1title: ATR Rule Categories to AI Agent Capabilities
2metadata:
3 id: ATR-CAP-MAP-001
4 version: "0.1.0"
5 type: MappingDocument
6 gemara-version: "1.1.0"
7 description: >
8 Maps Agent Threat Rules (ATR) detection rule categories to the AI agent
9 capabilities that create the opportunity for each category of threat.
10 The source artifact is the ATR rule corpus, grouped by its nine detection
11 categories; the target artifact is the AI Agent Capability Catalog.
12 Relationships are expressed as relates-to following the convention that
13 external cross-references are refined by downstream consumers in their
14 applicability context.
15 author:
16 id: atr
17 name: Adam Lin
18 type: Human
19 contact:
20 name: Adam Lin
21 affiliation: Agent Threat Rules
22 email: adam@agentthreatrule.org
23 social: eeee2345
24 mapping-references:
25 - id: ATR
26 title: Agent Threat Rules
27 version: "0.1.0"
28 url: "https://github.com/Agent-Threat-Rule/agent-threat-rules"
29 description: >
30 Open MIT detection standard for AI agent threats. Rules are grouped
31 into detection categories under rules/; the reference-ids below are
32 those category identifiers.
33 - id: ATR-AI-AGENT-CAP
34 title: AI Agent Capability Catalog
35 version: "0.1.0"
36 description: >
37 Capabilities of AI agent systems that create the opportunity for the
38 threats ATR detects.
39
40source-reference:
41 reference-id: ATR
42 entry-type: Control
43target-reference:
44 reference-id: ATR-AI-AGENT-CAP
45 entry-type: Capability
46remarks: >
47 Each source entry-id is an ATR rule category. Targets are capability ids in
48 the AI Agent Capability Catalog. A category may relate to more than one
49 capability when its rules cover threats arising from several agent features.
50
51mappings:
52 - id: MAP-prompt-injection
53 source: prompt-injection
54 relationship: relates-to
55 targets:
56 - entry-id: CAP-MODEL-INFERENCE
57 strength: 9
58 confidence-level: High
59 rationale: >
60 Prompt injection and jailbreak rules detect attacker instructions
61 smuggled into the model context. They exist because the agent runs
62 inference over a context that mixes trusted instructions with
63 untrusted content.
64 - entry-id: CAP-MEMORY-READ
65 strength: 6
66 confidence-level: Medium
67 rationale: >
68 Indirect injection rules detect malicious instructions delivered
69 through retrieved content read back into context, which depends on
70 the agent reading external or remembered state.
71
72 - id: MAP-tool-poisoning
73 source: tool-poisoning
74 relationship: relates-to
75 targets:
76 - entry-id: CAP-TOOL-INVOCATION
77 strength: 8
78 confidence-level: High
79 rationale: >
80 Tool-poisoning rules detect injection and unsafe behaviour through
81 tool arguments and tool results, which is only reachable because the
82 agent invokes tools and feeds their output back into the model.
83 - entry-id: CAP-MCP-CONNECTION
84 strength: 9
85 confidence-level: High
86 rationale: >
87 A large share of tool-poisoning rules target MCP tool manifests,
88 schemas, and server name fields, and tool redefinition after
89 approval (rug-pull), which depend on the agent trusting
90 server-provided metadata at connection time.
91
92 - id: MAP-context-exfiltration
93 source: context-exfiltration
94 relationship: relates-to
95 targets:
96 - entry-id: CAP-OUTPUT-ACTION
97 strength: 8
98 confidence-level: High
99 rationale: >
100 Exfiltration rules detect secrets and sensitive context leaving
101 through model output and downstream actions, which requires the
102 agent to act on and emit model output.
103 - entry-id: CAP-TOOL-INVOCATION
104 strength: 7
105 confidence-level: Medium
106 rationale: >
107 Many exfiltration rules detect data carried out through tool calls
108 and tool responses, depending on the agent's tool invocation
109 capability.
110 - entry-id: CAP-MEMORY-READ
111 strength: 5
112 confidence-level: Medium
113 rationale: >
114 Staged exfiltration rules detect sensitive data pulled from context
115 and memory before being leaked, depending on the agent reading
116 stored state.
117
118 - id: MAP-agent-manipulation
119 source: agent-manipulation
120 relationship: relates-to
121 targets:
122 - entry-id: CAP-MODEL-INFERENCE
123 strength: 8
124 confidence-level: High
125 rationale: >
126 Manipulation rules detect authority claims, persona injection, and
127 goal drift that steer the agent's decisions through its inference
128 over untrusted content.
129 - entry-id: CAP-CROSS-AGENT-MESSAGING
130 strength: 6
131 confidence-level: Medium
132 rationale: >
133 Some manipulation rules detect influence delivered between agents,
134 which depends on the agent trusting peer-agent messages.
135
136 - id: MAP-privilege-escalation
137 source: privilege-escalation
138 relationship: relates-to
139 targets:
140 - entry-id: CAP-PRIVILEGED-EXECUTION
141 strength: 9
142 confidence-level: High
143 rationale: >
144 Privilege-escalation rules detect sandbox escape, stacked SQL DML
145 abuse, and delayed-execution bypass, which are reachable only
146 because the agent runs with standing, delegated privilege.
147
148 - id: MAP-excessive-autonomy
149 source: excessive-autonomy
150 relationship: relates-to
151 targets:
152 - entry-id: CAP-AUTONOMOUS-ACTION
153 strength: 9
154 confidence-level: High
155 rationale: >
156 Excessive-autonomy rules detect runaway tool-call loops, SSRF via
157 autonomous fetches, and unauthorized orchestration, which depend on
158 the agent acting across steps without per-step approval.
159
160 - id: MAP-data-poisoning
161 source: data-poisoning
162 relationship: relates-to
163 targets:
164 - entry-id: CAP-MEMORY-WRITE
165 strength: 9
166 confidence-level: High
167 rationale: >
168 Data-poisoning rules detect persistent memory plants and poisoned
169 stored facts, which depend on the agent writing attacker-influenced
170 content into durable memory or state.
171 - entry-id: CAP-MEMORY-READ
172 strength: 6
173 confidence-level: Medium
174 rationale: >
175 Poisoned data causes harm when it is read back into a later turn,
176 depending on the agent's context and memory read capability.
177
178 - id: MAP-model-abuse
179 source: model-abuse
180 relationship: relates-to
181 targets:
182 - entry-id: CAP-MODEL-INFERENCE
183 strength: 7
184 confidence-level: Medium
185 rationale: >
186 Model-abuse rules detect attempts to misuse the model to produce
187 harmful or fraudulent output, which arises from the agent running
188 inference and treating the result as a deliverable.
189 - entry-id: CAP-OUTPUT-ACTION
190 strength: 6
191 confidence-level: Medium
192 rationale: >
193 Harm in this category lands through the produced and delivered
194 output, depending on the agent acting on model output.
195
196 - id: MAP-skill-compromise
197 source: skill-compromise
198 relationship: relates-to
199 targets:
200 - entry-id: CAP-SKILL-LOADING
201 strength: 9
202 confidence-level: High
203 rationale: >
204 Skill-compromise rules detect backdoored, impersonated, and
205 over-privileged skills, which can only execute because the agent
206 loads and runs third-party skills and plugins with its own
207 privileges.