ATLAS AML.T0107: Exploitation for Defense Evasion

Every AI deployment leans on security features that sit around the model, such as approval prompts, sandboxes, localhost restrictions, link redaction and injection classifiers, and a bug in any one of them can switch it off silently. MITRE ATLAS lists AML.T0107 Exploitation for Defense Evasion under the Defense Evasion tactic (AML.TA0007), rated demonstrated and mirrored from ATT&CK T1211, which ATT&CK v20 now names Exploitation for Stealth. ATLAS describes it as exploiting a system or application vulnerability to bypass security features, including flaws in defensive software itself. This guide covers only the AI angle: which AI-layer defences are exposed, the documented case, how to tell this technique from model evasion, and the engineering controls that keep a single flaw from removing a defence. For the general technique, read the MITRE ATT&CK T1211 Exploitation for Stealth guide first. It is written for AI platform engineers, application security teams and red teams.

Key takeaways

A guardrail is software and has bugs. AML.T0107 is about programming errors in the defences, not clever prompts that fool a classifier.
The documented case bypassed a network restriction. In AML.CS0050 a cross-site WebSocket hijack carried an attacker past the localhost restriction protecting an agent gateway.
Defences that one token can turn off are one flaw deep. Once inside, the attacker disabled execution approvals and the sandbox through the same API.
Chained filter gaps add up. EchoLeak showed that an injection classifier, link redaction and a content security policy can each be passed in turn.
Defence in depth must be independent. Layers that share one process, one token or one trust assumption fail together.

Exploitation versus evasion: where the line sits

ATLAS separates two ideas that are easy to blur in AI work. Crafting input so that a model or classifier misjudges it is model evasion and prompt manipulation, covered by techniques such as AML.T0015 Evade AI Model, AML.T0054 LLM Jailbreak and MITRE ATLAS AML.T0068 LLM Prompt Obfuscation. AML.T0107 is the case where a programming error in the security feature, or in the software around it, lets the adversary bypass it. The distinction matters because the fixes differ: evasion is reduced by better models, tuning and layering; exploitation is fixed by patching, secure design and testing like any other software defect.

AI-layer defence	What it protects	Flaw classes that can bypass it	Closest neighbouring technique if no software flaw
Localhost or network restriction on an agent gateway	Only local, trusted clients can drive the agent	Missing WebSocket Origin validation, DNS rebinding, request forgery	AML.T0049 if the service is simply exposed
Human approval prompts for agent actions	A person confirms risky commands	Approval settings changeable through an over-privileged API, client-side only enforcement	AML.T0081 Modify AI Agent Configuration
Agent sandbox	Commands run isolated from the host	Sandbox toggled by configuration, container escape bugs	AML.T0105 Escape to Host
Output link and image redaction	Responses cannot carry data to outside addresses	Parser gaps for alternative markup forms	AML.T0077 LLM Response Rendering
Content security policy and domain allowlists	Rendered content only loads from trusted hosts	Allowed services that fetch arbitrary URLs on request	AML.T0077 LLM Response Rendering
Prompt injection and jailbreak classifiers	Hostile instructions are flagged before the model sees them	Input handling bugs such as segments not scanned, fail-open on errors, unscanned input fields	AML.T0015, AML.T0054, AML.T0068

The documented case: a localhost restriction bypassed (AML.CS0050)

ATLAS case study AML.CS0050 maps AML.T0107 to step S04. After a victim clicked a crafted link, script in the victim's browser performed cross-site WebSocket hijacking to bypass localhost network restrictions, opening a new WebSocket connection to the OpenClaw Gateway server on localhost. The researcher's write-up explains why that worked: the gateway's WebSocket server did not validate the Origin header, and browsers do not apply the same-origin policy to WebSocket connections, so any website could reach a gateway listening only on the victim's machine. The project fixed the related token leak in v2026.1.29 (advisory GHSA-g8p2-7wf7-98mq).

What followed shows why this technique sits in Defense Evasion. ATLAS records that the script, now authenticated with a stolen gateway token, disabled the feature that asks the user before running potentially dangerous commands and then disabled sandboxing so commands ran on the host. Those steps are mapped to AML.T0081 Modify AI Agent Configuration and AML.T0105 Escape to Host. The defences were not broken individually; they were all reachable through one interface that a single flaw opened.

Filter and guardrail flaws in practice

EchoLeak, the Microsoft 365 Copilot vulnerability disclosed in June 2025, is the clearest public example of chained bypasses of AI-layer defences, although ATLAS has not mapped it to AML.T0107. As summarised on the EchoLeak 2025 page, the attacker's email was worded to avoid the cross-prompt injection classifier, reference-style links and images survived link redaction, and trusted Microsoft services permitted by the content security policy fetched an attacker-controlled address. Microsoft fixed it server-side and reported no evidence of exploitation. The classifier step is evasion; the redaction and policy steps are gaps in how the defences handled valid but unexpected input, which is where engineering fixes apply.

Published research shows how fragile classifier guardrails are on their own. Hackett and colleagues tested six prompt injection and jailbreak protection systems, including Azure Prompt Shield and Meta Prompt Guard, and reported up to 100% evasion success in some instances using character injection and adversarial machine learning methods. The vendors say the same in their documentation: Meta's Prompt Guard model card states it is not robust to adaptive attacks and recommends layering, and Microsoft's Prompt Shields documentation states that a negative result is not a guarantee and that the standalone API leaves blocking to the application. That last point is an exploitation risk in its own right: if the integrating code fails open, ignores a field or skips documents beyond a size limit, the defence is bypassed by a bug, not by a clever prompt. Prompt Guard's 512-token context window, for example, means long inputs must be split and every segment scanned.

