ATLAS Impact Tactic (AML.TA0011) Guide: Denial, Erosion and Manipulation of AI Systems

The Impact tactic is where an attack on an AI system turns into a loss someone can measure: a fraud payout, a deleted file system, a model that quietly gives wrong answers, or an inference bill the victim did not run up. MITRE ATLAS defines Impact, AML.TA0011, as the adversary "trying to manipulate, interrupt, erode confidence in, or destroy your AI systems and data", and notes that business processes can look fine while having been altered to benefit the adversary. This hub covers all ten techniques and ten sub-techniques in ATLAS 2026.10, how they appear in the ATLAS case studies, which ones defenders should handle first, and the detection and mitigation priorities across the tactic. It is for AI security leads, platform owners, fraud and detection teams. Each technique has its own guide; this page links them and does not repeat them. For the framework overview, see the MITRE ATLAS Guide.

Key takeaways

• Most recorded impact is harm to people and money. Of 70 Impact steps in ATLAS case studies, 44 use AML.T0048 External Harms or its sub-techniques, led by User Harm (16 steps) and Financial Harm (11).
• Integrity attacks are quiet. Evade AI Model (AML.T0015, 8 steps) and Erode AI Model Integrity (AML.T0031, 6 steps) leave systems running while their decisions become unreliable, so availability monitoring alone will not catch them.
• Agents add destructive impact. AML.T0101 Data Destruction via AI Agent Tool Invocation and AML.T0112 Machine Compromise describe agents deleting files, calendar data or whole file systems with the victim's own access.
• Exfiltration often comes first. In the case study step graphs, 11 of the step links that lead into an Impact step come from Exfiltration steps, which is how stolen data, keys and models become financial or intellectual property harm.
• Cost is an attack surface. Cost Harvesting (AML.T0034) and its agentic sub-technique turn compute and token budgets into the target; quotas and spend limits are security controls, not just finance controls.

What the Impact tactic means for AI systems

ATLAS splits AI impact into four kinds of outcome. Availability: the AI service is slowed, flooded or made too expensive to run. Integrity: the model or its data is corrupted so that its outputs can no longer be trusted, sometimes for one trigger input, sometimes for everyone. Direct harm: money, privacy, safety, reputation or intellectual property is lost, recorded through the External Harms sub-techniques. Host and data damage: an agent or AI artifact is used to destroy data or take over the machine it runs on.

The tactic description also says impact techniques may be used "to provide cover for a confidentiality breach". A noisy denial of service or a visibly misbehaving assistant can draw responders away from quieter collection and exfiltration in the same intrusion, so impact alerts should prompt a check of the full session, not just a restore.

Every technique in the tactic

Maturity is the ATLAS rating (Feasible, Demonstrated or Realized). Case study steps are counted from the ATLAS 2026.10 data file: each procedure step tagged with tactic AML.TA0011 and that technique or sub-technique. Sub-techniques are covered in their parent technique's guide.

A zero count does not mean low risk: Cost Harvesting has no case study step tagged under it, yet the LLMjacking case study (AML.CS0030) records the same cost outcome as Financial Harm. Related techniques sit in other tactics with their own guides, notably AML.T0020 Training Data Poisoning and AML.T0018 Manipulate AI Model, which prepare integrity impact.

How adversaries reach Impact

Counting the step links that lead directly into an Impact step across ATLAS 2026.10 case studies gives: Exfiltration 11, AI Attack Adaptation 8, Resource Development 8, AI Model Access 8, Initial Access 7, Execution 6, Privilege Escalation 6, Impact 5, Defense Evasion 5, Persistence 3, Command and Control 2, Credential Access 1 and Lateral Movement 1. The spread is wide because impact is the end of very different attacks. Four chains stand out.

Chain 1: adaptation, model access, evasion

The classic adversarial machine learning chain: build or obtain a proxy model, craft adversarial inputs offline, then evade the production model. ATLAS records this against a phishing email scorer (AML.CS0008 ProofPoint Evasion), Microsoft Edge AI (AML.CS0011) and face identification (AML.CS0012). The impact is that a detector or gate stops working for the adversary's inputs while appearing healthy.

Chain 2: stolen access, financial harm

Stolen credentials or keys are converted into money. In LLMjacking (AML.CS0030) stolen cloud credentials were used to run large language model workloads at the victim's expense; see the LLMjacking breach analysis, which cites Sysdig estimates of over $46,000 per day for one model family. In Bypassing ID.me Identity Verification (AML.CS0017) the case study records at least $3.4 million in fraudulent unemployment claims, and deepfake KYC case studies (AML.CS0033, AML.CS0034) follow the same path to account fraud.

Chain 3: injection, agent tools, destruction or hijack

Prompt injection reaches an agent with powerful tools, which then deletes data or runs attacker commands. AML.CS0046 records Claude Computer Use deleting a file system after indirect prompt injection; AML.CS0047 records code to deploy a destructive agent found in the Amazon Q VS Code extension; AML.CS0063 records Gemini deleting a calendar event. See the Amazon Q Developer extension breach analysis: an over-scoped build token let an attacker ship a prompt telling the agent to delete file system and cloud resources, and AWS reports the code failed to execute.

Chain 4: extraction, intellectual property theft

Model outputs gathered through inference APIs are used to train competing models. Three case studies (AML.CS0056, AML.CS0075, AML.CS0076) record distillation campaigns ending in AML.T0048.004 AI Intellectual Property Theft, and AML.CS0058 records model files recovered from a mobile application. See the Model Extraction and Distillation Defence Guide.

