Agent-Threat-Rule/agent-threat-rules — Open detection standard -- like Sigma, but for AI agents.

Description and use

Agent‑Threat‑Rules provides an open, community‑driven detection standard for AI‑driven threats—essentially a “Sigma” for AI agents. It currently includes 311 vetted rule sets, integrates with Cisco AI Defense, and has demonstrated a 97.1 % recall rate against Garak‑generated adversarial scenarios. The project targets AI/ML security practitioners looking for a structured, interoperable way to identify malicious or unsafe agent behavior.

Problem

Agent-Threat-Rule/agent-threat-rules helps connect AI assistants to real tools and data through a standard protocol.

Outcome

Early or unclear: treat as research material until maintenance, releases, docs, and issue activity are verified.

Workflow

• connect AI agents to tools
• ship Model Context Protocol servers
• standardize integrations

Evidence

Open detection standard -- like Sigma, but for AI agents. 311 rules, Cisco AI Defense, 97.1% garak recall.

Source