ATLAS Initial Access Tactic: How Attackers Get Into AI Systems and How to Stop Them

Every attack on an AI system needs a way in, and in AI estates that way in is as likely to be a model download, an MCP server or a poisoned email as a vulnerable web server. MITRE ATLAS defines the Initial Access tactic (AML.TA0004) as the adversary "trying to gain access to the AI system", using entry vectors to gain a first foothold on a network, mobile device or edge device whose AI capability may be local or cloud-hosted. This hub covers all 10 techniques and 8 sub-techniques under the tactic in ATLAS 2026.10, ranks where defenders should start, and shows how the tactic chains into execution and persistence in real cases. It is written for AI platform owners, detection engineers and security architects. Each technique has its own deep guide; this page links them rather than repeating them. For the framework itself, see the MITRE ATLAS Guide.

Key takeaways

• Initial Access is the most used ATLAS tactic in case studies. 61 of the 77 ATLAS case studies (24 incidents, 37 exercises) contain at least one Initial Access step, counted from the ATLAS 2026.10 data.
• The supply chain is the biggest single door. AML.T0010 Supply Chain Compromise appears in 20 case studies, ahead of AML.T0093 Prompt Infiltration via Public-Facing Application (15) and AML.T0012 Valid Accounts (14).
• Two families matter most: artefacts you pull in (models, packages, datasets, containers, agent tools) and content your AI reads (emails, documents, tickets, web pages, crafted links). Classic web exploitation and stolen keys complete the picture.
• Many entry points are identities. Stolen cloud keys, Hugging Face tokens and LLM API keys give legitimate-looking access, so non-human identity hygiene is an Initial Access control.
• Detection sits upstream. Most AI initial access leaves no alert at the moment of entry; provenance checks, inventory and ingestion-time content inspection are where defenders win.

What Initial Access means for AI systems

In ATT&CK, Initial Access is usually a network event: an exploited server or a phished user. ATLAS keeps those techniques but adds entry vectors that only exist because AI systems consume external artefacts and external text. A model file is executable content when it is deserialised. A shared document becomes an instruction channel the moment a copilot retrieves it. An agent skill installed from a registry becomes part of the agent's trusted toolset. The adversary often never touches your network: they publish something and wait for your pipeline, user or agent to fetch it.

That changes the defender's question from "who connected to us?" to "what did we ingest, from where, and what was it allowed to do?" ATLAS reflects this: the mitigations mapped most often across this tactic are AML.M0042 Threat Intelligence Program (9 technique and sub-technique links), AML.M0035 AI Red Team (6), AML.M0023 Maintain an AI Bill of Materials (6) and AML.M0014 Verify AI Artifacts (5). See the MITRE ATLAS Mitigations Guide.

Every Initial Access technique in ATLAS 2026.10

Counts are the number of distinct ATLAS case studies that record the technique (or one of its sub-techniques) as an Initial Access step. Maturity is the ATLAS rating: Feasible, Demonstrated or Realized (seen in real use).

Several techniques sit in more than one tactic. AML.T0093 is also Persistence, because a planted prompt keeps working; AML.T0012 is also Privilege Escalation and Lateral Movement; AML.T0015 is also Defense Evasion and Impact; AML.T0052 is also Lateral Movement. See the ATLAS Persistence Tactic hub for the persistence view.

Where to start: ranked techniques for defenders

The ranking combines how often ATLAS records the technique in case studies, its maturity, and how much of a typical enterprise AI estate it touches.

1. AML.T0010 Supply Chain Compromise, especially Model Repository and AI Agent Tool. Model hubs and agent tool registries are open publishing platforms. ATLAS records malicious pickle models on Hugging Face that executed reverse shells and evaded the hub's scanner (AML.CS0031), a reclaimed deleted namespace serving a malicious model under the old trusted name (AML.CS0065), and the npm package postmark-mcp, which added a hidden BCC address to every email sent through the tool from version 1.0.16 (AML.CS0053). Start with an allowlist of sources, pinning by digest or commit, and an AI bill of materials. See the Model Supply Chain Guide and the AI Supply Chain and AI-BOM Guide.
2. AML.T0093 Prompt Infiltration via Public-Facing Application. Any channel an outsider can write to, and your AI later reads, is an entry point: inboxes, shared documents, support tickets, calendar invites, code comments. In EchoLeak (CVE-2025-32711) a single business-style email retrieved by Microsoft 365 Copilot was enough to start a zero-click exfiltration chain. Treat every such channel as untrusted input to the model. See the RAG Security Guide.
3. AML.T0012 Valid Accounts. Cloud keys and AI service API keys are the commonest identity-based entry. In the LLMjacking campaigns documented by Sysdig, attackers exploited a Laravel server (CVE-2021-3129), found cloud credentials on it, then used them to reach hosted LLMs and resell access through reverse proxies (AML.CS0030). See the LLMjacking Guide.
4. AML.T0049 and AML.T0132, exposed AI infrastructure. ShadowRay (AML.CS0023) showed Ray clusters whose Jobs API allows remote execution without authentication being exploited on the internet, with SSH keys, OpenAI, Hugging Face and Stripe tokens collected from the clusters. See the Ray and AI Compute Cluster Security Guide.
5. AML.T0078, AML.T0131 and AML.T0052, content aimed at users and agents. Web pages fetched by agents, pre-filled assistant links and LLM-written phishing share one control set: treat external content as data, never as instructions, and train users on assistant links as well as email.
6. AML.T0119 and AML.T0015, specialist cases. Prioritise AML.T0119 if you run a platform that processes uploaded models or datasets automatically, and AML.T0015 if an AI model is itself a security gate (malware detection, identity verification, fraud scoring).

