ATLAS AML.T0115: Publish Poisoned AI Artifacts

Attackers do not need to break into your AI pipeline if you will download their poisoned dataset, model or agent tool for them. MITRE ATLAS AML.T0115 Publish Poisoned AI Artifacts describes adversaries creating or modifying datasets, models and AI agent tools and publishing them through public or shared channels, so that victims later pull them in through Supply Chain Compromise (AML.T0010). ATLAS added the technique on 31 July 2026, places it in the Resource Development tactic (AML.TA0003) and rates it realised. This guide explains the three sub-techniques, the real cases behind them, and the intake, scanning and pinning controls that stop a poisoned artifact before it reaches training, inference or an agent. It is for ML platform engineers, application security teams and anyone who approves models, datasets, MCP servers or agent skills. For the full model-loading and file-format detail, see the Model Supply Chain Guide; this page stays on the publishing technique and the intake gate.

Key takeaways

One technique, three artifact types. ATLAS splits AML.T0115 into Datasets (.000), Models (.001) and AI Agent Tools (.002); each reaches victims through a different hub and needs a different intake check.
The publishing step happens outside your estate. You cannot detect the upload, so the control point is the moment an artifact crosses into your registry, notebook, pipeline or agent configuration.
Scanners help and miss things. Models built to break Picklescan, poisoned GGUF chat templates and skill instructions that look like documentation have all slipped past platform checks in documented cases.
Names are not identities. Reclaimed Hugging Face namespaces, lookalike npm packages and copied skills show that trusting a name or a download count is how most victims were caught.
Pin, mirror and verify. Pinning to a commit or hash, mirroring approved artifacts into internal storage and checking signatures turns a public upload into a reviewed change.

What the technique covers

ATLAS describes AML.T0115 as adversaries creating or modifying AI artifacts and publishing them through public or shared distribution channels to facilitate compromise of downstream AI systems. The artifacts may contain malicious content, behaviours, code or configuration, and may be new or malicious variants of legitimate artifacts. Channels named by ATLAS include dataset and model repositories, package registries, source code repositories, tool hubs and remotely hosted services. Earlier ATLAS releases listed this behaviour as three separate techniques (AML.T0019 Publish Poisoned Datasets, AML.T0058 Publish Poisoned Models and AML.T0104 Publish Poisoned AI Agent Tool); since the July 2026 release (2026.07) ATLAS presents them as sub-techniques of AML.T0115, so update any detection rules or risk registers that still cite the old IDs.

Sub-technique	What is published	Typical channel	ATLAS maturity	What happens downstream
AML.T0115.000 Datasets	New or modified datasets with manipulated samples, labels, annotations or metadata	Dataset repositories, code repositories, file-sharing services, compromised data sources	Demonstrated	Training Data Poisoning (AML.T0020) via AML.T0010.002 Data Repository
AML.T0115.001 Models	Models with manipulated weights, configuration, architecture or serialised code	Model registries, code repositories, other model distribution channels	Realised	Code execution at load time or backdoored behaviour via AML.T0010.003 Model Repository
AML.T0115.002 AI Agent Tools	Tools with malicious model-visible definitions, hidden executable behaviour or manipulative runtime responses	GitHub and GitLab, npm, agent tool and skill registries, adversary-run remote servers	Realised	Agent manipulation or code execution when the tool is selected, installed or invoked

AML.T0115 sits next to two related techniques. MITRE ATLAS AML.T0111 AI Supply Chain Reputation Inflation covers inflating stars, downloads and reviews so the poisoned artifact gets chosen, and MITRE ATLAS AML.T0109 AI Supply Chain Rug Pull covers publishing something clean first and poisoning a later version. Once a poisoned tool is installed, its effect on the agent is covered in AML.T0110 AI Agent Tool Poisoning. In ATT&CK terms the publishing step mirrors T1608.001 Upload Malware under Stage Capabilities, and the victim side mirrors T1195.001 and T1195.002; see the MITRE ATT&CK T1195 Supply Chain Compromise page for the general software supply chain view.

