An example of an ATLAS Technique in practice is prompt injection, where an attacker manipulates model input to change behaviour or reveal restricted information. Defenders test for unsafe instruction following, validate user and system input separation, and monitor for unexpected tool calls, data leakage, or policy bypasses.
What an ATLAS technique example looks like in practice
Prompt injection is a practical example of an MITRE atlas technique. The attacker’s goal is not necessarily to break the model itself, but to steer model behaviour by feeding crafted input that overrides intended instructions, exposes restricted data, or triggers unsafe actions. In practice, the technique often shows up in chat, retrieval, or agent workflows where untrusted text can influence execution.
That makes the example useful because it is observable at the interaction layer: the model may follow hostile instructions, reveal hidden context, or call tools it should not have used. The same technique can be staged through documents, web content, or messages, so teams need to think about input provenance as well as prompt wording.
For a broader ATLAS reference point, the MITRE ATLAS adversarial AI threat matrix is the canonical place to map this kind of behaviour to AI/ML attack techniques and related red-team scenarios.
Why prompt injection is a useful ATLAS example
Prompt injection is easy to understand, but it captures several important attacker objectives at once: instruction hijacking, policy bypass, data leakage, and tool abuse. It is also a good illustration of how AI attacks can be indirect. The malicious payload may look like ordinary text, yet it changes what the model treats as authoritative.
In agentic or tool-using systems, the risk rises sharply when model output can trigger downstream actions. A successful injection can move from misleading text to unauthorized retrieval, unintended external requests, or unsafe automation. That is why the technique matters even when the model appears to answer “normally” at first glance.
MITRE’s broader adversary knowledge base remains useful here too, especially when defenders want to compare AI attack logic with established intrusion patterns. The MITRE ATT&CK Enterprise Matrix helps practitioners think about how initial manipulation can lead into execution, persistence, or data access patterns in adjacent systems.
How defenders test and harden against it
Defensive testing should focus on whether the system can distinguish trusted instructions from untrusted content and whether it resists hostile re-framing. Good tests include attempts to override system prompts, hide instructions inside retrieved text, and coerce the model into revealing context or calling tools outside policy.
Controls should be layered. Separate user input from system instructions, constrain tool permissions, validate retrieved content, and watch for signs of policy bypass, unusual data exfiltration, or unexpected external requests. If the model can act on behalf of a user or service, then the security question is no longer just “can it answer?” but “can it be steered into doing something it should not?”
Risk and Threat Considerations
Prompt injection is risky because it turns ordinary text channels into an attack surface. When the model treats untrusted content as instruction-like, an attacker can influence outputs, leak hidden context, or push the system toward unsafe tool use without needing conventional exploit code.
Failure mechanism: The model collapses the boundary between trusted instructions and attacker-controlled content, then propagates that influence into reasoning, retrieval, or tool invocation.
Impact: Organisations can face data exposure, policy bypass, incorrect decisions, and unintended actions in connected systems, especially where the model has delegated authority.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATLAS, MITRE ATT&CK and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST AI RMF sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATLAS | Adversarial AI Techniques | Prompt injection is an ATLAS technique used to manipulate model behaviour and trigger unsafe actions. |
| Recommendation — Map prompt injection to ATLAS techniques and test model boundaries with adversarial prompts. | ||
| MITRE ATT&CK | Adversary Tactics and Techniques | Tool abuse and downstream compromise patterns mirror established adversary technique mapping. |
| Recommendation — Trace how input manipulation can lead to execution, access, or exfiltration paths in adjacent systems. | ||
| NIST AI RMF | AI Risk Management Framework | Prompt injection is an AI trust and misuse risk that needs structured evaluation and controls. |
| Recommendation — Apply AI risk controls to separate trusted instructions from untrusted content and monitor abuse. | ||
| OWASP Agentic AI Top 10 | ASI01 — Agent Goal Hijack | Prompt injection can redirect an agent away from its intended objective. |
| ASI02 — Tool Misuse | Injected instructions can push agents into unauthorized or unsafe tool use. | |
| Recommendation — Test whether hostile input can divert the agent from its intended goal. Constrain tool access so injected prompts cannot trigger unsafe actions. | ||
Practitioner Guidance
What to verify: Test whether the system preserves instruction hierarchy under hostile input, especially across retrieval, summarisation, and tool-calling paths. If the model can be manipulated by content it did not originate, treat that as a control failure, not a harmless edge case.
Common mistake: Teams often focus on obvious jailbreak phrases and miss indirect injection through documents, search results, support tickets, or web content. The more autonomous the workflow, the more important it becomes to verify what the model is allowed to trust and act on.
Practitioner takeaway: The practical question is not whether the model can be persuaded, but whether persuasion can cross into unauthorized action, disclosure, or automation.