What to detect and where

Signal	Data source	Why it matters
WebSocket upgrades to agent services with an unexpected Origin	Gateway access logs with Origin recorded	Cross-site hijacking of a local service
Approval, sandbox or tool-permission settings changed outside an admin change window or by a task token	Agent configuration audit trail	Defences being switched off after access
Guardrail service errors, timeouts or skipped inputs while model calls continue	AI gateway and guardrail logs	Fail-open behaviour that bypasses the classifier
Model output containing markup forms the redaction layer is not designed to handle	Output logs before rendering	Redaction parser gaps
Rendered responses triggering fetches through allowlisted proxy or preview services	Browser telemetry, proxy logs	Allowlist abuse to move data out
Agent commands executed on the host by an agent configured for sandboxed execution	EDR, process telemetry	Sandbox disabled or escaped

Metrics that show the defences hold:

Percentage of guardrail integrations tested to fail closed when the guardrail errors or times out.
Percentage of input channels (user, documents, tool results) that pass through injection detection, against those that exist.
Number of agent deployments where approval and sandbox settings can be changed by the task token, trending to zero.
Days from an advisory for an AI security component or agent platform to deployment of the fix.
Bypasses found per red-team cycle against each AI-layer defence, and time to fix.

Mitigations and engineering controls

As of ATLAS release 2026.10, ATLAS maps AML.M0016 Vulnerability Scanning, which reduces opportunities to exploit weaknesses that bypass security controls, and AML.M0042 Threat Intelligence Program, which tracks adversary use of exploits including zero-days to prioritise remediation and update detection. For AI-layer defences, NHI Mgmt Group recommends the controls below to make those mitigations concrete. The AI Guardrails and AI Firewalls Guide covers guardrail selection and placement; this list covers keeping them from being bypassed.

Enforce server-side and out of band: approval and sandbox policy should be enforced by a component the agent and its task token cannot reconfigure. Put admin settings behind a separate identity with step-up authentication.
Validate WebSocket Origin and authenticate local services: OWASP recommends an explicit origin allowlist on every handshake and authentication before any protected action.
Fail closed: if a classifier, policy engine or redaction step errors, times out or receives input it cannot parse, block or escalate rather than pass the request through.
Scan every channel and every segment: user prompts, retrieved documents and tool results, split to the classifier's context limit. Microsoft's documentation notes document detection is off by default in Foundry and must be enabled.
Sanitise output with an allowlist parser: render only the markup the application needs and strip the rest, rather than removing known-bad forms.
Narrow allowlists to destinations, not domains: an allowed host that will fetch any URL on request is an open door. See the Content Security Policy Guide.
Patch defensive components like products: guardrail libraries, AI gateways and agent platforms belong in the vulnerability programme. See the AI Gateway and LLM Gateway Guide.

How to test

List every AI-layer defence for each application or agent, with where it runs and what can reconfigure it.
Fault-inject the guardrails. In a test environment, make each classifier and policy engine time out or return errors and confirm requests are blocked, not passed.
Test unusual but valid input. Oversized documents, alternative markup forms, unscanned fields and tool results, checking that each is inspected or rejected.
Test from a hostile page. Confirm a website in the user's browser cannot open connections to local agent services.
Test privilege separation. Using only a task token, try to change approval or sandbox settings; the attempt must fail and alert. Record findings in the AI Red Team Test Plan Template.
Roll out fixes behind monitoring. Switch new fail-closed behaviour on in log-only mode first where availability is critical, review what would have been blocked, then enforce.

Common failure patterns

Counting layers that share one switch. Approvals and sandbox both configurable through the same token count as one defence.
Fail-open integrations. Guardrail timeouts quietly letting traffic through to protect latency.
Scanning the user prompt only. Documents and tool outputs, where indirect injection arrives, left unchecked.
Denylist redaction. Removing known link forms and missing the next valid one, as EchoLeak showed.
Trusting localhost. Local agent services assumed safe from the browser.

Framework mapping

Framework	Reference	Relevance
MITRE ATLAS tactic	AML.TA0007 Defense Evasion	Tactic for AML.T0107
MITRE ATLAS mitigations	AML.M0016 Vulnerability Scanning, AML.M0042 Threat Intelligence Program	Mapped by ATLAS 2026.10
MITRE ATLAS case study	AML.CS0050 OpenClaw 1-Click Remote Code Execution	Step S04, localhost restriction bypass
MITRE ATLAS related techniques	AML.T0015, AML.T0054, AML.T0068, AML.T0077, AML.T0081, AML.T0105	Evasion without a software flaw, and the follow-on steps
MITRE ATT&CK	T1211 Exploitation for Stealth	The enterprise technique ATLAS mirrors (renamed in ATT&CK v20)
OWASP Top 10 for LLM Applications 2025	LLM01:2025 Prompt Injection; LLM05:2025 Improper Output Handling; LLM06:2025 Excessive Agency	Classifier bypass, redaction gaps and over-privileged agent settings

Practitioner checklist

Inventory AI-layer defences per application and what can change each one.
Enforce approval and sandbox policy outside the agent's own token.
Validate WebSocket Origin and authenticate every local agent service.
Confirm every guardrail integration fails closed.
Scan user prompts, documents and tool results, every segment.
Use allowlist output sanitisation and destination-level allowlists.
Track advisories for guardrail libraries, gateways and agent platforms.
Red team the defences themselves each release cycle.

AML.T0107 Exploitation for Defense Evasion: Keeping AI Guardrails and Approvals From Being Bypassed