Where to start: ranked techniques for defenders

1. AML.T0101 Data Destruction via AI Agent Tool Invocation and AML.T0112 Machine Compromise: if you run coding, computer use or workflow agents, these are the highest severity outcomes and the controls (tool scope, sandboxing, approvals) are within your control today.
2. AML.T0048.000 Financial Harm through stolen AI access, with AML.T0034 Cost Harvesting: spend limits and key hygiene stop the most common realised loss. See the Denial-of-Wallet and AI Agent Cost Runaway Guide.
3. AML.T0015 Evade AI Model: priority wherever a model makes a security or fraud decision (malware, phishing, identity verification).
4. AML.T0031 Erode AI Model Integrity and AML.T0059 Erode Dataset Integrity: priority for organisations that train or fine tune, and for anyone who ingests public datasets.
5. AML.T0130 AI Agent Response Biasing and AML.T0048.003 User Harm: priority for assistants with memory or that recommend products, links or actions to users.
6. AML.T0029 Denial of AI Service and AML.T0046 Spamming AI System with Chaff Data: handled mostly by existing rate limiting and capacity controls, extended to AI endpoints.

Detection priorities across the tactic

Metrics that show it is working

• Spend guardrail coverage: share of AI provider accounts and keys with hard spend limits and alerts.
• Destructive tool gating: percentage of agent tools that can delete or modify data which require approval or run in a sandbox with no production access.
• Integrity evaluation cadence: share of production models evaluated against a fixed canary set at least weekly.
• Dataset provenance: percentage of training and fine tuning datasets with recorded hashes and source.
• Time to revoke: median time from a spend or usage anomaly to the key being revoked.

Mitigation priorities

ATLAS 2026.10 maps 23 mitigations to techniques in this tactic. The most widely mapped are AML.M0035 AI Red Team (six techniques and sub-techniques), AML.M0036 Limit AI Workload Resource Consumption (four), and AML.M0004, AML.M0015 and AML.M0019 (three each). The MITRE ATLAS Mitigations Guide explains each.

Phased rollout

1. Set hard spend limits: enable budgets and alerts on every AI provider account and key, and remove unused model access. See the LLMjacking Guide.
2. Gate destructive tools: list agent tools that delete, overwrite or execute; move them behind approval or into sandboxes; keep backups of anything agents can write. See the AI Agent Sandboxing and Code Execution Guide.
3. Build integrity baselines: create fixed evaluation and canary sets for each production model and record dataset hashes.
4. Monitor in alert mode, then enforce: run spend, drift and destructive action analytics in alert mode first, then add automatic key suspension and agent kill switches. See the AI Agent Kill Switch and Containment Guide.
5. Plan rollback: keep the previous model version and dataset snapshot deployable so an integrity incident can be reverted quickly.
6. Red team the outcomes: test evasion, cost runaway and destructive agent scenarios at least once per release cycle.

Decision guidance

• Approval versus sandbox for destructive actions: approvals suit infrequent, high value actions; sandboxes with no production credentials suit coding and computer use agents that run many commands.
• Model consumers: focus on cost, key hygiene, agent tool scope and user harm; integrity of a hosted model is largely the provider's responsibility, but your evaluation set still detects change.
• Model builders: add dataset provenance, model hardening and artifact protection, and treat evaluation drift as a security signal.
• Small teams: spend limits, removal of unused tools and a weekly canary evaluation give most of the benefit with little tooling.

Where identity fits

Several impact chains run on non-human identities: stolen AI provider keys in LLMjacking, an over-scoped CI token in the Amazon Q case, and agent identities holding delete rights. Give each agent its own identity with the narrowest rights, separate keys per application so one can be revoked without an outage, and put spend limits on the identity, not just the account. See the Agent Identity and Access Guide.

Common failure patterns

• Watching availability only: evasion and integrity erosion keep services up; without fixed evaluation sets they go unnoticed.
• Billing alerts as the only cost control: alerts arrive after the money is spent; hard limits and per key quotas stop it.
• Agents with production delete rights: a coding or computer use agent running as the developer can destroy what the developer can.
• Treating impact as the whole incident: the tactic description warns that impact can cover a confidentiality breach; check for earlier collection and exfiltration.
• Unverified public datasets: re-downloading a dataset by URL without hashes lets content change underneath you, as the split-view poisoning case study (AML.CS0025) shows.

Framework mapping

Practitioner checklist

• Every AI provider account and key has hard spend limits, alerts and an owner.
• Agents have step, token and time limits per task.
• Agent tools that delete, overwrite or execute require approval or run in a sandbox without production credentials.
• Production models are evaluated against fixed canary sets on a schedule, with drift treated as a security signal.
• Training datasets have recorded hashes and provenance; downloads are verified.
• Models used for security or fraud decisions are tested for evasion before release.
• Previous model versions and datasets can be redeployed quickly.
• Impact alerts trigger a review of the whole session for earlier collection and exfiltration.

Standards and references

• MITRE ATLAS: Impact (AML.TA0011)
• MITRE ATLAS: atlas-data repository (techniques, mitigations and case studies)
• MITRE ATLAS: LLMjacking case study (AML.CS0030)
• MITRE ATLAS: Amazon Q VS Code extension case study (AML.CS0047)
• MITRE ATT&CK: Impact (TA0040)
• OWASP: Top 10 for LLM Applications 2025
• NIST: SP 800-53 Rev. 5 Security and Privacy Controls

Related NHI Mgmt Group resources: MITRE ATLAS Guide, Denial-of-Wallet and AI Agent Cost Runaway Guide, Model Extraction and Distillation Defence Guide, AI Agent Kill Switch and Containment Guide.