evaluator treats it as assessable today.
+    threats:
+      - reference-id: ATR-AI-AGENT-THREAT-CATALOG
+        entries:
+          - reference-id: ATR-THREAT-UNBOUNDED-COMMITMENT
+    state: Draft
+  - id: ATR-CTL-ADAPTATION-DATA-SCREENING
+    title: Screening of model adaptation data
+    objective: Data used to adapt a model is inspected before it shapes behaviour.
+    group: pipeline-screening
+    assessment-requirements:
+      - id: ATR-CTL-ADAPTATION-DATA-SCREENING-AR-1
+        text: >-
+          Data used to adapt or fine-tune a model MUST be screened for
+          attacker-controlled content before it enters the training set.
+        applicability:
+          - data-pipeline
+        state: Draft
+        recommendation: >-
+          Held Draft because of a mismatch that is easy to state wrongly. ATR
+          does carry a rule for this — ATR-2026-00073, Malicious Fine-tuning
+          Data, which cites AML.T0020 Poison Training Data — but it binds a
+          runtime event field, user_input over an agent I/O source, rather than
+          a corpus at rest. A deployment could satisfy this requirement with a
+          pipeline scanner ATR had no part in, and ATR could pass a request
+          without the training set having been screened. Draft until rules exist
+          that run against a corpus rather than an event.
+    threats:
+      - reference-id: ATR-AI-AGENT-THREAT-CATALOG
+        entries:
+          - reference-id: ATR-THREAT-MODEL-BEHAVIOUR-COMPROMISE
+    state: Draft