How it shows up in real cases

ATLAS links nine case studies to AML.T0115 sub-techniques. The ones below show the main ways a poisoned artifact gets past a reasonable team.

Case (ATLAS ID)	Sub-technique	What made it work	Control that would have caught it
Malicious Models on Hugging Face (AML.CS0031)	.001 Models	ReversingLabs found PyTorch files packed with 7z instead of ZIP and pickle streams deliberately broken after the payload, so Picklescan errored without flagging the dangerous calls that ran first	Refuse pickle formats at intake; treat scanner errors as a block, not a pass
Model Namespace Reuse (AML.CS0065)	.001 Models	Unit 42 re-registered deleted Hugging Face author names and republished models under the old Author/ModelName path; catalogs and code that loaded by name pulled the replacement	Pin to a commit revision; mirror approved models internally; search code for bare model names
Poisoned GGUF Templates (AML.CS0064)	.001 Models	Pillar Security showed a chat template inside a GGUF file carrying hidden, trigger-based instructions with the weights untouched; the Hub interface showed only the first file's template	Extract and diff the template in every quantised variant; allowlist approved templates
PoisonGPT (AML.CS0019)	.001 Models	Mithril Security edited an open-source LLM to return a false fact and uploaded it back to Hugging Face, where users could have downloaded it	Verify publisher identity; run targeted behavioural evaluation before approval
Split-View Attack (AML.CS0025)	.000 Datasets	Web-scale datasets distributed as URL lists pointed at expired, purchasable domains, so content could be replaced between curation and download	Store and verify content hashes for every sample; snapshot data internally
Postmark MCP Server (AML.CS0053)	.002 AI Agent Tools	An unofficial npm package published 15 working versions, then 1.0.16 blind-copied every email to the attacker	Install tools only from the service owner's source; pin and review diffs
Poisoned ClawdBot Skill (AML.CS0049)	.002 AI Agent Tools	A researcher's proof-of-concept skill on ClawdHub carried a prompt injection that made the agent run a shell command; 16 users ran it in the first 8 hours	Review skill instructions and setup steps before install; restrict who can add skills
Remote Poisoned MCP Tool (AML.CS0054)	.002 AI Agent Tools	Invariant Labs showed hidden instructions in a remote MCP tool description making the agent read credential files and pass them to the tool	Hash and review tool descriptions; alert on change

The same pattern played out at scale on ClawHub in early 2026: Koi Security audited 2,857 skills and found 341 malicious, most of them in one campaign whose "Prerequisites" sections told the user or agent to fetch and run a credential stealer. See the ClawHub Malicious Skills 2026 breach page. For the email theft case, see the postmark-mcp Malicious MCP Server 2025 breach page.

Where to put the intake gate

Because the publishing step is invisible to you, every control for AML.T0115 lives at intake: the point where an external artifact first enters something you run. Most organisations have more of these doors than they think.

Notebooks and training jobs: calls such as from_pretrained() or load_dataset() with a hub name pull directly from the internet. Route them through a proxy or internal mirror and block direct hub egress from training and inference hosts.
Model catalogs in cloud AI platforms: Unit 42 showed that catalogs which import hub models can carry a reclaimed namespace into a one-click deployment. Treat catalog models as external until verified.
Local model runners: GGUF files loaded into desktop runners execute their chat templates on every prompt. Developer laptops are an intake door too.
Agent tool configuration: MCP server entries launched with package runners that fetch the latest version at start-up, remote MCP URLs and skill folders are all intake. See the Agent Skills Security Guide and the MCP Server Trust Assessment.
Retrieval and fine-tuning data: datasets pulled for fine-tuning or indexing into retrieval stores are AML.T0115.000 targets, with impact through training poisoning or retrieved content.

