ATLAS AML.T0145: Poison AI Agent Learning Environment

If an agent learns from what it experiences, anyone who can shape that experience can shape the agent, without ever touching a dataset or a model file. MITRE ATLAS added this as AML.T0145 Poison AI Agent Learning Environment in release 2026.10 (28 October 2026), under the Persistence tactic (AML.TA0006), for the Agentic AI platform, rated Feasible. The adversary manipulates webpages, tool or API responses, rewards or evaluator outputs that an agent meets, so that the resulting interactions are folded into fine-tuning, reinforcement learning, synthetic corpora or agent memory. This page covers how the technique works, the research behind it, and the controls ATLAS maps to it. It is for teams that fine-tune or continuously improve agents from their own trajectories, ML platform owners and AI red teams.

Key takeaways

The attacker poisons the process that produces training data, not the data store. ATLAS says the technique targets how learning experience is generated or selected, without direct access to datasets, parameters or stored agent artefacts.
Poisoned experience looks legitimate. It was produced by an authorised agent working through an expected interface, so source-based trust does not catch it.
The effect outlives the bait. Once learned, the behaviour can persist after the manipulated content is removed, and may wait for a trigger.
Off-the-shelf guardrails missed it in research. In the Malice in Agentland study, data-screening guardrails caught few poisoned trajectories and runtime guardrails did not meaningfully reduce attack success.
Six ATLAS mitigations apply. Sanitise and trace learning data, validate models after every learning cycle, check actions at runtime, re-check alignment, and red team the learning environment itself.

What the technique covers

ATLAS lists the environmental content an adversary may alter: webpages, tool or API responses, elements in simulated environments, task descriptions, reward signals, evaluator outputs, and other content used during agent learning or adaptation. The manipulated interactions may then be incorporated into model fine-tuning, reinforcement learning, synthetic training corpora, agent memories or other persistent components.

The goals ATLAS names are to introduce backdoors, increase compliance with malicious instructions, distort policies or preferences, teach unsafe tool use, or manipulate reward-seeking behaviour. The malicious behaviour may be activated later by an environmental trigger, or appear during ordinary operation.

It helps to place AML.T0145 against the poisoning techniques it borders:

Technique	Where the adversary acts	When the effect appears
AML.T0020 Training Data Poisoning	The training dataset itself	After training on that data
AML.T0080 AI Agent Context Poisoning	The agent's context or memory at run time	While the poisoned context is present or stored
AML.T0099 AI Agent Tool Data Poisoning	Data returned by tools the agent calls	When the agent consumes that data
AML.T0145 Poison AI Agent Learning Environment	The environment the agent learns from (pages, tools, rewards, evaluators)	After the interactions are learned, and possibly long after the bait is gone

The tool-poisoning and context-poisoning techniques often provide the bait; AML.T0145 is what turns a one-off manipulation into learned behaviour. See AML.T0099 AI Agent Tool Data Poisoning and MITRE ATLAS AML.T0080 AI Agent Context Poisoning.

How it has been demonstrated

ATLAS cites one source for this technique and, as of November 2026, lists no case study, so the evidence is research rather than a reported incident. The source is Boisvert et al., "Malice in Agentland: Down the Rabbit Hole of Backdoors in the AI Supply Chain" (arXiv 2510.05159, first submitted October 2025, version 5 dated August 2026). It describes three threat models: direct poisoning of fine-tuning data, pre-backdoored base models, and environment poisoning, which is the one AML.T0145 describes.

In the environment poisoning setting, the attacker controls only part of the environment where a strong "teacher" agent collects trajectories, such as a webpage, a tool output or a service endpoint. The authors give examples of hidden page elements that a human would not see but the agent parses, and a tool return value carrying an injected instruction. Poisoned trajectories that pass the pipeline's filters enter the "student" model's supervised fine-tuning data, and the student learns to perform the malicious action when the trigger reappears.

Benchmark	Poisoned share of collected data	Reported outcome
τ-Bench retail (tool use), Qwen 2.5 7B student	About 200 of 4,000 samples (5%)	Attack success of 100% with no defence and with both runtime guardrails tested, while task success also rose after fine-tuning
WebArena-Lite (web navigation), Llama 3.1 8B student	1,242 of 54,000 samples (2.3%)	Attack success described by the authors as near-perfect

The abstract states the headline result: poisoning a small number of demonstrations was enough to implant a backdoor that made an agent leak confidential user information with over 80% success. Two further findings matter for defenders. The poisoned students also improved at their real tasks, so ordinary performance metrics would not raise concern. And a student trained without poisoned data followed the same injection far less often, showing that the learning step itself amplified the attack.

Why ordinary controls miss it

Trusted source, untrusted content: trajectories come from your own agent, so provenance checks that only ask "who produced this data" pass them.
Screening sees samples in isolation: the researchers tested four guardrail models as data filters. The best detected 69.3% of poisoned WebArena samples but only 9.7% on τ-Bench, two detected none on WebArena, and the authors estimate enough poison would remain even after the strictest filter.
Runtime guardrails were not enough: guardrails applied to observations and actions during evaluation did not meaningfully reduce attack success. The authors conclude that such tools judge inputs and outputs without the context that makes an action malicious.
Removal is not remediation: deleting the poisoned webpage or fixing the tool does not undo what the model has already learned.

