About OATF Scenarios

What is this site?

This is the OATF Scenario Registry - an interactive companion to the Open Agent Threat Format (OATF) specification. It provides a browsable, searchable collection of security threat scenarios targeting the emerging ecosystem of AI agent communication protocols.

What is OATF?

The Open Agent Threat Format is a structured YAML-based format for describing attack scenarios against AI agents. Each scenario defines the protocol surface being targeted, the execution steps an attacker would follow, detection indicators, and mappings to established frameworks like MITRE ATT&CK, MITRE ATLAS, and OWASP Top 10 for LLMs.

The full specification is maintained at oatf.io.

Supported protocols

Scenarios in this registry cover three major AI agent protocols:

Site features

• Registry - Browse all scenarios with filtering by protocol, severity, and attack category. Full-text search across names, descriptions, and tags.
• Editor - Create and validate new OATF scenarios with a live YAML editor and instant preview.
• Coverage Matrix - View how scenarios map to MITRE ATT&CK techniques, ATLAS ML threats, and OWASP LLM risks.
• Scenario Detail - Each scenario page includes a structured attack timeline, protocol-level message flow diagrams, detection indicators with regex patterns, and framework mappings.

Confidence scoring

Each scenario carries a confidence score (0-100) representing how confident the author is in the assigned severity level, following the STIX confidence scale. A high-severity attack with confidence 30 means the author believes it could be high severity but has limited evidence. A high-severity attack with confidence 90 means the assessment is well-supported. Defaults to 50 (neutral) when omitted.

Note: The 0 floor on real-world observation means a scenario can score up to 80/100 with zero real-world exploitation. This is by design -- novel protocol-level attacks that haven't been weaponised yet can still carry high confidence if the impact evidence and reproducibility are strong. A high confidence score should not be interpreted as implying confirmed malicious use in the wild.

For the full contributor-facing rubric with worked examples, see CONTRIBUTING.md.

Who is this for?

• Security engineers building or auditing AI agent integrations
• Protocol implementors designing defenses for MCP, A2A, or AG-UI
• Red teams evaluating the attack surface of agentic AI systems
• Researchers studying prompt injection, tool poisoning, and agent-to-agent threats

Contributing

Scenarios are maintained in the oatf-spec/scenarios GitHub repository. Contributions of new scenarios, improvements to existing ones, and framework mapping additions are welcome via pull requests.