There is a "Final rule" on this subject, posted in several place's, including here and here. The full text of the rule will appear in the Federal Register, but it is apparently not posted yet.
The posted text says:
The final rule clarifies that the definition of “machinegun” in the Gun Control Act (GCA) and National Firearms Act (NFA) includes bump-stock-type devices, i.e., devices that allow a semiautomatic firearm to shoot more than one shot with a single pull of the trigger by harnessing the recoil energy of the semiautomatic firearm to which it is affixed so that the trigger resets and continues firing without additional physical manipulation of the trigger by the shooter.
The rule will go into effect 90 days from the date of publication in the Federal Register.
Many federal laws authorize, and indeed require, various federal agencies to formulate and publish rules to implement those laws, often including formulating or updating the definitions of rele3vant terms. This seems to be such a case, but I have not found the specific provision of the law which authorized this specific rulemaking.
EDIT: As a comment mentions, a lawsuit has been filed against this rulemaking. A copy may be found here. This suit alleged procedural failures in the rule making process, particularly that the comment period was too short; that at first the web site incorrectly said that the comment period was closed, and would not take comments; and that no hearing was held. The suit further claims that the rule contradicts previous rulings on the same point by the same agency, thus harming people who were entitled to rely on the previous agency statements. It further claims that the rule is not based on objective evidence, and misstates the evidence. It further claims that the rule is beyond the agency's authorized powers, in that it would significantly change, not just interpret and clarify, the congressional intent as expressed in the statutes. It further claims that the rule would be invalid even if passed by Congress, in that it would deprive people of various Constitutional rights, and would create an ex post facto criminal law. The last point I think has no merit, as the rule would apply criminal penalties only to people who do not destroy or turn in "bump stocks" within a period after the rule is passed.
On the various other points asserted in this suit, I have no view with enough assurance to include it in an answer here. Procedural issues in a rulemaking can usually be cured by repeating the comment process, and sometimes courts do not find them significant. The congressional intent issue, if upheld by the courts, would require new action by congress to sustain the rule, And the Constitutional issues, if a court agrees with the suit, could not be cured even by congressional action. I have not seen any response brief to this suit, and I don't believe that there has been any ruling on it as yet. It will be interesting to see how the court rules, and if it is appealed.
In any case, the suit does not really change the basic answer to the original question. The ATF has been given the authority by various statutes to pass rules, following designated procedures, interpreting and implementing those statutes. Congress, by the way, can void such rules via a resolution of disapproval, if it so chooses. It rarely does this. Such rules have the force of law unless overturned by Congress or the courts. The US Supreme Court has held that such delegation of power by Congress is Constitutional. Such rules are subject to review on both procedural and substantive grounds, and may be overturned. But the agency's authority is derived from the laws passed by congress, and this is not an "end-run" around congress. it may be beyond the authorized powers, and a court will rule on that. Congress may choose to disapprove the rule, or may change the law in light of the rulemaking.