MITRE ATLAS Guide: AI Attack Techniques Explained

Security teams are being asked to defend AI systems against attacks that ATT&CK was never designed to describe, such as poisoned training data, extracted models and hijacked agent tools. MITRE ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems) gives those attacks a shared vocabulary: tactics, techniques with stable AML IDs, mitigations and real case studies. This guide explains the matrix, the techniques that matter most, the link to ATT&CK, and how to use ATLAS for threat modelling, red teaming, detection and incident mapping. It is for security architects, threat intelligence analysts, red teamers and AI platform owners. IDs were checked against ATLAS data release 2026.09 (15 September 2026) and the release notes to 2026.08; ATLAS changes monthly, so confirm IDs before putting them in tooling.

Key takeaways

• ATLAS is ATT&CK for AI. It is modelled on ATT&CK and its techniques are complementary to ATT&CK's, so use both: ATT&CK for the surrounding IT estate, ATLAS for the model, data, prompts and agents.
• Sixteen tactics, over a hundred techniques. Release 2026.08 lists 16 tactics, 114 techniques, 83 sub-techniques, 39 mitigations and 72 case studies, tagged by platform: Predictive AI, Generative AI, Agentic AI or Enterprise.
• Names and IDs move. AML.TA0001 is now "AI Attack Adaptation" (formerly AI Attack Staging) and AML.T0019 and AML.T0058 were folded into AML.T0115 Publish Poisoned AI Artifacts in 2026. Pin the release you map against.
• Case studies are the fastest way in. Mapping a real incident such as EchoLeak or the Morris II worm to ATLAS steps shows which controls would have broken the chain.
• Identity techniques recur. Valid Accounts, Unsecured Credentials and agent tool credential harvesting appear across AI incidents, so AI threat models must include the API keys, tokens and service accounts that AI systems run on.

What MITRE ATLAS is and how it is structured

MITRE describes ATLAS as "a globally accessible, living knowledge base of adversary tactics and techniques" built from real-world observations and AI red team demonstrations. It grew out of the Adversarial ML Threat Matrix that MITRE and Microsoft published with industry partners in 2020. MITRE's stated uses include threat assessments, internal red teaming and reporting real-world attacks on AI systems.

• Tactics (AML.TA00xx): the adversary's goal at a stage of the attack, such as Reconnaissance or Exfiltration. Most mirror ATT&CK tactics; two are AI specific: AI Model Access (AML.TA0000) and AI Attack Adaptation (AML.TA0001).
• Techniques and sub-techniques (AML.T00xx and AML.T00xx.00x): how the goal is achieved. A technique can sit under more than one tactic: Evade AI Model (AML.T0015) appears under Initial Access, Defense Evasion and Impact.
• Maturity: each technique carries a maturity value. Training Data Poisoning (AML.T0020) is marked "Realized" (seen in the wild); Poison AI Model (AML.T0018.000) is "Demonstrated" (shown in research or red team work).
• Platforms: since release 2026.05 every technique carries one or more platform tags, the quickest way to scope the matrix to your systems.
• Mitigations (AML.M00xx) and case studies (AML.CS00xx): mitigations link to the techniques they address; case studies are incidents, exercises or research written as a sequence of technique steps.

The data is on GitHub in mitre-atlas/atlas-data. Use dist/ATLAS-latest.yaml; dist/ATLAS.yaml is deprecated and stopped at format 5.6.0 (content release 2026.04). Content releases are now numbered YYYY.MM and the data format separately (currently 6.0.0), with dist/manifest.yaml mapping the two.

ATLAS tactics reference

The 16 tactics below are from release 2026.09. Read them as an AI kill chain: an attacker researches the target, builds or adapts capability, gains access to the model or the system around it, then achieves an AI-specific effect.

Tactic placements for techniques numbered above AML.T0043 come from the 2026.04 data (format 5.6.0), the last release whose tactic assignments we could read for those techniques. Names below follow the later release notes; check the current release for any reassignment.

Selected techniques by AI platform

These techniques cover most of what practitioners meet, grouped by the kind of system they target.

Predictive AI (classifiers, detectors, recommenders)

• AML.T0043 Craft Adversarial Data: inputs built to make a model err. Sub-techniques: .000 White-Box Optimization (attacker has the weights and gradients), .001 Black-Box Optimization (only queries), .002 Black-Box Transfer (attack built on a proxy and transferred), .003 Manual Modification.
• AML.T0005 Create Proxy AI Model: train a stand-in from gathered artefacts (.000), by replicating the target through queries (.001) or from a pre-trained model (.002), so attacks can be developed offline before AML.T0042 Verify Attack.
• AML.T0015 Evade AI Model: adversarial data that makes a malware, fraud or content classifier miss the input (Predictive AI, "Realized").
• AML.T0024 Exfiltration via AI Inference API: .000 Infer Training Data Membership, .001 Invert AI Model, .002 Extract AI Model.
• AML.T0031 Erode AI Model Integrity and AML.T0046 Spamming AI System with Chaff Data: degrade performance over time, or flood a system with junk inputs so analysts waste effort on false alerts.