Mitigations

ATLAS maps six mitigations to AML.T0145, each with technique-specific guidance:

ATLAS mitigation	Guidance for this technique	Practical form
AML.M0007 Sanitize Training Data	Screen environmental content and resulting interaction data for poisoning before use in learning or adaptation; quarantine and remediate affected data	Hold collected trajectories in a staging area; scan tool outputs and page content, not only final actions
AML.M0025 Maintain AI Dataset Provenance	Record the sources of environmental content and interaction data so suspicious experience can be traced to its source	Store URL, tool name and version, response hash and timestamp with every trajectory step
AML.M0008 Validate AI Model	Evaluate after learning with clean data and targeted tests for backdoors, unsafe tool use and unexpected behaviour; compare to trusted baselines	A release gate between every learning cycle and deployment
AML.M0020 Generative AI Guardrails	Check outputs and proposed actions against policy at run time and block prohibited ones	Policy enforcement on high-impact tool calls (data egress, payments, credential use)
AML.M0022 Generative AI Model Alignment	Train to resist malicious instructions and unsafe tool use; re-evaluate alignment after learning	Alignment regression suite run on each new checkpoint
AML.M0035 AI Red Team	Introduce controlled manipulations into the learning environment to test for persistent behaviour change and verify detection	Planted canary triggers in a test environment, checked after training

Given the research results, treat AML.M0020 as a limiter of impact rather than a detector: it bounds what a backdoored agent can do, which is why tool permissions matter as much as filters.

Implementation steps

Map your learning loops. List every path by which agent interactions become training or persistent data: supervised fine-tuning on trajectories, reinforcement learning with rewards or automated evaluators, synthetic data generation, and long-term memory. If none exist, this technique does not apply yet; record that and revisit when one is added.
Control the collection environment. Prefer allow-listed sites, pinned tool versions and internal mirrors for trajectory collection. Content the organisation does not control should be marked as such in provenance.
Capture provenance at step level. Every observation should carry its source and a hash, so a later finding can be traced back and all affected trajectories removed.
Stage, screen and sample. Quarantine new trajectories, run automated screening on observations as well as actions, and have a human review a sample weighted towards external content and unusual actions.
Gate every checkpoint. Before deployment, run clean evaluation sets, backdoor and unsafe tool-use tests, and compare against the last trusted model. Block promotion on unexplained deviations.
Keep a rollback path. Retain the last known-good checkpoint and the exact data manifest used for each version, so you can retrain without the affected data.
Constrain what the agent can do regardless. Least-privilege tool scopes and runtime approval for sensitive actions limit the damage a learned backdoor can cause.

Detection and measurement

Useful signals include new or changed external sources appearing in collected trajectories, tool responses containing instruction-like text, actions in trajectories that send data to destinations outside an allow list, and behaviour differences between a new checkpoint and its baseline on the same clean tasks. In production, watch for tool calls by the agent that its role does not need, especially data egress.

Metric	What it shows
Share of training trajectories with step-level provenance	Whether a poisoning finding can be traced and cleaned
Share of learning cycles that passed a backdoor and unsafe tool-use evaluation before deployment	Coverage of AML.M0008; target 100%
Detection rate on planted canary poisons in red team runs	Real effectiveness of screening, measured on your pipeline
Time to roll back to a known-good checkpoint	Recovery readiness
Blocked high-impact agent actions per week	Runtime guardrail activity and possible learned misbehaviour

Where identity fits

The behaviour the research backdoor taught, leaking user information to a remote endpoint, is only harmful if the agent has the access and network path to do it. Agents should run as distinct non-human identities with narrow tool scopes, short-lived credentials and egress limits, so that a poisoned model meets the same access controls as any other workload. Separately, the identities that can write to collection environments, reward functions and evaluators are part of the training supply chain and need the same scrutiny as those that can write to datasets. See the Agentic AI Identity Guide.

Common failure patterns

Treating self-generated data as clean because it came from your own agent.
Screening only the final answer or action, not the observations and tool outputs that led to it.
Judging a new checkpoint on task success alone. In the research, poisoned models also got better at their tasks.
Automated evaluators and reward models with no integrity controls, although ATLAS names evaluator outputs and reward signals as targets.
No data manifest per model version, so a poisoning finding cannot be scoped or reversed.
Persistent memory written without review, which turns one manipulated interaction into lasting behaviour. See the AI Agent Memory Poisoning Guide.

Framework mapping

Framework	Reference	Relevance
MITRE ATLAS	AML.TA0006 Persistence; AML.M0007, M0008, M0020, M0022, M0025, M0035	Technique tactic and mapped mitigations
NIST SP 800-53 Rev 5	SI-7 Software, Firmware, and Information Integrity	Integrity of training data and model checkpoints
NIST SP 800-53 Rev 5	SI-10 Information Input Validation	Screening environmental content before learning
NIST SP 800-53 Rev 5	SA-11 Developer Testing and Evaluation	Validation gate after each learning cycle
NIST CSF 2.0	PR.DS-01; ID.IM-02	Protecting data at rest; improvements from tests and exercises

Practitioner checklist

List every loop where agent interactions become training data, reward signal or memory.
Record source, tool version and hash for every observation in collected trajectories.
Quarantine and screen new trajectories, including tool outputs and page content.
Protect reward functions and automated evaluators with change control.
Gate each new checkpoint on clean evaluation, backdoor tests and baseline comparison.
Keep the last known-good checkpoint and a data manifest per model version.
Limit agent tool scopes and egress so learned misbehaviour has little reach.
Red team the learning environment with planted canary poisons at least once per major pipeline change.

AML.T0145 Poison AI Agent Learning Environment: How the Technique Works Against AI Systems and How to Defend