How Initial Access chains into the rest of an attack

ATLAS case studies record each step with its tactic, so the chains can be read directly. Three patterns recur.

The Amazon Q case shows how short the poisoned-artefact chain can be. An inappropriately scoped GitHub token in a build configuration let an outsider commit to the extension repository; version 1.84.0 shipped a prompt telling the bundled agent to wipe files and cloud resources. AWS said a syntax error prevented execution; by 25 July 2025 it had withdrawn 1.84.0 and released 1.85.0 (AML.CS0047). See the Amazon Q Developer Extension Compromise. The 2026 OpenAI and Hugging Face incident shows the stolen-access pattern run by autonomous agents: exposed Hugging Face user tokens were validated and used (AML.T0012), and malicious dataset configurations were submitted to the automated processing pipeline (AML.T0119) to obtain code execution in production pods.

Detection priorities across the tactic

Initial access into AI systems is often silent at the moment it happens, so detection relies on recording what enters and alerting on what it does next.

AML.M0024 AI Telemetry Logging and Monitoring is the foundation for the content-based signals: if prompts, retrieved context and tool calls are not logged, prompt infiltration cannot be investigated after the fact. See the AI Agent Security Testing Checklist for test cases.

Metrics that show coverage

• Provenance coverage: percentage of production models, datasets and agent tools with an AI-BOM entry, a pinned digest and a recorded source.
• Exposure count: number of internet-reachable AI runtimes, notebooks and agent control panels without authentication, trending to zero.
• Key hygiene: share of AI service API keys with an owner, a spend limit and a rotation date; median key age.
• Untrusted channel inventory: number of external write channels (inboxes, shared drives, ticket queues, web retrieval) feeding each copilot or agent, each with an assigned control.
• Technique coverage: number of the 10 Initial Access techniques with at least one tested detection or preventive control, refreshed each ATLAS release.

Mitigation priorities

ATLAS maps mitigations to techniques; the table groups those mappings by what you build.

ATLAS lists no mitigation for AML.T0131 Crafted AI Assistant Links in this release; user training on assistant links and restricting what assistants may write to memory (see the Persistence hub) are the practical controls.

Implementation order

1. Inventory: list every model, dataset, container, MCP server and agent skill in use, with its source and the identity that pulls it. See the MCP Server Inventory Template.
2. Close exposure: scan for internet-reachable AI runtimes and agent control panels; put each behind authentication.
3. Pin and verify in audit mode: route artefact downloads through a proxy that logs source and digest; report unpinned or unapproved pulls for 30 days before blocking.
4. Enforce in rings: block unapproved sources first in production pipelines, then on developer machines, with a documented exception route.
5. Treat external content as untrusted: mark retrieval sources by trust level and restrict tool use when untrusted content is in context.
6. Rotate and scope keys: owners, spend limits and short lifetimes for AI service keys.
7. Roll back safely: keep the previous pinned versions of models and tools available so a poisoned update can be reverted in one change, and test that rollback before you need it.

Where identity fits

Three of the most frequent entry paths are identity events: AML.T0012 is credential use, AML.T0010.005 often arrives through a developer's own registry token, and the Amazon Q compromise started from an over-scoped GitHub token in a build configuration. AI estates add new non-human identities (model registry tokens, Hugging Face write tokens, LLM provider keys, MCP server credentials) that rarely have owners or expiry dates. Inventory them, scope them to one purpose, and alert on first use from a new location. See the guide to finding LLM API keys in code and CI and the MCP Static Token Audit.

Framework mapping

Common failure patterns

• Trusting the hub's scanner: AML.CS0031 records malicious models that passed the model hub's pickle scanning because the files were deliberately corrupted. Verify and load safely yourself.
• Unpinned references: loading author/model by name lets a reclaimed namespace or a rug-pull update (see AML.T0109 AI Supply Chain Rug Pull) replace what you tested.
• Counting only network entry points: threat models that list firewalls and VPNs but not the inboxes and shared drives your copilot reads miss AML.T0093 entirely.
• Ownerless AI keys: provider API keys created for a pilot and never rotated become the LLMjacking entry point.
• Exposed by default: AI compute frameworks and agent dashboards deployed for convenience on all interfaces, with no authentication in front of them.

Practitioner checklist

• Maintain an AI-BOM covering models, datasets, containers, MCP servers and agent skills, with source and digest.
• Allow downloads only from approved sources, pinned by digest or commit, through a logging proxy.
• Load models with safe formats and scan before load; never deserialise untrusted pickle files on production hosts.
• Scan the external attack surface for AI runtimes, notebooks and agent control panels monthly.
• Give every AI service key an owner, a spend limit and an expiry; alert on use from new networks.
• List every external channel each copilot or agent reads, and restrict tool use when that content is in context.
• Log prompts, retrieved context and tool calls centrally (AML.M0024).
• Red team the tactic each ATLAS release, starting with AML.T0010.005 and AML.T0093.

Standards and references

• MITRE ATLAS: Initial Access (AML.TA0004)
• MITRE ATLAS: Supply Chain Compromise (AML.T0010)
• MITRE ATLAS: Prompt Infiltration via Public-Facing Application (AML.T0093)
• MITRE ATLAS: Valid Accounts (AML.T0012)
• MITRE ATLAS: Mitigations
• MITRE ATLAS: atlas-data repository
• OWASP: Top 10 for LLM Applications 2025
• MITRE ATT&CK: Initial Access (TA0001)

Related NHI Mgmt Group resources: MITRE ATLAS Guide · ATLAS Execution Tactic · Model Supply Chain Guide · Prompt Injection Guide · MITRE ATLAS Mitigations Guide