Generative AI and RAG

• AML.T0051 LLM Prompt Injection: .000 Direct and .001 Indirect. See the Prompt Injection Guide.
• AML.T0054 LLM Jailbreak, AML.T0056 Extract LLM System Prompt, AML.T0057 LLM Data Leakage: covered in depth in the LLM Security Guide.
• AML.T0070 RAG Poisoning and AML.T0071 False RAG Entry Injection: plant content in the sources a retrieval system indexes, after AML.T0064 Gather RAG-Indexed Targets and AML.T0066 Retrieval Content Crafting.
• AML.T0060 Publish Hallucinated Entities: register a package, domain or account that models are known to hallucinate, so users or agents that follow the model's suggestion reach attacker content.
• AML.T0061 LLM Prompt Self-Replication: a prompt that makes the model reproduce it in output, so it spreads between systems. The Morris II worm case study (AML.CS0024, "Morris II Worm: RAG-Based Attack") is the reference example.

Agentic AI

• AML.T0053 AI Agent Tool Invocation: make an agent call tools it can reach, listed under Execution and Privilege Escalation.
• AML.T0086 Exfiltration via AI Agent Tool Invocation and AML.T0101 Data Destruction via AI Agent Tool Invocation: the agent's own tools become the exfiltration or wiper channel.
• AML.T0081 Modify AI Agent Configuration and AML.T0099 AI Agent Tool Data Poisoning: change what the agent is told or what its tools return.
• AML.T0110 AI Agent Tool Poisoning (.000 Definition and Instructions, .001 Implementation, .002 Runtime Response) and AML.T0010.005 AI Agent Tool supply chain compromise, which cover malicious MCP servers and agent skills.
• AML.T0034.002 Agentic Resource Consumption: drive an agent into costly loops, alongside .000 Excessive Queries and .001 Resource-Intensive Queries.
• AML.T0105 Escape to Host, AML.T0107 Exploitation for Defense Evasion and the 2026.08 autonomous techniques (AML.T0116 Autonomous Reconnaissance, AML.T0124 Autonomous Attack Orchestration) treat agents as both target and weapon.

For the data and model supply chain techniques (AML.T0020, AML.T0018, AML.T0115) see the AI Supply Chain and AI-BOM Guide.

ATLAS and ATT&CK: how they fit together

ATLAS reuses ATT&CK's structure and many techniques carry an ATT&CK reference in the data. The ATLAS Navigator is a fork of the ATT&CK Navigator, and since 2026.07 each release ships stix-atlas-attack-enterprise.json, combining ATLAS and ATT&CK Enterprise in one STIX 2.1 bundle: the easiest way to load both into a threat intelligence platform or coverage tool.

When to use which: if the attacker never touches model behaviour, ATT&CK alone is enough. If the attack works through the model, its data or its agent tools, add ATLAS. Most real AI incidents need both, because the first steps are ordinary intrusion. For the ATT&CK side, see the Threat Intelligence Guide.

Case studies and mapping AI incidents to ATLAS

ATLAS case studies record each incident as ordered technique steps, and the release artefacts include a Navigator layer per case study. Several match incidents NHI Mgmt Group has analysed:

To map your own incident or red team finding:

1. Write the timeline as discrete attacker actions with evidence for each, then tag conventional steps with ATT&CK IDs and AI-specific steps with the most specific ATLAS sub-technique you can support.
2. Record the tactic each step served, not just the technique, because the same technique (AML.T0053) can be execution in one incident and privilege escalation in another.
3. Note the ATLAS release you used, since names change between releases.
4. For each step, list the control that should have stopped or detected it, and whether it did. The gaps become the remediation plan.
5. Build a Navigator layer of the steps and compare it with layers for similar ATLAS case studies to spot techniques you did not consider.

ATLAS mitigations

Release 2026.07 renamed many mitigations to separate predictive from generative controls and added AML.M0035 AI Red Team; 2026.08 added agent scope controls. These are the ones most organisations can act on.

Guardrail products sit mainly in M0020; see the AI Guardrails and AI Firewalls Guide for what they can and cannot stop.