Intake checks by artifact type

Check	Datasets	Models	Agent tools
Publisher identity	Organisation verified on the hub; source matches the paper or project page	Organisation verified; namespace not recently re-created; matches the vendor's own model card links	Published by the service owner or a named maintainer; package name matches the vendor's documentation
Pinning	Dataset revision or commit; per-file content hashes	Commit revision, never a branch name	Exact version or lockfile hash; remote server URL and tool definition hash recorded
Static inspection	Label distribution, duplicates, outliers, embedded URLs and scripts	Format check (prefer safetensors); pickle opcode and import inspection; chat template extraction and diff	Read tool descriptions, skill instructions and setup steps; flag shell commands, downloads and credential paths
Behavioural testing	Train a small reference model and compare against a clean baseline	Load in an isolated sandbox with no network; run targeted evaluations and trigger probes	Run in a sandbox with egress logging; watch file, network and credential access
Provenance record	AI-BOM entry with source, revision and hash	AI-BOM entry; signature verified where the publisher signs	Inventory entry with owner, version, scopes granted

Two practical points. First, Hugging Face documents that its Hub runs ClamAV and a pickle import scan on uploads but states that the import lists are best effort and users remain responsible for checking files, so a hub badge is a signal, not an approval. Second, signing proves origin, not safety: the OpenSSF model signing project (model_signing) lets a publisher sign a model with Sigstore, keys or certificates and lets you verify file hashes against the signature, which defeats tampering and namespace swaps but not a malicious publisher. See the AI Model Provenance and Watermarking Guide.

Choosing how strict to be

Situation	Recommended gate	Trade-off
Small team, a handful of approved models, no fine-tuning	Allowlist of pinned models in safetensors; block pickle; tool installs only from vendor sources	Slower to try new models; minimal tooling cost
Data science teams experimenting widely	Free use in an isolated research enclave with no production credentials; promotion to production only through the full intake pipeline	Two environments to run; experimentation stays fast
Production inference and agent platforms	Internal mirror only, signature or hash verification at deploy, behavioural tests, AI-BOM, change approval for any version bump	Highest assurance; needs an owner for the mirror and review queue
Developer laptops running coding agents and local models	Managed MCP and skill allowlist, inventory of local configs, egress controls	Some friction for developers; see How to audit MCP servers on developer laptops

How to implement

Find every intake door. Search code, notebooks and infrastructure templates for hub loader calls, model names, dataset names, MCP server entries and skill directories. Unit 42 notes that reclaimable names also hide in default arguments, docstrings and comments, so search those too.
Start in report-only mode. Put a proxy or mirror in front of the hubs and package registries and log every pull for two to four weeks. This gives you the real list of artifacts in use without breaking anyone.
Pin what you already use. Replace branch and "latest" references with commit revisions and exact versions. Record each in the AI-BOM with its hash. See the AI Supply Chain and AI-BOM Guide.
Turn on blocking in rings. Block pickle-format models and unpinned pulls first in production inference, then training, then research. Keep a documented exception path with an expiry date.
Add behavioural tests. For models, a sandboxed load with network denied plus targeted evaluations; for tools, a sandbox run with egress and file access logged.
Re-verify on every change. Any new revision or version re-enters the same gate. This also covers AML.T0109 rug pulls.
Roll back cleanly. Because everything is pinned and mirrored, rollback is a pointer change to the previous approved revision. Keep the last two approved versions in the mirror.

Where identity fits

A poisoned agent tool acts with whatever credentials you give it, so the blast radius of AML.T0115.002 is set by the tool's tokens, not the attacker's skill. Give each MCP server and skill its own narrowly scoped credential, store it in a secrets manager rather than a config file, and know how to revoke it in minutes. On the publishing side, hub write tokens are the keys to your own artifacts: a leaked token lets an attacker publish a poisoned version under your trusted name. See the Hugging Face Security Guide for token scoping on the Hub.

Detection and measurement

Proxy and mirror logs: pulls that bypass the mirror, pulls of unpinned names, and pulls of artifacts not in the AI-BOM.
Sandbox telemetry: process creation, outbound connections or file reads during model load, which a weights-only load should never do.
Tool definition changes: a changed hash on any MCP tool description or skill file since approval. See MCP Tool Poisoning Detection.
Endpoint signals on developer machines: package runners fetching new MCP server versions, and new skill folders appearing.

Metrics that show the gate is working:

Percentage of model, dataset and tool references pinned to a commit, version or hash (target 100% in production).
Percentage of production model files in a non-executable format such as safetensors.
Number of direct hub pulls from production networks per month (target zero).
Median time from a new artifact request to approval or rejection.
Percentage of agent tools with an owner, a scoped credential and a recorded definition hash.

Framework mapping

Framework	Reference	Relevance
MITRE ATLAS mitigation	AML.M0007 Sanitize Training Data	Mapped by ATLAS to AML.T0115 and .000
MITRE ATLAS mitigation	AML.M0008 Validate AI Model	Mapped by ATLAS 2026.10 to .001
MITRE ATLAS mitigation	AML.M0042 Threat Intelligence Program	Mapped by ATLAS 2026.10 to AML.T0115, .000, .001 and .002
MITRE ATLAS mitigation	AML.M0016 Vulnerability Scanning	Mapped by ATLAS to AML.T0115, .001 and .002; ATLAS notes scanners should handle models that cannot be fully deserialised
MITRE ATLAS mitigation (supporting)	AML.M0014 Verify AI Artifacts, AML.M0013 Code Signing, AML.M0023 Maintain an AI Bill of Materials	Practical intake controls for hashes, signatures and inventory
MITRE ATLAS technique	AML.T0010 Supply Chain Compromise (.002 Data Repository, .003 Model Repository)	The victim-side step that follows publication
MITRE ATT&CK	T1608.001 Upload Malware; T1195.001, T1195.002	General staging and software supply chain equivalents
OWASP Top 10 for LLM Applications 2025	LLM03:2025 Supply Chain	Third-party models, datasets and plugins
OWASP Top 10 for Agentic Applications	ASI04 Agentic Supply Chain Vulnerabilities	Tools, MCP servers and skills; see the OWASP Agentic Top 10 ASI04 Guide

Common failure patterns

Trusting the hub's scan as approval. The CS0031 models were built to break Picklescan; Hugging Face changed the scanner afterwards, but a different malformed file may still pass. Block the format instead of relying on detection.
Loading by name. A bare Author/ModelName reference follows whoever owns that name today, which is exactly what namespace reuse exploits.
Reviewing weights but not templates or configs. A GGUF chat template or a custom loader file can carry the malicious behaviour while the weights are clean.
Treating a skill or MCP server as documentation. Installation steps that download and run something are code, whoever runs them. The ClawHub campaign relied on this.
Installing the first package that matches the vendor's name. The postmark-mcp package was not published by Postmark. Check the vendor's own docs for the official tool.
Research enclaves with production credentials. Free experimentation is fine only when a poisoned artifact there cannot reach production secrets.

Practitioner checklist

Inventory every place your organisation pulls models, datasets, MCP servers and skills from public sources.
Route all pulls through an internal mirror or proxy and block direct hub egress from production.
Pin every model and dataset to a commit revision and every tool to an exact version or hash.
Block pickle-format models in production; prefer safetensors and treat scanner errors as failures.
Extract and review GGUF chat templates and any custom loader code before approval.
Read every tool description, skill instruction and setup step; reject anything that downloads and runs code.
Run new artifacts in a network-isolated sandbox and log process, file and network activity.
Give each agent tool its own scoped, revocable credential held in a secrets manager.
Record every approved artifact in an AI-BOM with source, revision, hash and owner.
Update risk registers and detections that still cite AML.T0019, AML.T0058 or AML.T0104.

AML.T0115 Publish Poisoned AI Artifacts: Spotting Poisoned Datasets, Models and Tools Before Intake