Using ATLAS for threat modelling and red teaming

ATLAS is a catalogue, not a method. Pair it with a modelling method (STRIDE, attack trees or the approach in the AI Agent Threat Modelling Guide) and use it to make sure nothing AI-specific is missed.

1. Scope by platform: tag each AI system Predictive, Generative or Agentic and filter the matrix accordingly.
2. Draw the data flows: training data sources, model registry, inference endpoint, retrieval stores, agent tools and the credentials each component holds.
3. Walk the tactics left to right: for each flow, ask which techniques apply, starting with Reconnaissance (what do your model cards and papers reveal?) and AI Model Access (who can query or download weights?).
4. Rank by maturity and exposure: "Realized" techniques against internet-facing systems come first; "Demonstrated" techniques against internal systems come later.
5. Assign mitigations and owners from the AML.M list and your existing controls, and record residual risk.
6. Turn the model into red team objectives: each high-ranked path becomes a test case with a named ATLAS chain, run first in a non-production copy. MITRE's Arsenal and Almanac plugins add ATLAS techniques to the CALDERA emulation platform. See Red Teaming AI Agents for Identity Abuse.
7. Re-run on change (new model, tool, data source or ATLAS release), keeping the previous version so a wrong mapping can be rolled back.

Organisations consuming AI through SaaS should focus on Initial Access, Credential Access, prompt injection and Exfiltration, and rely on provider assurance for model internals. Organisations that train or fine-tune need the Resource Development, AI Attack Adaptation and Persistence columns too, because poisoning becomes their problem.

Where identity fits

Many ATLAS chains start or end with credentials rather than model attacks. AML.T0012 Valid Accounts, AML.T0055 Unsecured Credentials and AML.T0098 AI Agent Tool Credential Harvesting cover stolen API keys, leaked inference tokens and secrets lifted from agent tool configurations. In LLMjacking the root cause is an exposed key. Treat model API keys, hub tokens and agent service accounts as non-human identities with owners, scopes and rotation. See the LLMjacking Guide and the Agentic AI Security Guide.

Detection and measurement

• Inference telemetry: per-identity query volume, input size, near-duplicate queries and log probability requests, which signal AML.T0024 extraction or AML.T0034 cost harvesting.
• Prompt and tool logs: full prompts, retrieved chunks, tool calls and tool responses for generative and agentic systems, so AML.T0051, AML.T0070 and AML.T0053 chains can be reconstructed.
• Artefact events: model and dataset downloads, uploads to registries, signature verification failures and new external models entering pipelines.
• Tagging: put ATLAS IDs in detection rule metadata, as you already do with ATT&CK, so coverage can be measured.

For SOC integration, see the AI SOC Guide.

Framework mapping

Common failure patterns

• Treating ATLAS as a checklist: ticking techniques without data flows gives a long list and no priorities.
• Mapping to stale IDs: rules tagged AML.T0019 or "AI Attack Staging" no longer match current names. Record the release and review mappings when MITRE publishes.
• Ignoring the conventional steps: in the Azure OpenAI abuse by Storm-2139 the guardrail bypass came after stolen customer API keys. Model the identity path, not just the model.
• Red teaming only the prompt: the 2026 case studies concentrate on agent tools, retrieval stores and model supply chains.
• No telemetry to map against: without prompt, retrieval and tool logs, incidents cannot be mapped and the threat model never improves.

Practitioner checklist

• Inventory AI systems and tag each as Predictive, Generative or Agentic AI.
• Pull ATLAS from dist/ATLAS-latest.yaml or the combined STIX bundle and record the release used.
• Build an ATLAS-based threat model for every internet-facing or agentic AI system.
• Add ATLAS IDs to detection rule metadata alongside ATT&CK IDs and measure coverage.
• Log prompts, retrieved content, tool calls and inference volumes per identity.
• Map each AI incident and red team finding to ATLAS steps within 10 working days.
• Assign AML.M mitigations with named owners, prioritising Realized techniques.
• Treat model API keys, hub tokens and agent credentials as managed NHIs.
• Review mappings at each ATLAS release, at least quarterly.

Standards and references

• MITRE: ATLAS Data repository
• MITRE: ATLAS Data release notes
• MITRE: ATLAS Fact Sheet
• MITRE ATT&CK: T1195 Supply Chain Compromise
• NIST: AI 100-2 E2025 Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations
• OWASP: LLM04:2025 Data and Model Poisoning
• MITRE: ATLAS Navigator Data

Related NHI Mgmt Group resources: LLM Security Guide · Prompt Injection Guide · AI Agent Threat Modelling Guide · Red Teaming AI Agents for Identity Abuse · AI Guardrails and AI Firewalls Guide